From c2a23466cac3c148ecb8a4a30616bcfaf4c39b28 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 27 Aug 2026 10:39:38 +0200
Subject: [PATCH 01/55] feat(services): add Executor one-click deployment
 template (#11530)

---
 public/svgs/executor.png                   | Bin 0 -> 176782 bytes
 templates/compose/executor.yaml            |  35 +++++++++++++++
 templates/service-templates-latest.json    |  18 ++++++++
 templates/service-templates.json           |  18 ++++++++
 tests/Unit/ExecutorServiceTemplateTest.php |  49 +++++++++++++++++++++
 5 files changed, 120 insertions(+)
 create mode 100644 public/svgs/executor.png
 create mode 100644 templates/compose/executor.yaml
 create mode 100644 tests/Unit/ExecutorServiceTemplateTest.php

diff --git a/public/svgs/executor.png b/public/svgs/executor.png
new file mode 100644
index 0000000000000000000000000000000000000000..a7cc57de9f1992625720221a1004d4d023fcc5b4
GIT binary patch
literal 176782
zcmeFaXIPWj_C5>*f=F>9qaam5u>&eikfNd}D4^1m7DWY-DpI6putX71Q9+TS!T<@9
zAVUiRQ7JZxVklA)0YyRyEp(Fq4mCi+c|W`#e_v*D=DMC|uf5j2?sc!V_rtkuY^W!=
zQfws$2Z!L%Bf2L!I97n4D>zm_!M|Q7S1W>laeAE8JHU}%A<@CXv7Y0o?tT*=&aNiD
z|B~$YCv@hNemN^(x1yQ{vgMPL=(~MLnLXiF;(x>5LjOL|u<lSnu-o$z=s!PJ9G5+^
z9VxidO4std!^OXzY}m-jwehdrHCHLLHyY`GZAYIpwXgG|SDr?jJ<uoY9S<6c`950I
zp&-q@;;;2O!5o}i|M%nnobZ20_`fXpzbyFwEeo)LT&ih3{!gTnO`>R`+Cd#e%&@J(
zc$WOQuMm}DbVhr3{FDFXZi#1jK7um_zMA%pZ=kQ%&umqyl=-ASb%OjWlQ=#`rl&TW
z2BeJXQuD}Z<Sz0vvN&OsaDz}n*hENo9PaYyenPLa43i!o8fc}zsu?Sz6;_Po8Q7MM
zbow~ADu+wAQp0NlPI&I8mXkXPwI~I1dz1K7Ewh3m-^wqY5Q4V3^s8p;Nl)s7`i22<
zLaV*@Fn;s}G9PRx_bRNo8+BQ-(Xzu_czK`Uck@e_H#uqxkJud;ZO-KTqgO6Ria(=?
z8Ot0!KN+1sYjfI7|1!!wbZy{v_pXncas>*pNZZb%-tm+>BD<|{Bk&z6qWprTG9ejm
zE!znlgd!8VAB|S<uWwHmQ8UB0s;k|w;7iBKsJM%6Wn|oEiR@a#WosJZ!dkT#xcXmm
z0~D18Yq}=E4rTwvyD36)SUPU9u^o-6@O~K)OSS8-YnxnS^cpk9b^WuvjOgYycX_y5
zul{3HDYELW@Curnm)QI2-~0!Alx@}AI#MC6n4Glm)4%D+H(txv)3hl3WAfpFqmvmL
z<LQJ+`+S_V<z$7^J1T*ofi^0S_#&<MIYN?Tx0x1QWlcSLxi)8%(r2Nxdu_zsLy*=C
zXzO`o#FsMx2A)5<l>Uj2pB#`y`C0WOB4SJ$YC5$g;-i*_mH1Y-NpgOB<cn6(p<5N+
z=JXTP;Q_m$GFVTm+OUCldrWWh1fMJA?eijDyAz)*p6y<ndRG`)dJeJ5%rzzM)MT;K
z{?8Cp--<gKq+f=ahqzmdg#U+-sQVisjB2Rx?vA+qWxU+GOWRND>s~Ltpi3(CK{Wq!
zM8nC0@y06aif~@7=MjAlcid6<_KTZsCr(k5Gb5paXNOjV-ZJ-&S6H2U+_U`ns6vy-
zrsY%%yn`qGOp~wHs81!C*S@Tq{$oOoHf(DDq;dEUXM}CtJ*d3(MmHB~N4*`CmOl2r
zzEv?0Hx@T~lq=aJ2NiBRMjy!KST=-0XGqcHwNXz<^yg$%`$!tyE_-0)edfoKOf-MH
z-jfDIAx@*JAm=l^IlNlgt6W;Oca$7ts*oCIqKU<IP83o5h;LRcyTW4=xSnU`C^sp3
z#l#bG(turQWi*8(UAfJBAHCm*E9S$nl+6i9YZ1i&<$;Q*l>XZHg?!6CnXl2VaK)eB
zg!=|#^t}o(%K!nd&)4Xn^^u-Hwnv+rP~s^q(v>38dPv)^Z3*%AFA*Ioifehh;wFPy
z-;noYmhrvG^R4MR0f|U2eW~5E&sO(8k0e?|$GPPMq|<9W6-7z!F`qP{w$u+45tYZs
z6-@0O5anqdhAmI=!_62yNR+(L$YJWo(T|+1yEa6m8NPBk>D<spR~YMGt{Sg3BRwTJ
z|IQzkR&U6oqcej7oBaEoyQ(D1sF*U{_{xu_5HYoAXlYAuM(>}`12>K+prp*3`~n^E
zf+9oo*EXWdNM3~UTD8Kl@X>*sGLPIKSCtO>WAY%GOK-@s4gUNV^l>ht?+C&J9q~m<
zx|fJbHd*ydK|swtjBZP=hAqQ{b&80WsK|EVNp0iFiivd%b}#4$geT>$Mfp4!hI@sM
zXBmo!3R>Y5N$&}t(ebHL#!acXikp+R^&&FMfZc5qcec4IrqER-k3Lv0M6WfAPbs|g
zf~Z?`J5bO8UL<%|kFN_=xZ6^ow}QM1MK^9j<GQ=z%j{10FDLyi%n^~OQ)uZ|Hi|*e
zA@g<(t8TCChSLzSD*R7n#kJ78r%r0^v0TwRMvg-9ni5T|FIdwlJ(0^)g0%neRP?x+
z(JLEGA|YtMvRuls{#{kUP$jIp;N5DjiuC3alSIPH_RTyJ`QL(8=Bcqy4@Ah?+{2#v
z<Z*kA(V#rvgVa&-xyZ@2>K0wkIR$q(LHtk{a|*`h<fM-$g?y0^9zu)6yDk$M3w1;*
z+Ol%<cu<zFoo8uRbceyQA%(7u@zyosIiH^@cV2LXyL#GCe}X(b#5tVi^54~<GuPfO
zgHNK2+j-AWG9uGnUps)d?~=y&aX0yK?&Mm`SwRUafccdpI@DVOWxS0Syd3e=!e2%L
z^kssKRpe?w#h490(cC<iY_F$7&mjwE-lp?+cjaUfVLf8Njq<g4AAfu;Dkv?^R1<}>
z^L+PiBK7wT_A!=|bBnCsNMB{HkkV`!@KQ`evpf7k0;iyZ4urP>pI$EuDKsv4K2}1u
zAt=iYwWB_>r(7o_UJW%GNKh~dvW`97ty1rr5du{L?@Bub8ArLANuzA6H2=j}dv@KN
zNNo>gZ<CoWyes!j05xQwX_69S^zQD*=#Zwb9kqL^0ZtMSS&r}>`^5RHO1E-q+XfhU
z4mg(GnHcTd&7Om9?R0xYt{?=Z*;of;<BHE0l?XAMrGzC3-o0_DwQmn4J+R2v#52?J
z^I7`GKf>%yd#no>Up`ZIBIue*A3cXqPl)4*Z##`{dZ`r=`+@ONvwTD-I>KDxm6Uap
z!%>>k&~84qujBo@PDNX4^m(T2gZR^vcAhT3)aZmbjy-QXCJDg2Ub-q4J!VC<&*X8{
zwr<M8)o{`W2l?6WlV8TIl?)qby+^bRsJ>og_a?S?I+XMu_#W~XvL~U^%p09vxIQS*
zZyj6QA`H`{%rtX+Z9NfuLBauYV~iL&ko1)mr4R!pWXwhW-+}4sN$NGjYuUdeY;~>|
zHKCrn!~;dQj&*%U*FWB`Ce(2M&y?fc5}>931ZSd(o@wrG|448~$BI*V-(U{1(`#vk
zc(tb^S_D^fx<$bI>qUG)8h*+QtKbL4L?Z;$3VaDpXYocAG~a%5P{Yra>|Bn>`dd_Q
z6)|tDq~4aEJ?5BIt6O>V*r0@ieM*q)FqVO?OAMc%r#>LxLPgf}i*v+>va6mJfe1;0
zx0z9jjdkpaFj?gB-BUyc%-Z1v5vh>+JkU(8&n)Zrw^f#^ZVh4gn&@c!akO*_En%#^
z-i01|e8h4lXkr#*=#Xjq7bD8L<dJ7*tUb>WiMdv6_)w7#v6HY9m2B>cu0WUSB4T3&
zroyHJLDz%Wdl2HyB4Xo*JlZxEcDmnZ6E`>yPrA0BVQ<72UYa(=A}CaH#|R@&5)dDO
z4490yEyx@zCl3*Z)=V^)ZDLd95RYKF7d?sO98}QLRf7$Lyr=o<1(;@Y2BnCpJ%bLJ
z*_&cgrA{^ZTqqR3vVol`w|NXxq)r$3d%dA_c#Rr)*|+~Z#x+_X2b+pJ=^eQ#^Au;G
zUpBIrM#zd9@sm}EW#i!;Vfe3vt(muJwyCs2b&Ocq*wZ&>r}F~Tu`^0o`@)po3j|q|
z`@4H=)fhaCI~>(xU4R|a&1$$_#ItG&$KWkaIuN`2KUGmVru0jNEBd09$7rR=8`!XT
zBy2<*6_2957`tOlle?w@e_+4UD{M@{OZqZ!jzu?A{)wjVpO*xRxp%6U;ctySBKmAn
zLg)b8z;l4y-mW)p3x8LeSTx17z{UKH_-68#`e6l38m*FC%G(zZVax6%W`-nn!mw#&
zEal&ZEPTj>*VXi)a6<}a*c?>&V5m?sqAw*FV;-bw`FC$F8M=MgI)<N}3K@r~J@>71
zf=@)CD$V_ljWsl-PE`@$;ycQ2XQ@V+m&d4NDFR_=K=Xb)ySEr@Rg{|yO7JzM{&MVk
zpz+MwD^Nju3OT@@$4LkS)GG5zRL^P2{D;KyYhPJ|NAWbsg)AU)CM(Gjk+ik@ECzuh
zV8E|RCm(I}#gN-4&@;!e{d|$-)t{_ifvw`wKv7VEE-DF=HROGfG&$d6gHvw+>EL!l
zuq#$usN+BKcgKbULCNhUtWyEMk=x~jrn6UKcLSPVpx^fAdiraLQ(d0wCoQM^tAy<n
zyj#LyZx(b?^EIw{V`1o3Hkpb2i%a!Y+`jn1q7R8hM}uY^qJ+IT^#W4`w3L~($A-f3
z0U6fS0iML|VljD)noT|sGI3eugKN~UQp)S|6;@M*0LOlg6X?a0b03ZMd@EsHukbhd
zoKg)@acc2{-fxONKDh8?N1u8YYRa+bI=qE|TWQyLrgnPIDapLE#5H3F*m(9Km)*CZ
zeI7&Zgc!8zj}F)5Ip~U6<bwV(xEd{DO0;&i{6yJT;J}*hEIbgqI)V;RUlPPo9_Rq*
zn21Y4&>HXEI5~~0Q~aO<xkbds)epPJqvB3AftM=NZR$5~WR;fqlPe@_HFL)@>vz#@
zcXhbFBfeNQ>)^+Q2y22KnwVyoo-JSEon!+h>a4aU@c>@|uzhL3{zG`HUH2QiS$Y9_
z00Z>Eu!&J@0L6Q<{zb4mIg$;@SX@EusvDOiP)y@fN_S;IN7u~)E&<V@<Q7P+8I_F>
zx9q1l7x=TZ;@C-&9HG*bf+}^#E_fQ$G>p18ZAFToxrW@R_3KbMmX3I^;%=*T&>LSn
zWiQ`#ZT9nfP{I~LOJ61!V&ZI@vVUZ6BvO2zuyVs+7MDPWf6E+`Qg|{f)_PpLjp|`F
zQ-&CXGE|FK+eto1P%u?Z&rToou9OdF$=UpJie3(}`!uqtPY9dQnsSpneW%LMbP`*H
zKufotbbTeIsUb;nBs}IB*Q)!>l5z3+EAGCn?KFwN&@ylif>58~9LSf-`gJKYYyfgu
z(eRPFpO*~&^F@BHp5HLe?e5w?S>})h2k6_z&FKYWC|O!}S7z_Q=^SR105?eMf2k2B
z^i*8xDbBSdp|=LC+6;IHw~MlN3%xabMD;__TR^t~Kd5sgxdzB9Sa0d5ESI4Lj)E<K
zvkb9Q0v<*<h$>2zSLwLiVmoJo1AM=@Xv7M&Oka1;c=8{?iMaYGmK=+Jx6%pSV+`up
z3t5_AzrvsO^fldFg9BbjM+QFvk6_Whm0f=IW#;BoWblmwO7A;XlwzTW5Jqn{rKHR6
zT4cyaanWS1XO;yoa0be2abv7J5sd$|@~-5GRZmyl2_(1#g-jS|eQ+&HmW-b=0C?2u
z1SB85%2eC7sVbFYyI)W%D;tg(f)ZFj-b&y_?Gp7p1W5{v3!ANipz5HMd#U6~dm_Jf
zBJNXL57bJLRqk%zfX&3!`sdJVyM}W9ynQ#9`bvs@&><6Pbex%W8L+{<vXvDq(%t}V
z(TW;w=ytsq)Dkj*&i4CCt-Ft&L25p<A|`&NTZCi7C*p=&9abTItPdAB)10dQO1&%*
zb9<iJ8D2<*mZoyF?mFG-etNS!K{8mxfQ1^sf8w($@;yK`B5Z<Q!+c+liS@Xg;}O2e
zV3x$pQW1T1X;Ef5m~2dAYzWH=4&T62>O!|PuS8d%hMtV5_F?8zBmtp(8E#HZCvQew
zHnCjWpN<b@1ub|g7`JJ@9*ZG!LEc<e!RPDe*I0#GN6*I80p2Yp%I{p6W@8+Xe1pRv
zK;c&ji$Q_K3PeVOgTw$mlu(8)kfR-+U`V6c^oPF}&rR{Q_KbHdJJ7h*2gZtpfZkL4
zO_wKpMtMjK6#ay}@v3;$RI&H*j+x3JW|0IP`eOKN%z>IoxNXQ|@pOE<!o#IRg#UL%
zSDKW~<U!>)O`Lv6QhLewY_>AeWSijKGKhbY?^(~!jyp)y{VYPmfe2cY>rUNHNR}LM
z{TgyZdTt*&5Ca0fgkXujWu}KKVntr?r(6wa4bz~Lv6t_8r$VopUub{YiRC{v=ZiFJ
zh#xvAHO{Qb;c1Rq`coDg801d3nLI-ECe-abU-bwvpB$hpp%Izrc2lB_b8Pd@i0v#2
z0`>=&C91RB8xm%{-_HBqej6y0^$e|AfoV3@OjLKta=m6Hxiq&B1QF5v02gD;{IQc+
zmBmFj<|H$ttVLUa3?DX&NDar7a-C&4INos^pH2Qw&LZ$YeKxD&FK;F~QrZS+zCp8b
zRQnFPNK$2G&!xbZxQ`DS8+=$*CAsa`OkX$ZFrn_3M+zh)P+DU)F{Wk{UJzR}&BL?P
z@tMSLRy`Vm2bLR1eMpXHfN`h)ED)zLnSLJ9ZXRUQl=`D^{jjPHl!X^Q^4+yoSH%S8
zsAr0mUHg$#!h~k<Q|%$t%aoE5h*iIM#oJsydOnKIFYocr-UXO_FJ6w%3GHGUYZhzw
zjrf9>c_R*RL2=Q|cLLIUojlv*ng&K*v&aoI8@N3fhAE)<Yuth<#$LRmnqH4CF<Au9
z0x!86P&oFBocO4y;R=GqOH_`)^{6CrH$m-jwa#|PLL+3wM;PZ)4XC~?yIDq6A`w)u
zm#AS=zhe`YBTO2DQAn>q+D$R29<wmL$Wc~>gT%pAi-|iE@J6hX*!Uq<vv95Jg5^m%
zf>u@qg}Bfg9K5;t1DK_A0J*K$B%C|-GNB{0D7@WS%Au;f$Uc#Y?0^*)A+4|ru0Y6!
z=|!<JL-7)#Z{kagS!HUWQws<Kzc!P`QNmsq>`HGoopkeTOr-Q$?VF9=Tx9VZc}k1v
zf~a=$_8mVth!=Zy_h)rqnVN0Q*nvN%q9}EC=stP##n5LFv2C$&EEHSxGklJDkX5XG
z3$aIjffwLBKnp01pQqXp?nmagdaxK#Zdbs*!X2b06K-r*!`t)Loa@2&7y8&T?L#FK
zk?|L458)L0GG@X$o`0!!wz!7qCTt~KK0eV<f8pmXW_FSLfwx%EdxIQ>?liSDqZwB5
ztX>k%w1@a4VLApQ|Mbs#-~=V$gsTgj&;lmRT+d7=9X*x#InBsYbxRu)vy<>+6GX2e
zyJHi!AQVCh3;du18Fwai)l2?#HQD^CE%rH!vSs0j*wq&lPd*Nc=g5!-!xb&v`2IK_
zBW73RBNWUlQ(W3~gOdt3549{o6%Y}xaDG%(g1j(Yjy6kAGgKjQ5@NRjPcc)C-npU<
zx7s^Y{+~H0%>IC1;w}xR`<b}@*Gj(!9aiy+x{q;9j$wA`+DvdH7EDY_f34(w%Vx_`
zRDE07m0}nxO%2M3)s&+zG9t}@VFae!h}+_a_z{I?vkT7^E%+`TV1b5Nkm-{V+b^*P
zyxguaqd^JlE9l?1o1Zg#$M5bJ=7;8<oBe^^0cO*dCK#2zBKdq@fvWUoj#tCq{ifT)
zsltJ+5$r-&qy>U8W*3ZeE!U3El3BG!XP=*KNG#SP8cZ-K`74RZ9~X!rP&8tir&0Bh
z@Rk26<xkSmK6OV5zV2whB*6g9FWBom#z8zok?0@oI=lc^{i*<0{;08^<PSUrIfJj4
z%3GBa@XMZPatYzuV*LTA(qaT!dLTHW+>mFakBo}((e5x<Dr0sa@zEnir>XytB_RI%
z+Iah%ntn=6zm)GProhzT5CsHY`(&<(6g|j}53$)%OGHE+9O3?*ew#osv5#4#$^ciu
zJH+cw73BNsWCes!b_MKRqAwB0SLf<e2gzR?CD!HD<Qw^G{mWd$0YX(Uh$aHjEZIy$
zrK7MqYUy;}!X6>pu6H1?w7BTds<nZ0E$I|hZ6^W|V{4M*E`wJmI*$)7t`-QvztvuV
z;)`(HC;rV)Vu6AHi~n1V=OIX!OG8wpc-xm2UpOC6>4}J86z#c~o{kuasi~eyPB>1`
z|K->ta^0pkMbrmNk}`4)7_PVUQ3;!t)@?A+{H)YlLhc}BZT73}dbi|ZgY}BxSN6FN
zwI&hNTE13DEw-G|5f7Qhr^gvvd-C;o7w9f_JwB1U6c%1|CZK7t@?p?|+a~ck%K)se
zZkESM@2~QY7pEgOm`l%8+a}h16R-DB&cOT1df37m<pBR7*p=FRvMEn2;?cko*sRAQ
zxb#d`rE8rDdnqnhGdq`_3m)RVGwB8S5#iNN?mE1NzwMnx21KXfhsX~>iLZO^o*SYO
zsC{q|v5MvTLt6W;RAO9=onyNsbNM&VCh#oJr$ypL-SYbUH<z;ZKR8hc1;yoMZHG;5
z@)Fn`GbH7bbI`6Xcv8hL?|>0|4FnS*GkzY+2VG5GgvlzDmtjwMBhQi?tT{qTA!iUy
z%YknFEATn9)Ic0}fqR2_id{!(YX^%HP%Az}#>*Bz(1O|}-)K^q9i`9Z4*Y~zuG<h2
z7ga8ON>$376?V0`?08GMQL3hP_9ZU_dVD0C`C0g|-K5AwGBbYMQhN!df*3p|;|QUs
zjL4S$kZrUlw-@dK95bAQw0_4KnXSTvM|W8lERDezo^Vv0Nk9oJ2x1c%0J4ca8CKoB
z)B|#xu$g1DdimR{%<amGWqR6rpT1F;+y0DTbW;?xGMPN;c~03de<=pREGR>`C7ck0
zvSyipYn(`z!I50JO^1fRh~A<)aLf$e=_FDth}KRk%=;%qgEv#Q7?TxpWUl*}f-;`0
zs%V%$euNr8P~)lOU0f64n?O~)wb|5Ot%q146}mvBF%Xmns81YCNy~m!Y+V>S3*6bN
zBDYmBe7wkyTH#13hWd2<K0VpAui1{0u^<Y-1<!0Xb8urD^;TFZEiwT6A6IKGJrYen
zV|^ZoG^xe$ufi88yZKT>2rvV`TFQ;Z2#$oQW&8SjK7Jb;B;L3;T5?0+D@ol&F)%Aa
zXc9o5Xx=)wZ;9MS+*mCNSxdAo$p2yAPi&i?v(6|J2U4)0l`&{0Ov0)MmtsK0nsmJ$
zULtLtFVG|5=2m7HM<9M|)f|#yZpf#OiPa8Kl2Nj%lR`xPC0^X_HrSOyk54PS*g`C3
zVFFgH&T<k%mY3pJtao24Vz>|pDu+PBLL^Uyk87vBjSXpnwbV8oT1<shAa{9uj(Q45
z@YFrrwaRu;FMsSXd|yOw!$obHpJzs_<PvQJpwwA|Uq^^UxsSyyna$##u9Ps>EKqMC
zRp11B>ON+UX<U0#)@-*Rm?StjhUD?_^YlyROzRN6WpsGqHb4*h3TH{}aTM4m@kQr`
z?Pr69KxUML5kddVu^Wy%Du$QPx!Oi>Gl7UI9pDwLQ=ARneAnh=1J2ijz*Uj%eTn)0
zMYk7|IiurxkE)Cw$?4s{WL>N=Xjg13V=bJYw58lw(r2VU#H;ntAA>y6g!-&?3@($8
zDQ~#&KCWOv8eoxv&nz{ctCRJc`o<3}QURb8hQA7YHHNz#Burm~Ur>mX9N_!bk~9fT
zXvs*i61R-SPY3d3n-8aHsabL;LWS14n}^i41uW)sFe`J1h?pgpOY>tri@fQ94;J|V
zkWt?=e2iI;2_qHXE$o~bp2VL7s*oB~ICkH$T|dGhck#Uwk|lSk4n72JB;I(M{8lpG
zHr;2KUtDFucJL<Rb=H#+<h75gISMbR6>HB@$+W^m5LS!k(_Gc0SJc_DOh@<y@sV#`
zy1`{8dar7#ZlV{Dg>K^S6NFJ7f<0+nqzV)7oLm=;`~_u=Q?RQDNXiCuWGoc!hFs`_
zw3|~kT^i-y>S}y_!7ym*CGazV3?|Qc4mt{W=B`|*XB0IN?u~R$w7q%z6P74a>;Q5|
zI<3dFJGxo%_Tq8UX9oOFQJWnbNe%UH=Ycz~N50|@5iSvK6YBPn7VAI@I0O9glHJ}J
zw}bel7j2mFiaH~RT_)Zht*0&sN9g&yQCeVp^nc)N20_?7>|y5`b<0|6LCB_cffeJJ
zhaZJD^wlj{G?PT|tgbuLbaklpm)B$i;cVZ6Hh0Pv(qCdDR$v~2<PoFvo?O^W;M=&p
zOolO9reUq)@<k7b+IyBF*Mam&37bDQK!y??e+<LsE*kt}KXTQk(Jm{yRAIh^y|I0N
zbV&v$ARx-Uzv^3gf)d3d#0D3$M_MLcEu8Y4u#Qy~W;79!Vs)n`4|#?<?(?l$Ttl&?
zT&*|98&I_-`87X(({waACj9bsm&Tylk@SUpf>3vNY4~Ij?p@8p=J9*_T<w>7PX{7i
zhgTCMWf44U9PYkfd~zPS7F;8_<JjodaET>u${k2f$(+Z0{XZ>?8~*IdyVmqouS(th
zV%+U0m#@?=Qh;FNq}L4QGmo_j(_6FTm_leh_CjD<b12H-7|n8mSvyWOK7cU(Q3ee}
zAK^Z)Xlw7HK@&ca$IE0@npOc^btuZZn?mWPEoE&$d#GL`2Iw}HEi|43vHh>yi_~w9
zQ6GaeG?qGB%;Evm5F=$G>CV$C8MtWhdrTkh2P)<%gDdReo{h+O@^cMA5cMijjNrbA
zaY?(m$|`6yRTTemT0{Np!8w!r@T<Xb;+U>yyQ7m=?;^Cx$tt>BH%iqq4ij(toc?rp
zcpoeCYoPLRVLf-th3u+B78P7<KUbM)k*PJDB};?3H5QRk|1-o8Vllc)UgQW<nMEAs
z2j|mi%~svkZ)3(UG(91CHkiJgiPpUN7V%(k9d}w%y92gC#E9v6POj~n-Of{^$!JE$
zz$#t`zzs!?(u>GWb32dgi|zi8%Mu-9>Y6fi?9cD!irdusy>B0(7ZgbVq8*nZcBhJ8
zqBD-ZTa;<w@}VRl0A0-(rm^sOFqG!$QQV0VH?^x?vh?3vWoDHque>}}{L=k`jT9y!
z_JD(ihNyE7%R(2-@em&wY2uC6vI?_r+}WAoZ<8}@$bw*~PNbIltsIpprE)75$xQfj
z?rf7Xb8Yj0_pI6sM&<ySdAD4cg6SbC1>X>B??1;(l8V<5oo23SL%2L`Qu(BBk5q47
zx8YKj++hnLrUhOaQY(46S^FLLg1B+3n39m>4TO3Y)0(L`A`ZI1olrieo`mC)9epJW
zx_$TquGSB9VU)-hvlQEw-?V$KJ>8!y3a!^Q@1Z<d9KSSsNU}N6vin&ZGIF6*LI{e~
zsRXGs@uK_EaMU*))V$Hz163ySP|SjsUJMm6tp$!0SnNn^aKk9>3|r(YVO<389v7jc
zxH!P@xV!G7iOfm~R5=Uhz;4jf`^YtYH*3zfq2w*L9@NU1ulPK|OSJ4}&E3Bi&N1QT
zpi~i01=O&MA~<@hvo82oJ@p6fqO6t{Y(cXF`t@yu0aR#Hqw7fd<i)OSy~^DeSwztV
zB8@JrmI?kCR++b;(52nRXMtnw(mm~s6MI-BA26K=hDDL6mo?`H%Qi2NMu<luV9I1c
z-6Tw3t2L)7m@*%6<1*ZpT1vjipbdBRg|u;SZQaQ*YkIP2RBoPaZj4|44way&8^d@%
zrnpW24E>I`M`@Th2whY9;JPr69x=}O4E1O+BRM1U7X#*OK_p!wwSZ~U*X<hTel0x9
zCM9r}-ls>TRJeN-DX9*J{?~xNoH2fANfKi7!1%P;Dz@uB2d}c+ZxQBh5!~(p?=Z*2
zb$$R6du`C%y7NB34hs4g;*7Eak`8071Qx_j!gy-hsTn?DJ2tg_?<k%i+G3f6JtAne
z+wwzSCt(+_gk=B1Td1JZ_A=9MW32Aw#cK5j-~u|=n{-^E9#>kiMcjgB8^30ygr#QY
zk6+NBO|HEnm&y>e=Xmcf0WaJ`e8kF=SZ`4kzFlH#zXCIf=)kw~WS2)w1SQMTk55=m
zuwYR9d9hpvl?PODDL(AO)@wEkn)RXWie}fe6UH9IjDKuwY&e^dr?F#XV6kRE9C8FO
z`b6F~F1fcqk~#a<W0kndzJQx+1-Rn2q9udtDPIDKtaUn;e4oQ$PkQ?e=JOB|kvrRL
zv$?BB8$HprOXN}xaKLcrQU?r(tGRmVw;7r0O*U+Ku<+Cvabs<rif#GiY4q4}+QJ5X
zHj-B9U{+v&YF+Dl{d1@+^Sllbo)%|i?Vl&EvAs(*=tco6@B_soquh%idlBl6wJg-=
zYmb177-8fjf=wjdY>3U`x1km3QdZp-3GVU=H<&w<$hD&A|0u=*ZTgMhcYfREfhkE}
z+Ma>>jU5GYEfAxA@tdrZd>r!|_}43%*=zr&Ue;D*Iyt-Bg($pLhcB#e<)Arw;o5E!
zYIsBk`d2dpNO3PBW7~KR%KDa%o&Al;-x%z$l+P+w+9eUHb*ky*53RiWDk8_2$`BZ}
zi=wfvTKVh7^BvPFY!YL1F(u<HfC%m}<|Ft~$zP=S-P+{B0!9}c)JEUMM^6+Tq+Vjj
zWmDJb{ZMo(NsT8bR2SS2MF@fq+I*dq&CXgLtz^+<0XBeZg7aOY!h9T|YuCdD6(5N&
zQOrod>+?%!Te?p^bIkb|6w0dC0@SR6MeIT4pW()Svx{K9z=aT8EviQ&ruphAn^|Mp
zQ7-W@m?a>d>a}TN;1b74&o*e-?a|%Ld1SE{v1>G_fy~dQS79`JZQxo?vgu|MOEZ^^
z6+Fy0FX56rrH<q>vv$}1uqK+B|M*@FP8K1o!YctMm=q@C@(yuys_p)Biiu0HySePB
zgUToolYAij>zS{?Fp+7npuhXjhfm|C4dxe3DsC|M`EW_@bn}7&F?8yyMCL1WOw|ON
zB6v4)d%SU2<c<L5M}zSfxJw;7PN6CnH`y0s$zHQ}0p=?M{3xSy>zL5}?EX4wfgU|(
z0|e1m!d}n><fNc03gk6pSURE<%uiqY8+g8J(;MYrG6je-J9NAGaxN$q^v}k5C>!Dy
zG@OW!d=j>kr<Ki)TE<qefnYuGzLnPNAG`AIYcZz~{ya}M_=YIp13Lwx1KC~!?y|2V
ze2tWx^kBZZ3r2j$Xv9qQ%Ox&dj{`h$wXU~ru!5dNKDd6a5TiNP?-;p`>hYWjdqBY;
z>x=0|W+E{YIj@;+)-mk@&L#M!2&9f~@T*91zN^gV>fpPkT?C3*>k1|G$N77k^N<1I
zKgN*Z4d#|+zJry_H-^F0eRn&LbJWL<@$8dMt`0v+h^SEca94Qu0?@!O@ff1CcE63m
zrKZ8XW4$gfB)(}nL~O6cZzAkLw?6httYkhXfWHR!oX5@V!Jbj9_pAc}ACEMXso?V;
z4aYysCuN{zi3Q)x4m8%~<t;9iGaJVjT_#BmlwAxjvtQ6*gIkE8<mdlrE$tyT)$J9c
ze3HCXb~}<q$WA$s2Eb^rn_uHw`wgaK2X`=9(NX5DTQavcCgvTcWU_b`l&qgh-~&&j
z<37Xc1^w3A13>azq1vz~SqD;rSe>cnD|N>WhsWNmV45h&DY$(md$@E7kxP5r%x;bs
zc&%mWa)Kj#pW(m_0s*x%QrelDsoqXqEGx_z!+i{jTsjb)cAZ)p7^u0T(=)fq1{5-%
z_D3=}{+uU5JpVl|BlAp9mRYBtc0oLgvM1pJp`cwz8-tHV6ySX3cObsa&5CM^a#yPV
z*<3X;DZq3h%}f%#uLPf+XhQ!eeEu@9koiN&NMW@?-wVp&8$IkwnUZ6{&(3N*I5K&^
zlPkJ$1kFExy9~Qws!gV-^tt|={y1!@?^F`OHUDH2J(mwF5)=;1msoI}KHG$76Ywdl
z>1JcyY2_j<^zXbYj1Q%lxRvn}z7BLMnrN|zUkkbE{c6$5b@|>@<w!cKLx3q4Vz+{8
zeeQ+Nalg-o4UU#G6T}&~J-AVG&817_SE<W7^F+ULuairy2NP}TWs)<2Ag6h*gSo{5
zL;RO0do#ePF%#_4<(*RRZE`jt`=A(gAcjewfV)1sz<{#ArEBf)(uz-`RLi}Uk6$g>
zxDMoV4gNGC77gerZvj17U1EF^fi^d9%{%wmtF@KtTe;Y4)A9TF8|bnQqWeUR7PO}$
z-dw6F%@_K?=zPgJ+Kdk#zd(edHk;{9<looQW*Q3tS}#3ucC)FpmtD@^s$Qo~m-MK2
z*RgEzcwOMb6Yg=X8F5<7o6iM<>mGv0a*jKxg3SR}XuVqOV&&uKv>}+ol~&Nl&22sG
zavrLBnc<~<c=pL2W|1p^n*#`)s7^CWIZZNi*p3;)_lb0UCHNTDnYjF8l{|cAzWy>H
z9!?PVarJ!97w(NaKc8ulYeXaIMz7>mMqT^Zq1`MU5m6z+c~@A6nbxuIxXMg|jJw_K
za;~U)p$mPRsP)fTipg|;h`mX&S%bMxT6NMqL4tWe2Dk>(w@*>kV9D|IjN#ZHg8o@J
z?_Yo+R`KW0F$BU?xbCEN@|Zy+Xs0b$^->_^6jPz{X;P-$R$2RvYUjV(gQLI&y=IUf
zCxN>um?3h&+}A`4@P-Jv1mD5sbI!Bag!hQG>RdmHF#StZ&o9;_0MD+CViZywIJl)N
zkGp^0Cg6{Q&inh6aGhDx^Rc_)`A3O$l3(=QifSqrl;GKP1v~G06=x~AC+qFW+WAY>
z@OmB>>wvGzEbTzrEqM13hXOj?#`*Nneq#(1*iigkDLv)^le>xEE%OR~Y|kkuYPMZ)
zOgIY|#_nyYIRs_%0PJ__e9$Z|0{Kf%A&bk=Uy*B;65I6iLRI*f_RX9-2BK4#{=x-(
z6HjRy-N+<Lf)q0ra+<HJ_RQXNmYYvN5L`$QLOJTy_Pvhe7xS66<2g8BibPv4zxr#0
zk%_9!JNFX`^MAJl+(DPnw2U1Wh@`uah5G-k_%und$)ikCX)K0dZditNypZMm>#(u)
zU-O~g1OwSpi5_}7k;O6VsU;gw`vNVrXeyTp-n34V>C;*>eehi_j~u<}yX5cVO>fh=
zhdaBaSaJ-y349)X>SA)Zi*@Q(6A>opB6z@U=?htvZ5SR778Egs9lV&Tn+<i65Y8hd
zOZ_(Qy0q)~K0@a)T7If!YmEB#VROG<g~PSuGv5I)8-jleKBeT`hx$>t`X!3#Dj@zJ
z@Of3bWx>Z{4D0#9RAqyR<tC10IJW;2_Q-edd~tegLn<a~iuWF$1X~~Kd?m%Mz>pb>
zPh9mZ{uY77am;59XraAmwrF3__MvfX1VIAgxC2PqksILNoTvhosej(_3SUERtIy1)
zT@x-$&2jYeG<WuMEy!W*MetpDT)pToj3qbrKf7`pwOIt<xmGkLjy+t~0v-o&ZzqOu
zf?v^#ylK8+u@FOK4A6fQl0_Kcw+7(1)MN{OXE4NRAx9^zbEY1c9|b$TU^L!#o<Ni>
z;{hHg25mh*#1W%*r)&P+-;NvLu1*75L7t>aHFL)FpqweMhRs-33KCpgG?c^Ur1gcZ
zhiwXu%!fdH2etrr*)x0D^*1@diB1Qr<IT;RNEs%!^Pf-Q5Aff$1GT2`4L9+-beBH7
zsG01}l6=4b!3AOm!+%EGiTHBYFinE6`@tPf4b%2$&<xCcp}0s{fwZ)E2Q8Het~IHx
zOW0*<dvm_l9#{zspt$xEk2kGu{(d^E2!|dj$Z57@VT4c;B4Y*VxD+q;UTc-j-*W(f
zu5e22xx_ddXPW|PM;NwW-pN%L{PlwE+)Y|=3IQs;pJ_YhgX++&*D`gKj0e--HZCYT
zQ*?r^#anRq){xKeE6a42%z}ufJ=6oKz@WZJ(<84N%dB6Ykg_9<>mMHRZAkeoFVZht
z>P~E3kIOdAAf*R*)5*B(HTmZbm82ix+n6|P6Fn#pdF<kYCxh2Hyw>jxst^>;jMkB>
zE*x(5w!vI`zTsHmum^Ftc~ASbp1rH@=}2$77fQz<k<NGM>iO&7!JJUh#s5h72YN*q
ze;ujzCgQh6fF<7%9j?{)g1I-Y=j2n;<vQ47J48=kDMa?XY>u&P*z0M?>Mg$KNWYP4
zax(p1DS=1lpFfgtl24$3UQQ=&rFD`ovRXYDAtw4^JLj?6NIf&he{0_|t^QpL@fOzC
zkIa1u4H=8O%02Gt`EU=O10tZf=pV+KkeoW91n|i@*NoxdEsu_pg2$sK=>;uC=`Krm
z&9EgU717A;me$R&Z4aeehq2+Q)pd3Xe<-1w>lRxpOMdUHNw>+#_8>poy=YO!|Lnpb
zKEm9O?X<rm`QMborl0Q+7X2I6u2&p;hmOOsau<jJq7DXo@62mFmgmYlyKpeKW0X$d
z0R0B+Y<*Bu)p&zocahyKRv|+{OD*{lygYsjS<D6Np$cLHtS<uQo*!;w-L%9>)8^xe
z3~%4fT&;7d9UtH}7i{AgZm3@IX;?;i0?idlHSIR@vQqD3Y5Si-;I-aPq}mIW%rYU9
zx%H1EnDDh-pxY*lV0tm5AuP-WJ|Ft1<H98hgXukTl&ib-Xc}e=uci2Nh4fgyCSQYP
z)Z+u=p+o8~@`<pWd!FoK;dhg-;4LGEbS2J=o<7gJWhQRmWyW{7`(M+I!jU`g(C^UM
z_&_H|uuU#l`cU!Dq-faChE4PC-xi}IPm5m%>l7sCYo=h%<-E50cB7I7;_!Idx<6<5
zNZ3ymavF+rUR;m3X+(O6{9`g<K4H%i?VM0wr}e6w{<1PRl_$PnS25e3%H1DB->j#b
zzds;?m#Y3^7$bYe<%%7P_oTc)bi?{C9OroS)W}<LHd~J*{1o;%r<-<ixz(E(o;#x}
z(b&7EL@QwdXw}qZo(huv0*q}-TrQL)^2f6ZA!2fmo2#zBm9S1nd$r_z{2c1Ip@)iZ
z!!j)TZ2MR~3EuX{1LCb$d`q?ke=}Bj=<Qs_1#|1i;9ttV_?S>w`9F8=C)1({b2q+Z
z|CkBC!1D&A56EZ$z7duI13?_jM`#}^wv;*N@V;DPTxZU0I$TKxq(8`L2V){7WNe$)
zb`3e}5ti8Lif2F{hZH@DTX#`<KJ|_yoL#M^By;$1v5+8#7{?Ndoem*_Q~6#DhmFgo
z;G0jhhxgCzUMF?6+76k(gc0ooh%ZR{TEU&Fc`RX1z-J?UF6j!$6Pz+vZJ&p|Vglbj
z@P<UNdCbcgR$=3WidEnNX09IRfT-W<QHYw0T+&g}J>-a!u9GU(H5U<Jn*UfbD%_tX
zVdCuJcDnlvgmo_cZVE7-L%rg9K8e3!(xFJdzv*k}EI9-4-Axs&oQ&bRdr!^>r82?p
z{bo0~?i;<nqUXGWxP<&#o}CKUSnj<E{~GCYRad}qWSxVwF%#<$SBr|lq7D_ugZpG0
zi;LTA^5|cH@7H}+<(m1CCNpO^0FB{#@0*1(GJ&qfwy6C91dS-k_#W1qA8NvXL8`re
zZvP@cjp+?qMx<cm$SveZNJ~+R_R`uk#a_makfJc;`*DA>dfR!n*;sXtuT7O6FAj?l
zARB0=)bbQitgBu>Si|BiI*$aqkjTr*oJwu}Z&q!Z3;mc9!fHZ$myG(FWnBMB^uuuu
z+X&>rv8y-hRp&#$+98_zN*_HDX>r!r_R0Q$M<Dhw>8!VpvnMqpM=W$D>J&4-X(5>+
z7{AHQN_U6xGNiNZGARz}W27t4o%!S<ktuE9cwrwO-MhO}FkJ~Yo39S5KmWB!fd%vs
z+r)D<WNa{eaD4l(0FF8LS8e8#fWcG`>o!ABpF+-*{hnY|r5SQTL$GljOd%BcMmf!v
zDe>1Zz@Mw%XWJU`dlid?K`N!hBAj7;ZAek8`=c(mHq3e6F&2-2^+^v0G+l<<<|7K^
z?PGgbl7`|v!L)qW8+FN-xl%k|;olm}=p$nU_szq_<1#H$B|#-YtQUtT)IiO2i~H6@
z4|}bcvpeB2Ut0_P5UfumWbDi;vZqgHFB@$o52==Ifn`10<y|%ZbQ|9@ahUfO+IAXC
zHN`+|*G2d<x!?ztwDFPI=e}<PYRp|<*Qv=_r<Tyv5w9M=F4cX-fw(EUjXaz6bgwsd
z_60{068WBq!5B)^m(7zvADn~x>H6=M5!%+VFE?W6ytnV;VXzDb1&F$J0kwzhNsDFU
zvAQO_CakXqsg|%dvt8)q98WylfsmCwcfF-3+=h*-gAoBrZr-|9qOgMoD$+fz`m;I~
zp})Boi_BG#>2E%s@9j25>}SU^qCSccZ{6b1o`%(M<0Sj9lF#PyWXn-5USf`Jb+W7s
zrG5||qDD8=VhtDIf4|+>tuj){d<h#(Ii*j{>;dsf?%wc4+&-E9-N*gJ{u|ZITdaep
zxMnJRq2Ny=xj&E#{!}9@5j|^zU>s04Md~uN7bBQa1nVjx3QrIb_!5e=6Z3azEQ_40
z5|0elQ%VN^LDtpqLvR5d6NC0wSFl45K@}@26Sxkx3f-87gFKjfhamXdvak%ZK3hEn
z77RC~vUC*08B`U9JSgT9-l)g4{*m=Xqx3qYMcrqJdTc&{(&!l;YsWg0b>@%;*_IHP
zJABi{8p-Rk+h6Ta#T|YJnYt|g#_I6#GA%7g(QgR@zqB6DJ-fw|>snqC<&dsT;3eC9
zrOCagSrw_NfPkhzL#AaN?7n$2)nE>PM-rk|fB3v3Kt`tjwZXWC@c{8-INK29Lu(Ef
zr^0sSM*YqY5TBzv<4y)+#7r?p`6{;PfxzLXb)Q*uKJn#Mm`fnv4Tv{s-wb41ydjDS
zoh~9N+8B>$HU^}mGuj#lg)e^NYv;3figa3K&qXeqL!2rg_~~~*?mx?5CY@V+&;Ekt
z2=)dW=D2v~d&XL}KW4o;?lOY`eivdOeroh??fGhzrBC_^+hw{ed_vacju%GN+DOBA
zzdP16zn#zF$zvoEa^#|J+pmYXhJcRB&v#ib4-x<)=oE@<r?gAt(vQu>@4Fo0Ijrv|
z^26sXR4PaLaMUh#7{=4YEJR>sdc_GpzK}HLWl~ibcmI{6BD%UZT9<-&t!NtcY#}rl
zh4>eU9o64&Cr`{rKZfyq&UV`6K(_p|<vs%FTMOrl{gNqj*!4kj_xB%(xQkTYBvwT=
zA5JOKOWw`K`l>o;|KsfVJ4lH1Ir*z^vZH420yGvqo=fDcBcwWHbUM(QQEZ)<2<^Fz
z%sE_q@5~pn#*w*AV57K&ZX?BI&gmWH^;CBi&mX86bq{1Mm=lTwCbr5{5V)~Xj={v)
z<rDh(+J4>B5`$g4mPiu|9`!q4&Z<FU{I@D|MjoBouANWenCtTJ5RixKt^I8wc-z0}
z%Gzv6)Z_#H9a3$A)1!rkne%0e6IY0AOB!+{;0E++0AVM2oUF^b_Hsf$*^|sc8eOm-
zm7L??)pa`&n{{<#md&9%VxWEky%ypXBR;G>XSvQVV7XLz+Mi%U5tmV%TkM{8HXt7R
zgl`%y5b!>&D`A}XB#?LG91Q?)=uWJcxzcWDE12SMThC4}2`JrR$ew*`xaLA<oW(74
z7r9Ee*sCOH8TL`$T?K<hgd_Kx#*BFHo28HMdl36lt{u{yczzgyJKP~p-FsD?UHyQ#
z!Vl|8oT^-ncsUnzeTL!z-R03`)Bm_&+bj1V80?lwDhJ78w!uoV<tjU*d+IpvRh%Pl
zA-ZO-n-Ckooe*dghehcX-y3_hQX*qE=%z>D7P^gT%fUSu@eVI7+mZ(;d*vaHvRRF<
z6Ts+Aq{EQiP*3O(Tf!FT+Kt^HV+hpgjr4hS3cC3Zv7wkyq_%ifw^)_(r`4ylZvCoY
zZF(>Qq3U*7SE8vmb8^0|&oWx?y+doKOwV!y2~jva0_vq(On|u`=|-=d8=)mU7xozp
zaHT7#CN#7L8=80Hy$R~P6`ZV@1K`Dv;`gNI4k(>fnKZ3A<&$+BUKcRFb`pqewsQf{
z9tP~bm-9_iPguvfbDNOWH0@Sl`2@m{^g9gqjVq;GekgP*{$S1?)&?jlVxcvMicg7o
z4H0=~g+qcDAdA~JQZVoB%gJ5EDrX4bs<T;Wc{TVf;Kg<$><<^qL2xds{#+#pIhntj
z_{C<l5O$sv19NvfXvXQkW%hB$Nc_*`ry*e1QtNV6WzvyIh~ufVZV9u=qGZDLUZ$lC
zdQ}sI{iJtl<%@<VY=~CW0upowDWY3Ux`~30%#DIfv>4Tj2+OdB1VcGk%Opk-@h#W!
z(|u+(x-A6qaE9K&C<9C{6~d5>w^PJTpzJ|An2y*A>%-nmT{*IT)^Zbdgq`e*gMGFG
z5H?W)@-*NaTu;|uOGYT|YS!Dgv*Th#5~G)E75p=HUMKlrwztOlUt5h>TfQX|0fs<;
zoZ<NG5Ushg^ynBV0XY(=+g9;@_o}D<UhNTVoCZ%2fMy>q&fIp|-OYH`bO8shgAC>O
zLGsoG(Z5IURtU4(fzBF%9k-G1q5mBq&CO8~uJApB!7P_8D2i1SXrVBS*F3$S6g*2#
zqW8GN!;!zBS3%mM57?vZs?M^jXM>IS0$86b%pD(W!Z(pLYq*IVqVdFt_%cl-2sHFN
zL)S{noO8Rd?JptS*_I;k_<HZvg|af);@<`TBp7--Rp#4W*m97y+f)8Q)F9Q8Y`62!
zcF&@GTcl3U#y6*y&+VJL6y;=Yn*O``=iHF}PZW1}7*Yj-ySc8)^!Xmbu0L3IWz^SY
zJ?6*weZVUU1g@alv#gwCL^=!Gb>M%jtkm0%{D2;D<k}K&w3KsdJRi(GrozY$SJ-`x
z6`tol&5nqc5-Xxq3DmM=s`E#@_pA<0=;C`O0xL3~sGXQ=x0Xl<o%iC=t6|qnZHs2Z
zd=F3D=;ox`7QVmf*>1M-4W7`)81qEv6>|pdX{D&nKAqypb?Z>^mSyX%z{5}Yc-a<H
zP=abqh31q$KAq7s+>$+)zu!6)>WOm|FB-4ednJ77ZW+mvpe^8pL`Hg*kBv*u;_JIQ
zLgY{}WtjmJcyh}tKnA<gY6$Zy>qtn#E(`q8*GTA$s5lXHOXvb?Sj}!4^j6ebg;`)Z
zM&r-I+?N}w0rx*r>@7o%l!?`7NW7lLMZyqYn-Jbeuh=UDr!PRhN>m9Pe&x|7!CGqT
z1c?Hv9+4ifMwerHyNIWo++1`g_Ad{sPwPa5Vb|8c=faz^pG!}-SRaD>1o-Qv$9LlM
zgX|dF!5?ysN?ZkYD_A$T+ilPASma3RG9yIBZdH2ok!qNCRH0jP(}FG~fQwfb1XsqJ
z)=~A4O=V`Flb})s1hXlV!Emn1+enQy%L!mbV{yneQ_>rC?3^eu*@8GIdk(>A?F_w&
z^FlXebxx=ku`Ur<474AGzvfALqtEpGdIUtaMSpp&a=f%2BlOIiZ)moAMm*T8xKYMt
z9c)<iJK>6P4n{J8_RQrhJ2?G-_HTQ8Eo*+WTim&f?jWhl90`GL;rkDKIC8{FS74`m
z`Fp*YbO+c6BvT)pUIS5=%qR5Jc?QPXvR?O3I3i!Rg~~`jg79qmZ8^&|`g0Niib_D!
zwUP16{&Q^ECIJUkIaK^{Q<~q%hZ!vXkOPOeMiEHuZOiq1Kt}M2ii*H)eb2trf}iOY
zHW`pckQTJyTX`<!WUtHWITbtEmNRbwrwHUQXw@DNwEeB76Hupnwb~Y$z_T4eP0z%1
zSd#@~D?Wcgybl-GXQ5xr3MZY9t8*1)dam8$_4QWgm^>}{k~KaU>}gVq{|3$x&wKtQ
zZ9ZL+z&WJUI#|pay6084t%)KYuO$jPBw{%7c~)wo+DwbBb9A-ZJ{gz#TetEI!JZwL
z-?Lzw=?z;LEX3gCs=i$_PJ0Aq`Qx|&+Gd&T%N$i-KeFp9f$2?3jMEIXzj6uZ%#1<*
z0e(QH#k<Kr+B*kQ6<@3TiS6S$o`QFgNU*fX{L;rsRY(hPfD;qR;9)i>@rAF)?4Izl
z<TS~SYr{`fhXiiEwj{cCZOH$(T{o_QCF>R^tp0w)Uw0<bNvlOAVC{#CZIw9w{5j8N
zWndD*X1AiOOn8dPp_18Cdi{I&R@oO>QBuE~x;X~hJ;T_?%=kD2OvSXp;TxahCao7U
zY`vOsa#UnGQCq&8vjgBHZ&=?y`X(k4Gt)e<>o@W;JslyuIG1uqfNxC2cJ}xd+!2a=
zuW!7k4>l9%Btz0JSjK74OKxWO6bRm6214ObF=tXbYNU52BcX<jR`6Tds(~Iaj<EsU
zVYY*8(UgA?`4r+xxErL_&|hiB*IR`}SHoOGk=<e(SC<30j`li-Fl1TO>(?y@XU+@6
z)EMo^<3Qi&&hKd#lm8tczhUd`t_TECw|Kvx)xo~6Ga4dEf4#z__VGSj)#bJ<5R7=U
z27g)K^mO0Z8D9xL)v+0)%fd43IHdlJSM&TS`l`7Mw5bAV5lB5Hhn*#5Gn3zka){)^
z#nONOkCf&RAGx3_aq{WP&{f-}tD6IsTPO@!51CM`O*&m5f4u$s-V5yDStktv4Av<t
zgR$v~nw5x6N7ifa({}h@9Okeda&3F?X788HKO<%bhJV5A^@^<p2X%<?hC1{xp_A;B
z5@ip+sw<K9RCZ>_f-l_E+l#bF0rP_8avA)E_~w<Q2Lao!jhvc6m+xjb9bNyg-{{b*
zf@%rXNtOlj)@(P8m{i6p%Y?u3K3ev51|m}Gh)kK5h&x4WkDwXclJHirQ53ey@6Wee
z+B3&lDfV2W8|uH4Rt-#ca}N?bWZ3!{o^S@5tyjz|d+vzlXZ7$i)2xjh=7tjK_Zpvb
z>MWa44~y}Sk!k^yU#sYcXZXH|acy8gwq<zJwdl^OG_za(4s`gl1@>SuJ{qZ(8~967
zZ^yK|>pZyh4iz6L0d<Ofol!JCz<@`IpFCp3dL|VMR;#U-DHMf0rqx>4NA~E`cWSeJ
z0pt?gLs!BYvpVAC%$1c1XRgYu!6KK6)m|P#ZR@`gyKjlIfk?tG!HH5cjv&hw{Tfq&
zHjd}Md8pW_#8!}l?TP}5#+(dP)*db<jXm_0m^m_s+jE70>kp4<stIU(uwk;Zo!1X_
zg$jPwEGBRr5sp+lzU#=0uXDJiK<jd9g22HjzDv56ng6zCkDIlwgh|f3h}NmiBF5yv
z@mI8Q#;sAEtFSQ*Ps~(!loAn9g@c<qnka$hxQQl;Ati63f3SJjDz16Fc{p)+^udfC
z)!cnAK6y0nX*_0hZ%lj+#kW>N{K`I(ec&O98IPspF{D#`rzP}C+q8$0x%&%MUBTQ;
zIcOv%;lzJamtaz^BPaos{0`M3nklaDW@q&W*!$|}ud>yNw_Cq`|0rBNm>T)*?xo1;
zFY8WyOIvrUy6Z{d`RSd4nS8XehhyKq*u4Szeg5T@^%HMmcVF@s)A;>ZY3woVQgQkF
zQ2Tz@pz)YNv@K0$ayVJb^mgCPQ3%h*86&r(B9vk7y0I&D!cC|ANq&OwfMuj6uDUF|
z`HttbJ9QK7W8Dv*fJdvHbvp6g^{KYTPRnl(&6E@j(Plf2qs^6*D~29_&+|QWhWPcV
z%GGpz@tW+UuulJv)4Ya=6a7$GJz-T|Sv&Epys|;rIVWkT=2xm`$+z#X{ZI5Av-z&1
zS{}3KrGw}PL9Um2VaJFQrM1;h?Bkx?6j*m|pWU&~vw<CqN1$a|f_)!{NMud%;r9&;
z>3tC-%F}6EA6Dbt%Os<;`hTuUa<|h<%FDD*ObT_~xsoQ?z4OqnbDwV#E;anFxY}Oh
z+2P$#Gd>&7NjNFJp*Be)JMFlos%K)kxS2?0TcgB1@%}TGkN^Fh#Q*Id%l5y^Ia<rY
z4C#G+5lQ^=x%k8&`th;PXKJRG{@%dgzERk&6rn@w%ck!@Q5gj)=(KJl`p>C~7ZC%$
z-!OVMs*0jRRf5u$;^QR`-hYl#TI0IzcaG42<=wpApz(jhUyJ~S?A-*8A~^q<(oF~&
zKwEwu-+Jwk9OsT5aUU&J(vQZ}WQkOEcuH;$y%@YEXQ!dT+6p3J#l0NL-d;T9RA8xi
zJHhW+`-H~Kg|WdrL<y{~&iB!EiC43(1Ls~L2;KNq8;>=9&j<fs#@@7b@B|})eKhw7
z168XaXUC`7XrD+$k-x9JCC1S1SWcQY_77uA87kt7PVGw0Yy60zn&0P4gWo(gvVoC4
zZ7+%r*BbkyweDavM3Hwc9sgzwVr!jwjBlNcwqs1>09W*XqZjoisMbwi1WWLTN{xQ7
zt0riV*qo_T+WhKF-i}}I5ULY?X4g*?KaghRHC|`khjPDbzvA9((`lAkuT4xgjEgSp
z|D|w=qw2_9?H+uEAQFq#=mcy#7(RWAZ(A(hKt_h*VaKrnGL3rui=_Xm4UbnR8|pi6
zj}j@NzbWd~S+jGZVCBW>NP^wDv@`@L2Q#4B@K`~AkNvTu*9?N6AG{@oe&m#PF}=iU
zW{{S&TTvBEfpB7Nq-o{4mQO+qRu0{eBz8Tzch}GN4Coq*s&%Gi-bq3X1ip<?O_P5-
zF+3Dhxl&=JdH>Y@9sY(`mvexiZZ(5MYkD}2{V*?j7QXklsNH_M{j&s|;40AeibLyf
zSjgoQl2`6cQ_4r~{)1hu^F1Jdzjx6<x03hJ;EOF-XM<!_dd}7}%KBeFwZrcNEd9}h
zcsCWwzoIzpG~<fibNLL8Y)Mr7NmLc4U3oMsHqS%68*?u73vW9OyD~jVG#=%KHqrkY
zfBC{_Z>Uy9%m4!e-y86UL<&@nKiRior|q|g>J656e*Lq?(ic-FV{m$!O&=f{Kr#u&
zqQ9XYeLe~9=yhim9la%S1u1hwhG&+nt5l&bw~-;+Y&TsAp59d+clcd!q^(Dlm)c9O
zVB9}4wt<Kg{iJr(T+2M!Ebh~a%YH}{a!NdKqw<9t!xlxn4n_P!7{_+Y$B9p>lM}ZW
zjTCkKc^RS7K~#;L-x^f~T=N5WAx01B&rUg#j=+!TPMGUDnU8FB{aKdh(ZlEpe8qFy
z9)wo6+!*-wLwS4kV?p$(=FJw*56w)DO&WAuMm|^4059B;3&sRZUcMttl{ZwIHWmOs
zz#i_Y+a|Jga#k+NAgX20g}yscz^_+PG{Bg+KWxB@6Mc?mOwey;IbZ55RTksOHq9r!
zOlY6J?{jtCmTZVcgIOB4qWinLtKU!PJsF|o-wvw(G=0VlY#ccU*4Q??hSF6o-owRi
zhvKh@{6DI`Gpebr>pBp`tAbtx=>meHs5I#ykb4nP5J8k)rAQ}K0jbez0i-CsBVB2N
z^ct1kdxs!Z2)#oBdG|@c=ljO+r-O6O-fOQl=Uj8`c*V(*bm9r+Nd1_YNZtn^TV&|{
z^_ATBhpOh&Mp<o$j4eDh+IZ9V+43-ZGc*ye^)z|>^{F|`9?9dGv_gfK;50D4;rk}n
zea{}+7^_6YcpmqPu2b-j4?k!~+czT`!UD6?t-fZfgGng1UG9Y$oq*{gh-J7J93xn3
zo3Hx?-!q0zC_h4V>~3U^4T)W3mY~vT9G)y?DUo_Js5i>MuGom{XZ+fDR5w1dbi!1F
zOQfpmu(yeAwZ%5{Mcw{%=v2y|nN2@6)sXsFMY?Y{cX~={Lu59KL@_PyL8R<kF}cNH
zdE_}rR7&bU#rii5M%dS)k?g<w%%Q@>V?HKoKg7bX+@{2k8i*aXAyfS(CbOgQ*E-Js
zKPaB6sHT^E*2R;mT-;;C%<sPFm|0ogcKgAKk{~}ml17PCqwbjg=8jC4*G(h~6he;M
z{@ERT*H6zxwpngvx=G?YF^{8J_^U4S>I=()qX#NXZvF{hZkUn}@w0k6(f!I7Eq@Ld
zC-c}(zl&w|#v4EU5l3-!K*9#mQ8*29@yttEvNB<$+<glr$7y`mk3E}P@aPeYZoa4h
zes4J_eYzBvKo!gymie@+A+~z!MbE(A^J*p|BNZSb!CdY1BPEA*x>HY0y^mxQFt~Lt
zxv`dbhG6h23t(z1{TgwB`y|PxL>-MbqsgygV0Y%e@ZdTLT?wEm`O1GM3)?o=_Ey?F
zUC^uI9CN`*BE7B1NgO{Z9eU2UXAhMbs%J&&E#SBB3hg9!k{*Icqb^jaeM+r;V*L{-
zWoke@5*BL7>(ajkzMH&+yy2OjP)~opNn7#S8L2ZRG)G*S58}1H;AN$=In=}Q$-5)=
z2Wg9J^aeDtse~tIf6e#hc^BnBrEYjL>(z=Qy=W(rQih#I&Pv_P@hdU2bgB{qVQXTg
z<Ydi#`p`RmEAq!)fSbgiIIuJ7<>l&5KH=2UA874w3tLx1`^y}O+erqL#Wq^;F_C=t
zpyEMTpB3A}xz$#_azA+#5}6+$H*P4)m-Ev<Nw#@gsPP0;$qMVu36Z8xtHf-jDg{SY
zZgva1tp8VNRo5LBNf;~tEC=@uKXTb-Mx*d}!y-p*P=TeqHewA`g57Glti-r)?R;82
z-m3!(BSpY1W358rBuM+_KICA)1fRPdddA<5_&HR7`(BcJlj?eimFgZH>UpfRkz82)
zO}#7QnLImkuOG{6I5)EQ%oioiG+10F<dSRf0m>GkSA&#-Jw~VAw@@1CJv)2%mmdj-
z3^NY0(L~<4<4x0Zr1BzaE(`2d*UZq;<p1<d5rv-(mEv}VGAJ{P+pjZ*QExDAUR@L+
zn&hQUSjiDG3-Zpten7FN$_00|(T)|(wN`=vq_$8-dV}oYTKyXlHkOz(w-}CMrH1kM
z`*)A`(<Z0*Kag5tqcwz9jdOe6?v1fe1V0o1R_EW8?J~H<&4`jpiMA-wGB+GQ0}SBM
z>%|m}@~8?s!;HV5r2N~NFn)H+W1Jc4$b7Np5F^+QeU;47|8}b_QA#M@x%)n~po}2@
zQv(v@BBQ)+H=#fyct>54#4|bvz|cn?*~GBF>=R|vYsDn({p(5itCQy*uHXlJlxgdO
z?{Cbu-n(I^8z-7=s|10xvQvm(8Rf6p=laVa_PJooA+~Qj*8Ax84ufc$^3_Dog8Xi_
zdc|2qx=*C!Wt0?24dvaz0eN<eAqkSlBgT=lpbN5W;QcOIT)=?@tPp-wdft08^VWt3
zjxkamcdcx-V<d-l{moELPdQd-;$q33+tIH2Xr3s=Zognqq3ehvnhQ|{%#9tZwz`r%
zv(#BV-SQhfSq58*CMD+s$69|~yG!~kVC_|=anPz#dK_dxe24v8C=<@)A)`;duTF#t
zb6XN$_C+0<MuGK1yVT0-`Sf36sh>lyrt8kNDFQ^B7S5}rrl6|?7=e!PiRnHvM-%kY
zj@ZfR$?wb5<Yh@of{1^zvrh;n#_EH^9)QAUw|A`I^*TCmzr@BnZ%m!qI5W#|v?9K!
zx58hgIc3h%yuuaiPI(Y@0faPdBd*nxoAbFFhwL<b=+3)IW+Du*rJA-SOW12Qr+@A1
zH`S0X@hv^=O290`2t3=MuQH3qsHc2;GUt2l8{bMbgdOEzk0O~1PrCTS*TnuH>K4;)
zE0~2rIY%I?!(-ce$yr1z>WEV!;EaQGG#S0$gl95|GEx#ht++I&9n$w?{C!G!5mE|Z
z?nPhFtd#YdZ{|-Q{Y${Qz8AvB5A6Bq3WfQv7oV}vExSEa?^|h$2EZbq>OUtZgdJ65
z7RB`BzlY5p)GO7JzUt(3P0dd(Z)oo<7GYz?N46?)HJC&K?~e2wA4A#Z8<eN=?A!)O
zPiige@|K&KAL>o0CE0|KDfj9~P{@oLf0Oggwi!+14$*6ZdT}L${rUit_><=oMw9im
z)Wns_V-jD;OzGAJJPRD3viZFZDXI94a~&#Nc5DfE$8K>3vWrP7M+?g+CyJJ7@o*qn
zzFK@AHRky>%JJ1|rl2r=shC9i%AC%iq;pt9&it)$R<&~>@MXkGmym)~z$Vroo1f)=
zHE;1z_G*6FH;aWPUEk@KPY;^|W$Fe15o<XxbeCNls}apXs#H`1gyMPb_x^BcZqA@i
zDwe=Ns3df_dIjgMRA5)i!S5pPQ`OCt`RIPs*9{%5;q>!R>bPB+@FgCTOX&;Br~JmG
zu-#&&0gF_WwZOn1^062SW#lth^%%!OQVobaRVmDQIC-g3<=oRy4u1<$qP+bdD)L}T
zHr?811MA$g%Hp5y3&rygNKEN_-~5;0>;7apyh@Kfu<P;EWcpbrKz=!ms>q`cIdk6s
z;VmO0BdY1UaeBfXCkVO!`tYF{PT*aZ<nv`1mc+7cZ^XRlcP&hZ$QpOz=<mm#MJ1{2
zxSI85jyg?UC5NTCH%a(#O=|ZE&BKGB;)r;|3h1+AH5r?HG!L77kapLHJIk!*28QDU
zDfYh2aK9YA9kOzx>^=v(k|q~S6F#N592kvTrY7QF0E-w`Zr8dsu=-2T9o41ZaQHW_
z$%*QllzZbOj2#TgkXO7`lWu7n6&wMs7#4B->d&5;$Qr3C!oi9X;c$ih9%gS_-EwrW
z%hJ){iqS%<u=Q-OFtYu9udvT^ol1KHo#IrUv0~3T4e~Mx4u;cCPx%?v{3plKgTgQ}
z%P(lltiydz+Fea5?TxCtGG{i?-m;8bcfGJxk(-iB?&Ga1!_esDAZzGUmXr{%v?tkG
zx96#xtCKH0^TWuXi_0*pEZThUWBR1^{G@IGWuhl9zg0{uJxHBr?BXAL&RE|TgU#es
z-nw@fBkTHXEqsN{W51bDjqO;*Bh48w)=zulCOzhAxCr`y9rGWK<9Fsf?hVW}CFZyf
z{V?X)0K9p8gZ@f<mcL0GHMxEpSp~+V{8n?ci&q(jD$Zmlq`Iv-i;M$vMo06eGAN2d
zL0Nm^?YBQ9)040n95QxSN^ny4rQDvmc9ay(GkRiT3BVt9k!=>fE+F>F_}|x1`ApKF
z43b(d-Q3KO=9Qje>bTe8IV;r7WPV#n8mDcZO2Bszt`*ZX;;2<vWkqK$z@N1Z4zY#=
zc$Ota?r<H-W>HStQb_6qhy`!3RBKTG9{CaSLw9ez?e&6QYddmzu4LP_>N93-;D@(&
zOLbL|L{W~O0Uh4)sVqaglb|#b^Wn@&nYgTZf1$9`eps@D`NH%m`KJPgS?(jj`6hQS
zc)XsoMcfUlEGvybR?pW9<Lg=c^H}Uk`Nr%IT<Rh&b$D-o>&AFWW8Y88gshzK*>E8w
z$`bGlX?U;l>N(|~$eV`=l?RQDG-7GGcgOW?<UX!k+OuAa0;I5IW3DAp2&sGv0LDqi
z_5A7Cm!ol=eQsgF68!E7D}oXMqpPafh|Z#Q^uh%xP3GUj<)&V^+&8HBz<V<rzha)Z
zvsoDJQ2LH8hUT$sP|TkCQy9nufyFFnKHz1@3J*~^-MTk1{cdpKk_^W=hfp4WZ_?Rb
ztV8cq?~HA3Boc)6aj}LMZct9YG|`kp@D1~73)fszn|(P32&(^;9~+JnW$0+kWE*lx
z=IhsAgd5NMnh<=`Gil2ku}kjScs#ccpVeHlLA9OZcc~iQ#4{6nf&2J$FTTw=b&2%_
z*0R;eNCKOLv75ui!*vE(6<OSnO1H=WUfgT1#qj!A753tao5%iIuy>gEc28oe;lcXc
ze96FJxyAY4R%fGRY#kjIoy<F~6*OisOoyLv<ho;rXuffZj+*?&b36U+BFX!9GR@TV
z%M#1{>ZLXKL`q*ktG&0qXKonsjcwU^|HM<00+Z@VExH6!%ECUgrV%N_<}-3Ru1WI?
z?u;>EgGyv|dm<A=J^We)s-)(?c0L|p7~>l#uukjFbvR6{_u;ohd}0p8vyM2O%C6Xe
z=VeBkHe6qgEg!A6zV4`0aN~PPf8zu|!|UtyWk!*hklcT}>IHi<cB9&!RSbb4|4CHK
z)?7*d2Fs#*6HafsLw>Om@6Bh^5tqL~eOP%yfe(c2bRK?^q5Hy$kKqdfZaj8<Yb&7z
z6F+{C>q<W`Dm8w%?c6Rg_rx(y+O#obv$&*61XNB>pQeVmU}^J^Z;jE@7pUvskC%N!
zwBMME(7YNgXzLgwWc{M+T8QTT#z4Bd(^vF&;<h8gSU#@PpDyF!@tL{%K383_yqK}E
zPGcaKin$3P8m(E_*e16p^HH;HcX*&$r^y2`)Nog(W=)#3ltqvo!|fT8{y$F==FL<f
z2aUx<DtaqHEdk4ve~5rFNsaQM_^<yqQ?E+%NbfbND5|(OKklB-ki8<k^*JL0X}Fam
zZFeOk64#EDoO@~E4VSE`(#@v-`k9O82M=0Ajcob5j1u4B+z+4PSQg#&1%|SrD|zoe
zL@sp5&*Qfb0ax>%S=lJqb^nY<dSPShwm#&AdR9$ixeaAiJSS;;01$ih*+UL_XcM~8
zWGInUGmcEq8$~{pJ=okV%#bM>{K$d)CxqpMV<<YTiT1h3U(-$>Sp?Qkle=&E>Zva2
zNN|WzXo;Y!=Dz3dpmtp=fEeLSuls5`T(Ej=E3Zs}QSMLs0&Z^fFObrM9m7+I_Bzz~
zJ>Wu*8j7Vgt&Y5VOpYyt;lW;uCOzl8R}VIO5)B?NswV_6m0gQuAzQDWb65Api!LMR
zbnx;1K4T&wnC3Ph!-e@6e3aoIODw5}q~`s$JfCRq&7WC4)<A2W9z`p+Ul=lU=_~0D
z_SyUi5)?Kd-4{>qV%Od{5;^_MxBr4t0A&y_;Jt|9S((l;9Kw*WS4obrd)TxSU1`-Q
zR<lRF6Gm2@Av`?TJSRAQq;nWj1A8pP=G}i9cYwxmnFICWvi<!#HalOJ2i_L>(b8T$
zB2wTdZ}=*1R&C`V?++NdF10@c_`qMfV}qr9k9Pqt>SFGp)I}G9X>Y6R*ZXT8YaFnW
z2irx!%XqHvGhnvTee5(WEywrLeGJ+-#R{fN+BRb6+?jA<HS@~zgC@Z)K1^s_OM-W9
z^T^f8dF9BolFAvwZg2#Og&n8c>YAzC!vSWz4|0~lMGlOQ<nVL5iy<8zc4zI+IU?OA
zsy@jc`V5G2m5~|sw|<`gl2tuF-fgrKAw7n~CzM?zp@8eQM)G%VXS12zP#|SX>H8Cz
z?|utk%iK&tUk<#_O!{xz#uF<lw*})p*PG@~sfb^Rf4=aUi0`2?p_GA<L~5+PvEwV9
z<s8+}rLge*Jtr3Cv}Ox%buwezPI!m>q~0pK*mLLns=6%0gD*dpc{1YS9!kz%9@sO;
z-MEX_zM7clxgs$W_PG0VhRi1mszzm2Agl9j>m&jildpc?Zo9E=fZBS*pO@X{aWYMk
z>}i6&kAfx~9aB8g9jD#X?ON>>j(gy@EEMRrvJu@XO(HFwCXnvqpFsB?zJ!Ev4k+H-
zsSRf<m-hZ0Lm_yINEXqEIx5d4YeVIl{h5w{yS{a2=AdqbRLNh1HUYl5KSF%AZ7<!*
z6VG><iU~V|bpO0tX@hSQ8w;s6JGI=5K^lULm67GMS|x1xqZHCv3!T?;>b}6-V?U0*
zGZpz*U9~+rau|cugd+?-aO&chU90u?upRh!do)K_>>3Is#Wne%kKa(@Ut-&C5JQo0
zo~Gu;cX-=nxjO&rtxWfbx=`46^jZUZB45??BuIYMX<Ei!vzt6XuWMH)E8ku^#5Ti<
zPpS&zth=(Mw5P?&oj&j~;G9rm4EPOQOaOf=?`gZxtAQ#hc1$0}@#!typ!|7GO)>`t
zU{>D@WVG;knCx%mdFNYaeboC;e^6LVgkL{Iqxj~1_tziW`))kXRV#2%?qW3x_dTef
zuW%acpXpcz+z822+_ZPNQ;lVNlH#GtRBt7dlE_1>$W}HJF~Gj+b4Kn^iuhrfc90^u
z$}G#FtQS>E(uN>YG}QfYp7gt#TB(oT8X$-UGI=S*NSG+<lv{W|@@!FZ!sMIf%&g(u
z-SJ=OCe}wrhdTCy`ong7pxzT;B-L8LHlGn6@$mLq?WU{Gjw_Fp@bkPmiaDtD1Et{~
zKQM#?Kg-=f_pFb){yF5cZPEGGuYI@Tb3pUwp)zb)zH0mSf)(ty4f6iRT>H)9Cik^~
z4p;tL-hZr2l;h|znzhA+h&<M4VgX%5lJon$!-uSXjrik9>!gO8C+x*-wjn*Mu655!
z4{hj{maRr$Cfe&t^jh2GX_3EPoN-lAK0PF_*(Dp>lyxr~s}&6tmYdsyhrjwTDl6_C
zGr3K6dZ8`{(X&E{dx_3%!9G#x4-!J`;>B(NT>WSPEV#zU!NTe>>HA!WU>36HNLXY2
z-C*WupurU_t1PRK@)J-jO&FutXilymQH?%ViD;-#i9?poE(d!jda8f(`?19Ll!M_P
z8Bn59L4S-Wyj(dmm(d@QCNJnp?2bjWvoRQMKS6AJ%-G%pcSbC7G8}9q43`<j23S45
zs`5Y<H!m{3l}GTI50N`77~RhpYMCZ}u7S<N=21x7$O+HI6!wR-4Z+G4NX-I>Cq8d$
zej-d^v(TB8%9Etqk)}@#%hF68U5(I8a2vz&U9T(ZV(D<l{B(mF6i|>bkD|BVx!G<t
zYX*^;yxUh%|In=Q(|lk*>un$TztxAsf4-qs3VzX>()~DLeR{I35o-5ApnizrtAldM
zY2MSg8Q#SeY*|ZPAur27YF}1NPr(&s%lg75D5Ircm7c#ppP3Tm$h$qEv-wRq_0?I)
z%u;sg{jP=!y7wL=2v=JOSXvr{t)E{mTQkMlDZ_9J{fSwJRhGy(H-JcAD?0_eDH*6*
zc3D<mR{ygRQ;Ze?@7^w{d}{O|`6v1mfwrxMeEHyi4)V?lN`uvx45@iOOE>DQU}dGT
z0hMKgBSlxx<EL+W*Ob>4;p=@g$!vi_Z|S9Aty5%d3B<q~Gn0#NWjFt!H4hYW&?s|q
z7&1dX(DcHxSnl`UuNxVGnu&*wLg+W`>U9V6c_R@|b|jsH#|TcbD~9eZA1jrcfU+5I
zfqPx?O8vPiDesVs+ec=fq_>p0nHr~Bx=6C6E9B`hod5N+_8g9z=hzU0Iw`o?LBKC;
z))?;UL8`cwe!i2EFTOvAv-gnUQ*(^I-C?6L2UbeA$A7l2Ze*}*l@LwXbAAB;>b&HO
z5Nu<|%_^Z&k`SExqFHrIe>digzd9NBd-lh|JiG?td8M)!+F;fr-H`UW#N+tABzqvX
zV+^-5I9l7=2MZ}Fi@xok_u?nkaAkaEoTPSuuojMhGHT{BeE{B_lz1MJXDHOJJV@Va
zH;rMPX*>#j52279hnm?2*$2uS<_z-1m7B$rPgWQ*n5BC_pNbBtGv_rp*BX-m(IBk_
z!o;g{qEGv^XrC2{vn#N<oBmn>8B}kLdnae(S=y}Gna3X1PF<-5W<M8<>ptGC$@Q#0
ztcZLr0-Nqrir|Y$gii7JDkU|{!($ugHTCaN`e#JIH5Kl7ll2~<No@$1zajI4^%<)v
zS5vwlMbXy^)QTrg*K&Dr-m=a%peNmBsqS!O{OeN9WFO+f=?#hT;xr+b!jja=#r^E)
z$2}^!dk!yJP1sBxWUpfWrj*%gQc366->aFA_#l=BsTlIgPLCnINO{B-YBj`<z-{Jl
z7JqG&pFovI;H%)VUIU`s?k(>si`oi#XnX3AZgO&r;|JPU9~KW%fd!h1!;aThVn$!~
z?2J8;?Q(D$(9!s;aR@X1Nu2u~=%4I|tD8d|o|0`bf<+eOzxAq;Eyz`SnFo_K3}<U_
z1qAn|ML*j5^hiKqAPn$N*Mqg1UsQ1}{o3<0gw29YKNY;@QxT+occt?`R*+y;QoTV>
zKjds^AXM!-HGa+&<iNHEJsHXmBlR2|eoBbu&eu2uW}A_Q3=ncGQH(SvKffVPVSsU^
zMzI5Jwsz_Rdr?2*e@XM9D1T;g&?oOv@o`iJ+QDpYIE=26xn!cR$0;=Ozz{Q}L#GNg
zm=m_Lh4e-)R264!ZuE72lI!{OmQBazu^`~kg>JtpA@%;pI_Ta&&AXk1Eu)=Eklp}v
zS>k-w9`%v04>pmooX~z0e}PtzT#zhd#;*Xm!IH*LQTe|M;NryKS+>4UJ4uKg?Y*iy
z9J9Nx`PjQcbfqLdpmzLAj>bPr?K#-);x?(sgAOILIdyi3C25QoB?^Ao66()yVAIW}
zwBJw`OP_yyH4Wq?HK6o|Y4Q&hde4b+?~R-3`dW?EuzfjY1bU~&U?@w!7IdU)z1pGz
zkFqYKg&w>OxZTIE2r57mwn=QKSea;+xM#nJ2+ny*CX(JQtOHG}BE=iXB6Xct-_yDo
z$1|5!v|+GzPQz_&rTLL*%bWvfW!8<)yGJkbgkDW$sM*CkH}hPLWwajk6P%m<r@bxO
zT;^&#A$h}}_rba%{h8QV`WsQsg+-~#*x{aH-uM`pRl#)xz<_g}kfi6j{oZ-VEVBGL
z+w`!Y%ni(LtArD2T<rQYFmY3v!j{HQgtJN2r>KJ7smR}{p2uC%|1;u)hA}e=Td1zx
z-37?8XF<J<r{<C61z$(HUG^_DT!{^yG8^t~$i~^p&ub-#vR{mh8bdD4FR**cDl^Ka
zYkg03pMTjqH2x9veR5ErA5z1xBR!xU^%^CnzkPS7gp5_`$*<~3#@p<q6bbHvVd0uw
z-H)haErYnk!c}|6J2q>GrHzwcPW?^GaeTN{D1mBTNpye|47>X*#mg63(S2wCa?ha1
zClTY{)^a#E>0`hqowq39H9VcH^#Y)!<<OH;&QqHOjN*s8Q$3(tl0SJU0wfh-pXJst
z%?e0Z&cSNA6a2ZC&D1M8TrPG1h5xblGm*B$a0vg6V&1#|QBLZ`R`+lQXWRJS?UU}^
zxS$03;ClKIr>-RSOdq=`d+QM1Ql69l<y)@(aJTd_w|;b|IPv-3>9_7f1gNvG$5>&z
zmn>}7y$gssAp`>Xp-%&4nPyp+<|JNhe@l!{AmHcHfY9aBJt$ZLwdU#C_}$fEH)6t8
zWct-7d@_AzpB0TRekgglyX=~)2-0k-wS{cnr}FnMtQihR6dZ0hagJtf*T1ilHHe7C
z?$iP`bBC=EewZX8Xl(r7Q3xN_qaisBWF3*2gF>gSn>F_jRZlPys`LG=_bO++@|}J;
zjmI&~yPM1IAltv?m*%_mQR}&m70GWXjWcr~U*+36nRj>gYVCX(cYAI#R+>IIY1;H-
z&k|}0ny_s!?ns%i9Hnt+z(bFPMoztj)Wnp8I*UKEWQL}9A7mbJWrQ~M?E_1d8{56@
z9@mjWrQEh7-Ji*lOmUWTV#cm~e$rA0_>2L!jheNqH4jv`yCh!p-7x%6A9zvU=1eE(
ztaj1$xES_OsRlmt&54!te^XT1*Yx`lmk4aLtLRC;U|@&sZBlAM{A31Ki6m&o7esOq
z`(!BK+U94gq{dB%>{<LEtq<x*-kp=(i8emBgzvZE%e@vBo}n7ip*~)HiT|xMkk2=F
z8)U~t^f#=_mt{Squ|StBsaeXg1Y)67358Y_CusBAxrBZc5nZw^@~s@Zui&Ay*4nHq
zt3`&^lN(!c55kBLrFT_Mcn{|!#}y%BJ-+5ceo~<}`@FR8gNT@$M?OrH4znAi`ozq3
zJdEFAXkJfP_qb8Ldr)t2w(&Kga?{6Pwi4)=%88OZ`c7@Z*7E}$EZovNrW0K3d-nNP
z5C+#}@<Q^TF16c|t-FM-I55XEPZ{)&nJZS$&6ukj{JNC4okWJ-s>#4&Rvbv^7a_+C
zMiURq@E`+2<E*3%ET(X$`g82N|Bae-qAAC>a$VDzdbl$nYnAmt_RZ5RW4z6~8wa`%
zDx9$8h3-EWlK(CS6##-lp3K4)A=qqGo{%iV7NO(yisxKSI<TO;HWu-%RJ@DzPpgyW
z%X9vicS#v`;DK2PoV#NOYwY+OF)LrU4SXN_gmOpzP>CbyZW9g752TK#36b*f=qXlO
znl@>-zoROJ-TyesH$zbkGTZr<y^XOwP`4V&Z2bA7EU%d{DJvk{d1rGu2RDIluxu`2
z>cxBpwyr~bCT8{adLvg)PvUl=@Uu-`04|v1e~BYqyNk~I;+|l}GWIz~pw=K@Tggvt
zCwKETVD^}e#iQH0P>xJsKmp0?I^U83jgqKhDAq>^?C;-s3hluDM~YO*;Wbs;VwT&j
zpP{Bq7$#^b;78!fkjLxd(bTTt0%73w<MLVvO|%aTpJ3kj)`dQ_aT|R4HVvCsA=(xv
za|Pm|z@Xp{_O&RLDQRa}*~=@DpBW~p8-T+AB}^Dry5oL$gh>#4RM`RVxE6F}oQO8d
z=2$dF{?6M|xv2Pwk2UyXbSp*4SFspq38k{3kLiVGQ_R$`5#|bxVoNWNeB+<sR4KJT
z%{}%4^z6+gBD=FZLk-%8U~%8B%B=a#Uqt%oHV?Ex7R>c4%AdbgU75l1Fht<W-Ij1W
z`0AKgk^VVK-wR5Q!Pedwbe_|m>tJU21DvRzPWXU1MRz458De30!M%zZKSaKJo9P!q
z7WG8f*OYj@SW+wH-Jnt)UYnT5bU*37yfDaIXrU4VmP*KhmXUZ!XCh-FLs@P)(fe3M
zIkE<)58?jLW_!uTQq+MefnFWh^2Aw6Um%`zf4QL4GwsI=YrZ|ZIusa9T8PXd)CkvP
z>WhdDqJa|S$h}(nZgBFKKK5<NsYbhph;joxeqxadG@e+TlPMYGl3EEKQ@2^`sK4$%
zQxaBUqorSYAPF*sbLT%NnLL<01ivOy%B&F%G-H7ERL340XMBH8Piwr~K{@}5uZN+@
z7_Pj%0kr6VzV2jx0%nqVmq~7q^(HArf)Qm*@ViShH(%}bLYmD&I64WpZMWxtQojUP
zP8PSFeguj1ld9HleYknN%d>phVoKloo1Qb|g8&m-Zhe_eHro5F;>AhLbgNdYTk9i=
zjj?pITd6y;#@Q@Cx!$&g;esx?7Il)t3JPE|;P}e`z+{j->Ew3crx&hNS5(~pyh}~M
zJM;dm|7I;9a2qCsn&O;1$L2id-5LE=$nuy#gRPY4aDN^n>Hcqi&ANVxm>pRrR=HF1
z&}k_qysmntY}Ms(Z%*t#mMNbpLII2T`a7=fVDH^m!sh*(#!9}Gb$2hW@SBOxj>1A>
zdmZ5jZ-a|Ic$2Y{fyWjAU(`A?xR~ecHFJs945)#t8ceaS#w&XrR~y`cT>p4f?G|h%
zhB~}8V#K{|^4YiJbqB5}!vY5=@&V@tk1B)!`0!;-_p4=b6_nDhnuH0Q<#3oEG5m8)
z%!VtUx-{?nxJ6fwU1tJv@33xcfKwV7x-_SKO0<D!x<eyQKzCInXa=8;Axgcf?Gy=Y
zG<(l%Zz=u3SBU%6xA(h(AIetldwfpGxiV8V3-0sMfFtZ0iEVVyLyq@YF3bJ)(ZJmM
znbl|_Q!vOun`Iqd#e=%uptomS5eR9vu)%)uogW}hDlaqx%X2ntLgu&jF>#v_6KK8;
zo4I*<A4Caaix%8JAQszbHR^YBuD<N)QTNhIWEBX$YrW&;w}HjtgX5>V>##ueUC0nM
z=Js=oyR2EZX@*twx5RCz$=Rn#NV>+y4;)!8#Va=N%CXOHkO}{|4zCb{wML0bfGt_e
zO{1)e*mfEH)xnfP3K3Ng_|Bc$mM?~Po&JNuwK)=f1}e0@MLw#rZh~t^3L{vyh6dRf
zofw7-9yc-7z}bU<SMJ4V8bcnNoD~aY=rorhEEjDT+YlJ$-R^M12Lt*zEHOf60)fA6
zY4|+Cq!%r6cLwyfvBQsL*!R3M$&!$H@ExYTV{{?Q6m^m2XR{{rh94BKPsD&1+SpN6
zn&N@8Mp7o){~s<=MG3T>NMYYoy*~azzlu|P|HXvAUPX;%EQ=uI)y}yQK{V3+JSW>)
zI#?Qo@)oe)pU=n$;Co@~FgDXCw!VE$KPzR?J8&O!;F`B+1#6r$?tlLoRIOi<0(RDm
z4zU|kc%nrD^qi__92{I)EP|jbW)OSlcQf8KDiucg9=oiG0|4y%6EztpO4@n0tJ{&<
z*KM{8pIRfek>g*>#n}TG+La*t!CC1|)d8IoxgxT1;dADVPVEvIfJY9WH|p8n4%3_+
z91+3p;FhbSojUeh0S6uu5`mQlht0`M>PcvlF!t?K)N2|C(>+B~8R*Un)WQ{e)jO>l
z6E7N1MxN54Ej&Wvs?2c0A(H(bWZZ$=?7+ItV=scHhwUv90L2fO$u-<-)(orvm`IC{
zQ@sMub8kCg+4}oK-GKwBZOMPdWA4^qp9jJYhE~6Nz!BpKzg7;H-FEJn-28(RnW5Q|
zku1%-PIrhg15(_(Qen<@<srDn|BjJ7mFEOpldk1@$xXv2ixS8@Y_&(Ii($aCcp#Ql
z;&)5)Q@UFWwu5tv{PnE8gRWybKJdFY1@u78Gsyn4M!63;LhQ%~2dsw@v3m!?Vz6oT
zN5GW}d|%A4QH5q#c8B&jA<}EH^&-IRhhDB)v<h_NVv-JI!D|7%fz798j{Va&kDy3c
zI~s=}R6|a`LeKk;bt;~jb;CM0UaG4EcmvxOgOa`v<a2?ayZzNU9p5@({^mN9_|$u$
zZctBqKEB=v$N|*c`rAc>Y;IUV7ManOe=^O_(=gDzEUyu#PaxH#cNceR+;noRVp1UJ
zs+vr}x3gVC=0|qw=p~+Xpuy}#HN-L?t(~XFJ(tXAf(5qzoC?U1_Xz9!NDchJlUm@<
zaceulK&K3Izv2t@OiL`V(w{;<hk5zbv{J)#*G~i8k#0n=@^|Hi9xb)KGUGW7<n7;a
zk{QHUfLj=;13O)^PINGloZmXd%0hF4a+Pf2q^In}pKD#bOedODyd9yet5axXw_stN
zU+5xRJyc#2P7WRT76OY;?0+Un4pecj<L>it;01yR81O@mh`Q>WN@8D*1XalWb<CcV
zc{<kHBWDf49(ZyT$vo#hr6<lnd=(L)5KS^S%{$Y!nIv;B%KO2D|2tzIdRYtHKYy;m
z%uGU64tS0`$?!|plq45oR&Zka6}Q?)1mCl|f3wbcIiS<Vy?)(%ckx?dERj@1e_V+y
zqv6OSH<}5nu8^gthOrFL>GqC-j!yaEK1QQG9QTs*+|jZN{Eg+D%=FH7-^+p+4!F0t
za#Jz(WXL~%9sdVaeYm?1R!^%7*6AvrojZ9bcOX=wUI{=k<Q||a6NU+Zo7?$bELryq
z3a0p%bZO@3MHJf(m7VwH_N^}S0a6)J4hQ&OY}~#In@pB>#-w&3i01ent)xV%X?2(k
z6R^A+exM~b=e!jsc*hTSLRK=~R{F8hN|25*RR{`SyjLk9q~?KjyaC(%`LW-_n!MDc
zWf%hL#(rxUo!Q|7Bj4qd^@ryUHZTAa#{!2_vPFLru4j(hxAHuCJlD3ShR{X^I%q(^
zAWE+GSk|^j%V!d(k8_1SoP~4pKkqLdd)CAyf##_5>nS?rRA5c_?jHZIXK*fs(XiR}
zgoI%YD;Q(uzxv)D;xz{~)!#(gqD7>o7aj%Q%2yxr<DDxepWBw7i;o2Q=QnF9DA5Px
zz_Ka666y}6$9$Yj<iW}g#Xxo!G3uJGt;Z;AMym;T;#d^vDq55b6eqhsyl#+DeQ{B5
zCpwUSPf@HZZ^PN1d2I^_Sw8JPwlgx<qd^xdYPK~dV%@Rd<2rh`YMj?%iKoLj8Vh6s
zz~f?o{XlYi(1f}EZQ?2X12j5;x^laSfqsN+n)k{2>FfF<WQ+66J03V!c3x(fD9P6k
zQIB`AZ!5%@W&dE^J`r%y-@}Ee;YcJ=NCNI_78>`a3+Em)9a-sM@C#!0z+~0E2$V|z
zR0G7cE_~U}Q|${KU0)}#3>00+5_kZdXBVAXyK*c14PCwaztnfc%*8o9goc|6O}p@u
z%;V*se|i-%l&B5$!M+yf3_4!Q)0!IoTwgSGTQc})Grlsw3A)(kxK|Kg>3j<*M1-Js
zmDB$0xn_SXVoyfVt1QTS-<~~C&S8d8+MM_gKWlGr=mTWe0JFMa86CK9qCEbl20fgZ
zackF1Am1dU{tg#7wE2!Hz36_|`;K612P^e@tk9+RA@(K+t{+jUlO`Vv^mb%2%;`u+
z#_O4p(w*D6=dgy=(D)K+nA`qk2?4kG%dFss>G3>-a2#qBCg4<0M-8jm?YDA0V+j&R
zI%vqLZFHZg8>wZ6y>C#y7SV#X=C2eW>TotOq5ZkqKv;-e&H(Ubnlhj(<*w+cP;Ze=
zu65s@V>JmsUwe(>?=6;`BTmzAK7wZMzKtL9*U5F(z9m0@bf`D|QNZ+LXAVaM@WRS<
zOILDa6EXHn7S=rD9MxviZTI26Yo&fo>rCQvaX$B;_97U$phM<h%3R{_`m%|VkGkOY
z!&p*9bF5WbB81ZfQ;_rFa|zfi&w)s%**H>+sNR4sl;qmaq?{drW>YiG$bHypSfn3V
zZwZK?lHHEXzirfD4Ztvm1~m+>k==rOlV{KuN6#A-n_ICw3=Kq-@mYK8??-3H$%a;K
z{}@OGDV2U;qu#}qr{?>(Zs5Nzco}&(I-<Q0kUX90)X!RG--{l#TmN)-8b1=kl42>r
zw4{556=@tKiQ)XNvl#LRH@EVGBa{V$UlFtaxiydm!~kp9?_aTBq<PwH$4a@2O88WO
z3oY~zgXMEn4#&r=3#ofu6;lC@3+JCM1L>fv#-I#f#8$#6%fcaMc^tGa?lH;Q72;BG
zN5Blgp>yyN&Pj(V)s1ytQkEq{5(cKeTl!9uMjpW26QN@~-gm$y;^ZX3ra|dn#e2j5
zrDmsfszvY#AehRjPBg0-fBf3>TvG0&1xvS@&a?8fQe@;$=Otek+oU1RH_m#MnCKdq
zwS2r{jky9^KmyLEuecKkPM0nPEZr+e^@vDJysBa|zpxOugNt8@Tk*npw8N<^V2qzV
zP<-Hvmo5AbJXj{T@;sK{^$LPz<#nbehOPNEzf#!!a&$%e+2#drbzZny|9140(Hm-w
z9Z?u7%Tho#nNiOhmo?zo>0_Ojd~>WZXTCwzJZJE29^gHJptxg1&pFXU=o7ar7r)hh
zbYfRwaPTKgJ966ndDRKEmeSikcnhDUvR@w0m);FjZHt^^WS5^Xrbh+p7Bws-9<F`M
zciDKO)Ab^=MyOr^*P16}LEhMYUmGsp53^4#;t@sav9ljEDztvcHTk1{S}{gF;5nGS
z*;`%t`mcAse?1W;XUGT(y04}#b>9phcy!}&ANcKqq(kL%+74M&IXukI?E(fWXZt>C
z_uYHOG<QCD1L#nVjms3BUrlriOGM@SDeN7MwO;iJ$HJCvVU5h!3dEl&Ul1Ezebn&K
zFZkj>a$hCA$Z~x=v=$RLDG#rw6($vgOG)vOb8?W+{f)9&_gvBD)(Wr=u>OM`Ybk|c
zy)|S;HmN1s^ZgfHZT$u+_n8}X{es1?xeJ%Y_{*k0?q>Mx+bj;3<@8T%R8_#JDrnKd
zF|cK8nD{XJMccQ=BN57AV9}?Q)iUVMMF?L^I4aJdAGd!xoKcVmJCRgC<7T5cpLyqr
z%lSw3!&*mh2Yo<o0c%u%Bep%UOCzEUS$SPBd!NKZyXx!ZD1OgFr+n9)AjU=8;6(@a
zA>JkITIL7N!*&lA7<U1sFV|Zur|Cd3Z@nKilBax3Y_pHF7!DzOIkPO+=Xw-(5ERcC
zQHwnU_Io^Ik2h2Omm(SeyyCNG2*8b*VFfBBR<NjOlZKkonLada!s@P8jh*rmAB+pG
z|KY;70Im0V4WgI<n1JZt`b)eY#;(kSCYC<Bgt$bag<!QaBT$QcFj?WB%u(#LWHf)H
z6z@));z|2e$*pJ;d714P&Is&~7JK5iy-J~|SbaY)%T$bYZba)Bjaw~lk)D+d{06K8
zRR_ZsgZaD#QeITsF14TU2a`uB%6*3ebxOy0E+}X1vx@f*!N=<+^+lLbL!4heBXKF|
zIuYB9*hP5GA&55c@4+Q<!bk=oe({W3LFDR()u+UlHKIRS?v_sn`DPn$O7|DCb`#_=
zxh^@b>&6pREAFmK^xFzLvBr)z91kCwD#Ly*Q`+Mfo$TpTrWz<yDmLsv9Pl14^d#O=
zh~YX~Z(q~`6Qc@`zToSa$Vlk%h#9Wc!LV*4gO8Vr<&6Ja*qRwkMh!FPmr<U1{AF%G
zrt4FJh21bitXOVvR$e#Eh%d84k7L=1eFvLcA-cUZ#5ANY%Uw@7S-TrT>HAq2_Ws;m
zq^9+v-5{IKfo5XFYM#LlOcaaLQ7AW3c@FBst{V=}!N3Oa+?i0h>^3X&ovYrs^{6@K
zE(V=8Y8clm{Vq>?L!05Re7W5)j<Ty|nmTaEO=o;iE>fgGMzvYokl$6^Xy@dUt9-}o
zaBuM}OgrTcQd4(vsEF%u8+rJpP-fk`$_S^|bIg?EsachI%z}%y6`+{AGeJcoE}Pb?
zJJ&RvtZ)41LbXN|Sb#15>Od-I`5u&XzQfPq(uFUY5`2#KdRjN`+qH+Iz^ufV!Ab}H
zrCjz`UKjld=R8jOe$as<3|)1XmQQ7A=DgFaYQ8O@DN~hKcKml8Z6*@Jx^e9w$D7go
zO-7UHNkN|)HXfnY%&pWUF9<mvh>7XC9SHaX7TBAUl2b-g3By-kiNLf{v@*gm=o<!W
z>x13{5x=dFpD&b*otS9du&0j&9}bsZ%J)IaW$S-yj#s<xJ!TwqlfY{EK9G2iD_Wb1
zDlLrd@!s`B7_{$bOU~8CFtr_RZdG|$faRYg^Dl_|xUyAY!;(I>g$`!e^M>-GEU$v1
ze;X1+w2NqCZ)lFvoZMas0ud1fa>~`KZ^o!6s9fQV#-Y-;E(K_A|Mfa6ue#aAzwB6=
zg6;`fe3e7M3cK(do`;THv%<uV=YGwwAGhD#spAU=caFAv$QI4Av-HKQz-4cJ=Dc>_
z15>6Q|3Dn@!?X?-n?2riF0TJ=<jTs<-V3vjp!EGdzC9eTR-llk=d{%q6zPAFf2YQ7
z&2=E3R6?GNBevbJX5o38r-)~5lpjj&I`JGgd|rm#{BV<W)_hSoP~;kw;0U>F?W$Wq
zQ`RUk$a;fP;w!r>bC}PP{MkVz=ai9Wp$Z($1hP;A%rsE#?b+qPHkN?~kpT;sfXWk-
z1cCN?(v?`K9_Gen^3{=@ERVe`Vo8x9M?T~kTS|2p4z2gPZ@)&vezf43A3>N&SipWC
zjDO3i8GzZRVb!Q5A;+#RW<6q<cj=pgujz^9y%&r3y1Z5TVFI^1nc9?b#@JcvwFT>3
zhxbpW89#S#MR^q+l48e5hq7EvkwK$+@+u6J63!4cosVi(&gY~1@841TNA37hY(*pj
zx;N39!kU6|!F)pB2j5VX{9IE($+V-q!+%WvMrTLEb`X_w-LKjDVG~+|jTp_y!_md4
zY>Xh!wlQhX5SOS-UCG>Hn-igLe1}lvSK{#+Xv+HgDt{AI9rw`}Mu~xZxL|10l3-f}
zMW;a#X9U0NNtiXgb;K7YH>~cV0_$Ln)LqI7V^G`UVp#hrR+AdY-k*K0pxc6i0^Kc#
z($~G>Zsu^lg-^WC5q=FrMTB+B`};uOs5<l4&4)a;PV3iun_6BP{5t+Ynb|t<iPW(E
zQ~jr?dI!+oK>vO?1r~E|IiPyEIEoQWl&&UG`lkGp?s~p!v^bhCVz4tj(Au)s<?skI
z^)J5e_(wk2>Ji(eSWLF#ua4>f=<MXBhE;C}gr=P+<ot6Br0PH5JB49dSMOyDs`|iN
zz$AjGofZo(*esh;;8(N+vg$~T@j$!nTKPa#|CZv3Jk8d}z(DaHMLPD4pHR{~X^Zf$
z#Ik^x;ruF)R(R_z?Y9#ZC!~(+QV5*%lpFV^1w+ok4G$JHtrG1!mdWisJv&oi%L5bw
zqTMVP70%Wr=#NZoF~js^XD0TWDx-tld&C)`$;6~}%0sTS&5zCM2a8{!jY|zXbW)rj
zdH7$rEREvd_x?VjWoS!Ke>!1CIYv2Xgf|tmZv`OXZn@U)S|m!5dDfib2$0wGP+A<T
z;xZuY55#YK);oB!vYatF*2Xt1jN}w8KUgIZj{pz(PzC`R-Qd^HsrU3a3>mLQf%s>J
zWiwo!V{8mY8M=KxW89#x%ULmYu!_j2fQ^p8><eYfrF4u5<8RzvQNn-_SkZs0Vb(lI
zguWi)v)9s4V9jb&(|#m+U4XI+y9&=iY^V;8iWNPc9)E-+1#W=6W&!(Z@YTSGLza@S
zdUtZSHjq8ftGg;I<w_7ci!+1o6qlfPq3jDu-4q8yxyoPEd5Pg0>^pl7$eZtv`B+>E
zDla39{@N*jDBv$}hIs80RyrKI3o|ve{^V{&kh`I?McE`uxo$R5jvZ$Mzp)e~cXFqG
z@LnDz^c)B9oC=*O^x@cAy;$}4qWevG%B}bJVnW})T_gUTYrZHS6&~rD)30T5*C0%&
za-ZiSKf2cDm));p2MJYg7b(7}&cC3V?m)XBYeXSn`suJ;Tu_ECgBvTW>9v6?naXP*
zfYj1Sf09K6CT_6dTFFdna->f4QF%(Fg?S0|vqRPBnhS-UeRosceT9Egf=*C3_#QX=
z-V&3ud=ZpwopLnubZA;44d?f}wg7pleR<-H@zk55uD)?KfFsw|tYlA5j8poi*GsQ)
zyTSw%qPYHG?YGS0(Q3_X0ZYM9OoWM&2P^XgD!R#f{?L72`|hareIc%&?-zFXHpZPJ
zm=eIp*y`=@VG~#Z_oua#gK%#;bnPHw)1?He%xmdl?i2{Nwqb53o}*JTjYbFZq@761
z!4C<N%8gHY*mBc%)2uT~pY$z^Ik}IbBIE|?G>P5o6%0{<*R20w=x2j>I!vp+r+RJ)
z`)!vca;I`fdL_uLC1PelZ-Eh5#ZC3zA6-ThE@Us9wz=D^`4_}rlEP@TV$>F#jk8Am
zl-K11NmH_9l+R2_(QwlGB;~s01cT2SgUQ&idRHk@bMtvoz2DlWW>K<H03Bvu;f!be
zr6#+T_~W}Ig10<%#Q5ro!$JTQJnKRyh8L`xX8_1@ogFoh7Pg#F*VLV?Bly3glutTJ
z7cY-6Hs+y#=@n~?jR@=-9@X-oLO1#S5*N`XxMO1*=3H68k{%{-b&VGCYvfiwh9ms)
zlv)+`;)CA@<`XO8wRfn5FtzP}w0$6mlq5`}6{j|=8FF9i()X7{&H~{SB1GEIt(Da8
zy6I89b67>4|Dw-ds~WG^Ab&RKjP>=Vw%bfv4s%OI62_)UH@F)pIjzaX$Mn=@^UQG4
zojq*4Z?_w+Q^VS6+i8zB1dWcSHVtm@_Okrq{rnDu&khNbgm9j;m06xgPjxSo%swET
zP@W)rgO0vn%!*0xE@NWii-pJ5u4KQLZ?mSzNf&YZ-eSP1lpu>JeaE-OM@Jd0HS(NK
z`U+jGya2ELLqPA%BNQ$DzI-Ca;wADSUS-jHXYZf=qg_!wXdoW2p0&xMSq92k47xi_
zY09t$pEjI<`KI!non<L&`Xa2LBF!}TU#*H~;gqn~)UT<JvDAbOWx=^-1NAo`Gl9eP
zHwqw+YF;KGLKCAP!!Z`VRzTb}|HXmgSf4E8i5Y$mZ3wr6796Js9r|<AeusVrF7;5)
zi?;%fHZoKwEMk2JeyPqH7P2a<`vbGHdz5!jt?1dXZq770;z4$#pid90)(EeCdk{8#
zbc#U~b@)>H?lW{1s1z+@M*fB%>P$;sSoX(kV=!3D=++fr@T6kvpjuigr6fz_;rnyy
zUrtTz=6}aA!}{}dFGlJ=pO-V99yZ#}rLI-Gc|<9aD8Og79y)(G<5R2;ZJGD2H0J^e
z+JY06cNmWAmOuw7{|1GOnj|q&dhfXUTm@|05J!iv?K%{f5Y&t2_61xqs8F=-&6c$=
ztaYR4r9?8L(|-=P9+HCNb}gFWvEtB4ivt>HG5@_gVZy!r_Q9h6$@AoY!iNsvI8d~B
zpYnc3I8cpxkK`0dy`ehie7Bz>WbBktu3bf9#!eeE?9INEbuePE^eMm=JaL$d19cL)
zf#LZi<DyYJl_`6im(`^#Z&4kJ;Jiv448{Swf9Ibkcaqj=cDus5-_h2_#dFY|y-a_U
z+LC%n-xu*U!YE0cG6Br~)J3$hB!8=tuu_JZz{4$JjoT$DOR7tJf3cCNvVNOoFgdoY
zx`?iJHEYrklSl}Sn}Xtef}~1P+C%?<oHNHWo7cV(!=!m}q&m8$<=Mo`GkouS4(EK{
zgDl%M(#LGVRn-S%8us@eP`SUw9W(o3zzrPPBxlk2heI<)`GZPXsB+D8tK%+!F+k@~
zQd8tLQ?eLjzb|<lv_^--6`XL3t(j8Ju6rR$r3ZRm5dTd{vou^P-p$~CtAwGjzika;
zT=dV~ju@`ChS}e2tIwa77AGxV(s>XNoz+<d>USVLL$&d*%3Eoh`d2?I#-*lrH_eJj
zvK@tv(J*P%622xFC23Jc+|)jwSh_aV1w@o3KG@Z(%@~-yvFEkBCo57wl?L4cI%b%^
zSwE{u<?*t&Qx2;sDxJ|jQP>5FWOxAjM_6~gq)JTBLxB;4t1phfio=ljAo~Zi*eGGP
zdXq1dP&@<j3~Vjmui^AzR@5*#>8>$%@nYmiHW}h)isz9`OC=z15$>81X7IS|dh$hj
zP$Nw#5)#$++n><F4X*kf-@ia5U@u9mC2{Sq^P>3~8*5Oy$b%QGHlwr(Z#@(-6d@uo
zQ`}I`5c9~&@cCfx&6JGL)h(S9#}iT@qvi0V$-mB~9JYW;)*YjN6z5yc-`Z1YWaKhA
zehNg30WTa69G2O*2G0;%Ep3n{mV8i`#YKl1v_Ifu8?dq&ZFQmmICX-!kP?PnGrDH<
zM{4g8TU`q47P|3RzAyzW*z5OblgElzul(~ck%ET7;fM{9QKl2=XMmaZnjOGhT2)r^
zHx0eh?zC^xN*HrL3m3MZPm8Rd4aBB^_`XY74kU=AO=_6em@Tw*mA^H;(>|Ik?>}1@
z5Hr4_adbHCL3cGyty#thODz7=eB?vZo7FuJ^yq6o8XO;B7`#Um`bOWP*R_oBI^nN2
zL*2XIWO1Q`CFbVNE``0z<N^$d)g3=Qp1HypS(XEJ;OKT+hn6-mWt?Y&yI?$v*c9<r
z4It=$vzWM}INwy3wLioGCB=I@`k+83)}87|*8X%%v>7wMlFBCU<zB{XxhU)0GD!%x
zx1HRn`>m?-c?D=m-7FBbu6XL<c@Pn+U-4vjxGqk8RH9{&NeT)u6f0xn|MOKyWuCFn
zSNFS(M~we;=dM9&0)V-^mwz!{D@Lh!t<x4I?}BV@$pU-$kV+wkEU83#dvTa%s4QT_
zxI)Cc{#Y<rFiql5D-?DOmu0yO&eA-@be3{@QY{?xUsA|Q@qIZu2@~Im5$^W&6hTx)
zK=mfP!>wM(c%yy`3hIJ?-P!DhWJg9qmIih$45_w@8^*_^CbviI!c#(0{s33TC_j)P
zit}=v)4JM0h5%bs6Q#BvWcncgqhNiD+fiXeBoLWFh<Rdh8@>tMOO>tXpip>GhB4Fx
zo@PUyDFS0%3SQ(piQ8U$FJ(6Xn;485&cF0<@;Hh!1UmsM4XZevL=EJCOjAe!seT^g
zXT^Q-q4!;L*5jIiMzoReE#rA(Dmn~05#L1culJ%B1RR)F0XNladN5Z!RCxvz$zP1J
z!|ZYg@kITjbmRGe;Qs_(Q1+}QWYrY;vrW^w9+EywHd<{zz4pNxtx$a@<FPQ505V^u
z&xe~8X)YR_I;5DNc|gnP{ct@1b(+O(bc&5dx5VZ>SB`QK=N<rVYSO1Utbw@80**kk
z117g|*)1f)>9ehaZNrg{MMc++ZsSRNU6w^L3}O(~EI%RlkmI!!>fXI4;$(AfE~Fby
z=}1IXKHo~JEsH8{2;3T>M^iGkA2?Xyq2TOVSi83NeO(0hp1QWtNE76gi#IgKEvsy+
z{&$bQJs;)6^sof2GQ|`qNj0idM5KpNUY2T)Tl|}agz2DdhICZ0rVZ__K^GlpODdV%
zdRQ=wkgV4ac>dD5`360H%R3K<NnkGpB?m7m2YOh!K4{X#+XhSg4{64sc4oeuw=jXg
zC<96ifKi9_Yokq5dgUGX>}C0*tQ*BZLf7V6<^rl`;Q&2o1C^NY#3Qw_>sLbe7+Dg~
zGkR$u9YrKdv%N*4JO5FT$xm@+g`+<p{t7i7)}0ofB|iKVES}z-iOR6<T%iXK=_^nF
z2@)85?g(L1HwjQSn@o7Ecpw)`t(5>(jR2j8%YfXy&(8m}H&Lxs^1M$X9v8(Q>~3Ot
z3|}T#L9wqqSkik!Zu=jkhjOkOswom2&eBH7=O-WUBWS%a9r58yPwNq7RN1-}k`SM_
zNfiqUJ{OTpGtoPJ&(^U1jYrB%=OLs@-zMyJ$WE07&O1hnCe$BalsemqE)MJd(X7t4
z1lTu1pDRRJ(lFttUz@SE;Qw+`DJfluUG8DL7KySkz|@pndQmZKl^8{sUEA+)nk%Q)
zhND3U>O7XSb~3RU{VFQ6irT4o^Lba~eOZ>CQ{<X(0x_q$+*)1XNh3TNP)ss}igDRr
zw`J0tD<6g?ye@n#e7uU_Do#kGVPsjf&AWirIO2DuS!f6Iz^i2vk(A!}hD17DQRKUy
zZGnP=12o!ec)c^LTZel9v(*Q06Q!C0OE1sguh<0)WB8BNW)N{d(dO4Ry$XMVYU2`!
zPV6vKLwhJm{tshAXYT0(xbIY_UMt#$8C<odG#Q$>>jnw9<x=Mwz~TNO1~aAp3rLM7
zoS>26DNt-T#5iC`_%w8H`^7o=ql^5YM7;Q_RQAb$73oW(|H9iVe)bX#g^eqz9kVge
zZTbHbr6-)QRde_ZzzyyE+c)9{aJ2YuYdC9afZ4jnhv`O&ZQh?V^r<qfGClI2gH=V_
zFzp^RKVe_WB<|p9dRX_^dHy<;N=7-8W0#scv5X-SyoN<LuEK@HR@3;sWgzKkYU))Q
z&>ELb?eT*~&a4u2BPF&$!Jb-R1x#ie-VXX*Jld4ojR+;h`IqGyCk`Az^mi*5Jyo>a
zdc~bMv|zk0BT2eUjF|nGg@`57<!vnkd`5T`7y-E<O&(yvE0&;jCnDrrEY=WIQCv$6
znqOXXx8Af^4wf=&9v@Q$I7XRAUweNc<su!($JP`HAJq2yZ$Gr5Z}b0ie=9<s6#iqE
zKG!28sPRjfL*>QMY7rn%D{V0P(oV^B^>v+>a<vHz9$S4hz;~hQxuAKtQ~Ryl`f!NX
zbDX5KQ{pjW@7yBF?z5N4#iostzl9Ws{P|Uk>qaD|e9ljlvf0|GWtO^YV2mDQdL?ja
zlnBh(l`TkLs-!NEoe+f$JFS-ymDnsL%cN^Uyb&}+4xXW=s1hCeB~c8>KtNZA5}>2_
znzokiaR&>uZ$TFi0vB&<S>Q7wU!S*qu|V4T11%dkc)qR%lZ%T;uvY2k5NrM9U20g+
z*g9K9egEM9(e>ToRR8b)$4ClEWkg6Jl2t}B-<1Z5P%1OBHyPQdjjXb=8zN+8uT$AG
zdyh!U-rMoJUx#z(bA5mRbbYSR+jU;ganHy7xbNqti%=3JnM`yEQbvK@gAKHO2%Hei
zZ8Nt~Yv;Om@B8#G$IbY+zh*PobctAA0^`e_hZeUe7T(9)&Gfi%93ZA*QYdU>iZdd}
z8MJ0GeeV0*w?kpNWE|v-D<f1l3O<2&=^sx$8vEtbpFLz<{8#aj4dtQD#MHNK;7CeY
z)oq0~%$X?cT!q(A4>PZzNVobDnTI6{t0(06h(~n!&5D)cgX&<%^(7~1S<<bG*NN#Q
zo4C$hSde~G4hhr+PS7~o0}|Mz`NO%8eLvndU@+HkS1+I<?p9auT?R`fF>WkPi->Jj
zFp1#l_M2X09_Zc$qwco-kY>MBD_9#kFxPVZ2a`Ji+_$~gUnlkn<)i|FEO+VX>fA=3
zT+A<NwC>B7TeAZx11oXPUVp|+yQZE};s-`0dZif>v~gEIq6(@1wC6U+R?iLS3{HR*
zw<{Q+O$qgWlCr3Jg%G_YnD=kQ21ebel#7i77Z^HEuJKBlF*wOlC;hxc3E{QwP<5QC
zqpXgqjqIs&nopojb6E~LpwMz%=&<`BOjco8Z7(l_zKD863dRLdP|e=k2ac-mFgQb`
z?lf&${E-M_*Vqm5f6CI9Xxt$Yt#hLN!34md>S-L>KX_lc<8@^c=fkrDcx3CN2_oSh
zpYBedo81f1?Nn=a5l5CquMz+>5SIb?&G+CSW=h6z+?T8)l1d15sOdv)Ne({lf^rv>
zaPCx^Y;G`<{FEHGIX~t}+?DYrE_?(nQ@NP}Gap+9KSg!w?iVhLqQ8lminV_G?8_mL
zI4?>B=$5Q)Q&IaDYt4e0Hn&>4tCh(B01ZX?y-b<joCM;J&R3DMjL1A0Bf1%+r5k##
zIioqHD9k9#2m-{8ll0Vm0YGwFBkP^sUCc@)o+S$vFr@B(Od8@NT_fX8dUcV{eriR^
zVB@ma%2NbI$~ITqT#I=I&QR_a@Awyh)srsvzvi6EQ|R}i=it^l`|QYt%|END!HI@%
z<Qr!30Zt3qGybl+MNoxLSNy>$EpofP9QAVFd<j%4+Vk}FkaYEKlX??@q(@m3gtm+g
zbhEjY;L!`1Qj85v&Z$@-jV~qW@u0Cyl?BgRb#F5?vJvyuA2d3`T8F6$a%i=Plm?&*
zY!F2c>PKfc1NZ|ko|I<Pl-1zG>TfdqLG(vZy2RVulovk*YQ#h12!J}v!6`8XjBQKL
zkgMH3e2DpX(}?ow@_v&MMo6BMey+~;m!R(Ql4_AIk0|EzkW6>xO%e~iY{v3rYmqG?
zM01ObqTFAvJD<p$4kA(H#iP#l6`ZdfG*3)6o|s=A@ZLgB>u}+nN5=A$<m_&eA;BqI
z>D7$1^<>@v+WL%gl*_E+`f%|Zv+odobxN7_Wr+oAKa3SFG*H0r!vmcQFT~3I%|5A;
ziAxYO4xpp21D^gw?%{!xWsSG-8)?AB%0y<VkhV;kzi3IkRWdW=bw^hGnOVxiVlFbb
z--d3SNFD_`b1dB9y23vC^gR$PpKa_sBtFskjz}imo$vK}Z#e(fr*qmc%o)lwbDT&T
z?}?$3y?Utq`c+>1!eSyeZK_$wY`aKu+5A^Bmf6tq5<}@(>a_fy$p|q8iry3*q*j)Y
z5RR)4-VFOVp&++fOpJ%_1q2+(u$FRvxr07wbl!kdwDrOa1S(HHrvHWIz51OH=m|vQ
zz7(ox=@zo=gI;0GS?KKZ{v0lPvFqn!L8(r9um=N3>hblj1QPxu4&)hg7a&%euhfbD
z+nQ(!!N_h#$3?N5r0YnSr+;i}2JqCe{jcL02)Q_AGvqe_#}!EsW5O!({L#xoR$ZU9
z{Qw9)#`A%Gnh&M-y|AIT^-w;5`f7zH4}0pOXT=QMLd5VqK8E;wG(?lHs#FD#SOoL(
zxWD9?lJhqyw~|5->k*vEL5&_5Jx!LN-wy)<<;DQ|`%V&x6d@q@EPo({)}CxLph6*4
zqlstmaD&E$mU+gi?mM4zn;e-e;R>K;R1~hf(sEdhbRDWWG91UI&Tz+CirrJiKDqby
z<Q;s)#}0>2c-VQ`?ICG7Jypu@@^<0xGWdqG3+v^m=KOf+$UbRErz6K}(+t~uk%D^5
zy2QxRr`Bn`0w2*$j{}bY1qC+3TNr}lACNsAo02-=DHqMo&UMInYhOo2H|>r{n#jEv
zC$fpoJZ>nbnEDYx-9t4=9QAVU60S1!nFy1nUZ~ebpdO5v=p2iEQ2H|Ak=qrp1amaE
zgOyE0uD02|s#EwDNwRP2_hWi-zaO9dUvZyA1!j$@{mVVgah19Ek9({kYI_SM;CwpB
z%bHpA`uCw`Ez74*{@${`O7}<>p`fp|a`Gb*O@-bd)dJ8XiuN5jFB#rMqe!+6D$_Ib
zFiFdqRD<~{BXJi2aBv8cqC|xneDB)O)N$7og|I$G+*s_^R411Nf0sqz6df(c)E=aK
zSLppn3@aFCE_2d!!^bYYm2VqQ?5^DNlx0h4DuOn%2*o5thWIEPMaMeTS`n%avJ0Lo
zmMke78fRO~bFztIAa~8VL?V-%%w5CL5-$HTR}eQ32ROx0gj#=KoEU0<4H#ONXdEBN
z{WaQk;v$9e(|vf=JQ@dw)m;2XxV=kjm3?&NCXep&3=cDpnB=XbL3YvV`~A!H8_P!R
zI80mjLHr5C7<@#G!JlyxACgrEsGw_@*9jSJ*%r{mnrt+ap(@+l1uzD&J{Zfmz;weW
zHH-IuEqdY`;~)y(Dp0!Wx|YezQ%b=23?JU`*2}YBT{Fv35fKc&DzE3GspD+uJ)mfm
zDNcXiK>%h5OXmOP(ZiR}!~}kXDBsoSl>5jGWT4Pn2x=}etfPC*e4x!<%$TsEP4?F=
zeg{<i?=-_Y;fZ;nsV^|P4e_i9?di{`g*Sx2P;NLTM0B4D)gdA(JmIO9PvUXJkBsof
zpAMF)J5t%H^2^C5THq*@I?2~m<^HPAYxJ-79JsbE9n`qo0rOa4Df{6gv<bt~ptO^r
zS+S`+4hqnF4BI>OmPlt{l?sI<&(yAeNYWnsRlYj8tmx#O8@lEBWLl`YRXa`aJL~25
zRQ6%_BKQ;mC3akTeyB3hT)6nOfHN|6{c;(A@9z-T`fjDrfhe@fd}(w!%uIdN+4mv@
z3`j92V0<@y#_;)5r38LQ=qt1ecWm7CM7cku$c1@h9&*PX=d9&c2&0=gw;LbYq8~!=
zeRMa#gv>aY21f)aezoy%&eF%g=awDG9inwBTfLWl3$zJDI)I1W-8b$R#4`bKe%*s!
z0*pPP-(N4MR{I5!jV3P)Ka{WEk9h7{<<BKV$G>o84pGz*=7|Q>(R(*jo&@!&TRUfW
z+t>=hwWI~~o|VEDf<c;XT31=_IS5ckdl$>+S|4bainMN!oj~=koOEwfD=P`zG}cOc
zNSpy?{&<sjP8U3fvTT3!wS}P2F^>9^Q4+Qh;&r$^dKm#W3!EJU&>Jk$gkQPa==2Ev
zP}HhHmcA5<Dth-*dD6eFKt>xXM^hA)@(G%E?Jfe#p|ju<G^eW3q!gQ-$=;NMz;Bpr
z6}e*71e1@EQ11w}A&m-EW<2vIME7*`;(bcdZhV<u0~w6HLFSR<A1qnjc^q|Q($=-W
z*}d$#q0aEa=Y~F8cEBXSG{zfRyPqs}2C^8`KHiT{eZ8IG6f2H0iU>#~z`i5K{Y@&#
zbWTtallgRPsx`1tGEV*eYS^#s=Qm^uA%sC#fWracGG5)9zjk-Ihjt+w7-~RB@`UmO
zq*4Nl4giZG<fZq8ncTofjwOouW<TmmHME%TyE$sh10ATWCinM7Y=TMWVK`H6S)HKQ
z9<K>*7$c*#^`V6|bEqOK{<4co)f~!tL))OfZ#<=Em(GBZ`ven|gr6qec?*RV0Azrh
z4SWxRBFRW1>Xzpu*K(d8F_Q|UQNhY9!S}D`zUC-v+X~z<G69?4!Bke>+p(d=zlyG>
z7bbdXz*kwDeM#9*g#zoJIj&i3;X~%Jw~KdXKEyoRZ8Q6bQ6($V2ut|LjNFtmDfSz?
zR>D;c<!kVc+@_V3GX&9)0=F@&Wmx}Ht7xsN@o)xbI;ZZ@J~FqzA#Q?5Z36_*`a#Z#
z4KV+Y1<y4f)MVxb+Sy$yRB~;EC_#&ym>A@NzZaYEmfq8Y{E!r}w~CxI`?;COKLS!^
zc;*XILdWqX4Z(*9oVe+FJ$+-=owA^R7k_+@+y*ep7!Hq}yhtL`8vg_EVG;A&^z@n!
zZWJCYaw~qfO=&Sle3@JR)J+9(pxFq-l1oU(&M{YdFDq)jAlMlci3+&=qtaBUIL^xh
z*?nt$9KH#WXHR3x+<U3kN)*>Fx=d3<CrXm(04sNq3dyHT98UiEYv!W>e1x3eZ&rl;
zZhO*hrJFTx(Jd+oN1Osc1b-g48a#5HeKu-;D*yGDc>4(G14y7E@K6~%{4_R*+E(^r
zph`1IhMiNysv$HUGUqOe2EgsRnUGxm;h>WP%BrAdb$TEyC!(#StR)9$*MZBi5w7f{
z{F5i#9^nBd(c}okHoN)0e!A<WEWYUp+)M;0m_N`q>fI;K*h>9w<vyTJDKMo&GP(9$
z`lY$L$R+ps09~Lw&Rv4E$E>5^KN1g9j$uMbeUzUJ`zI;rLLWo}TrQ+qAc7N*>6@{<
zm75d{MB@Dsj?_#G>PK_Ce@MyGasP{YF}h?(_*|%I9w6z<o`3wR)<!i8kpRS>NG-yy
z8o&u!+pz3WuCBq(s4Xd*FpPOS)q=Y#t5)*0!S#KPR}XsMz&mOWbT=cim1AnRn$v^*
zWuWHk!~j-6A8{*Sl)C9QGCn?eeegSiQ7q&<%FnWBMD;UPKg45~3>Dt!Nf3yMq?XO?
zn33{b<)&)UOPg?zJFpGuU2B85)&&Y)(FKtc3{HiEut2~8y~Hj3e6ubDxPFr|C9W8a
zL;(xIGl?iB<@jdN?OWfDFTF<l9m>ix{tkrXI!1IG@HgK0lx8pbmk^8<L#XNIsrkF+
z&3h_3x<tLA&yqdugZ5&`8E>^j>}u!{rg&kZU-LAmJGS3|G6IlrD<g_!KHi(*^NWVu
zBF-6Xa{iWP>CjPr`4|`+nd$W>99#=j#uPFH{<~dpcgG`SHQo?WEt{eo`<$`5T4lX?
zvNn)<O<4B-4!86|_#0+9*-&V169>E!b?5cB3K@{cB4Htvm5X~hwhpgY%^esAu<gnf
zBOiSLsW_`gntX-Zr|qFlz$w*J1U!Qw6rl#d*V>y>^{WOA$JuhBVw|C`Gd)m>qgwwl
z_XAf}VUZbKo{xO6ynMIbgH&;Q@R$PXgOjc`9C($%BpqJLKXZ%5^#TOF{xnOI78}y0
z2S0p>`?j4OQ9~5>D~0H&b5>@Fw;lZd5QG7IzM56r0DPG7rg_j?n@*H~vh&5SkUzF(
z+J=jxYQATFb5WmLt#RM_l#&%mA$RO$+Vm>p_i%OBnb5Smq666(c_Ro0%<C`+VKJG<
z*uiY+`R3>cr*4hi{t_JcD+%{Kgh<r*g`do+(=<B0ewZ0m)Q0kxOwe)oZcl~!EjKKW
zm*%6E2zaGw*Lm_CKY%WW_=pv+a7QLAKI)ka5h7&u457ZrA)29<Mit#9EcZ}$9S8if
zk_wJ1@mBBQ)kTquiiV~zV>h%KE=^%i$KW1cp9LV#F`_=&)-B#`dqFtEg2PMawSr8U
zP+MGpp9v8nx4~|Fp~-125wkoPSE5pRP|=s8e5-wC7H9LBP?yNg4HnGS+4hX)g%FYb
zuEo5Q^&aS%#8$WG>Y0AY7A^(Bw1B8V!M6l3AOsZbT`Ci;QGclsUDG%3dD~lf%QPP9
z#$1v6JJWRQpz95|M<tqerK!q_M|X4y;C6h>=4LCTey%)gE9?}!^Hr}gPx)O&6q(lA
zJ9-==Av0Hy(|2Jwi|A<h@r>~<D64k6G%5U+v*p<O3=EI!rR;vKyfT0OrkHsWq+l10
zP5laNEN-z4m~fEaq31Ovpyz8Ms0Z1sUQa3LfAf0Yb7pU4;7UUeOD*PFubTJ0K$Jpa
zm<lN;WtP)++hmY=youOYe>r*ye~&tKR4(IeEf=*B{+TK%w&J4L@WEJi70=h#d|Au4
z8W86J;XYanarFre_gT^2Kj+%*1VBO)(a1zmYn_dWPTqx#hg>Ne%+ewZKC6ra!Ri)K
zZA&=@pZbKo+r9D7{h=C6T43YBy*J0dq=Al8zrbkj3V(3Qm&1QMVKzbZAUh|Bw&xO=
z_~4`2dWV8@TJT&(FJ-|nFu@A*9ZK4-SXy{*bgVh*y2Q7}Px++uowiI1SiSLJhweT@
zj|rkI-DHFtqya77dk`HL7l?Ib++FbW)8@!^T%-fz-ockSkjUKnl{Yb7{F;fsRq~Z4
zWndph8(XS<@q3-Qph(0dnFknUBz3z#EXY?q*~q}8w{?14@#qx#kDbOBK-XCIql>xz
ze9%KDO%b};1eACpkXjg00Qgk7M*n@*iDx9YJ9$i`4Tfc<4Yo|fV@b2R{SRS!D1rxF
zdhTT7y4zzcqNO?Kghl>5)9eBITvl0xH@aDzLLX*08>PJBxm%TX9gNA*MI19s@-a#8
zfGP|w!~fk;da`b!7zPFEjhUzJHBaeHS@-ahCEU}g{x}cSqkvHeSEomQd@TeS$qr-H
zRN3|&zgiH#ZfdJN{sp~xMYi48V#Z49t9*ksThXDuFmwknfQ5ZKdICoM6>tifh1_Q%
z;W(3OF+PF>7EoicHnBOI?SlfY^nh=d<zUKvY?V{3esR)?&7H(2p~Y3?C|Hy<=cpn2
z)VSPV$T?PZz5M{?0ZP0n+Y9c+s|od^$Bm1xVCtK4PKIx~FA}lc`dn}Z_*nz(M%us%
z=VP_C;hXHSF>+6W%Jb|y)6@7<@IXs2Rj`m)Stln(id+X%QADocuiVLF95DIe>9n8}
z!L)QhM8kC*q<}pi`*_l47X{rfv9x<#?7a-gd{8JJq${>jQ$HwMYQT2)67@rt1SR*~
zwj2V(PUB;3rUS>fe(F#sa(LRsDS3bR;qY>OF%)okKMp37qDcvp68)9oV=$A!o@ZiM
za#3t7te8PZ=Q@?k;AnOUaQKj#3*b(<<|rfJN!{udi%au23t8Rac6X8R*l13Fv4$@!
z%J#cvSYgyZ$aQYzBXC8{EnpUO!TmcBF^o*UU|kMiO-^JoW!nSgS#uo0O=zr}4&rL0
zz#PXpE2fqOoHl?EL#Z|8cSu4HvKjfwM1d7=2nP9%L%%{J%N{?Q6B2lo8c?>A4B$<o
z-?cv2Yo;#x*%Mx3J36^%U)PB}<udR(sN>J4Y39`*E2Qp8H}|~(v4cXh%`GLvn>lsq
zeyw=c;gl;$haSr9cnGZ`69@4zD{WFYvDmqdYu%g{+gJGx2?L|SZ8fb!B{I$>ah%$<
zUo!1}rS4Pyr+{LH+L0jdvf!Ao4|EhM=e}HCSPC%nt?F{`U`Dlm))XFH)t<A>A9rvi
zJW%$l5%YQR=HYc&(4-I=N59H5A+O_Pi=m9SB^m+>NQiUuM;Ia;{?1KI+Vm9ke81en
zCO!`*4Ktk02N!)bKNGvj*fYOddv&&h9qDufdXxD+q1^-kgYwW<43J@FG;T?n2f}II
z^;b6WKXukQUB;yZpENLVJwx0FG+0^uG=n@bYGbzEN7kE;maXF+6UPt(kV403j%W9-
z%p;x)$T%fXfbMo(kq+kvvp#km#P*a<;?XP(R=UBJA7>Ar*gU-7B_8D{uG8K!zQ?CN
zfE#(U_WS-!hEBH5Rw4*Ku>%npDDv(~jq?5NSk@H%yZz0uUU}G$u+%X!t!b~2a)f^d
zutYYvfGqRQ96sy}|Hii?M*9e`00Y+}bhwSi#usCRB(rv}gMN8I@faQ$XNX6_fKr$g
z7>3$6)^#{UYvs7qE}ow^pF9aMKlP#s-g%5oySE-@WGd$0MdkrfYMOr2isNGbhN#*u
z>mkOBb8Vr7PB^Q(B<0F-eu)o)TI#%It{+cr`C!+1wfY~v58{Z2z_f><T9XQd-Ikv7
zTOXmDI{T&UOBr}ACYaY|B=$ubJQ`rGt+h-8l9La!bL+bayb%E<Qk+bliJMmp=O7O9
z!3?U%ZHT5&*miLk<B2qo^=N{8R5hWjz}gip<<^(%8jjX}^5MC8V1!-_ip(PC=kW#*
zM(CD#nbg2#xnT!>APZXA3MXBu6?aVu^_U(?anQs+smLKb#UJ!Jz0;be!kE-8?!#-J
zr|C~m<7H9l1|o}UKhA{^cU5}6U3$H-Tz5PDewtq1yYer>iR^#P7?-BzS%IOGuZ!g7
zUK<@69WA{F9L#$TO*;2E*FO9$u|u607_M^jRv9xl8+gia98Wb7p>OP!*WGp@I1Dxr
z9$esgfjIRx?1Z}Bw5|ebUaDx#&DN!X%4G_wCpdR(WhupkwA`&~st>Hg2#g!A3bR!1
z5kPXC{)xaw3Z6UqnN7$1zmrR_#XflV$J?Qcp9tdVEk(0(M-CD~O<^La#FWUp&zGiI
z{XAdEQON<SorYd4Tr6xzwN*zdXA7YLwz(H7HP*}=F3ThFefp)RtI=I+J(>IPKZlWl
zs7B<uol-bEanMUlxQg83FPCqr{Xy+J>}W6|BW9?Iz2=3Hywk6xrvr^2ruGJ~>p?pb
zj%}otU+M<QC3LF1cztl$gc#V(8m3B1Kb}kJB-^fUmn;CugP=P$C@HJcn5N<msYTJo
zvGzU=S-jJR;ue(FWga4E3DC^*2lqg>bn13$%oWf5T_>%}Wqc`-4!d(*;e*ibI8Jli
zcKRyzO_AYN3m<C{_Cn3Ciff0H{l*@Tx@_HHs2)NaSl6u^i4nPs(12LwxtYTUANT0C
z=;A8=xPU>Y7jbP!fTP-#XRM&%^w+N@pLg`co-<Hz(?NLfP*elr7E+8*^CJR8*jqB+
zzT~o$OQBeuFoA=Kk!hgpzMX55$V`WhknL~l!4@C!q}anXh^JdX!5D1F4A>9_)W%vz
zu{St^7^BMlT|DS=nSD5h8Up=6-w*I4LlVh6%)$|HN4t3Fw_}}c)OY!P1vzz2{dU2Q
zFLrNTVniwCXJ8}sP!fxY?Zp^nnx)~4BQbQLbfI{+jUsu91R^jz3^=ia$J>gf>$J0y
zQg3~(1fF`lAG*sjKl9f8$q}PZfPH+-9*y>nu4Y6b<udR>W!_qI$7aJv1-Dh=*x{w?
za(@Bx>ohTxJ$jkucBt}5h*7-ayZ^dN38Z^m`8uHi<xkrS{Oq#K;?-7ALhFD7$Fgn`
z`=QS<<qZ7}N19Kq!3zL!*4A#f2RaIh^VvM<<%f(=p<Sc9+VlqSDo<JCiKhM)&tjs2
zY|+s|?ytqcu83=92gK~I|FWvZryfAk0T0v)%|+b@t5aNLL3l8kIi}X28?VrD((8W#
zktjnf8bE%tfMayA>}FalS+O%6DCM``jcT(?9>ohI`rBcoc%k$uAu*B`9dQv@+%?}6
zLRI8+8Po;|p78^Knn2A?+H;hre|_#uG!3}D2R%tB2mz^0`(MfPc~XtGT~q-aYizXQ
zCJ^H-oz3$Rz=Ypz+MCs0J7Q6Dbw?;sgUJSqU42!u*#IfVS!v1rRjT78p}4zeYtB8a
z4t)obj2I^fD-X)7{v?@JQCzRQV|%}r-Lp*QA(e*9bSVN4r&-q5RaoRk*Rnla<~O}!
zB$dODbd|#}2>BZ0WIy~aiO9T+`pttr<w2>j;wouW5YQ+uUV3=&Fo8^h0el|8vDi$D
zC`_E~Ej%wvj=Vd@dD$%E0}IKl(b0VM3d{9Y%S(_0Ku8uGKHx552#71vPlh!AB^D<T
z#f-EGE%ezDvYTd1RYdbe^JnC$oW$;0KPu0kzR&WS?PX3pK6pQdV8uOftd90gYQ+rn
znjiMWRFtQhJM0UiCQ;M2yV;#-rvf~iIyg}!cf%tV76`y)jPl<dKtX6C@G{Y9)I*(A
zamacv_5#xw*qF6^`^qZw0g-LJm_H3C*}16~(bB69*4T7?S%tuMi>p#(zrSK;hN?}o
zJ0{I6k?#Q80cmMKI?Cm>R}xRvJbvn=nX*)v9JGZP#FUUtT;*PO+Bfn}<Ui7rH0Wq(
zGt4MC==C)1DXz73Gm`=lwTGaV9&)7%)6d<f77*Vg_B8@>p*Z2GDz&212<3bHvx2qB
zY3bSD0L>tjRq<>~pOC__*tj11hs>or*x1AjOXoRGrr0Z!+U!U70dq-Hl+IswM`Cps
z@rEiDRbJEcE0z!~xveXt_(8N3)S8zWnaN8sY|w9sU1`cx?23+HNbb^@?-#QH{2w@j
z@9qs}IWAXg8DMP+2{j7=B~_AjXj&4B_vs|1;c_Ll2sm;!`<KU(C+@*pWRL!cj~Y>X
z;BLj1*t;PGb=2ZD`Qn&8GT)No_nhgHEVti)X7885A6=0mr3E7jvblGI6>r;nQYE#p
zHh?4N&$##KZ&Pj}z9KkOM`R_^Q4#u`d`(Htc#d-S+YjH4oS-e~+2fDT=R&37%R;E`
z;^~<Db)~iLdh8crKVittp(o>n^z^imN%ui0S?0nJeW(F|Pc}m7EU+19D%SPQe;@!D
z8M^)7ZEr8mwL;>+9UB7dDUo}%RZsMZ3~2E6ILcq`II71YL~2;KKbU04IsK4QXfQjH
zFD7OGS?#mha2KXr+WrDk!v<pgF@7KiWyM0TyLrCW&wZ%hX0{@DAFO0X0$pIUs>YBT
z|K=l(4x4=XrSHVU9d45vw=0PpqNA&eWp+FR>D7Ee5-06vDwYlx-w~c_@N;7aPBsg;
zC#0Ylb|iT<5`_>vp*MzcaokI-U|=XCuXz6KiPgyDT?Bkfj%mrkk0><%TZ#i6+FM!f
zxk7qS)O`*r_Np!85OW$=T|TP`Ua>v@Z=&`~iaP1y)8&tZV}y^A7>Zi0LlhM$o>eBJ
z==_p(yuMTuRd&hgeM&y>K9LFEE{pX`r_{4*B8C_V-TFE)6=c}kZ*D=2*5cTdJe20u
zm!e&N@=Fa6b{qH|cd&85S1t+`CMsC$ac8Lx=Hs=QDan$@3JQ3WK?y>2wZ!$7qcjxJ
z7sZju9f`v1Ld@+49lG7Z$vo~HF>QM|lv8)cw`_AbKUnhH!lJQ?lP8IfO&M~Qd{cOF
z;2hmD-V9(U!M?@2lOR1zmfzomp%8z?T0Bdw3jn5X+F=&G){xc^{nM!sX~WwKNJqH_
z!03JprC`jz2#tHwI`k$JVI+n$2w~cx9wdo*9%uqrY9LL_RQ2U-HvcOH{1;IqhKLEr
zmM+3mVE289?x4qSR=e}k@!nOPy9o0nDDU?lp)$K&%!zavfdPQ9IB6C7w=UBFFkA-w
zq1(9w`>0UEXNwH;wWcK7UgLilQ^1gOB6cplgWuKZGEKZaDW3v2v#4inH9P0D?!9f{
z#Xt-qA%voAD|})9Q5@C1I**OYT3Q~KJVAHrc7IOoS8LN+liIudBnVFq7}wyuUJRCx
z0J{vrAEa6a^dD%nJx}7XTq)*-*FLVt=;B2CPp!S)n6b<KE!?q5`5!3{K5-TB#jg)>
zia2JOv-cYH;>N_nh3Q`>q^}<IcsO)#nAUV;=J%m=#ST%{Zlri1C?=w`_&e5&38Dj2
z2abxcgTcJ&WpUfz(~0>*=KCR#FKYcjyu%^%$ff>_1GGa5stj9HOT-9DG~>jHT5YL#
zW05J#(u;?$xZqFap)P*53b^=g0CoVda)2Jq(u?~Ly2O4c#(Mf5f37<oc9Riha5g#F
zkHyKAol_TI1+f!CI#b*~S$t}Zf{kA4Plo~_Gquqka*CVVG16uS3}&5TO=Wpit!OP5
zQf?N($y=XW*!vmci_v2dh=WGj00%Fxj=Jsk04N9ukxVcRB+X(Rx_pw~M}*^@G&-GO
zX|{tG?IcPQZ$YZ{3VigF^XmuqmSMI@Iye-U1?+Ayl?wM--)fl3>+jQQ@ItbN)z@A6
zSCiVQubwCSXw(mYqi+vYm+7uWz4xwmmMEkH7ffR2vnTVTtq^t%oXx8XD;_<SMu#8h
z68aWR)xz7>X-gB@L%vo@NqydvnBv;@R=+{9Mk#4vwNQ4+X=CG8iBiF+UoVY(2p@Nn
z>!`HnS+b9o{g>V6yxMbJ5g55e>Y?^zE|)0^8Os1=qpi|mdBp1-+eNUuh7R7x$c_z2
zMeeLAx=-^P=n}lpp)TCDp5g7+kIr-bKB~nGan~vNN2P98=uS@wkh#ry@oY7fGC(=h
zu9yS^jipd#d4W((jR*72ZmiAv{QUm%?P!*+cJ^WE!Oe_TMjt_xoy>)+GZ*fX8t@bQ
zUFD7xvc6?75V+reKLIu^!c8Uccmp$kq(#p))7HDzxqE?675i9|NU4g!(1vKUFtw(5
zLem?-h&SNTjj;gs4owsk{PX}?WJI0RQJT0ufwzk%@Aq%iXdP}A_mmMnKD834+^TT=
z9@`EYP7uT?G9(xnPIq6rtEu6L^y-=VmjGj^j<lz_eQ`^Ehpy%?mO$w6(94qKIwG}7
zip{NK8=jekQs=R*XV7Wg8M&vM2xEPxbg)s%c55zzG1ZYz29>Q^AjY!&tk?WwBad>h
z(OMJkAp<b07@~d+FUv)&*<dfT_40ex@!R6nX$G~%wRgx!=(Qa0x%~RxcKN%nc|%Xb
zfpR~pOAFj<&clzK)}@_~e9htwhi@MFB|!iJ0xK~N%5u_D&aq09?8GhJGOe;IAFqBb
zVjyr&JkZ=wcZng=$=Yk5II-pg@$CDLzv@=1S6-tB7#-I~wbgjCvY{FQHHdM#wG3gu
znmJeBeTyXv=HXDKU9jFqsHs#L^pCgjbad*`ghrCz?>TdaUZI0?*Q(w%ybB~EV`<%z
zqnyZz;i4J-Xz#Iu-&)mLLns5=Fs9nGVF;lLnXA)oHMuxRtkjn~2Vg4X(m;J2Wf{g#
z$Iyu}Bb$hbRE~F`L66Ax-}UsI;pBYzIc;lbI1yPLQs;K{z7@ywj(*v+<1?mjJ;a?6
z@oVahrPwR%rvci7B2!$Mg7&JM5ZJ$t&x<F@$wsgYI8IRcfe3f(a#>{>A@2}S;v^Y_
zM!XiD9@yX6Me=SoZkL4*sY@>iqY&Zwc_bLBvH$+x!nLXFwFP%?B<$n<tE<gUb2uj&
zy)nD!&a|7!p&UZ!`=yIWLAA@a@<A`Z>G{p7S-0g&jr^d+&f0cH^-X<0sgGb3v-O3C
zMwl<g+@*0mFZVaJGF|y~><6DG+aSee7<MhLLZqebIy6~@6fCI?Aho4}o=L}yg)a-I
zywSzWqs3kbEFxp+d_TLd4TZ74W7b6-ymdK8pOZ-`e{TF-NQ<`h!z3!p-C2D3A#mH?
zQK~lLu1<w_L~+s1wdeD6!LU@^tMVY>kHYpHR4y|IMO!U$`?^{Xkk}duAjv@W2=isM
z&mocN=;@HQ<=KkARGTr-yz|PI-_vO~P5gDz<di@6+4jU?@LWNdcZO?Qz&xN>ZF=ac
zUX9IJYw+_0?F+T75u*&Oz{t{T;+i8Se1jR7M?S$s)dhw}kzLtNq%xi_E8DoI2$1vQ
z;iX%0e+?5=@-pL&SxwNi>l5c%5(m6YQ`&AWFv2;=zlY`wXFBt<k`jf9Zad#`7F6OR
zfrqEPp{Gj_7~Y_1t@Ha(5Luc~?HP`CFEV|zSF1Wyy-GNnL2+<%-a6(2&X!f@hFmOs
zOs;yISn)b!2WRM>@5~PFY|6-oc<G+#+;t{x93GKg{>CoO&fzc>GGrz!d_fk#oeGPu
z(mfCFiD<c-*nF^GM1L*vZBKvrSR9oTWgA5Ri>gfeXIr>>I^_|OTr)UK-@kBmyX>c<
za}F0#hWZ@q{$7Z5%q;!b-FpyG1Jl!GZdZkF)nOtXy6K=W_6|a22(emXiTX>Hl&-y`
zx`>b#pnV8pfLpoNp><+?rkckIu<=vjA3@4azj8w^!BzvMi8plK@r+$G{BH-@ss@>0
z14Z>@M``sw2pt*R*XpESlzP*PyBYpn%KVu5@pBv+8JZ42d>PV;4>O$tTp8W7etUl^
zQoOasdiakQ^bx@5fW1)Qr5mQld%&0^vLf&q|1HaBFDQ}L@e)%g%bCw>Z~<3NcsuZU
zC;&DMOL0qu*DPq-uEX}5w(EQ%q7yu(%CPmbx5_Y2>9rUp-TRz%>yw!`nSoJ@oE~XE
zdlCL2GR`j2eaZLs7o!{c1JTb-$-DaR2IE7oP&JZCiR{MsXgc)F<^E3)ScixHw$n`~
z4<RSy!#10ewQM1TR6AgT$!zUzu?Xs<fX@MOru_<*PI_iN1#Eep>c>o{Dp?i<qiw4S
zqp^L+V4J`4?kxqnT7+w6;L1RERlz{W=f|upXdJs9&}VA#)8Hc{(3ne`Vr7^%(c9Mo
z4olIg(XaH|Q;O;ch<jf71qn>Osb7mmdS%D?5Gg(e^WO@~S2Q+?k#S%!j%#CO$lcRW
zYW7Xg3x~rgvSY7J31og9IkHROLu@RDZb<VI5BXx$u5qe_T{{)UkwoxZuK+-R^G>FC
zVCb|_CfS7`i3MUGf7!mwbXacdMc#$g+pOTH;2Q4xua&Qxxvhh!A;uoTgWlA;Jj*T7
z*s&*j1V=3V&^@H?e1iClA3`3Ky82?~1l!9rL4x|S^x~{i#vT9g3Fpt+wwLeM(>Nqa
zt)-p3q#I~RlHKj1azFd0rK#9{FiW;DUa?0XnUiNfj8?bE?KpC*13zX84w06`U2JwH
zKKc;a=5oIwSiq2LH#tdGjgz+hSKXGipc^+_op;~Jj`q4NF+gJ|WHN3rUWIhPz?Acm
zH2-!y7r?i8HNV&s!7u_^KLWMN%QFovW=x87rNU@1WV{fPcEBTT0l%r+w&v6#*6XHV
z>f3G(jm?dVvs2GRO9)&l!?%ktgtBhAn*ZGMCLI9dms)6`E`uQy39nMqqF=p^6+$||
z`HI%~wY{E2cD(}{926w;X1}UxNlW~=lRv+KP~r2kwV8$^9kjRy|DH2)OMYB(2T#U`
z(IMjmT<pz5&t^q0nTN-%oWJffptw`XhSxz4wAiMRR^4l1yB;?7=I6$Ew%Y}^dJR!S
z+eit_8i&1Q@i-Gg!AE%TFiOeV#YF%TJz4uMY|_u+=3mXfd&cbgoY$?!CDRqLe*5N|
zS<a*mCi71J9F;Ed79+If=){=dnvv2A;5aym&v+xq(u=1XYrJcvcL_Ix8~Y)UdA?bL
z9#gn+1%c{$w6Kl0bFA*Q95}n6)|jrk*%%;>?O)WZ9ic^N=7`aO_+RixmljXI;nTGw
zw*Ch`sE)SuNqvR?$}g=V!%0^1x)9oH*uJq(!gOmreONnq3Z_e*_Dq}Ha?!2R+srx}
zgMN}TJOL}*G+dUXSQWXy`C{TqymvY9)O3V$zuAQ$A<PPCWl2W#x@{P$#?vnR;1GoY
zf9~o_LkY>=sg<@;PzPijROTg*-sINK_e3xt#l(Tsacb?g>wxrXFR%<?s^G=)fD4)5
z+!s7I5YQNYEGcI!y?RODGQs&#s&-&Bhj<4&&(MV4A??){ly>%hn0AOjl!;lwIR{58
zqU7EU3#lCOsF^_46r0oKMe+v0RT#_S<=W{KZLD(A-G`UQ53T`li*!0<4!A*e<Guos
zWaMY0g&c|lrhTS>@FMs%BIuvBi^YoOO8HBmSNTRlPR_HFSm8iHp=VpBS?L7H39u$2
z8K*x*A3)n&($SCHcgb6I&yj7>(trd9()He58%^ujarL%xju4HAYQ3^B<yU^_H;0$f
zPDly%F0^KsOs-E%me{pvG8J#ETKYMxeYMLh-*w-QvH~0B%DdW|*@m@PtD7v~?VXXv
zK7WXrKZu8bK*Okote|x!!6w*xJc#_7H1RNu_PiTkZ}yhYVt|nL1UBKUOB@eo_@}9M
z@!#s{_{*B?4YQbwe%tkctpmr*H}St-*+au+Na_ZiwAm$gVh7vsoI>Pp&fqjghQ(_=
zuIt&@oqpEUKf4Fl^sCvk*|YJ66z^Y_(CA2L4<9-;+{r@|szr*usO)HP^`7-XQT#E*
z6l{S-(~|t!;y|tKbsO(O5R?Ow(pTnQJiWaw2gv_w5wU_<8_j=%t`^=UtvZapd7y1b
zL4#>W=DyWT^^kiZ+E^S!ZeS!a`Q>b#xZ<P4&OLmCmiSjvw)h^ChXMI`pdePAyC6sU
zkp)emB6peNsbTOTI#Fwa3#{5iAI{MB&d$xh#riG{X|Fs5rF?te?+F3Egw^3>gWJ_=
zL|-`ttna0MX_$z^W3Aa+l9?u)g?H+h8e9jPf86<vj;z@ADYWC-AnS?B;|<%@(aqnI
zk#h*j_+XlHQD=n4G33cq&4F*w9)|xJXnsRx!B}OzbM7t5HZA|?SmUQf12t;@v4APU
z(l>7;J{=8F|K)3isv|+il#0l^xve!PN;0Q~i}1gOUsU$7jqm35oj0>fOX;N(s;;uE
z@>LSv;n}<kMBqZI)EYA{9}~zVmpC0Obc#(P<4J0cClg*Ul`L?ET|(n4JjN~!O{ebb
zpZv;~tAnpPUd4}Dz=!>y-p(Iyot!^O!=+7%jB1l+Pp*#45h*GII@#v(L*L+Hu$f!^
z(Nzo3`QRnJ(d1D2io-iG;!oP-fk^x&a6c)NNo96Q`%W8+C#Lz>)V|98Hyn>k6}s`F
ziJsZ?@h5jJN)-JrS<+eiZCM~l$KOh-lgziFVZJp_62H2LGK{0#-+@m-@`ZAwRkY}E
zMO&FaFB0r82TqG(@!!QP;;zEKd;qJOZG1oVjN3d1zZZo1XFt}C;{Ryt7jK?H8ql5&
zogD3CqH$az*9cS|X+g#C5a2MV)HH1_F`;y!peQ*7#$^m}EBXQh?G|r?o;wGDE4_6*
z*twt8v07}zLtdC!Wx2lKF-g~SHH{MdXe|aETxL)}w-A@1`F!7)7d!-7&R)d6H7T0_
zP9zxU$mYuBFI*yJfpLxj&B4ut=mfgTH+z0VufLV7Pw7D_oevshZ_3ZLYgZDOz&MS9
zp4(?Cav@SKmCZaCV<c#nPE_`uIpJJ-$qau1L^y@7u)X1)*R_!AzP6e(^^Jm~I3aQk
zDAo9pgt$LWxR1=WD83!lm@G+y&bZuvgFE*7tIk)QJB~C0xD_x1v57Z*czGVFQ#M8C
zum$sJD#Oew*P!lg{sgj5XrXne*E&6~NyDXxt67Qu{}%V3J7<@@jV@R3La=B#2pR__
zArf`wf7hqmFF(XR*?ExWtTU<BYvsJl%IeC5nJ93NXEyJVQ+A<XqXxLFx8d=6-LH>!
z-MqTcuITwc2bV{7t`5I8sZ$Nkzb~e=zo5cv6h>y#>lV<@8s@pazo0ptWVmhy-LF>;
zB;{Qd(6b!dj_#nLZ7&&CGIs9COrYbqCwYVzaTiA>N9K;dIGc~tD1*B?{NL)C#kv_3
zS3kwwV(ZXj<q+QSXRrqoCdZyP@*j(i6A!(>P{##wayZvVjnT4BZ%6ewH%I<-&9<XV
zQarl^@>+J9TjLi)cW4MA{7UvD(Oj23+q7O_-W;ETK}J0XIuHDFmp!<<99Guguc~)j
z|Hxks4<7EpxHv8>EA621AUC<!OlR>;_13EL_quol7m`$B|E3e{p3Qxn)W174U9T^$
zsIaem7&|?QxTzXxu`u_fE)KPSw|VCb;#l;CxMn*kXwE`;O88z)=M%R7IRD%BqMNmw
zVddNWjrCDrg&c|o^KezT&n32D8Xg*Wn}IWvfDcGQ6)3XEY$WlR(i(19L(03|*%yN^
z(h)8d^9AP$ls>>aZ5E@y+GW<tQi|CC&=>kVShAu_jDIC~OLu_sf=yl0*K$5e9Os9z
zRgvrC!~DnflU-~_^zVSPyb-213XP=QVS0z#(9`0iJ(xB1#bveL^TeAIT(>NTK?g?k
zy7syGn>1W*q`gAbyS+bnlx#P~%WQU_DSaWvnweQTtiD~!jb8uT$kNtY@`}J4#%)@L
zgK91=u#U&=QyUBLX^&6sd3~4Tgm9(!)5Ca2uS2$#!#{GO>3hH2Kan#qQ>_Qe@Z0xr
z4RdQxYtIg?29E9or3;iKUOo@L?kY>_#ft9XjObQ4d%)y?3I6Y7uH&q(Qpv!&nfWZd
z|2WVPqG{k(^>^*QxuyB`ks!|WS{KIhP;s*<^~HWPO^#6PgYNqR<CQYs<iBlGsNy$O
zA~95}WKj%!mZ<x<y!F@R;cyb3bGxfpD_D1iBG88JGJ}p)**Jh6xZMAgJ2qe5K1S~1
z)r;Fz`I=3y<#jtJy4Jid4Ar~QTl`XAKBTV0+Q8@JTLQIX^JfJV$?R#1yEj+pST4aV
zap1zMDg0hhB(VSl0G4Y;*W|sTb)szdpr-qrFG7vr_B9>V^~4XQ*)-=d>165RvC;$R
zA!LENm-`brzf@f}I$-A|fd54d<)-L0zgsu6Tm)29V?IHx47l4h9A`r1lS)6A{;MDw
z3>6cB*aF=UXY)exwWGw+uarjwa)0UC1PHtqAgJA5U7Xr=@O_|PUMF+%E17l2=BDX<
zCAPi&-){jilo$#x4>)hp&qmgZeLVB2*i$C$_*6Hr=fo;lZT#gmu4-(bW5nhdP+7kA
z`qC^1W@E1t(#uyN<p?*75FKLv#k}oUU<}7FS&{14tCY{c*SXj~0u5eb(*5lF*#ox!
z$VMNx#9Xd-^y`var5y>i@`TJ}QkeF+^NulxsJ_5Jg5}2t5@3PW$ES+pUT7V-+(;m+
zfO(w6nfRDLr7O9e*c9yO@F0w?6Hq&=z4M1a01wq76pi|m7L{$m-Wcj*snE<-x5XgD
zt?eVw>7l%qdoqT8-4!udanjb0IZ>WP?>JV>_%n7c%)du)J%Ke)X<dQT>o8hgMegyd
z!Y26zuaF&~6%raM&7EJ@u-HJzY|-v(zPIxpc#?*ZGXA?snE=W)V?p_%th=Oc`_aR(
zFv1bdi{75Rgu%?=1VtcZ*WBp>L{JK*=Tkfp-XwQ}o;nBTzhbiCSGelYns{<{cY!7U
zp0~128S)3q0_YALNO;spO5sIv^45bFS9D7Q8XBw*QFxv8-8Fht*H9_2_yrZwe;3d1
zK|lEw{KeVQ=FH$(@{SEVrOQ_2?AkrUW969!J`~GEtC5Qms}cEqiw^Z6*=WlR{g)%f
zpJc>%rd)h_6-?(6LY%h6<`5YviWHR~@WFCH@Dyv2I7{k=TUthj3JLEdS=j94+V%hi
zur_xnPwip5#y{NN7IzCReXGBav7NDf$C;bu5fPz?JPfGo6KAmUbi6NCC0tY58yao|
z8~D|K68twp{$<*~$o6Dl&j|KCaqMSIOITre@7T>V!UQd0*pJ$eim&o0qAi~u)m}d~
zk-BcrXtXTyBf@zY-|U1FiYi?lSMr}98n3&#PL1)TDv;mH{hj$6&ssu6EZjl{C4-8g
zeLQ<|{pF-4)+c8uSUoWI=b)|0bpp(Z+sHDbqv3+e{asw<yY^ACb;ot&|E<*$R@r(a
z3;7(f!;@6Q>UO6>T$TsU+Ks3xd~pdksw><o{A~F*eE}<3<G5le#|2tPbXjKE&gEnt
zMz&_u@}odb+R(;@y=XMj(tF+2Ro`f7=_Mnf;JoQHqR4`u?zgXSdzFNWO~R}SIh&d;
zB!uT}Um-b)9HnY3&{w7R=C<%5ZM(8+T?dEkOLwDugob+_68N>Sc62k<nj-l<18!K?
zg9X~0yMuQJ!|>??{O3+e<hQ=q7-?lj3uoyXyR_c8OipC965BgByUakSw}1grBpJOx
zUSEw{R3ave?a5GBVWzNii$V|XMsWY&1WP2)a(=qoxqf^aL$ct_%*@Pa@=&BX!eMxa
zc_1QF7O}GU`>|NcYJv8wz!R(J|NFe=F$G@IlMCvWFS{(WHLIvtqZKX?`j2rYy`l*-
z)S>vAHs%5C**ovEvo59NeIle=7@2!GDexj$wm;HT?{0Im+oH={xOv7bUTm_CFkBmP
zgda@$dm9zpUHiv)ru-P&7~6ITdGn?$F@K*)z}8H<%r>6YuL@KRmy!y3#{Q4d@Q+6K
zJ>Sm~y?*fyk=#u*tI<L$2)KCW{|NYqKoN7fu$a_=zSSs)Qf!fwLgreSNnNfjfl+`+
zFgN3E*7IlcRGYL}MMn3UF`Z{<{L=bmNA3}0PeP0$MvXHBsx2EP-;q2t9A#%P_V@4A
zwCTY!##jDF$`6Nz&tL5L8j?V~`^kQ<@>@Adp9rl1@HJsZobJsC6ls==q?vF<Ietq!
zj}q1j8JnFK+rD8$q@FP@nSA2JNSU?Lp5=R@B$0JKLyc<3pTswKpgd4A`Okjc+{nGK
z$oDeCpw7xXVY>5vN=n;y83;Lbp&Cpi+mqy^xT<|cLbRcVKSj-cn#vi=5k&pX=CW3f
z7Dbk4-*0%7(`AugR#$hut^Ha`+6vtY-HvM#@b^G(P_jwH3LVs86&l^E5sZ1%P|~oY
zbC4?&r_1*HDr}cJii>^@Tf=ZVzInTEz3Sip6)Ubx^zQTIm-QuY+E2xP!kniMSJpNY
z!cfZN_lYLOY0fW!CzgwXT6RN2)+5cIk{|BTn4P1Uqrv|bqG?A}NK&|JN!xeVW)XKi
zg`>Y|6cfMm=<RT3&uGy~A|!gFQqe`|`kT|G^9jDAK`b6DgooCU;}THHKvQHyo)n*I
zRMojf{?<|B>2FWQ9UfKbIc|d*WK-i(b(PZrOX$Vo6ASb6c?K=kwT-)f?A}gJ5bZHJ
zZKY}a5hG=kMeF#cRI_QI)u_>kQ14}M4Bb2~>N4Av<%5aO2L8rHGCDgsv1IKVw;Z?p
z$H5Vig_-Htk>5MoRhdr0FS|>s^_OhS;rD{uBJKYa_iGVkQ`|>Jy?#0m2ws-vvA4H3
zu=YuFXe;?QBYh<>^?d)g-q=v$RsW7#{deiT+4<-gZ;>6x-#7H~A(rcdz@hr_GcQl6
zAKEbJi=!Y4TwD3X|CawBDdRX}bw2C0{_ZH3U0GCYNvAp<H8QmAAY@-@#L270_eE7-
zhp)V%C2<nVSFdW(k7WxB{<BB49HXQBjEWAcK-b<Q`_JdpKaG1u&r-|(m<Aub#gyWl
ztMcI&!%Jdr*w={z&>=dJ*ETR3<@U&pc&D+rZ_>}yaXp0DafbG+$dgp5rl+3-KL`>k
z`vO0daM~@luUF;VZ}}pZwEZ5VP8U)}S2)5t@P~kiL@E)9!_)mAIi&Y25M?A`!bLn<
zpWSJ~zlM(JtAfx`XkGMg6p$#dKMhuAWBwh5uDf>hXd9<i@f?}Z|0K2wr&IZ!q$&nC
z>F<to*~OO@Drzifdd&D3K_@BAe&7zw_rhYc@59=Ww~oI}wP`^vL~?G8KOTSl&zS)%
zE;J=W{<GrOiLX*R!L+xPPFPUUQd!|o45ScyA2HHLGw(SjM;n@zHab>ODEjvF^du`z
z+}OEO(16<0RwlTGJ-}Th4a(nYTU>Qw1aYTt!<-Z6*j@d6()W4Ixw9Z)B8d%yuEI3`
ztP5R0RUrNMYASVz{;qxGY~3jxU7-dk=MuI<UEChM9#2I`H+}1}@KtpDHYogS#-c)O
zWAkBL<nVDetQxaXZS!p`=5;d0GpsqRdB>WC>TthO_kBUtZ#_?2gE_m)z6-*mhNNeH
zi}1t=F4)KaGb5CG>Pf0yW0MXmU;f?#g^X<LTCGe~0-(Pch^RjA&vj2`b(!q49{rr%
z=wF?|He4V+x#Ob(KTeSpQ?N;#$={Pfay^f@ulYmkhn;@Idh?iAzr;DMy&gP1{f<KV
z!0z2-VJ&mhMT}lMe+gcIAY&nCI}$V})c(9WnV3S@nW=5;rhMl1$`QA5#SS%L>r<Ag
z_kFrMyI2eij!D%}TcB-SB!1jE&Q}`+qnpyh1;qRB<3cv&*LPp<j77?DF_M6hVi%?)
z;jQC}aa>tcRFr|RTS3alV>?wxz&`{{%_&Z`@HIUVL&WxE_5WJc73U?>vy*Fw$bzZ+
znEl)qZXhwP3SY{{h}m(Me`4G-lp2vefgMCA)X@ip;)UaP$ca%B*entQw#POMw`~^9
zr;Qa|<;MQ}F}gHc?rd`Me>^P1ZMyUAd>x*t)WJ7*^}g%qYBxx6N;pASIrv1eXT{Iv
z>QwIaxAtkUMo&E{ry%;(1XT#T<Q*T?i8)N>Mt}aSKq7a>V}&eY?WUO4n4R~R2KPr9
z{FI_fzdueI`(L-y=;yEo)Jznk_rG_?g1ft@v5W1ys}qQ`O&3J6IufHswuADcD5d0|
zDfbFzZ!#>c8Ey!J<B`?l^DB#(9h3N<BP!s+ttOq=kAf|!;s07t;M2WThB^@2YEAv5
zF2NQR83>^Z;(q^ob4soxlh<vIja|^ciC#ZX?*3!U+$=*)vV|~eKnH?$m+#sn&cjIp
zFds?DrN>n3u(PwX(C>u4P+Q+fd<X2NKz%{;q=yNKx3lwDT_e9&NR~;qGwAjaK8n%_
zJ*5Q9oy1EaC4;__oc0eM2<6fIS{I_<dEf||mvf>LZZ7ENuDa$w=4S8zSyPMvoK)}6
zl&^)hY77j_cMmN-T+vEPOq91x?yMCXZd=|FD0`qUG2W&>-_DU}47Zm|9Nqdqhc%7d
zUcjzBRhBwG%|**4?cMJlXZo*KUhiK}D?SUodV%~oyC}^9Iz0h1A6DpNxsdQFY+LBa
zQGxDDrXG_==%C?iA?&Pqrw~=1iRhmQ?O{TN068W`<NlnakG1<mKJC3m&339SqBUZt
zG~w3cw~IVMuRmSB_>gFy%j_kQ#|0t(dvls3wy(p;R|W3e?6<r?zVW%EYsnxbECK)c
zh5!cS+wNI0*>c^`uca$%-EsV0B<t&p4_eHBh-KID64U?*`>HUdcN8L+&6H_F51x0F
zvAt{ik0D^%kE(Ds(x7~K;uclu(07M&XF9A1c15lDg_`EWhifzR(oFRm80SGT!)RJ<
zrxEVy_F)!gzjHHFOA&fe%-S;p^ioUp(hC99WtOh%uN>DirQN175fK0jbz}eA!jE3I
zRtw#tCB3~-mxP}b`2Fuz6-Y!mglQJ;!MRs5!nx1=bM8n2-6@`AKA&1Z^w@tC&jnyu
z=yMzOfsrSxs)*1o_seX&`2M@ZP(rUSr<5*J`dm>)#u=%hN=2`Fx7L8^p}1lpoTfx?
z{7N`mFvs`S!?Tr%NjrD!Ys@7zwGd8C;qV7_iL=`jHE=dQ0;wmT{0L}i?)b{7g0>Zo
z6OP*<$40(HL>{fwhU$`Y{Lj8h=l^~_tvOsY|CMOnSKN$M{M<Rl1}?{%#dfod+JT6U
zjDfDcbNpJ<Jt^hRlewBlV`R}D1D=$K&)iESG~D?&>O=BQdjhk9H{h~#PanL;%AUB_
zrI487k06ttZ-dWv$6X9FoK3=E6igT4!j6PUdu}WxJCwLCcI4}mY?Pla7#Hc1Sh6E7
zZKF68okD)%%enmlP4zrQtv@XnT=UlBiz#<_bHpt=vLjjNb3<V}`_xL+{;YD7W6OQQ
z)jReaUkhTFNsQvTOjn-bI`2&_)#+|!H5DMTSh<!lz)f1(Mph$jIPqAU{wU>-Bi_Y@
z%XvAqB7X9mqyu*~yE5<gH2Z9)!w|&6)UwKJPh9=YPNqUMTW~ezwXuts6umhiUP0S~
zn=-2Vk=f#|F9nH`mQyADfLr}qS9?#7W?td->ChDt>UMs&KaVH9DJ*iowvh@gnGz=#
zjd<<8fEv%MTgsiV-g&GTnRK$=fZFB`G~8%072Bac=^J@u!S!QX@1!CjM&MW2WG)E`
zan{dFQ#{L$tS7ZMHK};IHbH#J67AmTIjyc;%+AMJ)TKr$#6@Y<5v%R>Nt*T@W!tsr
zhQfa`?~?}o>GwZ=le!{8%T?s?ZVBrtCzO8V`Rq3C>K_JjG((2+nsnf2i7qas3s;+&
zo`{T$wD#+Xrt4c&94^hDEa0HK_xzUhowst*De-*|H>MWa``QfMKbIp5-jR|_0ZYf=
zjGcW9+@I_x;VZ5z3eMYyc@hqjOB<yFVc*g;MV%iIn-1y<vZuT%r(&*_ad($k|DrPJ
z)3)B+M$$Ze5!$$)4}j9&d=n>YR^jbFA+-aKgU_0ML8t9MZ+ZGPNT~PT2t%~R9C7Wt
z>2eZk{EB4sAZ-ZbL0PSS7A<@4D<NTTXQ#is>OM`rN-wqX;kHZMdPxGCB56Dur4s2C
zU+D?4wETQ=`3n<lK84TY<D9mwuYi&hNvT?zG_UukjK|kL68G8s<XV4vL8VgfK0f<H
zKS4fr0yR|~t<CJv@i5K|JF?NR@JLcp(z><g@N{^{y7MWr&YMoE?mWKwe+R?|h*l?u
zJ0qqtmmAhr`{u6Ve+ZG#7&MtziY|ZAs~&gN7=7B?KV&drOkqs;jlu5Mg5cV0NKwhF
zr7cKoIIx(qM(1AY_5;0&Qw?jEq0|3)C^#O&Xl8G4N@1t-OMQL!C1b0Cq@Ea@+<9sD
z4f=ltE4Z!40Jf%2e$UQ;;@Y6>;CA6OCKlAZks8LY@_L0^7Cn^L3^ZrG<-+mp=kr?M
zzWg<&B1WBq=TWk$_v4rybgEqmo#r^NUD1V6Pmh-4k*Pj8CCc`sFXZ#|uUWaL+xZ2I
z1V+iM5P3*0wrd_YIL;(kSSV>-H+E+lC<`x4%b!Wo=p6rs+L(^49th-CVd%P|r=M4}
zn&ig1GrL9m2u%eAE4U+@5D<Sdg}L;tIq63dZUvkF#E?OTWxN~pyU>`gO*m&_a@3pO
z>Fd>L-(8}6h$JqN6JnXKXrfk=)Q^U5-~MBaX$7oQ7F3LP8Qt0Cn*vaSOoPn!0<Ltz
z9`cAhy4+S1Z?DPbyWTLb{V<R}p55z|xKuy6UVhuf=UZMm!;|5)VtPe+$JqkWvZ5lb
z-tLT@m+paHqdY~;Mww+sJhoe36D?};pr!SXvZ&oQqSSsHcJY@CwE!VW7$22U-UA1R
za<I7KZlj|iC7>{*L?Zj2FsP>qMa{e$E>BM8n_%p>&`bG>m0ZNPB;d~D3I;QIp4?eq
zGRS_4HxV;@0F^TRc6vLLRx(D8iws5AZFAui_EAq%ytPlvKuTA%!#C?`fanepx66?0
zEKl`J$B-=gfwdURUEID?#3C#+a236By<W|UaZ_rgU5YhO8w}Gl`4qe@!+wwo9<4=T
zrpqNSzmMJH6MRfn&~>GC`up&Pt%g|o?fv~Uk5B+JJ5G7-Iggq+?DwF4sy=7uou-rd
z);XOV?^jnw^PVTaz;`UD@P(0q$lEu@g}3>)KBVLgiZVxxD%Hu0iz}b3QCN%2jh_VF
zqfg13naQy?gYTp~LW%Y{ns-}2A3tpN?(5y;HmyOae`;q6LROdLVJlZ!Y1>acnTl4p
zm=y3fVEeo<GUPW<M+;FH4(;5~S~|^WvX#}rYDITrjl89OY#zmXiCiXUEK7K^yC0R(
z-D%$VQSna{DZ+GCdbIM(W6P_%44&@C{xJB%$jr#ReN;iBkkf0S`T=B3EXWUBa4Kyh
z9xG__oqomt|M>b6XeisT|A&!Olok@Qw5Sj&MA=HEO|;n=MfNp&mN98VsPHO#$x@cF
zWGl>+t&J($*w>JC$TrNF`R-?AX8OMK|DX4q_jC?s?&o^0^>_WQ>qZI_vP8CUc%S9%
zl|n9=bb@&A?JmnK*<g9Sb?*K8-^IY?Cs|T123$A%&ufb(o&LilTO^0TCcYk+c-O=<
z&C%}d?A%<9MUt<3*-Q~~0~_T4ha3zgOq&uP0T?^h-|@C#H96ek51Bc;4I$168a$t~
zZ2wsNnq4-R6lp?<Rf}b8KhdZL2-<5tsAP0)jIo8InMJh)QTF}R?nKV1bY2|k>#gZ%
zjFPISmsdfXRov2^r9I4N=a&0%3Navlug>`Jnt9FqY~1l!E`!FCjm$(O5Uma(%ULOC
zin_48HEx|r(j8yl{-;{P{M$Qk2c@%Jd|cD~jToi{ZrKwL<Zu{`wprZ^NRM6`k=zuu
zd%4a<k+y5QpRG4(*i#m3E655qs#F2{Hew6(8IG?T*7PfKL$<cH?SM<V+EDeGFG?UY
zAdBG|s=ca$Hg>9mvO_NR(NE8uP3p#tEUjkr*B#zs_vF&|UNu+W)3Ltu_ovIH8y-qL
zl~~=5F83rEM$I5!j8=~?pAJH4@czEqy`lV;qU<FT#n_PJ4%h^HpSy(HW2B#iyrm4r
zv;r_Up<BJr9riVDEF0l#mA)r;Q{1WPWRv$#Z>E#V_y)rhf#n1XVmXx}AL#5iA>}&J
z>e6x|&^};xxumP8qs61^#$;aIo2P=TwyYt<9shIoK(6Q$$2IdC#VOW8y7uNaiOibO
z(i#|Y0)+cjWi!hM*&g+Vl|NL+=Y+6f(f%=BoEO%^7S_xB4`!oRUze*Thz_#^3G{m&
zKe>*PcL?V@YpfpdQq7;Xl%G|w;Fe?hMv+D!|C4Niu55w%;|Q+~M*?YpwotC5toG~{
zZ?e+l0+!g7hs6*NVGi9=PFG78;b0ALa=bY<OWRsEeJ)~mJIOV6@bGpcMot2fKxYjA
zNa2ok%zCu^{JA+@r{`F}tR`(st)6t<VGdnCzE48<JN^J^-^|Xd$n?Z?v%1kc?~qQH
zxzZ(sU89h$U78hBaSK;ET-9L&%JiMaj*hJn$LF7y09;#I6M_NObNfVOIdsF$Bt6Jx
z$;ZIE%sk1}7^k*w9+97g>#>)xHDiie?uQ_7%<NE$k-vSmw;)dD!?-YpG)X9+oDb|v
z^{O^JVr{d{ZW~MH0zPl>=+p<^PXUIP(s#NyN==>P$ygH99Ze5l9#zO57J|7&Hfcd*
z`Tb!fIbIr-2NMRWD9Z);!2WeyA0~?I$H&K;rle4ncxCsEEJ^ui0&W>J`ZC*>wblrl
zp)(c!6DiMotv1S-N|pPupMK`B{9pbj$0sMl;f&TB|Eb4nJ3DEPM;$eFj!U>iomJ&P
zr(Ypg?VgK4<vwh;?wXTaUZrwT^Pj}{{&SZ6Ug|Zu^7Z@Q(9MO6shPxvVDF+R174wU
zLel2H7k6FXOeFnM!f1eQ0~u|9!UD5q^i3l3f%hu7ys|A^FaMrBNc>*jGZ`-JjoOT5
z$ARbuIy#k0v%7TF&c#Kp-nX$+2{g>~bP%Lp`_u%}FTS|)-u|V>k9d#doKcoML1Tow
zEbnI}l9<l!dykjeQJw6*9Z|QllJU{WuYsrKfX1=0#Wcx^Exoy#*0mp;XxfV6fiQyq
z5w)1!N+66?fK%VKKRJ`L&MuQdnFKdm$W0v>u;a6FhYe*?mMtKRJB*v5%jolTg#)K{
zLcGn)l$xZzORwplCRMxmb)7mk6gy`q0V?d6gaA9B&2Oqa8U$@81urA#SR#?w0R%z*
z4ry%pn)xLFvD{B=I!VYq)X9jsk`Az?-x&WzvWfSqZ)-6=O)#D|pe#@Zjt|5(YZ~5z
z^undX!9?Fr0Ki3#gv7Rd`1yh9g3Objaq{ob&(uhfaw!Wvy;qiBP)(2-BVMh@=A%*Z
z+Odg=;C+cM4rL389R*x$Fy@~${n-CLw56PCOwKkY+hw<~yv@UM0FA5oi7+R|c&+Ky
zeYGYzI6Igbok8{v8_m3Vw&N)ekTHSTh#k`e?9yp|@xV33oxDkZe(j5<8rdei^GwJn
zzQby6iU`_HfX)$J3saok*T}p}?kGxDuw*(XG&e~5_iTfn3xv%KEv^qVnZMVV?z~gB
z{MQE8+kUVAoCrixW@**gMePl$5|zFeWyacEM{hB8{n}@`^+<KV)}x0O)w4m{IN3Nc
zYpOlKKZ#{SI6t<)UxbUh7qWtaf?OvJt>KWC?Z?$C1cu%^Z-&+t9K(ja>o1p&Vlhqg
z<kOrj4|z8_w*Ddry#c`dJbz!a`;W&gO=Gcp`$50Jd{axe#1&^}9hK>O76VfaA0&6O
z?@x4}!fZF?UAsg!_3c8jerzE69gj+FlhGQ%>u4(Pr}cH|^NLAL$mP}FL6^bNo*(j#
zlsMb2{Uj|uslL9xWWmh0CN76&n5qfc>ustgBrT4Dy0$Uu*n8BV2kmx60=$KO6(5ha
z>V15M2UQ-iUPS@qTm1Ho{F$5=9)z75`*P<mZh)>m46-6UsJCur4J7i-;W}+0JUkqZ
zV>RDomaj-tjRJt)D+(<d*67QG?o06Y1J0*Nt5AzY;lbB6$WH}W*z?(3qZ?JG-H}>X
z+X|)%ytaW=UVID$w{4J1!gEDOBT7}Rx-cP}M_-XcF5lsD{1IP0=|sOL{T@H9^I1Kk
zxtJTG$F6CLK+e$E40(&qtVvybYSr+?$JOlbg93^YJ@NXUG`tR)zb8JwFjq||8|8Ba
zCGyt?5P!F)Tc=~Osg$qdph4wxR_x-uL$AcjsfVJx#chlP)-zQmsv!{4uwx4>xG?hB
zEN40_8$e(5J`2E2z?oeDL<TS-tf_PbHSlGP(3PtStP(*B@<`j$4~<)=u&ZhR4+j=?
zNj?MD1#6(8x~)*IEagJbTTn5J92<TD$2D-`0MatC3RZT7vKsr6xj!*;ulVhlhKSRs
z<jz_rKJMV2%^sG4Gvv3b<WCz49$LqU*SIrqDklxOghPS;eU%IMO-)Uwci>x(cKZ(>
zjOJ#$7#>j-fpiHF{!Q%3u;&-uwD3}7l;sN`gtpuinfK&$^8_HCc<A?jl7N~uevnu|
z(B8}RZf@(t=oG_QFhYL_2Cv>&a+!l<NM&KdIo#jBJckf*ySzy6Tb^FRzG24dP4i@S
z&dE*U+mKz8>XN!%YjU!1cYpj-XYL1OIm8B$b8pM1A3JueAI9P^W&OtB<XNC;uS5P2
zQw91QS4=gtlWu2;4uA1s0l~~8xwE!I8NQPfJk)FG9wWcFcO?1K+}oK}F{&sATdSyE
zj(_Wb$WhgR;kcNZ{-29u5)IQGkMQ|^q)G3lrw?m)jpJ^WnjAycGnUMOGyq&>{CZu{
z`X*!aB=4u(P|ZP^jj@Ukwye5Qjeb}ccO+j5kEj8Ou4CPv3aj>V=YtOhz;xB=vfrN~
zt{vvcb)VijeLyGR3P=Xt@n@}Ju~>jw_;Z?FBTf;<uJ@i3zgIZn^qRED&b9ja5TcYG
zRX^AHT@UyA8g*d$Q-uHioSi~Bosp2!a^2i?u#Vr|Gf1+aza3_t`Bz{Mv(<n-Uq&(e
z5lt>E=KSs&R{>!bWv>Rx4syeFI?(=a@6QdoZQQuA29Qz@x`Jlq*ZWX_XWga&t2oEB
zk&F>0>IKBX{jL^gJ-U;6r+oc3wm|Y#+gBuEL6+|=rAO1x)pxE(xFv(NPwLiAdo>{>
zsWZL5>CIIIa(m<WRWA<~+Yoa`s2{G-L*J3o<$zlB3&jUYxOtiH?h0s70DtvXJIQ_k
z69?)jz##LzE^M6l?urikb79e7QQGgtJS8;|#qJ=ZH+&3>04J5l;T-2SqRP$IY_x?=
z@u15h&(>pS7zJt*=%auX)+|df>}5qoH@K`iUZhrECi5CyrTr!{@s9wgk~6JfGLTKQ
z%W@w6>BFoKZGzC3SHxRe#FjIJ9%8Z;H0D>lQ~XTYQ7h+$?%eqrJslk#zqXNddi1%*
zm8_IFoZw;tD}!2R@v8f$`zdsbz;nRQsOV<PB@COQ3ATTlx_@0}rN?A6)BB~_o@Fw1
zW0$7)1a43IbN8$2I`ir&Rae?_;*JmR-^-JYfS9d4Sj-oQ8M{gR`xjroiQi+{xQFr)
z4Gtp8vh|Gh^}3G0M~#42p#8X}U^p@L<1??IRPkZ#hY#eBytubN_eS5@f`hxfzLR;r
zns&ds^(K7dX2vKiNwaP-n!E-Y-HGyDE|#u(zx|cOqch@+H-eJ@Jqu87y0r9Q10wM+
z%cIJhcJKHNQWm`WNEMtYrk;e3nk_Vz%(WQ9u$z6g>grXWEBauQh@NAII7xGQy$`hP
z3`o|3hAav%PXH=?j4kj>@K4eM0#<M4l}}yhxLrqM<5s!@fg}GluHF!0fT~kr^M7p#
zIt!IU-J6>A{aM}sNu6_Jwih%$=cC^%5;{tgmaO9rQ)k#KI&I|{rrHT*Z%2kZyQMJY
z`kUF6MyduZqANDSa9BW}TT)060?`sm{+IdmLj{4a|0{k;?ToTm-TLAg1~~f~(6Hcy
zWruay#er8oVWAH8#`mBQ3?ic;5^4$Osr7M=6$-^1b5TDx5YVrp#DHsoqF<}Wy_wq>
zSgzKyew_cL!SE~H($KpSk82ofi*?yo;*XhU`-SYdEm?7gCy^gMfMs{J>PK^g4NYEP
z5CX_j>BQ+jjW=B#ZmH~3D^UA~RkO#bcVaOdv(u-XPifD+DfM6k;o^^b%(^b)HGqrW
zu|u*x(;K8lz6Z#LrRhx*{>UmV`p|<icoL0D7+L_znYDAlmLX6&Y@5faW=iC39h=Dp
z0lx&Pxj*c|lbK!>hPU#8gWEnR*XgEwBBgAryp&)^mM$Lq*80$X*@}(H=XKZ({0P~u
zJ^u5aIkZue4@tuw>Rzmg5n4ikbfRLwUdzlGMv7XFvZdBx>(m*l2_Yi>ia!sp`k<{=
z&Yoz1x|->|1$RJJr4%?C1D9_+uEPnQj{#S&<%t55f&zO)`5Ii^+(tAk{%vf~hRdu(
zFPoqh!Qj;weOgWkwVVj|ZJ3;#H1Hd&f=z1i*b0gO+AReSvc&%t%OTGHejTsy`~}oK
zS2*rqxZ!W+NT}GFl{c!whVytCO}O8G4m!<c?l+i!{vISztJPnfv}h?TEbwF8{$hd7
z&SsXrDPVPEtrvH1InFh|q#`v{rl+Vxk>*ig`D*IT6;&(<KX%e>FLCJnH#`bBFqMJ9
z^y@=oPzW!MOdTl$tqj5+qxZ#>!S4T+tnB5^0@Mm+{B&VTPBFW)%jS%#(;9B4QyBEI
z{V#z~+}WYXttr!wDmN8|pDzjjT9H06HWntUzMKk&pz|v0l9j@bAjxkHRQi&~hiirj
zvMd!*AX-t7<j-}(vpmQggD+qoF5aAD6*$D?Cu_9)O%Y$HO4&!uKbWw0;H&&oFkJES
zuz2A0lnea;KHUd+FGg1<XIOj)pz}I%Qh854j~phoUnUr%FDUr56MkLxEo4NjKOmWS
zatSi;s<Mgq|9nw9xIK2uXiMOGJ{@*%(9<-0!HWZxK);$!&jqezHbqL#lLg{>*0^J7
z-wPi9PHpdE1$Cc{aGRNu{D}O`)rf~yggwkY2tbE|)^+hWwBPw?|Ef@*0LVMdWzu+{
zJ+JS)-%h$C{-8ebCNCwWvOT|O^{-cAi1v|OGf1q5EudVB+R-T_9gc*UuwSz2U&*MD
z#OfYt+n>qM-#U8z9yFA6q!`F%472PSujX&B7i*qsx*(%YAhPU`;(qrX_i}FI-EuYj
zdg;8g#zkipROD5dUoK*`qB$RrfMR`9W2@-K*@fCoWi-|3b!;Y{BQgE&Y#T*9mn{zR
z*w+Wmz_#<(#x)u^6BGW5JeuFLVS{l{)sxktMgZJHO-~OGk@I+V2nY*5CaMuT|0=pQ
zbz-Zli#bj;`_sZZ9>aOO=`iy=0vT<%(6OByzWxDxt%vT(+5T)U`z<dcFT?zm(Uoe*
zyyh`t>{!yg-n?FzqAvG$+F(-8&QP|c_rdNh7Y-)ff|Fd|NuiraB*tT?n@JCWpTQv>
z?e<3qdA$FQl#4D`A6BR<c`6{*Z1vgbzX2;eXKZz#N6iTULrvCXcj>j*0y-p2EV>fR
zi)#%@osQa`D17|*aRstsPFwn=Q5Gko(akB7;UzFWw|L#$imR_ePf>=FH5+@bKG==1
zE#Mt~rF=oi>-}-c+T%+N#UMznT51O1(}Am@cN{=f@TH~0KhJ;RbfG@8#R!(tfQBcf
z23$MVP0#8MzJ7Rc4-Xd)OW^x&1=|rV5bZEPG^S~XBFjiUlAGB}$o0nk73A@*eESKo
zz!7V$%90S^G;VU{yjeMTG8dFZjqv#lfpqTNsT0?9xWOG4510gF4Mm`rKy7N}V-%}#
zplQ{guI_PT?@0(-I?`U!tY>WHR^AgeGv4E2$|!fiYXl&6$zJSq;cnn+*rC|5*n>>D
zJIafJFH3%t@}}SoXHn<vP|}36pF&RDS?lGdCBq!h$WQ{ElSxg-vQ3U})oB&>%;_o!
zaZtfUr@Rt)7YzGp2zSQ#AFm!sf1l4mv)Q%g#9D(5jz$~i)8dMb%2IDvNQwtysN~^+
zUR+?I^#l{MfK{DFz}W<VIAr3yW@Dpe+dGNSJ8zi9hQ@AyiU7D@=`5sCFi2B0ewO{E
zsKa3^YH2_;iV8eDX=uVZVLN&0PGq*nZVb8m8*wx9X#vl19jC-eF8{fW_sZ2U>*Gt-
z;T)<iG;!TF>tfg_`t}Oi1=na-Rdhf&bFJN36oI8IHm7c)7h6d3=n<GI-yPJwdMU?>
zkxp$#&~}_`RmA|mo?Xn2xs(^&cf>Z3`GCJx;zl3_a+x?VP-tD;<rxOr`!8q31M~PU
z3;-_c1+HG%Fg0zR!hhZ%;DcKcj`Pkhl}Wmo?T8anD@bFx==?gp?7UW;KVZ}2Q407W
zlZC?~uAmcq9^m@`=NbUS0%Pq<+Lu@&7#KQ@;GEnFeYW@Rd6cpoC814@mH($af`P3Z
zL=GbCuuCr+x%#E=_W#s4a;J*o24s#Cw}oPqY_2($MR+g<_+SwL^b^H(<I?U2pSpJ^
zt@kT<-KxO02W*I6^;42`COt0k;?}p9Ip2fy3Ixzy{1FYvqfhJG-wqZ~{tW8_VfW;0
zAuOIrKoSRxSSoOh|2SKG*)`OH$Y*wrM3_qFml@c+5_taCKSGFL@ZQc^pH&7OC2L{#
zz{01W+jI4^9Wm|A&3v@URM~KVjl&Y5bRa_k*46S_;U6cZ45Ern(>0Zph0=3ZQ;X6<
z{uu$-O_#C!r>6@ps&_Kbpc+zI$T|YYnkx^X5Z(HRYNQG!CAlYV1^7IBPbSI(t^gW;
zY(>~u$i`PP^HQ6gX4=SD&;d-d1u)ak9)w(yYeH(y@8#wO!2kv!q#yh)RJp4jP1q*>
zz^i=5F|W8deampQYEj{W!JHlw&H}g9JZ}tqkz4#ZgMC4dqvA}U#OejmAWk2EZDkuI
z5O!qa7ARLM>rzmbw;y#_&HwTn1azAB2FQg-ueQg7cX_n8;Fwy%g<(ei0ge`?=yK{z
zf&Ihw!1dC_C5m@kZRG_d8N%k4?}Ur2K-CwjhDUfVCRKQp4Qchr`g57P+gw%||Ir3;
z+JZhppH)kbuW=8n3I2c(`{d0f#t$BTgPZ03<c;{z=4XG8MPj-sz;%F3c`aV)(V*bL
z4&$`8rqSQOAHm3y3CJ>m6~codt{Bw?UiREGrmW<p&viJd!!Jyaf9Jf`yF>imIqg{a
zIQja}8Ac5F^*4+C9<&BB@qOzv;j`53TMc?)QED7h^l2f`{VY`=3u8EsGGZ@;@DcL1
zM+|-H-W9q2JGVIHl3RLg-Ok}=9|pelbw#s{4%QkSB>Rkxj)olBcuXwEEWmk0bA@C8
zI5s(Kv0jL#MK3C|oVtB@>g7eC9|dfD``IC^tnb#!VS+TXY}jAG5Qbbj=Ut1stQ&eD
zxj7(vCm`NH;o1@}E=G+uQUaQrhvHxK9qu9edtx!n_|kNvcZTQr2H((&k^noH%tXY6
z6@@XDoC1sWfE7>*k{b{M?ZGO$qp3?vcLt7kE2;yuCh8bRuBU_2>Xgx>rbqX~tVKJF
z4=Yzu@<wmRi|;u*tq_tfE?j*98?ak8AS*R18HxDcW{U4&-+VnGI5kP4Hr-F%2xY|y
zgbhf=(EA3`72V0r3bQj=e>a+~cnq7D=u9EG?eqLEt|fc3;}8d{Y&Fdq(&TqL-CR{D
zjTsma20HFDb-cmHInk?7JH6;?`X$gB`%Q-3wV>&iP3jIsynz8hiL9GFt}D9uO91U|
z3xvb@oS@u@ym|bFVMY@88RQD!KaZrI_d0{|#P?$|Fry<Hct9Aa3S3@*XOgZvk(3pA
zn5-@~&OZt+t9rr({qlY366x}{rvxnO6y1lsKFmF@{Aa_iZHSq4)wu(%-Xo^qpwcCS
z4@w3$c6=z_d)wJf^$YP%fBf-b#$#UP>5Tp|-hM+d84k5W2LFUwU@s7W1`m@PJO%fk
zglg3mek)bnHUx?Xwlbgg>l{e?kX|^Q*mCJxK#@I@X{m9aN7@l*(rRpZ1$;o<%`nCQ
z0;nB;GXz6)E<vB>QtJpYVTH{ABj}kfT7-KKAX+)21~OgS-`S2wS9RA2&Jk^gm<DX=
zWG)}sR#@qvv4#V3c%;CxNxmJlc{Cug8Hoq>x^b8jsChyUVY@78YVCPZX#YuWuxIOo
zg{ulmO_7Ey_!pISGWS@uKS^cJxW!X~r-e&h8H!#=KW}b;9a7zn(Av(2Ql=Hy2N(eJ
z0No>cSEK(6=VSSnN32w82;q20Zu80Kv0o_dH(CtQl?NM&q_6OBePp7KXqp0?Aeker
zkpDeHn|gL1kf|7JX?O_1$UpvgpOQGV&_OHjNqblC$4~HQ1XwUGAqO&n5A~(FG1gbm
z1B#ntv?Ifguy_=n6~q;pHXRuYmWNwcMeh#1Aj&Rac1K^uvgPBXF;9ha>QM8rD-XlR
z2z<ujQ1^MQtPf*7pL^)_rtXmD67m;f`PSFK<8wi+F}8ZCR>=TBuNa@b3dbmL;7LPL
zhk;6Sa!ShX5#JMboPHt%a5(`ZGCw;!)x!>XT&g~DXR*h)?A$@KI<CrftG^(o32JH3
z=ejk2>wqAPM-8KT%TqVeZJ3Tn&0ISEzShb+Lfh4G@nQ~Ri!Yc66CjDQ1wNJ_d5Dab
zDnJD{if*t#Zh($P&uG8Nqpm2(fq6LZx$FAZc5zHq5>fm3Ya{Kl{bdOBif#3O-rEoh
z>!2oOKK$=N+MoST972Rzo32~4QY(32EaU(rCkST&<xk3a5t|O>j^%u)I_*VC1G)?M
zL#HDWMc1xfo6z$xzK5qPj^c(bW`;JoCsAm1F33{;BW6Zd{l>IJp|^s#y!fiH=$$#(
z=WK>PyYRGcS6`|q0aBg(fbVu4{M-*@4TDh&6~m@^q&tY=<)8Qu|57T>?I=M)$@Oo%
z&&Xn1`?c++?KEr@8LGSk_Q(gIUeLFBH2)~VG8uGS69d}c<Ow8WKwe(g^2e|xOC&^A
zbuOy4aW}`*+2M9|Hy*}|1fyc-5Svy{kG0#puk?`u^@sz-IJD(2i+&OQ2J7d5<si5z
z(KWfJc3G_+w_D&h02h*$i$m$Qh=3<wv_t}Iq!XQbsd2<*0;4+)f7N+Fu}ZFg>3vC-
z<{50>5v6_-QM2gg#^^bG{o7pR22n-U7sDg?{FsMb+2nS8{aqZn4qp;n@v5FMyGuyL
zY@zi}k41v!Fk@f1dGaoLqIYRGWhs2_Ye;gjAt9OZ$pZVcS0Z8}l&ox-MET7*-|iMs
z0=#lG7n=z@LifS3_~68HP_tI?TUN4wt~k))xw@)?J9Eu^cbzM9Mi@A^obLI*`W<`a
z)?r;rH3bIZ0B!vGE)JJ&^|G$35QVDywMX=;d)Jg<7o&Uz3=<$|g-;lwIm+o{b9t}B
z7KQbzY651K;KErKGQTNbuR=<GU!Sh}pQ_$Q&iC)%_Ztr-?c7(Z1=7*|;Wq$_v!&dZ
zc{edAhhGCnnOyP0TMttq^RVWgMN=R%B{<s#hbE1$YW|7@JY4My07Cm>SHoI5Fn#O7
z<YUlhI&hTir&wpRYQS&;{yd?1TgS&16Lg&7yQd3y1s~=~1#H4rgi75~qA+QSe0zC#
zqPRmw#_(P87V$uR?4Loww}Nk1qY(^BJjn-t5UbViQ$EG79b+eN8m~3XfYA11zz?g~
zp@NN<d<uvKwrBQQ(+LTn#sMzQK+Vq!G)yn$R7?^F%dyA3>REEuARy6S3bmL;o9*%f
ziDCIxtW2;txMd0uU~vEtOiASQbuKgm7VLD_aDosJrlJ7*a|4BUA8Fa%94JYeS3_{^
z44xIi1mn3tszXn`&1B1VFPynQ5L3ZaE1P0)X7>jufVlnChe{;gkz;jhlGK0nh+-+#
zc!?vQF$%hHgY#11&tW&)lgw~OA6YPSqr^tc=Nwk#_p{<rW=I_kGn3);YNj_x{<{2i
zfsBth0Pyq!0;j<!ug3K2yMV1ZjD0YJOeN=AO#4bO0)z(4S+Elc9-jO3Ve1-)0>=Ud
z4leiP@5=%SvYe3bd{C?r$kkzfu0rOw=@J@`>fYWq{ILcF98v6_SM~}#Vc8H#L3E=3
zjPrbX66fE$2I;>Pw*pKB?t>g+kz=OiB6i83lB}S5U?k_R0+ju*_wPfC#K)}9t+9)7
zM&GS$_HGByF?OxXJpooqPfF@uOYZm$pt%jsA4=be2f{NL8#i)W`s%!WcDlB|oyl?0
zJp^pfr*7I_tv!`5$T`T#1xAimyt3{w@H5aIwyKN2d`xrRBi886j#jUv@(V%`+~5N1
z0%QqnSRED@j?=JX9PVXPEQeY|4YTv5;Y1HRw~r9LGf@e$73<-m#a0u-1Pp$=YCpTE
z5{qXQ9I#@7Fm@<qXN&infPrdd&+yg!9nclvfNPLqi@7|UUNkcUcn!Mkbh4&_+jTeQ
zO*X*(t{eg5KQm`lFx%HdCElr?(|>%P|LvBc$LX1&fE+>5T(9`uSkX6`<1vbm%YcV^
z-K3eNYHE36JS(+L>>lGtt{+`KviSbwa`0q;a4CG)KJ8<Y*cJqj931+hz=ze|jT5j5
zWWyrgEi7!9(?_i;Y4Yt=L7ilSgp9O#R)4UP1;W~ET?7S6Tpo-)<ycyeSNa{;0QkFr
zL11iWHDTz>Dygac;Isb34iNm_r9|BQY*kzrW<FeVnz41^b0u(GpaJCpVC^5u1rztj
z?}Ia;D>o*X0;y$VOB2zY0#m*hMX<F>_<BaV^y4si{R&{+$(@%_AWwE0=c-=dG~&Pu
z0E7^ws#u$u*dHo(hBFy&T6+AuOH+9u3TVIE+Bphf9=QJ7nao=?gls6V=D+{*aR6ST
z<SMtEiX)r~7203#6<NRF?DW3q9a|uhO0koP{q<?7We)@G2JLC9|L^g*Ae(@uPKwL2
z-OQZ5rl(i8Z7pC2mw=DM_>H(Z?6tGk9HO`pE;HrM4b)-939f-0Y!nojjv7v&VGsDy
z&B}PIquJIS@{W>@Ss?oe7>yK_nwUZX%w6SEq=uwplR}NlD(nJ|2-Cw>+{x2t?8Td#
zpD^P|#$zB3P;a|g;om+!NLJO(_7w2$-<re=2dJIU@9}Z>om0L{nZw};b`}`rfI2NH
zsJB15z53hmjaBR*ALzLl^dnq6JL!P%4{ih)--3zV(sNTNFsWwkC2IFz4RJ(}$>Iat
z4e%11RJP#9?pN|7E4L?|LBCwXc*Qu06<k%eKsNI(x*sz%TyE?1<{_<mfCdj_#<}xg
zK9#z0=bT_s#Hdd|&*(nc^YdMq>bos|a;F$pLg$(R8E$?kYE^#SySxo?)OnNNivN5F
z9(cbRww87j|7b3qg(1h?bZa$sm{`4RF8m?Ssld7F20*BXTON8)Z;3_H)dl53d_Mkb
z9qj4P(|*(XF|^Qq0>3;bg)w7H9|V|)hgPlF)b4VO)n)sW0x}E_#s}&S_yhOK20Sg)
z`&np3>xf?_f>{=LZq0ZUOObs*t47im=H`rOE&q=oXYz`zA)fQm`?srGwE-Aavr_L*
z#p+`ZH-}Z=Q`beuqXBV*G&xfr2Eba7)R*~m3q@uUYr3^4z5&Awv4O;L1H(i6n(*eA
zh}qn<VKPG3!Ce{9yPg-q=bLRYlbz4Cow%{-xVtCJM3}9l@l`I6#!zG3g)Cd>z+#cr
zH}7Se__|reRV{wgsvU@_uQ>f7{PE*+JXn1Cf#`ea)wBeBVE;4?cG!^_Z+h7Nkayyg
zz3Q1SL=hf#T8YZ_+8VcxWPM?67Hox413)9&I;`#DL^RA!Yw5*ll#PBR>fIz^L3&DE
z>WTI0Vl{DYhW&KN-+0@6&s8l!XZ4`Te&C0|>6ZCaK!Iat7jt%Jt60PIqJuN|@D-VE
z0}a!m$A{&Y{Lb+F)7k|yiuU2inV;PaUnS5<slhC##Qm*3O({JdFC}bSUW0fn;!}0Q
z^=7l~2+;o&8lL>HxVHbf_l3r|nf@|{?f_zo+^R?F)8?<Q<PX=z&N34zjc>5i<b$58
z<F`WNTPL<2wKNA{+M^5GdoBm}(O`xvJYoJHa^~nYV_N5XrmFxTMy;IOKFpz_l<Y!w
zf-2`8p&S29;m5-MsSv`oeLvb(=5M1MXG8~MmitG~bJJoDmL8cbt(^qYHS#KFmF`7O
z6}IG-U~el7`9;kIWg*%6xEThpe61F|N|+=+!vUEf-@5tRHkFS5tyLrsQIH^=RQWTd
zX`!X1^+M2JEwe_R;X7d94(vYxLUwq99P6WIT&{zNDJNKj44Ro7(3TBQ{BFqnAff2L
zOrzqQoE-YtI2iMUOI*ONf~Q0C($lqO<cULX{#kAm1rH8pH%@UQ7na{D?iY@Ez_f6%
z_6SZ6qN?BGU-WnslB5>lff|@hu+)dzZ0=3;?dJ3K<)LK{Qd;ueCgT~YRq9b-`+Z{A
z7ES7ZYmiH8kVW^N;iaxK7MQ{#S`Z!Z$-l-k4xlO5pF6P!mZwlKw}O%~T>J6kiG^hB
z`?aZd_~F~8OiGS<?+s3oDL$w$ymH33YcD^(l0V{1;2B1mg`;Z*3?Q_{q}rInR4Onm
zwI6&k2rHDn1?<+)fpdBFYLRoy(g`GKLNKO^g`)wbEeyI9l(mkzuLGyC6(}1WlbC;P
zmF#_yx+v=Hy!Qc(0UJapOsoADi%hCjV5UpScR42)I09pb``XH<Eci?y#W}?}rhiWb
zg%u3Sq$x)~Lj$e=DZf!C42*PL5QR#t`<&?w3NWa8-UE5|OAx+)iS>PN0q;9sXn+ua
zBNp038oU$S{9xPaCu`JzAA$zkxAAXR4#Ngpa@*1sm|EopVhEUMZCzFvAlsiG`)ci)
zz|`K1Mw}?n-g&gQ6UOgCLaW1T$Jb0hB#_Za2NL~XoY9r!48i_~1U!sXQECLngdd)H
z0%}#O`nKNpnxvxtM#8yOmlBBn&eORMdeR|)ogeVm9tu6ZTVpp%IG^}?Q2G2Ta&nIC
z??`mCtB>{<?GmJZz!oo46F<G5-_eO&O&`!-1xV$P#sp%z(`<3q2JGPtJvDl6{~M?U
zIAXr15S+4a_ah;|QFQ<_l0FEbl;}xl!WZYTJRLkx7_fRy)im^!L(YYE7b_eOqsd_d
zYC)i^_POQuatlk_Bfg+&JBDg+dRI8@%APBElQi7XL$Z@jw0uHV_Mqe(SbY^hCjn;%
zwH|6x<Hb)zKYR~en`BS^DgKDj5Q_Q^y9GooOey4vcHn6vv{YawK%ante?FwG;-ALY
z7Fiajz<uo}&XVf}zLT>pytrun_lEs%$}hk2v}0J9+z&3`K-r-%mtU$T5sJ+khbXA_
zt4UiP#&lm_>Z9E?c6xMtGS{Ck&M*Aj49n0tSe*$^6n$*3`DhkxyvEAOE(nLkykXTp
zcytsFJt;#WL+AN9J-a+&yg_PyUY&w`PYU<OQOVW2e)LkCTFH_BVwGP645B-DJEmLA
zfI!0z@@!%13Y`#f5bBkJ<h`HSPRUO!sd$VwdDlf$Ai-(j*7j7T6&TvfNo)RkCxd#&
zg>?f0dW(R-8-L;P=+f&T!>Oz5-eRIFe_4P*C4pT!AOTir6ugP%<XpRU0B$-1qxg&6
zzwJXs5-(@J8?i3sXJA;M(Ru=L;kMAt<K69a(xUN2A(M--U4rYF?^hdmIbg&(Ryr+`
z2!L2j?{tn6T}e3&jw=fH%+(iztyUFj$P{A_CyMa@fdRc*)Hcq4?UWRQl3!*UG8#N`
zKj3Vf9g4{RSgh7jrk3gM1oLHA8z!TDwD*AhmWoFmb1G`HYI!)vP$)QlmI{<87mF7S
zWS6s_hI-MG3i86C?kthB4Y>3@{LphRPnkMI?TgDPSpc1@2PIL-oyBrsE3{fKnNTpy
zs*K&Sc(B92Yk2O%eum;{Y~`lBns?3BAJRkbf~Foyh`rlfyqW1q%+3FHx1Y;G<`Yi8
z{_9a3hJcJ<E<pRiMzf_6Um{<Ow2>}&sTkB;XbC`F4;!6Gxn-oImia)9`8`716fx#g
zR49rS8WtO}d{3{=iu?E?9}#;i*?XL}vBP;g7-`c4uXUl@&9~DYuX@wkI-UHmhk<&+
z0Ib+iL`?IF)Im2XpeO50&_Z(+6GJiY&HJm}SDmyuYK{A9+Ga<LYvC!dhD|iBhy2x`
z(sLvsZ)64_y~lgDH=PY*_@*o#zhlfZV@>4pE6i=?ZIc;Ujicg9Mhuhk$2Vu@X$ix<
zB=YR(zupu%dpGhXSb0Fc9!J#A;b|^WREnr)EaCwOA2D-9%gr&opNuw?M{O`2&>UcR
zzl=w8KLxj`&Ik$oCPs*2dno`Sy)p{n0D=xS5L6tTpPw%ozWytbU^CW@pJQ$t5!;Gz
z{tgz~d)s4hO}w8*FY-UILR+!$U7rDYg9LGfjsIxSDR~aeL6%x4><H~!d>{O-g^=c#
zxT|dH<)#W*0FLbOnJBvSwfs`N`Y@B-nQX~vc7?3eD&>}iJNqTDgJj>yNEo=UeGP<t
z;a8uT`kW|Pa(P*-QMJV%M$=oBB72uT21T~dBMBlN%p4x~JI>mYRe6QBxGjA1_)xo)
zOT_)zM;p#Xel$m~BJSqNd;gw(J7g2=Oa4(q)P$LlaO*xi+rS7Yqbw@Gqw@xN!oXdW
z1>6VWifYrF+phJ|?1jY|ew#A+is@Hrc1*-47hXXF#Ny2!Sok5&{%9eJ2rv87T#%6l
zDF?jP1a7#1sYjbx+j$n>0_+qeFL%6FyvQP_oSl%`@@~pUzH?QR*f?*)xT^uwD~x1&
z(zulQDG#vNYRcz3cgvXiX|1X_@dYaLWBM1yRkn0JQvpqFjfsLOY2;$1q`Zo7kT}ar
zG^8goQO!B{gc=Vo26Y1zBAFY)m6r_jNRo)6hTOq_nWuYhfF+YBAhB<U0w&h_2Uo{c
z^*8r=dp`rW$*$^NJ}3lNJfU7Fx_|Q`99k%Yc#I5?0wDU4+Vzuekciz$b>-Oq6o?9w
ze5+1Wqli-kbm{zg6UU@vT|R!Ezk9<XyOiMy_pH#j6Tc^B@gq8%3bZLB5h&PsfXym?
zWaHs#06s3f=9oNJXfP{CkYmIXFuQ2i8^9K5QcEfnT`-pZnkI9ehnt6GAWREXrz<Be
z0<@uayKgXUs1Vd-FtC$Jqb>p}#8d|1i*|MdswbAkK?I`L?<moMlIKr&=U`N_Pj1kt
z)No@imPmGAbxdi1;RJ5QyA19Op-<fD^t^W`OlT`3sitErOTg)i!9e4xG<@1#eR8-d
zxc-c3B=hqE(Z}dHcx$9Br(+iSz}2)W9n|P20~JLqX>9Q@tq0&biu^i<TU#v_h=%)C
z<q9XnPu`%v@P3*sjJR8VxOV;bFYb9Zhns%BwyM!)-0x!(4+AF;p3l@PcbI)N6F<jf
zeI24;|FXUkEEBqV1iesKS=U{eCyR6HJ>*?-Td_L1#(w+H{f#9*_Aqnx40wG3n6)|D
z;x00gIi4A7YYqkm1IBlYW>rn0ntwm@h7k)eh;Lu#&-6rais<ct&@7BVmmen3TibOG
z*Swv>Sl_PVN|6SjUIUDf8D=7*4$K`4oZcSrdP^k@<{<$}uQIS1yFaR)kvd^bj9d=J
z0@fqEhK^Nvb{6XQ_VRv0OxWBcy|7h?j^8xAs?Gv75i2PlM%5m}?I8;K6SO~gVh%Vq
z3rA2QO@fJb!vfEp=5)&N=LUI*9^CC0{rZD6wL_trY1VH6`VTUcker=YmkDG2c{G^g
zXuw@h(0*NbNpWrlp5Or+RQBE6Y-64hAY_-ZdYcH0BU|3;{c7^CHT=UoEEJmS%g>`H
zU-soszmY7wBK24EZNM7Zz;~Q+GxgJa(EP)R9ws?cfV%w#8Xo?N2V+`|nDlYLQF7~L
znHG`z;etSBtsKAC`6L(Z)*(f|Lv{`V{EPs`?GQzm3mK3!9}2<=_6+`oF;MV10#)f!
zQpMaE(@mmAYiV8YSuhtMaS{2c?!QNO;5+#|H_+r1O9sv&Y}xAf+bd}(rG@P19aPz}
ziJ=m5W1=7^ggBsk{Y*K6e}RpyWkvIcKqg{>{<%#^R4r0MfSEpQ1V#u-;_owjkaE_C
zZ4r4G%+ZQT1<Yf3x~@NO@fHmWj|BTCR_Mc{yT3BCzoa{jGU|2sf$yV-2UV&(#|!n%
zFNf4^N;+4`M1928!nh94F)*2CBUkwHV-uKQ#wU^=eC4L;hsgxjiY^FO(i9E8_En4s
zEC(=0Yo5G7SK5oR`QEDMD>+nf|JBRXb<EuD2@GO_meVi@Cd)VM<7}&uR4ipSM$d|b
zRQcHZolqgk|B~}RBl~mZ%`E-{EMt70FvHuCM=(Q6nes~docQ5zsFflA^T30`aI2pV
z<kDr+=aG`0z7HM&=m%ufRMaojbo3f{n~p!t-E5pVHjr^YeAa!|oki3cS?D=&4z|E{
z>s~|bpPSnsd^Ho0H<dSC{S|Z-oG<|>1_&c($HDhj+fd@PXWOxI;TRJ=pc;Qk>gE}z
zAI#pKy}kNpz{)eq&}%^@o7hM2m>MqCxJG4v$(F*#KvnmERu?!qu<=%*!kehhuCC=?
zy4wIaOemI$1!S#=4u=_~h1gR>g>07z>yiML2n&=M?y@T&@JrR0Trr^vF$Gn5Rpz%V
z((?`Aobaf|GYLn1_xolT@oYmaqQKI{obML2(7!bj@tp-&be9{@NoM{n_!qin2Ppy4
zXgNZ8zmZy6s3=o*sgbcM9{hNT?z9aw=dxcOZpMHN8!Xk?I`H*rb@bvlTD4b~;6j(R
zGfzd00;%cBK^9vu@5OVr+~f7c*smY2ZqqaOd?6^IX0KLvXt=%fZ(@QLrhoRY-p)f0
z3@C%N4VMDUQmKEiT!)1Lw3f%Es8l=o&t^;*oqqg)cPT%?{P@&+Nx38Ua=TwSkX|)G
zPk%52oA*Unr@{Cl9vIF1gRmYUuyUeyYdFdYd^ida?YwKg>4aA29cuJGV)r(UHPG;$
zG%z4=w1yVsz_XmV`&IYvF;Xu;5QI@xKoBgtk=A=jlV^5zR)y3`g9mkhn8BzhJoG~D
z1@xe!MyMWLHwBg~UrY#r{eI`}MDN&JcxVJ)y(=#Cv}T-Prwc<%n!thuP}>Q<b>>Mm
z!QLc+6;QRcfcr0bgpvgMYV?`3UR+>#YA!d!J;1*DhY6zRtv&mAwV}Q_miH6!ic>7f
zq1o{f%Zj#NVBIlnI%PhI&=Yd3L(??yO^wvay?N(Ri&!wHLf;t%COWS~VoJ5u=B^`I
z@(+Ri+<tq;))fU|GTA%s@wUjn{nF<zKh5&0TfKq6gV#Xyo1xr*qXElK8G7aAD8F$U
zuuND>z_WnvS(veN`E{UyKOQ$dW`<VSyknhviDR*luj@RYK%4HsCv^;VG39|B)7#|2
zbOClqD8DZ$X6F6RuCAR(zpoo4=UTx>V__C-qVIUlM*@X2NidUnkvtF%r44tkO(&Nx
zIcI%mPU*G!p=UEgWryGx1Utq-P{n}Ei6_RFM}3w8$^bPbiYT%)>k1IcO;TbBEdc)*
zK*uPjlZ!OLXRLaH)0p8AHY3auLJKfB9g+5TQ$3lDfwyH67^^+S;Q2Jr8n<b;celWU
zc@*YEUDFhnF;UmlX&>OG6W06>!HVht($pKC^IIL(WMr}<yIa#9pfG}U2Ur_t4Pb#G
zIQzl0JpM7|O|XOg!<SzBc6pEn7f2vW-3(SNQac0x&=hvFyeeSOEdt&ka_6)aZ-2;3
z%}ca;NcazXV^H|m!_^1W@Le%^U(iqtd+UorBK?-f%=o~rjO->P9f68K%~A}6ktueA
z{$Cxt7Tu^U9>wMjn#=)xp8`{R-=y3BlQH6nYI&W~WSH>x6k<Mf!OY(r><Z-p6x+q&
z?_nU8UAH5_ibx+v12DBVRnTrZ%4=DPm5>1Dp6q(DV53pfaR|__rKTK0$1iVxk@m2U
zr82lmKYVLww41D=l9E8rVtDbj+a#EQCUCUFp&-p<##=VsYq-vb1xZgH<g7W#wd@mt
z+362P#;QI!E`Dmhc!=4i5_kl^OmOCoQ0*6o_nMLNHdO;iI-2~AW{h(4_X8ceUg|F@
z3$_GQ>>UC3?9M~183vwd-DIN@jhX%xuWZc_b1A)sF{m6gtb~c}-wqZ(+HOjE3fH-%
zeKdH{47|1&UUHg(DGyU)X%oYlWyw#H(V9_s1dS9_bJa&sr#{+^(el3rdb{AiLX*To
zN=dDDM9<<-YP2v_7QP(7<5yoEm$ICpNF?iD0E+T09={J@B_@Hsfwiaf?6vt_FVVXX
zFmeevi~$FwCcW%$aA;c(*rPNMt?!q48#M>NIe1<9-^pi@g^*K3zMQQi$bIp<hnX2`
z@<&cJOTTRPIX!bSAR7nWuoJdnP1~jfRw|Cl2InoRi(hmeW0wYXB$X*h072pX$#E87
zoMmjz!UU7uJWF`%_Dh&y$=qPW!i$yR*^u?pZ+^V`QSzgNkvRzLr!T4o1KaLG*Zvtb
z7hX~4l~Hrq>bVA^b6(j>N9&oF5kUx^qb_CBV2j8rc5J?qP=%7hWo{9szKhW3TLb+K
zV#&Dx{r3JHui5|X^agNhS&?NLOr3+LHzV$Z^&inrVkJKVfe-Qsw>;{@Ea;-0-y2+`
z-h7#70Wq?uJ)o^imv*_o0lc#TUK0dpiBiWYSZcc{Ow5-7)p&{Q9#5o;_E}<VZ@dyq
z&2&%^tZ2Sb^pk#WTEoq<SngQvRn3DCZ7USbO&2nsHUZWra^|gm6(}~qha<f^>RdrR
zT}NHApGYm7XRRfG^PnkAtz`>5^SGj1>oQv3$bj}CSN<gTZl*kpz*GhO*a`lvFuP`-
z8nqAZu;*9Op56+DmsA2U%lbl&t6%y+N2v?TXp_MHFf?tw__!_55U@7j5PyIzf5n+F
zG-J(=?&g&+GnC-yc-_*`@hi2+o15y{;UpycVfF${h6P_T9sLd7xg!ct5oP?3#k8z-
zv>Yn)q8~srRR9Y&<yu$dt_iOS`duVrqb;B<up0Bkj)3oh^M?(Pr5BGRbxQ!TeE#uK
zQ(D2-jZ^}dH->i>j^X`0z=oAClfq+ezulO11$eDrxI1q-fM<A%`woh-y~dE>_7@7D
z7u_RQ)1J5VCVEEf$l;wj@T*;2#{r<BM7z~>91|}mUjFO2XL%^^E`zl*DeP;(`mpqi
zb%IIF5bO$86g_zySkILWP}#ZNdzR0f)vW*7+iM>0+w#J7?vJk&_-yJDZFP@`(3RqR
zq?>;L_UJz+U&rm&-AZ5hu~U;Pa<2x)_USpz@Y6?c{QV9RZM<vUbJJTsN>k1fQsRP&
zYw}*{zAHjyzFOmzS0t01{3y^M%O=yYQ1A7t!Xl4bTenr0H@|NV+3;B;pXmE(Pvk|3
z@6TR*kv=DJB(mDcsf;#!F|7I?PI{qUb+}s;A8Gx`a;V#_XNFus_9v3N-RwRFat8V-
zKz>u;swcY}oe3_Vrl*69D|WW+8z^A+QJ@)?I-C&p>dc$}IscQX-QZsuuG|#=Hz8ON
zEslJy*_M;}wf5I8G9AL_P;dj%qGW{~lrdR)<Ik@z(`!*v@iqq7{I{XhwL*fif`sbE
z#5?czAYGsN{p%(n#0&J%1ID2m2X^Nkk`30az1$Uil$C@}CHy^fucSVd(UPa^F&b6U
zJ2!lqFh3N#pSs{tT<w-PGoFFL#Arlm{F@1d-0I~^m8Ra2-dvJm6sc+!vx_;@q#*(>
zf%>eE09%ht4;;9X_4@OpdcsdF(Va;Yl6rLoIuZWx1&=Cwq+57DiqEKifc)GdpM_Ni
z6HfwOTsda^#fanl4)hpL!?TSIoA;(vnS5VWG<3T{G8?#^XBt^Ct!~@!n$(p}yYxND
z%}ZEdG&8uL)(sebMc-sY0eI6IVFxh<3jZs_y4M=q1NL7&X)Nzl@5D2m!3%1^*{#e{
zM%YdRp;0dgbraV^4+Rg7(sUA4l+CCQt+niD(qi{hXqLqKK8c4y>K+~!;}owy!+4)l
z8~(1$5~x8d4yOYy7t+n=M_)P9+k9GkQpxFy`>F{9qIa#_MEb~SCgA%KtM898sq-NM
zo#iQ3Av8k-PQPNd^s|%KlZBZ9QW=s7*}_JkC7*jF)!qF-C|2YGNB)KLDmFiMy8bx#
z`ZtRN!T1DxL-siKd@=1U1`}}=ED!%)K`x3d{e{va;i;Cz%FmVEtj-PZQ@mh(Rl0hW
zhC{c|Gd9VWOM&EfqGMi11*n}2+_K>rEAsnz<?7OTWa>HgTQL;%g?Rny`Tyz^=HAe<
zNIkhur{iybjr?9a5FZg%-SGId>ozUMW3zGA-0H2rvK^(G$W<nnI-A5fRKl6|I`lPT
zT>=jGh<=5bIZc7OOn96U9)k73BdZe=5)||)L<jqjbd|v`PfeEtQ>Tr$XdYtKO7wc6
z60?<q?@NvH)E6jveg7VlAgfU)0N;v-quP&uNd<J;KAnmlUqZHm*B9D&B(40o(Ey;$
z+^G8=Q}ea8Hl#I}$u9-S#G$GAl~Y@8wmH0Ro7I*lzb^|jx?Ss?;ESRlGA3^Vn|3K-
z%W#sHlVwsMKBTX3-kO-0STc2&Pz^>e%QkJJ_~V4-ij*}vtC-7wlh5;%8G(a;-Hi5q
z>yA4cayEqN?S9q6R?6puxkDr0wyvU%AB{9>OQ-56^^r)O)@pn~AH14O`qb^+Th&{I
zh`vOm6xCPf2$Gp`03YMA!&@%Z-BTI3nX4R5Pt2F<I3m3ttz}ea8l~Vqsn5m;T=cVj
z$~uXb3m=eW=APPSf7GR@q5`9#V0ih|#U#bB=6K_S1oDI0LJ7vB1D2Q_4@Ek4_DZVV
z=KWe6)bCZ73%5Sxc*?=tBY1><|6MC8%z@_7G&?dqbU`+}VzMZf(nR}cEZpfq-qe36
z!sl_RinUv*t4hAB^re251QoYiQ0d8)J60>F&-cA>R^kyejfN0g&HoBts~goqAk^A|
zn?j10r+OaB`lE7r%|eke(q*!jj!mC(o8kCgS2MUf;==T1Q5Kc_dNUbZYbUUB{`?CU
zEEk?XxyFlN{S62DSNLLf6IH<)w=FSde`<a^*uNdoS+=g*XnYhC5t-!jOu6*CTmH27
zuj&1YHyOn;kbWCamXuZ>!6HP1AH6*_D&P0wS?PbC;Fe-Cn;4P@5?xG3nOA%t(#j{O
zklxUo1D2)oymWNxw$r@a9YVLO(6TZzGY5{WRnxlJivN6o^%dg;xczkA02SgxU%hgk
zTpM_0*U4Rsxg?MeT?YQ<35GKewK%$che&GQ72?hUon>r)1X4shY|O4=D#`y3%3NPR
zer8m^=GT|VwyfN`E5-}nTRyRdE0;%T)PDVG!T|g%Ihwe0@@M6lsw$_;3EuRdW+>P1
zi(mb>UccAmZx#`%5*2_8T~oo9w1f|#X)bq7hpT@una19g(6S@o&vi20E|Aqa?y_?)
z=+_7j?$wZVl{m*pGXV`P1sE{=3?I9WKlk5OFxV<}DNa$L-giQI8rQ;^wA4e!TJ+;|
zk$#jE8gFB|wnaX>#J9dqi}PHp9uy2M0Be}79R%UaVKZr13);UZwzyhq!y!2swg!EK
z#{8SH#!JVeiCY!}-ud71)FJO%ZrM8UA2FaYor=0n!gE`psLMSSn<IR_TNuQPg+^F4
zV=pxQ^E@wjD7#YKi?$SUMIB*BUA3xuCh$yvMWU~_0f7;qsR2=c+0n7FMd=w~x{1tx
z>)CSrSkYn=O}v`c=GDXBHo-goZLh#;{G%sR=-5M3Ne5D`qYFSFJKd|Y^?cpM{m;(d
zy5t~up=On)t?~@cAnc*fGUWkFBk6|wVr&ys;Gvmru(ge%>{UzsXjV<r450}f%?jC<
zNa3J<{Y88_WI-ER{)eL=X=84EekAXF(=Oe5F3XtbpC=W>N5nW;o+S!g3K&RHfGlH>
zNp8f6r+jZGg3lN4`!2J9`n0aLRy(OeW{G@k8+FqGiuL5Nj@bS-{F1+Z^8SH%`-?G7
z7eiAGSVX6L1;H~YO#yG{^RB7>s0KWD=d+C_Uo_9L+~!>gzb9*ihTdcUK`H9*+?iVu
z@<pl*?`*FQ@L<%{V~ZVhNvP+aP(zOT&c0>6i`ECIzDaUK7KH_CDFjIs@Y^}gp8h&&
z{(@83!P31f*L2ItU4d1)1IjJG<z~6?Ms%cf*6m>g`Ag)!O{iDPfT9}gk5CPvY3-+O
zn(W>jQ!(=DxxDQb=fW4i-MSOJSbT^8srELAdlg)kn_Fej9^UL1E><xyyW}Wv73Z&F
zHZk(Gd4(iOhK^-~__|2bNg8P&B6KWg(R+N{_9{vJWS{zxB2?~CHScEft`Fx=9vJ42
z7%XS5&V`fg{ZSz8(+S0$I%U3ZeTpyy&=;5s@G|(N?$#j7p8{JVA0JtzT1CU2r-uhx
z`(Ua6@sY$^*{UIh^Ru8D(%y~~=!l)vC!y|rLg`WPeqDZzJckA{QUrwV=bguQB=)p3
zd%fUW&pY&fjA{_oIW<jidxWdoTO;*S{3WaHio?(MflW-R!L!IY%&@>J&-YQ6=0Yfd
zP=aF;mY*5O)4Ka~3a#^IhM!uv;1kqCQX<r1v$gU(G8AaCZOr~JFx2Z-y~77m3!>9b
zoA25+6)q{H@=WrXBvTVh!FA}pPdB{wIUt4_ut$1I1@8VX+U7q-`#oq~JO05rwA}a3
zwq>nWQm)nDD^m8p#P|=&=R`DiF{xy*9G|-&)`AQ!_EA4(m=~=t)Voy;w-*)u<eKHv
z)tfyt^nh}N{Dht;>@xBGIJQg5Q$Mr%XGIRsj@k{0KyFjyp5T{Mr~9<c{L~{Cvg_jd
zn*brm!^1<R4Z))9u=8<Gi?TYP4ZpVDy$4c};fm{i4euRhv3G$|V93?B(C0})qJKkq
zi@y#G@PG>^Y5>Yr4su7$KGe4RAO*vwSQx7ivyRwzU(Sx$jY0h)M&8`3#}to(x%u>|
zZ2_tefhsEPO`Sz5$Yty?bJt_WlWX6BCHKoimen20LFKMB1xbdH#fayJEY6tR{&_#o
zhFUH&r~dU7%4#1uQsH9RB!zIwbB@E;@!UmLg$Gdwxr21K;T_jSOAgN$eis?LHNoRX
z;lWqjRDgsX*u5w0>)*VP2uw-SiTKuY$I!u`z@db#-~3Pq;b&Xd(H~oh*gxe@O;3D`
zH>yy+?oiEWrNX)VdYfKZ36RK_o-+4mTN`W{qBF&Oj%_vIOMdcQp1I~;v6v>*UosG$
z{gqro09gWYd9rb!JyV^3Vw3zCPjZk-b%jmsvudJ+=%Ncqb+YB$B25BcGv{7mBv$SQ
zXZ`hO{OI7vxMH5kbwZt6PON9P)p<aK)$QaA%;GBdm|60!E5+o*>UiK|6{KX|Pu(q9
zZZW>8@BHBvO+a=IWfSx%B4En-Y1he*)OPAWeirOl;6-519w>L%6^c!~z>%ZE@$%kj
z9*NW)Q&x<uXhnKQA<O&S;|-JQ6slMMcXe+kapHs;D2BYLGxd-0o!*Y}3OQ~sXj}M}
zHz~47$D*87sM8SzF-0-|@+}0sl@PQSSMC%&qrWM$eQm}SmYCKM=DjJfHXMb7rDx|C
zJh+dtTk3OsCa0H=jgI!)>Zq!!O;M$8RyQmjYU-J2r0$iWSj#9nn;bEr;QJjbj`py|
zULZx4$LQ{;hC^EoDRU;fTs*<O^_zk&|2Y}68n0mQycb-on|wzQ+NcPBmjU*UEj^@z
z%S(t_W+7Mr)l9o~+v9_EdR*$JrVlK|5WuD2b+De=CQ5%)Ij~Rs+`kUP!94XgcsO?s
zv#2XeL`jir&kj91#Iy)LP)sJ5oo)>}y?EZgE@b>$%=gd;>cGSPX3U+_D$~FAT{O_d
zS%}O$_ik&G4c>(M{kCKw$2i5_x8NH&rtd0sleIm*zTSJ}g4wpV3BK|4y^<_;3u~#!
zN1Xn?_kcZcsy8aCVNy%uzzgvkt4<i41E&N+S;i!1;6wh03zH+kLkESx6)B`)ZvwJn
zcfRo&%JerRKi;RlVBoohRhW-(Gl8%PS+8y{=S?1T4vuqve}j}y1tkn0WnV@w?Z-^K
zf<NU;oa|+aXl>d4wc^VENJGK0x9jWAUAn<sS(uk66o+2N3HTggcBKSh$f2+in)<QJ
zb$$V%>Hkz=&G@Ke#Q5!Lo-uuT%HV~a!BobKplH#=uwt-)XzCUjxfr4@=p^uY{kOIS
zby}Oy02~?%Gx;~soaTdPU@!99jYJEci%tlV!g%XkOgL8EeFXtq6-(xYJIh^`wxt@0
zKfvB2aA8*?@oXTA_DuZ-G325HTJMBO*|%F__P<FrgbHCT?Ig8l91%%RxmasK;J-<y
z&yU<XPk+ub{r>r%TZ?b*Im7%qi$efFIPu<Ojcvs7yrO{FAXKPfK}~?v!@TdJ0k!0f
z|C~(M2BCiLK*Hr<5DT`UXD*7|PgHS#G9t#P_-}&>0awLu%U50fL71~8+h|LK|F}h6
zp>m@Apu#VfSscKJd&qh0>iJs9)1exBcTGKuYLInP+P_DCk3JKdT<;9(jl1s3>l;Me
z`b`QQx&*KbA9Q3XCYE^F9sj&b?u#YpHPQPicP_zs((9-Ol)&s(wcmT6Y?EL8IJ6+J
zCiDLFg(3YnP3;iJecSsD@qTA6#>#*3Geyi4mOU!_XD3}$D^430+ZQhPXn}XX9{pnd
z>4E#4(CLvY+f!A$tDd)m*@Aj?Vkf9dj>Pz=Gla47%>tol^-N2U4}{|Uc%b*OtLK4J
zlyabATd!ta-?n}DieM}3;+MX8RRKat&9mO=<6DB5uZjMzO=(eP*&GMiqaWka_xN5&
z8t1!uh&kX6s(Lxoub<x4N@CN2y1LG2AFTp8%%1T*<1F6^n_-PzZ~B4MVLdorobEmR
z#r6y9SjBlDb&bUhML<p_=Mg<i1WXM;tyEh$B6=c)|Ce%o=H~t%vaT{L%B^b;43458
z(kUQ~C?Q?KIf6(CNJt7uNVjy3O-o4%D2^x{(lsh6B}gM7DcvP8-+qX}^M3!%b>y1;
z?7dgs>t1WWiwaeLM1fSeIWobCno}cVW95U^I9f902@qBe<(Pbt`MhtlmVKk8j=RhC
zad1VE)8F_T3jUUQ=@6P;?Zz)TQxwQ6xI7A+W-)JH{{Bz?sbB%V%;Q|q+0jwG%WyrR
ztPqfw2!eSb%}CZn_yqO1&fgnNxk>0Php&rw`63eFAb+eM!W0&6Eu5?f+7A%0Q!{Gh
zA0(BxuegA4EDh88gA7wi88u%iT_xM`H`O7Y-@yz89FZY_Co}oCJAaNdmtOjet=~lT
z0pGAfZcAQMTSSI%T`#H^&G9ws?CD7$YLa01CfXo+vM$K12&qL3w{`GVE+BKdzNbX?
zhWDNT39%PIFh%xJ@y@#qstLzWAo11T?`|>%{RE`f7<!!*UH=;}3Eqc-K>k(LT^9nT
zCGJS&+e%_2dV$zyD$sb4KTi6R^{AvIv<JQad1$Mi$dC8^?F1|3M6~Fgp?`+{6Tw=c
z(N$3$%L;8wFQ1=Dj8yZ?MIc^}hmM~Z0`wDVAZn_TL;n^I^Hjb8qP9H2<16$4WNc4b
zPHpr@B>qQi0p4WMdgE6Q-;2Y%-}k}F$GAqhw~D{8oTpeA*s_9Qh2{myAImhc;ya-t
z`&(npNK)R@-}oB%{(E#ZTj3oAXU17^tE1IuGC%*rG0i-E0yC%zL8q5dua~*8gA)7%
z0$VUVlQb33w{6CTs&pUym+kez63*~Vak<A4`Zffq+HI9vBu0S@$KNj<05CWX+vU4_
z`V#dfDQ2^EBJ-crTbx;wrpAfK|MSGGKXRDY0htdz4A^V|X+INx1p;}3lMpPp2@<y1
zWwOjYyXjrXkHl1s%ib|Gl*;C_ZL?`>{;vyII)m^HR}<q`sWq%;!d>*h%Z*_9FZkF2
z1g?YJf&6Q&Qzio8w)jGk$HPP^NurNV=$oigsI>8acS;qF^x;I2MkUHJst~*1R+#<=
z?x6wK!Ij57nWH@N0@798utJOZO$8J4VQH0$otz<R_4i7mqauZ;i%$Pfyu=ZXoRlE<
zy%+=nX!rXH)8?$W+@(y!C;nV@75re-`xhBh+@U6X4n`k%s{TwQnEd%<DJVtRH>LRC
zzoJZPJaSs0mFZ>inZ!i38DSiy20TU_6eE_B+363=<=Gw+PW_$N9VMj`<-@@sfr_)X
zHp-5!e_8*R)$vCrQf)~O1y+Yb<%G=EMp*c}@OLLV#!&%&3B@^n`9;u}1!1PPnBnrU
z*R5Z}H^$9b^8SihI1-UPT*5)p^vp}Lk@COTNaYCwt{$5<#x&@-^uvlA=BMiI-+y$x
zCo%sqErHTmjOYI;d^AmiU4icd`k?AidA$8hh10Lc!^Tfu3PC@i{SM>ZH_m=kLKRvk
zZRn<#xIAZm)5mA;Ntm0L<^SXpDenn^)m2utqCiUA95LfWoxZIqDEW_k6lW+_Ramb9
zx4!HtP-`tEex0Y>tGK>&szPD8T4pt-!oT9b!p3_UPP?ML<)Xy&Qg&n<_)hBYsWjh7
z#z~Zp6#)h(vIdTQ>ueb?y~1j6ug$fZ3H!<`@0H?Ka!uOld+7i3+#vu%n-Nv-JFnn+
zgi340o%VkcjQ1A+eH#Lx{Utkai;`)}qaj!Ibv-%Q^2ht`nhN7;Zp;5n79$w%K$oxR
z@4DD9@eb64HwE0druYU67;wabi!|Yx0T(%Vi_m*QF*yk2%l*6Bx!eEGvZXgjyLzoV
zN5{%Cwh?b>lM{-_Gs-g_-=;q@5SX=>IZPYKH{KW9Zk_w-yU;LYyPsHYGT9tQ4g$GW
zl2<3^aqwT&WtD&8Jh=D8goxc!8^4)i-2sSXw}9yoar#w6B0E2)wjAwl(56FwnsD}R
z4QHB!{IX%>$ymOF%aBG9nigwG{SyGZ0v(bP6dbsJiSIwjp$fco9D%70K-!eHB;Nh#
z&;CDP+adRcd~*u2IFnYQ*yVhDd{B`RNrrE+gCq|1fw8=@3?swXLoC9H5@6A}H_&J`
zHN1^wI@LiT7Q(-Ryfx#OyJwm1C;<Q8;3eRlJm7x#c?JaD0zJ`&r`d6<1JMZl;bnI3
zT2+E$RYCS2LAPF~J%8dF*;lnTTF{bgfC&DafuDgANYHuY>FY23I$;PMM7u8s4F>&~
zUhbUPEiiSlWzTr+H-%+7QdNVS-M%ceNc+1BraFS~2l$d>t=DkY7Ec~q>3@U2@kVJ^
zz4Zbo!)+ITCV-KrJz3l$tup4oa#*Epfqp@dX}fR#&$g+l-HQOtx4ypJ9(&zZHz`6Q
zRJP-Pj?G9#VH&T?jF{tJyjEq-J+&`oMWo$-k68_d68BxQm*lHKKHLkt%S5BUQ^Q_q
zM{1j-d_i3Q(;imSrRB$zUA@p>vixjz?1!-LWxGGkA<J<p!@RrfI~bLFezy8vEnUl>
ziS#GDHMhKV>O<@=vipu6_fatm<d&UzYFN*KtAnSk#JN|0=KjF<zV9b41vIJxfgmgY
zooUI)Fl7%iPsfe`_IMNe2cdc9F)tI(!0YMwxw0!(eE8g2=d_DV?_}x~FbUb~GPLN?
zyhWAr_3IYN%oepQOFNs`Soe$U+Hd9<UgV153D|isObW6r>gCvai8?BwXUEqJ-mL0E
zQ%1d#O}RzvZp0)Mk#ytB3Amo33)MU2aC9zJmrT9!XnN-UMV?*LI-+4V0@hN9G?y5|
z)IPN@VWi-WrOmi|CFB{Q^|PS;EFzoG?D>JWX&Hil$_9+J+BSOoeq7((ob&3dE-V%z
z6o#9Iz?x#X0~z*~c9#G2RC60RFO-)0wse)zFPCK&9)BA$pJuCoiQMmE#u@M7C#v1}
zpWkccV;?m7-~=I5dhXo<s@u*zg_WX7m<oOn6}0N>OgN){-q?2{684_?v$dQh75t1a
z<GIw}aC<kM<m;<npY9L(T+B1q(jox3=HtCVzO@XgzTtvJGfekzkLXXT?}L3L0|Q0p
zh0kZ|6keHZE9c4f9^MJIG&w;tQgjIb`n_h%3dBhbFZ&aI+c4WtQAg$DU==wE45I2b
zQ~tlcd~N^SmGSQ4!icb`B<Ww3zm#+1QNabogVsdq;r(u5ll647uQ6+FXSY$Yazq5{
zgob>K<+kX2)^lU?_Fj4*m-%>sFK^*;YgtpNQ}%HPj*HkpMbT@$8_h8xNA|prqR&Jd
z<>5q8o%q8KXQAWK@#dDzYcdJm`?)yygLH9swHN@!3?BkFkxUaB+!afNknmpUV_(;c
zr+t2Iqc3eoQ83v|3(=5$CfDr8vtI*eL8MwNR$up*t#2o^QB$TszLgzm29AZ?vS3Er
z#qC6f#~Xnb<xwIPH62z&YQ;|Xr9F}QqvFQ^suo<HBn``orWD`M&#$k!eNAq*x6!8T
zo7mrRb3Jd^FGU-PikI6Y+K}xY`SGJm>?fEl*Z8GmMWGnp@T06YPg@R~F{cVGg}eoV
zk#i>TrCPsTZkT5-rB&qOu2}W4IhWoBumi{4<x&k<?lAt1Ro^DJYU)1Lh8D$%gqWJU
zHbjCB%e9pCZ=bHdT}QU$WfU`S5U#z-{Ecx~z2AN2dwHtu76tqqWpl`Ct5+6Z&i!X6
z>CXqmP*&m<T-jjs{Bt{ky=v3HOLoivpf#F%I`W*0X4}A}-g#rNxHhkzUcK{O*x0Mw
zEANo?*EjMUzoumety^oI_q*noTP=Q`AlfavG5hk%d-oa3FG{<XBZc)H{<&mgepMj9
z@TEw=@ti)5Jfz|Ks8(*{<sQBu^yv(DqkbcW@7VZ&AgT+T{0c?50G@`5H*I%LFeu%r
z>C~rIX4NpmpVMy5XjRcQy}A<kYO?NE)2d2MMZ6%DsTOrZJYkW5-HRX|-_$&NNi5Zj
zS5*c=iNn+tD3DAyM|Pt+9t$--w~wfmQ971#fc}7l%YTMbRYm4b=H28}$aAeXo67)#
z7cuGeP@T8=xrn5#8upv6`1^Gsv(KdV3<E?t%IDD)r3GUEvgER%W3atCGMt5dI2xHQ
zn2UM=Y~&SSBa;%;{@6#VcPT3i^+sr7ua^3tjIJ8+NH;vm8Pq=@L^u^pAl28XD{V*`
zO4|QL;Jr{FT)Q``RliY`l~<m_e3{Sf;U~fR4xm+_>>zwP7Jjmazy~9G3XM#vooDD`
z)cW@wXk~{ZrT>aNN5Zk|-AQr=g+zVNMp~1Ock;4|D<TE~jp@8gg?`%#pNa)!F|Dom
z<-3?St3N_RPaC(Sn=Oa<?Rjd}be8=N?~xs4K8A@^%@F%#A3!2-73|V3BOk|7om1x|
z<Kcx$3Lw__)H{K}^wdBJ9(pI|1qi2<8?-;AMO&DT2oqNPdUVdXHovyLJoPG&-8$r(
zsz805l(Yh~t;=|uEmigUMz()lCJVe;iSu<<Fc92O^l6(YKj+jd^rI(r3|<moFF^3S
z#bC$CB`^flL`>>}nONQEGE7Z1sY}L3gN*n3qk*QFlx+DK{a(rwBVN_&_Rsxz-}XwZ
z6gy<XHOa@qGf8)Y*RjtSsA|J^)D_stO1EZvWe;SC?adeEe}%r2oLuKq2q0AY$C4@V
zZj#B|)W**6&Z|+sr;{u@o;!b<!K;-F3~ocqW4-y7H|F}fG{aT)84_=}xfaW*k3G{a
zGrjM<JH}98!1ou8imVpRHeo`{;fdFJi*qkc1}XEmil!c@sO;$D+DnERT+cGJt^~3t
zK2*CyA{MH?l6RSK_g9kv1>~M=^@M9j7A{8H!hTzZW$Dp8vzJ?HRPlX#dCYcRpsX;`
zJ>WRvBdbC81RCtR>@qnhDNG|D5r`zn;?tbOp}?oWRPWVVx11RhPX@4j-E>+q1*nyj
zQm1Z|Mg$dF7;RL#)jxB|F!mbg?k!JCdrJr__bjR}dLNQ!HPKP>XGSHSHuKkCGHX1-
z6BQ<#Lc_GQSXjcj5zqSg<R9xy4g&kSvkP6M)eEhsM^Cj$DJ~mc%i(CONWb2S3Zf*S
z9P}#FH5rz+H=~7lia*Pd$#q>{0neRhWQZ+{>8Nboo5habVbp^1R!>JkGQUa$@fK~Q
zVm2FPf^h)<@%B<+Kw33aaP;`U^tMf)!L$fKRi=$(yM4``+-N9&GiRaF&oyqZE8~@{
zm$f>m_T_lP(KoVT4k28ySmu^+tX}gSB2QuzNUIm<AT@>Rs52iHWc>erF$4wRY@<0@
zlT({BF9reMs$|AK=fy|$v|Fa+%;6Ifn%f>_3;ouq_rK2kp0)|tfBiboFE{6{7OWxu
zLVU46O`us2v$b;WdCqw;8HrkKI?WM;jP6q1TBng=3_@o{bzCQv)nPkJ`}49&E|qZI
z5fQZzq)XB+WO;(j!SfRIAlOv#o@0O#-wlZk34-w&G@-Ef<#?fChVmUT;}6y1`Hs4c
zqITwPUIK!4FU%Av>HxOysO&Ua(_iS?ligbBd^j@#{er+-cUl`Sof8+dDH9WV)83`M
zdwjJ1$ooJm>+XtVoAP~gj+sm}ldWag8yPmPyCWAz)bgBQya9bXdHdl(tT&AT#Xmq2
zu&mqFo@xaw6i8#P=m<z%-_Hxni(uw*@^|t-K5R5GVMS?tV6{Qe8Si!@sZpb1`9k><
z;86rBlYOIjRj2!M#cNE;K8Uh8l#~Ip^|kJaBubJM9xdpwI%OBwZJS_Xv>DnfuDXrz
zAG&DU-kZw}#eyn+e}1%3cdH$*2Ih_kFa3z>&{3#kQoT)F^7Ce8KCR0#<;l=3Z6HIz
z)h{!t3@fPY`aTIIIdsV10o}`+H6de>`k9>YDL~(dm9kg1v9}HUyuSdDRlQ{{*xJLw
zy1Jd7x{A`xuFlfjB(84H)@`S%BV8D|geU`e^j-Dk9&2Lc)cYvkjSJ&K<`JwX-$fwt
z2qY!7Tn5&Fr!G1$lrP%qzQNyeE{vC_S6z|*?l-ix;c7f&W*!y^%eii2^aWrKi)tX(
z;#085XCEtkqIZEtBlHu-#2<>zG%IngYg(nwc(DHU+H~LpNG$^!1D9(9hXLzrc|}S>
zob7hJ#*=p;CQ<sCqVOEA!R<WHiTvLS7SvU{nElUHfrdCK<pr$WIrpeRBf3`0>#(<3
zmUKBTBF7mdug%C}M%LEsIs|w1Axh-2v&BG-G90A8s+qV&&mQL`=e*fpD4A0kdbgGH
zA^SywI=tY4q|id?PHS(jou+BbAZAzvGX-izsjS^uI>c^+9;d}c3r$*t^97T!5eNV#
zK`Fc`ItUmZ=9ex-y-@*w8&+lrjh{PZR=YJ?V}~)a*Y~LPGM?$=oP0{$d~T!D>1;GF
zuXT4Obc+H)nL)25=a;LK_aSR=<SiZR=cR=FVx>-wbj5Cjof9>dp0_nC7=ZTRL}h+u
zU3~m~Syb-i3d!gCllNgqTmWIP1rb>r!qX<=T2Sdf!4RWBC+Oo@Tc6;Q?jr`56LOd@
z?5SBn1-<o9yfL>h`@&|9o{DCmglEFLuh3^;$rj(&dmwA_!mQAV5?0XmzEiq_+eL#M
zR^;4!etSJ!xXYMX=;RYlg9zb+x8ujCr<cQAwzezgpJV8uOl?t~rk*`qdliwdIG3YW
za7~w?m(I)81(fEKTRs9Z<hKdMQES7Un0P6<(>>>_bmg$<S*hSsTbJ(cdYO!or-Efc
zBYSaV7-2yT_PK$V%)l_5=b_?ytEHj@6=nL&YUhdOiKrW@k)_TL<i_e;+WV@mB6iA|
zd7K^1y__?(i$p@D_T8Q3L%VtE9`4tF!jks^soO6b+8-U#k1tQd)Hsj2h#CtFo&{nn
zy-rrXs&=KR$x$M=@RIMMTe6+<<=#Y79>a34ZPuVkIYnm^NEL^WN&0{#Q_KeBu3V@^
zu~qU&PJx4L1B`>5$<dr1HeA2EFF$iovr?acE2?)6qK|Quk>R(o-mU?9s3Hi(SmYNC
zH&7%`34)u^AdD8@<=mOix}8^$CJ92G$@e%$z+VF8e1m|^3NB)~_tHazYY^vvI7nJh
zZbXL@l{{b(W|MmLFY;YyHc)$jQ0ut2eKnZ}j|@Y^#?G#;2}#khEtU(^ThYj{-5*l5
z@tRF<t#^ug2YZNjPVYE%!Cu~bJpv+E=c-_x69JK+ElG<%S8b30VAI%mwVCjS>_M3#
z=f#te1W;Z8&XGQF110th)C`v?7u~%;sgSizp1PjRvH^Vw0TP3-x<7?n&v`J_AUUO@
z`gR8{ZLNMqmsbUjzBJV=W^Foq#gT;lXxUh4ID;A!1yc6~`ZcM@2b&>VyyL_fa0e_8
zFd#MZVXi$9ozF{?33gEUNa1v)zgmHyJ0F>mvoB*);b*%BsL&7}xL+^c_}8OS8d&CP
z#mVSj522-|sE)ou)!lU(*^zI$LlR!|5r3&3GgN7WOQX(hqCEE@QXil5WU~ajDP6*o
zOK>?}hdq~`npbs%c^T$jAlDAh;DUWBv<cW=UHAcWc;YM^QTQx5j}7Z}zS$YsD_Fkj
z$UW2fFP_0`wQphuHo3JYg(rU`GXyi@q-dPlQn=pQA?s}1ovBl|O<Y&%lUE^~L|C!(
zlqa}+v5Xn`dKo`MbAolZdgPnk<`xK%09s)U<E?fN!{*2<HbyR2$$TqsLIuXosE#TL
zd#8&DEGMmf0Ko(Bhf4Uzh*N7!Qk#<@)}x<(D7QE>)#b^PT?2r=!S*+;n$f4Lsb+d(
zOA{EVzAe!rpEV!^Ifr)G(wV8;4r}T*dr9oD(s#7c&ty~XGN~r3>6(2{*gCl~Dv|sH
zkzCQRpq<ZqXlow|#-XnPin^AOW}-<-3c_G-Myob(LeUsRQ3M-q^;O6rNZCU03l=NI
zLnSw~>&{v=i!C+GO6L*N9tuhN7xZIJl%h3iYt{wgHO?v-X!3dVnGTp@Q)x2@RfeN2
zf)+fsw_i)zE`QV7y#o{>j^UetRIkc_O3c8)h}P#)C6H&J78j$Z;@)3mm}}C6qv0(f
zj*F6RmN4En_neb+1s!5)3g#T=f~2p?j)VZCy~>*NxWiFY_{3sDyaXUQ250}IiiQFl
zaQRgecL<=gYdqZTweGj(=e-X9k){&#^xWi4ldomJ2iqx5KU)!IHz$PImyH`chphkg
zaFYR{&27$>Ocby!mvL2YbDF*8@wgZj+Ej}DBB~D`An1`xDC9k$%}SL+JhR<58OAdj
zwSHdry!PJGx^I>bkwZY4?QPoB>KuNp<XtI|>Ie1janRaaf3%%<2@X$8wF^;|O?L&i
zkP6wtR+OI9dpVxhJm|Q9z)^N^h36?s1DDnzx+ZwpEfkP{iiy5U)Jl_6m8^yin1Cz_
zjJG3$m%EJ@;fzEC@r-7jtswVlncSKeKMq{ZAcpP))f(pL;8i_*f^&cM!O8eH-h&bh
z05|^qg&E;%eeEMh=QYPCC}lVA$hx0ii>}=KNuEH{EemWukpHQCoD|^b^u3p9Tg1DA
zPcFbi01C($I8K2}x;c_>)ko!ZF+$?x-%$Ym1#<Cu)N`mhTc?yG$$f?NEf}v5CQn(<
zLfrsZxy`Tn#f$7LUo5n~>J|SUIgIcR0${f1-mm3M%VV)dMo|5}#d-1G;a+^jQBf}F
z-r%6WqlV`PI?cHF6f?J_TVxlkuIv%9?A5SU*jCuaQ-+j1H(3kBto=t9%?`rTxexaJ
z)AoMJ@3-e#q$W?O&PWNG5?N|(JS$P$tFpsn;=TbFPpq@k(F%kxhzdU!QzZiUsH?Fy
zj!F^!1i|g-(^6ZX0hW3nvQ4iC=Syv1BD|mYi){KYP*wsHEZWUT|DzvE&7vwsZgx6>
zh>{X%A1hNQ8F0%gnD66f`s2Z`FU=2KSt$-<Is4YB94Q`v``JhtOMQ`!rruf_#`t9F
zmI{asB$#N~%VpER^1t|Pm}86#1?==G?K@#cyPADlO{@K#d41xCpc=0+TuO!W^+!A)
zb#%z$c;1^5_j^10I<b(Opy?stF9e$dAfMmfLiG!vNwJYu7Rvc<Ij<{s<gTxT<@wHk
z192sk6FGvaop3R%ArRAd6@TOWTFv`sg^s_T+Vc{{J^w58dXOTHdZ=-g(y!8$SVR!D
zrXKL5U!Fyzr&SOed|o@;Y91gz;tg$m%ozJH{bTi&k)uR}FF_O<Jq9v{tqw{lDSiFL
zS-T+Qptw^v?7Oi3F2m1CW*VW)&~w8M$W?<!t9G_R`Gs-VIFlgwJKFYJH4`H)XJLo~
z`ahc`=nOtIlf5v90V0fKsOW>cEx|XuH1Vr+`IkCksstdw7LrQ<@`evCFz<Bw7)+*S
z;&Y0>mn<(c{#vHFj39(fnpm40O9-PMB3pHr9EbSU^gv<Jn+;Fa@RMUWK)80v5?9o=
z($^e8T@gI#yP(~O+GUMNB%OL^ir8N=;|T&ewG4=XOq285xQh*^OQ+tnRr}@IZ<XXv
zKA96bWnY3Ohtb<g{u<5_#i|Cr;8IXjhcmgKtTdk5ALq!nC(74Z6$wP_Td|cI)$0cb
zEb-~L=5)0^lotKz94?AcwRn&cNC=E{E&1YJf_9~oj*b0*7+|GccQl;d25Tn^!U*PO
z0zrhG2j%r6k9zoZYT2^*n~Gb>^zsfJZi)@UQ%ynraCy%=3e#z93Hi5$guV)WJ+=bU
zI0wkr()YJoteBzlRKcX3pZsqjq)iQ7T4OL^;PnoXkMQr?9Fp|5+*=5JrBA+3)QapQ
z$N%HzdQ(Mf)*<!FtRY5hHNxYhB+aOTuv6axr@b|NCNWmcigx;0XPdmi35?kZWn>_@
zrKq^PU09vN3>wok12H649ts~sUtRNPrh!2zW(aMMEGVkl(ZceZFy@43f$hd8gmphD
z%w=1n5j`x1rKlo?GPbyInU?&Bw~FvHRY_x?D8`X+*C8E`saa6u4uaK2poBk<OQ4Xx
z?%D6PNfT0uZ2ojM>5F*UUV*xl&*X)gN_p<JKX(>@GvaRxeDt88+F(;m3no%xx70<0
z?KS#Pf;4;=m9*!FQt=}NJ9Q>iuVrV$e@%1iH<fuE^`ZXM9t2P5ujJKiGhTf@)%Lrc
zU3|9v8asG9cnGT+beQkf*I!LD#WvQ#KyaP<V7YE7?5-Q14lqrCjEi7)SGO~Xle=?k
zb-s#ewH{2`lqRJ8t;~7*?h16k)d!tOQi2kky}A9l*xZ6(_u0V-v!(Z99NJc+d3?A-
zumAZy%xhWA7G5vyLJOXQunz(F^i3~Cb%ME}@BxJX+y<WQRXyXzx7&{U+f#9AnaL+A
zvSK^}MhkAN2@_ucG#~bNQAP4>8gAD<Z@c(ng*_Zp>i~86*V$Fl<;rd6g}^v|^GR0Z
zs0hm{RV*VM<ePE=Hrk}G=Uez<dl3GTl90i_+7gmy@wq}|v7%>%@1N_Lziw7NBjw6F
zB=n^`AlxmC$T{-@{fl@jUOw*uyDY6Mt?RK;1F9*6XDZ3$VZKjUXcsdj?T)Jl*Waj1
ztxT`9x=I!6vpATCa=h`-?Ng1BpBr}$jJI?6;^6D6d0Cbw2Y}{|E+7jU{je4|eH1K7
z;}Gmhpw@!FDkfJk<1#ti!9nE8#LApZia|d)@H8XeN4-li)u}FuiLU)0AwtNdx_J!C
zGF3wia(i{MrYI}nt(%<Q+{NFGW^n25*zbitdIGjpQdPSsp4g1c#=lQCg&C!h(+Nb_
z!Tq3Q7=tHWMFMMmzKTU|H2@PBMhKhW-jZ5d_Hz4F7X&81Rj?@2J!heZliG}&YV-5G
za<781s930Wp(+#rCkfy_TQ_X;JbwIvtaDo<o_HQxW^=si&)UOLQOJL(wu-+tB^~UN
z7dJu4^l5B^O}=eD_ByW}Ugw)rf1LJxj@!UMZ%xSTwJ__Qdpm;_G+P5)Il<9QF*Q(f
z-<F*Xnz&-X!l6Zzy`8y2Ra;LJT689_9AB3|vVzKe>hr&8Il$^amm6{R7$gwq4)_a0
z4G=hp7)3#ID1#S7WWjvftOK2AD-i;YbR_Ns8ff(CY)?O^AnNK`T(9Z}8YaJ4!qE#C
z+lTtepgO3q-$FsA2Kt*!_EU+N!sF+xKx(R@uAm}SF+MF0);`VbV5czs`4NEy?QPoI
zC!d!OF{E%tjKZt*4GVCGK_`O+M5eY0ou3C}JdS5bqP@Y>2f*XvZ1emCrl8cpVKdai
zx{qYGCp);!XM@c-#^pp*r0EF+(xPV0Q;7KhO%;*At$z=CG%k=a|1%;Xs)9AZP!$W9
zr|d77&-In7^-?dW`5%m5(ix><nFnuNB8mLAZa~-gO9jJ_$h@-U0>C(n!6MP_Yy<k_
z%4z<e8oePdM%&#;W3Hpw-DKa;T0}f<e?o!Yydl=UZ_L$M^WdxPS8Re31^Rs<ak^4<
z)$rOubD2pofk}^Vw{MZfLD5op$iYXz-m+mHg&}Hv4lgf*>dtqe@vYm<A(On$f9(+v
zAhZOl=f3}&hM_#zWHLwpgT7^jr4wTx)qk+u>2qM}Oj*|S{;yF#P&`7BvL+ekha%~y
zL}oJ!jE8>iJd@HfoY{Wg85Sc5vl%GkyvuD!l3cZn@O2tV>zri>GrxVjgH!xV44kMR
zL_97>n-md8tu;L&bVyK6IC=388FAR9+WE9#Zn>;TxPG-&tl-_<`9YT7R2)S}(2=&C
zXWG7N0nkRLW^t5vv!o7O`bV91)x$eKmp;z6n05d4T4%ISE*nb2&Em}uOpyN>I(lRr
zC(0N9i81?yzeg5QB_CK_1s#DVdTSsX?zIfn5>QQe8ZTff=A8+n9D=)Y?RK7V-{@}}
z`&J*gG$<$amZ2`ax?*sl$I$JfoT!uOpm3E-@>T%Dp$mB`=rH)pOnI0XoUR()0$(4w
zYkmPvF%Fgs0tPlgToARx&~S09pa}w1>df)$()QB#tOTh`W?RLL=V!?CQpb?H!mu@$
zn^0BdlaYbG*Sz2)|LT#i0s<+`3T~6XdgRtq<>ABIT+Dgj@~MYOv<AyP;?+Gcx>4yk
zBT)7;&LBkw%Dx$<#x>50&3rG_;m%Xdp@1X+r~!o+2w{3cwl7YtPSptZ=(lJn-wttY
z8Jo(AJTfvM<IT^AlbTo}Nn3mYPL&ha@1@!woqtYO5Pl#$86t`<IrQM^2!Fk*ofgph
zJ6UqOKUw}8pQ;Z6#4A(h4V9&KG<-m;us{oQ-E@%w&={Znf{k;0Ar?(TLtGs#{v2_&
zH$OH(ICee^-5I5pF#hj4D`lekRMc_tmn!b?3fp14I|~D&y(VEFAF9=?9`0=zvwsyr
zZ!IkCg6~ycd};v$hK_q7!G}m)RM70TaK1|tHp11sKVpBL$NoS<Q)NdCZ~JTV;q*rh
zL}BxC69A@y{L7sdMgvuHl_lD@Xuob1P!>{Vk;A2`=DRI=bH&8^<5T_2%`bs0Vu1Xo
z*W%!$kTW)TJiIYJzy4HmvAyyGKUo6Ymr<5YS*0>Q+lgs=exM3Q5`?geS$a_G+8&@i
zXPEvAF0Fy@r8C@Z*hS7}u;YT{y)3>GFFCN<f?>57z>bxRoa|=bSkw3w*Bya4$jbuX
zXI3!JDP4W!@NSYIhi`N4$&o9c75XUj@z|(ABV-PwG7m^4U`-aZ?mh;cWgV$v1;Y_9
zOj3#nn-loOAwbH_P!4jEKoeXO9s#0N?LD_4JKus=Cyf3N?~plR@4io)%RrYVeNVv>
zWh!IK&YXBcJF)^*abVC)EMZi=UF7y<TVDXCl4HsQc2~ov3WG2DZk9uJ)UV0=!{ur0
z=Ly!y-{Kg7Bt5)Ru6yPWdbUUii-lgcV=VXFP9Wm3KDfDC%uB?iI<@TA5@v8&?1D+h
z4oPgtnFFv7Z9xm$Alj(Y^z)Jhz4To)Lo@)Kr|&|0VJ0Q>>{<eU5BJ6G0L#AZ04Orr
z<({(MBXBLrnb`uN^s2&e=b6N#h)r6VfbJHjq~*J(%2MnHkw8+k+8;Az#HSV%-r3`1
z41GxA1up8dHH%?^%7X8HfpA?gH9uSP2cP(HT6nFH!^BSZ3!r|WJXOw12m^e16Hude
zTxnF{?a_(E=96H2DtaYK&6V646X1U)m=CuPHWRJE;i~reuQ5Z&_Ja_>h~+8fv6ORD
zwI4qeLn^RJN#xYf!cPe}bnRe-AZ8NC+RuT$Sx*$eXw%zsGHR5Xj{+P(B)`sA7oTPb
zLS*+_cvXg9{^8`jgMRm9bulFFNad_R=Owtk(?L678!qdCvdd2*mGgV@dhYupiD^ZC
zJs}-k74{Q?@IKd5;c^M)D=UlQ<pU;Nfv9X4`p=83o>7_(>ms+KkTDbCo1`W-bxBak
z4|rWF6TBh2{L8bZW<N~Fux#D&?*}U~bC%fJ_tB*#`|5&3i@IKvu6`qbBi}=C>F1OL
zJCuQd==7-->^Dek$w8FUsN!(WzoOqse^T;Dvj9Qq9^mKJYcH-@gTR6)0R52@g-Kt*
zzmcz;A9`$3j7EeHeEgCHxDc_T+SO#Y_oLONW5Sc?z0C1@!l|~tN_p!*i3ZS!z#dqx
zO&$Wan&g3<g!>^1X`dFAKM=E{f+v%LN31OzL715w{`-W%@PXnmi&TT7q3Z15c20nN
zB%9{t>0chKKdCr!kzNZ`{7}^gMBmVk0N4g-BAqZ*Bd@M}<yEmc(ZdV-03K3%A2p=$
zC_e4^1(057;$`#4b&s1~eq*YBJOE!1R7ruuVHSkV(f$tDG~6DFy=JD+5=yjlW9J5<
z&fI9fLNxE={d*7HipbIdTOmX66}Q0!6_II{)nvh=_t=1;K+DjIjI3a0x|vk_&r}GZ
z*3QxHF552Es_Y&I#|I3n6p&GXOp#!{w*LCcFTnikmthx^NFJwwYZ{N#kg5bvC{osf
zB6_&b+kLdE<K#dljuA*<Xkh6zZ(S@MyHVJ=BIsP?1UJU8e>6vq6bVw8vfI2vrpIgH
zAgpS^rbfx$(Pyg~hAx`bVi<fe;!x8lnK5}am5~wP#;(rW*Om!#nLst}g;@@LI2w?P
zMp?9ARIA%L(JoOvmTkvLry1{(<Ag5AmOA7{%FU=Ug_I)LPOM|;L7<C%a~tp6)F5e?
z-|m>xbeF+xrx38^t^KPQ`UK&uu(=;=AoL3Cf_?8J0W_s9Fd%!f68mIaENJRc;oQ43
zt(Z)I2Tx|C1CVzj&eqCb7CA~2A&<@LdIT=u7_HU`I*yJpFaSyd>Fe<&ZxU+)jX0#9
z-`ZoynL%ZAkb2UK^^ET=f((hzZ-|Z%rum@5({XNAHjh;NP~h2`rS%l1wNXbK106d!
zk$q2YKZuYJ>O9_^^r-`H?T~w+7<3&&jA)uLa=NgMHydxdOh;P9ed&M<eyzpqJ@$bl
zvA^o-WXtP|?5`ib6>U#Ep_=lBBlb~iW-4JEz#Q`8Hl<tsm@mA=bYj8i00|A44NzhO
zg;vK6MMFBkM~H8zc{UYs%LHI2;KAJ2Ut=&*yc!iAMIe!HE?qPLTbf(FHOn+y{NTvo
zBhS(_WGnmbfBqK*r6s5^wA^J8G^?}??{Ol8gJ3&oC?$V?-q*NV!|?f^@-dYm?|{*2
z5A!dR7kB1oRMM-)+AtD#ujtVMMhE3gB<A!~*SxLXSXJMq1&o&`{)GAzAix`|CYHU%
zdb}^cShYWK?_}25SrbjBj>pqk4FXZ@w}TxI#i$3pMQqnT{wif@rvfI&Z#%}1*jkGx
z48UJcL2rDv_ICg_gA#!rTsm4jYh5s<$DZLZVv}AV`018=YdYi13uzA~UM|$9mhqVK
zMwN($No=1CM;?fH3I|{ZO#kIVp87jK(rC3<>9sZ@HX;h`MskMtvY`s{+NKLdIu2t3
z<tE|UO^AU?x#%qiHOnxxgdJZ#7-(TOlD-lpA(;-MksHiQ+q%QKUV9PP243lP;8Rq~
z31Lv%Csf-Zjc!<yh<HHI`2q<z;9?Mwq3-=N7l^z02E;sv!*BrCwPIam_=`<QY~fJW
z{(83a9Nj?}MFyS+O^Zsxd}l&cgSb439XAKif%0LIj|e{!p7g(>V}VS5XhHb9WW1{3
ztLNAsSd_=Rrs@fAbFafd6^Od-tAu>HUUK)rl8Ttci@&L_PflJXTu!quwP{|=(vKdB
zjtxBiJ&jT%At#D@g44}Y18Dg3n??^5EVZIlID`rUPaU6xbO^LjFGAQ=J>j~=>w9j&
zdo&C?8)YOPCax{*=~Yoem55iiA$+~V_c9?g<ZJO&3#*?O>`UiVnj<IwdKM$#nnTNt
zb5Z-;xJ;@;XMXBt6Xw-N+nf|W8XiOU2h2pzAVu5mo_R@5AxpOmYo3G(p>DbThGcv0
zeHXxtBQjLRuzLmZwLJh_85#=Lbyp}%cI-2=pDae~P2RViq?$Wwj`<*Z(8HTsF`*m=
zR$cmjW>*vRo<!QV+%6K@7CL_GRFxlMGN<xt2IA`a8OkO44V3~uhZcX;{KVV@RjfNa
zh_W?oj^q!pCtqVad1`kBiNnI7+VPbJ8kCS=W{A`_DIu(`ttO0tkJ9<j!dP{nH=;T|
zJ*Qyby9az-1+n{Gg=v5MVm5Yt`8!V!ssY99>@Q(QTmax=Ki~r!XO)U$gzbDuQ~rqG
zv*EDe0KKP?9<68sF|N7_pn5XJ3<V6zXVWrVw$38_Rwfl&V!9t4-x-kJ`y<v9S6w_G
zf_uHe%qxoebZa!lDFB{F>2>7tjZ!KgE|eb}4cK@k`~504KwVU1M!z`Udda8y6|uja
zTulR@2uXdJ;ere<5FL^OC+KHBwG@3$C{vHzzH06Em7ZL)*|wEzsah@XLo>5gh@87T
zo+I%|WEumKlWz=2qWBlSlEi(x{kvFDPxGKmFAVbrV*x?|N<dYvDdak@KCixNF+z*^
zvwlFI19S(#ooS$X$u_#OhjI^{qk#1}y4em>%ywtKP!xo@4=+_=fu*Qnw0{#OruzFV
zwamybrlsJh4wcoCJXa->V;UpyXJb%*aTzV_6?Z&onAcDI2%!m;{ug;v{4dpZ2i&U2
z2a4=yxcALtFl~V|D2`T@8WYo&vk-cknkCwusY_w+`Gd9fqvLV%PQa^b2bc0K`SNZN
zgq})Dcnb{n#$Ahwt=PPXU>usoF-n$pQx7(fZ)q#B-IxaPO-o5B=nd6^aS+c4f38$6
zLeQmYEoN>7BWnd~2z4`8@%jV+FmT~x5sKWC@z%#T=8tru-D(QpboQix)HMiQzZ#qA
zq7-=M<lYbVC`Jo|279<A0U`_gWr-?NfOG8jqnix(S7N<}E59bEKnxnnT)@|n)Gf9R
zC2yjzh8gYj6xEk^uk3Ws9{rpH9@K8T*ZP&5)d$3DM#fA_fN<6p#w%@m#^&saTR97{
z&DI5Bz^>M07;M)A6wy#SX2XEQlz^-aJuu|zamBEVqpZk&rz;H;)B^*I<*W1-cENyX
zR$EJHXnMY|>ZECvBMrIDi7GqUq_hxBkCibn#^0ee5zFH{;JJRtM)*TCvO&M~Rw!~4
zjU=PjBLT<i`xR}%u+t03yw~X=_mb55>Wk0;{|X{0K3skTYI4H+b=IGf+{f3SY`wsC
zLh)L`wIuZa>DUA*8k-QV;WdvC&y{?gS7g{M&I!zzl3o{p%`wb{RPUgp`CQURt1A;K
zY2l>SBWpiY!l32_LfX4>Acv=;y4;<H@ymCca`^GDo4F#Cmj+R^1_cd$z(I?|_d2o+
zjUEb<^lj>`#i$N-_M+zLKCm`DH!dY$fLY>Zf5g}R%rtfC+*rH&VehNaE~K?`VBCt$
zPOC7674$tu31$jjfkQpWQ;Ci@Ar@Ucjc`r&P$(!3I&Z1m)#mw@41yF0HtFpsxkS;N
zOln`T^aVdG)um;tNARRkMfCza<K8~zmqK0@J1!{$lKp*D*|}?uz3&vZPEfGmhC`XA
z|M)^^YG?rBDATr!7N><@F!4vK(U$CO3_xt+_Ku%adp@t9a{iHeXaL4X(B2y;mIdYU
zSmDj85>>eWCYd$XHGoIh_8mu?5|g0#?-uda-H*bJ^eUrIv3W;I1Z1GAag4^EX)c%4
zzrFy1zX<*b#nu;KUL4>yfU=6cl{O`W$V0vl693{_h->FowbueQbG}}c6Pb$EFL$@I
zHb2rPjuK?@`=}(xcmKXy1Rht(8;@I=Q&M{=pcc`Mz*bO=MtY#7%K_QUMG>@+><#6#
zrBwz(K)S{k^xIRbqsYm+-_uqhfU*W;3?gnrd^;(>b*@QG>yuZykxtaT5o+nlTO?`b
zWCsWsXsVe{uX)h#tT1|VxKUrB!xe&=$`(O`rU2BSRvJM<uk{6t*uH6M1XBOJN?Yr>
znLc{Z>U0*Ghf~N25$+84zQx>JD{ES=n&ZpbJkAA>>B0_!;eju!c!0+(J>%UruD2eU
z6H>);%mqHEPu4;;<W5Rp&qpD&fjVR3{>FWR@gL}6fD)SkysiC5AIYA$I7Gn(N87KL
z@XW9&rg}}*Iirvfo6$>)5`g(*4{uH=Bqr$`Tw_UtEo>$3;Y$K11MCMuiMVPr!vCQ8
zNz6q-G=i93Jp$UC*$9{6z8a{j@b6Az4h(;kZ+@}6vvqgL_wIaF2(&fa9i5URhtGz!
z=ScmPncpP*^e&3+;z!u@4hVdsgV4*IC?w76SQ~%VN7#ig1DGSlT{ayRG+6_1hTz)E
zv_TuOBq_3jOY1opMVp~d*CD*k)jHxWIQ?R72$?>>Z85toliJQey^byk?9=;=)5Ptz
zD<Gb*ATFu=K<iw8^{;25mQ;ZozdQ`0P>b<;VCn>wMSg8Lv0RdPKMpXw;6`+D^?HcK
zP{##8uB!zD68Yjquc~OBZJ>ea#?zXB8+Kf6NxrClh5pa}%wo6R@wzbhbE+*5h3Q>6
zF6lpR!2Exc9ci(H8;xE!9eqXj^2(6~Mg9u_GTxO@uhO%c%vWETC8zs<2~!juafJnY
zr0_1wk(L+(8eoKIxf6-zhKT#j*5t&}qOFxL&W=4GgaHp22+@DdrMx0byUR`z|CCNd
zzq$f=_{{PLKTsA4UA+7O7=gTzhB@w64;O<YUy$+&qQ?V{<gFmh9)rC+0L^i^;C>mC
zx8g&C$aQx*xr+7f6+@B%AVNGC!{1P}cu>O9sbI7#o8~tOmA{&Gsp78ngJX|pq=Bf~
zwWyWDKrv(AnNC#Hf>2(Fm2rW`D~%JI4E5#n(ZGs|Z9+k*j^>6a-HnZ>8&3<ZM#dvm
zLZQ@9yZC|GL)+nv3>C~~?X86Pl?~^<`E&Vt)TUYjTWe|d0>kn4Ck{=)a)go-)pNJ#
z({vvQVs4TEn3{Jx#%X0!TjD5hla>Wr<+uq)gR!3g4C}PI|6}%Ur};=bp~M8IN+@80
z$U?M6P#Em9RS5Ll#$-}ovW7tjIb?nz9IvIc+wA0WQ3AP=sE0pq1%~<F1mR*nvAd0e
zW%4_8D*LILTftZ{-UYY&5`*wx^xc_7DT%pXkq1>NjsPTAj<+F1)hMzZBm)u4*_}qr
zV=X2iQ;;VBgyU$I>)qG4@9q3Gt5^eyn6!%C&-Te0X%IWm!U9N73g0Q;fz>-06m{z&
zn3wug=q|D*&^<1O8uZF<{`4`2=y;H=0~pO0VHm_+1JpUbsVcASIGEHBE!nZgr#vGt
zjluYJeMk@U)du@|OYE)%DpoY{?`$5~J~}>eB&40t0IbFB*=m8wberZrDTRmNK^+fg
zbGg-5&wel11OSte4p8a}OP}VdO}o`>kCT>PFtw{6H2-|G5d0AdgfkcrtDI?JjR{ur
zL+%%^97bcR3DAa$!DO#B3>as5*{tKUiM%l%G<_E;I6_enpwj^8Anh^@jE1(m7EqHk
z^Qm<7x+eR-dAJQ7eJZHb8d7Oav=f1K#+h*4=&rrAC1ce%z8^ql1pN%szO=Ba6;vB}
zUASa89wofcY~;^uc914l%uVwndM3g%0|2+`U;7*EY|+lP9<Eid?T`IZDiTD3JWaBK
zKmGx=1h5;w1tHiF-M6ht#^n_M;{t{m2xb|p31Rj0&PqCMm4e{?5@21r&@rG|S>m?`
zdJ3#UkoWEZ{!9+ok<d`J&_czSt8-4_vF!&{l8*$R-bcL;OP~4u9EiCSF;ZP!;jzh}
zz>Xw7<*^3(gJ(8?%(Ves6&F{GwpkJ((E^dL8r=M~%Y&cGV|u9{9dFFd%)bB*P=q(C
zt#pmuOU_pxv?@aB+E3pdTh<UQ*5NV9VnOViF{+O6<R)3x!~JpM7RSqQT@UC_Q3Ph<
zs5}Ez6pY4e-?WoO)a?`uV}^>|=^vYe=MAqRzS)m}s5lguDcPo?I;!4E<_#hW%nwXo
z;%ktSX$h9hcQeHKwP3sJz+=6<FF{oE)FfT(4=XU7`Z6O~c5u~wmd7%oRM=P@1=!e(
z$%HT{@r+{X8{uQg0)6D~5XxfHH6>FE;s=hfZ-@?pi2bH9j|uevU<0~fAeQA-%jV2`
z3e~Q}*m)?(M^wG9)Z(LpF28>a;72NTyrfvQ8J>nGCd^zo$5#m6dbI|=0t_DH?W|@7
zb3}Z7Lg)BdiotLi9t6}>kmvCEr^U|_ZqOK=@qSCn`;`BnIMmn#n6Kd#7;HL)y5_JK
zdpXos9#4i*i+IbxKxjPlhSSL$b)$EX?C0PZweNcUeS<2#E1Y@8+Y#<5rF_8oX=sAl
zh4^C^>$?E!d7vQn;AR>9s&n_kp^?&f4W77-YHiRY|M3|TOHN$MG!UUiWS7bJ*R@R^
zH%_O68Ywh=aJN=`*r022E^aQ4iX$62U|(&!rM?33p#dJE2`(zf9D?&_KC1AY*4x3}
zJ3(*{`hAqzUTk{E(RSSR6+X%_rIrK`OtqFCJ2_ndJ2Lta!c@FR8^>-7Z22@^24*k_
z3D`Xsp+X&?_fX9(W`jE0epRb>p_66eA2I+fl+drl&mVWwrPLs<zsflK{xK*>Qfc8;
z8I0n;y+Z3+|2qU^5Jw6<k^&HkZ7Uen%rG$sIX7?ui^1zsituxjZBWxg>%s<L6RK-M
z4N&676DzDVu;5Dl(8|ZNLWWtt4owEf6C_5SQ_@7g>t;0w8D3_bsbB*TF{#5PHX~ZG
z1kdB87*U5U;_vI$_2UzO2*e;-#byDPZh8k8TDc9&Z6A20Cg5}n3WEQs4Q4LKG%d6D
zaP%A^jnZ!jG95w3N0;5j;4{JExM8<B3*%m#6C@t!?fZEo<kGi6^aZt{i`!%F-}d?x
zlOJQuSd9Qp;$_+eRyq(V{(y-vlM#>bhu;u?Zm88gvP4!4Te@y)i>)~Xx1mqh-LqYT
zfncjN2;D+Lv3*<nFTcXObYN;Ta7OA>?s2tWtC9(VYQSdKmZm}bF2rqsnvO6=F65Yk
z3~GR_*MLq(L0D8{*m{qBc6H4SiNnMHpbN)<UM{PJ%Q5F~f$Z}qvAd<h^c34-`s)hT
zNEYlhrUOUZ09fb9O7XG4&8oC??>@>tN<LLd#C5+_a}&j}XV5@rtLxjC$V&0&3Dkf@
zDANNNC7@#N{!Kl}hQ6r#B>SYwK%N5Gr=u2)q(49!7npdjqB=Pm??}p@pXw+*nm&ZI
zg2oL<5yJY|Rfl&cg+l}zM>bhL0CQo3Fj$G8te12fCMFUPzT1Vu6d?R<7B0>$hPG}@
zYJYM_Lcqp8*o=LM?};=>*gG1w_7y>|#JOj-kp2qVXo@NE*1N`5TKbcallX9p(ylu5
zt8G#$zy4VUp4!PQrK;-s(8{YO<Gu)4h&KXQ$NcsWz?8E6Mj9Bxb@2tHZVsRI0W@Wp
zU1vz#9TD1|bl8)QG^C{hYu;_V96}G)WOO@#r~H&WtCQAjl5A42o;eW;C-+C&-Gfw4
z`$?7WenP;!&g|SmtUMS273GklY7C!u-0oxNyM^8@+?e6&0)EiiU$g76SsR%QP#X{a
z-|o#pN1+Z#F^kJ~{T5~l!Cn>Uk*HH~FImQ%<AbN_-yZiZvweYV2$*}g+1(8@`l(V=
zvPqX1Qipb|zepKG(Hzv0&@BfDdnHni$;F_R6o5q8=#Km>J^;UG;Yf$dBw-a848H=t
zG$yK|<2MfE;V6+@Hw)fu6p-+qL|)Or)i5#;!a&P}@pgVK4U8qeF2Z6({AW~`^u~3-
zNer~`F<NzaBVi9tmc9+}ub}j6AYQ00ac3b!U0D>Bxtv+!RXO#k4m+Ldn;n>C{Lp*h
za`eHCjuUUqM|Jo{TJ^DO(mFSCAM3mk9WcxqRe*e(>?-HAy2P$>4-CfsOdo-)ppF$c
zcLmfHs{J(#=<C#UJLNwoxb9L+SX~DY1^^P$SqE11xkyZ^AN?3;u`uNEh;D}mg2+S&
z*G*|;oN3uM@?=s4z%~x@65iYlE+`zx{}PFS;a~OwcWF8j$TdU@wOa$K6_i1PdRSH&
zAkw**6$>@keRVqE&F8+NS=YU+V$z-GPIL&`rZ63}Te{eBMW0s!k~>ZeiuO^1n_nmY
zAvg(%oIrnv^aS8Osw53n`xYW#&NAFnXLkDfhuRFCTe?7X`5TzIK;M_8kk9ohcr#+h
zV`mSL2;YKUG8*CRpyKL1r?Kz)So^~Zh#M`Os5sUfUQcP@&VSw<3E)Is$B*n+jupYQ
zN*$@qI5ZOL8)X4l)e6R|GVYP&U{g4~>gGFTxjg8%<7(6Q=@RHT%E(^w%O!pThzTG)
zpa5L-x`AQ9qj%3~Szf3RUpy3(;3hO-X_lH8FIX;Lc7&F#)$w*>>inmb)w0#&eIoAw
zKHba5fUQPB2utO)_A~RVMb`jQW}>rk<LD^>hlqg0_VKAztDUm)9Fr}I(*Px^9}s|P
z-|&#arZP9pNBq<jcsTT)w!<-g8w>E(?EHQVCZ0^1k%KXiLldRI@#X~+lNR2t;vH$}
z@bBVkR~Z9`GOE4S0h%6d0LS^)^IDw2HOa`x=}7+h=H|F~&P$#-XCl_kCGR_sur)@h
zZ(QGr?6Eem<aciM-t?04S~Snvvms%`X=8H;e^JqhCu_{c(GZu&=Z`~R1cOtd(KQ6$
zVbXBePIJu$^$JrCBNfnl$%nNosIvDJ+RRr8%Pc>Ln`yyv5&qqio>`e3?HN-BwNEx{
z*eV)>DtM26=1duqi8yY$?<}i*Fy1XjJN!8=rj6aO6rxAFyHscx;^^<_1;9##F#QaN
ztY<g`Hr7UMlAE1hcIj+C5L#-<71+@z>}yl!M4$F7@Bf7QsLb^(&=R&Z;_(fD`Ql^b
z*k9pa8Z6PI+^%Dh#!XTgk)x-58S6dumICbNXeBf?(D`lIERHakk%Y0t7yo*KX0LtG
zLe}L0J=(%*@rVvWm}EPJt*&9J8S7KA&2;<w?Isj)Dyg7Ead<5L&k1eF!c!#;-;5JR
z!0>CXBEQOvV<aSQIU<`*aUXvP)tL`CG@v_vMC>WPAc2vQ9z3H%%cA5>KRM>Pu#CFv
zwx6CR=z_1^%Vd>3<w;HmOC&<9c{>d7`ByvZAAKwkK1HSoisElf!?Ad`(5v`Lq~YF(
zW=FzUeH*8|fTQn$AxJDh8IcB7qWnwj6r766cI45y)}FUtB#PJkDqan4c5D{P(Ft^C
zIZLe;XYaC2G2%;{rk)R#;y-^Mx@K@NBm8jtfCkZ|9OV^+yg%M(61s~izt0>_MOmf4
zWqkBU{zx+6!#hglZ3lN0EVQ&JwVjvE$>ZvV@%pIBkh4i*Yv1v#|0Tub)bHrwcQ{6$
zPVG1M9*YwUQDmKRPsTOC%PgFd5r<^S8<*iiI3dBSfs0o-x!<`v;_UR+AKsGt4<HHx
zuv~jj=V8<G+<OuCN6wiieT<{#DlAG@JN-vY&2t(P{tVX|_8}v?^HGJ(-lTB#=bw1a
zq}Y1~m_OeVZJQRW$73K1`10r^_=^5D?h%jMY@x@Z3ASEjesFX}=8yf%f1;&x36zqr
z-}76~z;s8v#kIA{Z2v{rZX^Jc`I7zXk}$h^wPP*$Slrx%GsoEj6@fk%X+-OOPiB(k
zU4BE*OBntZ6S6I+K`KrLznkUkK*D^;vDm~ALfYgX<FhhECB^qr1kP{X+L_s`sjFUi
z6Ud&+n6wrn4NQ#rewKmO8__;$&sy>r{y2uYM(-l20fr+9MlMrvkcLlJeNb3o12;ty
z;ZJyGUCD^W4)<|pBMnx}=XwthFl^49;S$3Nejt*+ZMWjpD>5rR=f@kah11rL2ay)A
z-xhi~ns1z1zA5!^ai`%hatv*YQUeh@{N&ho$QC9it$!~ER-D0q>7PTg)y{G{dimkS
zWzmOe$D#xNR;l4&F$bS7HIxWmBLoGv{>ZB@pq1jsn|<X$0kU8OOmCi1Lnoc5#qS>?
zkr99Vi#Ph*dfl+sAU#4r5YX_sDqUga!NI1`znE64>Bw;1RE<cG#stSYm2_ky5*%zF
z;Sj_k*P@#Qf2w9Z-g|Agjk$fJk%0jtMu*unB7|A@M9uK4NKH463GA@%upj>b)lw8P
zMwaF3r7jtRCqSdz@J)G*ysXfZOv#V1s~`n|)7lME6z4LMWxlWFoj*EoiZYQwJ4m0|
zG2{tyoLXd|q)+!{a%%XiI%#r@t#{}rf#2~f#y&HR_0)c%plXd>t~VT6EHh3rtjXf>
z6_P^55nbZEsV8$5jK44qr?IzX#JGU40JL5IS(5A~-U~KxIR>9kRlJL$T6kea!j`HF
zy9}1CR@QdkS2~z{Mg!_ceVfe;&uvuIZJ6(v9BQYxeTuxyhP*awI3*KMt$Vl(#Npfs
zuVJDMrSqy$pN~EXy@_2%5n5*|$tyIQyP*r{?1oG6^sW069M#1_U6wlXZ?13jGFM5x
zFW@=tW%yvHVDCsM9EF!mhBcWFx1%!RMo{O-5M1h>#&K*NLG)>SXpOjkmEplZ3%$&<
zLUrHOwDPh}J-^|CmyMGG%(r6TxwUq={V$?lm0PK)xE@K~&E4zUKTzHa4sZ+?({r|p
zh=y~(yl!zL`<Pb3{E1@q^_?A$l?jH3usK|X?LHF`SVi@dn4vB8?ohVSMfw+r92`dd
zv{#=&(TlxRKEhl1i#FL@-i!IRjYInqM%zFUZdsKfv+@iQw<PpK;*U#P{&lrHl+{=R
z!dQEtudp5#rBC-6OAr)S++};RIlHn$A6)!B`#l7H4`~gvINxJ+=YG=uv<i`PYvkyZ
zM6k=}i?h8OHeLt5BK9q$L9$;mUQ{pw4YDUK(Uh?n8DWYfz{)<@$<cYy|MDb&e->~U
z4Pc*1UnB2VrR_itxoYhW3q<YmE$4g<@FBV#BB&dioIxbDTmO#kc^~FcDJE~QZ{g^h
z4XIxQHY8PL$*j~JZtJ;>sXuZ^3oc2DOJ;t&;w?_N0F0&RyTIN1Tr~LQ;tp9C+&-V0
zN{iyjb}8xp?C(bS(`~p?S4|@&t7YA88pB9|u~j-ReAn97plE-Y$j@kZf{y4!bd9dS
zs}<eXUsAFFv2($-WLlvkWg2>Y;r>9bEp|y4up|hPX6m-Lsp|Qb4B&>>7bRNSS~~jE
z6+()HA!|g_i|~JD)zZ}1ahhTGvvy?VF0Cx=(BT5%1+t2{5I*K}FJQbS5{A#hisY9a
zPgc5B;r8z%Fsu>#IW@z;6wzD2EbKc}%|7Y{?mRljZREt+8>wjHSLF9EL8f+<M#c?t
z8cWOXgq8DR-7_rzY!}!4x!ls&dh6CgVowdG;#qJb)zR-Esc1RKh|A+*41w~p@V>!&
zAJkArMRZHQ<eKFZtoP;R<p$exN8zL>@!!qTpn=6^j`m-G2k;sx4hd)Fv?sMvT%1`X
zaD__`inV;x7tA(!z*Iz-^O@?%%$|A>hJqb&0f0x6Ffl54;qCP=xzzPIyj%WwH(8f1
zA|AF8{MKJnzjCa|jH*D9mjDJ`RyYwKm#4-9ih9!9V`49683|a1&=ph3KY*>6w>ei{
zjuAfp@KhO2${V5aI>Re$LrigzqQ?e`UidpZ)ANw@iDfwu2a?39;xbT%-wz{ts3fCC
zaJ&`_&I#fR|8Zg1Ll*&S%@6+;T>D`OyY<;8cvgZ<u+ntolZv0N?KTG7<vg(YzmOm7
zXlBlXQUDO*#4#{i@;H8g!n%>RD;TN&qwKw-n(UT0(9i`zL_~@R7!d?SniT0OC<q85
zQlu&f(m_h-MWv%Or56=Mq!$S#l%Ue23DP6Isr25HyI&x9&OP5fzjN36mVbPUB=5WT
z?3rhtd1m(8`<yAtU_oyXwz-+B`>cOvKLl_LNBjY7iX4I&DcNC)O0CKNgj{+^0;@|l
z3YD^&8n>FV9kNHAqMIz6z>#f>6B_Q|rtQMId;BkZPApk-x^GI5{F~9_g*0#(cP?#k
z9=u)(ZG>nXv0^Lxk+LWW{3=`p4&R523HFZner4`8heDy1ci=}Ofz>EOR`Zh*+#6<Z
zlUU%N+Nz-atZJp24mX>cTi%fqe7tiR=4I3Bi;tL~)IoYn&ZO>nriX_hIRFEp5k6Gx
zU6h}UkA1RFfSt8nsypz+Y`?$;DtHme+J5TdtxrlwQY3=a8s>WP9~UK(aT)f?xxmvs
zX_upm^-hDatPIWCA8Cr=4bq*vD$_PRHKlhNZ}F^5y%*snp?B)XQh==}7^##0<b;dl
z+l_z<>j8=cK!sdj{|(Fgf1b&3y`r;qPZOpP=$>0vI!XD?H}oD)ajt0&YTNrw-j{)0
zmX%Rl`dgb4!luIaA&l-~^Pm3)GzNk1=isby8n46nK$v0k6*wWLAV>OCjHafonV1>B
zpbQEx_csy9c_xFOY`XSsb>%G`fz>@74<#8-?k|&B+!(tLJhpDa^uPe_3(*}Wn7{i<
zag9y!P54Fq!pA0sF+*`12Vf8aS{s#tX)o@4Ief`pAHlGon9gLE2it|7_|;#CJowe2
zGwl!x9iRFRL(9=dy<i9|^ZlVJqd$9WJyWgB86h&Q=KX=kgKT%sdwUZck21aJiy-q;
zn&POSZ+(sbI)!(>J@VtRiuX1);E?(BUL~9gZb(pM{`pY458d{;<}ciG=>cwM&>VK5
zxvf2<dQG^so(l#7vw*POG_R<o;vHZA(^*b$O7yM!wjr3ZUGd$Azv67>+i!x!#%HIv
z2c@+B&0W6n?Scz>k_k&<Lm&^p@ftk`SC2#2gofyG#NeGOTGj^ysPG-QwzsO>>FMs@
zf1c_w!3Zn(o=`QUnMzVJdv@NrA09KyA_P$RlUi@SlY^B@ETr2KPP6gq`lWURQ`bWO
zMmrc$g8cX&#d~Y}@5*qKP&7D@>N2w(;1~}Li7j{EXwm+I&eqv^9U#T1+<2%7a-6_v
zS<0`iXz!i+YRim54UijJwA?V@s&Jq1q+D@&{762?z-#l7y;S!@ap&~L$cy+j4ovmE
zP2-9avvBdCfX<6Dx33PogSGx@=uuq?^1~m75w$`K{1~P^q&6G<tLix^td66OgYxTl
zSwL0$pUx~6?axI1tkj~IH*jHHV<2{C{|peB)SrfP_Vm{g&1QFE@!kymffRdFu7l%V
z*I3BjiAf~isrf*}PT!(;`2b6S6=vPb5~*OCJ{BMc=!m>lIUX6(=k4(cXV+5qH9dw3
z+_2VoUtRAFas{^_`)UFgP{J~wLx9$l&$z(TaV|{qX+cZ@{o%?HW6(qLCTn8T2oI*c
z*A(|1lN)#9Q{`9~jGg&=zOW#{LU)tAHTn7a4->4r=dtT=i^^A|FphzzQorlg!rIql
z#zKW07vK5ar^{4xZ&nbj6XB~)r^AU-IawMa5>C5=q!_nJIhAI09UnW>9~+S)aH{3W
zjr0IcDYFsinzB0t6P=3U6o{96AYr$J&(CBtncfhfiKt+nXZkxdrlQ|sx8BFt9c#NH
zNy^WEp2*zX+-;1i$8zzH2bHL1(F#rkfz>sB3i_Owe{}%dRkB3^lGv&De_UB)=#d8-
zJSMoHN^`}Qa8*M3HDt=^uh5(DrBg&JrKG>ORKmjr81ZX<Tmyn7K<AO4cOAF|$Ve+^
zremHMC@q3@jE(dK3S)i<GL**`Grf4OUw~;sjB$=t_6^|Hw4WzG4sll|1iw#4x+)o-
za(er~bj;q|k#mky7Y^g&fZP>1dwy2nCjpqlal9V})*ToF+(tz^?6|pkCvXo2_M4CH
za_`hOkq^ZP93jFAEKD2js$YNosDH3OV|Rci8prBD;$u@H2y{I~x?CfH=Z=}pyk8{!
zyV*TxBH9eh;ztNH9FHQ#CIy|sDSyh(>D9y=^hV1*O!+nM=vNNnrhb9P$2rt|m9iuW
zVl>FQ4Ve<@JA_^Hc67R$ixlblEo+O?os?!o^t$f~8=ju&26+{LP38c3cEHe^2}7+z
zF4eKM`)>McGdetw`Banz%MeI$fcFSTbIOeilP<?nP2P=Hejt&52Jb=?g!k7R9julV
zk-r~BpX?5k$uwNykv9UQ1(+ubF4z6l#8>&IYnr=s**g@4y(xMglpv(MYFQ%G02U2k
zZKZ&HboTnv_T|c9L>;@l@G3A(<&A0m2VisIvdSl7Ip9a@uBfTFJoTAxx_bQYVqw5a
zG}^)#29G---imbR{Adn+eHo^<F;RYuh*ret#dTGg)wF$%0aGeiKHQR0!ZHnf_HS9k
z0B59MF`G;PDQvBbeBL2ZhHQH$?f~S63zA~b!asaXi>wzt3vIn3`@$m{*QjT=zA<Z*
z=9@erz&}D8!y5vl>33>^!6qOO6;G)JoX!%Kump@uD0MO;Yboh!oA9p>(yLtS7q_F+
z#b;k2GY3YJLl>L*^317Vr`<3EV_Hkgg{uo+WE#EddqWO!;Zw6W+H$7K?@a4sfM<gi
z!6hXy`@vGJOcb9L5AqQ5c!A(7yL1|sef$v#D%vh-a>4`{V}&9o2UFkVU6Fi`z7siF
zI@8hEl5}|W$<e4)Y3rY}^Ffc(-nYL%U542WPR1;Y403879614@h3G&%+9-;H{Z9`^
z7sCtVYNSk`ZNK8w?mcC76z>|;YxceBulYgsz(TV-^Cd%MSG3-<g#vO1gC0N(y_ffM
z?eEviL$1gmaPuB|2rAeBjWtL_f6gfHj&te|u+g=eZ!n69;zP9&At@YQIDgW@*@Fvm
zbYIzhrR35q37_?pavt4CW<H5`{AgJ_5WVu3uidGbR~xw8nL|`L3yyVhT86C5%G+JB
zm=7CZC1*O(E5Cm@&Hc>kjLy%?$?XJKdH_m?cn6J5FIH9OL;{47o}=OvAC+_!5S5tQ
z>!Pi%pSkBYBh4_7XHn20q7G8HubheSpxuLj4+(K$&s4s#Se5pge8$^=ZyK-xw#`~W
zp58uv)Ea|Na3P!t#&9%J@RVK7?`q2yAZ$|w*uFD9Q`m-UyQb<`G?tZRC|0@yW)x=7
z_)Slq2sU<U?2!Ab5zJSVla{P?J7aj85O@IrrC~doO&(eyY(ngVgn}0Q`CG^Yo~I5B
zcC0<~L1K#qX;P9ycs%oB7iiH#C`*%AE(OiDtR=tl4Zv-X@$zsvHudTfMbH%^F1Idt
z<Cx}e#^=U^7y%-n*HTnUY^TV=pMs?ITGzjHNAFu-`qFI~QzxY=8eoB;Ct};sm0x@l
zLYz6;@DG7T69bxeA@8YLVTiG2MUjMS%teFeBjgN|TY=N5Y)l({ZC;t1Wjg)ZCAYWT
z;kg^OFXS3o>UWm5uJ0!G(^|Ku*D;j@1K%5Z?ke-mjX3+Ty%Rtnyx<?`A#!6?yozei
z5-$1*$$cfgz(LaZFNnhE8<fY~2L6NsBq(V-(R@iu&J%9F)8{GEa(zJ@y*5=XrV2UV
zzEj;G<+d0LFboDUJ_XPSMe<*$y2`mdNqAs((zW*ZXzM%7aN%UcZ-K1d#TQV3XS+e(
zd@@3i!$BP(7+~FmJaCgnY!T2;Yqnc?UN1H^%{E!$5{pu`vP7;vr)-WFRx*soJ<ZkC
z&E-{b>IXKK;19gtI~5Wz7-XO?`^D<L_^KymUZb><glrL0EET7w%JIIPy%DVoe_|hM
z;pA}|GPyuk!k&<ZNp`Am+W5p_sV8jsvjQU;6alcj1SoaB6vrn-ePrGJb@R%6IzKpm
z74_&K&g3`mYyJA$kp|nSl8d`C?W3Y8L#cr5Vgh(BOwHxNpu<)Hxa3Ak#{oM!yG)Oy
z#^5O>Uqyz;G!X+24GP9i?>XSm6B};=<v0XN?XNZwpE$(nXtd_uA`r;}S`Z?FQg&Bl
zko~t4w}s052q+WX=dQ%RF1s~t(QV<aI-c|%SGMgfNJaI`^Gq%Qng#V_I!9D!@QKae
zT=?mO;Q)cm_C@QxmA4_6{7QVBRu;cB0LkBlaxL)6{eW!GPE+$<3`r3ppbI6xfE2>G
z>XEjJjZx|sKPk)Aznd8meFJbg<?jKwakZpOP!^D8G!**Y^A?0E%k<LK=!Cjrs&u!C
ziRmk5Uk)=AMPYt6IBS@0?MqvbVS=M~YuFer*i3NlBN-(Jd2BZRFZY<R1<l2afC3>L
z0-37YpzGAuAbk&yUY?QBA5w5jNxJBO%QMXY?#mq=!_ipP8|{*>4Sop2KKVf$v~5`&
z2s=MM&VMjb@IQFJw$m;eavcvfQpPZQ4*w?<^;8|y7I&`tDe6*O$1j6RKjd~n-%t=T
zgI7^sBlg2o3XV<{GjjjAB@HEe9UADa=IV&u<rHkS5{|7REV${$q85uNSCE!BF>Vk$
zEIQ<P&X{+~0{@LhY{gVNDS^zaB^GC(Qh^Wg!$h<qe2JPv|Af%*YpvtJr1tn~S#Aj9
z=~BVg^lW*S?)iOls(BjY1WGL?aPDHxcfD0sLuZ&a<`DBgp6)Q`<WZR$A}}Z=9B1m|
z<Xd@VZ%g!NBY5teWrC?M{`5}?a&X2+5~M)>EjiP#rPB2!=b&g?dfuq%b#|{Q8)jsj
zAf?IoUkRg6z7eE8AkHma{5=k)8>}HLRLw#}08!E$>X;;Kd1`9?WT3!tH6pX*O;>&W
z@M%qwAf%|k4eENEP$VcpCw>N;$J`=CYFNll+%h}<3HZa+NwHjT`r4dZ^`d)VPwc$i
z%fMb(UD|QRy?5WY5#?U=JNY~dfMVYhusQp^|M>Gf%KnYgY+q-)g7(p62dBJBP_(%p
zU|Gq=q@bkq!w|O>V-w`2n>naS7Wb|9bB~Qwoi3424)O$W)TeDLygt{rvc->^nO?+0
zN|0f62Q|#uXSOX`10D`4c{O{W+#5;xFKPdq@B2)eP4Ffy18^%0gF51`uO;MsHey}#
z_yd@m0n5BfjtZ4Bk>P#-K}8onSGYp?@;TlYxm*qL&(Z~v3&pykpnxcE=}-wB7SW%e
zG-K?KtEWVs#T>vZ{&a|a)c=|3;9<Pyi5v(^f&!^bl#hW4Fn`_ubIOYbpVR;&`{{kq
zO_<9^*|mP75_gee;m3B#ZBEBXpBfv@SFU%rB|67XnwUM-cY5ES^v8fHL4Bff1#$CJ
zF(}6I+*<LU&NEJ&_(_h3Rg`JzzRq*lFbAhdTUCIAdx+QQBaU(SJr&~miZs<dg#A23
zN~icbI!3QC!6XX_(F*o0ngkhnRKLNIRF-=`DR&a{dR9E$x6Nx(2=b9#Zz&M#xCQ?U
zR4{vn6p(Q-4Rybwp9Zr0P;&vzDMk<0RvkRX00}&6eX(G@C?{l+#Ow=E?8n~eT@-W$
zuI<1gJS>cUN6O#7ul{T9`KNcw3Iy>(Q7Q7J1^16G6|TNz-3{Mu`mjyk^H|yW_E%`W
z+|MLj_s);5_8AtE&!x;M1--(s=hL6wWozeE&)u)nuG7YUF@LxlDXIK;6nRF=;)%UP
zpojPv4bAEAVrt;Nhrf$oN(J~1?IvIdWrI@g$)CMFf>oj#g@MZnzU#fYoZ^Vvm64pY
z{w7S&Bge3i;+y(XT>XdEr5?3MaW^mtj$^X)#!r|*eSk4!yBzcBieA>ldwI7rR4`^k
zF<X2gf{l(!@*>>aKIhwF%br0JK!wC1q4u%rAQmJehVo#~d`+0NtE_@}e6)d#_rdd_
z%64KS1WdHk{}aEAR`tsJqPzCjz^M<qK^gdqQ+m<fbMrm@Kp{@#l<hC;9+m3@p^f%7
zu*VkJ_EdH~2JTeH7())<Q`UlUBOx#`+^3wG?<(Y%$rXo<Xf~@&ZnG`-pX5LMJD=)3
ziWXFNKjoD9KD^5uq7r4E`3s<3$n#O$`{hTU-1c0<LPeoKsxP?}ZG)Q4gsOtM<?8OJ
ze#bX?*9}jnZOFt4IKT~!d0@T9nzurZz9xlvCzaSGH?H9`ZJ@p|po{oT{_)!)9NL_4
zA7U#yAHOk%omi`fg@0|>2+gQn_Am~lAKeN{=K!;83G`s|8t%89erz%6zplE57;w^B
z(_Pc0ObZ9Cf8w|3`P{l*)Xe6*$X%#5Z#c~puACM-SKn4l>a$AK1##*<245&(&FAhY
z;Q0tPKgyl!a?%MtZupf^8Fr*`J?BSi$x*8Q`03G@M1=zewZaTd(F7`6nRF>T+FunX
z)~yf()YNjtLMNQV2!LC6-=;QZ!k8429+MhBo`f5fEctv>>2A{ftMQ}Wqw%a(#eRV4
z=DnYk*Q4hkynL)#;?OPnb_%FnfD6&ye?3;a7r6<@dkZ<PL?t~Ro{mN1R}Dr~BN+ZV
zE*De`dtkDQT=umef-Ya`O@&##_V>%XWTejR#PPm2nqV-x$h1Y>eJ5CI@CyYF0G4w5
zHz6F^#JQh4PFr`?l{?)BA+JYIg$Op~RU^J`>|Rv4cVyZ8s4C9GV>sU&t5@0!pz0?!
z3Ilh9{K)J%ng}Iz{4H;*9h~g~A-kXU_2xFt>D?MR?X5_DL<&d##^nf77|*fpuI#Rv
z?0arYjhyzEn#=e}J*<XfQ^UGr4CC|OpZBvsU@_dR3I64b-n5d~H96f+0C@UsUU6IP
za_IZuQK4#Yz<^r5R>-cjca{|hh=k#SJY4s#7`%c4>xppmC3xW_5>m@cpUaN?#d7wS
z?WU3t7FP|BJeO`_5-!M|FNFyYa`=o;-O;-6=^hNb%Sm0J`qe&Vm?>DX&4o$q*Bhc$
zKi4*MK$j(S_hit$<-&5BO}w6KHAT!684v#~yA1pKLux3&o(_LJi5UUcE6VW(TX(QL
zw55u2R%qj=;s07rs=I90qmL+`2(xA!2em5TR{H^&{tUB5E~+sNIKthXsWt`&_a}30
z#nhw~mPSLK>rPEr-Nm6~8JXUmnnIi+vqR4B9Ds3_pA<TR)QjQn71h5cfE7JX6Co7^
zS;~Pg@lcby9}8QWBR-Dtx5k$NWecI^<pCSUKX%5&YmWU%8I5JM4i$*cWUI>tfWg4d
z1-dJL=@)+Q)~#b`^yC{Z>aNunAFD6mTCLx;hTHK~OG_Sr1MdJFc)zh!c0v6dmikX=
z^h}Bb6S?JTIRz-#e9y{#N5IxMb*@5s>MI@zeMO^r$um&<K6f~XxT>BT#w=!RH*E4m
zkS!`o`#}Z7iXWFG8Un4<#g8Tc)l{5^dT~wT#QcqcI|9v2LjGG4#nqhe0L0&#5mGh3
zf1hdUaboHNG#M#S?hjem+)nS-)Urr>Uo)_4t0Hw-?|jKfw$O=gz#LujSba2Lmg3nP
z<B`v2pUhOTtbx3OVcy$54x=|(a%&56_g;$b`#%LEZ<^n6XtqXqKKe@h(;KnLl2)w`
z%s&QI7K#3DlteQ^<M|{mQa8Ks;oAXTD@<kvzbdulg6vusY&J{p$ENMlkGUNj7-0AY
zWN33b%gEsRXcRU|BAP$iwz0ah_|B|7C0|QQz4kZl;KQJ|V>?`ZLd|yUJap92LgZ;d
z4XUvhmxfGeFrn5!*s+fk;gmmdyYuGPts8i8wr#2D{NuBq6NL#@z=09hc&ihawNjL_
zOG$eVo09SHbo#JJ#b|KTYPI*GApj~v1Dm$Brn<Gy&f_YD>TcX;DlU8{XBfNAylq4=
z_bf;(U{qL4>)`CT)IogJNL(hf?H*rs;uU%jAoiLDA+mEE^s#s?j1gLhlx3%8xBo=$
z52$okarRqeCyOUB`d3}3Z`HAq&{8Rs+u}Pdr?r{B<i)STWIfCb$32IAw~P5@dUA3f
zDq%5W_p)n(!4uuxDY1SKR`n5>*HntTzrd?y!NagUY)cdt*zk$C3**8FVWtHQ!s-Wb
z|3<OHzwq(3rjlGqCF`0~E*_Opy6gTyOt^fwdN##cLg#8h5pVXy`>a(^Kr$)(HWYQw
zs`_LfxUF8b=X7p$>%eMt)!X~2vnn=v1J10I^NnXLb2e}QZCQHp@N#vUrMSj>^2@K)
zShv}4NK74Ag|95bMphv6)JF?uTmL-|6pN047X}d-upM(zHsE*lJ=igHDW%7ZF}T1c
z#qC;Z#DYXE&W43x_!%9{irgNR&>Ii4$l?(OWioqf+gy^;Q)t;8N{`=4X4BRs1DU}8
z%@uHK?v%W~r@bUoR*Nl&=gkJ->LW-^p|Ax=ICkR;Q!0msimoP2rUwx;yLeF@ilD<E
zi96)Rxi~yVMMth9P4Fz3&k!ZVl*h+Jy&p(w$yKOb>Kx?JcyX_y(7Onw6+rgRhI~45
zlyG-Bh1K-)w`y8VD~S|alu)bK^%!3LY`RCaz+11&=|0X}vJ-kO{HS-MuTwh}kWyRY
zQDH^YTOO<{m`(cm7)#Ovqiv?#(U*I<s&W3M=yeEYC@L7e4BX)(i-|p>7t3xGc}P7N
zo)%l}yz2z`)wLVCt|G+&A@?wrg!$ejlT^ASZ`k;Bt3B&ytJWHvD0;ZOgcjPvyfjoL
z7m4)&8sNc}T<$9K><Dg>=(pXh9v9Jlaam2L=*9!DT<OIP<ItqUw!h*SZzk=!0i0sS
z<)ujQILS)r=&P=Mwo%*_h8%==oQjt9padiMJ`{f{{my${^(uE6$;ZaYp&?rPESN@K
z*7py|9(vHB=g8f;VqfdL+~+JY8u(>ES_^1UKnbZNv0`9T=6lbG=C9Zp>6V^a#6{$5
z8!$p7qxvqW3zbcNtY`6jwcBR4%{t|`c!iH$>&ZR`lEUb6T@Ksga8GRTI7HE~bNSNB
zk2|GMjq8Ov2)sP>7o$eQMJb!15DLQ19YJJmIg-HKUpj$$gY%8gHoC3eizI8W#b$W)
zWCR$+`_Z&vGP$5w>FkGF>%LJk4ra!Zg{d#rh*?m<L~Q!kEHbFd>W3wl8Vngk8AT7*
zzz0WZ@?_mRGBdQ|B9KaO(#D>J|4!xP+YpM<IkY;qSkevve*dWX+5EEpK!7Im%PN?o
zbZ#pI>@nv1KubKh+sBNxY5X;gBd^y~y4SSGtgYK{XQ%qI44-aK4lg3hw)YI~%jtKy
z8#3L}->PfZUt)tMB>;_w$*B@agG5&#b{60^jc{Xn!m(4CRtV%isclt{PJll_a`M<!
za6x`S;US^n37XSvWew+v4qXFCT15vOQ~Nu*oXOJYu5sL#8(FTr+gZo~L#1|swC3ae
z)GIn!D?rNDSas&RXTo&FhTfFdHU<H4c+oMr&Pod*xa)W=K>bbNH%qcwX5Eo#6?D;z
z^pz>Tmhnu1<zogQ2Qz(?`!L%i8;|i}L|7pR!hu`h#@<7L868EgOdp}g;Xf)QAeTFi
z_x?Vtlo#)pqInsIfFG^F-lou!)+aD>tZ7FYUp~<d@F7%+V6p#7qinKi3lFiLtg&`(
z1EaI$bqYWYQ@DR{JegIseQ3KD+dekdkaCj=W;JozGWJ`ucBAxEjb|(M)SZf(t?LKd
zswiY6TH;k3^;&fBBxGSOp!&q(cMn$j{ZSzi9@fB^#5RVX3G<xOhj=D{^8xGA0SgC=
zB9cPZ8}T)VSna-EMvQ?Q`8EQ!Zp#5T7NT)&I7>GDK~?IWR<3qB0Cn@HaDbb<wK$Yg
z>upKM;A$0Yebb%zr4&VgCx^&3<(0^D_?(MeP>l<Ya(h!(rwg``jX;%y|GFH-iOXyb
zS6jXw{uRSQIA~l!sWjc97+B77f5!{_R0QhW=0KZY4oe9y*^n#J2_S(%moHQ^?kxT5
zrP!tVv<y02irW%7FBkXs{y(>@tuucNKF-n=8DvV=o*SwjOB1&3wczp`u)a^nji6$g
ziNW^r_1(7O#G8-YI4@0EcN86dtuFX3Ym@jq<KVoFw}0X`K*|sNp7WUbZDmiwi#iwi
zx!U{aePe4>t3t1}u_a-w#5#98>@gv@&YVgT+iN^mwlLitjk;+;X&YEBfvxXv+YrUQ
zNJu>myY~7~IVdcwy|AA<oybQz?-60$DzYDushKiPM0iSR7?0&ZC>$KcUU@lgNwGi&
zf>shS{5moOM)^{E4DW7b8Dg(NZf0UMU`wJbL6{^OH-tQHjwnG2i<WZuWH&ojZde)`
zrv(3yu3deF<GeA|9G4nn=p3hetm?5-m1bU+9by-API#uB>F45n^)(#Qc(h?ip9s`<
zAfY0Fh~<ur59@B!-M}vt|1dR?^E%EcIs4OM`W}XPMy|KoTFAvbzGEM5EK!hz&nH3I
zkXBXf>hf}-zI{{lRpe+ll-J(<(C`T31ad``c)UKX>}_ZN!6(ZtcMGq-#o+vGkR$FT
zBRXcDSN9{3{C%w=O;FF)jozNO{;-kqwB-)yOfXKB!kVhM7F^P)2(*t_=Kj}5TZJzX
zP<QvbDDB0?M&dy}_*sspgAz1y940`vxR0(f8Dj;E{ZW|qV3u};jik|2O}GzkW6z|H
zy-Bxt0V+VhORAjSr@wzMP%{xmehGOu5%~kq502nMP`8bdfGpv94L|OmvAsjIcUXcV
z#b2lyznDGOa%b&GVsPO@{Z9+`){4Yt%|1FGt8M$@big;TeIykLX;_6vPBwC%whe}$
zgk(G{3uaf-ltzZ%Rs#M7fO;)KWl^NlzcV_p<Qlz_?g!_BCJG~Ds4LL$0q|Si#hP2X
zBPg{w9@RHRl;0+#ShmVOp~#t(X6C&(v~p9%L#;?q%iP@lEztdyqp&#}G61awU*K}-
z!Tq`c1HG`{F>{(Xx%hZH0=!nP*Ilc-_ILd}iKyU9(m>MVqPw?#eZ*_WBP=)qkjcz&
z>Lt9Sh3z$EB4VyAJ}GW47<a~c+9{(t>Y7$Ceff=G1LSxyorrbgG|0GZJ}#dRq5lJ}
zv1*lzS?4V8y&=$hW8NFLz4|u5D=p;IrSGF%n{zL5po9VHsb!`Y+?j)CIWNn-_qzT{
z7^YnmV7(1$|4CBrBHP-OYXutOhNEU9I|o|a;VY16T2x9`f9ypBbWrMPOO@rU*d|6}
z{^nz{!Hluep5=p{JxS%xDj)lwEI8jRr9<7I__~w4CC`Vc)BO4AHR}xH6bR%k%?dqV
zj!9`CFxH}Ln<p_-Wx1Fq`j$;Q^JP=X<yOBR@;0~G&n0{*o}07f*%DeKF`hYHnRHVW
z_Ua`4ubIAjL977wFY>TGoiR1%9i~O^>JA}~+eY*><N|l(h=}o9&7dGf)MMcALU*gO
zpz0gYG|hR>IZ_#nGzA+WXLHEk6qgOsU0-%6S^+njv|m4V<+&oCt*TprCr7>~FvC<J
zu5{f(6Akr%TA==2gBeX3b4wdLo(DkhkwN$LCcXcr1Am<y82NF=zQqp7L`((yh-m%d
zdJ%JS-|+*!7MLSla&GqG<lZ4BBiC!@hH*LBnMB$VMm<ktc(}jN>Ro8W97@%}L9kd{
zV<cK~u&`Mefg`Kz747YL3rO29FS_m<l;2PBShC-vkHZpWw))YRP&4mjwtsv7`b@$H
znX}~+kpD_dBWEO9RBJ9Q%|G^F1;qu9j8<g6(36>hY*={al+2D^;$GPhn3?)#wA&nZ
z{pzEL5(NNnH;J9;A}o%Da@iZLtbRR1DiFATl4HvWbk}fO(|J(cdd{^6)FS7~>Ls{C
z7rbk@U+T~Teb>DlSql{yQ2+mG^IE$*;MAjkB_@pqtwp-lXT}POte#Gwqr&DR?pyE)
z>ulW*pzMLDujXBE%jB$K8bTr@Pn!cdqjhH&N!cwTbZ48WnAy2QamT0$dJbFtW%-`)
zAR825H`slrLC_#_PCV9I6)(q5w6>2<7Es_ZWsJLS>7&v$a=t(CGvM*C%DeEnnk-Mu
zROx~4gHKthI)H{Ky$7GU@|#+E!^gm7gd`EwPCRT*v^`&4ZD3bJ;`aMIJ*uE}Zlh$e
zl>)aG81mRX%6&YDvE;QX!`M^Nx);SQz!-a75HkfSOP?I7Q$iN7S5ok_xDf^EXLw<X
z>K}^=mA%Z$gU~%hq3a~+qf5zg7yjZHMUjPpd9RzZeRIf}YF-B`zd@DjC((7>q>Hvv
zxndUb9e_IMzeO`y7yPk$b2V?}IqhvD@7qh*=HkBIsPr)DC3+wteIoDe{;F0XH7dud
z;8AnxaLdM;0THO(VY((Y11>Z)b*p;*VW<<U`<vDcOF^f37I??aU?$se$UAzxLhES~
zFt|qsHHtpL^L6MZQq$(xx1xh~&mcA&P!XUWZr3KBeq?13emu@9DM&a_yS-C0IPlZu
z$DY;-O2HJ46Ty$%hJDHY47$&^q{Xgt)Djk}NbihL|Gv34WLUjkIbU9XFILr3)117=
z9EeIRjTlF5yfwuc2HmVM&e@>o-mZ!8_(Xbw2_}}eyySXjo+@Pz5*#;z;^4NY#@(?T
zsLbcXccM4y9!#w4$U>w18xHlp)|qMO57q0@^wk^km9yQt5S440#XXRO13*N)!uJub
zgcr8BzJ97<X7ktD10I6d)4I|FQm2gc{i09N{}~IDdKaU==F}SXm{6hAH_y=Rqu1DJ
ztzSSH*cA;7h{xGDadYOe?tHxFOs+T2OussAGS)MZ5^08h83fvB)?)*KdytxB03tCx
zey3KFzG$lhUX2ENcHy79^C9=)wvhm^29WF3al;b%(;CRHf9B+BeBrrY&OBi~tYj#T
z8ThDA$K3-I7+S~2;(AV^ky^0RZPl1ynC1n{cT6sD1k;&31I7f{oewg9L~~1@F7q%E
zjM{)+m`mRSSh3G0ryijmVNXwIeFA(b6*tfuv~nu#3bnp4lRUk91$j#jRH58|Dmr(A
zo_U6*QR(ROTZ!R4W8(YbVs*4^QeZ_}fUxl3p0E>idFacf!AXvt(rdQAx?l2UK+AsH
z^Y$!`-><qgoDC>NJ)FH#2O+Sh{&XTUHofg6)L7*RD?!p5EJux0U~3+$K&KcTbE@p7
zvYs7QYvud(W9`qVrL_UA-17=kUwZ7;%-7%8?fLnOeX(ocmgisKUL9f3hSH>@g+lFu
zNRUhOzM4}ob781OtR!k;j<aa!!&Xn|Wms?Oxk5;#JIow026{5~C0>JqMhKkYTnGgd
zwBEqJ6Cp8{Do6DRiB0*zalE!3{gQGAqht14MRXto;?~o^tq}Fu;Q~+0vUx{r5Vh%U
zGyy4mSQRQ=mZRTiC3R?hq|Br`Ix<H5Ev8!I31%4ksej_6c7b?|-+nSDNXXDC3}W@}
zX?ZF^#e5J^^lFCU<NjD)pQAZB*}`)3LD+kSUW+*I=q)qK#Gedc!l+1epZ$-QsZbjP
z-`eXlN%RZeiK2KNariaTZu|A>FrMHFC*Vki*p0GaC*Oasd3MyD<2*i}TqxdCd;&iH
z9yo!YAbBefCitP`y4w>!Hj2lzP1cUr(GB{a)|j1ndM77Le;bEMzY93ymXWtEkn4Fu
z)YT2QUY*w_vmWaHN$y_8XF3yW5?WN#kcTy6&xIAC+bULx{W=DwSy`!l!m-)641xM&
z%8$7S4?GuM5}>wm*M>COTvGR7%rbG+1-PvsO>}7xe<6n@9`7{!@CJEqjHGlzQU|CQ
zZdsT48c6)N=Zf;J6`fH$(WqTxUFLqB#X#JAd&CWxd*^eyj{871dj@0qEd;2aZsue-
zgC0!@l&MRK=h_4H7Ktbe@}W~?%ywv$aUXQqm43m)INiY^P5y$(2td9A?YmvuBhkB%
z*r{GMKTiNz`^85X)|+_(bQib{RU$Y&yoZ^?93=72$e*uIbe5*CWoq^Ep!8ml;UEAU
zN%*r4XX;zZ48$&iQM*rf3HPG<=p&=KpJiJOhS-_pVgpU}3?LiRD|lDLI}?3rZvN#3
zKfz$*#S1TAth?W*^%;0;UHb{NIP`=*Y=L#hJ`6j;U$nO4>@J74#ZC3NfinQE0$!qP
zO(JrflSItjbK70*`Tavx>Nf=z2qSbUu&eiShi&D1f%vcAWionw==ek~?m=Dg;>)X1
zyA`0w45;Tp_cr}dMFOU%QK#0r^$E8F0_Zp`(b|PSwp-~Ib*Ilm)xndB!-SdyfsI!~
z8%a3m@!JUWGt;@1nklYZ9}!1!$mVJ(B9v(VpSj>9tD0wdsTt7<M1V}_2T>)SfXU+e
zeVse+0FwqKR-U7a^^TxyIymBmCXTPplVWk7x#J0Lt`_DI8sMF;23Rnj2odA`NuF$5
zq70RC&AWp#R>o3VX9%j}=2X|;N3vq}tLEy>vSooYaq!j4UX*)*Q-u&D#+t!r)M6de
zV26Zz2jxsPE?_m*_+@)vQCJr%cH!zCTeU@>(~79=C<htov7XF<Mcbww-I}N83%Eu(
z3j<|d_Y}S+XwL3?apQA;KM;Mo<{i8DSY9WBhhhpux2<mz<u2{lN?1Mq+^t`@Xv6xV
z@g}qV^L~*8DR*Sm(l;d=-F}h18ok$%d(j_X7;Bmo-;{H_G051oCGKKHUW-cu4N`gz
zRIrGAk#4QuQivi#*s|owF#G~9_(10*tLkI);*Gs>LhXr-iol&OL}bs>R63W790c*&
z60`=D9*_{bHSvm0fAQXVW@?tx0l>TX6NDAeuAq3@gVWD7J+Ni|^~BFx*T$2ZM5iix
z=Y+M<I1PbmZ}M*&`I7c9iu`x^QriQ`1h#EY+ge&3U+|X<IcE(z{&?XAu7I;2oUifs
z0VVxAwy0T6{X&<wy4^#_B<t&#Xy<_H0UhfsnO-Ea{#CDY3EkOdUt$064PUii{VI5j
z=@E+Q4u5DmUp0NZj*<GM&|RsX(djFO2L$&<t88vyuS&)aq?iZH(KW&!awccVREN$;
z#(g)scEE##n-JkPQ*f$NQn*B@_|c+W+`;Q-U~oUpS@hGu8Ot{1lBaQWjYwXN1w`<p
zj~3_(-J+13ClA_2b8|8svkYIIq<aiHbWBatP@a>Zt~6cLCaH2=_C#Gl$fa_%6xT^}
zQLh%j)ajQFKhjz$sXOnUecjp#jIivkK&c1OZQkwTk<t1SS__0#yfZ9H_UrmXlgwP?
z#z&WLHS^%J3jS|C1CCp@?42kVMd)4FeD9EZ+?T`Jb`Ce!3eq<n5*4lJ2LWf&ITP)k
zwq9A3OA?xrgR;eyS5c}R(9l#UnJGExtU1Z8_4OimvqRGZj6PQQo~2$*O>mO)x&t7A
zX6LM+A`wcdd+z1?hF9Y99LR~6CGTBX|IBw{lLJBB?&p~@XR<P>t<OxxGjWT^w%&mW
z$R$D~Dql)W)I>6`Z5TCF(3W06@49{C;zW6VU#pFpY_{KiKbyjt?D7ty6$Y-FOuFJ=
zI$Xz%ve`zH4d!t&dsj5oEHN;a+!i-~*)+49B6A%G;vi{S*S+67Kfkee`#dm?d1P=$
zGyCl~^`3kUt)gz;1RG2P^7VkcHKrB$)>>(9Zm7Vuj@WkGm}f?NOdr6&`SK`I*d*ct
z8eek-`~4d(=%7IrECWF|z`maK{S9Aw7)gD^H?j1b!|ksJXQWZsuJy{)FMY(o$Mpe3
znDqM0k6f6!p8`+h>(?jCQ4g}N(TS_GS(5jZ5ncz4(x|4sIWgu+VkB=^Yaw><0_mMs
z%XQ8SeVoXh!P)2#L>P7Nai^w63^yaP!UIT1g~@xDQP$o?uP<lITB{I(;zgI{@%-IF
zK!MN3tso<PgpW#YJR@64cAs<JUM!g}y>45*D<ZYja87-)f7FNQn4Qw{5V#RFH^aP5
zq-61rR`rgbuItyre1R-B88Z$0>ISK&X>R&{JpPbO|Gjxrudo}JH_sdfnNNu8#x$OG
z?hWWWMk`<x_95T?tLB-q<yHxGQ_5jUfwHNfan=2vKp$U4#tl@U$0c&7O9p$`MZqYP
z_$7Tr^%L2IPJ$PWBy*7my1tFC&<&hfe9Z|Tj-INRNp`Z9m*Yw7J5!+f*s&J-=hiyq
zNcyVq+)FQ1>i1yNxtH3gEL_q%89%S!yR=-l7t4&@3r3e0WHn~z^xYk00Vce0?m^FE
zV?-+Gi!7^y=|1?9JZp_uzwevJtue>sn0@69Ah9rEAUhpMn(JmT%5v^qo}mXFuxsm3
z!FhSA`qvt6I<LAl%6P4(8tde_2&xwyJM^nvBzeC^<@5dkNT+A44l3D}UUrCu7%Rp+
zD>@RMrJj3Q<*(_oT|Y<9l{~CQMOE|8)a4F7o{pwd+!EL84%Ii-HDO&vTtYsS2ma5J
zWozwBiTe{)vns#MQ~1bD_|S*|feX9iyWcm%rbyn)4GSX~hkZ5iQ4PNAGM={I>BjMJ
z_(zKLJynU>A6r1}c|%oZx5%xIF~y;+)BqGbP`bUr&-^yaK)=IqbTx7`PHMV8IM~^&
zdf>`qB}2@>t|ouc!!+J8TLj(x_My4x;%gJp5~jQQ7v6raU0aSMuq3q0BBYcX@G@<I
zA&0DgStGXJ%!VM<eP(0UT&OG?3Ou{w9kQ>Yg9kNtko8Bk1%9#!7_~?u!!X9;$ZWV;
z8bt8svKtxu3ggD7Oh3M$a^|e`G%?FjckjHZX<B|-R8UAW)3aA_>l|yhk<nPNXSU0f
z@%a3j_qmjk3CkY?>xJ`ImYCMuoO`M&kvWfz=D!Sv2@Cdan5a;#C0mmaZ(qqCsbONZ
z%4W(!+s0{+J)bbXqGJ%9G$HnQtlR%rMnTBUNS8+G`SZ@k1!wYdHfz_mCFV+BSbF7d
z;_)V0_6g-qUSMxa`hlBYP$LWoZm0`V{<K_n(i9)>6w-Zx%wMT`Ica;vce{E%*v2^~
zd*G}k$z`5oowMJ0hj6z?nuGm-dAip*nT7DY(s|oXu`M|z?(D}9eBUJQ2$3@<O8A(z
z!%I5U?6KhpQv%(BFKhOezZeJjjkc?Gb%2aW7~AVGpOaz3L)ojoxmHm1wqN+9_FZ4P
zft%9VHAdrKD3**pLwBlorI(!6c4xkL;_58c-H@LHE0MyiI_-sk_NnA^_fDGsS!V0E
zi%5uYgU^{US6X?)1t*1jV|E{+*E}&FvVYgJkVG~+&>AE-7$4f371~BHY2<A@y{#XV
zU?|ASrB_y7ZfYa+uzMKEc17QJ{PupcDu9%rpQL=Y{;8JLCRToKbI7^G=7HBslx6o^
zZ1F^X&Vnh4lrBYSs&%FA?VrIun#Vs8`qGi-Xe*q3@j2R%LbswVN%xG7JUWNn2vK3%
zTNv+?Gg#0SOehtxp3TkQanXp1NYjyZGvD5L{7d{1<W}JGf!>E<JT7hZ8EwURteakI
zs7inL%3sxUy{u)HLvu#R#m2e8l69#k>s7nTYgeN>TF>O?5sRL~<Yl+lF~MvrSEFZ>
zwfKjwUj5tY@wEk=UZNF;Wq2*J7Yzw)Ir3uySDqXX#as;!Iufk69}j(#81mn5w{3l<
zUrFRknvL#7!o5MLMimW3FR<t^VS;y^$#PXT!VEqS1zV*a-96{`sa<J9S6~)2#7*e*
z*6^OXb3wV%+ID+6I?SfT8zXJQdX8kJy&99rYGb~GU?Q>d=p7888!g$&AKiH=eZv#G
zRyEaNS-p*_OhHKBsQbWc+!<{jT)@3rAxK*5oN&MBMG|dq>Sdd<3DeeM=O?+fiPR3#
z_}Klm27Mi{AT5RT^Lrez0{TR$j+{vS2n;PRMn8i8vzhN`BI=*>b2BB6cB~l<b*qM=
zSBlT0208#dvUdLwJ*AH*E|YMzCig~sn2~+;4r^z1l>1~x1MOa(P+?`1wpgz@nqQCA
z{xS?Q&C)LpRFmQtT=3!1$2a!$FIpN@*{i+YTUkPu+eXwh=3{IO%g@-Nj-RYNI8hh|
zaFtGa)x78Y4=wtNcZ^w@<*1#U1>2?#$X}a1uq}4<2F)|A?k46|DC2J6oZc6dU5|#p
zjtSAI5cPm^%D_qj2`t8fv74PC^P<z#2`xjZnB^Sn){@wv2VRGYYB8q#1V!)h5jT3<
z7kjpCq(O+tr+{&i*h_L5UGpbr+&cx|i`t}hy?3*4gXO=5^s3*3%Tq?97fZ|#sPlzG
zTq|K0M|Shx7wE7gJXN1LdduWiI<%fU5711onV*1hH2|6Yw9>NSICGSPGX7Zchienf
z!j}r}6raZeE)uG?j}WiXMTk?NFB9Mw>^L>i&~B?IkZXS%$m!|+`DSfq5a=Z4rL)|d
z&g>4{BB)~}VL;Mi_Qh={tkIg-0)JUuss<K%4WKMd@t)J+*rAmeQ9UFAjvygy&O+T&
z=3)u`s4Sr|JHM73mN87xyNa{+KzS?6PnBr5vk2upyaq{mAm95bh^y4Mw$brUK(o3=
z+rA4qQo-WKv;Q(c-`9KP*}$$$=g`OL)0x6Dq9KHG`A3g~K3kc6nu2YSlu6E{TEIeS
zhZcfG;XVPhz4~&uxV{q?$$oJ*L+vR?WwWUuj>6ou?iQlQ+l)QCvR(5G2rP)XT}wr8
zZ#vcsrwZ^U(kQ@RxC5%t0idFBS?FAnBJQi|R@9Za0}1L=%VAJ=)0FFw)EgVkfrxw<
zxfQ2xk^J}zZF<;-*U8rhrdA_pH&-?Va-v5}nHPV6+BV{Y3`x}ZN#%y5pL=0|jgAs1
zCl~xPEIB^i^Rx0h+sgOM$*XbA)cxS6A}!u1%gu18d+q<q20uW2g|S5D>eOk<4~a`c
zB0=XDNE!h3d^UhN8$z6!YJNzO9;mf1{o06ciZ3D4!790uTCKhT^;?8N0Z1j2-TrWK
z*$;l*Il9b;KcE|EpMlG6FR7>XD<0vodLlR6d%5OnK!_*Bql3SrW-49upN6#fpc*zH
zS1FYj^Hgz(g2P00ZSOC_DM)8L9)iYTDfNsB$Kqs<rN%@uw*|@YGWKBY{qOL7bva){
z&h%yG+5I+hHUd@-z{yCq_==yW?o<xvzq()cvKO`+s$91K^)}FI_EWI(qnh2Y*&Dk9
z#gRf4fiAWh^l<_LoVTH^{ffiw(CI5w4)Eq6yp8)1n4xV>NwowxUD{{i!qE)m%;(`>
zn1{t0@dT|=1?gJ9C7<WyZ_cjh2|&(*@foUK1<#+-VfK@M^;$IOrvvv4T3okQpy&0F
z4-@~R07ms#;X6ZMM2n(Eq9Lsess3MO@LL5ak70Uvp=(7H)`NuvzHiR5`BZxLn-dmF
zOQ1`yOkzcZ$_X?^^80<z;F4T)Fk%G0PWA~ExV+r_t}#$<^L4w=S0*%KH&oZ6{&qg{
zv%_z0=U3J0LaOz>HskFe1^U{=7qelzcrAbty+be7%6sou8S=o)*PV2zGogPl%{gW;
z{q6WEiVL0L_!A@y&X`}4p@!c#(8u<A&<kUIlKq0h;UfBO09SS$rz<yOdgs6r)6@vf
zZAD=}(cG|;UUj+~Bg^^Fma+Ac<^tXT^Z}Hipmuv8jGyz?^f@TPDfjt+qR~0P{K;o6
zuTII}_&B!5B>GgV#t+p$&_D_-m&W|)O{fQt-~_{Kv<<xQ<<r~wN5v11d}uwo%c1%`
za0ig?4)7_U{ck1iNqc|<;_g_hKJpxf1~h<X6Y%U*i}dE4CM&-TX1)MNuO9w}4X=HI
zk&fCz$5;m(ufvymOlU|GAzClA*fyoccA#J+hB~!Rx^U<Yk4)$9b0@}(`J*_{(F|pr
z#g?~LaobC-${Y3GpHu#25=3}l1)u!1{*Ly(C!B{GNlnzhliOSk*gv#j4$va#BJ&w-
z(XKs>rJ~<E8vHs$fM$bAizpnVDF5_BTIK4~r+-UufqA~7a^oJE#`|AeqcChjv$^fU
zf!kyTgU0t3+SiCF*1fCbQ-MtqG^0h$n==eHOaqf7JfN~bYp(OUH?S|wS9HHYZBuu^
z8%HfP!a79my>#9XA43G?zS>Ys(C>LvS=b36u2EI{PHuWNV7AqHkEZ}nU-~C=Zx8@b
zL^<W>JtKt$OW)<*QeLyUQ}t5f1?1v3hR}7sm%vQJ&X>qlXb70rMZ-)0XeCI<DNgJ^
zE@U=Uq*ztC+ec+9Ls%p5u@cOqc`?QXTexyE81GMo>?TC3--3t%6`#o5Fy_z*9MXgN
z4d^sV?Q?I1PeM+cM@avJN<y89w+H8TV~htLbMq6a1~)X{5k7km6_5Ks8Z;J~KIJ={
zF7js%wU^GO!@*5_2&EOENO%ldYQT7k<jyo1gv}PNRpqc<g2UM8hg#S%+dzv?m5NYJ
z5p;JWetIQ<BK)0KZ!Y|crCA!O$sHq?O*(wLP^d;dnM4QM@IKtNVaC$&NTti164#+}
zOJpU|W8MU8D^u`|gKZsVWYAfwMiuE;X7K=xqL%m4Sb*c!%5UYhdPHH0M<c$UjR5s~
z*^4Gl<c3P1_dbJkM1e3SutE2v^HZ(f2MI+jd+T9jM#|!~K|N<v35wYWGFFnrVLH3s
zNh^mv3y2N%1;JuA2>BQY*FhP%9ij(=X-=NQCnjjwhm_CdP1<}qOEv@`CeDW#83hij
zdMRM+aH<hU_KUVaIO{Ok+zt(1($JYq9<XfMs1j*Ng>l?HGGck*%^puAn|V6lff%(6
zO_RuB=>%hJKzB#wbgQkyl=nl9ZLZ94A$&ywcQQh$<nGbYl>J{Mj7ER7<s)CFrjV%N
znaOYIo7`Kgd?BKMGtRL<74b2L@H=R};8?v|=~L5oGve6(Q}KHdCHNyxVu1u`PVX&f
zNa=Y+ZwVw-*o}H>NWfcrB$(!}bqbJDfWxpgzJC~C<PDTGu5M-|Fl-8(<{-MplIB)U
zT8Ksf7`f(%%%?yvY=pp1hBr{`{hs;&8W03I8$+Nc(e8S&Key6qoA*}gT-ElR@(QQv
zyOhL6$n)>@8wo8SXf~NwFYV_CCm52@U?|Tyza*nm&b@P1h`r4LQ=*<76IXzWBTyF(
z5TdoOaX_O~K%;3%XCCjSB?4#7^sXW5k35T)bSMNSjwBOERAKDBOoF_5HmKJS<@bEu
z-tmGC^$nX5Zy;&}Lc~-z^iAn&XP;jC>unUWea+-eCV#!7_TG;*Yy?WfmuUJbQo$bI
z^u_P79?`O)$JL@DO`uIz2GSn$wD(t05()Z3K2q~N6oi`0Z^TYkj2_1%T0<H^wpB{)
z5$`eC7;tpTA65(FbZTTkQ=NkkkZwatX;<@z$w`wxpS9?Jd2P?u%XvTK+-gjy_<M-2
z+vY8KTzGW2L_AQ-aM0)5c1I<w+>ugyTQbv(rf-$J3%MH*Y)UQ@c50b}&L<wy6(A7;
zz8ehKaU>x^>4ra5`$PA<H{I$kw6Y(~(G=ME!HMd#e>As#&%dnDU9knt%iw@OQw8s3
z{G`JIjr$7d^HGBayPagcApJK=jx*#Zh*xvMf7EerE!gh+XLciUJ$AV5tkqHq?t|<B
zHGL%4*EnqVmBEw69=&srnyCLtwexyP4y9UU?q?|uwC0igDVXkC^xSbPP~WwrWd*ZB
z_x61u(ifC7i>W0vLCd)lXhYSVs1M$8MtB4DH#BK#siO<(lmN<ZFyf~pi3ljVQpL?$
zgUT^BD8W8pWnND>_bmw6TC;3w;EbZ{-oOxWc%5INbK#LHcQ{LdBb36h?AarS@o;*A
zP3KgKx2B=TgXF56j*#-<*D;PGS$V(S`5gswCA6FxA8u=BD8(#XB|Wg<JcfMZqBE(p
zF4pz4en$<Q>ld^PlJlTZZa~mo0q97ftsI`bG_<TQzMYzY(xnZkC6~I+(0Odg;4NR#
z2pL!*9oOhx<^S&BoE=0k`~Zr>CQgPxl&>;PpLJUPm-&N*&rgMhFU^aI)$a}~*Qc$E
zbM$do(e5qd0USBpxr4<m_pJ_U;F928S@6bxhcz^CP<l@w_xHE{@#D#Y3!F4@1=bG&
zs=>G^C=Efko+#Cn6LC;m@4PxNtshV!BW{eh;eY&!MImTZPM;3w-iG?mAhNvR1juB%
zJ7A#1gZF@kZt36GLZKWQ94AhrcseWNOZ7em4M)425W6ckIQ%Ag<(c?E<l=NRyKdoM
z(E6WWCBtxmCSv`?hte-o&?`W1v34Ss3(ogHJwm*1bx4B_hG%jCzX|*i#M0dG(^oP$
zXWz^P<X#^<H&F1OzxsDmd^Z?fZp+Q2s~o`0aP%wMe6z-%T<`>Q!Z+mq{>uNki0qxR
z)q%_c6Bg7%djScU^^NoSsKCxAvZ}ubl5RI{INgfm?ZelF|I>`nK<(Pw5;p{d>ZukY
zJNsA!^u|V_UExclDzLxV^FMqR+9KcQ4B9;KqKE1eBMJBw6d|91!$ZX0aE|-@uWO($
zS5>N#<6pf`^n*zdU=^CJ(#U-{{tm19=O;L>Mbri`POPTuhAG~PRY3h{oDBZ3E%9v@
zxU}w{KZyUovNKdGK@E2>osTzo_ACI*WH|3DC7<>ZObliFzdqayHDs-a1P;7v<U2UW
z3JQc%m7WWmWMr$ctew9jLp@{I<085Ki#=~NqAh6pIL~&mKr<Kjc5+Y=sL^!xhKc?+
z`+=g1DX9T{gs~j^i{L#4G1vumaRT?XW;XEqXF7K~JsaHL>;B7p*Z(xC<L*Sb#tvN2
zCB&lJ{u-Wxq|sz@CPM#<32-s~Iv%kecJjeS(!tY5MxZa!=rj>{-Xe1pXEz=?tC((r
z*H{13!S)h_CUQiFUZc)a+@o(~2{9aY>47^*9I$xU|FH)E2ag9f*kDc>ZAct!Ap1FA
zM);B#*^1(s@BiZhc+*DoHC|X)h{qdIC9(7+_?`d76^@DI>&SU=z<-oz`HT$h12qLU
zMyQ2U7tG*e?yUDz`=BJarXP90X8nJ>&@d;_w7f~4$w_CIJ^dGy>go{A(?--nvjOq;
z`cLZznTWH+Fcr-eZ?jr@YzlrG;?M!|<HE=ONJwRDf7}jVzg2SaznGyB+ZxpLsUM}&
zIZ}M^8b*@jKQF=8nwf5s{_C8p|Fj|ScojWpQkpAnlJfM@0r)3KLbHH$_J24@Xm?6*
zl7>LfY2&3|3tI=fz&}VV%?Za1zriLy6W4z^Kl_B8RuIo){KG@|vN3A&!rfn%41b<F
zhzUOQkV6mqUmUti51NDKO4m_8=0TzZOH#h<OC7B6>e&{GY?aN4Z>gvw2cNtD<3{xM
zqfKcxk163)KmGhVwI3N>xO|o5$5sAsQ(_w?wb0%gQaXQe@aTRpGC9$EPcE8l$LDsy
zSofKi<5yY!i#IranaDP<AufvR(}M89`VAKozod(}8V~z5^H)FkPhY|IhLnXaBF=zk
zc)@Gm11T5@?mL06$=0-=UP=Q#{%|VdKYl|m={qpk#)RUc$KE&-;D=m<!K^a%YhY^i
z@qhZn-~A(QfO<!Qv_eEH@Ln|b7U74$21^3*j34ccGcRxd%Y@&3`10@3Fgm!w<}O$6
zLNWfuyNJ^(2Vi!hVT5mrqBxHK4Y~jMX;~O0Wne>r0dN08)xo>7og$w(3%4Y)Q~Qt=
zm3#ZYe%cNS0YhNqaKVM#1*wBCKsS+twqJt}<UVu%_0xdM>_k7I>HE=C%QSczAAh)g
z8EsityyD)GIhJ2}hG}U$7}oRe?|kS+d>9!{MTFI5W_(`XXOY+lWY|HSB^&&F>;Luh
z4ZvW_<mEbc)UrpU@bUK|tys)W0z37XYn)DwYaM<6&F0U;3vXTw;qt)m+=3DzDzM@1
zNgs2<|BvTAI5})2lshVNx0jS6{MYere^FtWjmBKn7o7GaN2mV+TwtV6Ez!|f+;0r4
z(C8iI5%+^f_c4TKiWt&Ih(0EKgW9j994^%V`^cs+0r29!`CjbHHW<#jhd^C8`0vVj
zjr|}JA4sg3oixD|&Hfh<i>9<X5z$s#6#jV~pD$LQH`2GazD)4F@9+5We|i9)Fv{Kz
z9CiLm_0Tu<3d8+hm)o1c_2VX)leon1|9)h_#5^XNO<8#Gg$mLGyV>9clFM;drvLM_
zgH~PaC3t;^Li`Yg;K6SL-His}c8J0U>SKQ#9Z6BCQHRrj|H=Hpyjd{Wk6O;e?H$F1
zievaE5FnV2-2Q`UYjS<Y0V|jIFG~kb|3Zc@7`*j?^{7CF86G@260TkFnUZvq{g5iu
zdnW0S1O0y`F9((d?59=1aq)Q%G*booPlnSjBk=MMVp+4lGoJp@3Rwh=lyEpOl4Yyx
z$QO5f{vpT7uOe5qu(s?lxbppKQts_?@&Eb?V5~AboK@Me{qPBVH582e19zyYV2;lJ
z)qMGf35dMuBEHD6^U?+L?@%5%u5dt=oruUM`~R^CvyB&C9paX73-Ux>cpg{*#Q(7Z
zih^nv;qGbo3H(zI!*v8`-Cqg})JB{+6OB*8|8e;MZ4ala;D9?s-eDUN#$%p)w7sfw
zOwge2eX%3n?l*9KDEh}L^X2*LLwyb@l;nyE3T(&UeN4PgOrrjF@y5O9@947K<k~4L
z3g~F~GBgNsqBV6MhkRhR4C$dDqsTC#QKD9;<<TCoyZ0RC592EN8C8~B6_%7OY_--r
z(-*V8<}p~T-8@riRz1J%DQ!97ik+W#Wx-!1;<I;WkuMjMm`K^JMWIanrY(Zd_4hu6
z6c^s0FH+28u-q9Cuf=7kI=Fpzh|_$u|Mz<z`uBf~u#`K|O1QRB<Fjoap^x+X6H0Ir
z!Bi1Eu&5+|S^Rw$|NbfH>tdh!hH1vU93f(uze7NBQcc!ZhfeInRuR|E&4E`FJ1RQ;
z97yuROKlD=`oiDCg8oFwoKscCl&d!LcJHBm2r=5j%bB{A1hI36_p1EokNa8+^6PDR
z4~cknk7)6{*?-?4!Y?^6um7jL>)>iC>)H^CNU@BF2qHSZRuG~{k!l%rW@u89&=W;P
zsZk6FNQunAC<-%!g^r3+5&}V_ms~}_f}r9Rqy`H}sEPrk<vT$jBqV-+VBY1L72dUO
z&N+KO``Pu}+|<oCWmzP@`FgW!M+WD2P$1rwCsr4h7e|>N2RmkO8|N=JjA6k-Ay3S>
zh0Ar~#(g5bXl&0bR{c0st+91_VLXONCN1^q2!3s9Tibs1uE)`M&M$lNd@^|keP+0j
z415EZb+A^>t&ApBqYlaZKSwrIICqFJ_0_O*&;)3gePn7eg#2@a96zyi?Ea=j22op4
zg16pT4=KT#YLm1vXZc{v_al#qsikLWisJ4?a~%@Lg%T|suJ9`>3R9BGS|09VJ^kb!
zVxHvr1B7w$sT9vwXAC!Q_gK};`Po*k$K`Q2JMpQTx`l7TmzJl_=s0&PwPfs@Ys{<o
zH%o|JFXIF*Pps6!?`P8Ap1<E=J0mXoS+RbL$&125BFkn`#G_jFpVTEHhsa(epQQeZ
zMeSBIn|>?XXyNG8dOwnt9{<>(_o7L2-7x1zptz4M-<V0fVIANy^iP-zYUX*S+~{@J
zn5O35;L*tdnb{vpTDW-|Gm!>##kD^TX0cT()f?ZE-34AoBfW<Q5%d3q6vRC#Yj<}g
z6VCa~s2FcatRuD2ssOlL)w=Ga_PLhK{Qw;A@iVKT&reW)B-{4w?$!_so>kRub*g2c
z1tD#{P<<lrBlA|rKZKOgUC+O{tZ_<W(+5yhrUlN0nF1r97bImE8KtZcWW_=v&)n$I
z@HMydNp#~`Y_1cl&6s)wk~;~(pgib7|CRZNYxRZm<sHYj&6x34Nqy?rRizS(fyUTI
z$F_@(&2RGg6BkiqwS1QB#5>pat%ipNkF&`Kn6k}HHV-5@$kYeAG%X$syt0r!W>sdR
zCNhxOU$Q6J?OevJz{3y$<Ss=aq|gICu=>s-P`Y#r+ThV$R^8y%OJ3jUhZ-VQO9|U*
z6dkWHPpCYsL!A(hM4402a)TN&>bBEtDJ=HJg5Cim`&_EcL<CFfdNV{Oi}Z~4LQ&ss
z|0Z-nt`Rkf*EE@Yn^VtYa`XNqe%v)U#h8*BvkkjJnK3^X3tY@_z&}4WA=SIY{qP2d
zF_x;~?$0UTrK5U|7(pIs%CUc{q*q`3Y&XTNq$!I(rl@O0s>#aaFcn0=?1q1p?A6&Z
z=^MUYXulBuhuGp$y+UljbY1?CyTr?CMnY!WkR~hxw=XnjpWf>ysyz+rlY^?RA_c&a
znjoG<HXONACp_`pAqk5eMB`!*6X2yo;zB<F!%2~F@*$Moq2b-(1>_k~ktJJ7{Ao%h
zf41dlP)ZW&i}T5S0-Q?E4*dBq4_M}?5)6ekPM)!$%T(xh=5aVNOh{Vz2f)CyIa23g
zop$LgjCBqW9pT)~EJga-Uh3>DK&ohihUq7lvva>3wct3oVR1uigF#t0R(a;k88)cl
zZ;oaEn0u(p#Ft>AVjZS}yZ$n29(*%Pw!6fp%$PxXK2kZ(F86$fqx15K9z39){WBN1
z<d-A6qgj21&*Nxb-<{)4=&@9$byRx)E>WDsJXp?J;0);!i@+;G8T7|S^@GE+Zc$0h
z2W8}-l<TZrpy!htw}n}n8Y_TviEkB0;~By|HUlFYX6*PT)GpVEEqe+GNJy|*bv}h|
zF)U#G0qoKl_Bf1d70XJWYKm-i=xdD4Oq@JM@xUqa*Bq27Esg1)yy!Yoj2WA}Iiv9{
z_}fq<LuyljNMY-;ko7-U{e&m|IK11i@_QTrxJ%0p5Ux2n#i#c~xwAI;qGg?1Tr7{M
zX8(*SBaWbNc%IE^r_J~`VX^*gRIhthpCjPY`#~_d02_1ik0~a0{9cB&l)>~fIg2~e
z-!WJPR@%%&U8}s@WKy1ty8uRtxl8PjEHgUX*Yx#w8umMH1F$7*L7J>|LbV=~fR+g)
zPw*a4jlm19G;@_1@3@CZQA0`#pLZraj%<Amj=mekC^FTY`-xT_s>szuI>e6j+m|&C
zjLcvx1mU}~(Q49~(DGw>=Rb$8z+LTmIs>z@*B)ZuHoOy4T#wM4Z{>2^Cx1oWSWg}Q
zz2|Bn9WIV6j$ZM_$FpG{t$mgvBoiFy_ZYfAmUyG3NX5!?z%?8CS+ph3Kpd>DHh33)
z?$eupw%YTJ)!n4_V;TZj4QVfuoxQ|!1VL-hp0R7mOf{s5a*zw5=Euj@@}M^{F2NC>
zr?O_BG$BLf45POh&0ozDFE+h3d(Ft6{RKT9sMj<>+u=~swNu*%1J=&j2nErFVO9J;
z%N_&H{f=w3UBuvA;3sKP0(GGqnsb_8M7Cz8{cb>eGWVn3bLjle2{<3|NOQGumK!{E
zO1(G0aCU9FwU`eYYpb;L$Am&q9Ias7w%T4kUOa1;NHU^?l!mG9ZKMQL*IM`Wrn=@e
zB+c5>3=_@#dBTIfA1(ta23pzeoYTzOI#$F$SX}|c2D6;UgH7-!bV{bhA@FUiTx%e9
z#(l}g5QqWRUOCRbO-d!U=GXj#qMt8(a2j+_FFPMfX)@>$3#^;db3z6n6jr*S=a20w
z`2_tOlVx48k}w;1?jioU1(=q8YVq^P)-=Fp>4~ksP==fM+ZLoRf6jx@zc2G^z&~>=
z`kPpo@v1=I{|{sS!30|Lo0pTb9#_^T9WhQ`^)@5dS%5i7Bavr-O?YQ#pygbzwMWbZ
z*}`Jzl{z&4ipRdaogMcqokE|*bABe68=JX1@P+=CdEW3?5p5=T3_(cQ((gT~eZB}}
zQ-l1YMxbH&SmJw_mOiZZfl<C{HY#F=yN8$?Vf@7nD^djqahEG0H*%<3X8icSv%sRh
z0IteBD^ebT6crdXA`v29<o>c3D&tP2vk&6q5CNO?&Kfz%+|XBeb~bI~ls$jdfM2xJ
z7|dZjee#hNuJXZuCZY;K7~9hm7$ed`@*&*tok#sPmLdh1C}s!iRZwlmm07P$LX42w
za_;E)Z1Stte&QD2+{qu2_!~rLcmz|i@-zoi7P9hcerFF5Le~qeDChqeun*&-xWdUk
zDUwKvP4~#AImU~Yl-@5Cl@(^ZzEyK|H!Dx@zO6;PGW&gA=@uHzDK}*s$Qy4l(m@0%
zIQf%ur)QH@4&^-@cs}=_n{1<Y(VAD@<c?RrM(D!bgk~QB8;8!xoG1C?^6phB6sphp
zmlPE|b<FFBA(Uziu|unXMOE+&=$Wl$NU~#r<8bpT_v+eT2F`8v_XubfKsX>T$QZWi
z{+^k$)0ok(h>EixKEg6#LMEdEbH17)Vn=>H&040Qh~vp+LF{<QTD$IBWa1O2=rTbk
zEtDy}r#m3q(=rz+PVcv$VNcrd<3(=~eNn4yVa{f4u*8m_-vEwB%y%9j3k&dJ5L7BZ
zdXnh}<L&L|;;lVIf}GCb$=@|w4xMuH=`CH-e1ShD%Y)%pdvZ8RrN^Ob*m;(qLJ*r*
z%B$V_TKz-i)HFi3Rup6dEBGy9bSiz;4JMcpJAV3oB&$vPy^`LFviFIf^7=di_=k(~
zo|y4W*Y>xn_;K4=Uj*tPQu>9(50-^2#`1p(7ed^sDDP=C{*aN7cOyFxHR}@&)7_<d
zGs|xmJ3j?R7+^XqNX75LtNj@*xsI=ghd5_WQ)kn9hOWB=^oP1YY0FBNl8fuQZ)62x
z=9a~!hz+BS^otr^;b|MK3Iy|<`we20H3p@k==frIU^Y|}7OQo@1v78E77o1f>1+H}
z)+BJ-ns{ddA@6;S@tdH1oYiy1`kf{tf0%jNyVDOduK<kL&BMsnm4#IQaXC;D_@p%O
zOSXqsGk>ClUOs_ck{$bEU+EU4S$wbCfYo&}AeOD8%MYcsNoEZ>=)@OVht~bI97$_z
z0o4;H<`dKY#@JrXx6k;;hU_1(|I9$a4_0S-2mH=~$28kv9a~TQaAk4n2@679^qWME
z`#g*b6AK&P5g0%?CZgw)>R+t~yEQit^Ec(e8}MB?a&^|}09Ve^D6z2hA<C3U1q8A~
z(5~5KvIf*rhrBnv*_<PLThjM12S^=3rki{<1@g1bHDWy3jg;tpue|U0oI?Umls>_r
z$^WQ+f|nF2Kw+&YnK@Oxv*jX?LwKWc@`%xBtKP;$*QWXgQv`nvgJP2x0LUHJkpzlc
zz;4dA)3)MijMg6#R{|2B>3=Y9WS85s^6y1*HWMJjL5!mvXhsN44A2|lFJcJ#BqOan
zWt81y6yEdJY0mZEgmk4G90O}=CqMc2I~IF<Q*S+?*j&Z$OVW1YOUIZ`grEn6ES2#c
z98K-sPR;c{Mkx6~T?E=9GZ931nUHlPz?O4j7h4>LX&N1%*Ltce=&IgGTHF|uu%d(C
z;?k-#qEVJwmQTXR;(N**;*NQbC?Rjg9Fi86M+j2&!6S47_@j5JXW!j9hbZZO8)Ohg
z@D9C^l*S_Mva*T#=KLHF&d+soB4qqFkp|3C5?U)KwKsXrBTLr!5k=rSRJF_xR=)lU
zsy07AI&hEWU5*?0IJdgJ1qgdSh6!CiQ$1x}UtaF{QvyGqK|C#AnBjk4gH>>JYwN&V
zqAQmM{Rz97jwlE`@%1Vw5pF=2ta8a{Qke@(WgAI|F7r)$S+8p+U-h=c)7Msu7WBF6
z@xy86aop%2tC^f=pBK_Q!Z8n3C*nAI0QrO5#l{9yt_LW?+uMH1!_1a&K&}6pn2+@c
zxy`F9=!kEBL)<V^(~8bl)0Zot9EP9aMEld@-ZbM`>b03bU{K0GN}6osLB+1iY|0n+
z`9^w~2nU}ORb<O5#u2!>uSLD4wrp|#X%jrS>&`Dzh3v$`ma?#hyT@5{w3_U=BL}R{
ztZ;Yz&k<67gmMSPa|Z}hUsTNlHgg_qw!jts1YuAGO-0E)iQ{>jf&!oaPlvD5dygE9
zW0dyUtQ*#w4LF6xu4hC2j2`m-A64MIkJIbO0qX7d?)%=E4Gy+Y6UD+*gwMMX(h|pu
znu@d^7(_1iY<}x=f+tgD|7r6KVx_B*ecZd=QQPM-iY?Rx;BCz*)0qLsBDg=*yoLfu
z<7!=&_kHJa5(QDQ4APJmt~pyBMEMPi)ex@b=X#)X(&umb-_&5G<*D}j&AMsgM>T5j
zm*Jq>x+fkstmF3_`~O3tM3l3#zIL$As6PzwofSBAUusRd(_y6oZzDJ{z^dha?7Mu5
zhZ~>ph6sy$rmyX<V4YGA=j7+OHEhSzwHkpG!b$wW&n$(-^IIWPxPs*P-X>^Rjiad(
z7IYl*r~N|B<=!;^R}Jl^!Td}MiCim^Oe#MoCj}+VR)|6W?z~tnIcU1zX4S^mE|AoZ
z;+`36-`B7{Z!Zm~o;$CqR13vFZ+*!2_9E>{gQTsV%}x1yRqR2}XQ%{@8a=z~RX3;N
z%LUV9GAfu%K>6hjgGKU*^nLPHZyxg!h~DJ(0&iM(;y4^#KIJ(U&rew3ZjO$%L3xu#
zj~JFy5dhuYjj%G1u_!l|I0<q>9#N0v<=sj9(}!cpep{(2#fAQ%iQ~C#|L<Y(OeMI@
z&$gGTI}0noC52?DjAW$!1OC!UA#Q+|7WT3npFNwJD}fxwwMj~25QUjzEA&QOT8gj+
z-8}=TG`{s*`6$qN@EsovZo6JsHdk|E_Z%H8%itdro#-0U(k@fM!FgVkN)TYoMSru4
zC$A5wYs>+5oCNGxfRdj<9gIcfvZ4I+9wvvjx8PF|Bk65FvZfanE>p>;etSE@!E<LB
zv=Y|qZPA1HcNvMx73B>lg7Y<4U4grsdpH{gg{BT4p&O_Hh0nE<b~nbpXx<3n`xW5F
zEF6YeCgjKEbH$=9RJ>R}rmTKh$W|{tMhh?|{|~XFh8678hb>&`sBSasAwcK8Ue+cf
ztXUY)txjs3X?AlhKSOfXMkah?ZGg+`Gvmju&z3Sk04L>$D^!A-5AEvE8xCDF&`vbu
zL(-7E3|mJu4c03E?adJ!d$2h~RN9;+I;gc@NR3&=pR<flvc0M;+(yW}F}8dT*MQ@1
zLk6S*)sEUp`Lx(F7pn<=8<(E&5~(=OO75&+-L<J0-o$}*?LFutj0NSJkIw}xjH5rk
z_-txG?-{|;Xs(J1tk6<c-g6QDG&9_o>h1OL?NvQKM+U_kO}q=!08YAVQ^cINtZd^i
z!~l#JaLP~l+P<*3+zSZ*mKAKddnkBC#G|Q<IcY;*WaYC&@xL*P#afEAVS}~|&*rv#
z7e1azzIGzmGB3dIx?9<bc@oP{g$}^Mz>ozl4MBZyL2)nZjp~x|?Xzqdf_R2uyW>h&
zWfiWg?QB7}Ctr|Nx#4t%Sf33iu;m9_2Y#Ky7_LVu!M?0m*K-+k2mAmOhp#xFYGR4;
zq-wNYLC~q!UNcQ>_Vc*iQV#fczk|j`mEHl53;a(Tqb*WkjkW4?sy%Ky@cZ1dpwbR1
zIR3Z5I}Qhvau*Ny>3#a@ulfgP(Ya6cI|eft5#(!q_CGP>Ii@UY(~qd=6AGH99|7&l
znio(tN!|A?>!Z`<;eHOfQmyFFvFfojlCwt31MLF_iCbM03H&?^*u1uNa#sbbTU9(j
zZcbUm)3S|NgF3cB?_bAPWF{{m0vuYMBiiH039z>yTM^@+-W{G+7;5BIU*#0F_#9td
zr8?6^;LwC`My&^Mb+aQHAT7#bhaezIMt=0*@5qTBy9WCi<?rqMnV$1R6=O<lg;$W9
z3r;U;mt~$!O((qJ*TllLNtfmo-)q_t|IxgTG#7Q<ghnNMGs?@0L3`mh0Swmovq(0%
ze@FR8^uT=jdb`RdV=bz+@POXPkk+YQW=s%2gTUc*#Un8^Y^(S1vm__toJoZs-fyRp
z$G$M$gB;S2Z{z_%;?f`sWK~_%U^xy4m%2S~E1G*AN?@Dh;5Rs28*sq|f87<Yb$j?F
zM98S=AlXJKAv(`YeLn}J!eXS7FrhY3rnoA=HZm)qmkgJ{QLn(+=>Y&U;x|=L4RUZQ
zBPfA`>v;5P#$FI~a1fm*TPVfU-8IXeXC3U$AwHS${09eD0R3Sj%f2$Vy)Ria16R{3
zgC^t}En0K^QJO6k&tBgb=ZjAyQob;6?7C~+gqoNCaSoS&v<6Kq!DNGcNa*1*3BG)=
z*>Hjt4)^EDtq3%oFRD%&<OdItJCdAIOZitRa0%juc7aDU9SmM`30bZXB0h0rE#5CA
zzD}ArXZiDXe)$!&h#ZdATXpVAy)nl{0Z~Uw_EO5ziYxZEZCU!oWH`$E9(a3A>w++b
zt^^<7Oj$9OGKUTzEY;tLM<nQq<Ys}%Hm+M{;uOK?#w7M%*wJg=riq%8nbuglz*UB3
z0kg9JuY}uPDbr&IwLAE9ST5ItdemLm&n<K57^hgl-h?f&!wK79-5@Y{ge+I<peGL!
zMmE~lfA!(enCxNtE|7y_tb@CSyfT&ynlPihNqkR_LxRSP4}rd`=fb=)3y2Vm9dLz<
z8si0@|JHPoC9kRAky~tA+<f6B+=B2MLjtVT<4qPV9TC^qp2fe)9C4hU%IG0Ey4Xm4
z^_Zhj037+>h(jbSB`n~N-4OqI8Db?8^jK8Lts88sziQ1Rw8J=%2?m53ynj^oa1DKX
zm2gtuF+DzADd6Tk2rSpar)lByx4va?HOK<nZI#Y!6vFJ|TV=s{%9O(4tmK^hZYeJF
zI7m!{Q%L4IP<*q9e)Qz~#NGlv73wMv(D`eI57bUzosZYwn6ES3bI|m3BSo=$Q+#s;
z$U$BQU6x)v9;f18K35r^4t;^lLHw#je_kn^)ID|De583Qe?go0y%w_N-cT&O+r_4C
zh)d#!=~vk`3(6EEFlIk-lwQlwBL${8R1V3^*VbXWs$`4DPKm*1Fg|KWeJB4qHBw1L
znOuI`Zg)hUzR^4v0&t#?13h>$SvloFcm!7GKZ6F+&_$$hOi69wnXX0ig|>$%1A1H<
z!;cs~i_SF%g}7V_(zW`^kIjcp(xXTbTGXJf<ayZwfVv9`SJ=|np8bQSt-UL*P^`<1
zWL)c7S-W&TsfHlpw@`D7i~W;DO1B$8@ztliv!B@VX?a0sLBDtkaPOu1d29jD9^+5!
z*m<nt<Ks1=uKd+rC9@_g2`y7V|2kI~n-;-|=`w7eYoUH@sJ_g+Mj{8eI(j0>>1*x#
z;@(OoZ$@*{Ebz%}8{UkW$@oiPhc2@jgesbb6Go@*zEtM2F*QJ~Np`LMLSC(l&ZTzL
zc`7)mmn~QyXA5R->L-R6hTb{%x(;v)9klrz1CKM83!KHUsRy+&Uy?Cd$t^SI8y7Kd
zL28SkNp)FmokCvEMM{syT8<bdoaWQcO(-LF$i=a4D|lvfa~gd><&vr<!~j$_IqX^N
zZu!@ILUA0f7gQk1DNVUZmGe&NTpR%gJxfrmVqI6z;}_-Q2%*1Z9IyuW6g+S7F6s`3
z66#6&HyA>S<7Z1o2BeoRi1OrfiQ1SOm<o!<To-rRl@k9{r;`28vOBraQ}g`aoKM`a
z1KFZ5<V%iN6-200<OT|QWuvV@p?}@4O9rd-;r=o`a_E8rMwKUh@R&?*H93_0=J5ol
z`NhVJ4GD3>nuXOg*%LLn=fya`h{eVb^sdb_ht*(Gl6DG^Fh|`9x1l1~o873C-aEJ5
zc}GzFhe*pPr`qkVERIp<wk=~@TueyN8AA0>O7z%9Z285&=GR&aW(9~$g>zN}U|Nzq
zrX}x4?7)38CiQ?B^{;$)eORQLgw3c`Y-J>Ab1JxOgn;+cIV|yrxjYpiW&qg_h!!S$
z=kv)psprK#vxCxgUEsJIoY98q)2FE6_cH%=jfwF=X7clZP^seRIcB44A$*tH3EhN9
zU?O9H685Cq&j=bCbKkH4COGi^q&AB{be=OjcAaNk$pmYhIkS*qB}m{PZR=oMqhTCD
zdL51aIyZayomX{CiAT<i3B%2uy+U=?taE8&d|Tm5P)2r%-f@KO?Ur1$B5RWZAw@x+
zO@@)See3M`&7~1-R~KfCb-Ioy^w^Yhs<>>iZ=u#A7Lk<WO)$z@pmfEr!Hg3ZZ*z2X
z>~rYyzpl)w#7sk;z4?1%JK#eu_z-P!#+kaF%i?^5moFYhwk%ICPFKi6^BCzC>H)E^
z#XWV|ZJ-l)XMqm|xP`P7<+Bcci-vdG-_QTpzybR7C(u>90Kz#W(L>US@7XErIeDP<
zZ40!nwW<*_nae-}PF%NuO#w;egAxPtNjSO!-oi}|!eXh`xELtt>#=3Hn8$65tzI;9
zD?Z0|0LL~hzf+9=-OWDf;54ty{Rf94D#0$OU~4693EVQiau)%Vm}IGBlQ;ZfUJr5_
z>l$0|1q>`YTpJ(a5*O@HKapS1x3EC7S#k8mhY$ZA0w>tSdxFk8P!i)JjLZrAvNyq~
zhYy=0sZ9`G^NF_gNL+N@cJ6Ep)ErPC{@PFS1xYa9$sW+k^hE>KrYU&t;8i)YS}ZKI
z0Gkz=_->sS^HBj!Pl}IEkPj!Cqgf|+3Q>I{8}dtcaRotph$yio)^(Ylpia}2yntQh
z<$){umlbT$>IEzO%WJTzzY<%c1Bwi8`_n=vUMhdki*R1!a=LLr;|BC>BCXXk)Cf;l
zVz%(m&iPK6T@oy$jy-pc`RdfO?nT4dBMXmky&ifV9lam8wcxnC4GRpHitr^T*|(nJ
z@7Iu$A_FADYFn06{-v&u^NJV1Y<pCxY5vxPvd{^OH6Qf6op;x@P#rxm+z<qJ0Cemo
zeF)0RQ`z2dP1IbEa2i2U4)og$P0z(R325EI^inmEXiwT)@_~iOZt?4$eqi=Lkho+^
znSZ%GLbY}8RBWx#V4%xIUN=K66`vv%Kec5k+H4&%=Z+sYZb7#EL|3*}-qGi^Y@y8L
zL6@&$BMbZSUzRb|u4_BDx!WJ6zhV$P7gMQ=zSXwav}tI&+c#h5RzKZDJj{417(>8G
zz4>cGk_R>$x3ZUSxAu)0)|TKC|Ec~#^u;VqM_)e{__UeZt;;q(L{w}SUW*ERymxBf
znh(j{(n9UN*B40d*(qG%2bKyc0Hc?W_jsJmOV|&AchAm<TrG;^w}F~#L`Cvu)c6g&
z=~H{2M;lWSUDoF0u<^&c?f39uJ6t}f-*{zZoqfa7qJ(|Ro7LHLd;tBss?iZ(KAC?6
z3e`xj$qFhfZVYD`mn(Gjal^%G3v!J^d8R_Yx=Rz5-^%`=;{{%-tM{koI&<#WZwvBY
z#P}u*V)PATg#Z`X?8%mx8`=2az2OfY+*p@1DT00{5SZ6pbtE+VviW#+DpR~aJt(Vq
z{Axpxe&YO42$Z2Eq#SG}j}jj9Pjzs{GNsvLmt5;48WQI27tCm#xO%1hl6}fnY;9j(
z`$5m`Xir_-3u_*tCmsNk6Jy6+ChJb#eOAx2^$8DRhpUi!c39}^13EFo3LcxeO%wo^
zUD-q%+4L2(@i^w2P^Q$H%p}KFFv-L(?xlKyrnEK&gDE*t2EG5r#ZAD=fOZuA@39e5
zfmxVvSZIS^{GAbh_Z175-wbHFE;DR}iawW_f^Ud<hUhX|;*g9{5)c`Hlpz32o#}Of
zfH8sxsfX!z!1#oEb{64pTIb#={X`FXp3XS$O*mrrY8}h6+r=PHJ+-}(E9qeeIWawm
zioLzpHZO6FQs8SW8?*;MGd{!RMNTh2zvJCMh)p_f4kx3uBPZ6izm=`mi{Ix);i*S;
zJ^@+J2+7zyH|U)`m$d+s0ZB_okPpVxQ);k^QMgyg<vcIXLC~+#Ee-~0y1qxyr%MlW
zQw_MkWDCZHt}@>Iv*trx{abOTh+HghoDq{m>=6BnmR_FTlvhhwVZ<piPe*4rp@%C$
z5s~$1FO@88;??os=cqUHLiy?am{fzC8k@<XQU$K>#kk{n5Z)2lrD}uCtnoh?OE4n%
zw}%!$zy={wadF8&Ru*V*t>+BT&PW4ELIjWwp$8l<gr0Y?FzHg2Tu`BpIV4hH%c7wj
zon$r}p5rELP%Ljktg@zAEA5b=UtXAh*&s!fN#*$pW@iU^$QG0oS1fuGMapudhEDkD
z_dsrEw4`~{zh*D`NoF$HIFae)F*ndLYrlC?3D`0S7E0(lvW&OgPTZ}9cVrUaw!9nK
z=ee^l_T&BAkZbgfa>gF7QU0VCeRRC;&I=o7Zpjh-G>{2QFobWA$P8}S8OfSo4P}RU
z^cs*gtB~8zXaeNOi}J<?xFyo(-Ot>6=!+V!EzRuM%nRScI56n2m)U?(P7D>9^waBs
zdQNZRBLJLE56hQ4j;UBIHE%d?MtjsJh>E++DR0d+XYE^FEcCXiN9bXUc=BYtL&IPl
zFNLsUyfXMbiME4pW|039!Xq9UlL9jB;s-Ij*k?OSJyHZ|75Y&A=RLs+F3Zm?aUt^>
z5HeUiEO#myt<?CCDNW<5yHCr*%nDbi07bKlboi=8yxNy`ClWh;3B{l=C_VGsO&tp?
zcnei#x^m%Ur_^>qB+$jNrrmZ`{zZ?6+?gd(Mx<h~cvSYVN5$Bm*y&5&->q-jZ-R;y
zn6puU8cebz2KVk4svYIjduBcnbCGN;ykq>EYZE>=b0u(|At3(*Ho$rb3#oohsN7e#
ztM=#5YiiNlSJl8Z<Z)6qY1rh*^M_XRo}J+Vamn7SwH9U1!Xa^CUJ}89_qzL{jjR%B
zM8YE0FKqB}<%lN^gXs}xxX*3PC%vJghIOS>NB31cXztsEFZHjxm^<bB97lO*#pB3;
zBi#h*>`T+9G8LA5DezwYVBpOS?yxI__)QaU52hmn(0W=qZ|L&|+Gb7zNlQsDVy;5h
zWq7jhyz%BdM2pq(W)kPDm>Z+>!00xS51K{61(&6XYX)iMx+ij6tRoC+q1bi}yt`s^
z*!<1p*MlJ%E3$|&HLHUsfCP2{DS-Rz?N)(&?*@UnI^-ye!8mhc92ATnaTSc&GPSvf
zP=VVsoX|@7jk#AN44VDKFShqdZ{(6DE=cA)b*$KR;9tt|b9%gPWeXl$qy?I8a|Vu`
z8;BqtmGYp!_;8tp&0q&{tI_+<+w-WCxKSP7_8};wj^bI+nEOJY4A}SSTVZFCqj7mq
z2TwG|mV&O7bcE>Aj5ZsY5y_UUKNr(5_FRVmWRYJ5<TykM(CG<IBr6A*@b2WFm5tay
zH+GF|;iZF`yTlZ@hop{w!+MPND0Sq;q?QfH+i#FI$OUws$*F$3)80G(a-{D3nQ7=Y
zcn^X9zC5qc>hY;q?ywFR=H>ek-abS<v&~LsMAqT{f#ul^T0D~=HgfD7^j7h?J8rUV
z`3t_m-Gb;%8ptx_n}Atqg0L=kg~(V*!6%*eY|g;+oM{!iFkiVAHqh@S?Cl6_yw2m6
zhg|8w=yoS1>L#9Om~GGQhXAogliXV6pk;sTUB)eUqQ?&W=%bHQ>Wz^i0W{7W*PKb~
z6oE@m_ZTkZ`0c~)&yLoWCI!AD?AEw6-vs0v4MBKllwE$aiSUJ3Xv7;AfL$~@;_epv
zpHY6u>dXhD1JW0G$l3iVBm?`R78Q)++6H)?8`z8)28RWMP~)v~I4gj{+i%NrPu_>Q
zlCe%0!WXetfqW`#ZvbazeGW&sPO<*t?NA*`dv{O8x&^k71}-%Av-;qM!WLFd!>&>x
zUJ$XbbFixrn3C<#sa5`+%$gP1&ulHYQ~?bujwVN|d@?90rYeXtc<Ug5Dv3pE)Pk{2
zMwzD+ZW&~2#Pzt4NU$3{lA-O;ADq>oQL4jl3mvLq0caL!>`vucsUV)GH%#M*@eCY9
zRz+goeUe!ZBL${E$66RH%91N*bE-G)Dq#H-r{Kob9UlVM*9eoxwoC<(z2!Q$v`KLW
zZ|BhX#sW+{e`0Kh@xv9R+iT7l@V;6ELa#3LJA*34ruSoHLO(BLS1__8r;|PQV1>(G
zclhC@cISU0xe$fJt(9Jr5mewG^K4T6V_cXvXC`y@ETGF^;b>tHyi*z<K^87lKyZ6(
z=z^lW+6XI)aT-q2j0_F@Z4L-?*tQu%R2*NX>@a!5Rmb?~+S)gR3hs+|>;v3x+s~|V
zEqs^AQ^#eyYvdTnJG|1{&@wKj3D5UMB*PIrr;r1$k_gHeOK_FPkIad0p2q|?BE-PO
zuIY(j9v_7>laa<y1562~c|CWW?Pgyj!F3E!k8LF>Q^In$o;WQR-t{_>XZbv$b2Pc3
zEZ5&b)8R=icW>(Zc0f<n$NC0JJyu#|jn=~AAnu@em_6)>o&1$B;;Q4s<adU~J;aX8
zOX`_ZR9)Sa$|M*JMwDm}x#9-)2zZWv5YrZZDjs=ia{dI=tS~@ty_Z~G?r*M{5O^fV
zlqc;c_U#0-TkjY{frGTF<;9#UVH}5NZw;o=!%0!>jyg|;ky<GprcyV#m-&}#mz+}d
zm?q~b&Zo4kNC%(K<*>T7w%6yQbv}s(??!YrE^<jU1}jo=t+UN`^1UnTROF#RkOuth
z#*~?z1(-d{oQ`nulF}~D`i1^}gm944P4TiG1ht!lJqx~Bd@?@Lanf#qy#v0;-2$dz
zUOm~U(0*9vhTB>672eqnmz{$b8RMi-m(vs7hZcm@0PLWC?8O{q^uaqqg~Zo$=|x!l
z4HECh492W7>9&FE7es<=_i-Eg23u_!@hr_(=zo7MHP`Swb_17@;J(SU*p}V)-=o=L
z$sc1x$u;RyzcG(2D1H-PD(E<rO+BK#_fdbbgK~qrdHj7l)PqFt%`UzZuRpX!YTFGe
z_FYKMExOKfS8Hz6;*4+Ec;E^(TjI&tSz-27e*6vs=02`5E;0Uuw~Gr)Be*qT?1n2`
z*@8v2qx<atb+(&7^TE;O6+}hgT4jf_`^Bvn+Fz-SQVfTx+Y@Ex4M{>@z$ED?YY+1)
z<AQ6oLiHcK4UlQ>qW%HysRn0{CAt<W->KZg-P|QsY7TZVY+>+%SK1$k2HUusqu-ye
zMO3VVHjr6PAkXD3=i6)%QO-{Ces|rgb`;x1r1CaV*am#P42<GOkhRf=wvTRq4a9k0
zZbWrExJ$qZX&Tc(VK6zX)_yn?HDEp`gE{IvjC&7;DX@-ZerLWtc3vn@Fv;J^FiOyQ
zAAJ0Mc+k|{1@RCF3S%UtLxtLr-`e$L5H;}8_Jegxz6>PT&X?y=#lpK|OvYZgc85}e
zKW}4V+IH<RAm1=2(=sFVhN_X=ZXJx)7hq@>j(wplirx!m`~v&jL(ExKc+>xPCPrL1
zwYafMl~QSF{A@UPl4B)WuD~N7hxe0}oQ>8or}!CIei}5zSPX<9tkc8g0P-uL!3Qj3
zQe6f*zl&Py#mAL`)V*G6jm~Me5I4u=ID5HCE&uC(2X{$p%rh~$dI+DvY9~#3=JnJs
zrA=@RV9lP1*r$$k2s=}#35}ozGyyK4)wucL0sf76n8p;=!ts45tIy~!rZk87IG=h{
z@D|Mb3<GiDTK@-itL-BE!mjt7DB%p*xU;Y1JOk4jdJVpfAJb+R=K@HKCvg&9L89$q
zZ{jU>{w4-jgL3&K?cUh9;b?OI1Ck3*i*MS!G@c_KSw`0*`(mn9#{#Qvx1Xq${o<8)
zYCbUDtuD;-Kh0dHJmEF5r=B)%K6MVFF&@MrGigNW^L60uAEEOnHZQ+`p2OLwrOXE`
z_oZeACH%noW@V#&Ac2_%|Fc|eZ1;Y*&$Tb^J$L75h4`F(scA10ay{O&gfg*-4|NNR
zb*6#7*A7^boFXoqAUtpX;9m9#`U<$tdR0x`kr>Qvb}%s;*UWx`hUFRqk1nG#;aeN+
z2b*hb_f1i9YdFA^x6ubtca*h}V{7$lR&xNdyMRyNEm`9QUSPAI)DF5=67*j6d9aeV
zStnAlh@}kbzK%|PG41=+vw5?wX}uD=SIUbEXJt)U5rz=kM|bN1Vbt;nLjepgk;kfG
zVz-i(AAe!Ufg*8LjmV~vXA|ETRzM(=mGiCD`xvOMy<x;}x-s5fU=wcVMByWo5JavD
zQX1i)Q{>xej#f@`u=Fmx-+7|$)#m}t`R}PCUXcfWC1*@rd7`d=-AfIAf>8}(!|WB~
z5NQMyd_}p+cHmWhg_JQ0xNU`R-pMDIV1umjHfXJwXS7)=#lE}Uez11g7cXw|dZ$pB
zGj@&P3NZTeWdfFaaAHQ?&{i;IyB1ZJub@_W>IjM}>H)7l>&SOjPIP$3N@LgD;KvKf
z<})$e@1XFcPI7W;J-Q59$2GR%4na993KYl78T6}>$Mvu9m8m3{;y_B^k2Af<ilmO3
z#OFzq@7vwL>zHRv7ditjPpb@fGMdRl37>;6rEJG?&l}C~0PY~T!g;o>V5|$qVk%<w
z<vh4XLW$8bE$Ff@kKji>b)On5c^eqBBC(Ziw4Y32M3FmclA>2lOxVt^<W{)=yP;*T
zwd~W6aF*hkHk-2{Z%dp_<M<aaW7J`yELAptYz<sns_1)QczE&{A^66(<mi-Lyxr#S
z3_>)Ov&qOxXlWj5w+0dRpL?We^S=hX-YSe7Qg-S~2Wth{Tgy+iBbgt_fSXGIlevy)
zgED^%;q|(Zz4K?_zy-(W(Z&-rlD`81Zx;1isVZL@k!@rbae@y|IuRb<9(biXrW@h4
zyY5{srwa>i0e3K*8ZbuojwqP|;UVrYeF_sWBD|s7vF-GP8&#?Kst{5Ba>lL2`&Nib
zz>Aff<GQQ9N?g9X%r!(lTok`-UFIHy<aYT#PTndw{EPR#Uvl>g)tlxBTe&++dv@*j
zW4$c-BwE}0t+b#(Z)kP*S>F=9T#e*!eKjQmLlenH!U$1`W$X6feiN&*4v9x+Q_S)V
zLJkT&U$=9e$lO20pGBN&Sf}A=G8yx}u<cKwnWsYLe_(A!n#uRu8&Jml^WI);mpT1z
zgk`_D^F4a;(-7&$-~T~JPtY+|A_FC4J#@*qW7z!Xr}x4B#^#?29hg)`iq(Ed=fS5B
zJ49ChEzJ4XNLVfJJY`ObBn{^_1>4hVNA>ybX4U_Y!%NG4W8P!PHjAA6<AwCkoa5}I
zrmog07&8HLIg*mBRbN#iqL#1Q!*v+;W~dtw0hsXG@ykgAj|SqBM)R6H8z}kCbxz{P
z_Dui7VUE$iGGZ9!SH89XgLQNW=W`rl-%9!M%WWC{_L^oU{g+nUF5m3SIn3Y01J9t7
z_Y7|NqnU@$<6Z;Vo695leG9y-(1rjr{$eQBx2Ga>7Sm2{?l4#zdwo_gHWAVjB=9zw
z0@o;5=diEhoG|BqDBOYwwlOFj+e1jr5K8@dMkh0xL2FR`bb|~}+kIsD!a?Y9>{aXm
zha3F%lDLs-PiO_Vm<!0Kk9u!Mn|@oHaQwSOrvIz8Pdvyr@Q&`C;@(=_Exsl5w=gGW
z8xNuZIRK-aRb^9u1;6i2;8*=8b1(^!&h!yKXw^GHT7?SM*L>!5K5uDh>so$#7Jc(O
z{V0s;{G1BJa;v;)^Xt|mleuroY>-Yc@cM^vm>J+k80;GdNME4lJvfS}8phzhe=t+Z
zO4#JUe6ZP2r7y!%o6+i7p1U+3L~g(5z&4fzUqO9=c>l|%Jn{ze3ewQ3-bVxA*PA<o
zY}aq)U=F+$Hl>KLt7xtMl`-0*eacS)@O<UccnRu<g#q+IIB#w$OnW1Z+jw)<e1L!;
z@yAeVQ7rQ>h63C;_LRRVik=`EW1_MRF^MI@W@C1H3%t=UPJi4syBn&L1~Lv6j4sP6
zHq8s);P;&Zcu&<>3>m_XBn*0UtRznC=80t-*fv(K2Jfo1W<FxX!Hus3Z9?r1w34*H
z%K%l~M(QDG#*BX~`ezoee-kU8LY>_@Uz_0wvf|b;?BkSkSTo)&utiOzNL)sto%7&&
zvbuHGDe)K5>u1ja7>fFIwfu%DbIO#5Zl`{FQ-Df!n&AO{Un7hlufyjsPQXUb?L{xc
zw&<1}^A+9rQaS-O=|VV1*hrqlbo|w7%1_UGaEnBTN&Qx3ZcWk5udbO*O)po_vZ~Ey
z31N@;_01yjq-<0jIScD}eo^EBM*#}*xd1i(jB95shJ#J)#V(^9%;*|i``IayV*525
zCX<>?Dp{?*4^L;r|8F7i*z!Ti%G--N_!gISS!1(m>!ok5-ZyVQS|TZ*f~)j*Fd)}D
zlz#tNE54{(M-4+bU+sBLzJYG1Xz6{U-QUbAaG30BM~BXkH}uX0XYz+`zP|~fTT_4P
zD}}Ei?7_*1R{hl=LTWI#7n``FKz@)g;WE#WL_~wzyYI=gtSrkbPY$aI*b5!-?jp=U
zh8Z}_@_ibA&B7lF1HT^3aH~JbN+I=NoDo;0_%eco>Mh6<{s>-5sT?~JuDKd_8ZB)1
zvb*T&ckmG_Ye0qM;*geku;rEC%mr*>4_zCPvKq%?3^Lxsv1o*6<F$}W1`)QspG*Cn
z*ldR@(x4XUX80c`=pA6Suc;VY#D6pH`*FKO9Gv4M2JbMUVcR(2T_POfh2mUrvXjAw
z%Wf4%-)3n=;sWFNFfRDw{H@41;Vdfyif+Dc^Anb)(KoNkt~1%AUnc^lzVBuy_4rFx
z5^UJ4Z#N{yU$AWW9@KzLNgK%K@j$eD=82Yc3~a<a%L&_>UEI55O<Iv8|KlucJVGoZ
z+1EW6a^4B4uM|Sx6~bNXIz##L^?X42^iKRV@Ii!E_xoP$058A`^c_vFS-F_6F@-?e
zBriV^8pniVlqt0@0C49yks!dApIC|Ah21b5N+w&s*AYZB5}C%tYbQdg(E}8-#8lA<
zJ7K!7q!9YN+Q23Ay0WfmZ+%@wBtCWJ6qXX1<!S49-f``NA_0c52d4=1PFH|a$OYDE
zC&gb#++6+3j6GdnC(>nIjbR;beYlO~v1Z5EF8(rd2P1@Jk<Ofg&1h%oEY#o9Gx5S6
zaV>xGs{1J#Wal*Jcv@oqFU1~t4Pp9r-f4m)v_ztJck-HG3udKj=GEp;n^~>Fb+=~h
zLDgLR;7e8-9ME~{5a!;i;6;%Vg6KxhjQ%g&m)0j7nXpOp{B7L|v~b+|U4P6*Wx6%M
zuJk}hZV?9KP?)lF>0kU&D3N&&Du>s@@nq%3ZF_`ID#?Xp4mu{SEKhQ)%LBgYEqoe|
zu{)c5N+o5I@)i4WgOT<j{$y;to@$?mCE%I&x(C!zUE9RnB<AR^@#1Rvlu2{4;bDW*
zuD_NhU0_+R@%8_kKc=Zwh?Mp8CK!uSjx&3j>`4|9yP0SsbdS+M!m=HfO_KEGms9Nt
z=n+~mn2HoRz|u5)I@BkCy)wjreGpOu&na7!oiIFQWY(tg2FckNTD)o-D;blV5Sf}}
z)tcYrmJyYye~!QVTt|%*9ZvVORk8@IIV*H!S=`<k6wnKHf_G<97<og(`)=4Ds@~Br
z$kf(RR{}r22%Vi?ZkIS@e;~wzBK_5md}t=v!a2L(GQSvkcuMQvD>f$lNm-*eD$5^{
zAea>vRkLcn<?qidXH>%{WQ5USv&{bRIBwTO;Bil(^Mm(IU!X`i9)AlUR`4}95##7Z
zDD_N3t3=x?s0(QSoipMgUb#jbB1e-8Ol5+?Q4Q!p?28obr4a&v<Q@*$tUL!Z{$`-^
zrCx~MTK?U}aE>mxXE{^BR;|B22-b`AIloxId2B3+FP9<FOAWL9y_sdMnQHfczDk_2
zi_AdrgAamD7~gvJi(K5ha~u9$n{uv^KYaFtKnG;yWrVfUldQ{JT%|`X@@)5qgh|ZA
zI*nUb%ZsscN$M!|?6tP7?%SpYyqCAvIVK7?*0ObjdWcoYQp@YorvjV2MynMNKEDe;
z-qxIlJ^n1A2$)FLQ(z^FhtT>_v29o{lw+rF8!?c-jj(r2jTRfu@-*;Rf&Ybht7tuR
zUHH<;64GCt<4=>ommPczZ5a*D^EYL_$QTU%=xWk(dOhDDfi1;M6{0c9IryCmN;#%L
zy78FF{jI{^Gd$xs;<bOKu(6m?Wjja52f>a?C50LS<>e#kkgt2w-;No{2(a>o{EY2H
zn<U7Vt%t~IY+%xFAIHf~)MZAJ!5oC8qcPB9l*0Md0`$0!dP`Id+ZxogjZS66_=$e8
zg}20P(VdCS8c(inbV#%dB<X^83lbc~STY3nceOw9iNL2%O$Iriep|L~p>8oq?uJ}t
zt+niyKb~YJu=9cG04C>K5HriK`1$tKhpZ&>*Q8G;_!9wJAyONW3WzKRB^{5IgPDv#
z__utS7t*)ZPXpCwuQ<Bu8_Soe4r8rT=(M_hWkdc*K_U|(YW@T;Hg2ABjdkAc^tVrp
zk3;28U1EN^DPJgciHP=9pJI5{eLiDU?Mz@jffuDwPDN(+TRZw(X&X4ND1cr7axEn<
zr-qR0tPn|dWo2V#gj#FrYO?0aLHX~z?ye%@OpdK5*P+$P0KEQVBg(2D^~j4%1;Wkd
z5F%wO-46KeE{rnSEJN#*#EWIq;kI!y@#UIfGQ$m4OnV3_D0=43liAi+MwYG;xIG~v
zK@E9Hw}G<OsqD_!S!OQdd?j>OUEI^{IJM5+KuttZTO_41c=&5m@KI*%Dcu?kFdc+J
z^<ujQn)><YdTeFU_eoq13+b`;jn9`p_Y2{Es?ZgoX>QdzD~`T2>8u#zi>k})cXYJM
zVeKo`8?zL+LFj^ngL~3X$T-9jij#HVnKnbZ{+|zI9Ods{2zZ}GA8zsMSKA_@;ygjK
zD9iKzosfO%4l8fv_^J;|Zz}{rP*kG#f57=GT90HWIhOgxDIn1?NvJD7zZP4WcK&h%
zo1rqz#H-NT)6B)D-jgt<rnXVp{T7bqIl-IDdWviXZ}#8Cy}Px=E|=X|8XsYaO*f-x
zosxVZJFT2mx*{qYCTQ5eLR}Kby2mH{ORE1Zt2<XH5Rk%%5*u7L;~*?T+CcI(6U+26
zd!JF4kh;hny{z<w*j|-%jEk7&p~#-CA}KG7@=@PTF^d@2K$9S}v!U*@E@PiS2!T?P
zqvYkIZ)CbqnM<>sklCJ-o=lZ1!f}XQVUM8;CvbOP1luty88V=lG;Xa;Q7clz=Cp1V
zcy3^bdh4ilrA>s(1%_wW`c6JzJn}mVHIDcjP?`u>ePuvltF96)J{c8^*%HnZY8*b%
zya+>#5nnp<B}%Y$i%O{e0c}jBh<G}*<`oAsFEgIQEbFw|l-xrP`YuSGHmo`TVtkk5
zICtlrsn-)6l<X(H2{wdmh8+A+?%m49P{9ZQtbGvSd~Dd16kv9suo|tNVW?{^GkPE|
z<JFp*LZ!Kqkf-nGTumpV+KeFGsJ`I(`^BtSpotRef;dSQ#wMjfubqEo?7KdJ-8;B?
zN*8*AvPR)4&3<EY6skS8>a^Pun~8^%ccoqD0yL25FWIu+Xx3#Ee;+2@@5^HfSp{9P
z{UbT!2j&lSrzCZ`6O;jcNlOwG5NpA-##m!X8mbH%JJM$uuuUlPHhoxbS)h{2Y8%>W
zdGcuWuD><9PEWE>Wj<ppD^h6JwTS}Cu+;}_b#_a?f*{UkXRS)h3ct3jL#8geTvl5B
zH6(?+6ot(;OT<XIEwiDCVJk;J`g@`!Cuo^LI+HDHF;^@m51AO{F3srIGG!G8=Ft$W
zC8a+X3yhrDONhzYoLXiRyKe9?s8uzS-*+KC*ql1=q$wGF>813vpE}ecdre4axyf(8
z?6p4r3#%Kx2&Vy?wD;35DrV`YvX<17rpVg{)dy9w!w>!l@~b4=iz=a*pYe6zwfIAw
zWtB$QK-$<h{om;4uOQ<7cm2M_vEv`7Y=_<`wr3jdST&MtXMk7hk4jDvA(6KZ4qU+O
zYX4VYNWne}Me_0{V!XBUC1{Ih+udSwFdy(Itd~|re7R+?m2uxy_SfpQotq>b?qB<W
zem8KQ_Rq_lqroPS{DyDAmVwSrdBHXM*I7qkgU;Tl36?E^P&r8{KQa2hA7}_Tz;*bG
z8SCj)-nr08`9e2Bdyy?&47N`bzhGW>;EfeYqw@(O<p@sp=*qIy4p*h!ZC@x~*^;vU
z;~j=Ee2Cm&QaR;<3P&%heXgo<VA5?1Lmg82JAB$v3*se6ZFyr!afjS<_V-Q{*)u~j
z&W+!IBf2OOk%@-G*ZlM@B%@rW(C<S|iA2=vP%R%RH=AC*_ATXaqx_rlG8@{n$`1#g
zRLEgvTe&7{tQ=LgY7K}uI<@7K3S;13<x}lfe<WjJ#40mf-Kl>eX2Hod@|A7ZI*B<3
z5B3g84y2(DVZ2C&`d3b~+?g;V0FENpcOATtOZM*akgAfsU=i}>Fm+N!OvS0f^X|#u
zT7Ao4+5TX=M2A4PIPuSwuDiTT)BHV{6Wv4Mn58X8Yo?xh7g;_w!fhMIK4(lwjqHC%
z7LfnV?3ZeSC_y#EVj`ldh*D#@mVc~GE(sve82{A25i=)Em5)^y{XKb|Q8pCw&4Rx6
zxp*}On^kU@?ZE2SkDOWrM|E!c!(xr{3Yn_(v6p`%r!L?A)~Ik~;#;L$aMkP3?JU}t
zfos`H4T=rQ1q8<V5@+-AoHJA5-phk_fr$XG2l$5$f3qe^w^vk?m!b#K+YW=-kq-Tx
zENb^@{bQb4^3A%LvfTy4BYmXFmHjum4?T6>_(LrV5myplUZr9Q@qMcIq7V~GX`P|*
zs2jFL%Y#?^h*f|5r9XtSAi(_?5C1*&pM3rU<bPK1pB4OP1^-#We^&6H75rxf|5?F*
kR`8z{@VA0DG>C<$-F13mw*@F?fdBn=!0eZ-eYgw%2X$4`O#lD@

literal 0
HcmV?d00001

diff --git a/templates/compose/executor.yaml b/templates/compose/executor.yaml
new file mode 100644
index 000000000..e6913ae5d
--- /dev/null
+++ b/templates/compose/executor.yaml
@@ -0,0 +1,35 @@
+# documentation: https://executor.sh/docs/hosted/docker
+# slogan: Self-hosted AI agent integrations and code execution server.
+# category: development
+# tags: executor,ai,agents,mcp,automation,development
+# logo: svgs/executor.png
+# port: 4788
+
+services:
+  executor:
+    image: 'ghcr.io/rhyssullivan/executor-selfhost:${EXECUTOR_VERSION:-latest}'
+    environment:
+      - SERVICE_URL_EXECUTOR_4788
+      - EXECUTOR_WEB_BASE_URL=${SERVICE_URL_EXECUTOR_4788}
+      - EXECUTOR_HOST=${EXECUTOR_HOST:-0.0.0.0}
+      - PORT=${PORT:-4788}
+      - EXECUTOR_DATA_DIR=/data
+      - EXECUTOR_DB_PATH=${EXECUTOR_DB_PATH:-/data/data.db}
+      - EXECUTOR_ORG_NAME=${EXECUTOR_ORG_NAME:-Default}
+      - EXECUTOR_ORG_SLUG=${EXECUTOR_ORG_SLUG:-default}
+      - EXECUTOR_ALLOW_LOCAL_NETWORK=${EXECUTOR_ALLOW_LOCAL_NETWORK:-false}
+    volumes:
+      - executor-data:/data
+    healthcheck:
+      test:
+        - CMD
+        - bun
+        - -e
+        - "fetch(`http://127.0.0.1:${process.env.PORT||4788}/api/health`).then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 20s
+
+volumes:
+  executor-data:
diff --git a/templates/service-templates-latest.json b/templates/service-templates-latest.json
index 00243fff0..b6a452e75 100644
--- a/templates/service-templates-latest.json
+++ b/templates/service-templates-latest.json
@@ -1400,6 +1400,24 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "80"
     },
+    "executor": {
+        "documentation": "https://executor.sh/docs/hosted/docker?utm_source=coolify.io",
+        "slogan": "Self-hosted AI agent integrations and code execution server.",
+        "compose": "c2VydmljZXM6CiAgZXhlY3V0b3I6CiAgICBpbWFnZTogJ2doY3IuaW8vcmh5c3N1bGxpdmFuL2V4ZWN1dG9yLXNlbGZob3N0OiR7RVhFQ1VUT1JfVkVSU0lPTjotbGF0ZXN0fScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0VYRUNVVE9SXzQ3ODgKICAgICAgLSAnRVhFQ1VUT1JfV0VCX0JBU0VfVVJMPSR7U0VSVklDRV9VUkxfRVhFQ1VUT1JfNDc4OH0nCiAgICAgIC0gJ0VYRUNVVE9SX0hPU1Q9JHtFWEVDVVRPUl9IT1NUOi0wLjAuMC4wfScKICAgICAgLSAnUE9SVD0ke1BPUlQ6LTQ3ODh9JwogICAgICAtIEVYRUNVVE9SX0RBVEFfRElSPS9kYXRhCiAgICAgIC0gJ0VYRUNVVE9SX0RCX1BBVEg9JHtFWEVDVVRPUl9EQl9QQVRIOi0vZGF0YS9kYXRhLmRifScKICAgICAgLSAnRVhFQ1VUT1JfT1JHX05BTUU9JHtFWEVDVVRPUl9PUkdfTkFNRTotRGVmYXVsdH0nCiAgICAgIC0gJ0VYRUNVVE9SX09SR19TTFVHPSR7RVhFQ1VUT1JfT1JHX1NMVUc6LWRlZmF1bHR9JwogICAgICAtICdFWEVDVVRPUl9BTExPV19MT0NBTF9ORVRXT1JLPSR7RVhFQ1VUT1JfQUxMT1dfTE9DQUxfTkVUV09SSzotZmFsc2V9JwogICAgdm9sdW1lczoKICAgICAgLSAnZXhlY3V0b3ItZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBidW4KICAgICAgICAtICctZScKICAgICAgICAtICdmZXRjaChgaHR0cDovLzEyNy4wLjAuMToke3Byb2Nlc3MuZW52LlBPUlR8fDQ3ODh9L2FwaS9oZWFsdGhgKS50aGVuKHI9PnByb2Nlc3MuZXhpdChyLm9rPzA6MSksKCk9PnByb2Nlc3MuZXhpdCgxKSknCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogICAgICBzdGFydF9wZXJpb2Q6IDIwcwp2b2x1bWVzOgogIGV4ZWN1dG9yLWRhdGE6IG51bGwK",
+        "tags": [
+            "executor",
+            "ai",
+            "agents",
+            "mcp",
+            "automation",
+            "development"
+        ],
+        "category": "development",
+        "logo": "svgs/executor.png",
+        "minversion": "0.0.0",
+        "template_last_updated_at": null,
+        "port": "4788"
+    },
     "faraday": {
         "documentation": "https://faradaysec.com/?utm_source=coolify.io",
         "slogan": "Faraday is a powerful, open-source, web-based vulnerability management tool.",
diff --git a/templates/service-templates.json b/templates/service-templates.json
index c193f0934..d279a6a33 100644
--- a/templates/service-templates.json
+++ b/templates/service-templates.json
@@ -1400,6 +1400,24 @@
         "template_last_updated_at": "2025-08-17T18:23:57+02:00",
         "port": "80"
     },
+    "executor": {
+        "documentation": "https://executor.sh/docs/hosted/docker?utm_source=coolify.io",
+        "slogan": "Self-hosted AI agent integrations and code execution server.",
+        "compose": "c2VydmljZXM6CiAgZXhlY3V0b3I6CiAgICBpbWFnZTogJ2doY3IuaW8vcmh5c3N1bGxpdmFuL2V4ZWN1dG9yLXNlbGZob3N0OiR7RVhFQ1VUT1JfVkVSU0lPTjotbGF0ZXN0fScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9FWEVDVVRPUl80Nzg4CiAgICAgIC0gJ0VYRUNVVE9SX1dFQl9CQVNFX1VSTD0ke1NFUlZJQ0VfRlFETl9FWEVDVVRPUl80Nzg4fScKICAgICAgLSAnRVhFQ1VUT1JfSE9TVD0ke0VYRUNVVE9SX0hPU1Q6LTAuMC4wLjB9JwogICAgICAtICdQT1JUPSR7UE9SVDotNDc4OH0nCiAgICAgIC0gRVhFQ1VUT1JfREFUQV9ESVI9L2RhdGEKICAgICAgLSAnRVhFQ1VUT1JfREJfUEFUSD0ke0VYRUNVVE9SX0RCX1BBVEg6LS9kYXRhL2RhdGEuZGJ9JwogICAgICAtICdFWEVDVVRPUl9PUkdfTkFNRT0ke0VYRUNVVE9SX09SR19OQU1FOi1EZWZhdWx0fScKICAgICAgLSAnRVhFQ1VUT1JfT1JHX1NMVUc9JHtFWEVDVVRPUl9PUkdfU0xVRzotZGVmYXVsdH0nCiAgICAgIC0gJ0VYRUNVVE9SX0FMTE9XX0xPQ0FMX05FVFdPUks9JHtFWEVDVVRPUl9BTExPV19MT0NBTF9ORVRXT1JLOi1mYWxzZX0nCiAgICB2b2x1bWVzOgogICAgICAtICdleGVjdXRvci1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGJ1bgogICAgICAgIC0gJy1lJwogICAgICAgIC0gJ2ZldGNoKGBodHRwOi8vMTI3LjAuMC4xOiR7cHJvY2Vzcy5lbnYuUE9SVHx8NDc4OH0vYXBpL2hlYWx0aGApLnRoZW4ocj0+cHJvY2Vzcy5leGl0KHIub2s/MDoxKSwoKT0+cHJvY2Vzcy5leGl0KDEpKScKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogMjBzCnZvbHVtZXM6CiAgZXhlY3V0b3ItZGF0YTogbnVsbAo=",
+        "tags": [
+            "executor",
+            "ai",
+            "agents",
+            "mcp",
+            "automation",
+            "development"
+        ],
+        "category": "development",
+        "logo": "svgs/executor.png",
+        "minversion": "0.0.0",
+        "template_last_updated_at": null,
+        "port": "4788"
+    },
     "faraday": {
         "documentation": "https://faradaysec.com/?utm_source=coolify.io",
         "slogan": "Faraday is a powerful, open-source, web-based vulnerability management tool.",
diff --git a/tests/Unit/ExecutorServiceTemplateTest.php b/tests/Unit/ExecutorServiceTemplateTest.php
new file mode 100644
index 000000000..7e3d0ce50
--- /dev/null
+++ b/tests/Unit/ExecutorServiceTemplateTest.php
@@ -0,0 +1,49 @@
+<?php
+
+it('includes an Executor one-click service template', function () {
+    $templatePath = __DIR__.'/../../templates/compose/executor.yaml';
+
+    expect($templatePath)->toBeFile();
+
+    $compose = file_get_contents($templatePath);
+
+    expect($compose)
+        ->toContain('ghcr.io/rhyssullivan/executor-selfhost:${EXECUTOR_VERSION:-latest}')
+        ->toContain('SERVICE_URL_EXECUTOR_4788')
+        ->toContain('EXECUTOR_WEB_BASE_URL=${SERVICE_URL_EXECUTOR_4788}')
+        ->toContain('executor-data:/data')
+        ->toContain('http://127.0.0.1:${process.env.PORT||4788}/api/health');
+
+    foreach (['service-templates.json', 'service-templates-latest.json'] as $templateFile) {
+        $templateCatalogPath = __DIR__."/../../templates/{$templateFile}";
+        $templateCatalog = file_get_contents($templateCatalogPath);
+
+        if ($templateCatalog === false) {
+            throw new RuntimeException("Unable to read service template catalog at {$templateCatalogPath}.");
+        }
+
+        $templates = json_decode(
+            $templateCatalog,
+            associative: true,
+            flags: JSON_THROW_ON_ERROR,
+        );
+
+        expect($templates)->toHaveKey('executor');
+        expect($templates['executor']['port'] ?? null)->toBe('4788');
+        expect($templates['executor']['logo'] ?? null)->toBe('svgs/executor.png');
+        expect($templates['executor']['category'] ?? null)->toBe('development');
+
+        $generatedCompose = base64_decode($templates['executor']['compose'], strict: true);
+
+        expect($generatedCompose)
+            ->toContain('ghcr.io/rhyssullivan/executor-selfhost:${EXECUTOR_VERSION:-latest}')
+            ->toContain('http://127.0.0.1:${process.env.PORT||4788}/api/health')
+            ->toContain($templateFile === 'service-templates.json'
+                ? 'EXECUTOR_WEB_BASE_URL=${SERVICE_FQDN_EXECUTOR_4788}'
+                : 'EXECUTOR_WEB_BASE_URL=${SERVICE_URL_EXECUTOR_4788}');
+    }
+});
+
+it('ships the Executor service icon from the public path used by the service picker', function () {
+    expect(__DIR__.'/../../public/svgs/executor.png')->toBeFile();
+});

From 7b7d5a0aad5feb37dfee42fc6575d9f1b141b17b Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 27 Aug 2026 13:45:26 +0200
Subject: [PATCH 02/55] fix(services): add CDN and default logo fallbacks

---
 app/Livewire/GlobalSearch.php                 |  3 +--
 app/Livewire/Project/New/Select.php           | 26 +------------------
 bootstrap/helpers/services.php                | 25 ++++++++++++++++++
 .../views/livewire/global-search.blade.php    |  4 ++-
 .../livewire/project/new/select.blade.php     | 11 ++------
 .../ServiceTemplatesLastUpdatedHintTest.php   | 23 ++++++++++++++--
 6 files changed, 53 insertions(+), 39 deletions(-)

diff --git a/app/Livewire/GlobalSearch.php b/app/Livewire/GlobalSearch.php
index bf64ee8e9..c6ed818e9 100644
--- a/app/Livewire/GlobalSearch.php
+++ b/app/Livewire/GlobalSearch.php
@@ -1507,8 +1507,7 @@ public function getServicesProperty()
                 'type' => 'one-click-service-'.$serviceKey,
                 'category' => 'Services',
                 'resourceType' => 'service',
-                'logo' => data_get($service, 'logo'),
-            ] + array_filter([
+            ] + service_logo_urls(data_get($service, 'logo')) + array_filter([
                 'amd_only' => data_get($service, 'amd_only') ? true : null,
                 'arm_only' => data_get($service, 'arm_only') ? true : null,
             ]));
diff --git a/app/Livewire/Project/New/Select.php b/app/Livewire/Project/New/Select.php
index 4cffff800..ba03041e2 100644
--- a/app/Livewire/Project/New/Select.php
+++ b/app/Livewire/Project/New/Select.php
@@ -111,38 +111,14 @@ public function loadServices()
         $templateLastUpdatedMap = $this->serviceTemplateLastUpdatedMap($services);
 
         $services = collect($services)->map(function ($service, $key) use ($templateLastUpdatedMap) {
-            $default_logo = 'svgs/default.webp';
-            $logo = data_get($service, 'logo');
-
-            if (is_string($logo) && str_starts_with($logo, 'svg/')) {
-                $normalizedLogo = 'svgs/'.str($logo)->after('svg/');
-                if (file_exists(public_path($normalizedLogo))) {
-                    $logo = $normalizedLogo;
-                }
-            }
-
-            $hasLogo = is_string($logo)
-                && basename($logo) !== basename($default_logo)
-                && file_exists(public_path($logo));
-
-            if (! $hasLogo) {
-                $logo = $default_logo;
-            }
-
-            $local_logo_path = public_path($logo);
             $serviceKey = (string) $key;
 
             return [
                 'id' => $serviceKey,
                 'name' => str($serviceKey)->headline(),
                 'docsSlug' => str($serviceKey)->lower()->value(),
-                'has_logo' => $hasLogo,
-                'logo' => asset($logo),
-                'logo_github_url' => file_exists($local_logo_path)
-                    ? 'https://raw.githubusercontent.com/coollabsio/coolify/refs/heads/main/public/'.$logo
-                    : asset($default_logo),
                 'templateLastUpdated' => $templateLastUpdatedMap[$serviceKey] ?? null,
-            ] + (array) $service;
+            ] + service_logo_urls(data_get($service, 'logo')) + (array) $service;
         })->all();
 
         // Extract unique categories from services
diff --git a/bootstrap/helpers/services.php b/bootstrap/helpers/services.php
index 07fdeb086..96257a632 100644
--- a/bootstrap/helpers/services.php
+++ b/bootstrap/helpers/services.php
@@ -1,5 +1,30 @@
 <?php
 
+function service_logo_urls(mixed $logo): array
+{
+    $defaultLogo = 'svgs/default.webp';
+
+    if (! is_string($logo) || $logo === '' || basename($logo) === basename($defaultLogo)) {
+        return [
+            'logo' => asset($defaultLogo),
+            'logo_cdn_url' => asset($defaultLogo),
+            'logo_default_url' => asset($defaultLogo),
+        ];
+    }
+
+    if (str_starts_with($logo, 'svg/')) {
+        $logo = 'svgs/'.str($logo)->after('svg/');
+    }
+
+    $logo = ltrim($logo, '/');
+
+    return [
+        'logo' => asset($logo),
+        'logo_cdn_url' => 'https://raw.githubusercontent.com/coollabsio/coolify/refs/heads/main/public/'.$logo,
+        'logo_default_url' => asset($defaultLogo),
+    ];
+}
+
 use App\Models\Application;
 use App\Models\Service;
 use App\Models\ServiceApplication;
diff --git a/resources/views/livewire/global-search.blade.php b/resources/views/livewire/global-search.blade.php
index 43d6e6b55..9e714b59f 100644
--- a/resources/views/livewire/global-search.blade.php
+++ b/resources/views/livewire/global-search.blade.php
@@ -655,7 +655,9 @@ class="absolute inset-0 z-10 hidden items-center justify-center bg-white/40 back
                                             class="search-result-item command-palette-item">
                                             <template x-if="item.logo">
                                                 <div class="command-palette-item-icon">
-                                                    <img :src="'/' + item.logo" :alt="item.name">
+                                                    <img :src="item.logo.startsWith('http') ? item.logo : '/' + item.logo"
+                                                        :alt="item.name"
+                                                        x-on:error="if (item.logo_cdn_url && !$el.dataset.cdnTried) { $el.dataset.cdnTried = 'true'; $el.src = item.logo_cdn_url; } else if (item.logo_default_url && !$el.dataset.defaultTried) { $el.dataset.defaultTried = 'true'; $el.src = item.logo_default_url; }">
                                                 </div>
                                             </template>
                                             <template x-if="!item.logo">
diff --git a/resources/views/livewire/project/new/select.blade.php b/resources/views/livewire/project/new/select.blade.php
index d8e0920ef..aed3b9697 100644
--- a/resources/views/livewire/project/new/select.blade.php
+++ b/resources/views/livewire/project/new/select.blade.php
@@ -287,15 +287,8 @@ class="group flex min-h-48 cursor-pointer flex-col rounded-xl border border-neut
                                     <div class="flex min-w-0 items-start gap-3">
                                         <div
                                             class="flex size-11 shrink-0 items-center justify-center overflow-hidden rounded-xl border border-neutral-200 bg-neutral-50 dark:border-white/[0.08] dark:bg-white/[0.04]">
-                                            <template x-if="service.has_logo">
-                                                <img class="h-full w-full object-contain p-2" :src="service.logo"
-                                                    onerror="this.onerror=null; this.src=this.getAttribute('data-fallback');"
-                                                    :data-fallback="service.logo_github_url" />
-                                            </template>
-                                            <template x-if="!service.has_logo">
-                                                <x-reicon name="layers"
-                                                    class="size-6 text-neutral-400 dark:text-fg-faint" />
-                                            </template>
+                                            <img class="h-full w-full object-contain p-2" :src="service.logo"
+                                                x-on:error="if (!$el.dataset.cdnTried) { $el.dataset.cdnTried = 'true'; $el.src = service.logo_cdn_url; } else if (!$el.dataset.defaultTried) { $el.dataset.defaultTried = 'true'; $el.src = service.logo_default_url; }" />
                                         </div>
                                         <div class="min-w-0 flex-1">
                                             <h3 class="truncate text-[13px] font-semibold text-black dark:text-fg"
diff --git a/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php b/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
index 08ae87821..affea0c89 100644
--- a/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
+++ b/tests/Feature/ServiceTemplatesLastUpdatedHintTest.php
@@ -36,11 +36,14 @@
         ->toBe(CarbonImmutable::parse($templateTimestamp)->timezone(config('app.timezone'))->format('M j, Y H:i'));
 });
 
-it('uses a valid local icon or the default icon for every service', function () {
+it('returns local, CDN, and default logo fallbacks for every service', function () {
     $services = (new Select)->loadServices()['services'];
 
     expect($services['opnform']['logo'])->toBe(asset('svgs/opnform.svg'))
-        ->and($services['pydio-cells']['logo'])->toBe(asset('svgs/default.webp'));
+        ->and($services['pydio-cells']['logo'])->toBe(asset('svgs/cells.svg'))
+        ->and($services['pydio-cells']['logo_cdn_url'])
+        ->toBe('https://raw.githubusercontent.com/coollabsio/coolify/refs/heads/main/public/svgs/cells.svg')
+        ->and($services['pydio-cells']['logo_default_url'])->toBe(asset('svgs/default.webp'));
 });
 
 it('crops wide database wordmarks to their icon artwork', function () {
@@ -127,6 +130,22 @@
     $view->assertSee('@keydown.escape.stop="closeCategoryFilter(true)"', false);
 });
 
+it('renders the local, CDN, and default service logo fallback chain', function () {
+    View::share('errors', new ViewErrorBag);
+
+    $view = $this->view('livewire.project.new.select', [
+        'current_step' => 'type',
+        'environments' => collect(),
+    ]);
+
+    $view->assertSee('service.logo_cdn_url', false);
+    $view->assertSee('service.logo_default_url', false);
+
+    expect(file_get_contents(resource_path('views/livewire/global-search.blade.php')))
+        ->toContain('item.logo_cdn_url')
+        ->toContain('item.logo_default_url');
+});
+
 it('keeps service template keys for service selection and docs links', function () {
     $services = collect((new Select)->loadServices()['services']);
     $denoKv = $services->firstWhere('id', 'denoKV');

From ac9b1c68c123c6e57ad537804b9f43c7330d24ec Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 27 Aug 2026 19:38:01 +0200
Subject: [PATCH 03/55] fix(server): allow sentinel startup migrations to
 finish

---
 app/Actions/Server/StartSentinel.php             | 2 +-
 tests/Unit/StartSentinelEndpointFallbackTest.php | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/app/Actions/Server/StartSentinel.php b/app/Actions/Server/StartSentinel.php
index cec90288e..3a37a7328 100644
--- a/app/Actions/Server/StartSentinel.php
+++ b/app/Actions/Server/StartSentinel.php
@@ -48,7 +48,7 @@ public function handle(Server $server, bool $restart = false, ?string $latestVer
         }
         $dockerEnvironments = implode(' ', array_map(fn ($key, $value) => '-e '.escapeshellarg("$key=$value"), array_keys($environments), $environments));
         $dockerLabels = implode(' ', array_map(fn ($key, $value) => "$key=$value", array_keys($labels), $labels));
-        $dockerCommand = "docker run -d $dockerEnvironments --name coolify-sentinel -v /var/run/docker.sock:/var/run/docker.sock -v $mountDir:/app/db --pid host --health-cmd \"curl --fail http://127.0.0.1:8888/api/health || exit 1\" --health-interval 10s --health-retries 3 --add-host=host.docker.internal:host-gateway --label $dockerLabels $image";
+        $dockerCommand = "docker run -d $dockerEnvironments --name coolify-sentinel -v /var/run/docker.sock:/var/run/docker.sock -v $mountDir:/app/db --pid host --health-cmd \"curl --fail http://127.0.0.1:8888/api/health || exit 1\" --health-start-period 120s --health-interval 10s --health-retries 3 --add-host=host.docker.internal:host-gateway --label $dockerLabels $image";
 
         instant_remote_process([
             'docker rm -f coolify-sentinel || true',
diff --git a/tests/Unit/StartSentinelEndpointFallbackTest.php b/tests/Unit/StartSentinelEndpointFallbackTest.php
index 8da3459b8..20422b2ab 100644
--- a/tests/Unit/StartSentinelEndpointFallbackTest.php
+++ b/tests/Unit/StartSentinelEndpointFallbackTest.php
@@ -15,3 +15,9 @@
         ->and($component)
         ->toContain('$this->sentinelCustomUrl = $this->server->settings->sentinel_custom_url;');
 });
+
+test('sentinel startup allows legacy metrics migrations to finish before health checks fail', function () {
+    $action = file_get_contents(dirname(__DIR__, 2).'/app/Actions/Server/StartSentinel.php');
+
+    expect($action)->toContain('--health-start-period 120s');
+});

From 97831ef06eee61433b758d6d2974f881e697f3d7 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 27 Aug 2026 22:32:16 +0200
Subject: [PATCH 04/55] feat(media): serve avatars and project icons from S3 or
 CDN

---
 .env.development.example                      |  1 +
 .env.windows-docker-desktop.example           |  1 +
 app/Livewire/Profile/Index.php                |  2 +-
 app/Livewire/Project/Index.php                |  5 +-
 bootstrap/helpers/shared.php                  | 50 +++++++++++++
 config/constants.php                          |  1 +
 .../views/components/top-user-menu.blade.php  |  2 +-
 resources/views/livewire/dashboard.blade.php  |  2 +-
 .../views/livewire/profile/index.blade.php    |  2 +-
 .../views/livewire/project/edit.blade.php     |  2 +-
 .../shared-variables/project/index.blade.php  |  4 +-
 tests/Feature/ProfileAvatarTest.php           | 69 +++++++++++++++++-
 tests/Feature/ProjectIconTest.php             | 71 +++++++++++++++++++
 13 files changed, 200 insertions(+), 12 deletions(-)

diff --git a/.env.development.example b/.env.development.example
index 380f10a44..56c17128c 100644
--- a/.env.development.example
+++ b/.env.development.example
@@ -53,3 +53,4 @@ DUSK_DRIVER_URL=http://selenium:4444
 BUNNY_API_KEY=
 # For asset uploads
 BUNNY_STORAGE_API_KEY=
+AVATAR_CDN_URL=
diff --git a/.env.windows-docker-desktop.example b/.env.windows-docker-desktop.example
index b067b4c5c..626d76ff6 100644
--- a/.env.windows-docker-desktop.example
+++ b/.env.windows-docker-desktop.example
@@ -11,3 +11,4 @@ REDIS_PASSWORD=coolify
 PUSHER_APP_ID=coolify
 PUSHER_APP_KEY=coolify
 PUSHER_APP_SECRET=coolify
+AVATAR_CDN_URL=
diff --git a/app/Livewire/Profile/Index.php b/app/Livewire/Profile/Index.php
index a20a1231b..04f58dadd 100644
--- a/app/Livewire/Profile/Index.php
+++ b/app/Livewire/Profile/Index.php
@@ -47,7 +47,7 @@ public function uploadAvatar(AvatarStorageService $avatarStorage): bool
 
             $avatarStorage->store(Auth::user(), $this->avatar);
             $this->reset('avatar');
-            $this->dispatch('avatar-updated', url: route('profile.avatar', ['v' => Auth::user()->fresh()->updated_at->timestamp]));
+            $this->dispatch('avatar-updated', url: profile_avatar_url(Auth::user()->fresh()));
             $this->dispatch('success', 'Profile picture updated.');
 
             return true;
diff --git a/app/Livewire/Project/Index.php b/app/Livewire/Project/Index.php
index 2b472a1a2..f43b7542e 100644
--- a/app/Livewire/Project/Index.php
+++ b/app/Livewire/Project/Index.php
@@ -53,10 +53,7 @@ public function render(): View
                     'uuid' => $project->uuid,
                     'name' => $project->name,
                     'description' => $project->description,
-                    'iconUrl' => $project->icon_path ? route('project.icon', [
-                        'project_uuid' => $project->uuid,
-                        'v' => $project->updated_at->timestamp,
-                    ]) : null,
+                    'iconUrl' => $project->icon_path ? project_icon_url($project) : null,
                     'href' => $project->navigateTo(),
                     'environmentCount' => $project->environments->count(),
                     'resourceCount' => $resourceCount,
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index c3bd4a223..f4dd3d185 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -12,6 +12,8 @@
 use App\Models\InstanceSettings;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
+use App\Models\Project;
+use App\Models\S3Storage;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
@@ -815,6 +817,54 @@ function firstDomainFromList(?string $fqdns): string
 {
     return trim((string) str($fqdns ?? '')->explode(',')->first());
 }
+function profile_avatar_url(User $user): string
+{
+    if ($user->avatar_storage_type === 's3') {
+        $url = s3_image_url($user->avatar_s3_storage_id, $user->avatar_path, $user->updated_at->timestamp);
+        if ($url) {
+            return $url;
+        }
+    }
+
+    return route('profile.avatar', ['v' => $user->updated_at->timestamp]);
+}
+
+function project_icon_url(Project $project): string
+{
+    if ($project->icon_storage_type === 's3') {
+        $url = s3_image_url($project->icon_s3_storage_id, $project->icon_path, $project->updated_at->timestamp);
+        if ($url) {
+            return $url;
+        }
+    }
+
+    return route('project.icon', [
+        'project_uuid' => $project->uuid,
+        'v' => $project->updated_at->timestamp,
+    ]);
+}
+
+function s3_image_url(?int $storageId, ?string $path, int $version): ?string
+{
+    if (! $storageId || blank($path)) {
+        return null;
+    }
+
+    $storage = S3Storage::query()
+        ->whereKey($storageId)
+        ->whereTeamId(0)
+        ->where('is_usable', true)
+        ->first();
+
+    if (! $storage) {
+        return null;
+    }
+
+    $baseUrl = config('constants.coolify.avatar_cdn_url') ?: $storage->awsUrl();
+
+    return rtrim($baseUrl, '/').'/'.ltrim($path, '/').'?v='.$version;
+}
+
 /**
  * If fqdn is set, return it, otherwise return public ip.
  */
diff --git a/config/constants.php b/config/constants.php
index b6fac21d1..e6e1a50f8 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -14,6 +14,7 @@
         'realtime_image' => env('REALTIME_IMAGE', env('REGISTRY_URL', 'docker.io').'/coollabsio/coolify-realtime'),
         'is_windows_docker_desktop' => env('IS_WINDOWS_DOCKER_DESKTOP', false),
         'cdn_url' => env('CDN_URL', 'https://cdn.coollabs.io'),
+        'avatar_cdn_url' => env('AVATAR_CDN_URL'),
         'versions_url' => env('VERSIONS_URL', env('CDN_URL', 'https://cdn.coollabs.io').'/coolify/versions.json'),
         'upgrade_script_url' => env('UPGRADE_SCRIPT_URL', env('CDN_URL', 'https://cdn.coollabs.io').'/coolify/upgrade.sh'),
         'releases_url' => env('RELEASES_URL', 'https://cdn.coollabs.io/coolify/releases.json'),
diff --git a/resources/views/components/top-user-menu.blade.php b/resources/views/components/top-user-menu.blade.php
index b176f4f21..7fdc312cb 100644
--- a/resources/views/components/top-user-menu.blade.php
+++ b/resources/views/components/top-user-menu.blade.php
@@ -15,7 +15,7 @@
     pageWidth: localStorage.getItem('pageWidth') || 'full',
     themeColor: localStorage.getItem('themeColor') || '#6b16ed',
     themeColorFrame: null,
-    avatarUrl: @js($user?->avatar_path ? route('profile.avatar', ['v' => $user->updated_at->timestamp]) : null),
+    avatarUrl: @js($user?->avatar_path ? profile_avatar_url($user) : null),
     openPanel() {
         this.appearanceOpen = false;
         this.open = true;
diff --git a/resources/views/livewire/dashboard.blade.php b/resources/views/livewire/dashboard.blade.php
index a8f4d0369..ebee5d2a3 100644
--- a/resources/views/livewire/dashboard.blade.php
+++ b/resources/views/livewire/dashboard.blade.php
@@ -66,7 +66,7 @@ class="absolute inset-0 rounded-xl"
                                 <div
                                     class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
                                     @if ($project->icon_path)
-                                        <img src="{{ route('project.icon', ['project_uuid' => $project->uuid, 'v' => $project->updated_at->timestamp]) }}"
+                                        <img src="{{ project_icon_url($project) }}"
                                             alt="{{ $project->name }} icon"
                                             class="h-full w-full rounded-lg object-cover">
                                     @else
diff --git a/resources/views/livewire/profile/index.blade.php b/resources/views/livewire/profile/index.blade.php
index ef54d3e21..4e6b77709 100644
--- a/resources/views/livewire/profile/index.blade.php
+++ b/resources/views/livewire/profile/index.blade.php
@@ -91,7 +91,7 @@
                     <img x-cloak x-show="preview" :src="preview" alt="Profile picture preview"
                         class="h-full w-full object-cover">
                     @if (auth()->user()->avatar_path)
-                        <img src="{{ route('profile.avatar', ['v' => auth()->user()->updated_at->timestamp]) }}"
+                        <img src="{{ profile_avatar_url(auth()->user()) }}"
                             x-show="!preview" alt="{{ auth()->user()->name }}" class="h-full w-full object-cover">
                     @else
                         <span x-show="!preview">
diff --git a/resources/views/livewire/project/edit.blade.php b/resources/views/livewire/project/edit.blade.php
index 564da2764..f3d27997a 100644
--- a/resources/views/livewire/project/edit.blade.php
+++ b/resources/views/livewire/project/edit.blade.php
@@ -65,7 +65,7 @@
                 <div class="flex size-16 shrink-0 items-center justify-center overflow-hidden rounded-xl border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
                     <img x-cloak x-show="preview" :src="preview" alt="Project icon preview" class="h-full w-full object-cover">
                     @if ($project->icon_path)
-                        <img x-show="!preview" src="{{ route('project.icon', ['project_uuid' => $project->uuid, 'v' => $project->updated_at->timestamp]) }}"
+                        <img x-show="!preview" src="{{ project_icon_url($project) }}"
                             alt="{{ $project->name }} icon" class="h-full w-full object-cover">
                     @else
                         <x-reicon x-show="!preview" name="projects" class="size-6" />
diff --git a/resources/views/livewire/shared-variables/project/index.blade.php b/resources/views/livewire/shared-variables/project/index.blade.php
index eb394ae83..63e4f4573 100644
--- a/resources/views/livewire/shared-variables/project/index.blade.php
+++ b/resources/views/livewire/shared-variables/project/index.blade.php
@@ -24,7 +24,7 @@ class="group flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-whit
                             <div class="flex items-start gap-3">
                                 <div class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-fg-dim">
                                     @if ($project->icon_path)
-                                        <img src="{{ route('project.icon', ['project_uuid' => $project->uuid, 'v' => $project->updated_at->timestamp]) }}"
+                                        <img src="{{ project_icon_url($project) }}"
                                             alt="{{ $project->name }} icon"
                                             class="h-full w-full rounded-lg object-cover">
                                     @else
@@ -49,7 +49,7 @@ class="h-full w-full rounded-lg object-cover">
                             href="{{ route('shared-variables.project.show', ['project_uuid' => $project->uuid]) }}" {{ wireNavigate() }}
                             class="flex min-h-14 items-center gap-3 border-b border-neutral-200 px-4 py-2.5 last:border-b-0 hover:bg-neutral-50 hover:no-underline dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
                             @if ($project->icon_path)
-                                <img src="{{ route('project.icon', ['project_uuid' => $project->uuid, 'v' => $project->updated_at->timestamp]) }}"
+                                <img src="{{ project_icon_url($project) }}"
                                     alt="{{ $project->name }} icon" class="size-4 shrink-0 rounded object-cover">
                             @else
                                 <x-reicon name="projects" class="size-4 shrink-0 text-neutral-500 dark:text-fg-dim" />
diff --git a/tests/Feature/ProfileAvatarTest.php b/tests/Feature/ProfileAvatarTest.php
index cf313882f..68ced553d 100644
--- a/tests/Feature/ProfileAvatarTest.php
+++ b/tests/Feature/ProfileAvatarTest.php
@@ -2,6 +2,8 @@
 
 use App\Livewire\Profile\Index;
 use App\Models\InstanceSettings;
+use App\Models\S3Storage;
+use App\Models\Team;
 use App\Models\User;
 use App\Services\AvatarStorageService;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -73,6 +75,71 @@
         ->assertHeader('content-type', 'image/jpeg');
 });
 
+it('loads an S3 profile picture from the configured CDN', function () {
+    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com/media/');
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::query()->create([
+        'team_id' => 0,
+        'name' => 'Avatar storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+    ]);
+    $user = User::factory()->create([
+        'avatar_path' => 'avatars/1/avatar.jpg',
+        'avatar_storage_type' => 's3',
+        'avatar_s3_storage_id' => $storage->id,
+    ]);
+
+    expect(profile_avatar_url($user))->toBe("https://avatars.example.com/media/avatars/1/avatar.jpg?v={$user->updated_at->timestamp}");
+});
+
+it('loads an S3 profile picture directly from S3 when the CDN is not configured', function () {
+    config()->set('constants.coolify.avatar_cdn_url');
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::query()->create([
+        'team_id' => 0,
+        'name' => 'Avatar storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+    ]);
+    $user = User::factory()->create([
+        'avatar_path' => 'avatars/1/avatar.jpg',
+        'avatar_storage_type' => 's3',
+        'avatar_s3_storage_id' => $storage->id,
+    ]);
+
+    expect(profile_avatar_url($user))->toBe("https://s3.example.com/avatars/avatars/1/avatar.jpg?v={$user->updated_at->timestamp}");
+});
+
+it('does not use an unrelated S3 storage URL for a profile picture', function () {
+    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com');
+    $storage = S3Storage::query()->create([
+        'team_id' => Team::factory()->create()->id,
+        'name' => 'Unrelated storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://unrelated.example.com',
+        'is_usable' => true,
+    ]);
+    $user = User::factory()->create([
+        'avatar_path' => 'avatars/1/avatar.jpg',
+        'avatar_storage_type' => 's3',
+        'avatar_s3_storage_id' => $storage->id,
+    ]);
+
+    expect(profile_avatar_url($user))->toBe(route('profile.avatar', ['v' => $user->updated_at->timestamp]));
+});
+
 it('removes the current profile picture', function () {
     Storage::fake('images');
     $user = User::factory()->create([
@@ -120,7 +187,7 @@
         ->not->toContain('Upload picture')
         ->not->toContain('type="file" x-on:change')
         ->and($menu)
-        ->toContain("route('profile.avatar',");
+        ->toContain('profile_avatar_url($user)');
 });
 
 it('offers runtime local or existing S3 profile picture storage', function () {
diff --git a/tests/Feature/ProjectIconTest.php b/tests/Feature/ProjectIconTest.php
index b5b6ed088..fc03c9f30 100644
--- a/tests/Feature/ProjectIconTest.php
+++ b/tests/Feature/ProjectIconTest.php
@@ -6,6 +6,7 @@
 use App\Livewire\SharedVariables\Project\Index as SharedVariablesProjectIndex;
 use App\Models\InstanceSettings;
 use App\Models\Project;
+use App\Models\S3Storage;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -102,6 +103,76 @@
         ]));
 });
 
+it('loads an S3 project icon from the configured CDN', function () {
+    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com/media/');
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::query()->create([
+        'team_id' => 0,
+        'name' => 'Avatar storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+    ]);
+    $this->project->forceFill([
+        'icon_path' => "project-icons/{$this->project->uuid}/icon.jpg",
+        'icon_storage_type' => 's3',
+        'icon_s3_storage_id' => $storage->id,
+    ])->save();
+
+    Livewire::test(Index::class)
+        ->assertViewHas('projectsJs', fn (array $projects): bool => $projects[0]['iconUrl'] === "https://avatars.example.com/media/project-icons/{$this->project->uuid}/icon.jpg?v={$this->project->updated_at->timestamp}");
+});
+
+it('loads an S3 project icon directly from S3 when the CDN is not configured', function () {
+    config()->set('constants.coolify.avatar_cdn_url');
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::query()->create([
+        'team_id' => 0,
+        'name' => 'Avatar storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+    ]);
+    $this->project->forceFill([
+        'icon_path' => "project-icons/{$this->project->uuid}/icon.jpg",
+        'icon_storage_type' => 's3',
+        'icon_s3_storage_id' => $storage->id,
+    ])->save();
+
+    expect(project_icon_url($this->project))->toBe("https://s3.example.com/avatars/project-icons/{$this->project->uuid}/icon.jpg?v={$this->project->updated_at->timestamp}");
+});
+
+it('does not use an unusable S3 storage URL for a project icon', function () {
+    config()->set('constants.coolify.avatar_cdn_url', 'https://avatars.example.com');
+    Team::factory()->create(['id' => 0]);
+    $storage = S3Storage::query()->create([
+        'team_id' => 0,
+        'name' => 'Unusable storage',
+        'region' => 'us-east-1',
+        'key' => 'key',
+        'secret' => 'secret',
+        'bucket' => 'avatars',
+        'endpoint' => 'https://unusable.example.com',
+        'is_usable' => false,
+    ]);
+    $this->project->forceFill([
+        'icon_path' => "project-icons/{$this->project->uuid}/icon.jpg",
+        'icon_storage_type' => 's3',
+        'icon_s3_storage_id' => $storage->id,
+    ])->save();
+
+    expect(project_icon_url($this->project))->toBe(route('project.icon', [
+        'project_uuid' => $this->project->uuid,
+        'v' => $this->project->updated_at->timestamp,
+    ]));
+});
+
 it('displays the project icon on the dashboard', function () {
     $this->project->forceFill([
         'icon_path' => "project-icons/{$this->project->uuid}/icon.jpg",

From b7f00e72676558bc1e75918e3eabaeb9232a75b1 Mon Sep 17 00:00:00 2001
From: kashik0i <amr.badawy13@gmail.com>
Date: Fri, 28 Aug 2026 02:45:17 +0300
Subject: [PATCH 05/55] fix(docker): detect unqualified helper images

---
 app/Jobs/CleanupHelperContainersJob.php       |  7 +-
 tests/Unit/CleanupHelperContainersJobTest.php | 69 +++++++++++++++++++
 2 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100644 tests/Unit/CleanupHelperContainersJobTest.php

diff --git a/app/Jobs/CleanupHelperContainersJob.php b/app/Jobs/CleanupHelperContainersJob.php
index f1635d6d4..425dd2591 100644
--- a/app/Jobs/CleanupHelperContainersJob.php
+++ b/app/Jobs/CleanupHelperContainersJob.php
@@ -19,6 +19,11 @@ class CleanupHelperContainersJob implements ShouldBeEncrypted, ShouldBeUnique, S
 
     public function __construct(public Server $server) {}
 
+    private static function helperContainersCommand(): string
+    {
+        return 'docker container ps --format \'{{json .}}\' | jq -s \'map(select(.Image|test("^([^/]+/)?coollabsio/coolify-helper(:|@)")))\'';
+    }
+
     public function handle(): void
     {
         try {
@@ -36,7 +41,7 @@ public function handle(): void
                 'active_deployment_uuids' => $activeDeployments,
             ]);
 
-            $containers = instant_remote_process_with_timeout(['docker container ps --format \'{{json .}}\' | jq -s \'map(select(.Image | contains("'.coolifyRegistryUrl().'/coollabsio/coolify-helper")))\''], $this->server, false);
+            $containers = instant_remote_process_with_timeout([self::helperContainersCommand()], $this->server, false);
             $helperContainers = collect(json_decode($containers));
 
             if ($helperContainers->count() > 0) {
diff --git a/tests/Unit/CleanupHelperContainersJobTest.php b/tests/Unit/CleanupHelperContainersJobTest.php
new file mode 100644
index 000000000..a649985d2
--- /dev/null
+++ b/tests/Unit/CleanupHelperContainersJobTest.php
@@ -0,0 +1,69 @@
+<?php
+
+use App\Jobs\CleanupHelperContainersJob;
+use App\Models\Server;
+use Symfony\Component\Process\Process;
+
+it('matches helper image references without matching similarly named images', function () {
+    $command = (new ReflectionMethod(CleanupHelperContainersJob::class, 'helperContainersCommand'))->invoke(null);
+    $directory = sys_get_temp_dir().'/coolify-helper-filter-'.bin2hex(random_bytes(4));
+    $docker = $directory.'/docker';
+    $images = [
+        'coollabsio/coolify-helper:1.0.15',
+        'docker.io/coollabsio/coolify-helper:1.0.16',
+        'ghcr.io/coollabsio/coolify-helper@sha256:abc',
+        'registry.example/team/coollabsio/coolify-helper:latest',
+        'evil/coollabsio/coolify-helper-copy:latest',
+        'coollabsio/not-coolify-helper:latest',
+    ];
+
+    mkdir($directory);
+    file_put_contents($docker, "#!/bin/sh\n".implode("\n", array_map(
+        fn (string $image): string => 'echo '.escapeshellarg(json_encode(['Image' => $image], JSON_THROW_ON_ERROR)),
+        $images
+    ))."\n");
+    chmod($docker, 0755);
+
+    try {
+        $process = new Process(['/bin/sh', '-c', $command], env: [
+            'PATH' => $directory.':'.getenv('PATH'),
+        ]);
+        $process->mustRun();
+
+        expect(array_column(json_decode($process->getOutput(), true, flags: JSON_THROW_ON_ERROR), 'Image'))
+            ->toBe(array_slice($images, 0, 3));
+    } finally {
+        unlink($docker);
+        rmdir($directory);
+    }
+});
+
+it('preserves the helper image filter for non-root servers', function () {
+    $command = (new ReflectionMethod(CleanupHelperContainersJob::class, 'helperContainersCommand'))->invoke(null);
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->user = 'ubuntu';
+    $command = parseCommandsByLineForSudo(collect([$command]), $server)[0];
+    $directory = sys_get_temp_dir().'/coolify-helper-sudo-filter-'.bin2hex(random_bytes(4));
+    $docker = $directory.'/docker';
+    $sudo = $directory.'/sudo';
+
+    mkdir($directory);
+    file_put_contents($docker, "#!/bin/sh\necho '{\"Image\":\"coollabsio/coolify-helper:1.0.15\"}'\n");
+    file_put_contents($sudo, "#!/bin/sh\nexec \"\$@\"\n");
+    chmod($docker, 0755);
+    chmod($sudo, 0755);
+
+    try {
+        $process = new Process(['/bin/sh', '-c', $command], env: [
+            'PATH' => $directory.':'.getenv('PATH'),
+        ]);
+        $process->mustRun();
+
+        expect(array_column(json_decode($process->getOutput(), true, flags: JSON_THROW_ON_ERROR), 'Image'))
+            ->toBe(['coollabsio/coolify-helper:1.0.15']);
+    } finally {
+        unlink($docker);
+        unlink($sudo);
+        rmdir($directory);
+    }
+});

From b357522f94f17715b4b1caddced388e67cec7502 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 28 Aug 2026 09:26:57 +0200
Subject: [PATCH 06/55] fix(livewire): prevent stale keys and refresh races

Use stable identities for dynamic rows and nested components so reordering does not target the wrong item. Scope storage count and volume-list refreshes, preserve PostgreSQL script identity when renaming files, use Livewire-aware destination redirects, and bump the version to 4.3.13.
---
 AGENTS.md                                     | 17 +++++
 app/Livewire/Destination/Show.php             |  2 +-
 app/Livewire/Project/Application/Domains.php  | 22 +++++++
 app/Livewire/Project/Application/General.php  |  3 +-
 app/Livewire/Project/Database/InitScript.php  |  6 +-
 .../Project/Database/Postgresql/General.php   | 11 ++--
 app/Livewire/Project/Service/Domains.php      | 22 +++++++
 app/Livewire/Project/Service/EditCompose.php  |  2 +-
 app/Livewire/Project/Service/FileStorage.php  |  8 +--
 app/Livewire/Project/Service/Storage.php      | 13 ++--
 app/Livewire/Project/Shared/Storages/All.php  |  5 +-
 app/Livewire/Project/Shared/Storages/Show.php |  3 +-
 config/constants.php                          |  2 +-
 other/nightly/versions.json                   |  2 +-
 .../configuration-sidebar.blade.php           |  3 +-
 .../application/partials/domain-row.blade.php |  5 +-
 .../database/postgresql/general.blade.php     |  2 +-
 .../service/partials/domain-table.blade.php   |  5 +-
 .../project/service/storage.blade.php         |  4 +-
 .../project/shared/get-logs.blade.php         | 12 ++--
 .../proxy/dynamic-configurations.blade.php    |  2 +-
 .../settings/scheduled-jobs.blade.php         |  4 +-
 tests/Feature/ApplicationDomainsTest.php      | 15 +++++
 tests/Feature/FileStorageMountPathTest.php    | 37 ++++++++++-
 .../PersistentStorageVolumesLayoutTest.php    | 10 +++
 tests/Feature/ServiceDomainsTest.php          | 15 +++++
 .../Feature/StableNestedLivewireKeysTest.php  | 64 +++++++++++++++++++
 tests/Feature/TeamScopedDestinationTest.php   | 17 +++++
 tests/Unit/ProductionImageWorkflowTest.php    |  4 +-
 versions.json                                 |  2 +-
 30 files changed, 274 insertions(+), 45 deletions(-)
 create mode 100644 tests/Feature/StableNestedLivewireKeysTest.php

diff --git a/AGENTS.md b/AGENTS.md
index 4d78dfd93..34b43e087 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -191,6 +191,23 @@ ### Laravel 10 Structure (NOT Laravel 11+ slim structure)
 - Exception handler: `app/Exceptions/Handler.php`
 - Service providers in `app/Providers/`
 
+## Livewire conventions
+
+### Dynamic lists and snapshot errors
+
+When an add, delete, or conversion leaves controls unresponsive and the browser reports `Snapshot missing on Livewire component`, inspect both component keys and refresh events. Stable keys alone may not fix it.
+
+- Give every Livewire component rendered in a loop a stable key based on the record ID, UUID, filename, or another immutable identity. Never include a collection count, `$loop->index`, or a reindexed array position in the key.
+- Pass the same stable identity to edit/delete actions. A keyed row can survive reordering while a `wire:ignore` or teleported Alpine modal keeps its original `submitAction`; an action such as `removeItem($index)` then targets a stale position after the first deletion. Resolve the current row server-side from an ID, UUID, or stable row hash instead.
+- Do not broadcast one refresh event to both a parent list component and children that the parent may insert, remove, or hide during the same operation. This can queue a child update after its snapshot has been removed from the DOM.
+- Split refresh responsibilities into targeted events. Refresh the parent for counts and tab visibility, and refresh an existing child list with a separate event. Use `$this->dispatch('event')->to(Component::class)` instead of a page-wide event when possible.
+- Before targeting a child list, confirm that it existed before the mutation, still exists afterward, and is on the active tab. A newly inserted child loads current data during `mount()` and does not need an immediate refresh. A removed or hidden child must not receive one.
+- A child that deletes itself should finish its own update, then target only the parent to refresh counts. The parent should not send a refresh back to that child when the list became empty.
+- Apply the same pattern to file, directory, conversion, and external reload paths such as Compose edits. One remaining broad event can reproduce the race.
+- Add regression tests that assert the scoped event names, assert the old broad event is not dispatched, and verify that keys do not depend on counts or positions. Manually repeat add/delete operations while watching the browser console.
+
+The persistent-storage implementation is the reference pattern: `Project\Service\Storage` handles `storageCountsChanged`, while `Project\Shared\Storages\All` handles `refreshVolumeList`.
+
 ## Key Conventions
 
 - Use `php artisan make:*` commands with `--no-interaction` to create files
diff --git a/app/Livewire/Destination/Show.php b/app/Livewire/Destination/Show.php
index 03fa2b510..63ceebef4 100644
--- a/app/Livewire/Destination/Show.php
+++ b/app/Livewire/Destination/Show.php
@@ -85,7 +85,7 @@ public function delete()
             }
             $this->destination->delete();
 
-            return redirect()->route('destination.index');
+            return redirectRoute($this, 'destination.index');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index 2f9370871..4168a208c 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -1322,6 +1322,28 @@ public function removeDomain(int $index): void
         }
     }
 
+    public function removeDomainByKey(string $domainKey): void
+    {
+        $index = collect($this->domainRows)->search(
+            fn (array $row): bool => ! ($row['is_suggested'] ?? false)
+                && hash_equals($domainKey, $this->domainRowKey($row))
+        );
+
+        if ($index === false) {
+            return;
+        }
+
+        $this->removeDomain((int) $index);
+    }
+
+    /**
+     * @param  array{url: string, service?: ?string}  $row
+     */
+    private function domainRowKey(array $row): string
+    {
+        return hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
+    }
+
     public function generateDomain(?string $serviceName = null): void
     {
         try {
diff --git a/app/Livewire/Project/Application/General.php b/app/Livewire/Project/Application/General.php
index 34283cd47..c5015dccc 100644
--- a/app/Livewire/Project/Application/General.php
+++ b/app/Livewire/Project/Application/General.php
@@ -4,6 +4,7 @@
 
 use App\Actions\Application\GenerateConfig;
 use App\Jobs\ApplicationDeploymentJob;
+use App\Livewire\Project\Service\Storage;
 use App\Models\Application;
 use App\Rules\ValidGitBranch;
 use App\Support\ValidationPatterns;
@@ -530,7 +531,7 @@ public function loadComposeFile($isInit = false, $showToast = true, ?string $res
 
             $showToast && $this->dispatch('success', 'Docker compose file loaded.');
             $this->dispatch('compose_loaded');
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
             $this->dispatch('refreshEnvs');
         } catch (\Throwable $e) {
             // Refresh model to get restored values from Application::loadComposeFile
diff --git a/app/Livewire/Project/Database/InitScript.php b/app/Livewire/Project/Database/InitScript.php
index 7074c235d..eba1c4d8f 100644
--- a/app/Livewire/Project/Database/InitScript.php
+++ b/app/Livewire/Project/Database/InitScript.php
@@ -22,6 +22,9 @@ class InitScript extends Component
     #[Locked]
     public int $index;
 
+    #[Locked]
+    public string $originalFilename;
+
     #[Validate(['nullable', 'string'])]
     public ?string $filename = null;
 
@@ -33,6 +36,7 @@ public function mount()
         try {
             $this->index = data_get($this->script, 'index');
             $this->filename = data_get($this->script, 'filename');
+            $this->originalFilename = (string) data_get($this->script, 'filename');
             $this->content = data_get($this->script, 'content');
         } catch (Exception $e) {
             return handleError($e, $this);
@@ -47,7 +51,7 @@ public function submit()
             $this->script['index'] = $this->index;
             $this->script['content'] = $this->content;
             $this->script['filename'] = $this->filename;
-            $this->dispatch('save_init_script', $this->script);
+            $this->dispatch('save_init_script', $this->script, $this->originalFilename);
         } catch (Exception $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Project/Database/Postgresql/General.php b/app/Livewire/Project/Database/Postgresql/General.php
index 051fb515d..83d6e97df 100644
--- a/app/Livewire/Project/Database/Postgresql/General.php
+++ b/app/Livewire/Project/Database/Postgresql/General.php
@@ -247,16 +247,16 @@ public function instantSave(?bool $isPublic = null)
         }
     }
 
-    public function save_init_script($script)
+    public function save_init_script($script, string $originalFilename)
     {
         $this->authorize('update', $this->database);
 
         $initScripts = collect($this->initScripts ?? []);
 
         $existingScript = $initScripts->firstWhere('filename', $script['filename']);
-        $oldScript = $initScripts->firstWhere('index', $script['index']);
+        $oldScript = $initScripts->firstWhere('filename', $originalFilename);
 
-        if ($existingScript && $existingScript['index'] !== $script['index']) {
+        if ($existingScript && $script['filename'] !== $originalFilename) {
             $this->dispatch('error', 'A script with this filename already exists.');
 
             return;
@@ -285,11 +285,10 @@ public function save_init_script($script)
             }
         }
 
-        $index = $initScripts->search(function ($item) use ($script) {
-            return $item['index'] === $script['index'];
-        });
+        $index = $initScripts->search(fn ($item) => $item['filename'] === $originalFilename);
 
         if ($index !== false) {
+            $script['index'] = $oldScript['index'];
             $initScripts[$index] = $script;
         } else {
             $initScripts->push($script);
diff --git a/app/Livewire/Project/Service/Domains.php b/app/Livewire/Project/Service/Domains.php
index d932e7649..7708e5535 100644
--- a/app/Livewire/Project/Service/Domains.php
+++ b/app/Livewire/Project/Service/Domains.php
@@ -1243,6 +1243,28 @@ public function removeDomain(int $index): void
         }
     }
 
+    public function removeDomainByKey(string $domainKey): void
+    {
+        $index = collect($this->domainRows)->search(
+            fn (array $row): bool => ! ($row['is_suggested'] ?? false)
+                && hash_equals($domainKey, $this->domainRowKey($row))
+        );
+
+        if ($index === false) {
+            return;
+        }
+
+        $this->removeDomain((int) $index);
+    }
+
+    /**
+     * @param  array{url: string, service_application_id: int|string}  $row
+     */
+    private function domainRowKey(array $row): string
+    {
+        return hash('sha256', $row['url'].'|'.$row['service_application_id']);
+    }
+
     public function addSuggestedDomain(int $index): void
     {
         try {
diff --git a/app/Livewire/Project/Service/EditCompose.php b/app/Livewire/Project/Service/EditCompose.php
index 46a8ecdc8..2feafe41a 100644
--- a/app/Livewire/Project/Service/EditCompose.php
+++ b/app/Livewire/Project/Service/EditCompose.php
@@ -78,7 +78,7 @@ public function saveEditedCompose()
         try {
             $this->authorize('update', $this->service);
             $this->dispatch('saveCompose', $this->dockerComposeRaw);
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Project/Service/FileStorage.php b/app/Livewire/Project/Service/FileStorage.php
index 84a0daec8..4520876d1 100644
--- a/app/Livewire/Project/Service/FileStorage.php
+++ b/app/Livewire/Project/Service/FileStorage.php
@@ -160,7 +160,7 @@ public function convertToDirectory()
         } catch (\Throwable $e) {
             return handleError($e, $this);
         } finally {
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
         }
     }
 
@@ -179,7 +179,7 @@ public function loadStorageOnServer()
         } catch (\Throwable $e) {
             return handleError($e, $this);
         } finally {
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
         }
     }
 
@@ -207,7 +207,7 @@ public function convertToFile()
         } catch (\Throwable $e) {
             return handleError($e, $this);
         } finally {
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
         }
     }
 
@@ -242,7 +242,7 @@ public function delete($password, $selectedActions = [])
         } catch (\Throwable $e) {
             return handleError($e, $this);
         } finally {
-            $this->dispatch('refreshStorages');
+            $this->dispatch('storageCountsChanged')->to(Storage::class);
         }
 
         return true;
diff --git a/app/Livewire/Project/Service/Storage.php b/app/Livewire/Project/Service/Storage.php
index ce278522b..adb19a313 100644
--- a/app/Livewire/Project/Service/Storage.php
+++ b/app/Livewire/Project/Service/Storage.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Project\Service;
 
+use App\Livewire\Project\Shared\Storages\All as StorageList;
 use App\Models\Application;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
@@ -51,7 +52,7 @@ public function getListeners()
 
         return [
             "echo-private:team.{$teamId},FileStorageChanged" => 'refreshStoragesFromEvent',
-            'refreshStorages',
+            'storageCountsChanged' => 'refreshStorages',
             'addNewVolume',
         ];
     }
@@ -87,11 +88,17 @@ public function refreshStoragesFromEvent()
 
     public function refreshStorages()
     {
+        $hadVolumes = $this->cachedVolumeCount > 0;
+
         // Avoid loading full volume models onto this parent (child All owns that snapshot).
         $this->resource->unsetRelation('persistentStorages');
         $this->loadVolumeCount();
         $this->loadFileStorageMetaCounts();
         $this->loadFileStorageForActiveTab();
+
+        if ($this->activeTab === 'volumes' && $hadVolumes && $this->cachedVolumeCount > 0) {
+            $this->dispatch('refreshVolumeList')->to(StorageList::class);
+        }
     }
 
     public function setActiveTab(string $tab): void
@@ -223,7 +230,6 @@ public function submitPersistentVolume()
             $this->dispatch('configurationChanged');
             $this->dispatch('success', 'Volume added successfully');
             $this->dispatch('closeStorageModal', 'volume');
-            $this->dispatch('refreshStorages');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -258,7 +264,6 @@ public function submitFileStorage()
             $this->dispatch('configurationChanged');
             $this->dispatch('success', 'File mount added successfully');
             $this->dispatch('closeStorageModal', 'file');
-            $this->dispatch('refreshStorages');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -293,7 +298,6 @@ public function submitHostFileStorage()
             $this->dispatch('configurationChanged');
             $this->dispatch('success', 'Host file mount added successfully');
             $this->dispatch('closeStorageModal', 'host-file');
-            $this->dispatch('refreshStorages');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -332,7 +336,6 @@ public function submitFileStorageDirectory()
             $this->dispatch('configurationChanged');
             $this->dispatch('success', 'Directory mount added successfully');
             $this->dispatch('closeStorageModal', 'directory');
-            $this->dispatch('refreshStorages');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Project/Shared/Storages/All.php b/app/Livewire/Project/Shared/Storages/All.php
index 583c2788a..fcd7752a0 100644
--- a/app/Livewire/Project/Shared/Storages/All.php
+++ b/app/Livewire/Project/Shared/Storages/All.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Project\Shared\Storages;
 
+use App\Livewire\Project\Service\Storage as StorageComponent;
 use App\Models\Application;
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
@@ -44,7 +45,7 @@ class All extends Component
 
     public bool $deleteDockerVolume = false;
 
-    protected $listeners = ['refreshStorages' => 'refreshList', 'refreshVolumeBackups' => 'refreshList'];
+    protected $listeners = ['refreshVolumeList' => 'refreshList', 'refreshVolumeBackups' => 'refreshList'];
 
     public function mount(): void
     {
@@ -163,7 +164,7 @@ public function delete(int $storageId, $password = '', $selectedActions = [])
 
         $storage->delete();
         $this->refreshList();
-        $this->dispatch('refreshStorages');
+        $this->dispatch('storageCountsChanged')->to(StorageComponent::class);
         $this->dispatch('configurationChanged');
 
         return true;
diff --git a/app/Livewire/Project/Shared/Storages/Show.php b/app/Livewire/Project/Shared/Storages/Show.php
index 7e1e2dec1..c70ebc57f 100644
--- a/app/Livewire/Project/Shared/Storages/Show.php
+++ b/app/Livewire/Project/Shared/Storages/Show.php
@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Project\Shared\Storages;
 
+use App\Livewire\Project\Service\Storage as StorageComponent;
 use App\Models\Application;
 use App\Models\LocalPersistentVolume;
 use App\Models\ScheduledVolumeBackup;
@@ -192,7 +193,7 @@ public function delete($password, $selectedActions = [])
         }
 
         $this->storage->delete();
-        $this->dispatch('refreshStorages');
+        $this->dispatch('storageCountsChanged')->to(StorageComponent::class);
         $this->dispatch('configurationChanged');
 
         return true;
diff --git a/config/constants.php b/config/constants.php
index e6e1a50f8..cb41d2f6f 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.12',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.13',
         'helper_version' => '1.0.16',
         'realtime_version' => '1.0.17',
         'railpack_version' => '0.23.0',
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index a9c5daea6..a87ca37c5 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.12"
+            "version": "4.3.13"
         },
         "nightly": {
             "version": "4.4-rc.1"
diff --git a/resources/views/components/application/configuration-sidebar.blade.php b/resources/views/components/application/configuration-sidebar.blade.php
index 078f3cafa..774bc49f0 100644
--- a/resources/views/components/application/configuration-sidebar.blade.php
+++ b/resources/views/components/application/configuration-sidebar.blade.php
@@ -261,7 +261,8 @@ class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3
                                 <span class="menu-item-label">{{ $menuItem['label'] }}</span>
                                 @if ($menuItem['badge'] ?? false)
                                     <span class="shrink-0">
-                                        <livewire:project.application.server-status-badge :application="$application" />
+                                        <livewire:project.application.server-status-badge :application="$application"
+                                            :key="'application-server-status-'.$application->uuid" />
                                     </span>
                                 @endif
                             </a>
diff --git a/resources/views/livewire/project/application/partials/domain-row.blade.php b/resources/views/livewire/project/application/partials/domain-row.blade.php
index 6c20d0a46..b41d3a431 100644
--- a/resources/views/livewire/project/application/partials/domain-row.blade.php
+++ b/resources/views/livewire/project/application/partials/domain-row.blade.php
@@ -37,9 +37,10 @@
         ->keys()
         ->first();
     $showDirection = ($showDirectionControl ?? true) && ! $isSuggested && $firstPairRowIndex === $index;
+    $domainKey = hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
 @endphp
 
-<div wire:key="domain-row-{{ $index }}-{{ md5(($isSuggested ? 's:' : '') . $row['url'] . '|' . ($row['service'] ?? '')) }}"
+<div wire:key="domain-row-{{ md5(($isSuggested ? 's:' : '') . $row['url'] . '|' . ($row['service'] ?? '')) }}"
     class="env-table-item">
     <div @class([
         'data-table-row',
@@ -185,7 +186,7 @@ class="icon-button shrink-0"
                             <x-reicon name="settings" class="size-3.5" />
                         </button>
                         <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?" buttonTitle="Remove"
-                            isErrorButton submitAction="removeDomain({{ $index }})" :actions="[
+                            isErrorButton submitAction="removeDomainByKey({{ $domainKey }})" :actions="[
                                 'This domain will be removed from the application.',
                                 'Redeploy or restart may be required for proxy changes.',
                             ]" :confirmWithPassword="false" :confirmWithText="false" step2ButtonText="Remove domain">
diff --git a/resources/views/livewire/project/database/postgresql/general.blade.php b/resources/views/livewire/project/database/postgresql/general.blade.php
index 738c46fea..130669b01 100644
--- a/resources/views/livewire/project/database/postgresql/general.blade.php
+++ b/resources/views/livewire/project/database/postgresql/general.blade.php
@@ -138,7 +138,7 @@
         <div class="divide-y divide-neutral-200 dark:divide-border-subtle">
             @forelse($initScripts ?? [] as $script)
                 <livewire:project.database.init-script :database="$database" :script="$script"
-                    :wire:key="$script['index']" />
+                    :wire:key="'init-script-'.md5($script['filename'])" />
             @empty
                 <x-empty title="No initialization scripts"
                     description="Add a SQL file to run during the first PostgreSQL initialization." />
diff --git a/resources/views/livewire/project/service/partials/domain-table.blade.php b/resources/views/livewire/project/service/partials/domain-table.blade.php
index f856285ad..f6bda32c6 100644
--- a/resources/views/livewire/project/service/partials/domain-table.blade.php
+++ b/resources/views/livewire/project/service/partials/domain-table.blade.php
@@ -61,9 +61,10 @@
                 ->reject(fn ($item) => (bool) ($item['is_suggested'] ?? false))
                 ->first(fn ($item) => $redirectPairKey($item['url']) === $pairKey)['url'] ?? null;
             $showDirection = ! $isSuggested && $firstPairRowUrl === $row['url'];
+            $domainKey = hash('sha256', $row['url'].'|'.($row['service_application_id'] ?? ''));
         @endphp
 
-        <div wire:key="svc-domain-{{ $row['service_application_id'] ?? 'x' }}-{{ $index }}-{{ md5(($isSuggested ? 's:' : '') . $row['url']) }}"
+        <div wire:key="svc-domain-{{ $row['service_application_id'] ?? 'x' }}-{{ md5(($isSuggested ? 's:' : '') . $row['url']) }}"
             class="env-table-item">
             <div @class([
                 'data-table-row',
@@ -208,7 +209,7 @@ class="icon-button shrink-0" title="Edit domain" aria-label="Edit domain">
                             </button>
                             <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?"
                                 buttonTitle="Remove" isErrorButton
-                                submitAction="removeDomain({{ $index }})" :actions="[
+                                submitAction="removeDomainByKey({{ $domainKey }})" :actions="[
                                     'This domain will be removed from the service application.',
                                     'Redeploy or restart may be required for proxy changes.',
                                 ]" :confirmWithPassword="false" :confirmWithText="false"
diff --git a/resources/views/livewire/project/service/storage.blade.php b/resources/views/livewire/project/service/storage.blade.php
index 81c19bd3f..e2749aad0 100644
--- a/resources/views/livewire/project/service/storage.blade.php
+++ b/resources/views/livewire/project/service/storage.blade.php
@@ -382,7 +382,7 @@ class="inline-flex items-center gap-0.5 rounded-lg bg-neutral-100 p-1 dark:bg-wh
                 icon-name="storages" />
         @elseif ($activeTab === 'volumes')
             @if ($hasVolumes)
-                <livewire:project.shared.storages.all wire:key="volumes-{{ $resource->id }}-{{ $this->volumeCount }}"
+                <livewire:project.shared.storages.all wire:key="volumes-{{ $resource->id }}"
                     :resource="$resource" />
             @else
                 <x-empty size="sm" title="No volumes configured"
@@ -449,7 +449,7 @@ class="inline-flex items-center gap-0.5 rounded-lg bg-neutral-100 p-1 dark:bg-wh
             @elseif ($activeTab === 'volumes')
                 @if ($hasVolumes)
                     <livewire:project.shared.storages.all
-                        wire:key="svc-volumes-{{ $resource->id }}-{{ $this->volumeCount }}"
+                        wire:key="svc-volumes-{{ $resource->id }}"
                         :resource="$resource" />
                 @else
                     <x-empty size="sm" title="No volumes configured"
diff --git a/resources/views/livewire/project/shared/get-logs.blade.php b/resources/views/livewire/project/shared/get-logs.blade.php
index 57391233d..dc64666e2 100644
--- a/resources/views/livewire/project/shared/get-logs.blade.php
+++ b/resources/views/livewire/project/shared/get-logs.blade.php
@@ -513,19 +513,23 @@ class="runtime-log-viewport logs-viewer-viewport flex min-w-0 w-full flex-col ov
                     @if ($outputs)
                         @php
                             $displayLines = collect(explode("\n", $outputs))->filter(fn($line) => trim($line) !== '');
+                            $lineOccurrences = [];
                         @endphp
                         <div id="logs" class="font-logs max-w-full cursor-default text-[11px] leading-relaxed sm:text-xs">
                             <div x-show="searchQuery.trim() && matchCount === 0"
                                 class="py-2 text-gray-500 dark:text-gray-400">
                                 No matches found.
                             </div>
-                            @foreach ($displayLines as $index => $line)
+                            @foreach ($displayLines as $line)
                                 @php
+                                    $lineFingerprint = md5($line);
+                                    $lineOccurrence = $lineOccurrences[$lineFingerprint] ?? 0;
+                                    $lineOccurrences[$lineFingerprint] = $lineOccurrence + 1;
+
                                     // Parse timestamp from log line (ISO 8601 format: 2025-12-04T11:48:39.136764033Z)
                                     $timestamp = '';
                                     $logContent = $line;
                                     if (preg_match('/^(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2})(?:\.(\d+))?Z?\s(.*)$/', $line, $matches)) {
-                                        $microseconds = isset($matches[2]) ? substr($matches[2], 0, 6) : '000000';
                                         $logContent = $matches[3];
 
                                         // Convert UTC Docker timestamp to server timezone for display
@@ -537,11 +541,9 @@ class="py-2 text-gray-500 dark:text-gray-400">
                                             // keep UTC
                                         }
                                         $timestamp = $carbonTs->format('Y-M-d H:i:s');
-                                        // Include microseconds in key for uniqueness
-                                        $lineKey = "{$timestamp}.{$microseconds}";
                                     }
                                 @endphp
-                                <div wire:key="{{ $lineKey ?? 'line-' . $index }}" data-log-line data-log-content="{{ $line }}" class="log-line logs-viewer-line">
+                                <div wire:key="log-{{ $lineFingerprint }}-{{ $lineOccurrence }}" data-log-line data-log-content="{{ $line }}" class="log-line logs-viewer-line">
                                     @if ($timestamp && $showTimeStamps)
                                         <span class="logs-viewer-timestamp text-gray-500">{{ $timestamp }}</span>
                                     @endif
diff --git a/resources/views/livewire/server/proxy/dynamic-configurations.blade.php b/resources/views/livewire/server/proxy/dynamic-configurations.blade.php
index 6e2016370..2ffc8ae77 100644
--- a/resources/views/livewire/server/proxy/dynamic-configurations.blade.php
+++ b/resources/views/livewire/server/proxy/dynamic-configurations.blade.php
@@ -60,7 +60,7 @@ class="rounded-lg border border-neutral-200 p-6 dark:border-white/[0.08]">
                                         <livewire:server.proxy.dynamic-configuration-navbar
                                             :server_id="$server->id" :server="$server" :fileName="$fileName"
                                             :value="$value ?? ''" :newFile="false"
-                                            wire:key="{{ $fileName }}-{{ $loop->index }}" />
+                                            wire:key="proxy-navbar-{{ $fileName }}" />
                                     @endif
                                 </x-slot:actions>
                                 <x-forms.textarea disabled wire:model="contents.{{ $fileName }}"
diff --git a/resources/views/livewire/settings/scheduled-jobs.blade.php b/resources/views/livewire/settings/scheduled-jobs.blade.php
index 11d0e5fdd..4cbd4a8cd 100644
--- a/resources/views/livewire/settings/scheduled-jobs.blade.php
+++ b/resources/views/livewire/settings/scheduled-jobs.blade.php
@@ -216,7 +216,7 @@ class="rounded-full bg-neutral-100 px-2 py-0.5 text-[10px] font-medium text-neut
                                 <span>Skipped</span>
                             </div>
                             @foreach ($managerRuns as $run)
-                                <div wire:key="run-{{ $loop->index }}"
+                                <div wire:key="run-{{ md5(serialize($run)) }}"
                                     x-show="{{ $loop->index }} >= (page - 1) * perPage && {{ $loop->index }} < page * perPage"
                                     class="data-table-row scheduler-runs-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.07]">
                                     <div class="font-mono text-[11px] text-neutral-500 dark:text-fg-dim">
@@ -272,7 +272,7 @@ class="data-table-row scheduler-runs-table-grid border-b border-neutral-200 last
                                     default => ucfirst(str_replace('_', ' ', $skip['reason'])),
                                 };
                             @endphp
-                            <div wire:key="skip-{{ $loop->index }}"
+                            <div wire:key="skip-{{ md5(serialize($skip)) }}"
                                 class="data-table-row skipped-jobs-table-grid border-b border-neutral-200 last:border-b-0 dark:border-white/[0.07]">
                                 <div class="font-mono text-[11px] text-neutral-500 dark:text-fg-dim">
                                     {{ $skip['timestamp'] }}
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index cac3b29a3..95d0593b7 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -402,6 +402,21 @@
     expect($this->application->fqdn)->toBe('https://www.example.com');
 });
 
+it('removes consecutive domains by stable row identity after indexes change', function () {
+    $this->application->update([
+        'fqdn' => 'https://first.example.com,https://second.example.com,https://third.example.com',
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+
+    $component
+        ->call('removeDomainByKey', hash('sha256', 'https://first.example.com|'))
+        ->call('removeDomainByKey', hash('sha256', 'https://second.example.com|'))
+        ->assertDispatched('success');
+
+    expect($this->application->fresh()->fqdn)->toBe('https://third.example.com');
+});
+
 it('does not revalidate dns on remaining domains when removing one', function () {
     $settings = InstanceSettings::get();
     $settings->is_dns_validation_enabled = true;
diff --git a/tests/Feature/FileStorageMountPathTest.php b/tests/Feature/FileStorageMountPathTest.php
index b43aae4b1..0b9e450a2 100644
--- a/tests/Feature/FileStorageMountPathTest.php
+++ b/tests/Feature/FileStorageMountPathTest.php
@@ -135,13 +135,44 @@
         ->set('mount_path', '/app/data')
         ->call('submitPersistentVolume')
         ->assertDispatched('success')
-        ->assertDispatched('refreshStorages')
+        ->assertNotDispatched('refreshStorages')
+        ->assertNotDispatched('refreshVolumeList')
         ->assertDispatched('configurationChanged')
         ->assertSet('activeTab', 'volumes')
         ->assertSet('volumeCount', 1)
         ->assertSee($this->application->uuid.'-data');
 });
 
+test('adding another volume refreshes only the mounted volume list', function () {
+    LocalPersistentVolume::create([
+        'name' => $this->application->uuid.'-first',
+        'mount_path' => '/app/first',
+        'resource_id' => $this->application->id,
+        'resource_type' => $this->application->getMorphClass(),
+    ]);
+
+    Livewire::test(Storage::class, ['resource' => $this->application])
+        ->set('name', 'second')
+        ->set('mount_path', '/app/second')
+        ->call('submitPersistentVolume')
+        ->assertDispatched('refreshVolumeList')
+        ->assertNotDispatched('refreshStorages');
+});
+
+test('deleting a volume asks only the parent storage component to refresh its counts', function () {
+    $volume = LocalPersistentVolume::create([
+        'name' => $this->application->uuid.'-data',
+        'mount_path' => '/app/data',
+        'resource_id' => $this->application->id,
+        'resource_type' => $this->application->getMorphClass(),
+    ]);
+
+    Livewire::test(All::class, ['resource' => $this->application])
+        ->call('delete', $volume->id, 'password')
+        ->assertDispatched('storageCountsChanged')
+        ->assertNotDispatched('refreshStorages');
+});
+
 test('volume storage list shows volumes added after it was mounted', function () {
     $firstVolume = LocalPersistentVolume::create([
         'name' => $this->application->uuid.'-first',
@@ -191,7 +222,9 @@
 
     Livewire::test(FileStorage::class, ['fileStorage' => $file])
         ->call('delete', 'password')
-        ->assertDispatched('configurationChanged');
+        ->assertDispatched('configurationChanged')
+        ->assertDispatched('storageCountsChanged')
+        ->assertNotDispatched('refreshStorages');
 
     expect($file->fresh())->toBeNull();
 });
diff --git a/tests/Feature/PersistentStorageVolumesLayoutTest.php b/tests/Feature/PersistentStorageVolumesLayoutTest.php
index b22d99891..f3938b87f 100644
--- a/tests/Feature/PersistentStorageVolumesLayoutTest.php
+++ b/tests/Feature/PersistentStorageVolumesLayoutTest.php
@@ -33,6 +33,16 @@
         ->and($css)->toMatch('/\.backup-table-grid\s*\{[^}]*min-width:\s*50rem;/');
 });
 
+it('keeps nested storage component keys stable when mounts are added or deleted', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/service/storage.blade.php'));
+
+    expect($view)
+        ->toContain('wire:key="volumes-{{ $resource->id }}"')
+        ->toContain('wire:key="svc-volumes-{{ $resource->id }}"')
+        ->not->toContain('wire:key="volumes-{{ $resource->id }}-{{ $this->volumeCount }}"')
+        ->not->toContain('wire:key="svc-volumes-{{ $resource->id }}-{{ $this->volumeCount }}"');
+});
+
 use App\Livewire\Project\Service\VolumeBackup\Create as CreateServiceVolumeBackup;
 use App\Livewire\Project\Shared\Storages\All;
 use App\Models\Application;
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index 76ca4f2a8..d18a9a5e5 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -127,6 +127,21 @@
         ->and(substr_count($html, "id=\"service-domain-group-{$this->apiApp->id}\""))->toBe(1);
 });
 
+it('removes consecutive service domains by stable row identity after indexes change', function () {
+    $this->apiApp->update([
+        'fqdn' => 'https://first.example.com,https://second.example.com,https://third.example.com',
+    ]);
+
+    $component = Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])]);
+
+    $component
+        ->call('removeDomainByKey', hash('sha256', 'https://first.example.com|'.$this->apiApp->id))
+        ->call('removeDomainByKey', hash('sha256', 'https://second.example.com|'.$this->apiApp->id))
+        ->assertDispatched('success');
+
+    expect($this->apiApp->fresh()->fqdn)->toBe('https://third.example.com');
+});
+
 it('shows and persists the HTTP redirect control for HTTPS service applications', function () {
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->assertSee('Redirect HTTP to HTTPS')
diff --git a/tests/Feature/StableNestedLivewireKeysTest.php b/tests/Feature/StableNestedLivewireKeysTest.php
new file mode 100644
index 000000000..c9b90bca9
--- /dev/null
+++ b/tests/Feature/StableNestedLivewireKeysTest.php
@@ -0,0 +1,64 @@
+<?php
+
+it('does not key nested Livewire components by mutable list positions', function () {
+    $postgresView = file_get_contents(resource_path('views/livewire/project/database/postgresql/general.blade.php'));
+    $proxyView = file_get_contents(resource_path('views/livewire/server/proxy/dynamic-configurations.blade.php'));
+
+    expect($postgresView)
+        ->toContain(':wire:key="\'init-script-\'.md5($script[\'filename\'])"')
+        ->not->toContain(':wire:key="$script[\'index\']"');
+
+    expect($proxyView)
+        ->toContain('wire:key="proxy-navbar-{{ $fileName }}"')
+        ->not->toContain('wire:key="{{ $fileName }}-{{ $loop->index }}"');
+});
+
+it('saves reindexed PostgreSQL scripts by their original stable identity', function () {
+    $editor = file_get_contents(app_path('Livewire/Project/Database/InitScript.php'));
+    $parent = file_get_contents(app_path('Livewire/Project/Database/Postgresql/General.php'));
+
+    expect($editor)
+        ->toContain('public string $originalFilename;')
+        ->toContain("dispatch('save_init_script', \$this->script, \$this->originalFilename)");
+
+    expect($parent)
+        ->toContain('public function save_init_script($script, string $originalFilename)')
+        ->toContain("firstWhere('filename', \$originalFilename)");
+});
+
+it('keeps editable and refreshed list row keys independent of their positions', function () {
+    $applicationDomains = file_get_contents(resource_path('views/livewire/project/application/partials/domain-row.blade.php'));
+    $serviceDomains = file_get_contents(resource_path('views/livewire/project/service/partials/domain-table.blade.php'));
+    $scheduledJobs = file_get_contents(resource_path('views/livewire/settings/scheduled-jobs.blade.php'));
+
+    expect($applicationDomains)
+        ->not->toContain('wire:key="domain-row-{{ $index }}-')
+        ->toContain('wire:key="domain-row-{{ md5(');
+
+    expect($serviceDomains)
+        ->not->toContain('-{{ $index }}-')
+        ->toContain('wire:key="svc-domain-{{ $row[\'service_application_id\'] ?? \'x\' }}-{{ md5(');
+
+    expect($scheduledJobs)
+        ->not->toContain('wire:key="run-{{ $loop->index }}"')
+        ->not->toContain('wire:key="skip-{{ $loop->index }}"')
+        ->toContain('wire:key="run-{{ md5(serialize($run)) }}"')
+        ->toContain('wire:key="skip-{{ md5(serialize($skip)) }}"');
+});
+
+it('keys nested Livewire status components rendered inside navigation loops', function () {
+    $sidebar = file_get_contents(resource_path('views/components/application/configuration-sidebar.blade.php'));
+
+    expect($sidebar)
+        ->toContain(':key="\'application-server-status-\'.$application->uuid"');
+});
+
+it('keys rolling log lines by content occurrence instead of list position', function () {
+    $logs = file_get_contents(resource_path('views/livewire/project/shared/get-logs.blade.php'));
+
+    expect($logs)
+        ->toContain('$lineOccurrences = [];')
+        ->toContain('$lineFingerprint = md5($line);')
+        ->toContain('wire:key="log-{{ $lineFingerprint }}-{{ $lineOccurrence }}"')
+        ->not->toContain("'line-' . \$index");
+});
diff --git a/tests/Feature/TeamScopedDestinationTest.php b/tests/Feature/TeamScopedDestinationTest.php
index 3088fb4db..be4ee0e4c 100644
--- a/tests/Feature/TeamScopedDestinationTest.php
+++ b/tests/Feature/TeamScopedDestinationTest.php
@@ -275,6 +275,23 @@
 });
 
 describe('Destination/Show team scope', function () {
+    test('deleting a destination redirects without rendering the deleted destination', function () {
+        $destination = SwarmDocker::create([
+            'uuid' => fake()->uuid(),
+            'name' => 'swarm-a-'.fake()->unique()->word(),
+            'network' => 'swarm-a-'.fake()->unique()->word(),
+            'server_id' => $this->serverA->id,
+        ]);
+
+        $component = Livewire::test(DestinationShow::class, ['destination_uuid' => $destination->uuid])
+            ->call('delete')
+            ->assertRedirect(route('destination.index'));
+
+        expect($component->effects)
+            ->toHaveKey('redirectUsingNavigate', true);
+        expect($destination->fresh())->toBeNull();
+    });
+
     test('mount with other team destination UUID redirects to index', function () {
         $component = Livewire::test(DestinationShow::class, ['destination_uuid' => $this->destinationB->uuid]);
 
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index d279087c2..9af95fd06 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,8 +23,8 @@
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.11'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.11')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.13'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.13')
         ->and($versions['coolify']['nightly']['version'])->toBe('4.4-rc.1')
         ->and($nightlyVersions)->toBe($versions);
 });
diff --git a/versions.json b/versions.json
index a9c5daea6..a87ca37c5 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.12"
+            "version": "4.3.13"
         },
         "nightly": {
             "version": "4.4-rc.1"

From 1639941da715fb979e33258c3ca2af940bb45243 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 28 Aug 2026 09:34:10 +0200
Subject: [PATCH 07/55] fix(domains): reject single-label hostnames for app and
 service domains

---
 app/Support/ValidationPatterns.php       | 10 +++++++++-
 tests/Feature/ApplicationDomainsTest.php |  9 +++++++++
 tests/Feature/ServiceDomainsTest.php     | 12 ++++++++++++
 tests/Unit/ValidationPatternsTest.php    |  6 ++++++
 4 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/app/Support/ValidationPatterns.php b/app/Support/ValidationPatterns.php
index 41b27f9ff..5c02b8426 100644
--- a/app/Support/ValidationPatterns.php
+++ b/app/Support/ValidationPatterns.php
@@ -570,8 +570,16 @@ public static function validateApplicationDomains(mixed $value): array
                 continue;
             }
 
-            if (blank(parse_url($url, PHP_URL_HOST))) {
+            $host = parse_url($url, PHP_URL_HOST);
+            if (blank($host)) {
                 $errors[] = "Invalid URL: {$url}";
+
+                continue;
+            }
+
+            $unwrappedHost = trim((string) $host, '[]');
+            if (! str_contains($unwrappedHost, '.') && filter_var($unwrappedHost, FILTER_VALIDATE_IP) === false) {
+                $errors[] = "Invalid URL: {$url}. The hostname must be a fully qualified domain name.";
             }
         }
 
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index 95d0593b7..43d153559 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -98,6 +98,15 @@
         ->and($validator->errors()->has('newDomain'))->toBeTrue();
 });
 
+it('does not add a single-label hostname as an application domain', function () {
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'aaa')
+        ->call('addDomain')
+        ->assertDispatched('error');
+
+    expect($this->application->fresh()->fqdn)->toBeNull();
+});
+
 it('lists existing domains as individual rows', function () {
     $this->application->update([
         'fqdn' => 'https://example.com,https://www.example.com,https://another.example.com,https://www.another.example.com',
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index d18a9a5e5..4c30ef619 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -193,6 +193,18 @@
         ->assertSet('forceSaveDns', false);
 });
 
+it('does not add a single-label hostname as a service domain', function () {
+    $this->apiApp->update(['fqdn' => null]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('newServiceApplicationId', $this->apiApp->id)
+        ->set('newDomainParts.host', 'aaa')
+        ->call('addDomain')
+        ->assertDispatched('error');
+
+    expect($this->apiApp->fresh()->fqdn)->toBeNull();
+});
+
 it('shows dns entries control next to Add', function () {
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->assertSuccessful()
diff --git a/tests/Unit/ValidationPatternsTest.php b/tests/Unit/ValidationPatternsTest.php
index cfcceac38..0b3252d7e 100644
--- a/tests/Unit/ValidationPatternsTest.php
+++ b/tests/Unit/ValidationPatternsTest.php
@@ -191,3 +191,9 @@
 it('validates application domains with underscores in the hostname', function () {
     expect(ValidationPatterns::validateApplicationDomains('https://myapp_service.example.com'))->toBeEmpty();
 });
+
+it('rejects single-label application hostnames but allows IP addresses', function () {
+    expect(ValidationPatterns::validateApplicationDomains('https://aaa'))->not->toBeEmpty()
+        ->and(ValidationPatterns::validateApplicationDomains('https://localhost'))->not->toBeEmpty()
+        ->and(ValidationPatterns::validateApplicationDomains('http://192.0.2.10:8000'))->toBeEmpty();
+});

From 28fb694fcb9202f04492b08690c1a2662029d7dd Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 28 Aug 2026 09:46:57 +0200
Subject: [PATCH 08/55] fix: preserve custom names and use Livewire redirects

Resolve custom container names consistently, clean up legacy container names during deployments, and route Livewire resource redirects through the navigation helper.
---
 app/Jobs/ApplicationDeploymentJob.php         | 40 ++++++++++---
 app/Livewire/Project/Database/BackupEdit.php  |  4 +-
 app/Livewire/Project/Service/Index.php        |  4 +-
 .../Project/Shared/ScheduledTask/Show.php     |  4 +-
 app/Livewire/Source/Github/Change.php         |  2 +-
 app/Livewire/Source/Gitlab/Change.php         |  2 +-
 app/Livewire/Storage/Show.php                 |  2 +-
 ...plicationDeploymentContainerNamingTest.php | 58 +++++++++++++++++++
 ...ationDeploymentCustomDockerOptionsTest.php |  5 +-
 tests/Unit/LivewireInternalRedirectTest.php   | 43 ++++++++++++++
 10 files changed, 144 insertions(+), 20 deletions(-)
 create mode 100644 tests/Unit/ApplicationDeploymentContainerNamingTest.php
 create mode 100644 tests/Unit/LivewireInternalRedirectTest.php

diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index 327fea25e..7168aea5f 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -261,14 +261,7 @@ public function __construct(public int $application_deployment_queue_id)
         $this->configuration_dir = application_configuration_dir()."/{$this->application->uuid}";
         $this->is_debug_enabled = $this->application->settings->is_debug_enabled;
 
-        $this->container_name = generateApplicationContainerName($this->application, $this->pull_request_id);
-        if ($this->application->settings->custom_internal_name && ! $this->application->settings->is_consistent_container_name_enabled) {
-            if ($this->pull_request_id === 0) {
-                $this->container_name = $this->application->settings->custom_internal_name;
-            } else {
-                $this->container_name = addPreviewDeploymentSuffix($this->application->settings->custom_internal_name, $this->pull_request_id);
-            }
-        }
+        $this->container_name = $this->resolveContainerName();
 
         $this->saved_outputs = collect();
 
@@ -1986,6 +1979,19 @@ private function rolling_update()
         }
     }
 
+    private function resolveContainerName(): string
+    {
+        if (str($this->application->settings->custom_internal_name)->isEmpty()) {
+            return generateApplicationContainerName($this->application, $this->pull_request_id);
+        }
+
+        if ($this->pull_request_id === 0) {
+            return $this->application->settings->custom_internal_name;
+        }
+
+        return addPreviewDeploymentSuffix($this->application->settings->custom_internal_name, $this->pull_request_id);
+    }
+
     private function health_check()
     {
         try {
@@ -3428,6 +3434,9 @@ private function generate_compose_file()
             $custom_compose = convertDockerRunToCompose($this->application->custom_docker_run_options);
             if ((bool) $this->application->settings->is_consistent_container_name_enabled) {
                 $docker_compose['services'][$this->application->uuid] = $docker_compose['services'][$this->container_name];
+                if ($this->container_name !== $this->application->uuid) {
+                    unset($docker_compose['services'][$this->container_name]);
+                }
                 if (count($custom_compose) > 0) {
                     $ipv4 = data_get($custom_compose, 'ip.0');
                     $ipv6 = data_get($custom_compose, 'ip6.0');
@@ -4027,7 +4036,10 @@ private function stop_running_container(bool $force = false)
             $this->application_deployment_queue->addLogEntry('Removing old containers.');
             if ($this->newVersionIsHealthy || $force) {
                 if ($this->application->settings->is_consistent_container_name_enabled || str($this->application->settings->custom_internal_name)->isNotEmpty()) {
-                    $this->graceful_shutdown_container($this->container_name);
+                    $containers = getCurrentApplicationContainerStatus($this->server, $this->application->id, $this->pull_request_id);
+                    $this->containerNamesToRemove($containers)->each(function (string $containerName) {
+                        $this->graceful_shutdown_container($containerName);
+                    });
                 } else {
                     $containers = getCurrentApplicationContainerStatus($this->server, $this->application->id, $this->pull_request_id);
                     if ($this->pull_request_id === 0) {
@@ -4066,6 +4078,16 @@ private function stop_running_container(bool $force = false)
         }
     }
 
+    private function containerNamesToRemove(Collection $containers): Collection
+    {
+        return $containers
+            ->pluck('Names')
+            ->push($this->container_name)
+            ->filter()
+            ->unique()
+            ->values();
+    }
+
     private function start_by_compose_file()
     {
         try {
diff --git a/app/Livewire/Project/Database/BackupEdit.php b/app/Livewire/Project/Database/BackupEdit.php
index 2c04f5ba9..2cd0d7673 100644
--- a/app/Livewire/Project/Database/BackupEdit.php
+++ b/app/Livewire/Project/Database/BackupEdit.php
@@ -212,14 +212,14 @@ public function delete($password, $selectedActions = [])
             if ($this->backup->database->getMorphClass() === ServiceDatabase::class) {
                 $serviceDatabase = $this->backup->database;
 
-                return redirect()->route('project.service.database.backups', [
+                return redirectRoute($this, 'project.service.database.backups', [
                     'project_uuid' => $this->parameters['project_uuid'],
                     'environment_uuid' => $this->parameters['environment_uuid'],
                     'service_uuid' => $serviceDatabase->service->uuid,
                     'stack_service_uuid' => $serviceDatabase->uuid,
                 ]);
             } else {
-                return redirect()->route('project.database.backup.index', [
+                return redirectRoute($this, 'project.database.backup.index', [
                     'project_uuid' => $this->parameters['project_uuid'],
                     'environment_uuid' => $this->parameters['environment_uuid'],
                     'database_uuid' => $this->parameters['database_uuid'],
diff --git a/app/Livewire/Project/Service/Index.php b/app/Livewire/Project/Service/Index.php
index d93ed7c02..6193f14b5 100644
--- a/app/Livewire/Project/Service/Index.php
+++ b/app/Livewire/Project/Service/Index.php
@@ -428,7 +428,7 @@ public function deleteApplication($password, $selectedActions = [])
             $this->serviceApplication->delete();
             $this->dispatch('success', 'Application deleted.');
 
-            return redirect()->route('project.service.configuration', $this->parameters);
+            return redirectRoute($this, 'project.service.configuration', $this->parameters);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -462,7 +462,7 @@ public function convertToDatabase()
                 $serviceApplication->delete();
             });
 
-            return redirect()->route('project.service.configuration', $redirectParams);
+            return redirectRoute($this, 'project.service.configuration', $redirectParams);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Project/Shared/ScheduledTask/Show.php b/app/Livewire/Project/Shared/ScheduledTask/Show.php
index 11df00153..4eb5c071c 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Show.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Show.php
@@ -169,9 +169,9 @@ public function delete()
             $this->task->delete();
 
             if ($this->type === 'application') {
-                return redirect()->route('project.application.scheduled-tasks.show', $this->parameters);
+                return redirectRoute($this, 'project.application.scheduled-tasks.show', $this->parameters);
             } else {
-                return redirect()->route('project.service.scheduled-tasks.show', $this->parameters);
+                return redirectRoute($this, 'project.service.scheduled-tasks.show', $this->parameters);
             }
         } catch (\Exception $e) {
             return handleError($e);
diff --git a/app/Livewire/Source/Github/Change.php b/app/Livewire/Source/Github/Change.php
index 2570c3a1b..001d31c37 100644
--- a/app/Livewire/Source/Github/Change.php
+++ b/app/Livewire/Source/Github/Change.php
@@ -484,7 +484,7 @@ public function delete()
             // @can and canGate checks against a deleted model (null team_id TypeError).
             $this->github_app = null;
 
-            return redirect()->route('source.all');
+            return redirectRoute($this, 'source.all');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Source/Gitlab/Change.php b/app/Livewire/Source/Gitlab/Change.php
index dd0284582..29374105b 100644
--- a/app/Livewire/Source/Gitlab/Change.php
+++ b/app/Livewire/Source/Gitlab/Change.php
@@ -338,7 +338,7 @@ public function delete()
             // @can and canGate checks against a deleted model (null team_id TypeError).
             $this->gitlab_app = null;
 
-            return redirect()->route('source.all');
+            return redirectRoute($this, 'source.all');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/app/Livewire/Storage/Show.php b/app/Livewire/Storage/Show.php
index 89782d686..17abd19e5 100644
--- a/app/Livewire/Storage/Show.php
+++ b/app/Livewire/Storage/Show.php
@@ -43,7 +43,7 @@ public function delete()
 
             $this->storage->delete();
 
-            return redirect()->route('storage.index');
+            return redirectRoute($this, 'storage.index');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/tests/Unit/ApplicationDeploymentContainerNamingTest.php b/tests/Unit/ApplicationDeploymentContainerNamingTest.php
new file mode 100644
index 000000000..b7b63ae54
--- /dev/null
+++ b/tests/Unit/ApplicationDeploymentContainerNamingTest.php
@@ -0,0 +1,58 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\ApplicationSetting;
+use Illuminate\Support\Collection;
+
+function containerNamingJob(Application $application, int $pullRequestId = 0): array
+{
+    $job = (new ReflectionClass(ApplicationDeploymentJob::class))->newInstanceWithoutConstructor();
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+    $reflection->getProperty('application')->setValue($job, $application);
+    $reflection->getProperty('pull_request_id')->setValue($job, $pullRequestId);
+
+    return [$job, $reflection];
+}
+
+function applicationWithContainerNaming(string $customName = 'shadowuw'): Application
+{
+    $application = new Application;
+    $application->forceFill(['uuid' => 'application-uuid']);
+    $application->setRelation('settings', new ApplicationSetting([
+        'custom_internal_name' => $customName,
+        'is_consistent_container_name_enabled' => true,
+    ]));
+
+    return $application;
+}
+
+it('uses the custom container name when consistent naming is enabled', function () {
+    $application = applicationWithContainerNaming();
+
+    [$job, $reflection] = containerNamingJob($application);
+
+    expect($reflection->getMethod('resolveContainerName')->invoke($job))->toBe('shadowuw');
+});
+
+it('adds the pull request suffix to a custom container name', function () {
+    $application = applicationWithContainerNaming();
+
+    [$job, $reflection] = containerNamingJob($application, 42);
+
+    expect($reflection->getMethod('resolveContainerName')->invoke($job))->toBe('shadowuw-pr-42');
+});
+
+it('includes old generated containers when cleaning up a consistent deployment', function () {
+    $application = applicationWithContainerNaming();
+    [$job, $reflection] = containerNamingJob($application);
+    $reflection->getProperty('container_name')->setValue($job, 'shadowuw');
+
+    $containers = new Collection([
+        ['Names' => 'application-uuid-192238854305'],
+        ['Names' => 'shadowuw'],
+    ]);
+
+    expect($reflection->getMethod('containerNamesToRemove')->invoke($job, $containers)->all())
+        ->toBe(['application-uuid-192238854305', 'shadowuw']);
+});
diff --git a/tests/Unit/ApplicationDeploymentCustomDockerOptionsTest.php b/tests/Unit/ApplicationDeploymentCustomDockerOptionsTest.php
index 9c671156d..234f216bd 100644
--- a/tests/Unit/ApplicationDeploymentCustomDockerOptionsTest.php
+++ b/tests/Unit/ApplicationDeploymentCustomDockerOptionsTest.php
@@ -64,7 +64,7 @@ function generateComposeServiceWithCustomDockerOptions(string $customDockerOptio
         'server' => $server,
         'mainServer' => $server,
         'pull_request_id' => 0,
-        'container_name' => $application->uuid,
+        'container_name' => 'custom-internal-name',
         'production_image_name' => 'example/app:latest',
         'deployment_uuid' => 'deployment-uuid',
         'workdir' => '/artifacts/custom-docker-options-app',
@@ -82,7 +82,8 @@ function generateComposeServiceWithCustomDockerOptions(string $customDockerOptio
 
 it('applies an entrypoint when consistent naming and a custom internal name are configured', function () {
     expect(generateComposeServiceWithCustomDockerOptions('--entrypoint "/bin/echo hello world"'))
-        ->toHaveKey('entrypoint', '/bin/echo hello world');
+        ->toHaveKey('entrypoint', '/bin/echo hello world')
+        ->toHaveKey('container_name', 'custom-internal-name');
 });
 
 it('preserves custom network aliases when a static IP is configured', function () {
diff --git a/tests/Unit/LivewireInternalRedirectTest.php b/tests/Unit/LivewireInternalRedirectTest.php
new file mode 100644
index 000000000..7dc19a81b
--- /dev/null
+++ b/tests/Unit/LivewireInternalRedirectTest.php
@@ -0,0 +1,43 @@
+<?php
+
+it('uses Livewire navigation after deleting or converting page resources', function (string $path, array $redirects) {
+    $contents = file_get_contents(dirname(__DIR__, 2).'/'.$path);
+
+    foreach ($redirects as $redirect) {
+        expect($contents)->toContain($redirect);
+    }
+})->with([
+    'S3 storage' => [
+        'app/Livewire/Storage/Show.php',
+        ["redirectRoute(\$this, 'storage.index')"],
+    ],
+    'database backup schedule' => [
+        'app/Livewire/Project/Database/BackupEdit.php',
+        [
+            "redirectRoute(\$this, 'project.service.database.backups'",
+            "redirectRoute(\$this, 'project.database.backup.index'",
+        ],
+    ],
+    'scheduled task' => [
+        'app/Livewire/Project/Shared/ScheduledTask/Show.php',
+        [
+            "redirectRoute(\$this, 'project.application.scheduled-tasks.show'",
+            "redirectRoute(\$this, 'project.service.scheduled-tasks.show'",
+        ],
+    ],
+    'GitHub source' => [
+        'app/Livewire/Source/Github/Change.php',
+        ["redirectRoute(\$this, 'source.all')"],
+    ],
+    'GitLab source' => [
+        'app/Livewire/Source/Gitlab/Change.php',
+        ["redirectRoute(\$this, 'source.all')"],
+    ],
+    'service resources' => [
+        'app/Livewire/Project/Service/Index.php',
+        [
+            "return redirectRoute(\$this, 'project.service.configuration', \$this->parameters);",
+            "return redirectRoute(\$this, 'project.service.configuration', \$redirectParams);",
+        ],
+    ],
+]);

From 51a8a97d876cdbd6beeced554dbb8b4bec5a3bb4 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 28 Aug 2026 10:49:05 +0200
Subject: [PATCH 09/55] fix(docker): create standalone networks without the
 swarm driver

Use the default bridge network driver for standalone destinations and bump the Coolify version to 4.3.14.
---
 app/Models/StandaloneDocker.php            | 10 ++++++++--
 config/constants.php                       |  2 +-
 other/nightly/versions.json                |  2 +-
 tests/Unit/DockerNetworkInjectionTest.php  |  8 ++++++++
 tests/Unit/ProductionImageWorkflowTest.php |  4 ++--
 versions.json                              |  2 +-
 6 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/app/Models/StandaloneDocker.php b/app/Models/StandaloneDocker.php
index 604a245fc..e7e0a8c10 100644
--- a/app/Models/StandaloneDocker.php
+++ b/app/Models/StandaloneDocker.php
@@ -43,14 +43,20 @@ protected static function boot()
             }
 
             $server = $newStandaloneDocker->server;
-            $safeNetwork = escapeshellarg($newStandaloneDocker->network);
             instant_remote_process([
-                "docker network inspect {$safeNetwork} >/dev/null 2>&1 || docker network create --driver overlay --attachable {$safeNetwork} >/dev/null",
+                $newStandaloneDocker->networkCreateCommand(),
             ], $server, false);
             ConnectProxyToNetworksJob::dispatchSync($server);
         });
     }
 
+    public function networkCreateCommand(): string
+    {
+        $safeNetwork = escapeshellarg($this->network);
+
+        return "docker network inspect {$safeNetwork} >/dev/null 2>&1 || docker network create --attachable {$safeNetwork} >/dev/null";
+    }
+
     public function setNetworkAttribute(string $value): void
     {
         if (! ValidationPatterns::isValidDockerNetwork($value)) {
diff --git a/config/constants.php b/config/constants.php
index cb41d2f6f..71477d73a 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.13',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.14',
         'helper_version' => '1.0.16',
         'realtime_version' => '1.0.17',
         'railpack_version' => '0.23.0',
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index a87ca37c5..2331c439a 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.13"
+            "version": "4.3.14"
         },
         "nightly": {
             "version": "4.4-rc.1"
diff --git a/tests/Unit/DockerNetworkInjectionTest.php b/tests/Unit/DockerNetworkInjectionTest.php
index b3ca4ac60..9427aa87d 100644
--- a/tests/Unit/DockerNetworkInjectionTest.php
+++ b/tests/Unit/DockerNetworkInjectionTest.php
@@ -27,6 +27,14 @@
     'alphanumeric' => 'network123',
 ]);
 
+it('creates standalone destinations with a bridge network', function () {
+    $model = new StandaloneDocker;
+    $model->network = 'test-network';
+
+    expect($model->networkCreateCommand())
+        ->toBe("docker network inspect 'test-network' >/dev/null 2>&1 || docker network create --attachable 'test-network' >/dev/null");
+});
+
 it('SwarmDocker rejects network names with shell metacharacters', function (string $network) {
     $model = new SwarmDocker;
     $model->network = $network;
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index 9af95fd06..857027a3c 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,8 +23,8 @@
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.13'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.13')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.14'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.14')
         ->and($versions['coolify']['nightly']['version'])->toBe('4.4-rc.1')
         ->and($nightlyVersions)->toBe($versions);
 });
diff --git a/versions.json b/versions.json
index a87ca37c5..2331c439a 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.13"
+            "version": "4.3.14"
         },
         "nightly": {
             "version": "4.4-rc.1"

From aff581043f095c7adbbfb1adfbd3aa94023da792 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 28 Aug 2026 14:41:48 +0200
Subject: [PATCH 10/55] fix(realtime): harden terminal command handling

---
 config/constants.php                          |   2 +-
 docker-compose.prod.yml                       |   2 +-
 docker-compose.windows.yml                    |   2 +-
 docker/coolify-realtime/terminal-server.js    |  14 +-
 docker/coolify-realtime/terminal-utils.js     | 130 ++++++++++++++++++
 .../coolify-realtime/terminal-utils.test.js   |  75 ++++++++++
 6 files changed, 221 insertions(+), 4 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index 71477d73a..3edc2e77e 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -4,7 +4,7 @@
     'coolify' => [
         'version' => env('COOLIFY_VERSION') ?: '4.3.14',
         'helper_version' => '1.0.16',
-        'realtime_version' => '1.0.17',
+        'realtime_version' => '1.0.18',
         'railpack_version' => '0.23.0',
         'self_hosted' => env('SELF_HOSTED', true),
         'autoupdate' => env('AUTOUPDATE'),
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 0d7caceb9..ebf12379d 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -62,7 +62,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.17'
+    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.18'
     ports:
       - "${SOKETI_PORT:-6001}:6001"
       - "6002:6002"
diff --git a/docker-compose.windows.yml b/docker-compose.windows.yml
index 33709873f..cc266e556 100644
--- a/docker-compose.windows.yml
+++ b/docker-compose.windows.yml
@@ -97,7 +97,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.17'
+    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.18'
     pull_policy: always
     container_name: coolify-realtime
     restart: always
diff --git a/docker/coolify-realtime/terminal-server.js b/docker/coolify-realtime/terminal-server.js
index 0d7b6dcdd..b72574c8d 100755
--- a/docker/coolify-realtime/terminal-server.js
+++ b/docker/coolify-realtime/terminal-server.js
@@ -10,6 +10,8 @@ import {
     extractTimeout,
     getTerminalSessionTimeout,
     isAuthorizedTargetHost,
+    sanitizeSshArgs,
+    validateSshArgs,
 } from './terminal-utils.js';
 
 async function postToCoolify(path, headers) {
@@ -384,6 +386,16 @@ async function handleCommand(ws, command, userId) {
         return;
     }
 
+    if (!validateSshArgs(sshArgs, userSession.authorizedIPs)) {
+        logTerminal('warn', 'Rejecting terminal command because its SSH arguments are not allowed.', {
+            userId,
+            targetHost,
+        });
+        ws.send('Invalid SSH command: Unsupported SSH arguments');
+        return;
+    }
+    const sanitizedSshArgs = sanitizeSshArgs(sshArgs);
+
     const options = {
         name: 'xterm-color',
         cols: 80,
@@ -401,7 +413,7 @@ async function handleCommand(ws, command, userId) {
         commandTimeout,
         terminalSessionTimeout,
     });
-    const ptyProcess = pty.spawn('ssh', sshArgs.concat([hereDocContent]), options);
+    const ptyProcess = pty.spawn('ssh', sanitizedSshArgs.concat([hereDocContent]), options);
 
     userSession.ptyProcess = ptyProcess;
     userSession.isActive = true;
diff --git a/docker/coolify-realtime/terminal-utils.js b/docker/coolify-realtime/terminal-utils.js
index 8769d62d9..4e86dc1f7 100644
--- a/docker/coolify-realtime/terminal-utils.js
+++ b/docker/coolify-realtime/terminal-utils.js
@@ -131,3 +131,133 @@ export function isAuthorizedTargetHost(targetHost, authorizedHosts = []) {
         .map(host => normalizeHostForAuthorization(host))
         .includes(normalizedTargetHost);
 }
+
+const REQUIRED_SSH_OPTIONS = new Set([
+    'StrictHostKeyChecking',
+    'UserKnownHostsFile',
+    'PasswordAuthentication',
+    'ConnectTimeout',
+    'ServerAliveInterval',
+    'RequestTTY',
+    'LogLevel',
+]);
+
+function isAllowedSshOption(name, value) {
+    const fixedOptions = {
+        StrictHostKeyChecking: 'no',
+        UserKnownHostsFile: '/dev/null',
+        PasswordAuthentication: 'no',
+        LogLevel: 'ERROR',
+        ControlMaster: 'auto',
+        ProxyCommand: 'cloudflared access ssh --hostname %h',
+    };
+
+    if (Object.hasOwn(fixedOptions, name)) {
+        return value === fixedOptions[name];
+    }
+
+    if (name === 'RequestTTY') {
+        return value === 'yes' || value === 'no';
+    }
+
+    if (name === 'ConnectTimeout' || name === 'ServerAliveInterval' || name === 'ControlPersist') {
+        return /^\d+$/.test(value) && Number(value) > 0;
+    }
+
+    if (name === 'ControlPath') {
+        return /^\/var\/www\/html\/storage\/app\/ssh\/mux\/mux_[a-zA-Z0-9_-]+$/.test(value);
+    }
+
+    return false;
+}
+
+export function validateSshArgs(sshArgs, authorizedHosts = []) {
+    if (!Array.isArray(sshArgs) || sshArgs.length === 0) {
+        return false;
+    }
+
+    const seenOptions = new Set();
+    let hasIdentityFile = false;
+    let hasPort = false;
+    let targetHost = null;
+
+    for (let index = 0; index < sshArgs.length; index++) {
+        const argument = sshArgs[index];
+
+        if (typeof argument !== 'string' || /[\0\r\n]/.test(argument)) {
+            return false;
+        }
+
+        if (argument === '-i') {
+            const identityFile = sshArgs[++index];
+            if (hasIdentityFile || !/^\/var\/www\/html\/storage\/app\/ssh\/keys\/ssh_key@[a-zA-Z0-9_-]+$/.test(identityFile ?? '')) {
+                return false;
+            }
+            hasIdentityFile = true;
+            continue;
+        }
+
+        if (argument === '-p') {
+            const port = sshArgs[++index];
+            if (hasPort || !/^\d+$/.test(port ?? '') || Number(port) < 1 || Number(port) > 65535) {
+                return false;
+            }
+            hasPort = true;
+            continue;
+        }
+
+        if (argument === '-o') {
+            const option = sshArgs[++index];
+            const separator = option?.indexOf('=') ?? -1;
+            if (separator < 1) {
+                return false;
+            }
+
+            const name = option.slice(0, separator);
+            const value = option.slice(separator + 1);
+            if (seenOptions.has(name) || !isAllowedSshOption(name, value)) {
+                return false;
+            }
+            seenOptions.add(name);
+            continue;
+        }
+
+        if (/^[a-zA-Z0-9_][a-zA-Z0-9._-]*@[^@]+$/.test(argument) && targetHost === null) {
+            targetHost = extractTargetHost([argument]);
+            continue;
+        }
+
+        return false;
+    }
+
+    const hasRequiredOptions = [...REQUIRED_SSH_OPTIONS].every(option => seenOptions.has(option));
+    const hasCompleteMultiplexingOptions =
+        !['ControlMaster', 'ControlPath', 'ControlPersist'].some(option => seenOptions.has(option))
+        || ['ControlMaster', 'ControlPath', 'ControlPersist'].every(option => seenOptions.has(option));
+
+    return hasIdentityFile
+        && hasPort
+        && targetHost !== null
+        && hasRequiredOptions
+        && hasCompleteMultiplexingOptions
+        && isAuthorizedTargetHost(targetHost, authorizedHosts);
+}
+
+export function sanitizeSshArgs(sshArgs) {
+    const multiplexingOptions = new Set(['ControlMaster', 'ControlPath', 'ControlPersist']);
+    const sanitizedArgs = [];
+
+    for (let index = 0; index < sshArgs.length; index++) {
+        if (sshArgs[index] === '-o') {
+            const optionName = sshArgs[index + 1]?.split('=', 1)[0];
+            if (multiplexingOptions.has(optionName)) {
+                index++;
+                continue;
+            }
+        }
+
+        sanitizedArgs.push(sshArgs[index]);
+    }
+
+    return sanitizedArgs;
+}
diff --git a/docker/coolify-realtime/terminal-utils.test.js b/docker/coolify-realtime/terminal-utils.test.js
index bf863099b..5ca0be830 100644
--- a/docker/coolify-realtime/terminal-utils.test.js
+++ b/docker/coolify-realtime/terminal-utils.test.js
@@ -7,6 +7,8 @@ import {
     getTerminalSessionTimeout,
     isAuthorizedTargetHost,
     normalizeHostForAuthorization,
+    sanitizeSshArgs,
+    validateSshArgs,
 } from './terminal-utils.js';
 
 test('extractTargetHost normalizes quoted IPv4 hosts from generated ssh commands', () => {
@@ -48,6 +50,79 @@ test('isAuthorizedTargetHost rejects hosts that are not in the allowlist', () =>
     assert.equal(isAuthorizedTargetHost("'10.0.0.9'", ['10.0.0.5']), false);
 });
 
+test('validateSshArgs accepts the SSH arguments generated by Coolify', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 3600 ssh -i /var/www/html/storage/app/ssh/keys/ssh_key@cm123 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o ConnectTimeout=10 -o ServerAliveInterval=20 -o RequestTTY=no -o LogLevel=ERROR -p '22' 'root'@'10.0.0.5' 'bash -se' << \\$abc\necho hi\nabc"
+    );
+
+    assert.equal(validateSshArgs(sshArgs, ['10.0.0.5']), true);
+});
+
+test('validateSshArgs rejects an injected ProxyCommand', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 300 ssh -o 'ProxyCommand=/bin/busybox id >/tmp/marker' root@10.0.0.5 'bash -se' << \\ENDSSH\nENDSSH"
+    );
+
+    assert.equal(validateSshArgs(sshArgs, ['10.0.0.5']), false);
+});
+
+test('validateSshArgs accepts only the fixed Cloudflare ProxyCommand', () => {
+    const validArgs = extractSshArgs(
+        "timeout 3600 ssh -o ProxyCommand='cloudflared access ssh --hostname %h' -i /var/www/html/storage/app/ssh/keys/ssh_key@cm123 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o ConnectTimeout=10 -o ServerAliveInterval=20 -o RequestTTY=no -o LogLevel=ERROR -p 22 root@example.com 'bash -se' << \\$abc\necho hi\nabc"
+    );
+    const maliciousArgs = [...validArgs];
+    maliciousArgs[1] = 'ProxyCommand=cloudflared access ssh --hostname %h; id';
+
+    assert.equal(validateSshArgs(validArgs, ['example.com']), true);
+    assert.equal(validateSshArgs(maliciousArgs, ['example.com']), false);
+});
+
+test('validateSshArgs rejects unknown SSH options and key paths', () => {
+    const baseArgs = extractSshArgs(
+        "timeout 3600 ssh -i /var/www/html/storage/app/ssh/keys/ssh_key@cm123 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o ConnectTimeout=10 -o ServerAliveInterval=20 -o RequestTTY=no -o LogLevel=ERROR -p 22 root@10.0.0.5 'bash -se' << \\$abc\necho hi\nabc"
+    );
+
+    assert.equal(validateSshArgs(['-F', '/tmp/config', ...baseArgs], ['10.0.0.5']), false);
+    assert.equal(validateSshArgs(['-i', '/tmp/attacker-key', ...baseArgs.slice(2)], ['10.0.0.5']), false);
+});
+
+test('validateSshArgs rejects a destination that begins with an option prefix', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 3600 ssh -i /var/www/html/storage/app/ssh/keys/ssh_key@cm123 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o ConnectTimeout=10 -o ServerAliveInterval=20 -o RequestTTY=no -o LogLevel=ERROR -p 22 -evil@10.0.0.5 'bash -se' << \\$abc\necho hi\nabc"
+    );
+
+    assert.equal(validateSshArgs(sshArgs, ['10.0.0.5']), false);
+});
+
+test('sanitizeSshArgs removes SSH multiplexing options before spawning SSH', () => {
+    const sshArgs = extractSshArgs(
+        "timeout 3600 ssh -o ControlMaster=auto -o ControlPath=/var/www/html/storage/app/ssh/mux/mux_cm123 -o ControlPersist=3600 -i /var/www/html/storage/app/ssh/keys/ssh_key@cm123 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o PasswordAuthentication=no -o ConnectTimeout=10 -o ServerAliveInterval=20 -o RequestTTY=no -o LogLevel=ERROR -p 22 root@10.0.0.5 'bash -se' << \\$abc\necho hi\nabc"
+    );
+
+    assert.equal(validateSshArgs(sshArgs, ['10.0.0.5']), true);
+    assert.deepEqual(sanitizeSshArgs(sshArgs), [
+        '-i',
+        '/var/www/html/storage/app/ssh/keys/ssh_key@cm123',
+        '-o',
+        'StrictHostKeyChecking=no',
+        '-o',
+        'UserKnownHostsFile=/dev/null',
+        '-o',
+        'PasswordAuthentication=no',
+        '-o',
+        'ConnectTimeout=10',
+        '-o',
+        'ServerAliveInterval=20',
+        '-o',
+        'RequestTTY=yes',
+        '-o',
+        'LogLevel=ERROR',
+        '-p',
+        '22',
+        'root@10.0.0.5',
+    ]);
+});
+
 
 test('getTerminalSessionTimeout always enforces the maximum terminal session lifetime', () => {
     assert.equal(getTerminalSessionTimeout(null), MAX_TERMINAL_SESSION_TIMEOUT_SECONDS);

From 78f9c676ba163d38f9996842d6f458e53ca13900 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 28 Aug 2026 14:46:57 +0200
Subject: [PATCH 11/55] chore: prepare v4.3.15

---
 config/constants.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config/constants.php b/config/constants.php
index 3edc2e77e..457a8a1ff 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.14',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.15',
         'helper_version' => '1.0.16',
         'realtime_version' => '1.0.18',
         'railpack_version' => '0.23.0',

From 0dfbc42c0f9ace412627973cd9231d3737f0883d Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 28 Aug 2026 14:51:30 +0200
Subject: [PATCH 12/55] chore(release): bump Coolify to 4.3.15 and realtime to
 1.0.18

---
 other/nightly/docker-compose.prod.yml      | 2 +-
 other/nightly/docker-compose.windows.yml   | 2 +-
 other/nightly/versions.json                | 4 ++--
 tests/Unit/ProductionImageWorkflowTest.php | 4 ++--
 versions.json                              | 4 ++--
 5 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/other/nightly/docker-compose.prod.yml b/other/nightly/docker-compose.prod.yml
index 0d7caceb9..ebf12379d 100644
--- a/other/nightly/docker-compose.prod.yml
+++ b/other/nightly/docker-compose.prod.yml
@@ -62,7 +62,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.17'
+    image: '${REGISTRY_URL:-docker.io}/coollabsio/coolify-realtime:1.0.18'
     ports:
       - "${SOKETI_PORT:-6001}:6001"
       - "6002:6002"
diff --git a/other/nightly/docker-compose.windows.yml b/other/nightly/docker-compose.windows.yml
index 43f6f0d0e..32524c4f4 100644
--- a/other/nightly/docker-compose.windows.yml
+++ b/other/nightly/docker-compose.windows.yml
@@ -96,7 +96,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.17'
+    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.18'
     pull_policy: always
     container_name: coolify-realtime
     restart: always
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index 2331c439a..455918fdc 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.14"
+            "version": "4.3.15"
         },
         "nightly": {
             "version": "4.4-rc.1"
@@ -10,7 +10,7 @@
             "version": "1.0.16"
         },
         "realtime": {
-            "version": "1.0.17"
+            "version": "1.0.18"
         },
         "sentinel": {
             "version": "0.0.22"
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index 857027a3c..293c9422e 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,8 +23,8 @@
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.14'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.14')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.15'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.15')
         ->and($versions['coolify']['nightly']['version'])->toBe('4.4-rc.1')
         ->and($nightlyVersions)->toBe($versions);
 });
diff --git a/versions.json b/versions.json
index 2331c439a..455918fdc 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.14"
+            "version": "4.3.15"
         },
         "nightly": {
             "version": "4.4-rc.1"
@@ -10,7 +10,7 @@
             "version": "1.0.16"
         },
         "realtime": {
-            "version": "1.0.17"
+            "version": "1.0.18"
         },
         "sentinel": {
             "version": "0.0.22"

From 8d675f2e21810bde0f67d6598da08fd52ba1cba5 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 28 Aug 2026 15:08:25 +0200
Subject: [PATCH 13/55] fix: update resource forms

---
 app/Livewire/Security/PrivateKey/Show.php     |   4 +-
 app/Livewire/Source/Github/Change.php         |  21 +---
 .../LivewireStoredSecretAuthorizationTest.php | 117 ++++++++++++++++++
 3 files changed, 125 insertions(+), 17 deletions(-)
 create mode 100644 tests/Feature/Authorization/LivewireStoredSecretAuthorizationTest.php

diff --git a/app/Livewire/Security/PrivateKey/Show.php b/app/Livewire/Security/PrivateKey/Show.php
index 664119bad..1b8f26ff2 100644
--- a/app/Livewire/Security/PrivateKey/Show.php
+++ b/app/Livewire/Security/PrivateKey/Show.php
@@ -76,7 +76,9 @@ private function syncData(bool $toModel = false): void
             // Sync FROM model (on load/refresh)
             $this->name = $this->private_key->name;
             $this->description = $this->private_key->description;
-            $this->privateKeyValue = $this->private_key->private_key;
+            $this->privateKeyValue = auth()->user()->can('update', $this->private_key)
+                ? $this->private_key->private_key
+                : '';
             $this->isGitRelated = $this->private_key->is_git_related;
         }
     }
diff --git a/app/Livewire/Source/Github/Change.php b/app/Livewire/Source/Github/Change.php
index 001d31c37..2dadd7366 100644
--- a/app/Livewire/Source/Github/Change.php
+++ b/app/Livewire/Source/Github/Change.php
@@ -122,13 +122,6 @@ public function updatedHtmlUrl(): void
         }
     }
 
-    public function boot()
-    {
-        if ($this->github_app) {
-            $this->github_app->makeVisible(['client_secret', 'webhook_secret']);
-        }
-    }
-
     /**
      * Sync data between component properties and model
      *
@@ -170,8 +163,9 @@ private function syncData(bool $toModel = false): void
             $this->appId = $this->github_app->app_id;
             $this->installationId = $this->github_app->installation_id;
             $this->clientId = $this->github_app->client_id;
-            $this->clientSecret = $this->github_app->client_secret;
-            $this->webhookSecret = $this->github_app->webhook_secret;
+            $canUpdate = auth()->user()->can('update', $this->github_app);
+            $this->clientSecret = $canUpdate ? $this->github_app->client_secret : null;
+            $this->webhookSecret = $canUpdate ? $this->github_app->webhook_secret : null;
             $this->isSystemWide = $this->github_app->is_system_wide;
             $this->privateKeyId = $this->github_app->private_key_id;
             $this->contents = $this->github_app->contents;
@@ -231,7 +225,7 @@ public function checkPermissions()
             syncGithubAppName($this->github_app);
 
             GithubAppPermissionJob::dispatchSync($this->github_app);
-            $this->github_app->refresh()->makeVisible('client_secret')->makeVisible('webhook_secret');
+            $this->github_app->refresh();
             $this->syncData(false);
             $this->isConnected = $this->github_app->isConnected();
             $this->name = str($this->github_app->name)->kebab();
@@ -305,7 +299,7 @@ public function mount()
         try {
             $github_app_uuid = request()->github_app_uuid;
             $this->github_app = GithubApp::ownedByCurrentTeam()->whereUuid($github_app_uuid)->firstOrFail();
-            $this->github_app->makeVisible(['client_secret', 'webhook_secret']);
+            $this->authorize('view', $this->github_app);
             $this->privateKeys = PrivateKey::ownedByCurrentTeamCached();
 
             $this->applications = $this->github_app->applications;
@@ -420,7 +414,6 @@ public function submit()
         try {
             $this->authorize('update', $this->github_app);
 
-            $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');
             $this->organization = normalizeGithubOrganization($this->organization);
             $this->apiUrl = filled($this->apiUrl)
                 ? $this->apiUrl
@@ -442,7 +435,6 @@ public function createGithubAppManually()
     {
         $this->authorize('update', $this->github_app);
 
-        $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');
         $this->github_app->app_id = 1234567890;
         $this->github_app->installation_id = 1234567890;
         $this->github_app->save();
@@ -457,8 +449,6 @@ public function instantSave()
         try {
             $this->authorize('update', $this->github_app);
 
-            $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');
-
             $this->syncData(true);
             $this->github_app->save();
             $this->isConnected = $this->github_app->isConnected();
@@ -475,7 +465,6 @@ public function delete()
 
             if ($this->github_app->applications->isNotEmpty()) {
                 $this->dispatch('error', 'This source is being used by an application. Please delete all applications first.');
-                $this->github_app->makeVisible('client_secret')->makeVisible('webhook_secret');
 
                 return;
             }
diff --git a/tests/Feature/Authorization/LivewireStoredSecretAuthorizationTest.php b/tests/Feature/Authorization/LivewireStoredSecretAuthorizationTest.php
new file mode 100644
index 000000000..68bb0ac8b
--- /dev/null
+++ b/tests/Feature/Authorization/LivewireStoredSecretAuthorizationTest.php
@@ -0,0 +1,117 @@
+<?php
+
+use App\Livewire\Security\PrivateKey\Show as PrivateKeyShow;
+use App\Livewire\Source\Github\Change as GithubAppChange;
+use App\Models\GithubApp;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Storage;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
+    Storage::fake('ssh-keys');
+
+    $this->team = Team::factory()->create();
+    $this->owner = User::factory()->create();
+    $this->member = User::factory()->create();
+    $this->team->members()->attach($this->owner, ['role' => 'owner']);
+    $this->team->members()->attach($this->member, ['role' => 'member']);
+});
+
+it('does not serialize a private key for a member who cannot update it', function () {
+    $privateKeyValue = PrivateKey::generateNewKeyPair('ed25519')['private_key'];
+    $privateKey = PrivateKey::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key' => $privateKeyValue,
+    ]);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(PrivateKeyShow::class, ['private_key_uuid' => $privateKey->uuid])
+        ->assertSuccessful()
+        ->assertSet('privateKeyValue', '')
+        ->assertDontSee($privateKeyValue);
+});
+
+it('keeps a private key available to an owner who can update it', function () {
+    $privateKeyValue = PrivateKey::generateNewKeyPair('ed25519')['private_key'];
+    $privateKey = PrivateKey::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key' => $privateKeyValue,
+    ]);
+
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(PrivateKeyShow::class, ['private_key_uuid' => $privateKey->uuid])
+        ->assertSuccessful()
+        ->assertSet('privateKeyValue', $privateKeyValue);
+});
+
+it('does not serialize GitHub App secrets for a member who cannot update it', function () {
+    $githubApp = createGithubAppWithSecrets($this->team);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+        ->test(GithubAppChange::class)
+        ->assertSuccessful()
+        ->assertSet('clientSecret', null)
+        ->assertSet('webhookSecret', null)
+        ->assertDontSee('stored-client-secret')
+        ->assertDontSee('stored-webhook-secret');
+});
+
+it('does not serialize secrets from a system-wide GitHub App for another team', function () {
+    $githubApp = createGithubAppWithSecrets($this->team, isSystemWide: true);
+    $otherTeam = Team::factory()->create();
+    $otherUser = User::factory()->create();
+    $otherTeam->members()->attach($otherUser, ['role' => 'owner']);
+
+    $this->actingAs($otherUser);
+    session(['currentTeam' => $otherTeam]);
+
+    Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+        ->test(GithubAppChange::class)
+        ->assertSuccessful()
+        ->assertSet('clientSecret', null)
+        ->assertSet('webhookSecret', null)
+        ->assertDontSee('stored-client-secret')
+        ->assertDontSee('stored-webhook-secret');
+});
+
+it('keeps GitHub App secrets available to an owner who can update it', function () {
+    $githubApp = createGithubAppWithSecrets($this->team);
+
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::withQueryParams(['github_app_uuid' => $githubApp->uuid])
+        ->test(GithubAppChange::class)
+        ->assertSuccessful()
+        ->assertSet('clientSecret', 'stored-client-secret')
+        ->assertSet('webhookSecret', 'stored-webhook-secret');
+});
+
+function createGithubAppWithSecrets(Team $team, bool $isSystemWide = false): GithubApp
+{
+    return GithubApp::query()->create([
+        'team_id' => $team->id,
+        'name' => 'security-test-app',
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'custom_user' => 'git',
+        'custom_port' => 22,
+        'client_secret' => 'stored-client-secret',
+        'webhook_secret' => 'stored-webhook-secret',
+        'is_system_wide' => $isSystemWide,
+    ]);
+}

From ccea7287bffc5afba32c292ccac391b617228ece Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 30 Aug 2026 16:20:16 +0200
Subject: [PATCH 14/55] feat(previews): add preview domain management and DNS
 status tracking

---
 app/Jobs/CheckDomainDnsJob.php                |   3 +-
 app/Livewire/Project/Application/Domains.php  |   1 +
 .../Project/Application/PreviewDomains.php    | 440 ++++++++++++++++
 app/Livewire/Project/Application/Previews.php | 137 +----
 .../Project/Application/PreviewsCompose.php   | 165 ------
 app/Livewire/Project/Service/Domains.php      |   1 +
 app/Models/ApplicationPreview.php             |  33 +-
 ...statuses_to_application_previews_table.php |  28 ++
 .../application/preview-domains.blade.php     | 152 ++++++
 .../application/previews-compose.blade.php    |   6 -
 .../project/application/previews.blade.php    |  61 +--
 tests/Feature/ApplicationDomainsTest.php      | 469 +++++++++++++++++-
 tests/Feature/CheckDomainDnsJobTest.php       |  29 ++
 tests/Feature/PreviewStatusSummaryTest.php    |  19 +
 tests/Feature/ServiceDomainsTest.php          |   3 +-
 15 files changed, 1199 insertions(+), 348 deletions(-)
 create mode 100644 app/Livewire/Project/Application/PreviewDomains.php
 delete mode 100644 app/Livewire/Project/Application/PreviewsCompose.php
 create mode 100644 database/migrations/2026_08_28_193100_add_domain_dns_statuses_to_application_previews_table.php
 create mode 100644 resources/views/livewire/project/application/preview-domains.blade.php
 delete mode 100644 resources/views/livewire/project/application/previews-compose.blade.php

diff --git a/app/Jobs/CheckDomainDnsJob.php b/app/Jobs/CheckDomainDnsJob.php
index 1a7ceaeab..c013da25a 100644
--- a/app/Jobs/CheckDomainDnsJob.php
+++ b/app/Jobs/CheckDomainDnsJob.php
@@ -4,6 +4,7 @@
 
 use App\Actions\Shared\CheckDomainDns;
 use App\Models\Application;
+use App\Models\ApplicationPreview;
 use App\Models\Server;
 use App\Models\ServiceApplication;
 use Illuminate\Bus\Queueable;
@@ -23,7 +24,7 @@ class CheckDomainDnsJob implements ShouldBeEncrypted, ShouldQueue
     public int $timeout = 30;
 
     public function __construct(
-        public Application|ServiceApplication $resource,
+        public Application|ApplicationPreview|ServiceApplication $resource,
         public string $statusKey,
         public string $url,
         public ?Server $server,
diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index 4168a208c..d736ec385 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -1007,6 +1007,7 @@ protected function checkUrlsDns(array $urls, ?string $service = null): void
         $skipDns = ! $this->dnsValidationEnabled
             || ! $server
             || $this->application->additional_servers->count() > 0;
+        $indexesToCheck = [];
 
         foreach ($this->domainRows as $index => $row) {
             $url = $row['url'] ?? null;
diff --git a/app/Livewire/Project/Application/PreviewDomains.php b/app/Livewire/Project/Application/PreviewDomains.php
new file mode 100644
index 000000000..f2557e4f5
--- /dev/null
+++ b/app/Livewire/Project/Application/PreviewDomains.php
@@ -0,0 +1,440 @@
+<?php
+
+namespace App\Livewire\Project\Application;
+
+use App\Actions\Shared\CheckDomainDns;
+use App\Jobs\CheckDomainDnsJob;
+use App\Models\ApplicationPreview;
+use App\Support\DomainUrlParts;
+use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\DB;
+use Livewire\Component;
+use Spatie\Url\Url;
+
+class PreviewDomains extends Component
+{
+    use AuthorizesRequests;
+
+    public ApplicationPreview $preview;
+
+    public array $domainRows = [];
+
+    public array $newDomainParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public ?string $newDomainService = null;
+
+    public array $editingDomainParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public ?int $editingIndex = null;
+
+    public function mount(): void
+    {
+        $this->refreshDomains();
+        if ($this->preview->application->build_pack === 'dockercompose') {
+            $this->newDomainService = $this->composeServices()[0] ?? null;
+        }
+    }
+
+    public function render()
+    {
+        return view('livewire.project.application.preview-domains', [
+            'isCompose' => $this->preview->application->build_pack === 'dockercompose',
+            'composeServices' => $this->composeServices(),
+        ]);
+    }
+
+    public function addDomain(): void
+    {
+        $this->authorize('update', $this->preview->application);
+        if ($this->preview->application->build_pack === 'dockercompose'
+            && ($this->newDomainService === null || ! in_array($this->newDomainService, $this->composeServices(), true))) {
+            $this->addError('newDomainService', 'Select a valid Compose service.');
+
+            return;
+        }
+        $domain = $this->validatedDomain($this->newDomainParts, 'newDomainParts.host');
+        if ($domain === null) {
+            return;
+        }
+        if (collect($this->domainRows)->contains(fn (array $row): bool => $row['url'] === $domain && $row['service'] === $this->newDomainService)) {
+            $this->addError('newDomainParts.host', 'This domain is already configured.');
+
+            return;
+        }
+        $this->domainRows[] = $this->makeRow($domain, $this->newDomainService);
+        $index = array_key_last($this->domainRows);
+        $checkId = new_public_id();
+        $this->domainRows[$index]['dns_status'] = 'checking';
+        $this->domainRows[$index]['dns_message'] = 'Checking DNS...';
+        $this->domainRows[$index]['check_id'] = $checkId;
+        if (! $this->persistDomains()) {
+            return;
+        }
+        $this->newDomainParts = DomainUrlParts::empty();
+        $this->newDomainService = $this->preview->application->build_pack === 'dockercompose'
+            ? ($this->composeServices()[0] ?? null)
+            : null;
+        $this->dispatch('close-modal');
+
+        try {
+            $server = $this->preview->application->destination?->server;
+            CheckDomainDnsJob::dispatch(
+                $this->preview,
+                $this->statusKey($domain, $this->domainRows[$index]['service']),
+                $domain,
+                $server,
+                $server ? serverDnsTargetIp($server) ?? $server->ip : null,
+                $checkId,
+                $this->preview->application->additional_servers->count() > 0,
+            );
+            $this->dispatch('success', 'Domain added. DNS check started.');
+        } catch (\Throwable) {
+            $this->domainRows[$index]['dns_status'] = 'skipped';
+            $this->domainRows[$index]['dns_message'] = 'DNS check could not be started.';
+            $this->domainRows[$index]['check_id'] = null;
+            $this->persistDnsStatuses();
+            $this->dispatch('error', 'Domain added, but the DNS check could not be started. Try again from the preview domains list.');
+        }
+    }
+
+    public function generateDomain(): void
+    {
+        $this->authorize('update', $this->preview->application);
+        $this->preview->refresh();
+        if ($this->preview->application->build_pack === 'dockercompose') {
+            if ($this->newDomainService === null && $this->domainRows === []) {
+                $this->preview->generate_preview_fqdn_compose(generateWithoutApplicationDomain: true);
+            } else {
+                $service = $this->newDomainService ?? data_get($this->domainRows, '0.service');
+                foreach ($this->generateComposeDomains((string) $service) as $domain) {
+                    $alreadyExists = collect($this->domainRows)->contains(
+                        fn (array $row): bool => $row['url'] === $domain && $row['service'] === $service
+                    );
+                    if (! $alreadyExists) {
+                        $this->domainRows[] = $this->makeRow($domain, $service);
+                    }
+                }
+
+                if (! $this->persistDomains()) {
+                    return;
+                }
+            }
+        } else {
+            $this->preview->generate_preview_fqdn(generateWithoutApplicationDomain: true);
+        }
+        $this->refreshDomains();
+        $this->dispatch('success', 'Domain generated.');
+    }
+
+    public function startEdit(int $index): void
+    {
+        if (! isset($this->domainRows[$index])) {
+            return;
+        }
+        $this->editingIndex = $index;
+        $this->editingDomainParts = DomainUrlParts::split($this->domainRows[$index]['url']);
+        $this->dispatch('open-preview-domain-edit');
+    }
+
+    public function updateDomain(): void
+    {
+        $this->authorize('update', $this->preview->application);
+        if ($this->editingIndex === null || ! isset($this->domainRows[$this->editingIndex])) {
+            return;
+        }
+        $domain = $this->validatedDomain($this->editingDomainParts, 'editingDomainParts.host');
+        if ($domain === null) {
+            return;
+        }
+        $this->domainRows[$this->editingIndex]['url'] = $domain;
+        $this->domainRows[$this->editingIndex]['dns_status'] = 'pending';
+        $this->domainRows[$this->editingIndex]['dns_message'] = 'DNS has not been checked yet.';
+        $index = $this->editingIndex;
+        $this->editingIndex = null;
+        if (! $this->persistDomains()) {
+            return;
+        }
+        $this->dispatch('close-preview-domain-edit');
+        $this->dispatch('success', 'Domain updated.');
+        $this->checkDomainDns($index);
+    }
+
+    public function removeDomain(int $index): void
+    {
+        $this->authorize('update', $this->preview->application);
+        if (! isset($this->domainRows[$index])) {
+            return;
+        }
+        unset($this->domainRows[$index]);
+        $this->domainRows = array_values($this->domainRows);
+        if (! $this->persistDomains()) {
+            return;
+        }
+        $this->dispatch('success', 'Domain removed.');
+    }
+
+    public function removeDomainByKey(string $domainKey): void
+    {
+        $index = collect($this->domainRows)->search(
+            fn (array $row): bool => hash_equals($domainKey, $this->statusKey($row['url'], $row['service']))
+        );
+
+        if ($index === false) {
+            return;
+        }
+
+        $this->removeDomain((int) $index);
+    }
+
+    public function checkAllDns(): void
+    {
+        $this->authorize('update', $this->preview->application);
+        foreach (array_keys($this->domainRows) as $index) {
+            $this->applyDnsCheck($index);
+        }
+        $this->persistDnsStatuses();
+    }
+
+    public function checkDomainDns(int $index): void
+    {
+        $this->authorize('update', $this->preview->application);
+        $this->applyDnsCheck($index);
+        $this->persistDnsStatuses();
+    }
+
+    public function pollDnsChecks(): void
+    {
+        $checkingRows = collect($this->domainRows)
+            ->where('dns_status', 'checking')
+            ->values();
+
+        $this->refreshDomains();
+
+        foreach ($checkingRows as $checkingRow) {
+            $row = collect($this->domainRows)->first(fn (array $row): bool => $row['url'] === $checkingRow['url']
+                && ($row['service'] ?? null) === ($checkingRow['service'] ?? null));
+
+            if (! is_array($row) || $row['dns_status'] === 'checking') {
+                continue;
+            }
+
+            $this->dispatchDnsCheckNotification($row['url'], $row['dns_status']);
+        }
+    }
+
+    private function dispatchDnsCheckNotification(string $url, string $status): void
+    {
+        $host = parse_url($url, PHP_URL_HOST) ?: $url;
+
+        match ($status) {
+            'ok' => $this->dispatch('success', "DNS is configured correctly for {$host}."),
+            'failed' => $this->dispatch('error', "DNS is not configured for {$host}. Review the required DNS record."),
+            default => $this->dispatch('info', "DNS check skipped for {$host}."),
+        };
+    }
+
+    private function applyDnsCheck(int $index): void
+    {
+        if (! isset($this->domainRows[$index])) {
+            return;
+        }
+        $result = $this->checkUrlDns($this->domainRows[$index]['url'], (string) $index);
+        $this->domainRows[$index]['dns_status'] = $result['status'];
+        $this->domainRows[$index]['dns_message'] = $result['message'];
+    }
+
+    private function checkUrlDns(string $url, string $key = 'domain'): array
+    {
+        $server = $this->preview->application->destination?->server;
+
+        return CheckDomainDns::run(
+            [$key => $url],
+            $server,
+            $server ? serverDnsTargetIp($server) ?? $server->ip : null,
+            $this->preview->application->additional_servers->count() > 0,
+        )[$key];
+    }
+
+    private function refreshDomains(): void
+    {
+        $this->preview->refresh();
+        $statuses = $this->preview->domain_dns_statuses ?? [];
+        $rows = [];
+        if ($this->preview->application->build_pack === 'dockercompose') {
+            foreach (json_decode($this->preview->docker_compose_domains ?: '[]', true) ?: [] as $service => $entry) {
+                foreach ($this->splitDomains(composeDomainEntryString($entry)) as $url) {
+                    $rows[] = $this->makeRow($url, (string) $service, $statuses);
+                }
+            }
+        } else {
+            foreach ($this->splitDomains($this->preview->fqdn) as $url) {
+                $rows[] = $this->makeRow($url, null, $statuses);
+            }
+        }
+        $this->domainRows = $rows;
+    }
+
+    private function persistDomains(): bool
+    {
+        if ($this->preview->application->build_pack === 'dockercompose') {
+            try {
+                $composeServices = $this->composeServices(failOnError: true);
+            } catch (\Throwable) {
+                $this->refreshDomains();
+                $this->dispatch('error', 'Compose configuration could not be parsed. Preview domains were not changed.');
+
+                return false;
+            }
+            $domains = collect($composeServices)
+                ->mapWithKeys(fn (string $service): array => [$service => ['domain' => '']])
+                ->all();
+            $validRows = collect($this->domainRows)
+                ->filter(fn (array $row): bool => in_array($row['service'] ?? null, $composeServices, true));
+            foreach ($validRows->groupBy('service') as $service => $rows) {
+                $domains[$service] = ['domain' => $rows->pluck('url')->implode(',')];
+            }
+            $this->preview->docker_compose_domains = json_encode($domains);
+            $this->preview->fqdn = $validRows->pluck('url')->implode(',') ?: null;
+        } else {
+            $this->preview->fqdn = collect($this->domainRows)->pluck('url')->implode(',') ?: null;
+        }
+        $this->preview->save();
+        $this->persistDnsStatuses();
+        $this->dispatch('update_links');
+        $this->dispatch('previewDomainsChanged');
+
+        return true;
+    }
+
+    private function persistDnsStatuses(): void
+    {
+        $statuses = [];
+        foreach ($this->domainRows as $row) {
+            $statuses[$this->statusKey($row['url'], $row['service'])] = [
+                'status' => $row['dns_status'],
+                'message' => $row['dns_message'],
+                'check_id' => $row['check_id'] ?? null,
+            ];
+        }
+
+        DB::transaction(function () use (&$statuses): void {
+            $preview = ApplicationPreview::query()->lockForUpdate()->findOrFail($this->preview->id);
+            $storedStatuses = $preview->domain_dns_statuses ?? [];
+
+            foreach ($statuses as $key => $status) {
+                $storedStatus = $storedStatuses[$key] ?? null;
+                if (! is_array($storedStatus)) {
+                    continue;
+                }
+
+                $localCheckId = $status['check_id'] ?? null;
+                $storedCheckId = $storedStatus['check_id'] ?? null;
+
+                if (($storedCheckId !== null && $localCheckId !== $storedCheckId)
+                    || ($status['status'] === 'checking' && ($storedStatus['status'] ?? null) !== 'checking')) {
+                    $statuses[$key] = $storedStatus;
+                }
+            }
+
+            $preview->domain_dns_statuses = $statuses ?: null;
+            $preview->save();
+        });
+
+        $this->preview->domain_dns_statuses = $statuses ?: null;
+    }
+
+    private function validatedDomain(array $parts, string $errorKey): ?string
+    {
+        $domain = DomainUrlParts::compose(...$parts);
+        $validator = validator(['domain' => $domain], ['domain' => ValidationPatterns::applicationDomainRules()]);
+        if ($validator->fails()) {
+            $this->addError($errorKey, $validator->errors()->first('domain'));
+
+            return null;
+        }
+
+        return ValidationPatterns::normalizeApplicationDomains($domain);
+    }
+
+    private function makeRow(string $url, ?string $service, array $statuses = []): array
+    {
+        $status = $statuses[$this->statusKey($url, $service)] ?? [];
+
+        return [
+            'url' => $url,
+            'service' => $service,
+            'dns_status' => $status['status'] ?? 'pending',
+            'dns_message' => $status['message'] ?? 'DNS has not been checked yet.',
+            'check_id' => $status['check_id'] ?? null,
+        ];
+    }
+
+    private function statusKey(string $url, ?string $service): string
+    {
+        return hash('sha256', $url.'|'.($service ?? ''));
+    }
+
+    private function splitDomains(?string $domains): array
+    {
+        return str($domains)->explode(',')->map(fn ($domain) => trim((string) $domain))->filter()->values()->all();
+    }
+
+    private function generateComposeDomains(string $service): array
+    {
+        $applicationDomains = json_decode($this->preview->application->docker_compose_domains ?: '[]', true) ?: [];
+        $domainString = getComposeServiceDomainString($applicationDomains, $service);
+
+        if (empty($domainString)) {
+            $domainString = generateUrl(
+                server: $this->preview->application->destination->server,
+                random: str($service)->slug().'-'.$this->preview->application->uuid,
+            );
+        }
+
+        return collect($this->splitDomains($domainString))->map(function (string $domain): string {
+            $url = Url::fromString($domain);
+            $generatedDomain = str_replace('{{random}}', new_public_id(), $this->preview->application->preview_url_template);
+            $generatedDomain = str_replace('{{domain}}', $url->getHost(), $generatedDomain);
+            $generatedDomain = str_replace('{{pr_id}}', (string) $this->preview->pull_request_id, $generatedDomain);
+            $port = $url->getPort() !== null ? ':'.$url->getPort() : '';
+            $path = ! in_array($url->getPath(), ['', '/'], true) ? $url->getPath() : '';
+
+            return "{$url->getScheme()}://{$generatedDomain}{$port}{$path}";
+        })->all();
+    }
+
+    private function composeServices(bool $failOnError = false): array
+    {
+        try {
+            $parsedCompose = $this->preview->application->parse(pull_request_id: $this->preview->pull_request_id);
+            $services = data_get($parsedCompose, 'services', []);
+            if (! is_iterable($services)) {
+                return [];
+            }
+
+            $usesLegacyServiceKeys = (int) $this->preview->application->compose_parsing_version < 3;
+            $previewSuffix = '-pr-'.$this->preview->pull_request_id;
+            $serviceNames = [];
+            foreach ($services as $serviceName => $service) {
+                if (isDatabaseImage(data_get($service, 'image'))) {
+                    continue;
+                }
+
+                $serviceName = (string) $serviceName;
+                if ($usesLegacyServiceKeys && str_ends_with($serviceName, $previewSuffix)) {
+                    $serviceName = substr($serviceName, 0, -strlen($previewSuffix));
+                }
+                $serviceNames[] = $serviceName;
+            }
+
+            return array_values(array_unique($serviceNames));
+        } catch (\Throwable $exception) {
+            if ($failOnError) {
+                throw $exception;
+            }
+
+            return [];
+        }
+    }
+}
diff --git a/app/Livewire/Project/Application/Previews.php b/app/Livewire/Project/Application/Previews.php
index e07a985b4..fa0272bd6 100644
--- a/app/Livewire/Project/Application/Previews.php
+++ b/app/Livewire/Project/Application/Previews.php
@@ -7,7 +7,6 @@
 use App\Jobs\DeleteResourceJob;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
-use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
@@ -16,6 +15,8 @@ class Previews extends Component
 {
     use AuthorizesRequests;
 
+    protected $listeners = ['previewDomainsChanged' => 'refreshPreviewDomains'];
+
     public Application $application;
 
     public string $deployment_uuid;
@@ -26,16 +27,6 @@ class Previews extends Component
 
     public int $rate_limit_remaining;
 
-    public $domainConflicts = [];
-
-    public $showDomainConflictModal = false;
-
-    public $forceSaveDomains = false;
-
-    public $pendingPreviewId = null;
-
-    public array $previewFqdns = [];
-
     public array $previewDockerTags = [];
 
     public ?int $manualPullRequestId = null;
@@ -43,7 +34,6 @@ class Previews extends Component
     public ?string $manualDockerTag = null;
 
     protected $rules = [
-        'previewFqdns.*' => 'string|nullable',
         'previewDockerTags.*' => 'string|nullable',
         'manualPullRequestId' => 'integer|min:1|nullable',
         'manualDockerTag' => 'string|nullable',
@@ -53,31 +43,23 @@ public function mount()
     {
         $this->pull_requests = collect();
         $this->parameters = get_route_parameters();
-        $this->syncData(false);
+        $this->syncDockerTags();
     }
 
-    private function syncData(bool $toModel = false): void
+    private function syncDockerTags(): void
     {
-        if ($toModel) {
-            foreach ($this->previewFqdns as $key => $fqdn) {
-                $preview = $this->application->previews->get($key);
-                if ($preview) {
-                    $preview->fqdn = $fqdn;
-                    if ($this->application->build_pack === 'dockerimage') {
-                        $preview->docker_registry_image_tag = $this->previewDockerTags[$key] ?? null;
-                    }
-                }
-            }
-        } else {
-            $this->previewFqdns = [];
-            $this->previewDockerTags = [];
-            foreach ($this->application->previews as $key => $preview) {
-                $this->previewFqdns[$key] = $preview->fqdn;
-                $this->previewDockerTags[$key] = $preview->docker_registry_image_tag;
-            }
+        $this->previewDockerTags = [];
+        foreach ($this->application->previews as $key => $preview) {
+            $this->previewDockerTags[$key] = $preview->docker_registry_image_tag;
         }
     }
 
+    public function refreshPreviewDomains(): void
+    {
+        $this->application->refresh();
+        $this->syncDockerTags();
+    }
+
     public function load_prs()
     {
         try {
@@ -92,103 +74,28 @@ public function load_prs()
         }
     }
 
-    public function confirmDomainUsage()
-    {
-        $this->forceSaveDomains = true;
-        $this->showDomainConflictModal = false;
-        if ($this->pendingPreviewId) {
-            $this->save_preview($this->pendingPreviewId);
-            $this->pendingPreviewId = null;
-        }
-    }
-
     public function save_preview($preview_id)
     {
         try {
             $this->authorize('update', $this->application);
-            $success = true;
             $preview = $this->application->previews->find($preview_id);
 
             if (! $preview) {
                 throw new \Exception('Preview not found');
             }
 
-            // Find the key for this preview in the collection
             $previewKey = $this->application->previews->search(function ($item) use ($preview_id) {
                 return $item->id == $preview_id;
             });
 
-            if ($previewKey !== false && isset($this->previewFqdns[$previewKey])) {
-                $this->validate([
-                    "previewFqdns.{$previewKey}" => ValidationPatterns::applicationDomainRules(),
-                ]);
-
-                $fqdn = $this->previewFqdns[$previewKey];
-
-                if (! empty($fqdn)) {
-                    $fqdn = ValidationPatterns::normalizeApplicationDomains($fqdn);
-                    $this->previewFqdns[$previewKey] = $fqdn;
-
-                    if (! validateDNSEntry($fqdn, $this->application->destination->server)) {
-                        $server = $this->application->destination->server;
-                        $target = serverDnsTargetIp($server) ?? $server->ip;
-                        $guidance = dnsMismatchGuidanceMessage($target, $target);
-                        $this->dispatch('error', 'Validating DNS failed.', "{$guidance}<br><br>Check this <a target='_blank' class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/dns-configuration'>documentation</a> for further help.");
-                        $success = false;
-                    }
-
-                    // Check for domain conflicts if not forcing save
-                    if (! $this->forceSaveDomains) {
-                        $result = checkDomainUsage(resource: $this->application, domain: $fqdn);
-                        if ($result['hasConflicts']) {
-                            $this->domainConflicts = $result['conflicts'];
-                            $this->showDomainConflictModal = true;
-                            $this->pendingPreviewId = $preview_id;
-
-                            return;
-                        }
-                    } else {
-                        // Reset the force flag after using it
-                        $this->forceSaveDomains = false;
-                    }
-                }
+            if ($previewKey === false) {
+                throw new \Exception('Preview not found');
             }
 
-            if ($success) {
-                $this->syncData(true);
-                $preview->save();
-                $this->dispatch('success', 'Preview saved.<br><br>Do not forget to redeploy the preview to apply the changes.');
-            }
-        } catch (\Throwable $e) {
-            return handleError($e, $this);
-        }
-    }
-
-    public function generate_preview($preview_id)
-    {
-        try {
-            $this->authorize('update', $this->application);
-
-            $preview = $this->application->previews->find($preview_id);
-            if (! $preview) {
-                $this->dispatch('error', 'Preview not found.');
-
-                return;
-            }
-            if ($this->application->build_pack === 'dockercompose') {
-                $preview->generate_preview_fqdn_compose();
-                $this->application->refresh();
-                $this->syncData(false);
-                $this->dispatch('success', 'Domain generated.');
-
-                return;
-            }
-
-            $preview->generate_preview_fqdn();
-            $this->application->refresh();
-            $this->syncData(false);
-            $this->dispatch('update_links');
-            $this->dispatch('success', 'Domain generated.');
+            $this->validateOnly("previewDockerTags.{$previewKey}");
+            $preview->docker_registry_image_tag = $this->previewDockerTags[$previewKey] ?? null;
+            $preview->save();
+            $this->dispatch('success', 'Preview saved.<br><br>Do not forget to redeploy the preview to apply the changes.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -211,7 +118,7 @@ public function add(int $pull_request_id, ?string $pull_request_html_url = null,
                 }
                 $found->generate_preview_fqdn_compose();
                 $this->application->refresh();
-                $this->syncData(false);
+                $this->syncDockerTags();
             } else {
                 $this->setDeploymentUuid();
                 $found = ApplicationPreview::where('application_id', $this->application->id)->where('pull_request_id', $pull_request_id)->first();
@@ -227,9 +134,9 @@ public function add(int $pull_request_id, ?string $pull_request_html_url = null,
                     $found->docker_registry_image_tag = $docker_registry_image_tag;
                     $found->save();
                 }
-                $found->generate_preview_fqdn();
+                $found->generate_preview_fqdn(generateWithoutApplicationDomain: true);
                 $this->application->refresh();
-                $this->syncData(false);
+                $this->syncDockerTags();
                 $this->dispatch('update_links');
                 $this->dispatch('success', 'Preview added.');
             }
diff --git a/app/Livewire/Project/Application/PreviewsCompose.php b/app/Livewire/Project/Application/PreviewsCompose.php
deleted file mode 100644
index 0fdcf4615..000000000
--- a/app/Livewire/Project/Application/PreviewsCompose.php
+++ /dev/null
@@ -1,165 +0,0 @@
-<?php
-
-namespace App\Livewire\Project\Application;
-
-use App\Models\ApplicationPreview;
-use App\Support\ValidationPatterns;
-use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Livewire\Component;
-use Spatie\Url\Url;
-
-class PreviewsCompose extends Component
-{
-    use AuthorizesRequests;
-
-    public $service;
-
-    public $serviceName;
-
-    public ApplicationPreview $preview;
-
-    public ?string $domain = null;
-
-    public function mount()
-    {
-        $this->domain = data_get($this->service, 'domain');
-    }
-
-    public function render()
-    {
-        return view('livewire.project.application.previews-compose');
-    }
-
-    public function save()
-    {
-        try {
-            $this->authorize('update', $this->preview->application);
-            $this->validate([
-                'domain' => ValidationPatterns::applicationDomainRules(),
-            ]);
-
-            $this->domain = ValidationPatterns::normalizeApplicationDomains($this->domain);
-            $this->persistPreviewDomain($this->domain);
-            $this->dispatch('update_links');
-            $this->dispatch('success', 'Domain saved.');
-        } catch (\Throwable $e) {
-            return handleError($e, $this);
-        }
-    }
-
-    public function generate()
-    {
-        try {
-            $this->authorize('update', $this->preview->application);
-
-            $applicationDomains = json_decode($this->preview->application->docker_compose_domains ?: '[]', true) ?: [];
-            $domain_string = getComposeServiceDomainString($applicationDomains, (string) $this->serviceName);
-
-            // If no domain is set in the main application, generate a default domain
-            if (empty($domain_string)) {
-                $server = $this->preview->application->destination->server;
-                $template = $this->preview->application->preview_url_template;
-                $random = new_public_id();
-
-                // Generate a unique domain like main app services do
-                $generated_fqdn = generateUrl(server: $server, random: $random);
-
-                $preview_fqdn = str_replace('{{random}}', $random, $template);
-                $preview_fqdn = str_replace('{{domain}}', str($generated_fqdn)->after('://'), $preview_fqdn);
-                $preview_fqdn = str_replace('{{pr_id}}', $this->preview->pull_request_id, $preview_fqdn);
-                $preview_fqdn = str($generated_fqdn)->before('://').'://'.$preview_fqdn;
-            } else {
-                foreach (ValidationPatterns::validateApplicationDomains($domain_string) as $error) {
-                    throw new \InvalidArgumentException($error);
-                }
-
-                // Use the existing domain from the main application
-                // Handle multiple domains separated by commas
-                $domain_list = ValidationPatterns::applicationDomainList($domain_string);
-                $preview_fqdns = [];
-                $template = $this->preview->application->preview_url_template;
-                $random = new_public_id();
-
-                foreach ($domain_list as $single_domain) {
-                    $single_domain = trim($single_domain);
-                    if (empty($single_domain)) {
-                        continue;
-                    }
-
-                    $url = Url::fromString($single_domain);
-                    $host = $url->getHost();
-                    $schema = $url->getScheme();
-                    $portInt = $url->getPort();
-                    $port = $portInt !== null ? ':'.$portInt : '';
-
-                    $preview_fqdn = str_replace('{{random}}', $random, $template);
-                    $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
-                    $preview_fqdn = str_replace('{{pr_id}}', $this->preview->pull_request_id, $preview_fqdn);
-                    $preview_fqdns[] = "$schema://$preview_fqdn{$port}";
-                }
-
-                $preview_fqdn = implode(',', $preview_fqdns);
-            }
-
-            $this->domain = $preview_fqdn;
-            $this->persistPreviewDomain($this->domain);
-
-            $this->dispatch('update_links');
-            $this->dispatch('success', 'Domain generated.');
-        } catch (\Throwable $e) {
-            return handleError($e, $this);
-        }
-    }
-
-    private function persistPreviewDomain(?string $domain): void
-    {
-        $docker_compose_domains = json_decode(data_get($this->preview, 'docker_compose_domains') ?: '[]', true) ?: [];
-        $serviceNames = $this->previewServiceNames($docker_compose_domains);
-        $storageKey = findComposeServiceName((string) $this->serviceName, $serviceNames)
-            ?? (string) $this->serviceName;
-
-        $docker_compose_domains = putComposeServiceDomain(
-            $docker_compose_domains,
-            $storageKey,
-            $domain,
-            $serviceNames,
-        );
-        $docker_compose_domains = rekeyComposeDomainsToServiceNames($docker_compose_domains, $serviceNames);
-
-        $this->serviceName = $storageKey;
-        $this->preview->docker_compose_domains = json_encode($docker_compose_domains);
-        $this->preview->save();
-    }
-
-    /**
-     * @param  array<string, mixed>  $previewDomains
-     * @return list<string>
-     */
-    private function previewServiceNames(array $previewDomains): array
-    {
-        $parsedServices = $this->preview->application->parse(pull_request_id: $this->preview->pull_request_id);
-        $fromCompose = collect(data_get($parsedServices, 'services', []))
-            ->keys()
-            ->map(function ($serviceName) {
-                return str((string) $serviceName)
-                    ->replaceLast('-pr-'.$this->preview->pull_request_id, '')
-                    ->toString();
-            })
-            ->all();
-
-        $domainKeys = collect(array_keys($previewDomains))
-            ->merge(array_keys(json_decode($this->preview->application->docker_compose_domains ?: '[]', true) ?: []))
-            ->map(fn ($name) => (string) $name);
-        $unmapped = $domainKeys
-            ->reject(fn (string $key) => findComposeServiceName($key, $fromCompose) !== null)
-            ->all();
-
-        return collect($fromCompose)
-            ->merge(preferredComposeServiceNamesFromDomainKeys(
-                $fromCompose === [] ? $domainKeys->all() : $unmapped
-            ))
-            ->unique()
-            ->values()
-            ->all();
-    }
-}
diff --git a/app/Livewire/Project/Service/Domains.php b/app/Livewire/Project/Service/Domains.php
index 7708e5535..b5ca45b87 100644
--- a/app/Livewire/Project/Service/Domains.php
+++ b/app/Livewire/Project/Service/Domains.php
@@ -1447,6 +1447,7 @@ protected function checkUrlsDns(array $urls, ?int $serviceApplicationId = null):
         $urlSet = array_fill_keys($urls, true);
         $server = $this->service->server;
         $skipDns = ! $this->dnsValidationEnabled || ! $server;
+        $indexesToCheck = [];
 
         foreach ($this->domainRows as $index => $row) {
             $url = $row['url'] ?? null;
diff --git a/app/Models/ApplicationPreview.php b/app/Models/ApplicationPreview.php
index 090524275..d9c981c59 100644
--- a/app/Models/ApplicationPreview.php
+++ b/app/Models/ApplicationPreview.php
@@ -23,10 +23,12 @@ class ApplicationPreview extends BaseModel
         'docker_compose_domains',
         'docker_registry_image_tag',
         'last_online_at',
+        'domain_dns_statuses',
     ];
 
     protected $casts = [
         'pull_request_id' => 'integer',
+        'domain_dns_statuses' => 'array',
     ];
 
     protected static function booted(): void
@@ -105,13 +107,21 @@ public function persistentStorages()
         return $this->morphMany(LocalPersistentVolume::class, 'resource');
     }
 
-    public function generate_preview_fqdn()
+    public function generate_preview_fqdn(bool $generateWithoutApplicationDomain = false)
     {
-        if ($this->application->fqdn) {
-            if (str($this->application->fqdn)->contains(',')) {
-                $url = Url::fromString(str($this->application->fqdn)->explode(',')[0]);
+        $applicationFqdn = $this->application->fqdn;
+        if (! $applicationFqdn && $generateWithoutApplicationDomain) {
+            $applicationFqdn = generateUrl(
+                server: $this->application->destination->server,
+                random: $this->application->uuid,
+            );
+        }
+
+        if ($applicationFqdn) {
+            if (str($applicationFqdn)->contains(',')) {
+                $url = Url::fromString(str($applicationFqdn)->explode(',')[0]);
             } else {
-                $url = Url::fromString($this->application->fqdn);
+                $url = Url::fromString($applicationFqdn);
             }
             $template = $this->application->preview_url_template;
             $host = $url->getHost();
@@ -132,7 +142,7 @@ public function generate_preview_fqdn()
         return $this;
     }
 
-    public function generate_preview_fqdn_compose()
+    public function generate_preview_fqdn_compose(bool $generateWithoutApplicationDomain = false)
     {
         $applicationDomains = json_decode($this->application->docker_compose_domains ?: '[]', true) ?: [];
         $previewDomains = json_decode(data_get($this, 'docker_compose_domains') ?: '[]', true) ?: [];
@@ -174,8 +184,15 @@ public function generate_preview_fqdn_compose()
         foreach ($serviceNames as $service_name) {
             $domain_string = getComposeServiceDomainString($applicationDomains, $service_name);
 
-            // If domain string is empty or null, don't auto-generate domain
-            // Only generate domains when main app already has domains set
+            if (empty($domain_string)) {
+                if ($generateWithoutApplicationDomain) {
+                    $domain_string = generateUrl(
+                        server: $this->application->destination->server,
+                        random: str($service_name)->slug().'-'.$this->application->uuid,
+                    );
+                }
+            }
+
             if (empty($domain_string)) {
                 $docker_compose_domains = putComposeServiceDomain(
                     $docker_compose_domains,
diff --git a/database/migrations/2026_08_28_193100_add_domain_dns_statuses_to_application_previews_table.php b/database/migrations/2026_08_28_193100_add_domain_dns_statuses_to_application_previews_table.php
new file mode 100644
index 000000000..fd1865ed3
--- /dev/null
+++ b/database/migrations/2026_08_28_193100_add_domain_dns_statuses_to_application_previews_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->json('domain_dns_statuses')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->dropColumn('domain_dns_statuses');
+        });
+    }
+};
diff --git a/resources/views/livewire/project/application/preview-domains.blade.php b/resources/views/livewire/project/application/preview-domains.blade.php
new file mode 100644
index 000000000..766d0f64a
--- /dev/null
+++ b/resources/views/livewire/project/application/preview-domains.blade.php
@@ -0,0 +1,152 @@
+<div class="flex flex-col gap-3" x-data="{ editOpen: false }"
+    @open-preview-domain-edit.window="editOpen = true"
+    @close-preview-domain-edit.window="editOpen = false">
+    @if (collect($domainRows)->contains(fn ($row) => $row['dns_status'] === 'checking'))
+        <div class="hidden" wire:poll.2000ms="pollDnsChecks" aria-hidden="true"></div>
+    @endif
+    <div class="flex flex-wrap items-center gap-2">
+        <p class="min-w-0 flex-1 text-[13px] text-neutral-500 dark:text-fg-dim">
+            {{ count($domainRows) }} domain{{ count($domainRows) === 1 ? '' : 's' }}
+        </p>
+        @can('update', $preview->application)
+            @if (count($domainRows) > 0)
+                <x-forms.button wire:click="checkAllDns" wire:loading.attr="disabled" wire:target="checkAllDns,checkDomainDns">
+                    <x-reicon name="refresh" class="size-3.5" />
+                    Recheck DNS
+                </x-forms.button>
+            @endif
+            <x-modal-input title="Add domain" :closeOutside="false" :wireIgnore="false"
+                canGate="update" :canResource="$preview->application">
+                <x-slot:content>
+                    <button type="button" class="button button-highlighted">
+                        <x-reicon name="plus" class="size-3.5" />
+                        Add
+                    </button>
+                </x-slot:content>
+                <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
+                    @if ($isCompose && count($composeServices) > 0)
+                        <x-forms.listbox id="newDomainService" label="Service" required
+                            :options="collect($composeServices)->map(fn ($service) => ['value' => $service, 'label' => $service])->all()" />
+                    @endif
+                    <x-forms.domain-input id="newDomainParts" />
+
+                    <div class="flex flex-wrap items-center justify-between gap-2 pt-2">
+                        <x-forms.button type="button" wire:click="generateDomain">Generate domain</x-forms.button>
+                        <x-forms.button type="submit" isHighlighted>Save</x-forms.button>
+                    </div>
+                </form>
+            </x-modal-input>
+        @endcan
+    </div>
+
+    @if (count($domainRows) === 0)
+        <div class="application-settings-section-body">
+            <x-empty size="sm" title="No domains configured"
+                description="Add a domain or generate one with the server wildcard domain." icon-name="globe" />
+        </div>
+    @else
+        <div class="application-settings-section-body is-flush overflow-visible">
+            <div class="data-table-header domains-table-grid-service">
+                <span>Domain</span>
+                <span>DNS check</span>
+                <span></span>
+                <span></span>
+            </div>
+            @foreach ($domainRows as $index => $row)
+                @php
+                    $dnsType = match ($row['dns_status']) {
+                        'ok' => 'success',
+                        'failed' => 'error',
+                        'skipped' => 'warning',
+                        default => 'neutral',
+                    };
+                    $dnsLabel = match ($row['dns_status']) {
+                        'ok' => 'DNS OK',
+                        'failed' => 'DNS mismatch',
+                        'skipped' => 'DNS skipped',
+                        default => 'DNS pending',
+                    };
+                    $domainKey = hash('sha256', $row['url'].'|'.($row['service'] ?? ''));
+                @endphp
+                <div wire:key="preview-domain-{{ md5(($row['service'] ?? '') . $row['url']) }}" class="env-table-item">
+                    <div class="data-table-row domains-table-grid-service">
+                        <div class="flex min-w-0 flex-col gap-1">
+                            <div class="flex min-w-0 flex-wrap items-center gap-2">
+                                <x-reicon name="globe" class="size-4 shrink-0 text-neutral-400 dark:text-fg-faint" />
+                                <a href="{{ getFqdnWithoutPort($row['url']) }}" target="_blank"
+                                    class="min-w-0 flex-1 text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs sm:truncate dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
+                                    title="{{ $row['url'] }}">{{ $row['url'] }}</a>
+                                @if (filled($row['service']))
+                                    <span class="table-badge shrink-0">{{ $row['service'] }}</span>
+                                @endif
+                            </div>
+                        </div>
+                        <div class="flex min-w-0 items-center">
+                            <x-status-badge :status="$dnsLabel" :type="$dnsType" :title="$row['dns_message']" />
+                        </div>
+                        <div class="hidden"></div>
+                        <div class="flex items-center justify-end gap-1">
+                            @can('update', $preview->application)
+                                <button type="button" wire:click="checkDomainDns({{ $index }})"
+                                    wire:loading.attr="disabled"
+                                    wire:target="checkDomainDns({{ $index }}),checkAllDns"
+                                    class="icon-button shrink-0" title="Check DNS" aria-label="Check DNS">
+                                    <x-reicon name="refresh" class="size-3.5" wire:loading.remove.delay
+                                        wire:target="checkDomainDns({{ $index }}),checkAllDns" />
+                                    <x-loading-on-button wire:loading.delay
+                                        wire:target="checkDomainDns({{ $index }}),checkAllDns" />
+                                </button>
+                                <button type="button" wire:click="startEdit({{ $index }})"
+                                    class="icon-button shrink-0" title="Edit domain" aria-label="Edit domain">
+                                    <x-reicon name="settings" class="size-3.5" />
+                                </button>
+                                <x-modal-confirmation class="!w-auto shrink-0" title="Remove domain?"
+                                    buttonTitle="Remove" isErrorButton
+                                    submitAction="removeDomainByKey({{ $domainKey }})"
+                                    :actions="[
+                                        'This domain will be removed from the preview deployment.',
+                                        'Redeploy the preview to apply proxy changes.',
+                                    ]"
+                                    :confirmWithPassword="false" :confirmWithText="false"
+                                    step2ButtonText="Remove domain">
+                                    <x-slot:trigger>
+                                        <button type="button"
+                                            class="icon-button shrink-0 text-red-500 hover:text-red-600 dark:text-red-400 dark:hover:text-red-300"
+                                            title="Remove domain" aria-label="Remove domain">
+                                            <x-reicon name="trash" class="size-3.5" />
+                                        </button>
+                                    </x-slot:trigger>
+                                </x-modal-confirmation>
+                            @endcan
+                        </div>
+                    </div>
+                </div>
+            @endforeach
+        </div>
+    @endif
+
+    <template x-teleport="body">
+        <div x-show="editOpen" x-cloak class="fixed inset-0 z-99 overflow-y-auto">
+            <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]" @click="editOpen = false"></div>
+            <div class="relative flex min-h-full items-center justify-center p-4">
+                <div x-show="editOpen" x-trap.inert.noscroll="editOpen"
+                    class="application-settings-form application-settings-section relative w-full max-w-3xl">
+                    <header>
+                        <h3>Edit domain</h3>
+                        <button type="button" @click="editOpen = false" class="icon-button" aria-label="Close">
+                            <x-reicon name="x" class="size-4" />
+                        </button>
+                    </header>
+                    <div class="application-settings-section-body">
+                        <form wire:submit="updateDomain" class="flex flex-col gap-4">
+                            <x-forms.domain-input id="editingDomainParts" />
+                            <div class="flex justify-end">
+                                <x-forms.button type="submit" isHighlighted>Save</x-forms.button>
+                            </div>
+                        </form>
+                    </div>
+                </div>
+            </div>
+        </div>
+    </template>
+</div>
diff --git a/resources/views/livewire/project/application/previews-compose.blade.php b/resources/views/livewire/project/application/previews-compose.blade.php
deleted file mode 100644
index 85159682d..000000000
--- a/resources/views/livewire/project/application/previews-compose.blade.php
+++ /dev/null
@@ -1,6 +0,0 @@
-<form wire:submit="save"
-    class="grid gap-3 rounded-lg bg-neutral-50 p-3 ring-1 ring-neutral-200 md:grid-cols-[minmax(0,1fr)_auto] md:items-end dark:bg-white/[0.025] dark:ring-white/[0.07]">
-    <x-forms.input helper="One domain per preview." label="{{ Str::headline($serviceName) }} domain"
-        id="domain" wire:change="save" canGate="update" :canResource="$preview->application" />
-    <x-forms.button wire:click="generate">Generate domain</x-forms.button>
-</form>
diff --git a/resources/views/livewire/project/application/previews.blade.php b/resources/views/livewire/project/application/previews.blade.php
index ef42760b9..13b73ef66 100644
--- a/resources/views/livewire/project/application/previews.blade.php
+++ b/resources/views/livewire/project/application/previews.blade.php
@@ -251,49 +251,19 @@ class="listbox-option justify-start! gap-2.5! text-error!"
                 </div>
 
                 <div class="mt-4 border-t border-neutral-200 pt-4 dark:border-white/[0.07]">
-                    @if ($application->build_pack === 'dockercompose')
-                        @if (collect(json_decode($preview->docker_compose_domains))->count() === 0)
-                            <form wire:submit="save_preview('{{ $preview->id }}')"
-                                class="grid gap-3 md:grid-cols-[minmax(0,1fr)_auto] md:items-end">
-                                <x-forms.input label="Domain" helper="One domain per preview."
-                                    id="previewFqdns.{{ $previewName }}" canGate="update"
-                                    :canResource="$application"
-                                    wire:change="save_preview('{{ $preview->id }}')" />
-                                @can('update', $application)
-                                    <x-forms.button wire:click="generate_preview('{{ $preview->id }}')">
-                                        Generate domain
-                                    </x-forms.button>
-                                @endcan
-                            </form>
-                        @else
-                            <div class="flex flex-col gap-3">
-                                @foreach (collect(json_decode($preview->docker_compose_domains)) as $serviceName => $service)
-                                    <livewire:project.application.previews-compose
-                                        wire:key="preview-{{ $preview->pull_request_id }}-{{ $serviceName }}"
-                                        :service="$service" :serviceName="$serviceName" :preview="$preview" />
-                                @endforeach
-                            </div>
-                        @endif
-                    @else
+                    <livewire:project.application.preview-domains
+                        wire:key="preview-domains-{{ $preview->id }}"
+                        :preview="$preview" />
+
+                    @if ($application->build_pack === 'dockerimage')
                         <form wire:submit="save_preview('{{ $preview->id }}')"
-                            class="grid gap-3 {{ $application->build_pack === 'dockerimage'
-                                ? 'md:grid-cols-[minmax(0,1fr)_minmax(0,1fr)_auto]'
-                                : 'md:grid-cols-[minmax(0,1fr)_auto]' }} md:items-end">
-                            <x-forms.input label="Domain" helper="One domain per preview."
-                                id="previewFqdns.{{ $previewName }}" canGate="update"
-                                :canResource="$application"
-                                wire:change="save_preview('{{ $preview->id }}')" />
-                            @if ($application->build_pack === 'dockerimage')
-                                <x-forms.input label="Docker tag" helper="Image tag used by this preview."
-                                    id="previewDockerTags.{{ $previewName }}" canGate="update"
+                            class="application-settings-section-body is-flush mt-3 overflow-visible">
+                            <div class="data-table-header grid-cols-1"><span>Docker tag</span></div>
+                            <div class="p-3">
+                                <x-forms.input id="previewDockerTags.{{ $previewName }}" canGate="update"
                                     :canResource="$application"
                                     wire:change="save_preview('{{ $preview->id }}')" />
-                            @endif
-                            @can('update', $application)
-                                <x-forms.button wire:click="generate_preview('{{ $preview->id }}')">
-                                    Generate domain
-                                </x-forms.button>
-                            @endcan
+                            </div>
                         </form>
                     @endif
                 </div>
@@ -305,15 +275,4 @@ class="grid gap-3 {{ $application->build_pack === 'dockerimage'
         @endforelse
     </x-application.settings-section>
 
-    <x-domain-conflict-modal :conflicts="$domainConflicts" :showModal="$showDomainConflictModal"
-        confirmAction="confirmDomainUsage">
-        The preview deployment domain is already used by another resource and may cause routing conflicts.
-        <x-slot:consequences>
-            <ul class="mt-2 ml-4 list-disc">
-                <li>The preview deployment may not be accessible.</li>
-                <li>SSL certificates may not work correctly.</li>
-                <li>Requests may be routed unpredictably.</li>
-            </ul>
-        </x-slot:consequences>
-    </x-domain-conflict-modal>
 </div>
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index 43d153559..8e6775134 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -2,7 +2,10 @@
 
 use App\Jobs\CheckDomainDnsJob;
 use App\Livewire\Project\Application\Domains;
+use App\Livewire\Project\Application\PreviewDomains;
+use App\Livewire\Project\Application\Previews;
 use App\Models\Application;
+use App\Models\ApplicationPreview;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
 use App\Models\Project;
@@ -107,6 +110,469 @@
     expect($this->application->fresh()->fqdn)->toBeNull();
 });
 
+it('generates a preview domain when the application has no domain', function () {
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 41,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/41',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('generateDomain')
+        ->assertDispatched('success');
+
+    expect($preview->fresh()->fqdn)
+        ->not->toBeNull()
+        ->toContain('41.');
+});
+
+it('generates compose preview domains when the application has no domains', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 42,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/42',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('generateDomain')
+        ->assertDispatched('success');
+
+    expect($preview->fresh()->fqdn)
+        ->not->toBeNull()
+        ->toContain('42.');
+});
+
+it('derives preview domain services from compose and defaults the selected service', function () {
+    Queue::fake();
+
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  worker-pr-49:\n    image: nginx:alpine\n  database:\n    image: postgres:17\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 49,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/49',
+        'docker_compose_domains' => json_encode([
+            'removed-service' => ['domain' => ''],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertViewHas('composeServices', ['web', 'worker-pr-49'])
+        ->assertSet('newDomainService', 'web')
+        ->set('newDomainService', 'worker-pr-49')
+        ->set('newDomainParts.host', 'worker-preview.example.com')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertSet('newDomainService', 'web');
+
+    $preview->generate_preview_fqdn_compose();
+
+    expect(json_decode($preview->fresh()->docker_compose_domains, true))
+        ->toHaveKey('worker-pr-49')
+        ->not->toHaveKey('worker');
+});
+
+it('handles compose parsing failures without exposing stale preview services', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services: [\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 52,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/52',
+        'docker_compose_domains' => json_encode([
+            'stale-service' => ['domain' => ''],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertViewHas('composeServices', [])
+        ->assertSet('newDomainService', null);
+});
+
+it('does not erase preview domains when compose parsing fails during persistence', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  worker:\n    image: nginx:alpine\n",
+    ]);
+
+    $storedDomains = [
+        'web' => ['domain' => 'https://web-preview.example.com'],
+        'worker' => ['domain' => 'https://worker-preview.example.com'],
+    ];
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 53,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/53',
+        'docker_compose_domains' => json_encode($storedDomains),
+        'fqdn' => 'https://web-preview.example.com,https://worker-preview.example.com',
+    ]);
+
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview]);
+
+    $application = Mockery::mock($component->instance()->preview->application)->makePartial();
+    $application->shouldReceive('parse')->once()->andThrow(new RuntimeException('Temporary parse failure'));
+    $component->instance()->preview->setRelation('application', $application);
+
+    $component->instance()->removeDomain(0);
+
+    expect(json_decode($preview->fresh()->docker_compose_domains, true))->toBe($storedDomains)
+        ->and($preview->fresh()->fqdn)->toBe('https://web-preview.example.com,https://worker-preview.example.com')
+        ->and($component->get('domainRows'))->toHaveCount(2);
+});
+
+it('preserves empty compose service slots after removing the last preview domain', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  worker:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 50,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/50',
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://web-preview.example.com'],
+        ]),
+        'fqdn' => 'https://web-preview.example.com',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('removeDomain', 0)
+        ->assertViewHas('composeServices', ['web', 'worker']);
+
+    expect(json_decode($preview->fresh()->docker_compose_domains, true))->toBe([
+        'web' => ['domain' => ''],
+        'worker' => ['domain' => ''],
+    ]);
+});
+
+it('rejects missing and unknown services when adding compose preview domains', function (?string $service) {
+    Queue::fake();
+
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 51,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/51',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainService', $service)
+        ->call('addDomain')
+        ->assertHasErrors('newDomainService')
+        ->assertCount('domainRows', 0);
+
+    expect($preview->fresh()->docker_compose_domains)->toBeNull()
+        ->and($preview->fresh()->fqdn)->toBeNull();
+    Queue::assertNothingPushed();
+})->with([null, 'unknown']);
+
+it('generates a compose preview domain only for the selected service', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://web.example.com'],
+            'api' => ['domain' => 'https://api.example.com'],
+        ]),
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 48,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/48',
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://custom-web.example.net'],
+            'api' => ['domain' => 'https://custom-api.example.net'],
+        ]),
+        'fqdn' => 'https://custom-web.example.net,https://custom-api.example.net',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainService', 'api')
+        ->call('generateDomain')
+        ->assertDispatched('success');
+
+    $domains = json_decode($preview->fresh()->docker_compose_domains, true);
+
+    expect($domains['web']['domain'])->toBe('https://custom-web.example.net')
+        ->and($domains['api']['domain'])->toStartWith('https://custom-api.example.net,')
+        ->and($domains['api']['domain'])->toContain('48.api.example.com');
+});
+
+it('keeps compose services without application domains private when configuring a preview', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  worker:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://web.example.com'],
+            'worker' => ['domain' => ''],
+        ]),
+    ]);
+
+    Livewire::test(Previews::class, ['application' => $this->application->fresh()])
+        ->set('parameters', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'application_uuid' => $this->application->uuid,
+        ])
+        ->call('add', 43, 'https://github.com/coollabsio/coolify/pull/43');
+
+    $preview = ApplicationPreview::query()
+        ->where('application_id', $this->application->id)
+        ->where('pull_request_id', 43)
+        ->firstOrFail();
+    $composeDomains = json_decode($preview->docker_compose_domains, true);
+
+    expect($composeDomains['web']['domain'])
+        ->toContain('web.example.com')
+        ->and($composeDomains['worker']['domain'])->toBe('')
+        ->and($preview->fqdn)->toContain('web.example.com')
+        ->not->toContain('worker');
+});
+
+it('generates a domain when configuring a preview', function () {
+    Livewire::test(Previews::class, ['application' => $this->application->fresh()])
+        ->set('parameters', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'application_uuid' => $this->application->uuid,
+        ])
+        ->call('add', 43, 'https://github.com/coollabsio/coolify/pull/43')
+        ->assertDispatched('success');
+
+    $preview = ApplicationPreview::query()
+        ->where('application_id', $this->application->id)
+        ->where('pull_request_id', 43)
+        ->firstOrFail();
+
+    expect($preview->fqdn)
+        ->not->toBeNull()
+        ->toContain('43.');
+});
+
+it('manages preview domains and their dns status', function () {
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 44,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/44',
+        'fqdn' => 'https://44.example.com',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.url', 'https://44.example.com')
+        ->call('checkDomainDns', 0)
+        ->assertSet('domainRows.0.dns_status', 'skipped')
+        ->set('newDomainParts.host', 'second.example.com')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertDispatched('success')
+        ->assertCount('domainRows', 2)
+        ->call('removeDomain', 0)
+        ->assertCount('domainRows', 1);
+
+    expect($preview->fresh()->fqdn)->toBe('https://second.example.com')
+        ->and($preview->fresh()->domain_dns_statuses)->not->toBeNull();
+});
+
+it('removes the intended preview domains by stable identities after reindexing', function () {
+    $domains = [
+        'https://first.example.com',
+        'https://second.example.com',
+        'https://third.example.com',
+    ];
+    $domainKeys = array_map(fn (string $domain): string => hash('sha256', $domain.'|'), $domains);
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 47,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/47',
+        'fqdn' => implode(',', $domains),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('removeDomainByKey', $domainKeys[0])
+        ->assertSet('domainRows.0.url', $domains[1])
+        ->call('removeDomainByKey', $domainKeys[1])
+        ->assertCount('domainRows', 1)
+        ->assertSet('domainRows.0.url', $domains[2]);
+
+    expect($preview->fresh()->fqdn)->toBe($domains[2]);
+});
+
+it('renders preview domain delete confirmations with stable keys', function () {
+    $domains = [
+        'https://first.example.com',
+        'https://second.example.com',
+    ];
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 48,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/48',
+        'fqdn' => implode(',', $domains),
+    ]);
+
+    $renderedHtml = html_entity_decode(
+        Livewire::test(PreviewDomains::class, ['preview' => $preview])->html(),
+        ENT_QUOTES,
+    );
+
+    foreach ($domains as $domain) {
+        $domainKey = hash('sha256', $domain.'|');
+
+        expect($renderedHtml)->toMatch("/submitAction:\\s*[\"']removeDomainByKey\\({$domainKey}\\)[\"']/");
+    }
+
+    expect($renderedHtml)->not->toMatch('/submitAction:\\s*[\"\']removeDomain\\(\\d+\\)[\"\']/');
+});
+
+it('removes only the matching compose preview domain when services share a URL', function () {
+    $url = 'https://shared.example.com';
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  worker:\n    image: nginx:alpine\n",
+    ]);
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 49,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/49',
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => $url],
+            'worker' => ['domain' => $url],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('removeDomainByKey', hash('sha256', $url.'|worker'))
+        ->assertCount('domainRows', 1)
+        ->assertSet('domainRows.0.url', $url)
+        ->assertSet('domainRows.0.service', 'web');
+
+    expect(json_decode($preview->fresh()->docker_compose_domains, true))->toBe([
+        'web' => ['domain' => $url],
+        'worker' => ['domain' => ''],
+    ]);
+});
+
+it('adds a preview domain and starts its dns check asynchronously', function () {
+    Queue::fake();
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 45,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/45',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->call('addDomain')
+        ->assertCount('domainRows', 1)
+        ->assertSet('domainRows.0.dns_status', 'checking')
+        ->assertDispatched('success', 'Domain added. DNS check started.');
+
+    Queue::assertPushed(CheckDomainDnsJob::class, fn (CheckDomainDnsJob $job): bool => $job->resource->is($preview)
+        && $job->url === 'https://preview.example.com');
+
+    expect($preview->fresh()->fqdn)->toBe('https://preview.example.com')
+        ->and(collect($preview->fresh()->domain_dns_statuses)->first()['status'])->toBe('checking');
+});
+
+it('notifies when an asynchronous preview dns check finds a mismatch', function () {
+    $url = 'https://preview.example.com';
+    $statusKey = hash('sha256', $url.'|');
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 46,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/46',
+        'fqdn' => $url,
+        'domain_dns_statuses' => [
+            $statusKey => [
+                'status' => 'checking',
+                'message' => 'Checking DNS...',
+                'check_id' => 'preview-check',
+            ],
+        ],
+    ]);
+
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.dns_status', 'checking');
+
+    $preview->update([
+        'domain_dns_statuses' => [
+            $statusKey => [
+                'status' => 'failed',
+                'message' => 'Required DNS record type A pointing to 203.0.113.10',
+                'expected_ip' => '203.0.113.10',
+                'checked_at' => now()->toIso8601String(),
+            ],
+        ],
+    ]);
+
+    $component->call('pollDnsChecks')
+        ->assertSet('domainRows.0.dns_status', 'failed')
+        ->assertDispatched('error', 'DNS is not configured for preview.example.com. Review the required DNS record.');
+});
+
+it('does not overwrite a completed preview dns result with stale checking state', function () {
+    $url = 'https://preview.example.com';
+    $statusKey = hash('sha256', $url.'|');
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 48,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/48',
+        'fqdn' => $url,
+        'domain_dns_statuses' => [
+            $statusKey => [
+                'status' => 'checking',
+                'message' => 'Checking DNS...',
+                'check_id' => 'stale-check',
+            ],
+        ],
+    ]);
+
+    $component = Livewire::test(PreviewDomains::class, ['preview' => $preview]);
+
+    $preview->update([
+        'domain_dns_statuses' => [
+            $statusKey => [
+                'status' => 'ok',
+                'message' => 'DNS looks correct.',
+                'check_id' => 'completed-check',
+            ],
+        ],
+    ]);
+
+    $method = new ReflectionMethod($component->instance(), 'persistDnsStatuses');
+    $method->invoke($component->instance());
+
+    expect($preview->fresh()->domain_dns_statuses[$statusKey])
+        ->toMatchArray([
+            'status' => 'ok',
+            'message' => 'DNS looks correct.',
+            'check_id' => 'completed-check',
+        ]);
+});
+
 it('lists existing domains as individual rows', function () {
     $this->application->update([
         'fqdn' => 'https://example.com,https://www.example.com,https://another.example.com,https://www.another.example.com',
@@ -360,7 +826,8 @@
         ->assertHasNoErrors()
         ->assertSet('showEditDomainModal', false)
         ->assertDispatched('edit-domain-saved')
-        ->assertDispatched('success');
+        ->assertDispatched('success')
+        ->assertNotDispatched('error');
 
     $this->application->refresh();
 
diff --git a/tests/Feature/CheckDomainDnsJobTest.php b/tests/Feature/CheckDomainDnsJobTest.php
index 74502268a..d760fdcc4 100644
--- a/tests/Feature/CheckDomainDnsJobTest.php
+++ b/tests/Feature/CheckDomainDnsJobTest.php
@@ -3,6 +3,7 @@
 use App\Actions\Shared\CheckDomainDns;
 use App\Jobs\CheckDomainDnsJob;
 use App\Models\Application;
+use App\Models\ApplicationPreview;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
 use App\Models\Project;
@@ -57,6 +58,34 @@
         ->and($status['checked_at'])->not->toBeNull();
 });
 
+it('persists dns results for application previews', function () {
+    $statusKey = hash('sha256', 'https://preview.example.com|');
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 41,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/41',
+        'fqdn' => 'https://preview.example.com',
+        'domain_dns_statuses' => [
+            $statusKey => [
+                'status' => 'checking',
+                'message' => 'Checking DNS...',
+                'check_id' => 'preview-check',
+            ],
+        ],
+    ]);
+
+    (new CheckDomainDnsJob(
+        $preview,
+        $statusKey,
+        'https://preview.example.com',
+        null,
+        null,
+        'preview-check',
+    ))->handle();
+
+    expect($preview->fresh()->domain_dns_statuses[$statusKey]['status'])->toBe('skipped');
+});
+
 it('does not restore a dns status removed before the job finishes', function () {
     $this->application->update(['domain_dns_statuses' => null]);
 
diff --git a/tests/Feature/PreviewStatusSummaryTest.php b/tests/Feature/PreviewStatusSummaryTest.php
index 6c1713561..dbc2b3a29 100644
--- a/tests/Feature/PreviewStatusSummaryTest.php
+++ b/tests/Feature/PreviewStatusSummaryTest.php
@@ -77,3 +77,22 @@
         ->toContain('title="Preview logs"')
         ->toContain('title="Preview actions"');
 });
+
+it('uses the shared domain list treatment for preview domains', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/application/previews.blade.php'));
+    $domainsView = file_get_contents(resource_path('views/livewire/project/application/preview-domains.blade.php'));
+
+    expect($view)
+        ->toContain('<livewire:project.application.preview-domains')
+        ->and($domainsView)
+        ->toContain('Recheck DNS')
+        ->toContain('Add domain')
+        ->toContain('data-table-header')
+        ->toContain('domains-table-grid-service')
+        ->toContain('class="env-table-item"')
+        ->toContain('No domains configured')
+        ->toContain('class="data-table-row')
+        ->toContain('DNS OK')
+        ->toContain('Edit domain')
+        ->toContain('Remove domain');
+});
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index 4c30ef619..bbcc3a2c8 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -456,7 +456,8 @@
         ->call('updateDomain')
         ->assertHasNoErrors()
         ->assertDispatched('edit-domain-saved')
-        ->assertDispatched('success');
+        ->assertDispatched('success')
+        ->assertNotDispatched('error');
 
     $this->apiApp->refresh();
 

From e0d233f933f570a85d87a5b7ae169c07c37d9d95 Mon Sep 17 00:00:00 2001
From: Devin Dissanayaka <dsdissanayaka2002@gmail.com>
Date: Sun, 30 Aug 2026 20:23:23 +0530
Subject: [PATCH 15/55] =?UTF-8?q?fix(deployments):=20keep=20every=20domain?=
 =?UTF-8?q?=20intact=20in=20COOLIFY=5FURL=20and=20COOLIFY=E2=80=A6=20(#115?=
 =?UTF-8?q?27)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
---
 app/Jobs/ApplicationDeploymentJob.php         |  6 +-
 ...icationDeploymentCoolifyUrlDomainsTest.php | 94 +++++++++++++++++++
 2 files changed, 97 insertions(+), 3 deletions(-)
 create mode 100644 tests/Unit/ApplicationDeploymentCoolifyUrlDomainsTest.php

diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index 7168aea5f..48547c4d9 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -2280,9 +2280,9 @@ private function set_coolify_variables()
             $fqdn = $this->preview->fqdn;
         }
         if (isset($fqdn)) {
-            $url = Url::fromString($fqdn);
-            $fqdn = $url->getHost();
-            $url = $url->withHost($fqdn)->withPort(null)->__toString();
+            $domains = str($fqdn)->explode(',')->map(fn (string $domain) => trim($domain))->filter();
+            $url = $domains->map(fn (string $domain) => Url::fromString($domain)->withPort(null)->__toString())->implode(',');
+            $fqdn = $domains->map(fn (string $domain) => Url::fromString($domain)->getHost())->implode(',');
             if ((int) $this->application->compose_parsing_version >= 3) {
                 $this->coolify_variables .= 'COOLIFY_URL='.escapeShellValue($url).' ';
                 $this->coolify_variables .= 'COOLIFY_FQDN='.escapeShellValue($fqdn).' ';
diff --git a/tests/Unit/ApplicationDeploymentCoolifyUrlDomainsTest.php b/tests/Unit/ApplicationDeploymentCoolifyUrlDomainsTest.php
new file mode 100644
index 000000000..f6684718e
--- /dev/null
+++ b/tests/Unit/ApplicationDeploymentCoolifyUrlDomainsTest.php
@@ -0,0 +1,94 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Tests\TestCase;
+
+uses(TestCase::class, RefreshDatabase::class);
+
+class TestableCoolifyUrlDeploymentJob extends ApplicationDeploymentJob
+{
+    public function __construct() {}
+
+    public function execute_remote_command(...$commands): void {}
+}
+
+function coolifyVariablesForFqdn(string $fqdn, string $composeParsingVersion = '3'): string
+{
+    $team = Team::create([
+        'name' => 'Coolify Url Team',
+        'personal_team' => false,
+        'show_boarding' => false,
+    ]);
+    $project = Project::create([
+        'name' => 'Coolify Url Project',
+        'team_id' => $team->id,
+    ]);
+    $environment = Environment::where('project_id', $project->id)->firstOrFail();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockercompose',
+        'fqdn' => $fqdn,
+    ]);
+
+    // The created hook resets this, so it has to be set afterwards.
+    $application->compose_parsing_version = $composeParsingVersion;
+    $application->save();
+
+    $job = new TestableCoolifyUrlDeploymentJob;
+    $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
+
+    foreach ([
+        'application' => $application->fresh(),
+        'pull_request_id' => 0,
+        'commit' => 'HEAD',
+    ] as $property => $value) {
+        $reflection->getProperty($property)->setValue($job, $value);
+    }
+
+    $reflection->getMethod('set_coolify_variables')->invoke($job);
+
+    return $reflection->getProperty('coolify_variables')->getValue($job);
+}
+
+it('keeps every domain intact when an application has multiple domains', function () {
+    $variables = coolifyVariablesForFqdn('https://a.example.com,https://b.example.com');
+
+    expect($variables)
+        ->toContain("COOLIFY_URL='https://a.example.com,https://b.example.com'")
+        ->toContain("COOLIFY_FQDN='a.example.com,b.example.com'");
+});
+
+it('strips the port from every domain when an application has multiple domains', function () {
+    $variables = coolifyVariablesForFqdn('https://a.example.com:8080,https://b.example.com:9000');
+
+    expect($variables)
+        ->toContain("COOLIFY_URL='https://a.example.com,https://b.example.com'")
+        ->toContain("COOLIFY_FQDN='a.example.com,b.example.com'");
+});
+
+it('keeps every domain intact on the legacy compose parsing version', function () {
+    $variables = coolifyVariablesForFqdn('https://a.example.com,https://b.example.com', '2');
+
+    expect($variables)
+        ->toContain("COOLIFY_URL='a.example.com,b.example.com'")
+        ->toContain("COOLIFY_FQDN='https://a.example.com,https://b.example.com'");
+});
+
+it('still resolves a single domain', function () {
+    $variables = coolifyVariablesForFqdn('https://a.example.com');
+
+    expect($variables)
+        ->toContain("COOLIFY_URL='https://a.example.com'")
+        ->toContain("COOLIFY_FQDN='a.example.com'");
+});

From e514a2d61f26012928e4fc58e926edd686344cc4 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 30 Aug 2026 20:37:05 +0200
Subject: [PATCH 16/55] fix(resources): dispatch deletion cleanup after
 response

---
 app/Livewire/Project/Shared/Danger.php        |  3 +-
 tests/v4/Feature/DangerDeleteResourceTest.php | 31 ++++++++++++++-----
 2 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/app/Livewire/Project/Shared/Danger.php b/app/Livewire/Project/Shared/Danger.php
index 7f0d3b173..d2420a029 100644
--- a/app/Livewire/Project/Shared/Danger.php
+++ b/app/Livewire/Project/Shared/Danger.php
@@ -106,14 +106,13 @@ public function delete($password, $selectedActions = [])
 
         try {
             $this->authorize('delete', $this->resource);
-            $this->resource->delete();
             DeleteResourceJob::dispatch(
                 $this->resource,
                 $this->delete_volumes,
                 $this->delete_connected_networks,
                 $this->delete_configurations,
                 $this->docker_cleanup
-            );
+            )->afterResponse();
 
             return redirectRoute($this, 'project.resource.index', [
                 'project_uuid' => $this->projectUuid,
diff --git a/tests/v4/Feature/DangerDeleteResourceTest.php b/tests/v4/Feature/DangerDeleteResourceTest.php
index 7a73f5979..af409a3c4 100644
--- a/tests/v4/Feature/DangerDeleteResourceTest.php
+++ b/tests/v4/Feature/DangerDeleteResourceTest.php
@@ -1,11 +1,13 @@
 <?php
 
+use App\Jobs\DeleteResourceJob;
 use App\Livewire\Project\Shared\Danger;
 use App\Models\Application;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
 use App\Models\Project;
 use App\Models\Server;
+use App\Models\Service;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
@@ -18,7 +20,7 @@
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::create(['id' => 0]);
+    InstanceSettings::forceCreate(['id' => 0]);
     Queue::fake();
 
     $this->user = User::factory()->create([
@@ -61,13 +63,28 @@
     expect(Application::find($this->application->id))->not->toBeNull();
 });
 
-test('delete succeeds with correct password and redirects', function () {
-    Livewire::test(Danger::class, ['resource' => $this->application])
-        ->call('delete', 'test-password')
-        ->assertHasNoErrors();
+test('delete redirects before dispatching resource cleanup after the response', function () {
+    $service = Service::factory()->create([
+        'environment_id' => $this->environment->id,
+        'server_id' => $this->server->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
 
-    // Resource should be soft-deleted
-    expect(Application::find($this->application->id))->toBeNull();
+    $component = Livewire::test(Danger::class, ['resource' => $service])
+        ->set('projectUuid', $this->project->uuid)
+        ->set('environmentUuid', $this->environment->uuid)
+        ->call('delete', 'test-password')
+        ->assertHasNoErrors()
+        ->assertRedirectToRoute('project.resource.index', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+        ]);
+
+    expect($component->effects)->toHaveKey('redirectUsingNavigate', true);
+
+    expect(Service::find($service->id))->not->toBeNull();
+    Queue::assertPushed(DeleteResourceJob::class, fn (DeleteResourceJob $job) => $job->resource->is($service));
 });
 
 test('delete applies selectedActions from checkbox state', function () {

From 67b33c27a9eb6718e965ff2cd58cd5645b322350 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 31 Aug 2026 13:13:26 +0200
Subject: [PATCH 17/55] fix(applications): persist restart limit state for
 stopped containers (#11566)

---
 app/Actions/Application/StopApplication.php   |  24 +-
 .../Application/StopApplicationPreview.php    |  36 +++
 app/Actions/Database/StartDatabase.php        |   1 +
 app/Actions/Database/StopDatabase.php         |  28 ++-
 app/Actions/Docker/GetContainersStatus.php    | 179 ++++++++------
 app/Actions/Service/StartService.php          |   2 +
 app/Actions/Service/StopService.php           |  10 +-
 .../Service/StopServiceApplication.php        |  17 +-
 .../Api/NotificationsController.php           |  10 +-
 .../Controllers/Api/SentinelController.php    |   3 +-
 app/Jobs/ApplicationDeploymentJob.php         |  14 +-
 app/Jobs/PushServerUpdateJob.php              | 184 ++++++++++++++-
 app/Livewire/Notifications/Discord.php        |   5 +
 app/Livewire/Notifications/Email.php          |   5 +
 app/Livewire/Notifications/Pushover.php       |   5 +
 app/Livewire/Notifications/Slack.php          |   5 +
 app/Livewire/Notifications/Telegram.php       |  38 +--
 app/Livewire/Notifications/Webhook.php        |   5 +
 app/Livewire/Project/Resource/Index.php       |   5 +
 app/Livewire/Project/Service/Heading.php      |  26 ++
 app/Livewire/Project/Service/Status.php       |  14 +-
 app/Models/Application.php                    |  10 +-
 app/Models/ApplicationPreview.php             |   8 +-
 app/Models/DiscordNotificationSettings.php    |   2 +
 app/Models/EmailNotificationSettings.php      |   2 +
 app/Models/PushoverNotificationSettings.php   |   2 +
 app/Models/ServiceApplication.php             |   3 +-
 app/Models/ServiceDatabase.php                |   3 +-
 app/Models/SlackNotificationSettings.php      |   2 +
 app/Models/StandaloneClickhouse.php           |   3 +-
 app/Models/StandaloneDragonfly.php            |   3 +-
 app/Models/StandaloneKeydb.php                |   3 +-
 app/Models/StandaloneMariadb.php              |   3 +-
 app/Models/StandaloneMongodb.php              |   3 +-
 app/Models/StandaloneMysql.php                |   3 +-
 app/Models/StandalonePostgresql.php           |   3 +-
 app/Models/StandaloneRedis.php                |   3 +-
 app/Models/TelegramNotificationSettings.php   |   5 +
 app/Models/WebhookNotificationSettings.php    |   2 +
 .../Application/RestartLimitReached.php       |  48 ++--
 .../Channels/TelegramChannel.php              |  45 ++--
 .../Container/ContainerStopped.php            | 123 ----------
 app/Services/ContainerStatusAggregator.php    |  34 ++-
 app/Services/RestartCountTracker.php          |  31 +++
 app/Traits/HasRestartLimit.php                |  73 ++++++
 ...ontainer_present_to_applications_table.php |  28 +++
 ...rt_limit_reached_to_applications_table.php |  37 +++
 ..._restart_limit_to_application_previews.php |  32 +++
 ..._restart_limit_to_service_applications.php |  32 +++
 ...add_restart_limit_to_service_databases.php |  32 +++
 ...estart_limit_to_standalone_postgresqls.php |  23 ++
 ..._add_restart_limit_to_standalone_redis.php |  23 ++
 ...d_restart_limit_to_standalone_mongodbs.php |  23 ++
 ...add_restart_limit_to_standalone_mysqls.php |  23 ++
 ...d_restart_limit_to_standalone_mariadbs.php |  23 ++
 ...add_restart_limit_to_standalone_keydbs.php |  23 ++
 ...estart_limit_to_standalone_dragonflies.php |  23 ++
 ...estart_limit_to_standalone_clickhouses.php |  23 ++
 ...s_to_email_notification_settings_table.php |  28 +++
 ...to_discord_notification_settings_table.php |  28 +++
 ...o_telegram_notification_settings_table.php |  30 +++
 ...s_to_slack_notification_settings_table.php |  28 +++
 ...o_pushover_notification_settings_table.php |  28 +++
 ...to_webhook_notification_settings_table.php |  28 +++
 .../restart-limit-warning.blade.php           |  10 +
 .../notification/event-grid.blade.php         |  11 +-
 .../views/components/status-summary.blade.php |   3 +-
 .../views/components/status/index.blade.php   |   4 +-
 .../views/emails/container-stopped.blade.php  |   7 -
 .../livewire/notifications/email.blade.php    |   6 +-
 .../project/application/heading.blade.php     |  54 +++--
 .../project/application/previews.blade.php    |   1 +
 .../project/application/status.blade.php      |   1 +
 .../project/database/heading.blade.php        |   7 +-
 .../project/database/status.blade.php         |   1 +
 .../livewire/project/resource/index.blade.php |  27 ++-
 .../project/service/configuration.blade.php   |   6 +-
 .../project/service/heading.blade.php         |  44 +++-
 .../project/service/resource-card.blade.php   |  30 ++-
 .../livewire/project/service/status.blade.php |   7 +-
 .../project/shared/destination.blade.php      |   4 +
 .../views/livewire/server/resources.blade.php |  12 +-
 .../Feature/AllResourceRestartLimitsTest.php  | 223 ++++++++++++++++++
 .../ApplicationContainerPresenceTest.php      |  56 +++++
 ...pplicationStoppedAfterRestartLimitTest.php | 167 ++++++++++++-
 .../NotificationAuthorizationTest.php         |  74 ++++++
 ...bleLivewireComponentsAuthorizationTest.php |  16 ++
 .../NotificationRestartLimitSettingTest.php   |  48 ++++
 tests/Feature/PreviewStatusSummaryTest.php    |  12 +-
 .../ResourceHeadingUnifiedNavbarTest.php      |  19 ++
 .../Feature/SentinelPushDeduplicationTest.php |  10 +
 tests/Unit/ContainerStatusAggregatorTest.php  |  32 ++-
 .../PushServerUpdateJobReturnTypesTest.php    |   9 +
 ...emovedContainerStoppedNotificationTest.php |  11 +
 tests/Unit/RestartCountTrackerTest.php        |  95 ++++++++
 tests/Unit/StopActionsPersistStatusTest.php   |  11 +-
 tests/Unit/StopDatabaseTypesTest.php          |  12 +
 97 files changed, 2181 insertions(+), 397 deletions(-)
 create mode 100644 app/Actions/Application/StopApplicationPreview.php
 delete mode 100644 app/Notifications/Container/ContainerStopped.php
 create mode 100644 app/Services/RestartCountTracker.php
 create mode 100644 app/Traits/HasRestartLimit.php
 create mode 100644 database/migrations/2026_08_30_193506_add_container_present_to_applications_table.php
 create mode 100644 database/migrations/2026_08_30_220617_add_restart_limit_reached_to_applications_table.php
 create mode 100644 database/migrations/2026_08_31_073116_add_restart_limit_to_application_previews.php
 create mode 100644 database/migrations/2026_08_31_073117_add_restart_limit_to_service_applications.php
 create mode 100644 database/migrations/2026_08_31_073118_add_restart_limit_to_service_databases.php
 create mode 100644 database/migrations/2026_08_31_073119_add_restart_limit_to_standalone_postgresqls.php
 create mode 100644 database/migrations/2026_08_31_073120_add_restart_limit_to_standalone_redis.php
 create mode 100644 database/migrations/2026_08_31_073121_add_restart_limit_to_standalone_mongodbs.php
 create mode 100644 database/migrations/2026_08_31_073122_add_restart_limit_to_standalone_mysqls.php
 create mode 100644 database/migrations/2026_08_31_073123_add_restart_limit_to_standalone_mariadbs.php
 create mode 100644 database/migrations/2026_08_31_073124_add_restart_limit_to_standalone_keydbs.php
 create mode 100644 database/migrations/2026_08_31_073125_add_restart_limit_to_standalone_dragonflies.php
 create mode 100644 database/migrations/2026_08_31_073126_add_restart_limit_to_standalone_clickhouses.php
 create mode 100644 database/migrations/2026_08_31_092837_add_restart_limit_reached_notifications_to_email_notification_settings_table.php
 create mode 100644 database/migrations/2026_08_31_092838_add_restart_limit_reached_notifications_to_discord_notification_settings_table.php
 create mode 100644 database/migrations/2026_08_31_092840_add_restart_limit_reached_notifications_to_telegram_notification_settings_table.php
 create mode 100644 database/migrations/2026_08_31_092841_add_restart_limit_reached_notifications_to_slack_notification_settings_table.php
 create mode 100644 database/migrations/2026_08_31_092842_add_restart_limit_reached_notifications_to_pushover_notification_settings_table.php
 create mode 100644 database/migrations/2026_08_31_092843_add_restart_limit_reached_notifications_to_webhook_notification_settings_table.php
 create mode 100644 resources/views/components/application/restart-limit-warning.blade.php
 delete mode 100644 resources/views/emails/container-stopped.blade.php
 create mode 100644 tests/Feature/AllResourceRestartLimitsTest.php
 create mode 100644 tests/Feature/ApplicationContainerPresenceTest.php
 create mode 100644 tests/Feature/NotificationRestartLimitSettingTest.php
 create mode 100644 tests/Unit/PushServerUpdateJobReturnTypesTest.php
 create mode 100644 tests/Unit/RemovedContainerStoppedNotificationTest.php
 create mode 100644 tests/Unit/RestartCountTrackerTest.php
 create mode 100644 tests/Unit/StopDatabaseTypesTest.php

diff --git a/app/Actions/Application/StopApplication.php b/app/Actions/Application/StopApplication.php
index 66ceb95f6..3feb5117d 100644
--- a/app/Actions/Application/StopApplication.php
+++ b/app/Actions/Application/StopApplication.php
@@ -13,8 +13,9 @@ class StopApplication
 
     public string $jobQueue = 'high';
 
-    public function handle(Application $application, bool $previewDeployments = false, bool $dockerCleanup = true, bool $resetRestartCount = true)
+    public function handle(Application $application, bool $previewDeployments = false, bool $dockerCleanup = true, bool $resetRestartCount = true, bool $removeContainers = true): ?string
     {
+        $containerPresent = ! $removeContainers;
         $servers = collect([$application->destination->server]);
         if ($application?->additional_servers?->count() > 0) {
             $servers = $servers->merge($application->additional_servers);
@@ -26,6 +27,7 @@ public function handle(Application $application, bool $previewDeployments = fals
                 }
 
                 if ($server->isSwarm()) {
+                    $containerPresent = false;
                     instant_remote_process(["docker stack rm {$application->uuid}"], $server);
 
                     continue;
@@ -39,13 +41,17 @@ public function handle(Application $application, bool $previewDeployments = fals
                 $timeout = $application->settings->stopGracePeriodSeconds();
 
                 foreach ($containersToStop as $containerName) {
-                    instant_remote_process(command: [
-                        dockerStopCommand($timeout, $containerName, $server),
-                        "docker rm -f $containerName",
-                    ], server: $server, throwError: false);
+                    $commands = [dockerStopCommand($timeout, $containerName, $server)];
+                    if ($removeContainers) {
+                        $commands[] = "docker rm -f $containerName";
+                    } else {
+                        array_unshift($commands, "docker update --restart=no $containerName");
+                    }
+
+                    instant_remote_process(command: $commands, server: $server, throwError: false);
                 }
 
-                if ($application->build_pack === 'dockercompose') {
+                if ($removeContainers && $application->build_pack === 'dockercompose') {
                     $application->deleteConnectedNetworks();
                 }
 
@@ -57,12 +63,16 @@ public function handle(Application $application, bool $previewDeployments = fals
             }
         }
 
-        $status = ['status' => 'exited'];
+        $status = [
+            'status' => 'exited',
+            'container_present' => $containerPresent,
+        ];
         if ($resetRestartCount) {
             $status = array_merge($status, [
                 'restart_count' => 0,
                 'last_restart_at' => null,
                 'last_restart_type' => null,
+                'restart_limit_reached' => false,
             ]);
         }
         $application->update($status);
diff --git a/app/Actions/Application/StopApplicationPreview.php b/app/Actions/Application/StopApplicationPreview.php
new file mode 100644
index 000000000..af5f3fc0f
--- /dev/null
+++ b/app/Actions/Application/StopApplicationPreview.php
@@ -0,0 +1,36 @@
+<?php
+
+namespace App\Actions\Application;
+
+use App\Events\ServiceStatusChanged;
+use App\Models\ApplicationPreview;
+use Lorisleiva\Actions\Concerns\AsAction;
+
+class StopApplicationPreview
+{
+    use AsAction;
+
+    public function handle(ApplicationPreview $preview, bool $resetRestartCount = true, bool $removeContainer = true): void
+    {
+        $application = $preview->application;
+        $server = $application->destination->server;
+        $containers = getCurrentApplicationContainerStatus($server, $application->id, $preview->pull_request_id);
+
+        foreach ($containers->pluck('Names') as $containerName) {
+            $commands = [dockerStopCommand($application->settings->stopGracePeriodSeconds(), $containerName, $server)];
+            if ($removeContainer) {
+                $commands[] = "docker rm -f $containerName";
+            } else {
+                array_unshift($commands, "docker update --restart=no $containerName");
+            }
+            instant_remote_process($commands, $server, false);
+        }
+
+        $preview->update(['status' => 'exited']);
+        if ($resetRestartCount) {
+            $preview->resetRestartLimit();
+        }
+
+        ServiceStatusChanged::dispatch($application->environment->project->team->id);
+    }
+}
diff --git a/app/Actions/Database/StartDatabase.php b/app/Actions/Database/StartDatabase.php
index 4b55b0c1d..7735c77d8 100644
--- a/app/Actions/Database/StartDatabase.php
+++ b/app/Actions/Database/StartDatabase.php
@@ -28,6 +28,7 @@ public function handle(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|St
         if (! $server->isFunctional()) {
             return 'Server is not functional';
         }
+        $database->resetRestartLimit();
         switch ($database->getMorphClass()) {
             case StandalonePostgresql::class:
                 $activity = StartPostgresql::run($database);
diff --git a/app/Actions/Database/StopDatabase.php b/app/Actions/Database/StopDatabase.php
index a3a7f16ef..f3c591acf 100644
--- a/app/Actions/Database/StopDatabase.php
+++ b/app/Actions/Database/StopDatabase.php
@@ -4,6 +4,7 @@
 
 use App\Actions\Server\CleanupDocker;
 use App\Events\ServiceStatusChanged;
+use App\Models\BaseModel;
 use App\Models\StandaloneClickhouse;
 use App\Models\StandaloneDragonfly;
 use App\Models\StandaloneKeydb;
@@ -18,7 +19,7 @@ class StopDatabase
 {
     use AsAction;
 
-    public function handle(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse $database, bool $dockerCleanup = true)
+    public function handle(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse $database, bool $dockerCleanup = true, bool $resetRestartCount = true, bool $removeContainer = true): string
     {
         try {
             $server = $database->destination->server;
@@ -26,15 +27,13 @@ public function handle(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|St
                 return 'Server is not functional';
             }
 
-            $this->stopContainer($database, $database->uuid, 30);
+            $this->stopContainer($database, $database->uuid, 30, $removeContainer);
 
             // Reset restart tracking when database is manually stopped
-            $database->update([
-                'status' => 'exited',
-                'restart_count' => 0,
-                'last_restart_at' => null,
-                'last_restart_type' => null,
-            ]);
+            $database->update(['status' => 'exited']);
+            if ($resetRestartCount) {
+                $database->resetRestartLimit();
+            }
 
             if ($dockerCleanup) {
                 CleanupDocker::dispatch($server, false, false);
@@ -53,12 +52,15 @@ public function handle(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|St
 
     }
 
-    private function stopContainer($database, string $containerName, int $timeout = 30): void
+    private function stopContainer(BaseModel $database, string $containerName, int $timeout = 30, bool $removeContainer = true): void
     {
         $server = $database->destination->server;
-        instant_remote_process(command: [
-            dockerStopCommand($timeout, $containerName, $server),
-            "docker rm -f $containerName",
-        ], server: $server, throwError: false);
+        $commands = [dockerStopCommand($timeout, $containerName, $server)];
+        if ($removeContainer) {
+            $commands[] = "docker rm -f $containerName";
+        } else {
+            array_unshift($commands, "docker update --restart=no $containerName");
+        }
+        instant_remote_process(command: $commands, server: $server, throwError: false);
     }
 }
diff --git a/app/Actions/Docker/GetContainersStatus.php b/app/Actions/Docker/GetContainersStatus.php
index 904885dfc..be098e481 100644
--- a/app/Actions/Docker/GetContainersStatus.php
+++ b/app/Actions/Docker/GetContainersStatus.php
@@ -3,15 +3,20 @@
 namespace App\Actions\Docker;
 
 use App\Actions\Application\StopApplication;
+use App\Actions\Application\StopApplicationPreview;
 use App\Actions\Database\StartDatabaseProxy;
+use App\Actions\Database\StopDatabase;
 use App\Actions\Database\StopDatabaseProxy;
+use App\Actions\Service\StopServiceApplication;
 use App\Actions\Shared\ComplexStatusCheck;
 use App\Events\ServiceChecked;
+use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\Server;
 use App\Models\ServiceDatabase;
 use App\Notifications\Application\RestartLimitReached as ApplicationRestartLimitReached;
 use App\Services\ContainerStatusAggregator;
+use App\Services\RestartCountTracker;
 use App\Traits\CalculatesExcludedStatus;
 use Illuminate\Support\Arr;
 use Illuminate\Support\Collection;
@@ -37,8 +42,12 @@ class GetContainersStatus
 
     protected ?Collection $applicationContainerRestartCounts;
 
+    protected ?Collection $previewContainerRestartCounts;
+
     protected ?Collection $serviceContainerStatuses;
 
+    protected ?Collection $serviceContainerRestartCounts;
+
     public function handle(Server $server, ?Collection $containers = null, ?Collection $containerReplicates = null)
     {
         $this->containers = $containers;
@@ -117,6 +126,9 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
                 $containerStatus = "$containerStatus:$healthSuffix";
             }
             $labels = Arr::undot(format_docker_labels_to_json($labels));
+            if (filter_var(data_get($labels, 'com.docker.compose.oneoff'), FILTER_VALIDATE_BOOLEAN)) {
+                continue;
+            }
             $applicationId = data_get($labels, 'coolify.applicationId');
             if ($applicationId) {
                 $pullRequestId = data_get($labels, 'coolify.pullRequestId');
@@ -133,6 +145,12 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
                         } else {
                             $preview->update(['last_online_at' => now()]);
                         }
+                        $key = $applicationId.':'.$pullRequestId;
+                        $this->previewContainerRestartCounts ??= collect();
+                        $this->previewContainerRestartCounts->push([
+                            'key' => $key,
+                            'count' => (int) data_get($container, 'RestartCount', 0),
+                        ]);
                     } else {
                         // Notify user that this container should not be there.
                     }
@@ -140,6 +158,9 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
                     $application = $this->applications->where('id', $applicationId)->first();
                     if ($application) {
                         $foundApplications[] = $application->id;
+                        if ($application->container_present !== true) {
+                            $application->update(['container_present' => true]);
+                        }
                         // Store container status for aggregation
                         if (! isset($this->applicationContainerStatuses)) {
                             $this->applicationContainerStatuses = collect();
@@ -220,23 +241,19 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
 
                             // Track restart count for databases (single-container)
                             $restartCount = data_get($container, 'RestartCount', 0);
-                            $previousRestartCount = $database->restart_count ?? 0;
-
                             if ($statusFromDb !== $containerStatus) {
                                 $updateData = ['status' => $containerStatus];
                             } else {
                                 $updateData = ['last_online_at' => now()];
                             }
 
-                            // Update restart tracking if restart count increased
-                            if ($restartCount > $previousRestartCount) {
-                                $updateData['restart_count'] = $restartCount;
-                                $updateData['last_restart_at'] = now();
-                                $updateData['last_restart_type'] = 'crash';
-                            }
-
                             $database->update($updateData);
 
+                            if ($database->trackRestartCount((int) $restartCount)) {
+                                StopDatabase::dispatch($database, false, false, false);
+                                $database->team()?->notify(new ApplicationRestartLimitReached($database));
+                            }
+
                             if ($isPublic) {
                                 $foundTcpProxy = $this->containers->filter(function ($value, $key) use ($uuid) {
                                     if ($this->server->isSwarm()) {
@@ -292,6 +309,11 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
                 $containerName = data_get($labels, 'com.docker.compose.service');
                 if ($containerName) {
                     $this->serviceContainerStatuses->get($key)->put($containerName, $containerStatus);
+                    $this->serviceContainerRestartCounts ??= collect();
+                    if (! $this->serviceContainerRestartCounts->has($key)) {
+                        $this->serviceContainerRestartCounts->put($key, collect());
+                    }
+                    $this->serviceContainerRestartCounts->get($key)->put($containerName, (int) data_get($container, 'RestartCount', 0));
                 }
 
                 // Mark service as found
@@ -335,46 +357,35 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
                 continue;
             }
 
-            $name = data_get($exitedService, 'name');
-            $fqdn = data_get($exitedService, 'fqdn');
-            if ($name) {
-                if ($fqdn) {
-                    $containerName = "$name, available at $fqdn";
-                } else {
-                    $containerName = $name;
-                }
-            } else {
-                if ($fqdn) {
-                    $containerName = $fqdn;
-                } else {
-                    $containerName = null;
-                }
+            if (! $exitedService->stoppedAfterRestartLimit()) {
+                $exitedService->update([
+                    'status' => 'exited',
+                    'restart_count' => 0,
+                    'restart_limit_reached' => false,
+                    'last_restart_at' => null,
+                    'last_restart_type' => null,
+                ]);
             }
-            $projectUuid = data_get($service, 'environment.project.uuid');
-            $serviceUuid = data_get($service, 'uuid');
-            $environmentName = data_get($service, 'environment.name');
-
-            if ($projectUuid && $serviceUuid && $environmentName) {
-                $url = base_url().'/project/'.$projectUuid.'/'.$environmentName.'/service/'.$serviceUuid;
-            } else {
-                $url = null;
-            }
-            // $this->server->team?->notify(new ContainerStopped($containerName, $this->server, $url));
-            $exitedService->update(['status' => 'exited']);
         }
 
         $notRunningApplications = $this->applications->pluck('id')->diff($foundApplications);
         foreach ($notRunningApplications as $applicationId) {
             $application = $this->applications->where('id', $applicationId)->first();
-            if (str($application->status)->startsWith('exited')) {
-                continue;
-            }
 
             // Only protection: If no containers at all, Docker query might have failed
             if ($this->containers->isEmpty()) {
                 continue;
             }
 
+            if (str($application->status)->startsWith('exited')) {
+                $application->update([
+                    'container_present' => false,
+                    'restart_limit_reached' => false,
+                ]);
+
+                continue;
+            }
+
             // If container was recently restarting (crash loop), keep it as degraded for a grace period
             // This prevents false "exited" status during the brief moment between container removal and recreation
             $recentlyRestarted = $application->restart_count > 0 &&
@@ -388,9 +399,11 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
                 // Reset restart count when application exits completely
                 $application->update([
                     'status' => 'exited',
+                    'container_present' => false,
                     'restart_count' => 0,
                     'last_restart_at' => null,
                     'last_restart_type' => null,
+                    'restart_limit_reached' => false,
                 ]);
             }
         }
@@ -411,6 +424,9 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
         $notRunningDatabases = $databases->pluck('id')->diff($foundDatabases);
         foreach ($notRunningDatabases as $database) {
             $database = $databases->where('id', $database)->first();
+            if ($database->stoppedAfterRestartLimit()) {
+                continue;
+            }
             if (str($database->status)->startsWith('exited')) {
                 continue;
             }
@@ -426,6 +442,7 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
                 'restart_count' => 0,
                 'last_restart_at' => null,
                 'last_restart_type' => null,
+                'restart_limit_reached' => false,
             ]);
 
             // Stop proxy if database was public
@@ -433,23 +450,10 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
                 StopDatabaseProxy::run($database);
             }
 
-            $name = data_get($database, 'name');
-            $fqdn = data_get($database, 'fqdn');
-
-            $containerName = $name;
-
-            $projectUuid = data_get($database, 'environment.project.uuid');
-            $environmentName = data_get($database, 'environment.name');
-            $databaseUuid = data_get($database, 'uuid');
-
-            if ($projectUuid && $databaseUuid && $environmentName) {
-                $url = base_url().'/project/'.$projectUuid.'/'.$environmentName.'/database/'.$databaseUuid;
-            } else {
-                $url = null;
-            }
-            // $this->server->team?->notify(new ContainerStopped($containerName, $this->server, $url));
         }
 
+        $this->trackPreviewRestartCounts($previews);
+
         // Aggregate multi-container application statuses
         if (isset($this->applicationContainerStatuses) && $this->applicationContainerStatuses->isNotEmpty()) {
             foreach ($this->applicationContainerStatuses as $applicationId => $containerStatuses) {
@@ -470,21 +474,21 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
 
                 DB::transaction(function () use ($application, $maxRestartCount, $containerStatuses, &$restartLimitReached) {
                     $previousRestartCount = $application->restart_count ?? 0;
+                    $restartState = (new RestartCountTracker)->evaluate(
+                        previousRestartCount: $previousRestartCount,
+                        observedRestartCount: $maxRestartCount,
+                        maxRestartCount: $application->max_restart_count ?? 0,
+                    );
 
-                    if ($maxRestartCount > $previousRestartCount) {
-                        // Restart count increased - this is a crash restart
+                    if ($restartState['restart_count_changed']) {
+                        $hasCrashRestarts = $restartState['restart_count'] > 0;
                         $application->update([
-                            'restart_count' => $maxRestartCount,
-                            'last_restart_at' => now(),
-                            'last_restart_type' => 'crash',
+                            'restart_count' => $restartState['restart_count'],
+                            'last_restart_at' => $hasCrashRestarts ? now() : null,
+                            'last_restart_type' => $hasCrashRestarts ? 'crash' : null,
                         ]);
-
-                        // Check if restart limit has been reached
-                        $maxAllowedRestarts = $application->max_restart_count ?? 0;
-                        if ($maxAllowedRestarts > 0 && $maxRestartCount >= $maxAllowedRestarts && $previousRestartCount < $maxAllowedRestarts) {
-                            $restartLimitReached = true;
-                        }
                     }
+                    $restartLimitReached = $restartState['restart_limit_reached'];
 
                     // Aggregate status after tracking restart counts
                     $aggregatedStatus = $this->aggregateApplicationStatus($application, $containerStatuses, $maxRestartCount);
@@ -499,9 +503,22 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
                 });
 
                 if ($restartLimitReached) {
-                    $application->refresh();
-                    StopApplication::dispatch($application, false, true, false);
-                    $application->environment->project->team?->notify(new ApplicationRestartLimitReached($application));
+                    $restartLimitClaimed = Application::query()
+                        ->whereKey($application->getKey())
+                        ->where('restart_limit_reached', false)
+                        ->update(['restart_limit_reached' => true]) === 1;
+
+                    if ($restartLimitClaimed) {
+                        $application->refresh();
+                        StopApplication::dispatch(
+                            application: $application,
+                            previewDeployments: false,
+                            dockerCleanup: false,
+                            resetRestartCount: false,
+                            removeContainers: false,
+                        );
+                        $application->environment->project->team?->notify(new ApplicationRestartLimitReached($application));
+                    }
                 }
             }
         }
@@ -562,6 +579,16 @@ private function aggregateServiceContainerStatuses($services)
                 continue;
             }
 
+            $restartCount = isset($this->serviceContainerRestartCounts)
+                ? ($this->serviceContainerRestartCounts->get($key)?->max() ?? 0)
+                : 0;
+            if ($subResource->trackRestartCount($restartCount)) {
+                StopServiceApplication::dispatch($subResource, false, false);
+                $subResource->team()?->notify(new ApplicationRestartLimitReached($subResource));
+
+                continue;
+            }
+
             // Parse docker compose from service to check for excluded containers
             $dockerComposeRaw = data_get($service, 'docker_compose_raw');
             $excludedContainers = $this->getExcludedContainersFromDockerCompose($dockerComposeRaw);
@@ -602,4 +629,24 @@ private function aggregateServiceContainerStatuses($services)
             }
         }
     }
+
+    private function trackPreviewRestartCounts(Collection $previews): void
+    {
+        if (! isset($this->previewContainerRestartCounts)) {
+            return;
+        }
+
+        $this->previewContainerRestartCounts
+            ->groupBy('key')
+            ->each(function (Collection $counts, string $key) use ($previews): void {
+                [$applicationId, $pullRequestId] = explode(':', $key);
+                $preview = $previews->first(fn (ApplicationPreview $preview): bool => (string) $preview->application_id === $applicationId
+                    && (string) $preview->pull_request_id === $pullRequestId
+                );
+                if ($preview?->trackRestartCount((int) $counts->max('count'))) {
+                    StopApplicationPreview::dispatch($preview, false, false);
+                    $preview->application->environment->project->team?->notify(new ApplicationRestartLimitReached($preview));
+                }
+            });
+    }
 }
diff --git a/app/Actions/Service/StartService.php b/app/Actions/Service/StartService.php
index 463a8ad5b..13371d126 100644
--- a/app/Actions/Service/StartService.php
+++ b/app/Actions/Service/StartService.php
@@ -24,6 +24,8 @@ public function handle(Service $service, bool $pullLatestImages = false, bool $s
         }
         $service->saveComposeConfigs();
         $service->isConfigurationChanged(save: true);
+        $service->applications()->get()->each->resetRestartLimit();
+        $service->databases()->get()->each->resetRestartLimit();
         $workdir = $service->workdir();
         // $commands[] = "cd {$workdir}";
         $commands[] = "echo 'Saved configuration files to {$workdir}.'";
diff --git a/app/Actions/Service/StopService.php b/app/Actions/Service/StopService.php
index 5e34c8e6a..341687d0d 100644
--- a/app/Actions/Service/StopService.php
+++ b/app/Actions/Service/StopService.php
@@ -49,8 +49,14 @@ public function handle(Service $service, bool $deleteConnectedNetworks = false,
                 $this->stopContainersInParallel($containersToStop, $server);
             }
 
-            $applications->each->update(['status' => 'exited']);
-            $dbs->each->update(['status' => 'exited']);
+            $applications->each(function ($application): void {
+                $application->update(['status' => 'exited']);
+                $application->resetRestartLimit();
+            });
+            $dbs->each(function ($database): void {
+                $database->update(['status' => 'exited']);
+                $database->resetRestartLimit();
+            });
 
             if ($deleteConnectedNetworks) {
                 $service->deleteConnectedNetworks();
diff --git a/app/Actions/Service/StopServiceApplication.php b/app/Actions/Service/StopServiceApplication.php
index 184dcb491..fa93a7880 100644
--- a/app/Actions/Service/StopServiceApplication.php
+++ b/app/Actions/Service/StopServiceApplication.php
@@ -13,17 +13,26 @@ class StopServiceApplication
 
     public string $jobQueue = 'high';
 
-    public function handle(ServiceApplication|ServiceDatabase $serviceApplication): void
+    public function handle(ServiceApplication|ServiceDatabase $serviceApplication, bool $resetRestartCount = true, bool $removeContainer = false): void
     {
         $service = $serviceApplication->service;
         $server = $service->destination->server;
         $containerName = escapeshellarg($serviceApplication->name.'-'.$service->uuid);
 
-        instant_remote_process([
-            "docker stop {$containerName}",
-        ], $server);
+        if ($removeContainer) {
+            $commands = ["docker rm -f {$containerName}"];
+        } else {
+            $commands = [
+                "docker update --restart=no {$containerName}",
+                "docker stop {$containerName}",
+            ];
+        }
+        instant_remote_process($commands, $server, throwError: ! $removeContainer);
 
         $serviceApplication->update(['status' => 'exited']);
+        if ($resetRestartCount) {
+            $serviceApplication->resetRestartLimit();
+        }
         ServiceStatusChanged::dispatch($service->environment->project->team->id);
     }
 }
diff --git a/app/Http/Controllers/Api/NotificationsController.php b/app/Http/Controllers/Api/NotificationsController.php
index f5493d024..1cca69a66 100644
--- a/app/Http/Controllers/Api/NotificationsController.php
+++ b/app/Http/Controllers/Api/NotificationsController.php
@@ -15,6 +15,7 @@
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Validator;
 use OpenApi\Attributes as OA;
 
 class NotificationsController extends Controller
@@ -45,6 +46,7 @@ private function channelConfig(string $channel): array
                     'deployment_success_email_notifications' => 'sometimes|boolean',
                     'deployment_failure_email_notifications' => 'sometimes|boolean',
                     'status_change_email_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_email_notifications' => 'sometimes|boolean',
                     'backup_success_email_notifications' => 'sometimes|boolean',
                     'backup_failure_email_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_email_notifications' => 'sometimes|boolean',
@@ -66,6 +68,7 @@ private function channelConfig(string $channel): array
                     'deployment_success_discord_notifications' => 'sometimes|boolean',
                     'deployment_failure_discord_notifications' => 'sometimes|boolean',
                     'status_change_discord_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_discord_notifications' => 'sometimes|boolean',
                     'backup_success_discord_notifications' => 'sometimes|boolean',
                     'backup_failure_discord_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_discord_notifications' => 'sometimes|boolean',
@@ -88,6 +91,7 @@ private function channelConfig(string $channel): array
                     'deployment_success_slack_notifications' => 'sometimes|boolean',
                     'deployment_failure_slack_notifications' => 'sometimes|boolean',
                     'status_change_slack_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_slack_notifications' => 'sometimes|boolean',
                     'backup_success_slack_notifications' => 'sometimes|boolean',
                     'backup_failure_slack_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_slack_notifications' => 'sometimes|boolean',
@@ -110,6 +114,7 @@ private function channelConfig(string $channel): array
                     'deployment_success_telegram_notifications' => 'sometimes|boolean',
                     'deployment_failure_telegram_notifications' => 'sometimes|boolean',
                     'status_change_telegram_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_telegram_notifications' => 'sometimes|boolean',
                     'backup_success_telegram_notifications' => 'sometimes|boolean',
                     'backup_failure_telegram_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_telegram_notifications' => 'sometimes|boolean',
@@ -124,6 +129,7 @@ private function channelConfig(string $channel): array
                     'telegram_notifications_deployment_success_thread_id' => 'sometimes|nullable|string|max:255',
                     'telegram_notifications_deployment_failure_thread_id' => 'sometimes|nullable|string|max:255',
                     'telegram_notifications_status_change_thread_id' => 'sometimes|nullable|string|max:255',
+                    'telegram_notifications_restart_limit_reached_thread_id' => 'sometimes|nullable|string|max:255',
                     'telegram_notifications_backup_success_thread_id' => 'sometimes|nullable|string|max:255',
                     'telegram_notifications_backup_failure_thread_id' => 'sometimes|nullable|string|max:255',
                     'telegram_notifications_scheduled_task_success_thread_id' => 'sometimes|nullable|string|max:255',
@@ -146,6 +152,7 @@ private function channelConfig(string $channel): array
                     'deployment_success_pushover_notifications' => 'sometimes|boolean',
                     'deployment_failure_pushover_notifications' => 'sometimes|boolean',
                     'status_change_pushover_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_pushover_notifications' => 'sometimes|boolean',
                     'backup_success_pushover_notifications' => 'sometimes|boolean',
                     'backup_failure_pushover_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_pushover_notifications' => 'sometimes|boolean',
@@ -167,6 +174,7 @@ private function channelConfig(string $channel): array
                     'deployment_success_webhook_notifications' => 'sometimes|boolean',
                     'deployment_failure_webhook_notifications' => 'sometimes|boolean',
                     'status_change_webhook_notifications' => 'sometimes|boolean',
+                    'restart_limit_reached_webhook_notifications' => 'sometimes|boolean',
                     'backup_success_webhook_notifications' => 'sometimes|boolean',
                     'backup_failure_webhook_notifications' => 'sometimes|boolean',
                     'scheduled_task_success_webhook_notifications' => 'sometimes|boolean',
@@ -249,7 +257,7 @@ private function updateChannel(Request $request, string $channel): JsonResponse
         $body = $request->json()->all();
         $config = $this->channelConfig($channel);
 
-        $validator = customApiValidator($body, $config['rules']);
+        $validator = Validator::make($body, $config['rules']);
 
         $extraFields = array_diff(array_keys($body), $allowedFields);
         if ($validator->fails() || ! empty($extraFields)) {
diff --git a/app/Http/Controllers/Api/SentinelController.php b/app/Http/Controllers/Api/SentinelController.php
index b3685daa4..81b932365 100644
--- a/app/Http/Controllers/Api/SentinelController.php
+++ b/app/Http/Controllers/Api/SentinelController.php
@@ -138,7 +138,7 @@ private function shouldDispatchUpdate(Server $server, array $data): bool
     /**
      * Build a stable hash of container state.
      *
-     * Covers [name, state] only — metrics, filesystem_usage_root, and
+     * Covers [name, state, restart_count] only — metrics, filesystem_usage_root, and
      * health_status are excluded on purpose. Disk % churns constantly, and
      * health checks can flap between starting/healthy/unhealthy while the
      * container lifecycle state remains unchanged. Both would otherwise defeat
@@ -153,6 +153,7 @@ private function containerStateHash(array $data): string
             ->map(fn ($c) => [
                 'name' => data_get($c, 'name'),
                 'state' => data_get($c, 'state'),
+                'restart_count' => data_get($c, 'restart_count'),
             ])
             ->sortBy('name')
             ->values()
diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index 48547c4d9..6d68160ce 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -4972,11 +4972,21 @@ private function handleSuccessfulDeployment(): void
         // Reset restart count after successful deployment
         // This is done here (not in Livewire) to avoid race conditions
         // with GetContainersStatus reading old container restart counts
-        $this->application->update([
+        $restartState = [
             'restart_count' => 0,
             'last_restart_at' => null,
             'last_restart_type' => null,
-        ]);
+        ];
+
+        if ($this->pull_request_id === 0) {
+            $restartState['restart_limit_reached'] = false;
+        }
+
+        if ($this->pull_request_id === 0) {
+            $this->application->update($restartState);
+        } else {
+            $this->preview?->resetRestartLimit();
+        }
 
         try {
             $this->application->markDeploymentConfigurationApplied($this->application_deployment_queue);
diff --git a/app/Jobs/PushServerUpdateJob.php b/app/Jobs/PushServerUpdateJob.php
index 9c4a2531a..0e73ee41b 100644
--- a/app/Jobs/PushServerUpdateJob.php
+++ b/app/Jobs/PushServerUpdateJob.php
@@ -2,11 +2,15 @@
 
 namespace App\Jobs;
 
+use App\Actions\Application\StopApplication;
+use App\Actions\Application\StopApplicationPreview;
 use App\Actions\Database\StartDatabaseProxy;
+use App\Actions\Database\StopDatabase;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Actions\Proxy\CheckProxy;
 use App\Actions\Proxy\StartProxy;
 use App\Actions\Server\StartLogDrain;
+use App\Actions\Service\StopServiceApplication;
 use App\Actions\Shared\ComplexStatusCheck;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
@@ -23,8 +27,10 @@
 use App\Models\StandalonePostgresql;
 use App\Models\StandaloneRedis;
 use App\Models\SwarmDocker;
+use App\Notifications\Application\RestartLimitReached as ApplicationRestartLimitReached;
 use App\Notifications\Container\ContainerRestarted;
 use App\Services\ContainerStatusAggregator;
+use App\Services\RestartCountTracker;
 use App\Traits\CalculatesExcludedStatus;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
@@ -95,8 +101,14 @@ class PushServerUpdateJob implements ShouldBeEncrypted, ShouldQueue, Silenced
 
     public Collection $applicationContainerStatuses;
 
+    public Collection $applicationContainerRestartCounts;
+
     public Collection $serviceContainerStatuses;
 
+    public Collection $previewContainerRestartCounts;
+
+    public Collection $serviceContainerRestartCounts;
+
     public bool $foundProxy = false;
 
     public bool $foundLogDrainContainer = false;
@@ -122,7 +134,10 @@ public function __construct(public Server $server, public $data)
         $this->foundApplicationPreviewsIds = collect();
         $this->foundServiceDatabaseIds = collect();
         $this->applicationContainerStatuses = collect();
+        $this->applicationContainerRestartCounts = collect();
         $this->serviceContainerStatuses = collect();
+        $this->previewContainerRestartCounts = collect();
+        $this->serviceContainerRestartCounts = collect();
         $this->allApplicationIds = collect();
         $this->allDatabaseUuids = collect();
         $this->allTcpProxyUuids = collect();
@@ -140,7 +155,10 @@ public function handle()
     {
         // Defensive initialization for Collection properties to handle queue deserialization edge cases
         $this->serviceContainerStatuses ??= collect();
+        $this->previewContainerRestartCounts ??= collect();
+        $this->serviceContainerRestartCounts ??= collect();
         $this->applicationContainerStatuses ??= collect();
+        $this->applicationContainerRestartCounts ??= collect();
         $this->foundApplicationIds ??= collect();
         $this->foundDatabaseUuids ??= collect();
         $this->foundServiceApplicationIds ??= collect();
@@ -231,6 +249,9 @@ public function handle()
             if (! $coolify_managed) {
                 continue;
             }
+            if (filter_var($labels->get('com.docker.compose.oneoff'), FILTER_VALIDATE_BOOLEAN)) {
+                continue;
+            }
 
             $name = data_get($container, 'name');
             if ($name === 'coolify-log-drain' && $this->isRunning($containerStatus)) {
@@ -241,6 +262,10 @@ public function handle()
                 $pullRequestId = $labels->get('coolify.pullRequestId', '0');
                 try {
                     if ($pullRequestId === '0') {
+                        $application = $this->applicationsById->get((string) $applicationId);
+                        if ($application && $application->container_present !== true) {
+                            $application->update(['container_present' => true]);
+                        }
                         if ($this->allApplicationIds->contains($applicationId)) {
                             $this->foundApplicationIds->push($applicationId);
                         }
@@ -251,6 +276,13 @@ public function handle()
                         $containerName = $labels->get('com.docker.compose.service');
                         if ($containerName) {
                             $this->applicationContainerStatuses->get($applicationId)->put($containerName, $containerStatus);
+                            $restartCount = data_get($container, 'restart_count');
+                            if (is_numeric($restartCount)) {
+                                if (! $this->applicationContainerRestartCounts->has($applicationId)) {
+                                    $this->applicationContainerRestartCounts->put($applicationId, collect());
+                                }
+                                $this->applicationContainerRestartCounts->get($applicationId)->put($containerName, (int) $restartCount);
+                            }
                         }
                     } else {
                         $previewKey = $applicationId.':'.$pullRequestId;
@@ -258,6 +290,13 @@ public function handle()
                             $this->foundApplicationPreviewsIds->push($previewKey);
                         }
                         $this->updateApplicationPreviewStatus($applicationId, $pullRequestId, $containerStatus);
+                        $restartCount = data_get($container, 'restart_count');
+                        if (is_numeric($restartCount)) {
+                            $this->previewContainerRestartCounts->push([
+                                'key' => $previewKey,
+                                'count' => (int) $restartCount,
+                            ]);
+                        }
                     }
                 } catch (\Exception $e) {
                 }
@@ -278,6 +317,7 @@ public function handle()
                     $containerName = $labels->get('com.docker.compose.service');
                     if ($containerName) {
                         $this->serviceContainerStatuses->get($key)->put($containerName, $containerStatus);
+                        $this->storeServiceRestartCount($key, $containerName, data_get($container, 'restart_count'));
                     }
                 } elseif ($subType === 'database') {
                     $this->foundServiceDatabaseIds->push($subId);
@@ -289,6 +329,7 @@ public function handle()
                     $containerName = $labels->get('com.docker.compose.service');
                     if ($containerName) {
                         $this->serviceContainerStatuses->get($key)->put($containerName, $containerStatus);
+                        $this->storeServiceRestartCount($key, $containerName, data_get($container, 'restart_count'));
                     }
                 }
             } else {
@@ -302,9 +343,9 @@ public function handle()
                         $this->foundDatabaseUuids->push($uuid);
                         // TCP proxy should only be started/managed when database is actually running
                         if ($this->allTcpProxyUuids->contains($uuid) && $this->isRunning($containerStatus)) {
-                            $this->updateDatabaseStatus($uuid, $containerStatus, tcpProxy: true);
+                            $this->updateDatabaseStatus($uuid, $containerStatus, data_get($container, 'restart_count'), tcpProxy: true);
                         } else {
-                            $this->updateDatabaseStatus($uuid, $containerStatus, tcpProxy: false);
+                            $this->updateDatabaseStatus($uuid, $containerStatus, data_get($container, 'restart_count'), tcpProxy: false);
                         }
                     }
                 }
@@ -317,6 +358,9 @@ public function handle()
 
         $this->updateProxyStatus();
 
+        Application::whereIn('id', $this->foundApplicationIds->unique())
+            ->update(['container_present' => true]);
+
         $this->updateNotFoundApplicationStatus();
         $this->updateNotFoundApplicationPreviewStatus();
         $this->updateNotFoundDatabaseStatus();
@@ -324,6 +368,8 @@ public function handle()
 
         $this->updateAdditionalServersStatus();
 
+        $this->trackPreviewRestartCounts();
+
         // Aggregate multi-container application statuses
         $this->aggregateMultiContainerStatuses();
 
@@ -349,11 +395,18 @@ private function loadApplications(): Collection
                     'uuid',
                     'name',
                     'status',
+                    'container_present',
                     'build_pack',
                     'docker_compose_raw',
+                    'environment_id',
                     'destination_id',
                     'destination_type',
                     'last_online_at',
+                    'restart_count',
+                    'max_restart_count',
+                    'restart_limit_reached',
+                    'last_restart_at',
+                    'last_restart_type',
                 ])
                 ->withCount('additional_servers')
                 ->where(fn ($query) => $this->scopeDestination($query, $standaloneDockerIds, $swarmDockerIds))
@@ -372,11 +425,18 @@ private function loadApplications(): Collection
                         'uuid',
                         'name',
                         'status',
+                        'container_present',
                         'build_pack',
                         'docker_compose_raw',
+                        'environment_id',
                         'destination_id',
                         'destination_type',
                         'last_online_at',
+                        'restart_count',
+                        'max_restart_count',
+                        'restart_limit_reached',
+                        'last_restart_at',
+                        'last_restart_type',
                     ])
                     ->withCount('additional_servers')
                     ->whereIn('id', $additionalApplicationIds)
@@ -402,6 +462,11 @@ private function loadPreviews(): Collection
                 'pull_request_id',
                 'status',
                 'last_online_at',
+                'restart_count',
+                'max_restart_count',
+                'restart_limit_reached',
+                'last_restart_at',
+                'last_restart_type',
             ])
             ->whereIn('application_id', $applicationIds)
             ->get();
@@ -417,8 +482,8 @@ private function loadServices(): Collection
                 'docker_compose_raw',
             ])
             ->with([
-                'applications:id,service_id,status,last_online_at',
-                'databases:id,service_id,status,last_online_at,is_public,name',
+                'applications:id,service_id,status,last_online_at,restart_count,max_restart_count,restart_limit_reached,last_restart_at,last_restart_type',
+                'databases:id,service_id,status,last_online_at,is_public,name,restart_count,max_restart_count,restart_limit_reached,last_restart_at,last_restart_type',
             ])
             ->get();
     }
@@ -441,6 +506,8 @@ private function loadDatabases(): Collection
             'restart_count',
             'last_restart_at',
             'last_restart_type',
+            'max_restart_count',
+            'restart_limit_reached',
         ];
 
         return collect([
@@ -495,6 +562,53 @@ private function aggregateMultiContainerStatuses()
                 continue;
             }
 
+            $maxRestartCount = 0;
+            $restartCountsAvailable = $this->applicationContainerRestartCounts->has($applicationId);
+            if ($restartCountsAvailable) {
+                $maxRestartCount = $this->applicationContainerRestartCounts->get($applicationId)->max() ?? 0;
+                $restartState = (new RestartCountTracker)->evaluate(
+                    previousRestartCount: $application->restart_count ?? 0,
+                    observedRestartCount: $maxRestartCount,
+                    maxRestartCount: $application->max_restart_count ?? 0,
+                );
+
+                if ($restartState['restart_count_changed']) {
+                    $hasCrashRestarts = $restartState['restart_count'] > 0;
+                    $application->update([
+                        'restart_count' => $restartState['restart_count'],
+                        'last_restart_at' => $hasCrashRestarts ? now() : null,
+                        'last_restart_type' => $hasCrashRestarts ? 'crash' : null,
+                    ]);
+                }
+
+                if ($restartState['restart_limit_reached']) {
+                    $restartLimitClaimed = Application::query()
+                        ->whereKey($application->getKey())
+                        ->where('restart_limit_reached', false)
+                        ->update(['restart_limit_reached' => true]) === 1;
+
+                    if ($restartLimitClaimed) {
+                        $application->refresh();
+                        StopApplication::dispatch(
+                            application: $application,
+                            previewDeployments: false,
+                            dockerCleanup: false,
+                            resetRestartCount: false,
+                            removeContainers: false,
+                        );
+                        $application->environment->project->team?->notify(new ApplicationRestartLimitReached($application));
+                    }
+                }
+            }
+
+            if ($application->stoppedAfterRestartLimit() && $containerStatuses->every(
+                fn (string $status): bool => str($status)->contains('exited')
+            )) {
+                $application->update(['status' => 'exited']);
+
+                continue;
+            }
+
             // Parse docker compose to check for excluded containers
             $dockerComposeRaw = data_get($application, 'docker_compose_raw');
             $excludedContainers = $this->getExcludedContainersFromDockerCompose($dockerComposeRaw);
@@ -519,7 +633,7 @@ private function aggregateMultiContainerStatuses()
             // Use ContainerStatusAggregator service for state machine logic
             // Use preserveRestarting: true so applications show "Restarting" instead of "Degraded"
             $aggregator = new ContainerStatusAggregator;
-            $aggregatedStatus = $aggregator->aggregateFromStrings($relevantStatuses, 0, preserveRestarting: true);
+            $aggregatedStatus = $aggregator->aggregateFromStrings($relevantStatuses, $maxRestartCount, preserveRestarting: true);
 
             // Update application status with aggregated result
             if ($aggregatedStatus && $application->status !== $aggregatedStatus) {
@@ -560,6 +674,14 @@ private function aggregateServiceContainerStatuses()
                 continue;
             }
 
+            $restartCount = $this->serviceContainerRestartCounts->get($key)?->max() ?? 0;
+            if ($subResource->trackRestartCount($restartCount)) {
+                StopServiceApplication::dispatch($subResource, false, false);
+                $subResource->team()?->notify(new ApplicationRestartLimitReached($subResource));
+
+                continue;
+            }
+
             // Parse docker compose from service to check for excluded containers
             $dockerComposeRaw = data_get($service, 'docker_compose_raw');
             $excludedContainers = $this->getExcludedContainersFromDockerCompose($dockerComposeRaw);
@@ -581,10 +703,9 @@ private function aggregateServiceContainerStatuses()
             }
 
             // Use ContainerStatusAggregator service for state machine logic
-            // NOTE: Sentinel does NOT provide restart count data, so maxRestartCount is always 0
             // Use preserveRestarting: true so individual sub-resources show "Restarting" instead of "Degraded"
             $aggregator = new ContainerStatusAggregator;
-            $aggregatedStatus = $aggregator->aggregateFromStrings($relevantStatuses, 0, preserveRestarting: true);
+            $aggregatedStatus = $aggregator->aggregateFromStrings($relevantStatuses, $restartCount, preserveRestarting: true);
 
             // Update service sub-resource status with aggregated result
             if ($aggregatedStatus && $subResource->status !== $aggregatedStatus) {
@@ -627,8 +748,11 @@ private function updateNotFoundApplicationStatus()
 
         // Batch update: mark all not-found applications as exited (excluding already exited ones)
         Application::whereIn('id', $notFoundApplicationIds)
-            ->where('status', 'not like', 'exited%')
-            ->update(['status' => 'exited']);
+            ->update([
+                'status' => 'exited',
+                'container_present' => false,
+                'restart_limit_reached' => false,
+            ]);
     }
 
     private function updateNotFoundApplicationPreviewStatus()
@@ -687,7 +811,7 @@ private function updateProxyStatus()
         }
     }
 
-    private function updateDatabaseStatus(string $databaseUuid, string $containerStatus, bool $tcpProxy = false)
+    private function updateDatabaseStatus(string $databaseUuid, string $containerStatus, mixed $restartCount = null, bool $tcpProxy = false): void
     {
         $database = $this->databasesByUuid->get($databaseUuid);
         if (! $database) {
@@ -697,6 +821,12 @@ private function updateDatabaseStatus(string $databaseUuid, string $containerSta
             $database->status = $containerStatus;
             $database->save();
         }
+        if (is_numeric($restartCount) && $database->trackRestartCount((int) $restartCount)) {
+            StopDatabase::dispatch($database, false, false, false);
+            $database->team()?->notify(new ApplicationRestartLimitReached($database));
+
+            return;
+        }
         if (! $this->isCompleteSnapshot()) {
             return;
         }
@@ -719,6 +849,30 @@ private function updateDatabaseStatus(string $databaseUuid, string $containerSta
         }
     }
 
+    private function storeServiceRestartCount(string $key, string $containerName, mixed $restartCount): void
+    {
+        if (! is_numeric($restartCount)) {
+            return;
+        }
+        if (! $this->serviceContainerRestartCounts->has($key)) {
+            $this->serviceContainerRestartCounts->put($key, collect());
+        }
+        $this->serviceContainerRestartCounts->get($key)->put($containerName, (int) $restartCount);
+    }
+
+    private function trackPreviewRestartCounts(): void
+    {
+        $this->previewContainerRestartCounts
+            ->groupBy('key')
+            ->each(function (Collection $counts, string $key): void {
+                $preview = $this->previewsByKey->get($key);
+                if ($preview?->trackRestartCount((int) $counts->max('count'))) {
+                    StopApplicationPreview::dispatch($preview, false, false);
+                    $preview->application->environment->project->team?->notify(new ApplicationRestartLimitReached($preview));
+                }
+            });
+    }
+
     private function updateNotFoundDatabaseStatus()
     {
         $notFoundDatabaseUuids = $this->allDatabaseUuids->diff($this->foundDatabaseUuids);
@@ -729,12 +883,16 @@ private function updateNotFoundDatabaseStatus()
         $notFoundDatabaseUuids->each(function ($databaseUuid) {
             $database = $this->databasesByUuid->get($databaseUuid);
             if ($database) {
+                if ($database->stoppedAfterRestartLimit()) {
+                    return;
+                }
                 if (! str($database->status)->startsWith('exited')) {
                     $database->update([
                         'status' => 'exited',
                         'restart_count' => 0,
                         'last_restart_at' => null,
                         'last_restart_type' => null,
+                        'restart_limit_reached' => false,
                     ]);
                 }
                 if ($database->is_public) {
@@ -752,15 +910,17 @@ private function updateNotFoundServiceStatus()
         // Batch update service applications
         if ($notFoundServiceApplicationIds->isNotEmpty()) {
             ServiceApplication::whereIn('id', $notFoundServiceApplicationIds)
+                ->where('restart_limit_reached', false)
                 ->where('status', '!=', 'exited')
-                ->update(['status' => 'exited']);
+                ->update(['status' => 'exited', 'restart_count' => 0, 'last_restart_at' => null, 'last_restart_type' => null]);
         }
 
         // Batch update service databases
         if ($notFoundServiceDatabaseIds->isNotEmpty()) {
             ServiceDatabase::whereIn('id', $notFoundServiceDatabaseIds)
+                ->where('restart_limit_reached', false)
                 ->where('status', '!=', 'exited')
-                ->update(['status' => 'exited']);
+                ->update(['status' => 'exited', 'restart_count' => 0, 'last_restart_at' => null, 'last_restart_type' => null]);
         }
     }
 
diff --git a/app/Livewire/Notifications/Discord.php b/app/Livewire/Notifications/Discord.php
index 797db8362..71c24e238 100644
--- a/app/Livewire/Notifications/Discord.php
+++ b/app/Livewire/Notifications/Discord.php
@@ -34,6 +34,9 @@ class Discord extends Component
     #[Validate(['boolean'])]
     public bool $statusChangeDiscordNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedDiscordNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessDiscordNotifications = false;
 
@@ -93,6 +96,7 @@ public function syncData(bool $toModel = false)
             $this->settings->deployment_success_discord_notifications = $this->deploymentSuccessDiscordNotifications;
             $this->settings->deployment_failure_discord_notifications = $this->deploymentFailureDiscordNotifications;
             $this->settings->status_change_discord_notifications = $this->statusChangeDiscordNotifications;
+            $this->settings->restart_limit_reached_discord_notifications = $this->restartLimitReachedDiscordNotifications;
             $this->settings->backup_success_discord_notifications = $this->backupSuccessDiscordNotifications;
             $this->settings->backup_failure_discord_notifications = $this->backupFailureDiscordNotifications;
             $this->settings->scheduled_task_success_discord_notifications = $this->scheduledTaskSuccessDiscordNotifications;
@@ -118,6 +122,7 @@ public function syncData(bool $toModel = false)
             $this->deploymentSuccessDiscordNotifications = $this->settings->deployment_success_discord_notifications;
             $this->deploymentFailureDiscordNotifications = $this->settings->deployment_failure_discord_notifications;
             $this->statusChangeDiscordNotifications = $this->settings->status_change_discord_notifications;
+            $this->restartLimitReachedDiscordNotifications = $this->settings->restart_limit_reached_discord_notifications;
             $this->backupSuccessDiscordNotifications = $this->settings->backup_success_discord_notifications;
             $this->backupFailureDiscordNotifications = $this->settings->backup_failure_discord_notifications;
             $this->scheduledTaskSuccessDiscordNotifications = $this->settings->scheduled_task_success_discord_notifications;
diff --git a/app/Livewire/Notifications/Email.php b/app/Livewire/Notifications/Email.php
index 3d95668b9..530583db5 100644
--- a/app/Livewire/Notifications/Email.php
+++ b/app/Livewire/Notifications/Email.php
@@ -79,6 +79,9 @@ class Email extends Component
     #[Validate(['boolean'])]
     public bool $statusChangeEmailNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedEmailNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessEmailNotifications = false;
 
@@ -155,6 +158,7 @@ public function syncData(bool $toModel = false)
             $this->settings->deployment_success_email_notifications = $this->deploymentSuccessEmailNotifications;
             $this->settings->deployment_failure_email_notifications = $this->deploymentFailureEmailNotifications;
             $this->settings->status_change_email_notifications = $this->statusChangeEmailNotifications;
+            $this->settings->restart_limit_reached_email_notifications = $this->restartLimitReachedEmailNotifications;
             $this->settings->backup_success_email_notifications = $this->backupSuccessEmailNotifications;
             $this->settings->backup_failure_email_notifications = $this->backupFailureEmailNotifications;
             $this->settings->scheduled_task_success_email_notifications = $this->scheduledTaskSuccessEmailNotifications;
@@ -193,6 +197,7 @@ public function syncData(bool $toModel = false)
             $this->deploymentSuccessEmailNotifications = $this->settings->deployment_success_email_notifications;
             $this->deploymentFailureEmailNotifications = $this->settings->deployment_failure_email_notifications;
             $this->statusChangeEmailNotifications = $this->settings->status_change_email_notifications;
+            $this->restartLimitReachedEmailNotifications = $this->settings->restart_limit_reached_email_notifications;
             $this->backupSuccessEmailNotifications = $this->settings->backup_success_email_notifications;
             $this->backupFailureEmailNotifications = $this->settings->backup_failure_email_notifications;
             $this->scheduledTaskSuccessEmailNotifications = $this->settings->scheduled_task_success_email_notifications;
diff --git a/app/Livewire/Notifications/Pushover.php b/app/Livewire/Notifications/Pushover.php
index 3b7c3c6ae..04cd82756 100644
--- a/app/Livewire/Notifications/Pushover.php
+++ b/app/Livewire/Notifications/Pushover.php
@@ -41,6 +41,9 @@ class Pushover extends Component
     #[Validate(['boolean'])]
     public bool $statusChangePushoverNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedPushoverNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessPushoverNotifications = false;
 
@@ -98,6 +101,7 @@ public function syncData(bool $toModel = false)
             $this->settings->deployment_success_pushover_notifications = $this->deploymentSuccessPushoverNotifications;
             $this->settings->deployment_failure_pushover_notifications = $this->deploymentFailurePushoverNotifications;
             $this->settings->status_change_pushover_notifications = $this->statusChangePushoverNotifications;
+            $this->settings->restart_limit_reached_pushover_notifications = $this->restartLimitReachedPushoverNotifications;
             $this->settings->backup_success_pushover_notifications = $this->backupSuccessPushoverNotifications;
             $this->settings->backup_failure_pushover_notifications = $this->backupFailurePushoverNotifications;
             $this->settings->scheduled_task_success_pushover_notifications = $this->scheduledTaskSuccessPushoverNotifications;
@@ -125,6 +129,7 @@ public function syncData(bool $toModel = false)
             $this->deploymentSuccessPushoverNotifications = $this->settings->deployment_success_pushover_notifications;
             $this->deploymentFailurePushoverNotifications = $this->settings->deployment_failure_pushover_notifications;
             $this->statusChangePushoverNotifications = $this->settings->status_change_pushover_notifications;
+            $this->restartLimitReachedPushoverNotifications = $this->settings->restart_limit_reached_pushover_notifications;
             $this->backupSuccessPushoverNotifications = $this->settings->backup_success_pushover_notifications;
             $this->backupFailurePushoverNotifications = $this->settings->backup_failure_pushover_notifications;
             $this->scheduledTaskSuccessPushoverNotifications = $this->settings->scheduled_task_success_pushover_notifications;
diff --git a/app/Livewire/Notifications/Slack.php b/app/Livewire/Notifications/Slack.php
index 9ee362402..f4323875f 100644
--- a/app/Livewire/Notifications/Slack.php
+++ b/app/Livewire/Notifications/Slack.php
@@ -39,6 +39,9 @@ class Slack extends Component
     #[Validate(['boolean'])]
     public bool $statusChangeSlackNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedSlackNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessSlackNotifications = false;
 
@@ -95,6 +98,7 @@ public function syncData(bool $toModel = false)
             $this->settings->deployment_success_slack_notifications = $this->deploymentSuccessSlackNotifications;
             $this->settings->deployment_failure_slack_notifications = $this->deploymentFailureSlackNotifications;
             $this->settings->status_change_slack_notifications = $this->statusChangeSlackNotifications;
+            $this->settings->restart_limit_reached_slack_notifications = $this->restartLimitReachedSlackNotifications;
             $this->settings->backup_success_slack_notifications = $this->backupSuccessSlackNotifications;
             $this->settings->backup_failure_slack_notifications = $this->backupFailureSlackNotifications;
             $this->settings->scheduled_task_success_slack_notifications = $this->scheduledTaskSuccessSlackNotifications;
@@ -118,6 +122,7 @@ public function syncData(bool $toModel = false)
             $this->deploymentSuccessSlackNotifications = $this->settings->deployment_success_slack_notifications;
             $this->deploymentFailureSlackNotifications = $this->settings->deployment_failure_slack_notifications;
             $this->statusChangeSlackNotifications = $this->settings->status_change_slack_notifications;
+            $this->restartLimitReachedSlackNotifications = $this->settings->restart_limit_reached_slack_notifications;
             $this->backupSuccessSlackNotifications = $this->settings->backup_success_slack_notifications;
             $this->backupFailureSlackNotifications = $this->settings->backup_failure_slack_notifications;
             $this->scheduledTaskSuccessSlackNotifications = $this->settings->scheduled_task_success_slack_notifications;
diff --git a/app/Livewire/Notifications/Telegram.php b/app/Livewire/Notifications/Telegram.php
index b04d2c73d..f77b3c3a8 100644
--- a/app/Livewire/Notifications/Telegram.php
+++ b/app/Livewire/Notifications/Telegram.php
@@ -41,6 +41,9 @@ class Telegram extends Component
     #[Validate(['boolean'])]
     public bool $statusChangeTelegramNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedTelegramNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessTelegramNotifications = false;
 
@@ -83,6 +86,9 @@ class Telegram extends Component
     #[Validate(['nullable', 'string'])]
     public ?string $telegramNotificationsStatusChangeThreadId = null;
 
+    #[Validate(['nullable', 'string', 'max:255'])]
+    public ?string $telegramNotificationsRestartLimitReachedThreadId = null;
+
     #[Validate(['nullable', 'string'])]
     public ?string $telegramNotificationsBackupSuccessThreadId = null;
 
@@ -140,6 +146,7 @@ public function syncData(bool $toModel = false)
             $this->settings->deployment_success_telegram_notifications = $this->deploymentSuccessTelegramNotifications;
             $this->settings->deployment_failure_telegram_notifications = $this->deploymentFailureTelegramNotifications;
             $this->settings->status_change_telegram_notifications = $this->statusChangeTelegramNotifications;
+            $this->settings->restart_limit_reached_telegram_notifications = $this->restartLimitReachedTelegramNotifications;
             $this->settings->backup_success_telegram_notifications = $this->backupSuccessTelegramNotifications;
             $this->settings->backup_failure_telegram_notifications = $this->backupFailureTelegramNotifications;
             $this->settings->scheduled_task_success_telegram_notifications = $this->scheduledTaskSuccessTelegramNotifications;
@@ -155,6 +162,7 @@ public function syncData(bool $toModel = false)
             $this->settings->telegram_notifications_deployment_success_thread_id = $this->telegramNotificationsDeploymentSuccessThreadId;
             $this->settings->telegram_notifications_deployment_failure_thread_id = $this->telegramNotificationsDeploymentFailureThreadId;
             $this->settings->telegram_notifications_status_change_thread_id = $this->telegramNotificationsStatusChangeThreadId;
+            $this->settings->telegram_notifications_restart_limit_reached_thread_id = $this->telegramNotificationsRestartLimitReachedThreadId;
             $this->settings->telegram_notifications_backup_success_thread_id = $this->telegramNotificationsBackupSuccessThreadId;
             $this->settings->telegram_notifications_backup_failure_thread_id = $this->telegramNotificationsBackupFailureThreadId;
             $this->settings->telegram_notifications_scheduled_task_success_thread_id = $this->telegramNotificationsScheduledTaskSuccessThreadId;
@@ -173,6 +181,21 @@ public function syncData(bool $toModel = false)
             if (auth()->user()->can('update', $this->settings)) {
                 $this->telegramToken = $this->settings->telegram_token;
                 $this->telegramChatId = $this->settings->telegram_chat_id;
+                $this->telegramNotificationsDeploymentSuccessThreadId = $this->settings->telegram_notifications_deployment_success_thread_id;
+                $this->telegramNotificationsDeploymentFailureThreadId = $this->settings->telegram_notifications_deployment_failure_thread_id;
+                $this->telegramNotificationsStatusChangeThreadId = $this->settings->telegram_notifications_status_change_thread_id;
+                $this->telegramNotificationsRestartLimitReachedThreadId = $this->settings->telegram_notifications_restart_limit_reached_thread_id;
+                $this->telegramNotificationsBackupSuccessThreadId = $this->settings->telegram_notifications_backup_success_thread_id;
+                $this->telegramNotificationsBackupFailureThreadId = $this->settings->telegram_notifications_backup_failure_thread_id;
+                $this->telegramNotificationsScheduledTaskSuccessThreadId = $this->settings->telegram_notifications_scheduled_task_success_thread_id;
+                $this->telegramNotificationsScheduledTaskFailureThreadId = $this->settings->telegram_notifications_scheduled_task_failure_thread_id;
+                $this->telegramNotificationsDockerCleanupSuccessThreadId = $this->settings->telegram_notifications_docker_cleanup_success_thread_id;
+                $this->telegramNotificationsDockerCleanupFailureThreadId = $this->settings->telegram_notifications_docker_cleanup_failure_thread_id;
+                $this->telegramNotificationsServerDiskUsageThreadId = $this->settings->telegram_notifications_server_disk_usage_thread_id;
+                $this->telegramNotificationsServerReachableThreadId = $this->settings->telegram_notifications_server_reachable_thread_id;
+                $this->telegramNotificationsServerUnreachableThreadId = $this->settings->telegram_notifications_server_unreachable_thread_id;
+                $this->telegramNotificationsServerPatchThreadId = $this->settings->telegram_notifications_server_patch_thread_id;
+                $this->telegramNotificationsTraefikOutdatedThreadId = $this->settings->telegram_notifications_traefik_outdated_thread_id;
             } else {
                 $this->telegramToken = null;
                 $this->telegramChatId = null;
@@ -181,6 +204,7 @@ public function syncData(bool $toModel = false)
             $this->deploymentSuccessTelegramNotifications = $this->settings->deployment_success_telegram_notifications;
             $this->deploymentFailureTelegramNotifications = $this->settings->deployment_failure_telegram_notifications;
             $this->statusChangeTelegramNotifications = $this->settings->status_change_telegram_notifications;
+            $this->restartLimitReachedTelegramNotifications = $this->settings->restart_limit_reached_telegram_notifications;
             $this->backupSuccessTelegramNotifications = $this->settings->backup_success_telegram_notifications;
             $this->backupFailureTelegramNotifications = $this->settings->backup_failure_telegram_notifications;
             $this->scheduledTaskSuccessTelegramNotifications = $this->settings->scheduled_task_success_telegram_notifications;
@@ -193,20 +217,6 @@ public function syncData(bool $toModel = false)
             $this->serverPatchTelegramNotifications = $this->settings->server_patch_telegram_notifications;
             $this->traefikOutdatedTelegramNotifications = $this->settings->traefik_outdated_telegram_notifications;
 
-            $this->telegramNotificationsDeploymentSuccessThreadId = $this->settings->telegram_notifications_deployment_success_thread_id;
-            $this->telegramNotificationsDeploymentFailureThreadId = $this->settings->telegram_notifications_deployment_failure_thread_id;
-            $this->telegramNotificationsStatusChangeThreadId = $this->settings->telegram_notifications_status_change_thread_id;
-            $this->telegramNotificationsBackupSuccessThreadId = $this->settings->telegram_notifications_backup_success_thread_id;
-            $this->telegramNotificationsBackupFailureThreadId = $this->settings->telegram_notifications_backup_failure_thread_id;
-            $this->telegramNotificationsScheduledTaskSuccessThreadId = $this->settings->telegram_notifications_scheduled_task_success_thread_id;
-            $this->telegramNotificationsScheduledTaskFailureThreadId = $this->settings->telegram_notifications_scheduled_task_failure_thread_id;
-            $this->telegramNotificationsDockerCleanupSuccessThreadId = $this->settings->telegram_notifications_docker_cleanup_success_thread_id;
-            $this->telegramNotificationsDockerCleanupFailureThreadId = $this->settings->telegram_notifications_docker_cleanup_failure_thread_id;
-            $this->telegramNotificationsServerDiskUsageThreadId = $this->settings->telegram_notifications_server_disk_usage_thread_id;
-            $this->telegramNotificationsServerReachableThreadId = $this->settings->telegram_notifications_server_reachable_thread_id;
-            $this->telegramNotificationsServerUnreachableThreadId = $this->settings->telegram_notifications_server_unreachable_thread_id;
-            $this->telegramNotificationsServerPatchThreadId = $this->settings->telegram_notifications_server_patch_thread_id;
-            $this->telegramNotificationsTraefikOutdatedThreadId = $this->settings->telegram_notifications_traefik_outdated_thread_id;
         }
     }
 
diff --git a/app/Livewire/Notifications/Webhook.php b/app/Livewire/Notifications/Webhook.php
index fcf110778..3461503d4 100644
--- a/app/Livewire/Notifications/Webhook.php
+++ b/app/Livewire/Notifications/Webhook.php
@@ -34,6 +34,9 @@ class Webhook extends Component
     #[Validate(['boolean'])]
     public bool $statusChangeWebhookNotifications = false;
 
+    #[Validate(['boolean'])]
+    public bool $restartLimitReachedWebhookNotifications = true;
+
     #[Validate(['boolean'])]
     public bool $backupSuccessWebhookNotifications = false;
 
@@ -90,6 +93,7 @@ public function syncData(bool $toModel = false)
             $this->settings->deployment_success_webhook_notifications = $this->deploymentSuccessWebhookNotifications;
             $this->settings->deployment_failure_webhook_notifications = $this->deploymentFailureWebhookNotifications;
             $this->settings->status_change_webhook_notifications = $this->statusChangeWebhookNotifications;
+            $this->settings->restart_limit_reached_webhook_notifications = $this->restartLimitReachedWebhookNotifications;
             $this->settings->backup_success_webhook_notifications = $this->backupSuccessWebhookNotifications;
             $this->settings->backup_failure_webhook_notifications = $this->backupFailureWebhookNotifications;
             $this->settings->scheduled_task_success_webhook_notifications = $this->scheduledTaskSuccessWebhookNotifications;
@@ -113,6 +117,7 @@ public function syncData(bool $toModel = false)
             $this->deploymentSuccessWebhookNotifications = $this->settings->deployment_success_webhook_notifications;
             $this->deploymentFailureWebhookNotifications = $this->settings->deployment_failure_webhook_notifications;
             $this->statusChangeWebhookNotifications = $this->settings->status_change_webhook_notifications;
+            $this->restartLimitReachedWebhookNotifications = $this->settings->restart_limit_reached_webhook_notifications;
             $this->backupSuccessWebhookNotifications = $this->settings->backup_success_webhook_notifications;
             $this->backupFailureWebhookNotifications = $this->settings->backup_failure_webhook_notifications;
             $this->scheduledTaskSuccessWebhookNotifications = $this->settings->scheduled_task_success_webhook_notifications;
diff --git a/app/Livewire/Project/Resource/Index.php b/app/Livewire/Project/Resource/Index.php
index 93633246a..7c375d0e0 100644
--- a/app/Livewire/Project/Resource/Index.php
+++ b/app/Livewire/Project/Resource/Index.php
@@ -187,6 +187,11 @@ private function toSearchableArray(Collection $items, string $type, string $type
             'fqdn' => $item->fqdn ?? null,
             'description' => $item->description ?? null,
             'status' => $item->status ?? '',
+            'restartLimitReached' => method_exists($item, 'stoppedAfterRestartLimit') && $item->stoppedAfterRestartLimit(),
+            'restartCount' => method_exists($item, 'stoppedAfterRestartLimit') && $item->stoppedAfterRestartLimit()
+                ? max($item->restart_count ?? 0, $item->max_restart_count ?? 0)
+                : ($item->restart_count ?? 0),
+            'maxRestartCount' => $item->max_restart_count ?? 0,
             'server_status' => $item->server_status ?? null,
             'hrefLink' => $item->hrefLink ?? '',
             'destination' => [
diff --git a/app/Livewire/Project/Service/Heading.php b/app/Livewire/Project/Service/Heading.php
index 34bb46ff1..0e7fed960 100644
--- a/app/Livewire/Project/Service/Heading.php
+++ b/app/Livewire/Project/Service/Heading.php
@@ -5,8 +5,11 @@
 use App\Actions\Docker\GetContainersStatus;
 use App\Actions\Service\StartService;
 use App\Actions\Service\StopService;
+use App\Actions\Service\StopServiceApplication;
 use App\Enums\ProcessStatus;
 use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
@@ -169,6 +172,29 @@ public function restart()
         }
     }
 
+    public function removeSelectedResourceContainer(): void
+    {
+        $resource = $this->selectedResource();
+        if (! $resource) {
+            return;
+        }
+
+        $this->authorize('update', $resource);
+        StopServiceApplication::run($resource, true, true);
+        $this->dispatch('success', 'Container removed.');
+    }
+
+    private function selectedResource(): ServiceApplication|ServiceDatabase|null
+    {
+        $uuid = data_get($this->parameters, 'stack_service_uuid');
+        if (! $uuid) {
+            return null;
+        }
+
+        return $this->service->applications()->whereUuid($uuid)->first()
+            ?? $this->service->databases()->whereUuid($uuid)->first();
+    }
+
     public function pullAndRestartEvent()
     {
         try {
diff --git a/app/Livewire/Project/Service/Status.php b/app/Livewire/Project/Service/Status.php
index 192d7ca80..27919f1ae 100644
--- a/app/Livewire/Project/Service/Status.php
+++ b/app/Livewire/Project/Service/Status.php
@@ -10,6 +10,13 @@ class Status extends Component
 {
     public Service $service;
 
+    public ?string $selectedResourceUuid = null;
+
+    public function mount(): void
+    {
+        $this->selectedResourceUuid = request()->route('stack_service_uuid');
+    }
+
     public function getListeners(): array
     {
         $teamId = auth()->user()->currentTeam()->id;
@@ -27,6 +34,11 @@ public function refreshStatus(): void
 
     public function render(): View
     {
-        return view('livewire.project.service.status');
+        $selectedResource = $this->selectedResourceUuid
+            ? $this->service->applications->firstWhere('uuid', $this->selectedResourceUuid)
+                ?? $this->service->databases->firstWhere('uuid', $this->selectedResourceUuid)
+            : null;
+
+        return view('livewire.project.service.status', compact('selectedResource'));
     }
 }
diff --git a/app/Models/Application.php b/app/Models/Application.php
index af95cd4db..4873a9146 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -213,6 +213,8 @@ class Application extends BaseModel
         'last_online_at',
         'restart_count',
         'max_restart_count',
+        'restart_limit_reached',
+        'container_present',
         'last_restart_at',
         'last_restart_type',
         'uuid',
@@ -258,6 +260,8 @@ protected function casts(): array
             'domain_dns_statuses' => 'array',
             'restart_count' => 'integer',
             'max_restart_count' => 'integer',
+            'restart_limit_reached' => 'boolean',
+            'container_present' => 'boolean',
             'last_restart_at' => 'datetime',
         ];
     }
@@ -605,10 +609,8 @@ public function link()
     public function stoppedAfterRestartLimit(): bool
     {
         return str($this->status)->startsWith('exited')
-            && ($this->restart_count ?? 0) > 0
-            && ($this->max_restart_count ?? 0) > 0
-            && $this->restart_count >= $this->max_restart_count
-            && $this->last_restart_type === 'crash';
+            && $this->container_present === true
+            && $this->restart_limit_reached === true;
     }
 
     public function taskLink($task_uuid)
diff --git a/app/Models/ApplicationPreview.php b/app/Models/ApplicationPreview.php
index d9c981c59..381e71817 100644
--- a/app/Models/ApplicationPreview.php
+++ b/app/Models/ApplicationPreview.php
@@ -3,13 +3,14 @@
 namespace App\Models;
 
 use App\Support\ValidationPatterns;
+use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\SoftDeletes;
 use RuntimeException;
 use Spatie\Url\Url;
 
 class ApplicationPreview extends BaseModel
 {
-    use SoftDeletes;
+    use HasRestartLimit, SoftDeletes;
 
     protected $fillable = [
         'uuid',
@@ -102,6 +103,11 @@ public function application()
         return $this->belongsTo(Application::class);
     }
 
+    public function restartLimitMaximum(): int
+    {
+        return $this->application->max_restart_count ?? $this->max_restart_count ?? 0;
+    }
+
     public function persistentStorages()
     {
         return $this->morphMany(LocalPersistentVolume::class, 'resource');
diff --git a/app/Models/DiscordNotificationSettings.php b/app/Models/DiscordNotificationSettings.php
index 135c921f6..48d5b5d29 100644
--- a/app/Models/DiscordNotificationSettings.php
+++ b/app/Models/DiscordNotificationSettings.php
@@ -20,6 +20,7 @@ class DiscordNotificationSettings extends Model
         'deployment_success_discord_notifications',
         'deployment_failure_discord_notifications',
         'status_change_discord_notifications',
+        'restart_limit_reached_discord_notifications',
         'backup_success_discord_notifications',
         'backup_failure_discord_notifications',
         'scheduled_task_success_discord_notifications',
@@ -45,6 +46,7 @@ class DiscordNotificationSettings extends Model
         'deployment_success_discord_notifications' => 'boolean',
         'deployment_failure_discord_notifications' => 'boolean',
         'status_change_discord_notifications' => 'boolean',
+        'restart_limit_reached_discord_notifications' => 'boolean',
         'backup_success_discord_notifications' => 'boolean',
         'backup_failure_discord_notifications' => 'boolean',
         'scheduled_task_success_discord_notifications' => 'boolean',
diff --git a/app/Models/EmailNotificationSettings.php b/app/Models/EmailNotificationSettings.php
index 814d05339..3b04b482a 100644
--- a/app/Models/EmailNotificationSettings.php
+++ b/app/Models/EmailNotificationSettings.php
@@ -31,6 +31,7 @@ class EmailNotificationSettings extends Model
         'deployment_success_email_notifications',
         'deployment_failure_email_notifications',
         'status_change_email_notifications',
+        'restart_limit_reached_email_notifications',
         'backup_success_email_notifications',
         'backup_failure_email_notifications',
         'scheduled_task_success_email_notifications',
@@ -73,6 +74,7 @@ class EmailNotificationSettings extends Model
         'deployment_success_email_notifications' => 'boolean',
         'deployment_failure_email_notifications' => 'boolean',
         'status_change_email_notifications' => 'boolean',
+        'restart_limit_reached_email_notifications' => 'boolean',
         'backup_success_email_notifications' => 'boolean',
         'backup_failure_email_notifications' => 'boolean',
         'scheduled_task_success_email_notifications' => 'boolean',
diff --git a/app/Models/PushoverNotificationSettings.php b/app/Models/PushoverNotificationSettings.php
index dd0d81cc0..2ab669314 100644
--- a/app/Models/PushoverNotificationSettings.php
+++ b/app/Models/PushoverNotificationSettings.php
@@ -21,6 +21,7 @@ class PushoverNotificationSettings extends Model
         'deployment_success_pushover_notifications',
         'deployment_failure_pushover_notifications',
         'status_change_pushover_notifications',
+        'restart_limit_reached_pushover_notifications',
         'backup_success_pushover_notifications',
         'backup_failure_pushover_notifications',
         'scheduled_task_success_pushover_notifications',
@@ -47,6 +48,7 @@ class PushoverNotificationSettings extends Model
         'deployment_success_pushover_notifications' => 'boolean',
         'deployment_failure_pushover_notifications' => 'boolean',
         'status_change_pushover_notifications' => 'boolean',
+        'restart_limit_reached_pushover_notifications' => 'boolean',
         'backup_success_pushover_notifications' => 'boolean',
         'backup_failure_pushover_notifications' => 'boolean',
         'scheduled_task_success_pushover_notifications' => 'boolean',
diff --git a/app/Models/ServiceApplication.php b/app/Models/ServiceApplication.php
index 9763fa894..f6284ecbf 100644
--- a/app/Models/ServiceApplication.php
+++ b/app/Models/ServiceApplication.php
@@ -3,6 +3,7 @@
 namespace App\Models;
 
 use App\Traits\HasNoindexDomains;
+use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
@@ -10,7 +11,7 @@
 
 class ServiceApplication extends BaseModel
 {
-    use HasFactory, HasNoindexDomains, SoftDeletes;
+    use HasFactory, HasNoindexDomains, HasRestartLimit, SoftDeletes;
 
     protected $fillable = [
         'service_id',
diff --git a/app/Models/ServiceDatabase.php b/app/Models/ServiceDatabase.php
index 603d11a7f..c932791a7 100644
--- a/app/Models/ServiceDatabase.php
+++ b/app/Models/ServiceDatabase.php
@@ -2,12 +2,13 @@
 
 namespace App\Models;
 
+use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class ServiceDatabase extends BaseModel
 {
-    use HasFactory, SoftDeletes;
+    use HasFactory, HasRestartLimit, SoftDeletes;
 
     protected $fillable = [
         'service_id',
diff --git a/app/Models/SlackNotificationSettings.php b/app/Models/SlackNotificationSettings.php
index 62603685e..648869baf 100644
--- a/app/Models/SlackNotificationSettings.php
+++ b/app/Models/SlackNotificationSettings.php
@@ -20,6 +20,7 @@ class SlackNotificationSettings extends Model
         'deployment_success_slack_notifications',
         'deployment_failure_slack_notifications',
         'status_change_slack_notifications',
+        'restart_limit_reached_slack_notifications',
         'backup_success_slack_notifications',
         'backup_failure_slack_notifications',
         'scheduled_task_success_slack_notifications',
@@ -44,6 +45,7 @@ class SlackNotificationSettings extends Model
         'deployment_success_slack_notifications' => 'boolean',
         'deployment_failure_slack_notifications' => 'boolean',
         'status_change_slack_notifications' => 'boolean',
+        'restart_limit_reached_slack_notifications' => 'boolean',
         'backup_success_slack_notifications' => 'boolean',
         'backup_failure_slack_notifications' => 'boolean',
         'scheduled_task_success_slack_notifications' => 'boolean',
diff --git a/app/Models/StandaloneClickhouse.php b/app/Models/StandaloneClickhouse.php
index 7ca45cc3b..ee8558bb0 100644
--- a/app/Models/StandaloneClickhouse.php
+++ b/app/Models/StandaloneClickhouse.php
@@ -5,6 +5,7 @@
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -12,7 +13,7 @@
 
 class StandaloneClickhouse extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneDragonfly.php b/app/Models/StandaloneDragonfly.php
index 769d9f00c..c72841955 100644
--- a/app/Models/StandaloneDragonfly.php
+++ b/app/Models/StandaloneDragonfly.php
@@ -5,6 +5,7 @@
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -12,7 +13,7 @@
 
 class StandaloneDragonfly extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneKeydb.php b/app/Models/StandaloneKeydb.php
index 15a1fe2f8..9c4e4aa66 100644
--- a/app/Models/StandaloneKeydb.php
+++ b/app/Models/StandaloneKeydb.php
@@ -5,6 +5,7 @@
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -12,7 +13,7 @@
 
 class StandaloneKeydb extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMariadb.php b/app/Models/StandaloneMariadb.php
index 378d36395..4eada8a00 100644
--- a/app/Models/StandaloneMariadb.php
+++ b/app/Models/StandaloneMariadb.php
@@ -5,6 +5,7 @@
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,7 +14,7 @@
 
 class StandaloneMariadb extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMongodb.php b/app/Models/StandaloneMongodb.php
index 1010ca5f3..d0a68d4e7 100644
--- a/app/Models/StandaloneMongodb.php
+++ b/app/Models/StandaloneMongodb.php
@@ -5,6 +5,7 @@
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -12,7 +13,7 @@
 
 class StandaloneMongodb extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMysql.php b/app/Models/StandaloneMysql.php
index 90828bf01..4f9e73719 100644
--- a/app/Models/StandaloneMysql.php
+++ b/app/Models/StandaloneMysql.php
@@ -5,6 +5,7 @@
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -12,7 +13,7 @@
 
 class StandaloneMysql extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandalonePostgresql.php b/app/Models/StandalonePostgresql.php
index e7db81285..602728855 100644
--- a/app/Models/StandalonePostgresql.php
+++ b/app/Models/StandalonePostgresql.php
@@ -5,6 +5,7 @@
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -12,7 +13,7 @@
 
 class StandalonePostgresql extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneRedis.php b/app/Models/StandaloneRedis.php
index 326261190..8a74824be 100644
--- a/app/Models/StandaloneRedis.php
+++ b/app/Models/StandaloneRedis.php
@@ -5,6 +5,7 @@
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
+use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -12,7 +13,7 @@
 
 class StandaloneRedis extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/TelegramNotificationSettings.php b/app/Models/TelegramNotificationSettings.php
index 8c644f9bc..3376e239d 100644
--- a/app/Models/TelegramNotificationSettings.php
+++ b/app/Models/TelegramNotificationSettings.php
@@ -21,6 +21,7 @@ class TelegramNotificationSettings extends Model
         'deployment_success_telegram_notifications',
         'deployment_failure_telegram_notifications',
         'status_change_telegram_notifications',
+        'restart_limit_reached_telegram_notifications',
         'backup_success_telegram_notifications',
         'backup_failure_telegram_notifications',
         'scheduled_task_success_telegram_notifications',
@@ -36,6 +37,7 @@ class TelegramNotificationSettings extends Model
         'telegram_notifications_deployment_success_thread_id',
         'telegram_notifications_deployment_failure_thread_id',
         'telegram_notifications_status_change_thread_id',
+        'telegram_notifications_restart_limit_reached_thread_id',
         'telegram_notifications_backup_success_thread_id',
         'telegram_notifications_backup_failure_thread_id',
         'telegram_notifications_scheduled_task_success_thread_id',
@@ -55,6 +57,7 @@ class TelegramNotificationSettings extends Model
         'telegram_notifications_deployment_success_thread_id',
         'telegram_notifications_deployment_failure_thread_id',
         'telegram_notifications_status_change_thread_id',
+        'telegram_notifications_restart_limit_reached_thread_id',
         'telegram_notifications_backup_success_thread_id',
         'telegram_notifications_backup_failure_thread_id',
         'telegram_notifications_scheduled_task_success_thread_id',
@@ -76,6 +79,7 @@ class TelegramNotificationSettings extends Model
         'deployment_success_telegram_notifications' => 'boolean',
         'deployment_failure_telegram_notifications' => 'boolean',
         'status_change_telegram_notifications' => 'boolean',
+        'restart_limit_reached_telegram_notifications' => 'boolean',
         'backup_success_telegram_notifications' => 'boolean',
         'backup_failure_telegram_notifications' => 'boolean',
         'scheduled_task_success_telegram_notifications' => 'boolean',
@@ -90,6 +94,7 @@ class TelegramNotificationSettings extends Model
         'telegram_notifications_deployment_success_thread_id' => 'encrypted',
         'telegram_notifications_deployment_failure_thread_id' => 'encrypted',
         'telegram_notifications_status_change_thread_id' => 'encrypted',
+        'telegram_notifications_restart_limit_reached_thread_id' => 'encrypted',
         'telegram_notifications_backup_success_thread_id' => 'encrypted',
         'telegram_notifications_backup_failure_thread_id' => 'encrypted',
         'telegram_notifications_scheduled_task_success_thread_id' => 'encrypted',
diff --git a/app/Models/WebhookNotificationSettings.php b/app/Models/WebhookNotificationSettings.php
index c6a81b50a..7ffd20a8c 100644
--- a/app/Models/WebhookNotificationSettings.php
+++ b/app/Models/WebhookNotificationSettings.php
@@ -20,6 +20,7 @@ class WebhookNotificationSettings extends Model
         'deployment_success_webhook_notifications',
         'deployment_failure_webhook_notifications',
         'status_change_webhook_notifications',
+        'restart_limit_reached_webhook_notifications',
         'backup_success_webhook_notifications',
         'backup_failure_webhook_notifications',
         'scheduled_task_success_webhook_notifications',
@@ -46,6 +47,7 @@ protected function casts(): array
             'deployment_success_webhook_notifications' => 'boolean',
             'deployment_failure_webhook_notifications' => 'boolean',
             'status_change_webhook_notifications' => 'boolean',
+            'restart_limit_reached_webhook_notifications' => 'boolean',
             'backup_success_webhook_notifications' => 'boolean',
             'backup_failure_webhook_notifications' => 'boolean',
             'scheduled_task_success_webhook_notifications' => 'boolean',
diff --git a/app/Notifications/Application/RestartLimitReached.php b/app/Notifications/Application/RestartLimitReached.php
index 635dfdbdc..687fd3086 100644
--- a/app/Notifications/Application/RestartLimitReached.php
+++ b/app/Notifications/Application/RestartLimitReached.php
@@ -2,7 +2,8 @@
 
 namespace App\Notifications\Application;
 
-use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\BaseModel;
 use App\Notifications\CustomEmailNotification;
 use App\Notifications\Dto\DiscordMessage;
 use App\Notifications\Dto\PushoverMessage;
@@ -27,26 +28,40 @@ class RestartLimitReached extends CustomEmailNotification
 
     public int $max_restart_count;
 
-    public function __construct(public Application $resource)
+    public function __construct(public BaseModel $resource)
     {
         $this->onQueue('high');
         $this->afterCommit();
-        $this->resource_name = data_get($resource, 'name');
-        $this->project_uuid = data_get($resource, 'environment.project.uuid');
-        $this->environment_uuid = data_get($resource, 'environment.uuid');
-        $this->environment_name = data_get($resource, 'environment.name');
+        $environment = data_get($resource, 'environment')
+            ?? data_get($resource, 'application.environment')
+            ?? data_get($resource, 'service.environment');
+        $this->resource_name = $resource instanceof ApplicationPreview
+            ? data_get($resource, 'application.name').' PR #'.$resource->pull_request_id
+            : data_get($resource, 'name');
+        $this->project_uuid = data_get($environment, 'project.uuid');
+        $this->environment_uuid = data_get($environment, 'uuid');
+        $this->environment_name = data_get($environment, 'name');
         $this->fqdn = data_get($resource, 'fqdn', null);
         $this->restart_count = $resource->restart_count;
-        $this->max_restart_count = $resource->max_restart_count;
+        $this->max_restart_count = method_exists($resource, 'restartLimitMaximum')
+            ? $resource->restartLimitMaximum()
+            : $resource->max_restart_count;
         if (str($this->fqdn)->explode(',')->count() > 1) {
             $this->fqdn = str($this->fqdn)->explode(',')->first();
         }
-        $this->resource_url = $this->resource->link() ?? base_url()."/project/{$this->project_uuid}/environment/{$this->environment_uuid}/application/{$this->resource->uuid}";
+        $service = data_get($resource, 'service');
+        $this->resource_url = match (true) {
+            method_exists($this->resource, 'link') => $this->resource->link(),
+            $resource instanceof ApplicationPreview => $resource->application->link(),
+            is_object($service) && method_exists($service, 'link') => $service->link(),
+            default => null,
+        };
+        $this->resource_url ??= base_url()."/project/{$this->project_uuid}/environment/{$this->environment_uuid}";
     }
 
     public function via(object $notifiable): array
     {
-        return $notifiable->getEnabledChannels('status_change');
+        return $notifiable->getEnabledChannels('restart_limit_reached');
     }
 
     public function toMail(): MailMessage
@@ -68,7 +83,7 @@ public function toDiscord(): DiscordMessage
     {
         return new DiscordMessage(
             title: ':warning: Restart limit reached',
-            description: "{$this->resource_name} has been stopped after {$this->restart_count} restarts (limit: {$this->max_restart_count}).\n\n[Open Application in Coolify]({$this->resource_url})",
+            description: "{$this->resource_name} has been stopped after {$this->restart_count} restarts (limit: {$this->max_restart_count}).\n\n[Open Resource in Coolify]({$this->resource_url})",
             color: DiscordMessage::errorColor(),
             isCritical: true,
         );
@@ -82,7 +97,7 @@ public function toTelegram(): array
             'message' => $message,
             'buttons' => [
                 [
-                    'text' => 'Open Application in Coolify',
+                    'text' => 'Open Resource in Coolify',
                     'url' => $this->resource_url,
                 ],
             ],
@@ -99,7 +114,7 @@ public function toPushover(): PushoverMessage
             message: $message,
             buttons: [
                 [
-                    'text' => 'Open Application in Coolify',
+                    'text' => 'Open Resource in Coolify',
                     'url' => $this->resource_url,
                 ],
             ],
@@ -110,10 +125,13 @@ public function toSlack(): SlackMessage
     {
         $title = 'Restart limit reached';
         $description = "{$this->resource_name} has been stopped after {$this->restart_count} restarts (limit: {$this->max_restart_count})";
+        $environment = data_get($this->resource, 'environment')
+            ?? data_get($this->resource, 'application.environment')
+            ?? data_get($this->resource, 'service.environment');
 
-        $description .= "\n\n*Project:* ".data_get($this->resource, 'environment.project.name');
+        $description .= "\n\n*Project:* ".data_get($environment, 'project.name');
         $description .= "\n*Environment:* {$this->environment_name}";
-        $description .= "\n*Application URL:* {$this->resource_url}";
+        $description .= "\n*Resource URL:* {$this->resource_url}";
 
         return new SlackMessage(
             title: $title,
@@ -130,6 +148,8 @@ public function toWebhook(): array
             'event' => 'restart_limit_reached',
             'application_name' => $this->resource_name,
             'application_uuid' => $this->resource->uuid,
+            'resource_name' => $this->resource_name,
+            'resource_uuid' => $this->resource->uuid,
             'restart_count' => $this->restart_count,
             'max_restart_count' => $this->max_restart_count,
             'url' => $this->resource_url,
diff --git a/app/Notifications/Channels/TelegramChannel.php b/app/Notifications/Channels/TelegramChannel.php
index c2fa3ff10..4f311bf68 100644
--- a/app/Notifications/Channels/TelegramChannel.php
+++ b/app/Notifications/Channels/TelegramChannel.php
@@ -3,6 +3,21 @@
 namespace App\Notifications\Channels;
 
 use App\Jobs\SendMessageToTelegramJob;
+use App\Notifications\Application\DeploymentFailed;
+use App\Notifications\Application\DeploymentSuccess;
+use App\Notifications\Application\RestartLimitReached;
+use App\Notifications\Application\StatusChanged;
+use App\Notifications\Container\ContainerRestarted;
+use App\Notifications\Database\BackupFailed;
+use App\Notifications\Database\BackupSuccess;
+use App\Notifications\ScheduledTask\TaskFailed;
+use App\Notifications\ScheduledTask\TaskSuccess;
+use App\Notifications\Server\DockerCleanupFailed;
+use App\Notifications\Server\DockerCleanupSuccess;
+use App\Notifications\Server\HighDiskUsage;
+use App\Notifications\Server\Reachable;
+use App\Notifications\Server\ServerPatchCheck;
+use App\Notifications\Server\Unreachable;
 
 class TelegramChannel
 {
@@ -17,24 +32,24 @@ public function send($notifiable, $notification): void
         $chatId = $settings->telegram_chat_id;
 
         $threadId = match (get_class($notification)) {
-            \App\Notifications\Application\DeploymentSuccess::class => $settings->telegram_notifications_deployment_success_thread_id,
-            \App\Notifications\Application\DeploymentFailed::class => $settings->telegram_notifications_deployment_failure_thread_id,
-            \App\Notifications\Application\StatusChanged::class,
-            \App\Notifications\Container\ContainerRestarted::class,
-            \App\Notifications\Container\ContainerStopped::class => $settings->telegram_notifications_status_change_thread_id,
+            DeploymentSuccess::class => $settings->telegram_notifications_deployment_success_thread_id,
+            DeploymentFailed::class => $settings->telegram_notifications_deployment_failure_thread_id,
+            StatusChanged::class,
+            ContainerRestarted::class => $settings->telegram_notifications_status_change_thread_id,
+            RestartLimitReached::class => $settings->telegram_notifications_restart_limit_reached_thread_id,
 
-            \App\Notifications\Database\BackupSuccess::class => $settings->telegram_notifications_backup_success_thread_id,
-            \App\Notifications\Database\BackupFailed::class => $settings->telegram_notifications_backup_failure_thread_id,
+            BackupSuccess::class => $settings->telegram_notifications_backup_success_thread_id,
+            BackupFailed::class => $settings->telegram_notifications_backup_failure_thread_id,
 
-            \App\Notifications\ScheduledTask\TaskSuccess::class => $settings->telegram_notifications_scheduled_task_success_thread_id,
-            \App\Notifications\ScheduledTask\TaskFailed::class => $settings->telegram_notifications_scheduled_task_failure_thread_id,
+            TaskSuccess::class => $settings->telegram_notifications_scheduled_task_success_thread_id,
+            TaskFailed::class => $settings->telegram_notifications_scheduled_task_failure_thread_id,
 
-            \App\Notifications\Server\DockerCleanupSuccess::class => $settings->telegram_notifications_docker_cleanup_success_thread_id,
-            \App\Notifications\Server\DockerCleanupFailed::class => $settings->telegram_notifications_docker_cleanup_failure_thread_id,
-            \App\Notifications\Server\HighDiskUsage::class => $settings->telegram_notifications_server_disk_usage_thread_id,
-            \App\Notifications\Server\Unreachable::class => $settings->telegram_notifications_server_unreachable_thread_id,
-            \App\Notifications\Server\Reachable::class => $settings->telegram_notifications_server_reachable_thread_id,
-            \App\Notifications\Server\ServerPatchCheck::class => $settings->telegram_notifications_server_patch_thread_id,
+            DockerCleanupSuccess::class => $settings->telegram_notifications_docker_cleanup_success_thread_id,
+            DockerCleanupFailed::class => $settings->telegram_notifications_docker_cleanup_failure_thread_id,
+            HighDiskUsage::class => $settings->telegram_notifications_server_disk_usage_thread_id,
+            Unreachable::class => $settings->telegram_notifications_server_unreachable_thread_id,
+            Reachable::class => $settings->telegram_notifications_server_reachable_thread_id,
+            ServerPatchCheck::class => $settings->telegram_notifications_server_patch_thread_id,
 
             default => null,
         };
diff --git a/app/Notifications/Container/ContainerStopped.php b/app/Notifications/Container/ContainerStopped.php
deleted file mode 100644
index f518cd2fd..000000000
--- a/app/Notifications/Container/ContainerStopped.php
+++ /dev/null
@@ -1,123 +0,0 @@
-<?php
-
-namespace App\Notifications\Container;
-
-use App\Models\Server;
-use App\Notifications\CustomEmailNotification;
-use App\Notifications\Dto\DiscordMessage;
-use App\Notifications\Dto\PushoverMessage;
-use App\Notifications\Dto\SlackMessage;
-use Illuminate\Notifications\Messages\MailMessage;
-
-class ContainerStopped extends CustomEmailNotification
-{
-    public function __construct(public string $name, public Server $server, public ?string $url = null)
-    {
-        $this->onQueue('high');
-    }
-
-    public function via(object $notifiable): array
-    {
-        return $notifiable->getEnabledChannels('status_change');
-    }
-
-    public function toMail(): MailMessage
-    {
-        $mail = new MailMessage;
-        $mail->subject("Coolify: A resource  has been stopped unexpectedly on {$this->server->name}");
-        $mail->view('emails.container-stopped', [
-            'containerName' => $this->name,
-            'serverName' => $this->server->name,
-            'url' => $this->url,
-        ]);
-
-        return $mail;
-    }
-
-    public function toDiscord(): DiscordMessage
-    {
-        $message = new DiscordMessage(
-            title: ':cross_mark: Resource stopped',
-            description: "{$this->name} has been stopped unexpectedly on {$this->server->name}.",
-            color: DiscordMessage::errorColor(),
-        );
-
-        if ($this->url) {
-            $message->addField('Resource', '[Link]('.$this->url.')');
-        }
-
-        return $message;
-    }
-
-    public function toTelegram(): array
-    {
-        $message = "Coolify: A resource ($this->name) has been stopped unexpectedly on {$this->server->name}";
-        $payload = [
-            'message' => $message,
-        ];
-        if ($this->url) {
-            $payload['buttons'] = [
-                [
-                    [
-                        'text' => 'Open Application in Coolify',
-                        'url' => $this->url,
-                    ],
-                ],
-            ];
-        }
-
-        return $payload;
-    }
-
-    public function toPushover(): PushoverMessage
-    {
-        $buttons = [];
-        if ($this->url) {
-            $buttons[] = [
-                'text' => 'Open Application in Coolify',
-                'url' => $this->url,
-            ];
-        }
-
-        return new PushoverMessage(
-            title: 'Resource stopped',
-            level: 'error',
-            message: "A resource ({$this->name}) has been stopped unexpectedly on {$this->server->name}",
-            buttons: $buttons,
-        );
-    }
-
-    public function toSlack(): SlackMessage
-    {
-        $title = 'Resource stopped';
-        $description = "A resource ({$this->name}) has been stopped unexpectedly on {$this->server->name}";
-
-        if ($this->url) {
-            $description .= "\n*Resource URL:* {$this->url}";
-        }
-
-        return new SlackMessage(
-            title: $title,
-            description: $description,
-            color: SlackMessage::errorColor()
-        );
-    }
-
-    public function toWebhook(): array
-    {
-        $data = [
-            'success' => false,
-            'message' => 'Resource stopped unexpectedly',
-            'event' => 'container_stopped',
-            'container_name' => $this->name,
-            'server_name' => $this->server->name,
-            'server_uuid' => $this->server->uuid,
-        ];
-
-        if ($this->url) {
-            $data['url'] = $this->url;
-        }
-
-        return $data;
-    }
-}
diff --git a/app/Services/ContainerStatusAggregator.php b/app/Services/ContainerStatusAggregator.php
index 8859a9980..3a59ad58f 100644
--- a/app/Services/ContainerStatusAggregator.php
+++ b/app/Services/ContainerStatusAggregator.php
@@ -18,14 +18,13 @@
  * State Priority (highest to lowest):
  * 1. Degraded (from sub-resources) → degraded:unhealthy
  * 2. Restarting → degraded:unhealthy (or restarting:unknown if preserveRestarting=true)
- * 3. Crash Loop (exited with restarts) → degraded:unhealthy
- * 4. Mixed (running + exited) → degraded:unhealthy
- * 5. Mixed (running + starting) → starting:unknown
- * 6. Running → running:healthy/unhealthy/unknown
- * 7. Dead/Removing → degraded:unhealthy
- * 8. Paused → paused:unknown
- * 9. Starting/Created → starting:unknown
- * 10. Exited → exited
+ * 3. Mixed (running + exited) → degraded:unhealthy
+ * 4. Mixed (running + starting) → starting:unknown
+ * 5. Running → running:healthy/unhealthy/unknown
+ * 6. Dead/Removing → degraded:unhealthy
+ * 7. Paused → paused:unknown
+ * 8. Starting/Created → starting:unknown
+ * 9. Exited → exited
  *
  * The $preserveRestarting parameter controls whether "restarting" containers should be
  * reported as "restarting:unknown" (true) or "degraded:unhealthy" (false, default).
@@ -228,23 +227,18 @@ private function resolveStatus(
             return $preserveRestarting ? 'restarting:unknown' : 'degraded:unhealthy';
         }
 
-        // Priority 3: Crash loop detection (exited with restart count > 0)
-        if ($hasExited && $maxRestartCount > 0) {
-            return 'degraded:unhealthy';
-        }
-
-        // Priority 4: Mixed state (some running, some exited = degraded)
+        // Priority 3: Mixed state (some running, some exited = degraded)
         if ($hasRunning && $hasExited) {
             return 'degraded:unhealthy';
         }
 
-        // Priority 5: Mixed state (some running, some starting = still starting)
+        // Priority 4: Mixed state (some running, some starting = still starting)
         // If any component is still starting, the entire service stack is not fully ready
         if ($hasRunning && $hasStarting) {
             return 'starting:unknown';
         }
 
-        // Priority 6: Running containers (check health status)
+        // Priority 5: Running containers (check health status)
         if ($hasRunning) {
             if ($hasUnhealthy) {
                 return 'running:unhealthy';
@@ -255,22 +249,22 @@ private function resolveStatus(
             }
         }
 
-        // Priority 7: Dead or removing containers
+        // Priority 6: Dead or removing containers
         if ($hasDead) {
             return 'degraded:unhealthy';
         }
 
-        // Priority 8: Paused containers
+        // Priority 7: Paused containers
         if ($hasPaused) {
             return 'paused:unknown';
         }
 
-        // Priority 9: Starting/created containers
+        // Priority 8: Starting/created containers
         if ($hasStarting) {
             return 'starting:unknown';
         }
 
-        // Priority 10: All containers exited (no restart count = truly stopped)
+        // Priority 9: All containers exited
         return 'exited';
     }
 }
diff --git a/app/Services/RestartCountTracker.php b/app/Services/RestartCountTracker.php
new file mode 100644
index 000000000..e67deacb3
--- /dev/null
+++ b/app/Services/RestartCountTracker.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Services;
+
+class RestartCountTracker
+{
+    /**
+     * @return array{restart_count: int, restart_count_changed: bool, restart_limit_reached: bool, new_generation: bool}
+     */
+    public function evaluate(
+        int $previousRestartCount,
+        int $observedRestartCount,
+        int $maxRestartCount,
+        bool $newGenerationConfirmed = false,
+    ): array {
+        $newGeneration = $newGenerationConfirmed
+            && $observedRestartCount < $previousRestartCount;
+        $restartCountIncreased = $observedRestartCount > $previousRestartCount;
+        $restartCountChanged = $newGeneration || $restartCountIncreased;
+
+        $restartLimitReached = $maxRestartCount > 0
+            && $observedRestartCount >= $maxRestartCount;
+
+        return [
+            'restart_count' => $restartCountChanged ? $observedRestartCount : $previousRestartCount,
+            'restart_count_changed' => $restartCountChanged,
+            'restart_limit_reached' => $restartLimitReached,
+            'new_generation' => $newGeneration,
+        ];
+    }
+}
diff --git a/app/Traits/HasRestartLimit.php b/app/Traits/HasRestartLimit.php
new file mode 100644
index 000000000..edb461cdc
--- /dev/null
+++ b/app/Traits/HasRestartLimit.php
@@ -0,0 +1,73 @@
+<?php
+
+namespace App\Traits;
+
+use App\Services\RestartCountTracker;
+
+trait HasRestartLimit
+{
+    public function initializeHasRestartLimit(): void
+    {
+        $this->mergeFillable(['restart_count', 'max_restart_count', 'restart_limit_reached', 'last_restart_at', 'last_restart_type']);
+        $this->mergeCasts([
+            'restart_count' => 'integer',
+            'max_restart_count' => 'integer',
+            'restart_limit_reached' => 'boolean',
+            'last_restart_at' => 'datetime',
+            'last_restart_type' => 'string',
+        ]);
+    }
+
+    public function stoppedAfterRestartLimit(): bool
+    {
+        return str($this->status)->startsWith('exited') && $this->restart_limit_reached === true;
+    }
+
+    public function trackRestartCount(int $observedRestartCount): bool
+    {
+        $state = (new RestartCountTracker)->evaluate(
+            previousRestartCount: $this->restart_count ?? 0,
+            observedRestartCount: $observedRestartCount,
+            maxRestartCount: $this->restartLimitMaximum(),
+        );
+
+        if ($state['restart_count_changed']) {
+            $hasCrashRestarts = $state['restart_count'] > 0;
+            $this->update([
+                'restart_count' => $state['restart_count'],
+                'last_restart_at' => $hasCrashRestarts ? now() : null,
+                'last_restart_type' => $hasCrashRestarts ? 'crash' : null,
+            ]);
+        }
+
+        if (! $state['restart_limit_reached']) {
+            return false;
+        }
+
+        $claimed = $this->newQuery()
+            ->whereKey($this->getKey())
+            ->where('restart_limit_reached', false)
+            ->update(['restart_limit_reached' => true]) === 1;
+
+        if ($claimed) {
+            $this->restart_limit_reached = true;
+        }
+
+        return $claimed;
+    }
+
+    public function resetRestartLimit(): void
+    {
+        $this->update([
+            'restart_count' => 0,
+            'restart_limit_reached' => false,
+            'last_restart_at' => null,
+            'last_restart_type' => null,
+        ]);
+    }
+
+    public function restartLimitMaximum(): int
+    {
+        return $this->max_restart_count ?? 0;
+    }
+}
diff --git a/database/migrations/2026_08_30_193506_add_container_present_to_applications_table.php b/database/migrations/2026_08_30_193506_add_container_present_to_applications_table.php
new file mode 100644
index 000000000..fc59fb587
--- /dev/null
+++ b/database/migrations/2026_08_30_193506_add_container_present_to_applications_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->boolean('container_present')->nullable()->after('status');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->dropColumn('container_present');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_30_220617_add_restart_limit_reached_to_applications_table.php b/database/migrations/2026_08_30_220617_add_restart_limit_reached_to_applications_table.php
new file mode 100644
index 000000000..80603ee97
--- /dev/null
+++ b/database/migrations/2026_08_30_220617_add_restart_limit_reached_to_applications_table.php
@@ -0,0 +1,37 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached')->default(false)->after('max_restart_count');
+        });
+
+        DB::table('applications')
+            ->where('status', 'like', 'exited%')
+            ->where('restart_count', '>', 0)
+            ->where('max_restart_count', '>', 0)
+            ->whereColumn('restart_count', '>=', 'max_restart_count')
+            ->where('last_restart_type', 'crash')
+            ->update(['restart_limit_reached' => true]);
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073116_add_restart_limit_to_application_previews.php b/database/migrations/2026_08_31_073116_add_restart_limit_to_application_previews.php
new file mode 100644
index 000000000..adf119a6e
--- /dev/null
+++ b/database/migrations/2026_08_31_073116_add_restart_limit_to_application_previews.php
@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->integer('restart_count')->default(0);
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+            $table->timestamp('last_restart_at')->nullable();
+            $table->string('last_restart_type', 10)->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->dropColumn([
+                'restart_count',
+                'max_restart_count',
+                'restart_limit_reached',
+                'last_restart_at',
+                'last_restart_type',
+            ]);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073117_add_restart_limit_to_service_applications.php b/database/migrations/2026_08_31_073117_add_restart_limit_to_service_applications.php
new file mode 100644
index 000000000..0838ad4bd
--- /dev/null
+++ b/database/migrations/2026_08_31_073117_add_restart_limit_to_service_applications.php
@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('service_applications', function (Blueprint $table) {
+            $table->integer('restart_count')->default(0);
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+            $table->timestamp('last_restart_at')->nullable();
+            $table->string('last_restart_type', 10)->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('service_applications', function (Blueprint $table) {
+            $table->dropColumn([
+                'restart_count',
+                'max_restart_count',
+                'restart_limit_reached',
+                'last_restart_at',
+                'last_restart_type',
+            ]);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073118_add_restart_limit_to_service_databases.php b/database/migrations/2026_08_31_073118_add_restart_limit_to_service_databases.php
new file mode 100644
index 000000000..046b02960
--- /dev/null
+++ b/database/migrations/2026_08_31_073118_add_restart_limit_to_service_databases.php
@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('service_databases', function (Blueprint $table) {
+            $table->integer('restart_count')->default(0);
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+            $table->timestamp('last_restart_at')->nullable();
+            $table->string('last_restart_type', 10)->nullable();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('service_databases', function (Blueprint $table) {
+            $table->dropColumn([
+                'restart_count',
+                'max_restart_count',
+                'restart_limit_reached',
+                'last_restart_at',
+                'last_restart_type',
+            ]);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073119_add_restart_limit_to_standalone_postgresqls.php b/database/migrations/2026_08_31_073119_add_restart_limit_to_standalone_postgresqls.php
new file mode 100644
index 000000000..641da5b75
--- /dev/null
+++ b/database/migrations/2026_08_31_073119_add_restart_limit_to_standalone_postgresqls.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_postgresqls', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_postgresqls', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073120_add_restart_limit_to_standalone_redis.php b/database/migrations/2026_08_31_073120_add_restart_limit_to_standalone_redis.php
new file mode 100644
index 000000000..24329da9f
--- /dev/null
+++ b/database/migrations/2026_08_31_073120_add_restart_limit_to_standalone_redis.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_redis', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_redis', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073121_add_restart_limit_to_standalone_mongodbs.php b/database/migrations/2026_08_31_073121_add_restart_limit_to_standalone_mongodbs.php
new file mode 100644
index 000000000..08980a7cb
--- /dev/null
+++ b/database/migrations/2026_08_31_073121_add_restart_limit_to_standalone_mongodbs.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_mongodbs', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_mongodbs', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073122_add_restart_limit_to_standalone_mysqls.php b/database/migrations/2026_08_31_073122_add_restart_limit_to_standalone_mysqls.php
new file mode 100644
index 000000000..729f85273
--- /dev/null
+++ b/database/migrations/2026_08_31_073122_add_restart_limit_to_standalone_mysqls.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_mysqls', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_mysqls', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073123_add_restart_limit_to_standalone_mariadbs.php b/database/migrations/2026_08_31_073123_add_restart_limit_to_standalone_mariadbs.php
new file mode 100644
index 000000000..6bada2326
--- /dev/null
+++ b/database/migrations/2026_08_31_073123_add_restart_limit_to_standalone_mariadbs.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_mariadbs', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_mariadbs', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073124_add_restart_limit_to_standalone_keydbs.php b/database/migrations/2026_08_31_073124_add_restart_limit_to_standalone_keydbs.php
new file mode 100644
index 000000000..41a983924
--- /dev/null
+++ b/database/migrations/2026_08_31_073124_add_restart_limit_to_standalone_keydbs.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_keydbs', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_keydbs', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073125_add_restart_limit_to_standalone_dragonflies.php b/database/migrations/2026_08_31_073125_add_restart_limit_to_standalone_dragonflies.php
new file mode 100644
index 000000000..23d8ccf2c
--- /dev/null
+++ b/database/migrations/2026_08_31_073125_add_restart_limit_to_standalone_dragonflies.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_dragonflies', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_dragonflies', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_073126_add_restart_limit_to_standalone_clickhouses.php b/database/migrations/2026_08_31_073126_add_restart_limit_to_standalone_clickhouses.php
new file mode 100644
index 000000000..5ec8d4522
--- /dev/null
+++ b/database/migrations/2026_08_31_073126_add_restart_limit_to_standalone_clickhouses.php
@@ -0,0 +1,23 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('standalone_clickhouses', function (Blueprint $table) {
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('standalone_clickhouses', function (Blueprint $table) {
+            $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092837_add_restart_limit_reached_notifications_to_email_notification_settings_table.php b/database/migrations/2026_08_31_092837_add_restart_limit_reached_notifications_to_email_notification_settings_table.php
new file mode 100644
index 000000000..e4db4b7e8
--- /dev/null
+++ b/database/migrations/2026_08_31_092837_add_restart_limit_reached_notifications_to_email_notification_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('email_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_email_notifications')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('email_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_email_notifications');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092838_add_restart_limit_reached_notifications_to_discord_notification_settings_table.php b/database/migrations/2026_08_31_092838_add_restart_limit_reached_notifications_to_discord_notification_settings_table.php
new file mode 100644
index 000000000..b7803e633
--- /dev/null
+++ b/database/migrations/2026_08_31_092838_add_restart_limit_reached_notifications_to_discord_notification_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('discord_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_discord_notifications')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('discord_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_discord_notifications');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092840_add_restart_limit_reached_notifications_to_telegram_notification_settings_table.php b/database/migrations/2026_08_31_092840_add_restart_limit_reached_notifications_to_telegram_notification_settings_table.php
new file mode 100644
index 000000000..51880ceb8
--- /dev/null
+++ b/database/migrations/2026_08_31_092840_add_restart_limit_reached_notifications_to_telegram_notification_settings_table.php
@@ -0,0 +1,30 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('telegram_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_telegram_notifications')->default(true);
+            $table->text('telegram_notifications_restart_limit_reached_thread_id')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('telegram_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_telegram_notifications');
+            $table->dropColumn('telegram_notifications_restart_limit_reached_thread_id');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092841_add_restart_limit_reached_notifications_to_slack_notification_settings_table.php b/database/migrations/2026_08_31_092841_add_restart_limit_reached_notifications_to_slack_notification_settings_table.php
new file mode 100644
index 000000000..0b82b423f
--- /dev/null
+++ b/database/migrations/2026_08_31_092841_add_restart_limit_reached_notifications_to_slack_notification_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('slack_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_slack_notifications')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('slack_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_slack_notifications');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092842_add_restart_limit_reached_notifications_to_pushover_notification_settings_table.php b/database/migrations/2026_08_31_092842_add_restart_limit_reached_notifications_to_pushover_notification_settings_table.php
new file mode 100644
index 000000000..596af0b5c
--- /dev/null
+++ b/database/migrations/2026_08_31_092842_add_restart_limit_reached_notifications_to_pushover_notification_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('pushover_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_pushover_notifications')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('pushover_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_pushover_notifications');
+        });
+    }
+};
diff --git a/database/migrations/2026_08_31_092843_add_restart_limit_reached_notifications_to_webhook_notification_settings_table.php b/database/migrations/2026_08_31_092843_add_restart_limit_reached_notifications_to_webhook_notification_settings_table.php
new file mode 100644
index 000000000..cc03cf0f5
--- /dev/null
+++ b/database/migrations/2026_08_31_092843_add_restart_limit_reached_notifications_to_webhook_notification_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('webhook_notification_settings', function (Blueprint $table) {
+            $table->boolean('restart_limit_reached_webhook_notifications')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('webhook_notification_settings', function (Blueprint $table) {
+            $table->dropColumn('restart_limit_reached_webhook_notifications');
+        });
+    }
+};
diff --git a/resources/views/components/application/restart-limit-warning.blade.php b/resources/views/components/application/restart-limit-warning.blade.php
new file mode 100644
index 000000000..3d08c803d
--- /dev/null
+++ b/resources/views/components/application/restart-limit-warning.blade.php
@@ -0,0 +1,10 @@
+@props(['application'])
+
+@if ($application->stoppedAfterRestartLimit())
+    @php($restartLimit = method_exists($application, 'restartLimitMaximum') ? $application->restartLimitMaximum() : ($application->max_restart_count ?? 0))
+    @php($displayRestartCount = max($application->restart_count ?? 0, $restartLimit))
+    <x-status-badge
+        status="Restart limit reached"
+        type="warning"
+        title="Container has crashed and Coolify stopped it after {{ $displayRestartCount }} restart attempts." />
+@endif
diff --git a/resources/views/components/notification/event-grid.blade.php b/resources/views/components/notification/event-grid.blade.php
index 2ce6a4a7f..55b452cf5 100644
--- a/resources/views/components/notification/event-grid.blade.php
+++ b/resources/views/components/notification/event-grid.blade.php
@@ -9,10 +9,17 @@
         'Deployments' => [
             ['key' => 'deploymentSuccess', 'label' => 'Deployment success'],
             ['key' => 'deploymentFailure', 'label' => 'Deployment failure'],
+        ],
+        'Resources' => [
             [
                 'key' => 'statusChange',
-                'label' => 'Container status changes',
-                'helper' => 'Notify when a container stops or restarts.',
+                'label' => 'Resource status changes',
+                'helper' => 'Notify when a resource stops or Coolify automatically restarts it.',
+            ],
+            [
+                'key' => 'restartLimitReached',
+                'label' => 'Restart limit reached',
+                'helper' => 'Notify when a resource is stopped after reaching its restart limit.',
             ],
         ],
         'Backups' => [
diff --git a/resources/views/components/status-summary.blade.php b/resources/views/components/status-summary.blade.php
index aee198a52..88102f57e 100644
--- a/resources/views/components/status-summary.blade.php
+++ b/resources/views/components/status-summary.blade.php
@@ -23,7 +23,7 @@
 
     $containerType = match (true) {
         str($containerStatus)->startsWith('running') => 'success',
-        str($containerStatus)->startsWith(['starting', 'restarting']) => 'warning',
+        str($containerStatus)->startsWith(['starting', 'restarting', 'degraded']) => 'warning',
         default => 'error',
     };
 
@@ -36,6 +36,7 @@
 
     [$summaryLabel, $summaryType] = match (true) {
         $containerType === 'error' => [$containerLabel, 'error'],
+        str($containerStatus)->startsWith('degraded') => ['Degraded', 'warning'],
         $healthType === 'error' => ['Degraded', 'error'],
         $containerType === 'warning' => [$containerLabel, 'warning'],
         $monitoringExcluded => ["{$containerLabel} (monitoring disabled)", 'warning'],
diff --git a/resources/views/components/status/index.blade.php b/resources/views/components/status/index.blade.php
index d774fa94c..aafa106a7 100644
--- a/resources/views/components/status/index.blade.php
+++ b/resources/views/components/status/index.blade.php
@@ -22,9 +22,7 @@
             title="Container has restarted {{ $resource->restart_count }} time{{ $resource->restart_count > 1 ? 's' : '' }}. Last restart: {{ $resource->last_restart_at?->diffForHumans() }}" />
     @endif
     @if ($stoppedAfterRestartLimit)
-        <x-status-badge status="Stopped after reaching restart limit ({{ $resource->restart_count }}/{{ $resource->max_restart_count }})."
-            type="warning"
-            title="Container has crashed and Coolify stopped it after {{ $resource->restart_count }} restart attempts." />
+        <x-application.restart-limit-warning :application="$resource" />
     @endif
     @if (!str($resource->status)->contains('exited') && $showRefreshButton)
         <x-status-badge as="button" wire:target="manualCheckStatus" wire:loading.attr="disabled"
diff --git a/resources/views/emails/container-stopped.blade.php b/resources/views/emails/container-stopped.blade.php
deleted file mode 100644
index cc1cec1da..000000000
--- a/resources/views/emails/container-stopped.blade.php
+++ /dev/null
@@ -1,7 +0,0 @@
-<x-emails.layout>
-A resource ({{ $containerName }}) has been stopped unexpectedly on {{ $serverName }}.
-
-@if ($url)
-Please check what is going on [here]({{ $url }}).
-@endif
-</x-emails.layout>
diff --git a/resources/views/livewire/notifications/email.blade.php b/resources/views/livewire/notifications/email.blade.php
index a41e72cb7..fdc2ac672 100644
--- a/resources/views/livewire/notifications/email.blade.php
+++ b/resources/views/livewire/notifications/email.blade.php
@@ -149,7 +149,11 @@ class="button button-highlighted">
                         :events="[
                             ['property' => 'deploymentSuccessEmailNotifications', 'label' => 'Deployment success', 'enabled' => $deploymentSuccessEmailNotifications],
                             ['property' => 'deploymentFailureEmailNotifications', 'label' => 'Deployment failure', 'enabled' => $deploymentFailureEmailNotifications],
-                            ['property' => 'statusChangeEmailNotifications', 'label' => 'Container status changes', 'enabled' => $statusChangeEmailNotifications],
+                        ]" />
+                    <x-notification.event-multiselect :settings="$settings" id="resource-email-events" label="Resources"
+                        :events="[
+                            ['property' => 'statusChangeEmailNotifications', 'label' => 'Resource status changes', 'enabled' => $statusChangeEmailNotifications],
+                            ['property' => 'restartLimitReachedEmailNotifications', 'label' => 'Restart limit reached', 'enabled' => $restartLimitReachedEmailNotifications],
                         ]" />
                     <x-notification.event-multiselect :settings="$settings" id="backup-email-events" label="Backups"
                         :events="[
diff --git a/resources/views/livewire/project/application/heading.blade.php b/resources/views/livewire/project/application/heading.blade.php
index 3892a623c..15181987c 100644
--- a/resources/views/livewire/project/application/heading.blade.php
+++ b/resources/views/livewire/project/application/heading.blade.php
@@ -34,6 +34,9 @@
                     <x-status-summary :status="$application->status" />
                     <x-applications.links :application="$application" compact />
                 </div>
+                <div class="flex w-full flex-wrap gap-1">
+                    <x-application.restart-limit-warning :application="$application" />
+                </div>
             </div>
         </div>
 
@@ -103,32 +106,18 @@ class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="me
                                     @endcan
                                 @endif
                             @endif
-                            @can('deploy', $application)
-                                <button type="button" class="listbox-option justify-start! gap-2.5!"
-                                    @click="open = false; document.getElementById('application-mobile-stop-trigger')?.click()"
-                                    role="menuitem">
-                                    <x-reicon name="stop-circle" class="size-3.5 text-error" />
-                                    Stop
-                                </button>
-                            @else
-                                <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
-                                    role="menuitem">
-                                    <x-reicon name="stop-circle" class="size-3.5 opacity-70" />
-                                    Stop
-                                </button>
-                            @endcan
                         @else
                             @can('deploy', $application)
                                 <button type="button" class="listbox-option justify-start! gap-2.5!"
                                     wire:click="deploy" @click="open = false" role="menuitem">
                                     <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                    Deploy
+                                    {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment' : 'Deploy' }}
                                 </button>
                             @else
                                 <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
                                     role="menuitem">
                                     <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                    Deploy
+                                    {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment' : 'Deploy' }}
                                 </button>
                             @endcan
                         @endif
@@ -138,25 +127,36 @@ class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="me
                                     wire:click="{{ $application->status === 'running' ? 'force_deploy_without_cache' : 'deploy(true)' }}"
                                     @click="open = false" role="menuitem">
                                     <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                    Deploy (without cache)
+                                    {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment (without cache)' : 'Deploy (without cache)' }}
                                 </button>
                             @else
                                 <button type="button" class="listbox-option justify-start! gap-2.5!" disabled
                                     role="menuitem">
                                     <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                    Deploy (without cache)
+                                    {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment (without cache)' : 'Deploy (without cache)' }}
                                 </button>
                             @endcan
                         @endif
+                        @if (!str($application->status)->startsWith('exited') || $application->container_present !== false)
+                            <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                @click="open = false; document.getElementById('application-mobile-stop-trigger')?.click()"
+                                role="menuitem">
+                                <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                {{ str($application->status)->startsWith('exited') ? 'Remove container' : 'Stop' }}
+                            </button>
+                        @endif
                     </div>
                 </div>
                 @endcan
             @endif
             <div class="hidden" aria-hidden="true">
-                <x-modal-confirmation title="Confirm Application Stopping?" buttonTitle="Stop"
+                <x-modal-confirmation
+                    canGate="deploy" :canResource="$application"
+                    title="{{ str($application->status)->startsWith('exited') ? 'Confirm Container Removal?' : 'Confirm Application Stopping?' }}"
+                    buttonTitle="{{ str($application->status)->startsWith('exited') ? 'Remove container' : 'Stop' }}"
                     submitAction="stop" :checkboxes="$checkboxes" :actions="[
-                        'This application will be stopped.',
-                        'All non-persistent data of this application will be deleted.',
+                        str($application->status)->startsWith('exited') ? 'The exited application container will be removed.' : 'This application will be stopped.',
+                        str($application->status)->startsWith('exited') ? 'Anonymous volumes may become eligible for Docker cleanup.' : 'All non-persistent data of this application will be deleted.',
                     ]" :confirmWithText="false" :confirmWithPassword="false"
                     step1ButtonText="Continue" step2ButtonText="Confirm">
                     <x-slot:trigger>
@@ -204,14 +204,22 @@ class="listbox-panel top-full! right-0! left-auto! mt-1! w-60! min-w-0!" role="m
                                         @disabled(!auth()->user()->can('deploy', $application))
                                         wire:click="deploy" @click="open = false" role="menuitem">
                                         <x-reicon name="play-circle" class="size-3.5 opacity-70" />
-                                        Deploy
+                                        {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment' : 'Deploy' }}
                                     </button>
                                     @if (!$application->destination->server->isSwarm())
                                         <button type="button" class="listbox-option justify-start! gap-2.5!"
                                             @disabled(!auth()->user()->can('deploy', $application))
                                             wire:click="deploy(true)" @click="open = false" role="menuitem">
                                             <x-reicon name="refresh" class="size-3.5 opacity-70" />
-                                            Deploy (without cache)
+                                            {{ $application->stoppedAfterRestartLimit() ? 'Retry deployment (without cache)' : 'Deploy (without cache)' }}
+                                        </button>
+                                    @endif
+                                    @if ($application->container_present !== false)
+                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                            @click="open = false; document.getElementById('application-mobile-stop-trigger')?.click()"
+                                            role="menuitem">
+                                            <x-reicon name="stop-circle" class="size-3.5 text-error" />
+                                            Remove container
                                         </button>
                                     @endif
                                 @else
diff --git a/resources/views/livewire/project/application/previews.blade.php b/resources/views/livewire/project/application/previews.blade.php
index 13b73ef66..ac616b84a 100644
--- a/resources/views/livewire/project/application/previews.blade.php
+++ b/resources/views/livewire/project/application/previews.blade.php
@@ -103,6 +103,7 @@ class="flex size-9 shrink-0 items-center justify-center rounded-lg bg-neutral-10
                                     Preview #{{ data_get($preview, 'pull_request_id') }}
                                 </h4>
                                 <x-status-summary :status="data_get($preview, 'status')" title="Preview status" />
+                                <x-application.restart-limit-warning :application="$preview" />
                             </div>
                         </div>
                     </div>
diff --git a/resources/views/livewire/project/application/status.blade.php b/resources/views/livewire/project/application/status.blade.php
index 2aa68fd77..6d692d36b 100644
--- a/resources/views/livewire/project/application/status.blade.php
+++ b/resources/views/livewire/project/application/status.blade.php
@@ -1,3 +1,4 @@
 <div wire:poll.10000ms="refreshStatus">
     <x-status-summary :status="$application->status" />
+    <x-application.restart-limit-warning :application="$application" />
 </div>
diff --git a/resources/views/livewire/project/database/heading.blade.php b/resources/views/livewire/project/database/heading.blade.php
index bcdf1cf85..ad1c43889 100644
--- a/resources/views/livewire/project/database/heading.blade.php
+++ b/resources/views/livewire/project/database/heading.blade.php
@@ -63,7 +63,12 @@
                 <h1 class="min-w-0 max-w-full truncate text-[24px]! leading-7! font-semibold! tracking-tight! text-black dark:text-fg">
                     {{ $database->name }}
                 </h1>
-                <x-status-summary :status="$database->status" title="Database status" />
+                <div class="relative flex w-full min-w-0 items-center gap-2">
+                    <x-status-summary :status="$database->status" title="Database status" />
+                </div>
+                <div class="flex w-full flex-wrap gap-1">
+                    <x-application.restart-limit-warning :application="$database" />
+                </div>
             </div>
         </div>
 
diff --git a/resources/views/livewire/project/database/status.blade.php b/resources/views/livewire/project/database/status.blade.php
index 8f8a72067..cf2d32c7a 100644
--- a/resources/views/livewire/project/database/status.blade.php
+++ b/resources/views/livewire/project/database/status.blade.php
@@ -1,3 +1,4 @@
 <div wire:poll.10000ms="refreshStatus">
     <x-status-summary :status="$database->status" title="Database status" />
+    <x-application.restart-limit-warning :application="$database" />
 </div>
diff --git a/resources/views/livewire/project/resource/index.blade.php b/resources/views/livewire/project/resource/index.blade.php
index 3ab0ac633..772a01fdc 100644
--- a/resources/views/livewire/project/resource/index.blade.php
+++ b/resources/views/livewire/project/resource/index.blade.php
@@ -220,7 +220,7 @@ class="relative z-10 block truncate text-[11px] text-neutral-500 hover:underline
                             x-text="item.typeLabel"></div>
 
                         <div>
-                            <x-status-badge dynamic>
+                            <x-status-badge dynamic x-bind:title="statusTitle(item)">
                                 <span class="size-1.5 shrink-0 rounded-full"
                                     x-bind:class="statusDotClass(item)"></span>
                                 <span class="truncate" x-text="statusLabel(item)"></span>
@@ -299,7 +299,7 @@ class="truncate text-[13px]! leading-4! font-semibold! text-black dark:text-fg"
                                     <p class="mt-0.5 text-[11px] text-neutral-500 dark:text-fg-faint"
                                         x-text="item.typeLabel"></p>
                                 </div>
-                                <x-status-badge dynamic>
+                                <x-status-badge dynamic x-bind:title="statusTitle(item)">
                                     <span class="size-1.5 shrink-0 rounded-full"
                                         x-bind:class="statusDotClass(item)"></span>
                                     <span class="truncate" x-text="statusLabel(item)"></span>
@@ -518,13 +518,32 @@ function resourceIndex() {
                 localStorage.setItem('environment-resource-view', mode);
             },
             statusState(item) {
+                if (item.restartLimitReached) {
+                    return 'restart-limit';
+                }
+
                 return String(item.status || 'unknown').split(':')[0].toLowerCase();
             },
             statusLabel(item) {
+                if (item.restartLimitReached) {
+                    return 'Restart limit reached';
+                }
+
                 const state = this.statusState(item);
                 return state.charAt(0).toUpperCase() + state.slice(1);
             },
+            statusTitle(item) {
+                if (item.restartLimitReached) {
+                    return `${item.restartCount}/${item.maxRestartCount} restarts. Container preserved.`;
+                }
+
+                return this.statusLabel(item);
+            },
             statusTone(item) {
+                if (item.restartLimitReached) {
+                    return 'warning';
+                }
+
                 const state = this.statusState(item);
                 if (state === 'running') {
                     return 'success';
@@ -539,6 +558,10 @@ function resourceIndex() {
                 return 'neutral';
             },
             statusDotClass(item) {
+                if (item.restartLimitReached) {
+                    return 'bg-warning';
+                }
+
                 return {
                     success: 'bg-emerald-500',
                     warning: 'bg-warning',
diff --git a/resources/views/livewire/project/service/configuration.blade.php b/resources/views/livewire/project/service/configuration.blade.php
index beb6df6e2..4afbcbc6a 100644
--- a/resources/views/livewire/project/service/configuration.blade.php
+++ b/resources/views/livewire/project/service/configuration.blade.php
@@ -143,12 +143,12 @@ class="flex size-7.5 items-center justify-center rounded-md transition-colors"
 
                         <div :class="viewMode === 'grid'
                             ? 'grid grid-cols-1 gap-3 sm:grid-cols-2'
-                            : 'overflow-hidden rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]'">
+                            : 'overflow-x-auto rounded-xl border border-neutral-200 bg-white shadow-sm dark:border-white/[0.08] dark:bg-white/[0.025]'">
                             @if ($applications->isNotEmpty() || $databases->isNotEmpty())
                                 <div x-cloak x-show="viewMode === 'table'"
-                                    class="grid grid-cols-[minmax(0,1fr)_auto] gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 sm:grid-cols-[minmax(0,1fr)_minmax(0,1fr)_8rem_5rem] dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
+                                    class="grid min-w-[48rem] grid-cols-[minmax(14rem,1fr)_minmax(12rem,1fr)_12rem_5rem] gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-2.5 text-[11px] font-medium text-neutral-500 dark:border-white/[0.08] dark:bg-white/[0.025] dark:text-fg-faint">
                                     <div>Resource</div>
-                                    <div class="hidden sm:block">Image</div>
+                                    <div>Image</div>
                                     <div class="justify-self-start">Status</div>
                                     <div></div>
                                 </div>
diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index b022eef10..e7da50c80 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -42,6 +42,13 @@
         ));
 
         $serviceStatus = str($service->status ?? 'exited');
+        $selectedResourceUuid = data_get($parameters, 'stack_service_uuid');
+        $selectedResource = $selectedResourceUuid
+            ? $service->applications->firstWhere('uuid', $selectedResourceUuid)
+                ?? $service->databases->firstWhere('uuid', $selectedResourceUuid)
+            : null;
+        $displayStatus = $selectedResource?->status ?? $service->status;
+        $selectedResourceStatus = str($selectedResource?->status ?? '');
         $environmentVariablesUrl = route('project.service.environment-variables', [
             'project_uuid' => $service->environment->project->uuid,
             'environment_uuid' => $service->environment->uuid,
@@ -65,9 +72,15 @@
                     {{ $service->name }}
                 </h1>
                 <div class="relative flex w-full min-w-0 items-center gap-2">
-                    <x-status-summary :status="$service->status" title="Service status" container-name="Containers" />
+                    <x-status-summary :status="$displayStatus" :title="$selectedResource ? 'Resource status' : 'Service status'"
+                        :container-name="$selectedResource ? 'Container' : 'Containers'" />
                     <x-services.links :service="$service" compact />
                 </div>
+                <div class="flex w-full flex-wrap gap-1">
+                    @if ($selectedResource)
+                        <x-application.restart-limit-warning :application="$selectedResource" />
+                    @endif
+                </div>
             </div>
         </div>
 
@@ -91,7 +104,14 @@
 
                     <div x-cloak x-show="open" x-transition.origin.top.left
                         class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="menu">
-                        @if ($serviceStatus->contains('running') || $serviceStatus->contains('degraded'))
+                        @if ($selectedResource && $selectedResource->container_present !== false && $selectedResourceStatus->startsWith('exited'))
+                            <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                @click="open = false; document.getElementById('selected-resource-remove-trigger')?.click()"
+                                role="menuitem">
+                                <x-reicon name="trash" class="size-3.5 text-error" />
+                                Remove container
+                            </button>
+                        @elseif ($serviceStatus->contains('running') || $serviceStatus->contains('degraded'))
                             @can('deploy', $service)
                                 <button type="button" class="listbox-option justify-start! gap-2.5!"
                                     @click="open = false; document.getElementById('service-restart-trigger')?.click()"
@@ -195,6 +215,14 @@ class="resource-heading-navbar application-heading-actions flex w-auto min-w-0 i
                                 </button>
                                 <div x-cloak x-show="open" x-transition.origin.top.right
                                     class="listbox-panel top-full! right-0! left-auto! mt-1! w-64! min-w-0!" role="menu">
+                                    @if ($selectedResource && $selectedResource->container_present !== false && $selectedResourceStatus->startsWith('exited'))
+                                        <button type="button" class="listbox-option justify-start! gap-2.5!"
+                                            @click="open = false; document.getElementById('selected-resource-remove-trigger')?.click()"
+                                            role="menuitem">
+                                            <x-reicon name="trash" class="size-3.5 text-error" />
+                                            Remove container
+                                        </button>
+                                    @else
                                     @if ($serviceStatus->contains('running') || $serviceStatus->contains('degraded'))
                                         <button type="button" class="listbox-option justify-start! gap-2.5!"
                                             @disabled(!auth()->user()->can('deploy', $service))
@@ -248,6 +276,7 @@ class="listbox-panel top-full! right-0! left-auto! mt-1! w-64! min-w-0!" role="m
                                             Force Cleanup Containers
                                         </button>
                                     @endif
+                                    @endif
                                 </div>
                         </div>
                         @endcan
@@ -281,6 +310,17 @@ class="listbox-panel top-full! right-0! left-auto! mt-1! w-64! min-w-0!" role="m
                     <button id="service-stop-trigger" type="button">Stop</button>
                 </x-slot:trigger>
             </x-modal-confirmation>
+            @if ($selectedResource)
+                <x-modal-confirmation title="Confirm Container Removal?" buttonTitle="Remove container"
+                    canGate="deploy" :canResource="$service" submitAction="removeSelectedResourceContainer"
+                    :actions="['The exited service resource container will be removed.', __('resource.non_persistent')]"
+                    :confirmWithText="false" :confirmWithPassword="false" step1ButtonText="Continue"
+                    step2ButtonText="Confirm">
+                    <x-slot:trigger>
+                        <button id="selected-resource-remove-trigger" type="button">Remove container</button>
+                    </x-slot:trigger>
+                </x-modal-confirmation>
+            @endif
         </div>
     @endif
 
diff --git a/resources/views/livewire/project/service/resource-card.blade.php b/resources/views/livewire/project/service/resource-card.blade.php
index fe976180d..c9106b0fc 100644
--- a/resources/views/livewire/project/service/resource-card.blade.php
+++ b/resources/views/livewire/project/service/resource-card.blade.php
@@ -1,4 +1,12 @@
-<div>
+<div x-data="{
+    settingsUrl: @js(route('project.service.index', [...$parameters, 'stack_service_uuid' => $resource->uuid])),
+    openSettings(event) {
+        if (event.target.closest('a, button')) {
+            return;
+        }
+        Livewire.navigate(this.settingsUrl);
+    }
+}">
     @php
         [$statusType, $statusLabel] = match (true) {
             str($resource->status)->contains('running') => ['success', formatContainerStatus($resource->status)],
@@ -26,6 +34,7 @@ class="flex size-9 shrink-0 items-center justify-center rounded-lg bg-neutral-10
                     </div>
                 </div>
                 <x-status-badge :status="$statusLabel" :type="$statusType" />
+                <x-application.restart-limit-warning :application="$resource" />
             </div>
 
             @if ($resource->configuration_required)
@@ -76,7 +85,9 @@ class="flex items-center justify-end gap-1 border-t border-neutral-200 bg-neutra
     </div>
 
     <div x-cloak x-show="viewMode === 'table'"
-        class="grid min-h-14 grid-cols-[minmax(0,1fr)_auto] items-center gap-3 border-b border-neutral-200 px-4 py-2.5 last:border-b-0 hover:bg-neutral-50 sm:grid-cols-[minmax(0,1fr)_minmax(0,1fr)_8rem_5rem] dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
+        x-on:click="openSettings($event)" x-on:keydown.enter="openSettings($event)"
+        role="link" tabindex="0" aria-label="Open {{ $resourceName }} settings"
+        class="grid min-h-14 min-w-[48rem] cursor-pointer grid-cols-[minmax(14rem,1fr)_minmax(12rem,1fr)_12rem_5rem] items-center gap-3 border-b border-neutral-200 px-4 py-2.5 last:border-b-0 hover:bg-neutral-50 focus-visible:outline-2 focus-visible:outline-offset-[-2px] focus-visible:outline-primary dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
         <div class="flex min-w-0 items-center gap-3">
             <div
                 class="flex size-8 shrink-0 items-center justify-center rounded-lg bg-neutral-100 text-neutral-500 dark:bg-white/[0.06] dark:text-fg-dim">
@@ -86,14 +97,14 @@ class="flex size-8 shrink-0 items-center justify-center rounded-lg bg-neutral-10
                 <div class="truncate text-[13px] font-semibold text-black dark:text-fg">{{ $resourceName }}</div>
             </div>
         </div>
-        <div class="hidden truncate font-mono text-xs text-neutral-500 sm:block dark:text-fg-faint">
+        <div class="truncate font-mono text-xs text-neutral-500 dark:text-fg-faint">
             {{ $resource->image }}
         </div>
-        <div class="flex flex-wrap items-center justify-end gap-1 sm:contents">
-            <div class="justify-self-start">
-                <x-status-badge :status="$statusLabel" :type="$statusType" />
-            </div>
-            <div class="flex items-center justify-end gap-1">
+        <div class="flex flex-wrap items-center gap-1">
+            <x-status-badge :status="$statusLabel" :type="$statusType" />
+            <x-application.restart-limit-warning :application="$resource" />
+        </div>
+        <div class="flex items-center justify-end gap-1">
                 @if ($isDatabase && ($resource->isBackupSolutionAvailable() || $resource->is_migrated))
                     <a class="icon-button" title="Service backups" aria-label="Service backups" {{ wireNavigate() }}
                         href="{{ route('project.service.volume-backups.index', $parameters) }}">
@@ -109,10 +120,9 @@ class="flex size-8 shrink-0 items-center justify-center rounded-lg bg-neutral-10
                     @endcan
                 @endif
                 <a class="icon-button" title="Resource settings" aria-label="Resource settings" {{ wireNavigate() }}
-                    href="{{ route('project.service.index', [...$parameters, 'stack_service_uuid' => $resource->uuid]) }}">
+            href="{{ route('project.service.index', [...$parameters, 'stack_service_uuid' => $resource->uuid]) }}">
                     <x-reicon name="settings" class="size-4" />
                 </a>
-            </div>
         </div>
     </div>
 </div>
diff --git a/resources/views/livewire/project/service/status.blade.php b/resources/views/livewire/project/service/status.blade.php
index dd7a0bd8c..2bdf531b0 100644
--- a/resources/views/livewire/project/service/status.blade.php
+++ b/resources/views/livewire/project/service/status.blade.php
@@ -1,3 +1,8 @@
 <div wire:poll.10000ms="refreshStatus">
-    <x-status-summary :status="$service->status" title="Service status" container-name="Containers" />
+    @php($displayStatus = $selectedResource?->status ?? $service->status)
+    <x-status-summary :status="$displayStatus" :title="$selectedResource ? 'Resource status' : 'Service status'"
+        :container-name="$selectedResource ? 'Container' : 'Containers'" />
+    @if ($selectedResource)
+        <x-application.restart-limit-warning :application="$selectedResource" />
+    @endif
 </div>
diff --git a/resources/views/livewire/project/shared/destination.blade.php b/resources/views/livewire/project/shared/destination.blade.php
index a1f7923d3..5aba6c9ec 100644
--- a/resources/views/livewire/project/shared/destination.blade.php
+++ b/resources/views/livewire/project/shared/destination.blade.php
@@ -35,6 +35,7 @@ class="rounded bg-neutral-100 px-1.5 py-0.5 font-mono text-xs text-neutral-700 d
                     <div class="flex flex-wrap items-center gap-2 sm:justify-end">
                         <a href="{{ route('server.show', ['server_uuid' => data_get($resource, 'destination.server.uuid')]) }}"
                             {{ wireNavigate() }} class="button">Open server</a>
+                        <x-application.restart-limit-warning :application="$resource" />
                         <x-status-summary :status="$resource->status" />
                         @if ($hasAdditionalDestinations)
                             <x-forms.button canGate="deploy" :canResource="$resource"
@@ -217,6 +218,9 @@ class="rounded bg-neutral-100 px-1.5 py-0.5 font-mono text-xs text-neutral-700 d
                     <div class="flex flex-wrap items-center gap-2 sm:justify-end">
                         <a href="{{ route('server.show', ['server_uuid' => data_get($resource, 'destination.server.uuid')]) }}"
                             {{ wireNavigate() }} class="button">Open server</a>
+                        @if (method_exists($resource, 'stoppedAfterRestartLimit'))
+                            <x-application.restart-limit-warning :application="$resource" />
+                        @endif
                         @if ($primaryStatus->startsWith('running'))
                             <x-status.running :status="$primaryStatus->value()" />
                         @elseif ($primaryStatus->startsWith(['starting', 'restarting']))
diff --git a/resources/views/livewire/server/resources.blade.php b/resources/views/livewire/server/resources.blade.php
index 491535dd6..9fb2ca2fc 100644
--- a/resources/views/livewire/server/resources.blade.php
+++ b/resources/views/livewire/server/resources.blade.php
@@ -61,10 +61,14 @@ class="data-table-row server-resources-managed-table-grid border-b border-neutra
                                     {{ str($resource->type())->headline() }}
                                 </div>
                                 <div>
-                                    <x-status-badge :status="str($resourceStatus)->headline()"
-                                        :type="str($resourceStatus)->contains('running')
-                                            ? 'success'
-                                            : (str($resourceStatus)->contains(['failed', 'exited']) ? 'error' : 'neutral')" />
+                                    @if (method_exists($resource, 'stoppedAfterRestartLimit') && $resource->stoppedAfterRestartLimit())
+                                        <x-application.restart-limit-warning :application="$resource" />
+                                    @else
+                                        <x-status-badge :status="str($resourceStatus)->headline()"
+                                            :type="str($resourceStatus)->contains('running')
+                                                ? 'success'
+                                                : (str($resourceStatus)->contains(['failed', 'exited']) ? 'error' : 'neutral')" />
+                                    @endif
                                 </div>
                             </div>
                         @endforeach
diff --git a/tests/Feature/AllResourceRestartLimitsTest.php b/tests/Feature/AllResourceRestartLimitsTest.php
new file mode 100644
index 000000000..8418b552c
--- /dev/null
+++ b/tests/Feature/AllResourceRestartLimitsTest.php
@@ -0,0 +1,223 @@
+<?php
+
+use App\Models\ApplicationPreview;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use App\Traits\HasRestartLimit;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+it('gives every independently runnable non-application resource restart limit state', function (string $modelClass) {
+    expect(class_uses_recursive($modelClass))->toContain(HasRestartLimit::class);
+
+    $resource = new $modelClass;
+
+    expect($resource->getFillable())->toContain(
+        'restart_count',
+        'max_restart_count',
+        'restart_limit_reached',
+        'last_restart_at',
+        'last_restart_type',
+    )->and($resource->getCasts())->toMatchArray([
+        'restart_count' => 'integer',
+        'max_restart_count' => 'integer',
+        'restart_limit_reached' => 'boolean',
+        'last_restart_at' => 'datetime',
+    ]);
+})->with([
+    ApplicationPreview::class,
+    ServiceApplication::class,
+    ServiceDatabase::class,
+    StandaloneClickhouse::class,
+    StandaloneDragonfly::class,
+    StandaloneKeydb::class,
+    StandaloneMariadb::class,
+    StandaloneMongodb::class,
+    StandaloneMysql::class,
+    StandalonePostgresql::class,
+    StandaloneRedis::class,
+]);
+
+it('collects restart counts for preview and service containers from both status sources', function () {
+    $dockerStatus = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelStatus = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    expect($dockerStatus)
+        ->toContain('previewContainerRestartCounts')
+        ->toContain('serviceContainerRestartCounts')
+        ->and($sentinelStatus)
+        ->toContain('previewContainerRestartCounts')
+        ->toContain('serviceContainerRestartCounts');
+});
+
+it('ignores docker compose one-off job containers in both status sources', function () {
+    $dockerStatus = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelStatus = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    expect($dockerStatus)
+        ->toContain("filter_var(data_get(\$labels, 'com.docker.compose.oneoff'), FILTER_VALIDATE_BOOLEAN)")
+        ->and($sentinelStatus)
+        ->toContain("filter_var(\$labels->get('com.docker.compose.oneoff'), FILTER_VALIDATE_BOOLEAN)");
+});
+
+it('shows restart limit warnings for every resource family', function () {
+    $previews = file_get_contents(resource_path('views/livewire/project/application/previews.blade.php'));
+    $serviceCard = file_get_contents(resource_path('views/livewire/project/service/resource-card.blade.php'));
+    $applicationStatus = file_get_contents(resource_path('views/livewire/project/application/status.blade.php'));
+    $databaseStatus = file_get_contents(resource_path('views/livewire/project/database/status.blade.php'));
+
+    expect($previews)->toContain('<x-application.restart-limit-warning :application="$preview" />')
+        ->and($serviceCard)->toContain('<x-application.restart-limit-warning :application="$resource" />')
+        ->and($applicationStatus)->toContain('<x-application.restart-limit-warning :application="$application" />')
+        ->and($databaseStatus)->toContain('<x-application.restart-limit-warning :application="$database" />');
+
+    $serviceStatus = file_get_contents(resource_path('views/livewire/project/service/status.blade.php'));
+    $serviceHeading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
+    expect($serviceStatus)->toContain('<x-application.restart-limit-warning :application="$selectedResource" />')
+        ->and($serviceStatus)->toContain('$selectedResource?->status ?? $service->status')
+        ->and($serviceHeading)->toContain('<x-application.restart-limit-warning :application="$selectedResource" />')
+        ->and($serviceHeading)->toContain('$selectedResource?->status ?? $service->status');
+});
+
+it('matches application restart badge layout on mobile resource headings', function () {
+    $applicationHeading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
+    $databaseHeading = file_get_contents(resource_path('views/livewire/project/database/heading.blade.php'));
+    $serviceHeading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
+
+    foreach ([$applicationHeading, $databaseHeading, $serviceHeading] as $heading) {
+        expect($heading)
+            ->toContain('class="relative flex w-full min-w-0 items-center gap-2"')
+            ->toContain('class="flex w-full flex-wrap gap-1"');
+    }
+});
+
+it('shows database restart limits in shared resource listings', function () {
+    $resourceIndex = file_get_contents(app_path('Livewire/Project/Resource/Index.php'));
+    $serverResources = file_get_contents(resource_path('views/livewire/server/resources.blade.php'));
+    $destination = file_get_contents(resource_path('views/livewire/project/shared/destination.blade.php'));
+
+    expect($resourceIndex)
+        ->toContain("method_exists(\$item, 'stoppedAfterRestartLimit')")
+        ->not->toContain("\$type === 'application' && \$item->stoppedAfterRestartLimit()")
+        ->and($serverResources)
+        ->toContain('<x-application.restart-limit-warning :application="$resource" />')
+        ->and($destination)
+        ->toContain('<x-application.restart-limit-warning :application="$resource" />');
+});
+
+it('keeps the service resource table readable with horizontal scrolling on mobile', function () {
+    $configuration = file_get_contents(resource_path('views/livewire/project/service/configuration.blade.php'));
+    $resourceCard = file_get_contents(resource_path('views/livewire/project/service/resource-card.blade.php'));
+
+    expect($configuration)
+        ->toContain("'overflow-x-auto rounded-xl")
+        ->toContain('min-w-[48rem]')
+        ->and($resourceCard)
+        ->toContain('min-w-[48rem]')
+        ->not->toContain('<div class="hidden truncate font-mono');
+});
+
+it('opens service resource settings when a table row is clicked', function () {
+    $resourceCard = file_get_contents(resource_path('views/livewire/project/service/resource-card.blade.php'));
+
+    expect($resourceCard)
+        ->toContain('x-on:click="openSettings($event)"')
+        ->toContain('x-on:keydown.enter="openSettings($event)"')
+        ->toContain("closest('a, button')")
+        ->toContain('role="link"')
+        ->toContain('tabindex="0"');
+});
+
+it('uses selected service resource actions instead of parent complex status actions', function () {
+    $heading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
+    $headingClass = file_get_contents(app_path('Livewire/Project/Service/Heading.php'));
+
+    expect(substr_count($heading, "\$selectedResource && \$selectedResource->container_present !== false && \$selectedResourceStatus->startsWith('exited')"))->toBe(2)
+        ->and($heading)
+        ->toContain('Remove container')
+        ->toContain('removeSelectedResourceContainer')
+        ->and($headingClass)
+        ->toContain('public function removeSelectedResourceContainer(): void');
+});
+
+it('imports the application model used when claiming a restart limit', function () {
+    $statusAction = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+
+    expect($statusAction)
+        ->toContain('use App\\Models\\Application;')
+        ->toContain('Application::query()');
+});
+
+it('adds restart limit columns to previews services and standalone databases', function () {
+    $migrations = collect(glob(database_path('migrations/*.php')))
+        ->map(fn (string $path): string => file_get_contents($path))
+        ->implode("\n");
+
+    expect($migrations)
+        ->toContain("'application_previews'")
+        ->toContain("'service_applications'")
+        ->toContain("'service_databases'")
+        ->toContain("'max_restart_count'")
+        ->toContain("'restart_limit_reached'");
+
+    $restartLimitMigrations = collect(glob(database_path('migrations/*_add_restart_limit_to_*.php')));
+
+    expect($restartLimitMigrations)->toHaveCount(11);
+    expect($restartLimitMigrations->map(
+        fn (string $path): string => substr(basename($path), 0, 17)
+    )->unique())->toHaveCount(11);
+    $restartLimitMigrations->each(function (string $path): void {
+        expect(file_get_contents($path))->not->toContain('foreach (');
+    });
+});
+
+it('atomically claims a resource restart limit once and can reset it', function () {
+    Schema::create('restart_limit_test_resources', function (Blueprint $table): void {
+        $table->id();
+        $table->string('status')->default('running');
+        $table->integer('restart_count')->default(0);
+        $table->integer('max_restart_count')->default(2);
+        $table->boolean('restart_limit_reached')->default(false);
+        $table->timestamp('last_restart_at')->nullable();
+        $table->string('last_restart_type')->nullable();
+        $table->timestamps();
+    });
+
+    $resource = new class extends Model
+    {
+        use HasRestartLimit;
+
+        protected $table = 'restart_limit_test_resources';
+    };
+    $resource->save();
+    $resource->refresh();
+
+    expect($resource->trackRestartCount(2))->toBeTrue()
+        ->and($resource->fresh()->restart_limit_reached)->toBeTrue()
+        ->and($resource->trackRestartCount(2))->toBeFalse();
+
+    $resource->resetRestartLimit();
+
+    expect($resource->fresh()->restart_count)->toBe(0)
+        ->and($resource->restart_limit_reached)->toBeFalse();
+
+    $resourceWithExistingRestarts = $resource->newInstance();
+    $resourceWithExistingRestarts->max_restart_count = 0;
+    $resourceWithExistingRestarts->save();
+    expect($resourceWithExistingRestarts->trackRestartCount(17))->toBeFalse();
+
+    $resourceWithExistingRestarts->update(['max_restart_count' => 10]);
+    expect($resourceWithExistingRestarts->trackRestartCount(17))->toBeTrue()
+        ->and($resourceWithExistingRestarts->fresh()->restart_limit_reached)->toBeTrue();
+
+    Schema::drop('restart_limit_test_resources');
+});
diff --git a/tests/Feature/ApplicationContainerPresenceTest.php b/tests/Feature/ApplicationContainerPresenceTest.php
new file mode 100644
index 000000000..4a80631dd
--- /dev/null
+++ b/tests/Feature/ApplicationContainerPresenceTest.php
@@ -0,0 +1,56 @@
+<?php
+
+use App\Models\Application;
+
+it('stores nullable application container presence as a boolean', function () {
+    $application = new Application;
+    $application->forceFill(['container_present' => 1]);
+    $migration = file_get_contents(base_path('database/migrations/2026_08_30_193506_add_container_present_to_applications_table.php'));
+
+    expect($application->container_present)->toBeTrue()
+        ->and($migration)->toContain("boolean('container_present')->nullable()");
+});
+
+it('updates container presence at application lifecycle boundaries', function () {
+    $stopAction = file_get_contents(app_path('Actions/Application/StopApplication.php'));
+    $dockerStatus = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelStatus = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    expect($stopAction)->toContain('$containerPresent = ! $removeContainers;')
+        ->and($stopAction)->toMatch('/if \(\$server->isSwarm\(\)\).*?\$containerPresent = false;.*?docker stack rm/s')
+        ->and($stopAction)->toContain("'container_present' => \$containerPresent")
+        ->and($dockerStatus)->toContain("'container_present' => true")
+        ->and($dockerStatus)->toContain("'container_present' => false")
+        ->and($sentinelStatus)->toContain("'container_present' => true")
+        ->and($sentinelStatus)->toContain("'container_present' => false");
+});
+
+it('shows accurate destructive actions and the restart warning on mobile', function () {
+    $heading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
+    $mobileActions = str($heading)
+        ->after('id="application-mobile-actions"')
+        ->before('<div class="hidden" aria-hidden="true">')
+        ->toString();
+
+    expect($heading)->toContain('<x-application.restart-limit-warning :application="$application" />')
+        ->and(substr_count($heading, '$application->container_present !== false'))->toBe(2)
+        ->and($heading)->toContain("\$application->stoppedAfterRestartLimit() ? 'Retry deployment' : 'Deploy'")
+        ->and($heading)->toContain("\$application->stoppedAfterRestartLimit() ? 'Retry deployment (without cache)' : 'Deploy (without cache)'")
+        ->and($heading)->toContain('Remove container')
+        ->and($mobileActions)->toContain('Deploy (without cache)')
+        ->and($mobileActions)->toContain('Remove container')
+        ->and(strrpos($mobileActions, 'Remove container'))->toBeGreaterThan(strrpos($mobileActions, 'Deploy (without cache)'));
+});
+
+it('shows restart limit reached as a yellow state in environment resource lists', function () {
+    $indexClass = file_get_contents(app_path('Livewire/Project/Resource/Index.php'));
+    $indexView = file_get_contents(resource_path('views/livewire/project/resource/index.blade.php'));
+
+    expect($indexClass)->toContain("'restartLimitReached' => \$type === 'application' && \$item->stoppedAfterRestartLimit()")
+        ->and($indexClass)->toContain('? max($item->restart_count ?? 0, $item->max_restart_count ?? 0)')
+        ->and($indexClass)->toContain("'maxRestartCount' => \$item->max_restart_count ?? 0")
+        ->and($indexView)->toContain("if (item.restartLimitReached) {\n                    return 'restart-limit';")
+        ->and($indexView)->toContain("return 'Restart limit reached';")
+        ->and($indexView)->toContain("if (item.restartLimitReached) {\n                    return 'bg-warning';")
+        ->and($indexView)->toContain('x-bind:title="statusTitle(item)"');
+});
diff --git a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
index 6b82d5568..3e6e04629 100644
--- a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
+++ b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
@@ -1,16 +1,24 @@
 <?php
 
 use App\Actions\Application\StopApplication;
+use App\Actions\Docker\GetContainersStatus;
+use App\Jobs\ApplicationDeploymentJob;
 use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\BaseModel;
+use App\Models\Server;
 use App\Notifications\Application\RestartLimitReached;
+use Mockery\MockInterface;
 
 function applicationWithRestartState(array $attributes = []): Application
 {
     $application = new Application;
     $application->forceFill(array_merge([
         'status' => 'exited:unhealthy',
+        'container_present' => true,
         'restart_count' => 2,
         'max_restart_count' => 2,
+        'restart_limit_reached' => true,
         'last_restart_type' => 'crash',
         'last_restart_at' => now(),
     ], $attributes));
@@ -21,9 +29,51 @@ function applicationWithRestartState(array $attributes = []): Application
 it('detects applications stopped after reaching the crash restart limit', function () {
     expect(applicationWithRestartState()->stoppedAfterRestartLimit())->toBeTrue()
         ->and(applicationWithRestartState(['status' => 'running:unhealthy'])->stoppedAfterRestartLimit())->toBeFalse()
-        ->and(applicationWithRestartState(['restart_count' => 1])->stoppedAfterRestartLimit())->toBeFalse()
-        ->and(applicationWithRestartState(['max_restart_count' => 0])->stoppedAfterRestartLimit())->toBeFalse()
-        ->and(applicationWithRestartState(['last_restart_type' => null])->stoppedAfterRestartLimit())->toBeFalse();
+        ->and(applicationWithRestartState(['restart_limit_reached' => false])->stoppedAfterRestartLimit())->toBeFalse();
+});
+
+it('keeps the restart limit state after Docker resets its counter', function () {
+    expect(applicationWithRestartState([
+        'restart_count' => 0,
+        'last_restart_type' => null,
+        'last_restart_at' => null,
+    ])->stoppedAfterRestartLimit())->toBeTrue();
+});
+
+it('preserves exited application state when the container snapshot is empty', function () {
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->setRelation('additional_servers', collect());
+    $application->forceFill([
+        'id' => 1,
+        'status' => 'exited:unhealthy',
+        'container_present' => true,
+        'restart_limit_reached' => true,
+    ]);
+    $application->shouldNotReceive('update');
+
+    $services = Mockery::mock();
+    $services->shouldReceive('get')->once()->andReturn(collect());
+
+    $server = Mockery::mock(Server::class, function (MockInterface $mock) use ($application, $services) {
+        $mock->shouldReceive('isFunctional')->once()->andReturnTrue();
+        $mock->shouldReceive('applications')->once()->andReturn(collect([$application]));
+        $mock->shouldReceive('databases')->once()->andReturn(collect());
+        $mock->shouldReceive('services')->once()->andReturn($services);
+        $mock->shouldReceive('previews')->once()->andReturn(collect());
+    })->makePartial();
+    $server->setRelation('team', (object) ['id' => 1]);
+
+    GetContainersStatus::run($server, collect(), collect());
+
+    expect($application->container_present)->toBeTrue()
+        ->and($application->restart_limit_reached)->toBeTrue();
+});
+
+it('does not infer the restart limit from an exited existing container', function () {
+    expect(applicationWithRestartState([
+        'container_present' => true,
+        'restart_limit_reached' => false,
+    ])->stoppedAfterRestartLimit())->toBeFalse();
 });
 
 it('shows a stopped after restart limit warning in the status badge', function () {
@@ -32,7 +82,8 @@ function applicationWithRestartState(array $attributes = []): Application
         'showRefreshButton' => false,
     ])->render();
 
-    expect($html)->toContain('Stopped after reaching restart limit (2/2).')
+    expect($html)->toContain('Restart limit reached')
+        ->not->toContain('Stopped after reaching restart limit (2/2).')
         ->and($html)->toContain('Container has crashed and Coolify stopped it after 2 restart attempts.');
 });
 
@@ -41,11 +92,12 @@ function applicationWithRestartState(array $attributes = []): Application
         'resource' => applicationWithRestartState([
             'restart_count' => 0,
             'last_restart_type' => null,
+            'restart_limit_reached' => false,
         ]),
         'showRefreshButton' => false,
     ])->render();
 
-    expect($html)->not->toContain('Stopped after reaching restart limit');
+    expect($html)->not->toContain('Restart limit reached');
 });
 
 it('keeps restart tracking configurable when stopping an application', function () {
@@ -56,6 +108,59 @@ function applicationWithRestartState(array $attributes = []): Application
         ->and($resetRestartCount->getDefaultValue())->toBeTrue();
 });
 
+it('can stop an application without removing its containers', function () {
+    $method = new ReflectionMethod(StopApplication::class, 'handle');
+    $removeContainers = collect($method->getParameters())->firstWhere('name', 'removeContainers');
+    $action = file_get_contents(app_path('Actions/Application/StopApplication.php'));
+
+    expect($removeContainers)->not->toBeNull()
+        ->and($removeContainers->getDefaultValue())->toBeTrue()
+        ->and($action)->toContain('docker update --restart=no')
+        ->and($action)->toContain('if ($removeContainers)');
+});
+
+it('preserves containers and skips cleanup when the restart limit is reached', function () {
+    $statusAction = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelJob = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    expect($statusAction)->toContain('dockerCleanup: false')
+        ->and($statusAction)->toContain('resetRestartCount: false')
+        ->and($statusAction)->toContain('removeContainers: false')
+        ->and($statusAction)->toContain("['restart_limit_reached' => true]")
+        ->and($sentinelJob)->toContain("['restart_limit_reached' => true]");
+});
+
+it('atomically claims the restart limit transition before stopping and notifying', function () {
+    $statusAction = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelJob = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    foreach ([$statusAction, $sentinelJob] as $detector) {
+        expect($detector)
+            ->toContain("->where('restart_limit_reached', false)")
+            ->toContain("->update(['restart_limit_reached' => true]) === 1");
+    }
+});
+
+it('clears the explicit restart limit state only after a successful main deployment', function () {
+    $method = new ReflectionMethod(ApplicationDeploymentJob::class, 'handleSuccessfulDeployment');
+    $source = file($method->getFileName());
+    $deploymentJob = implode(array_slice($source, $method->getStartLine() - 1, $method->getEndLine() - $method->getStartLine() + 1));
+
+    expect(substr_count($deploymentJob, "'restart_limit_reached'] = false"))->toBe(1)
+        ->and($deploymentJob)->toContain("if (\$this->pull_request_id === 0) {\n            \$restartState['restart_limit_reached'] = false;\n        }")
+        ->and($deploymentJob)->toContain('$this->application->update($restartState);')
+        ->and(substr_count($deploymentJob, '$this->application->update('))->toBe(1);
+});
+
+it('preserves restart-limit applications only while their exited container exists', function () {
+    $statusAction = file_get_contents(app_path('Actions/Docker/GetContainersStatus.php'));
+    $sentinelJob = file_get_contents(app_path('Jobs/PushServerUpdateJob.php'));
+
+    expect($statusAction)->toContain("'container_present' => false")
+        ->and($statusAction)->toContain("'restart_limit_reached' => false")
+        ->and($sentinelJob)->toContain('if ($application->stoppedAfterRestartLimit() && $containerStatuses->every(');
+});
+
 it('uses the application link for restart limit notifications', function () {
     $application = new class extends Application
     {
@@ -80,3 +185,55 @@ public function link()
 
     expect($notification->resource_url)->toBe('https://coolify.test/project/link-from-model');
 });
+
+it('uses the resolved environment project name in Slack restart limit notifications', function () {
+    $environment = (object) [
+        'uuid' => 'environment-uuid',
+        'name' => 'production',
+        'project' => (object) [
+            'uuid' => 'project-uuid',
+            'name' => 'Coolify',
+        ],
+    ];
+
+    $application = new class extends Application
+    {
+        public function link(): string
+        {
+            return 'https://coolify.test/application';
+        }
+    };
+    $application->forceFill(['name' => 'app']);
+    $application->setRelation('environment', $environment);
+
+    $preview = new ApplicationPreview;
+    $preview->forceFill([
+        'uuid' => 'preview-uuid',
+        'pull_request_id' => 42,
+        'restart_count' => 2,
+        'max_restart_count' => 2,
+    ]);
+    $preview->setRelation('application', $application);
+
+    $serviceResource = new class extends BaseModel {};
+    $serviceResource->forceFill([
+        'name' => 'database',
+        'uuid' => 'service-resource-uuid',
+        'restart_count' => 2,
+        'max_restart_count' => 2,
+    ]);
+    $serviceResource->setRelation('service', new class($environment)
+    {
+        public function __construct(public object $environment) {}
+
+        public function link(): string
+        {
+            return 'https://coolify.test/service';
+        }
+    });
+
+    expect((new RestartLimitReached($preview))->toSlack()->description)
+        ->toContain('*Project:* Coolify')
+        ->and((new RestartLimitReached($serviceResource))->toSlack()->description)
+        ->toContain('*Project:* Coolify');
+});
diff --git a/tests/Feature/Authorization/NotificationAuthorizationTest.php b/tests/Feature/Authorization/NotificationAuthorizationTest.php
index 793f76b1f..84b4ace6f 100644
--- a/tests/Feature/Authorization/NotificationAuthorizationTest.php
+++ b/tests/Feature/Authorization/NotificationAuthorizationTest.php
@@ -132,6 +132,80 @@
     expect($this->admin->can('update', $settings))->toBeTrue();
 });
 
+test('telegram restart limit thread id accepts 255 characters', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TelegramNotification::class)
+        ->set('telegramNotificationsRestartLimitReachedThreadId', str_repeat('a', 255))
+        ->call('syncData', true)
+        ->assertHasNoErrors(['telegramNotificationsRestartLimitReachedThreadId']);
+
+    expect($this->team->telegramNotificationSettings->fresh()->telegram_notifications_restart_limit_reached_thread_id)
+        ->toBe(str_repeat('a', 255));
+});
+
+test('telegram restart limit thread id rejects 256 characters', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(TelegramNotification::class)
+        ->set('telegramNotificationsRestartLimitReachedThreadId', str_repeat('a', 256))
+        ->call('syncData', true)
+        ->assertHasErrors(['telegramNotificationsRestartLimitReachedThreadId' => 'max']);
+});
+
+test('member cannot view telegram thread ids', function () {
+    $threadIds = [
+        'telegram_notifications_deployment_success_thread_id' => 'deployment-success-thread',
+        'telegram_notifications_deployment_failure_thread_id' => 'deployment-failure-thread',
+        'telegram_notifications_status_change_thread_id' => 'status-change-thread',
+        'telegram_notifications_restart_limit_reached_thread_id' => 'restart-limit-thread',
+        'telegram_notifications_backup_success_thread_id' => 'backup-success-thread',
+        'telegram_notifications_backup_failure_thread_id' => 'backup-failure-thread',
+        'telegram_notifications_scheduled_task_success_thread_id' => 'scheduled-task-success-thread',
+        'telegram_notifications_scheduled_task_failure_thread_id' => 'scheduled-task-failure-thread',
+        'telegram_notifications_docker_cleanup_success_thread_id' => 'docker-cleanup-success-thread',
+        'telegram_notifications_docker_cleanup_failure_thread_id' => 'docker-cleanup-failure-thread',
+        'telegram_notifications_server_disk_usage_thread_id' => 'server-disk-usage-thread',
+        'telegram_notifications_server_reachable_thread_id' => 'server-reachable-thread',
+        'telegram_notifications_server_unreachable_thread_id' => 'server-unreachable-thread',
+        'telegram_notifications_server_patch_thread_id' => 'server-patch-thread',
+        'telegram_notifications_traefik_outdated_thread_id' => 'traefik-outdated-thread',
+    ];
+
+    $this->team->telegramNotificationSettings->update($threadIds);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(TelegramNotification::class);
+
+    foreach ($threadIds as $column => $threadId) {
+        $component
+            ->assertSet(str($column)->camel()->toString(), null)
+            ->assertDontSee($threadId);
+    }
+});
+
+test('admin can view telegram thread ids', function () {
+    $threadIds = [
+        'telegram_notifications_deployment_success_thread_id' => 'deployment-success-thread',
+        'telegram_notifications_restart_limit_reached_thread_id' => 'restart-limit-thread',
+    ];
+
+    $this->team->telegramNotificationSettings->update($threadIds);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(TelegramNotification::class);
+
+    foreach ($threadIds as $column => $threadId) {
+        $component->assertSet(str($column)->camel()->toString(), $threadId);
+    }
+});
+
 // --- Email ---
 
 test('member cannot send test email notification', function () {
diff --git a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
index f6991025c..9d6e19a98 100644
--- a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
+++ b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
@@ -53,6 +53,22 @@
     'server actions' => ['views/livewire/server/navbar.blade.php', 'manageProxy', 'server', 'server'],
 ]);
 
+it('declares deploy authorization on the application stop confirmation', function () {
+    $source = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
+
+    expect($source)->toMatch(
+        '/<x-modal-confirmation\s+canGate="deploy" :canResource="\$application"/'
+    );
+});
+
+it('declares deploy authorization on the service container removal confirmation', function () {
+    $source = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
+
+    expect($source)->toMatch(
+        '/<x-modal-confirmation(?=[^>]*title="Confirm Container Removal\?")(?=[^>]*canGate="deploy")(?=[^>]*:canResource="\$service")[^>]*>/'
+    );
+});
+
 it('keeps mutable Livewire components behind authorization checks', function (string $path, array $requiredNeedles) {
     $source = file_get_contents(base_path($path));
 
diff --git a/tests/Feature/NotificationRestartLimitSettingTest.php b/tests/Feature/NotificationRestartLimitSettingTest.php
new file mode 100644
index 000000000..e068ea594
--- /dev/null
+++ b/tests/Feature/NotificationRestartLimitSettingTest.php
@@ -0,0 +1,48 @@
+<?php
+
+it('uses a dedicated notification event for restart limits', function () {
+    $notification = file_get_contents(app_path('Notifications/Application/RestartLimitReached.php'));
+    $telegramChannel = file_get_contents(app_path('Notifications/Channels/TelegramChannel.php'));
+    $eventGrid = file_get_contents(resource_path('views/components/notification/event-grid.blade.php'));
+
+    expect($notification)->toContain("getEnabledChannels('restart_limit_reached')")
+        ->and($eventGrid)
+        ->toContain("'Resources' => [")
+        ->toContain("'key' => 'statusChange'")
+        ->toContain("'helper' => 'Notify when a resource stops or Coolify automatically restarts it.'")
+        ->toContain("'key' => 'restartLimitReached'")
+        ->toContain("'label' => 'Restart limit reached'")
+        ->and($telegramChannel)
+        ->toContain('RestartLimitReached::class => $settings->telegram_notifications_restart_limit_reached_thread_id');
+});
+
+it('persists a restart limit notification preference for every channel', function (string $channel) {
+    $studly = Str::studly($channel);
+    $component = file_get_contents(app_path("Livewire/Notifications/{$studly}.php"));
+    $model = file_get_contents(app_path('Models/'.$studly.'NotificationSettings.php'));
+    $column = "restart_limit_reached_{$channel}_notifications";
+    $property = "restartLimitReached{$studly}Notifications";
+
+    expect($component)
+        ->toContain("public bool \${$property} = true;")
+        ->toContain("\$this->settings->{$column} = \$this->{$property};")
+        ->toContain("\$this->{$property} = \$this->settings->{$column};")
+        ->and($model)
+        ->toContain("'{$column}'");
+})->with(['email', 'discord', 'telegram', 'slack', 'pushover', 'webhook']);
+
+it('enables restart limit notifications by default in every channel migration', function () {
+    $migrations = collect(glob(database_path('migrations/*_add_restart_limit_reached_notifications_to_*')));
+
+    expect($migrations)->toHaveCount(6);
+    $migrations->each(fn (string $migration) => expect(file_get_contents($migration))->toContain('->default(true)'));
+});
+
+it('uses the inline validator facade for notification API updates', function () {
+    $controller = file_get_contents(app_path('Http/Controllers/Api/NotificationsController.php'));
+
+    expect($controller)
+        ->toContain('use Illuminate\\Support\\Facades\\Validator;')
+        ->toContain("Validator::make(\$body, \$config['rules'])")
+        ->not->toContain("customApiValidator(\$body, \$config['rules'])");
+});
diff --git a/tests/Feature/PreviewStatusSummaryTest.php b/tests/Feature/PreviewStatusSummaryTest.php
index dbc2b3a29..a31fd836d 100644
--- a/tests/Feature/PreviewStatusSummaryTest.php
+++ b/tests/Feature/PreviewStatusSummaryTest.php
@@ -19,6 +19,16 @@
         ->toContain('w-[min(16rem,calc(100vw-1.5rem))]!');
 });
 
+it('shows degraded aggregate service status as a warning', function () {
+    $html = Blade::render('<x-status-summary status="degraded:unhealthy" title="Service status" container-name="Containers" />');
+    $summaryButton = str($html)->between('<button', '</button>')->toString();
+
+    expect($summaryButton)
+        ->toContain('Degraded')
+        ->toContain('bg-warning')
+        ->not->toContain('bg-error');
+});
+
 it('uses the aggregated preview status in the previews list', function () {
     $view = file_get_contents(resource_path('views/livewire/project/application/previews.blade.php'));
 
@@ -42,7 +52,7 @@
     expect($databaseStatus)
         ->toContain('<x-status-summary :status="$database->status" title="Database status" />')
         ->and($serviceStatus)
-        ->toContain('<x-status-summary :status="$service->status" title="Service status" container-name="Containers" />');
+        ->toContain('<x-status-summary :status="$displayStatus" :title="$selectedResource ? \'Resource status\' : \'Service status\'"');
 });
 
 it('groups preview deployment actions in a dropdown', function () {
diff --git a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
index bb9e88898..330afa7ed 100644
--- a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
+++ b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
@@ -255,6 +255,25 @@
         ->not->toContain('Force deploy without cache');
 });
 
+it('shows stop in application action menus when the application is exited', function () {
+    $heading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
+    $desktopExitedActions = str($heading)
+        ->after("@if (str(\$application->status)->startsWith('exited'))")
+        ->before('@else')
+        ->toString();
+
+    $mobileActions = str($heading)
+        ->after('id="application-mobile-actions"')
+        ->before('<div class="hidden" aria-hidden="true">')
+        ->toString();
+
+    expect($mobileActions)->toContain('application-mobile-stop-trigger')
+        ->and($desktopExitedActions)->toContain('application-mobile-stop-trigger')
+        ->and($mobileActions)->toContain('Deploy (without cache)')
+        ->and(strrpos($mobileActions, 'Deploy (without cache)'))
+        ->toBeLessThan(strrpos($mobileActions, 'application-mobile-stop-trigger'));
+});
+
 it('places the state-aware no-cache action immediately after deploy or redeploy', function () {
     $heading = file_get_contents(resource_path('views/livewire/project/application/heading.blade.php'));
     $actions = str($heading)->after('id="application-desktop-actions"')->before('@endteleport')->toString();
diff --git a/tests/Feature/SentinelPushDeduplicationTest.php b/tests/Feature/SentinelPushDeduplicationTest.php
index aef1b7484..bc6f2d260 100644
--- a/tests/Feature/SentinelPushDeduplicationTest.php
+++ b/tests/Feature/SentinelPushDeduplicationTest.php
@@ -147,6 +147,16 @@ function sentinelPayload(array $containers, ?float $diskPercentage = 42.0): arra
     Queue::assertPushed(PushServerUpdateJob::class, 2);
 });
 
+it('dispatches the job when only the container restart count changes', function () {
+    $beforeRestart = [['name' => 'app-1', 'state' => 'running', 'restart_count' => 0]];
+    $afterRestart = [['name' => 'app-1', 'state' => 'running', 'restart_count' => 1]];
+
+    pushSentinel($this->token, sentinelPayload($beforeRestart))->assertOk();
+    pushSentinel($this->token, sentinelPayload($afterRestart))->assertOk();
+
+    Queue::assertPushed(PushServerUpdateJob::class, 2);
+});
+
 it('ignores health status changes while container lifecycle state is unchanged', function () {
     $healthy = [['name' => 'app-1', 'state' => 'running', 'health_status' => 'healthy']];
     $unhealthy = [['name' => 'app-1', 'state' => 'running', 'health_status' => 'unhealthy']];
diff --git a/tests/Unit/ContainerStatusAggregatorTest.php b/tests/Unit/ContainerStatusAggregatorTest.php
index 71425a21c..0a40206ac 100644
--- a/tests/Unit/ContainerStatusAggregatorTest.php
+++ b/tests/Unit/ContainerStatusAggregatorTest.php
@@ -70,12 +70,12 @@
         expect($result)->toBe('running:unknown');
     });
 
-    test('returns degraded:unhealthy for crash loop (exited with restart count)', function () {
+    test('returns exited for an exited container with a restart count', function () {
         $statuses = collect(['exited']);
 
         $result = $this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 5);
 
-        expect($result)->toBe('degraded:unhealthy');
+        expect($result)->toBe('exited');
     });
 
     test('returns exited for exited containers without restart count', function () {
@@ -214,12 +214,12 @@
         expect($result)->toBe('degraded:unhealthy');
     });
 
-    test('prioritizes crash loop over running containers', function () {
+    test('returns exited when all containers are exited with restart counts', function () {
         $statuses = collect(['exited', 'exited']);
 
         $result = $this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 3);
 
-        expect($result)->toBe('degraded:unhealthy');
+        expect($result)->toBe('exited');
     });
 
     test('prioritizes mixed state over healthy running', function () {
@@ -238,12 +238,12 @@
         expect($result)->toBe('starting:unknown');
     });
 
-    test('prioritizes running over paused/exited when no starting', function () {
+    test('returns degraded for mixed running and exited containers', function () {
         $statuses = collect(['running:healthy', 'paused', 'exited']);
 
         $result = $this->aggregator->aggregateFromStrings($statuses);
 
-        expect($result)->toBe('running:healthy');
+        expect($result)->toBe('degraded:unhealthy');
     });
 
     test('prioritizes dead over paused/starting/exited', function () {
@@ -357,7 +357,7 @@
         expect($result)->toBe('degraded:unhealthy');
     });
 
-    test('returns degraded:unhealthy for crash loop (exited with restart count)', function () {
+    test('returns exited for an exited container object with a restart count', function () {
         $containers = collect([
             (object) [
                 'State' => (object) [
@@ -368,7 +368,7 @@
 
         $result = $this->aggregator->aggregateFromContainers($containers, maxRestartCount: 5);
 
-        expect($result)->toBe('degraded:unhealthy');
+        expect($result)->toBe('exited');
     });
 
     test('returns exited for exited containers without restart count', function () {
@@ -501,7 +501,7 @@
         expect($result)->toBe('degraded:unhealthy');
     });
 
-    test('crash loop has third highest priority', function () {
+    test('mixed running and exited containers are degraded before paused or starting states', function () {
         $statuses = collect([
             'exited',
             'running:healthy',
@@ -602,31 +602,29 @@
 
         $result = $this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 0);
 
-        // Zero is valid default - no crash loop detection
         expect($result)->toBe('exited');
     });
 
-    test('positive maxRestartCount works correctly', function () {
+    test('positive maxRestartCount does not override an exited state', function () {
         $statuses = collect(['exited']);
 
         $result = $this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 5);
 
-        // Positive value enables crash loop detection
-        expect($result)->toBe('degraded:unhealthy');
+        expect($result)->toBe('exited');
     });
 
-    test('crash loop detection still functions after validation', function () {
+    test('exited state is preserved for any positive restart count', function () {
         $statuses = collect(['exited']);
 
         // Test with various positive restart counts
         expect($this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 1))
-            ->toBe('degraded:unhealthy');
+            ->toBe('exited');
 
         expect($this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 100))
-            ->toBe('degraded:unhealthy');
+            ->toBe('exited');
 
         expect($this->aggregator->aggregateFromStrings($statuses, maxRestartCount: 999))
-            ->toBe('degraded:unhealthy');
+            ->toBe('exited');
     });
 
     test('default maxRestartCount parameter works', function () {
diff --git a/tests/Unit/PushServerUpdateJobReturnTypesTest.php b/tests/Unit/PushServerUpdateJobReturnTypesTest.php
new file mode 100644
index 000000000..763d456b9
--- /dev/null
+++ b/tests/Unit/PushServerUpdateJobReturnTypesTest.php
@@ -0,0 +1,9 @@
+<?php
+
+use App\Jobs\PushServerUpdateJob;
+
+test('database status update declares a void return type', function () {
+    $method = new ReflectionMethod(PushServerUpdateJob::class, 'updateDatabaseStatus');
+
+    expect($method->getReturnType()?->getName())->toBe('void');
+});
diff --git a/tests/Unit/RemovedContainerStoppedNotificationTest.php b/tests/Unit/RemovedContainerStoppedNotificationTest.php
new file mode 100644
index 000000000..016801c69
--- /dev/null
+++ b/tests/Unit/RemovedContainerStoppedNotificationTest.php
@@ -0,0 +1,11 @@
+<?php
+
+it('does not keep the unreliable generic stopped container notification path', function () {
+    $statusAction = file_get_contents(__DIR__.'/../../app/Actions/Docker/GetContainersStatus.php');
+    $telegramChannel = file_get_contents(__DIR__.'/../../app/Notifications/Channels/TelegramChannel.php');
+
+    expect($statusAction)->not->toContain('ContainerStopped')
+        ->and($telegramChannel)->not->toContain('ContainerStopped')
+        ->and(file_exists(__DIR__.'/../../app/Notifications/Container/ContainerStopped.php'))->toBeFalse()
+        ->and(file_exists(__DIR__.'/../../resources/views/emails/container-stopped.blade.php'))->toBeFalse();
+});
diff --git a/tests/Unit/RestartCountTrackerTest.php b/tests/Unit/RestartCountTrackerTest.php
new file mode 100644
index 000000000..3004ffa16
--- /dev/null
+++ b/tests/Unit/RestartCountTrackerTest.php
@@ -0,0 +1,95 @@
+<?php
+
+use App\Services\RestartCountTracker;
+
+it('starts a new generation when an active container restart count drops', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 11,
+        observedRestartCount: 0,
+        maxRestartCount: 2,
+        newGenerationConfirmed: true,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 0,
+        'restart_count_changed' => true,
+        'restart_limit_reached' => false,
+        'new_generation' => true,
+    ]);
+});
+
+it('evaluates the restart limit immediately in a new generation', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 11,
+        observedRestartCount: 3,
+        maxRestartCount: 2,
+        newGenerationConfirmed: true,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 3,
+        'restart_count_changed' => true,
+        'restart_limit_reached' => true,
+        'new_generation' => true,
+    ]);
+});
+
+it('does not reset the generation without explicit confirmation', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 11,
+        observedRestartCount: 0,
+        maxRestartCount: 2,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 11,
+        'restart_count_changed' => false,
+        'restart_limit_reached' => false,
+        'new_generation' => false,
+    ]);
+});
+
+it('preserves the previous count when an active payload omits the container with the previous maximum', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 11,
+        observedRestartCount: 3,
+        maxRestartCount: 20,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 11,
+        'restart_count_changed' => false,
+        'restart_limit_reached' => false,
+        'new_generation' => false,
+    ]);
+});
+
+it('detects a normal threshold crossing', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 1,
+        observedRestartCount: 2,
+        maxRestartCount: 2,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 2,
+        'restart_count_changed' => true,
+        'restart_limit_reached' => true,
+        'new_generation' => false,
+    ]);
+});
+
+it('detects a limit that is enabled below the current observed restart count', function () {
+    $result = (new RestartCountTracker)->evaluate(
+        previousRestartCount: 17,
+        observedRestartCount: 17,
+        maxRestartCount: 10,
+    );
+
+    expect($result)->toMatchArray([
+        'restart_count' => 17,
+        'restart_count_changed' => false,
+        'restart_limit_reached' => true,
+        'new_generation' => false,
+    ]);
+});
diff --git a/tests/Unit/StopActionsPersistStatusTest.php b/tests/Unit/StopActionsPersistStatusTest.php
index a924381bb..35b6052dd 100644
--- a/tests/Unit/StopActionsPersistStatusTest.php
+++ b/tests/Unit/StopActionsPersistStatusTest.php
@@ -10,8 +10,7 @@
     $action = file_get_contents(__DIR__.'/../../app/Actions/Application/StopApplication.php');
 
     expect($action)
-        ->toContain("\$status = ['status' => 'exited'];")
-        ->toContain('$application->update($status);')
+        ->toMatch('/\$status\s*=\s*\[\s*\'status\'\s*=>\s*\'exited\',.*?\];.*?\$application->update\(\$status\);/s')
         ->not->toMatch('/docker stack rm .*?return;/s');
 });
 
@@ -19,8 +18,10 @@
     $action = file_get_contents(__DIR__.'/../../app/Actions/Service/StopService.php');
 
     expect($action)
-        ->toContain("\$applications->each->update(['status' => 'exited']);")
-        ->toContain("\$dbs->each->update(['status' => 'exited']);");
+        ->toContain("\$application->update(['status' => 'exited']);")
+        ->toContain('$application->resetRestartLimit();')
+        ->toContain("\$database->update(['status' => 'exited']);")
+        ->toContain('$database->resetRestartLimit();');
 });
 
 it('persists exited status when stopping an individual service resource', function () {
@@ -28,6 +29,8 @@
 
     expect($action)
         ->toContain("\$serviceApplication->update(['status' => 'exited']);")
+        ->toContain('$commands = ["docker rm -f {$containerName}"];')
+        ->toContain('throwError: ! $removeContainer')
         ->toContain('ServiceStatusChanged::dispatch($service->environment->project->team->id);');
 });
 
diff --git a/tests/Unit/StopDatabaseTypesTest.php b/tests/Unit/StopDatabaseTypesTest.php
new file mode 100644
index 000000000..0295b0c95
--- /dev/null
+++ b/tests/Unit/StopDatabaseTypesTest.php
@@ -0,0 +1,12 @@
+<?php
+
+use App\Actions\Database\StopDatabase;
+use App\Models\BaseModel;
+
+it('declares strict method types', function () {
+    $handle = new ReflectionMethod(StopDatabase::class, 'handle');
+    $stopContainer = new ReflectionMethod(StopDatabase::class, 'stopContainer');
+
+    expect($handle->getReturnType()?->getName())->toBe('string')
+        ->and($stopContainer->getParameters()[0]->getType()?->getName())->toBe(BaseModel::class);
+});

From 44bb1328332d0ec0462a23c3ef177d7754437d7e Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 31 Aug 2026 13:16:35 +0200
Subject: [PATCH 18/55] feat(settings): add development sponsorship reminder
 preview

---
 .../views/livewire/layout-popups.blade.php     |  7 ++++---
 .../views/livewire/settings/advanced.blade.php | 17 ++++++++++++-----
 tests/Feature/LayoutPopupsUiTest.php           | 18 ++++++++++++++++++
 3 files changed, 34 insertions(+), 8 deletions(-)

diff --git a/resources/views/livewire/layout-popups.blade.php b/resources/views/livewire/layout-popups.blade.php
index 2e5f6a02d..199774c3c 100644
--- a/resources/views/livewire/layout-popups.blade.php
+++ b/resources/views/livewire/layout-popups.blade.php
@@ -11,7 +11,7 @@
     reminderCollapseAfter: 10000,
     isDevelopment: {{ isDev() ? 'true' : 'false' }},
     init() {
-        this.popups.sponsorship = this.shouldShowMonthlyPopup('popupSponsorship');
+        this.popups.sponsorship = !this.isDevelopment && this.shouldShowMonthlyPopup('popupSponsorship');
         this.popups.notification = this.shouldShowMonthlyPopup('popupNotification');
         this.popups.realtime = localStorage.getItem('popupRealtime');
 
@@ -86,7 +86,7 @@
         return isDifferentMonth;
         {{-- } --}}
     }
-}">
+}" @show-sponsorship-reminder.window="popups.sponsorship = true; reminders.sponsorship.compact = false">
     @auth
         <span x-show="popups.realtime === true">
             @if (!isCloud())
@@ -140,11 +140,12 @@ class="button h-9 justify-center bg-red-600! text-white! ring-1 ring-red-600/25
             @endif
         </span>
     @endauth
-    @if (instanceSettings()->is_sponsorship_popup_enabled && !isCloud())
+    @if ((isDev() || instanceSettings()->is_sponsorship_popup_enabled) && ! isCloud())
         <span x-show="popups.sponsorship">
             <x-popup>
                 <x-slot:customActions>
                     <div class="relative mx-auto flex w-full flex-col overflow-hidden rounded-2xl border border-neutral-200 bg-white shadow-modal transition-all duration-300 dark:border-white/[0.1] dark:bg-surface"
+                        @show-sponsorship-reminder.window="bannerVisible = true"
                         :class="reminders.sponsorship.compact ? 'max-w-sm gap-3 p-4' : 'max-w-2xl gap-5 p-5 sm:p-6'">
                         <button type="button" aria-label="Dismiss sponsorship reminder"
                             class="absolute top-3 right-3 flex size-7 items-center justify-center rounded-full text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.07] dark:hover:text-fg"
diff --git a/resources/views/livewire/settings/advanced.blade.php b/resources/views/livewire/settings/advanced.blade.php
index d15a1b87a..94927ba25 100644
--- a/resources/views/livewire/settings/advanced.blade.php
+++ b/resources/views/livewire/settings/advanced.blade.php
@@ -127,11 +127,18 @@
                             ['value' => false, 'label' => 'Enabled'],
                             ['value' => true, 'label' => 'Disabled'],
                         ]" />
-                    <x-forms.listbox id="is_sponsorship_popup_enabled" label="Sponsorship reminders"
-                        helper="Show the monthly project sponsorship reminder." onChange="instantSave" :options="[
-                            ['value' => true, 'label' => 'Enabled'],
-                            ['value' => false, 'label' => 'Disabled'],
-                        ]" />
+                    <div class="flex flex-col gap-2">
+                        <x-forms.listbox id="is_sponsorship_popup_enabled" label="Sponsorship reminders"
+                            helper="Show the monthly project sponsorship reminder." onChange="instantSave" :options="[
+                                ['value' => true, 'label' => 'Enabled'],
+                                ['value' => false, 'label' => 'Disabled'],
+                            ]" />
+                        @if (isDev())
+                            <x-forms.button type="button" @click="$dispatch('show-sponsorship-reminder')">
+                                Show sponsorship reminder
+                            </x-forms.button>
+                        @endif
+                    </div>
                 </div>
             </x-application.settings-section>
 
diff --git a/tests/Feature/LayoutPopupsUiTest.php b/tests/Feature/LayoutPopupsUiTest.php
index 167a23a04..374473281 100644
--- a/tests/Feature/LayoutPopupsUiTest.php
+++ b/tests/Feature/LayoutPopupsUiTest.php
@@ -36,3 +36,21 @@
         ->toContain('reminders.sponsorship.compact = true')
         ->toContain('reminders.notification.compact = true');
 });
+
+test('sponsorship reminder is disabled in development', function () {
+    $view = file_get_contents(resource_path('views/livewire/layout-popups.blade.php'));
+
+    expect($view)
+        ->toContain('this.popups.sponsorship = !this.isDevelopment && this.shouldShowMonthlyPopup')
+        ->toContain('@show-sponsorship-reminder.window="popups.sponsorship = true')
+        ->toContain('@show-sponsorship-reminder.window="bannerVisible = true"');
+});
+
+test('advanced settings provides a development-only sponsorship reminder preview', function () {
+    $view = file_get_contents(resource_path('views/livewire/settings/advanced.blade.php'));
+
+    expect($view)
+        ->toContain('@if (isDev())')
+        ->toContain("@click=\"\$dispatch('show-sponsorship-reminder')\"")
+        ->toContain('Show sponsorship reminder');
+});

From d67d42039a824c3fc6ba9c14ba586cfbe3e933a8 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 31 Aug 2026 16:52:53 +0200
Subject: [PATCH 19/55] fix(ui): keep sponsorship reminder listeners functional

---
 resources/views/livewire/layout-popups.blade.php |  4 ++--
 tests/Feature/LayoutPopupsUiTest.php             | 13 +++++++++++--
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/resources/views/livewire/layout-popups.blade.php b/resources/views/livewire/layout-popups.blade.php
index 199774c3c..693c332d9 100644
--- a/resources/views/livewire/layout-popups.blade.php
+++ b/resources/views/livewire/layout-popups.blade.php
@@ -86,7 +86,7 @@
         return isDifferentMonth;
         {{-- } --}}
     }
-}" @show-sponsorship-reminder.window="popups.sponsorship = true; reminders.sponsorship.compact = false">
+}" x-on:show-sponsorship-reminder.window="popups.sponsorship = true; reminders.sponsorship.compact = false">
     @auth
         <span x-show="popups.realtime === true">
             @if (!isCloud())
@@ -145,7 +145,7 @@ class="button h-9 justify-center bg-red-600! text-white! ring-1 ring-red-600/25
             <x-popup>
                 <x-slot:customActions>
                     <div class="relative mx-auto flex w-full flex-col overflow-hidden rounded-2xl border border-neutral-200 bg-white shadow-modal transition-all duration-300 dark:border-white/[0.1] dark:bg-surface"
-                        @show-sponsorship-reminder.window="bannerVisible = true"
+                        x-on:show-sponsorship-reminder.window="bannerVisible = true"
                         :class="reminders.sponsorship.compact ? 'max-w-sm gap-3 p-4' : 'max-w-2xl gap-5 p-5 sm:p-6'">
                         <button type="button" aria-label="Dismiss sponsorship reminder"
                             class="absolute top-3 right-3 flex size-7 items-center justify-center rounded-full text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.07] dark:hover:text-fg"
diff --git a/tests/Feature/LayoutPopupsUiTest.php b/tests/Feature/LayoutPopupsUiTest.php
index 374473281..d405268d0 100644
--- a/tests/Feature/LayoutPopupsUiTest.php
+++ b/tests/Feature/LayoutPopupsUiTest.php
@@ -42,8 +42,17 @@
 
     expect($view)
         ->toContain('this.popups.sponsorship = !this.isDevelopment && this.shouldShowMonthlyPopup')
-        ->toContain('@show-sponsorship-reminder.window="popups.sponsorship = true')
-        ->toContain('@show-sponsorship-reminder.window="bannerVisible = true"');
+        ->toContain('x-on:show-sponsorship-reminder.window="popups.sponsorship = true')
+        ->toContain('x-on:show-sponsorship-reminder.window="bannerVisible = true"');
+});
+
+test('sponsorship reminder listener is not parsed as a blade directive', function () {
+    $view = file_get_contents(resource_path('views/livewire/layout-popups.blade.php'));
+    $compiledView = Blade::compileString($view);
+
+    expect($compiledView)
+        ->toContain('x-on:show-sponsorship-reminder.window=')
+        ->not->toContain('$__env->yieldSection()');
 });
 
 test('advanced settings provides a development-only sponsorship reminder preview', function () {

From 2bce16e4d4fa4f73a27e2f5117381606e719b14c Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 31 Aug 2026 17:37:10 +0200
Subject: [PATCH 20/55] fix(resources): remove empty-domain placeholder from
 grid

---
 .../views/livewire/project/resource/index.blade.php      | 2 --
 tests/Feature/ResourceIndexDescriptionSubtitleTest.php   | 9 +++++++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/resources/views/livewire/project/resource/index.blade.php b/resources/views/livewire/project/resource/index.blade.php
index 772a01fdc..09be82799 100644
--- a/resources/views/livewire/project/resource/index.blade.php
+++ b/resources/views/livewire/project/resource/index.blade.php
@@ -314,8 +314,6 @@ class="truncate text-[13px]! leading-4! font-semibold! text-black dark:text-fg"
                                         class="relative z-10 max-w-full self-start truncate text-[11px] text-neutral-500 hover:underline dark:text-fg-dim"
                                         :title="displayDomain(item.fqdn)" x-text="displayDomain(item.fqdn)"></a>
                                 </template>
-                                <span x-show="!item.fqdn"
-                                    class="text-[11px] text-neutral-400 dark:text-fg-faint">-</span>
                             </div>
                         </article>
                     </template>
diff --git a/tests/Feature/ResourceIndexDescriptionSubtitleTest.php b/tests/Feature/ResourceIndexDescriptionSubtitleTest.php
index ab570b7f3..eec80be0a 100644
--- a/tests/Feature/ResourceIndexDescriptionSubtitleTest.php
+++ b/tests/Feature/ResourceIndexDescriptionSubtitleTest.php
@@ -9,3 +9,12 @@
         ->not->toContain('item.description || item.fqdn || item.uuid')
         ->not->toContain('item.fqdn || item.uuid');
 });
+
+test('resource grid does not show a placeholder when a domain is missing', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/resource/index.blade.php'));
+    $gridView = explode('x-show="viewMode === \'grid\'"', $view, 2)[1];
+
+    expect($gridView)
+        ->not->toContain('x-show="!item.fqdn"')
+        ->not->toContain('>-</span>');
+});

From c97649bda2d52e4079ae13a9d03229c700448777 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 31 Aug 2026 17:57:29 +0200
Subject: [PATCH 21/55] docs(security): require scoped authorization checks and
 regression tests

---
 AGENTS.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/AGENTS.md b/AGENTS.md
index 34b43e087..f9f8ca563 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -148,6 +148,11 @@ ### Authorization
 - Custom gates: `createAnyResource`, `canAccessTerminal`
 - Role hierarchy: `Role::MEMBER` (1) < `Role::ADMIN` (2) < `Role::OWNER` (3) with `lt()`/`gt()` comparison methods
 - Multi-tenancy via Teams — team auto-initializes notification settings on creation
+- Authorize every server-side read and mutation where access can vary by user, role, team, or resource. Use policies, gates, or `$this->authorize(...)`; never rely on hidden Blade/Livewire controls such as `@can` for security.
+- Scope queries to the current team before returning records. Treat route and model identifiers as untrusted, and prevent users from reading or changing resources owned by another team.
+- Apply authorization consistently across Livewire actions, API and web controllers, actions, downloads, exports, search, event listeners, and any other path that exposes or changes protected data.
+- Default to denying access when a policy or ownership relationship is missing or ambiguous. Members must not gain access to administrative, credential, security, billing, or instance-wide data merely because they belong to the team.
+- Add authorization regression tests for protected changes. Cover permitted access, member restrictions where applicable, and cross-team access; verify unauthorized reads and writes return `403` or otherwise reveal no protected data.
 
 ### Event Broadcasting
 - Soketi WebSocket server for real-time updates (ports 6001-6002 in dev)

From ff8b019296025bdf0e8a08c1989b270193edddc4 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 31 Aug 2026 21:12:28 +0200
Subject: [PATCH 22/55] fix(application): defer Docker Compose loading and
 preserve domains

Load the compose file only after the user confirms its location, initialize the default compose path when switching build packs, and retain existing application domains.
---
 app/Livewire/Project/Application/General.php  | 22 ++----------
 .../project/application/general.blade.php     |  3 +-
 ...pplicationGeneralBuildpackSelectorTest.php | 35 +++++++++++++++++++
 .../Feature/ApplicationGeneralLayoutTest.php  |  8 +++++
 4 files changed, 47 insertions(+), 21 deletions(-)

diff --git a/app/Livewire/Project/Application/General.php b/app/Livewire/Project/Application/General.php
index c5015dccc..0c424631f 100644
--- a/app/Livewire/Project/Application/General.php
+++ b/app/Livewire/Project/Application/General.php
@@ -321,17 +321,6 @@ public function mount()
             }
         }
         $this->initialDockerComposeLocation = $this->application->docker_compose_location;
-        if ($this->application->build_pack === 'dockercompose' && ! $this->application->docker_compose_raw) {
-            // Only load compose file if user has update permission
-            try {
-                $this->authorize('update', $this->application);
-                $this->initLoadingCompose = true;
-                $this->dispatch('info', 'Loading docker compose file.');
-            } catch (AuthorizationException $e) {
-                // User doesn't have update permission, skip loading compose file
-            }
-        }
-
         if (str($this->application->status)->startsWith('running') && is_null($this->application->config_hash)) {
             $this->dispatch('configurationChanged');
         }
@@ -608,14 +597,9 @@ public function updatedBuildPack()
             $this->resetDefaultLabels(false);
         }
         if ($this->buildPack === 'dockercompose') {
-            // Only update if user has permission
-            try {
-                $this->authorize('update', $this->application);
-                $this->fqdn = null;
-                $this->application->fqdn = null;
-                $this->application->settings->save();
-            } catch (AuthorizationException $e) {
-                // User doesn't have update permission, just continue without saving
+            if (blank($this->dockerComposeLocation)) {
+                $this->dockerComposeLocation = '/docker-compose.yaml';
+                $this->application->docker_compose_location = $this->dockerComposeLocation;
             }
         }
         if ($this->buildPack === 'static') {
diff --git a/resources/views/livewire/project/application/general.blade.php b/resources/views/livewire/project/application/general.blade.php
index 7384067f9..d301b55b5 100644
--- a/resources/views/livewire/project/application/general.blade.php
+++ b/resources/views/livewire/project/application/general.blade.php
@@ -119,8 +119,7 @@
                 @else
                     <div class="flex flex-col gap-5">
                         @if ($buildPack === 'dockercompose')
-                            <div class="flex flex-col gap-2"
-                                @can('update', $application) x-init="$wire.dispatch('loadCompose', true)" @endcan>
+                            <div class="flex flex-col gap-2">
                                 <div x-data="{
                                     baseDir: @entangle('baseDirectory'),
                                     composeLocation: @entangle('dockerComposeLocation'),
diff --git a/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php b/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php
index 08f769eb6..1e341933e 100644
--- a/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php
+++ b/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php
@@ -15,6 +15,19 @@
 
 uses(RefreshDatabase::class);
 
+class GeneralWithoutBuildpackSubmitSideEffects extends General
+{
+    public function render(): mixed
+    {
+        return view('livewire.project.application.general');
+    }
+
+    public function submit($showToaster = true): void
+    {
+        $this->application->save();
+    }
+}
+
 beforeEach(function () {
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
@@ -85,3 +98,25 @@
         ->assertDontSee('Railpack (Beta)')
         ->assertDontSee('Railpack (beta)');
 });
+
+test('switching from railpack to compose preserves the existing application domains', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'railpack',
+        'static_image' => 'nginx:alpine',
+        'base_directory' => '/',
+        'fqdn' => 'https://example.com,https://www.example.com',
+        'is_http_basic_auth_enabled' => false,
+        'redirect' => 'no',
+    ]);
+
+    Livewire::test(GeneralWithoutBuildpackSubmitSideEffects::class, ['application' => $application])
+        ->assertSuccessful()
+        ->set('buildPack', 'dockercompose')
+        ->assertSet('dockerComposeLocation', '/docker-compose.yaml');
+
+    expect($application->refresh()->fqdn)
+        ->toBe('https://example.com,https://www.example.com');
+});
diff --git a/tests/Feature/ApplicationGeneralLayoutTest.php b/tests/Feature/ApplicationGeneralLayoutTest.php
index f2daac9a9..41f62022a 100644
--- a/tests/Feature/ApplicationGeneralLayoutTest.php
+++ b/tests/Feature/ApplicationGeneralLayoutTest.php
@@ -13,6 +13,14 @@
         ->toContain('Reload compose');
 });
 
+test('compose file loading waits for the user to confirm the file location', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/application/general.blade.php'));
+
+    expect($view)
+        ->toContain('x-on:click="$wire.dispatch(\'loadCompose\', false)"')
+        ->not->toContain('x-init="$wire.dispatch(\'loadCompose\', true)"');
+});
+
 test('docker compose heading separates its title and action', function () {
     $view = file_get_contents(resource_path('views/livewire/project/application/general.blade.php'));
 

From e4146a631409c18083718a13022ca093751dc0ee Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 31 Aug 2026 22:51:30 +0200
Subject: [PATCH 23/55] feat(backups): unify service backup management (#11574)

---
 app/Jobs/DatabaseBackupJob.php                |  11 +-
 .../Project/Database/BackupExecutions.php     |   7 +-
 .../Project/Service/BackupExecutions.php      | 124 +++++++
 .../Project/Service/DatabaseBackups.php       |  23 +-
 app/Livewire/Project/Service/ImportBackup.php |  80 +++++
 app/Livewire/Project/Service/Index.php        |   6 -
 .../Project/Service/VolumeBackup/Index.php    |  85 ++++-
 .../Project/Service/VolumeBackup/Show.php     |   6 +-
 resources/css/app.css                         |  21 +-
 .../views/components/backup-sidebar.blade.php |  10 +-
 .../views/components/backup-tabs.blade.php    |  62 ++++
 .../service-database/sidebar.blade.php        |  18 -
 .../service/configuration-sidebar.blade.php   |   7 +-
 .../service/backup-executions.blade.php       |  64 ++++
 .../project/service/configuration.blade.php   |   3 +-
 .../service/database-backups.blade.php        |  47 ++-
 .../project/service/import-backup.blade.php   |  39 +++
 .../livewire/project/service/index.blade.php  |   2 +-
 .../service/volume-backup/index.blade.php     |  81 ++++-
 .../service/volume-backup/show.blade.php      |  24 +-
 routes/web.php                                |   5 +-
 tests/Feature/ImportBackupUploadIconTest.php  |   6 +-
 ...bleLivewireComponentsAuthorizationTest.php |  14 +
 .../ServiceDatabaseVerticalNavigationTest.php | 144 +++++++-
 tests/Feature/ServiceResourceRoutingTest.php  | 307 +++++++++++++++---
 tests/Feature/VolumeBackupTest.php            |  10 +
 26 files changed, 1066 insertions(+), 140 deletions(-)
 create mode 100644 app/Livewire/Project/Service/BackupExecutions.php
 create mode 100644 app/Livewire/Project/Service/ImportBackup.php
 create mode 100644 resources/views/components/backup-tabs.blade.php
 create mode 100644 resources/views/livewire/project/service/backup-executions.blade.php
 create mode 100644 resources/views/livewire/project/service/import-backup.blade.php

diff --git a/app/Jobs/DatabaseBackupJob.php b/app/Jobs/DatabaseBackupJob.php
index 0b73ed0cf..b1f2c38b9 100644
--- a/app/Jobs/DatabaseBackupJob.php
+++ b/app/Jobs/DatabaseBackupJob.php
@@ -322,6 +322,7 @@ public function handle(): void
                             'scheduled_database_backup_id' => $this->backup->id,
                             'local_storage_deleted' => false,
                         ]);
+                        BackupCreated::dispatch($this->team->id);
                         $this->backup_standalone_postgresql($database);
                     } elseif (str($databaseType)->contains('mongo')) {
                         if ($database === '*') {
@@ -343,6 +344,7 @@ public function handle(): void
                             'scheduled_database_backup_id' => $this->backup->id,
                             'local_storage_deleted' => false,
                         ]);
+                        BackupCreated::dispatch($this->team->id);
                         $this->backup_standalone_mongodb($database);
                     } elseif (str($databaseType)->contains('mysql')) {
                         $this->backup_file = "/mysql-dump-$database-".Carbon::now()->timestamp.'.dmp';
@@ -357,6 +359,7 @@ public function handle(): void
                             'scheduled_database_backup_id' => $this->backup->id,
                             'local_storage_deleted' => false,
                         ]);
+                        BackupCreated::dispatch($this->team->id);
                         $this->backup_standalone_mysql($database);
                     } elseif (str($databaseType)->contains('mariadb')) {
                         $this->backup_file = "/mariadb-dump-$database-".Carbon::now()->timestamp.'.dmp';
@@ -371,6 +374,7 @@ public function handle(): void
                             'scheduled_database_backup_id' => $this->backup->id,
                             'local_storage_deleted' => false,
                         ]);
+                        BackupCreated::dispatch($this->team->id);
                         $this->backup_standalone_mariadb($database);
                     } elseif ($this->database instanceof StandaloneClickhouse) {
                         $this->backup_file = '/clickhouse-backup-'.Carbon::now()->timestamp."-{$this->backup_log_uuid}.zip";
@@ -382,6 +386,7 @@ public function handle(): void
                             'scheduled_database_backup_id' => $this->backup->id,
                             'local_storage_deleted' => false,
                         ]);
+                        BackupCreated::dispatch($this->team->id);
                         $this->backup_standalone_clickhouse($database);
                     } else {
                         throw new \Exception('Unsupported database type');
@@ -480,14 +485,14 @@ public function handle(): void
         } catch (Throwable $e) {
             throw $e;
         } finally {
-            if ($this->team) {
-                BackupCreated::dispatch($this->team->id);
-            }
             if ($this->backup_log) {
                 $this->backup_log->update([
                     'finished_at' => Carbon::now()->toImmutable(),
                 ]);
             }
+            if ($this->team) {
+                BackupCreated::dispatch($this->team->id);
+            }
         }
     }
 
diff --git a/app/Livewire/Project/Database/BackupExecutions.php b/app/Livewire/Project/Database/BackupExecutions.php
index 73877a945..2786a45c3 100644
--- a/app/Livewire/Project/Database/BackupExecutions.php
+++ b/app/Livewire/Project/Database/BackupExecutions.php
@@ -6,7 +6,6 @@
 use App\Models\ServiceDatabase;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
-use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
 
 class BackupExecutions extends Component
@@ -37,12 +36,12 @@ class BackupExecutions extends Component
 
     public $delete_backup_sftp = false;
 
-    public function getListeners()
+    public function getListeners(): array
     {
-        $userId = Auth::id();
+        $teamId = currentTeam()->id;
 
         return [
-            "echo-private:team.{$userId},BackupCreated" => 'refreshBackupExecutions',
+            "echo-private:team.{$teamId},BackupCreated" => 'refreshBackupExecutions',
         ];
     }
 
diff --git a/app/Livewire/Project/Service/BackupExecutions.php b/app/Livewire/Project/Service/BackupExecutions.php
new file mode 100644
index 000000000..87f24fb1d
--- /dev/null
+++ b/app/Livewire/Project/Service/BackupExecutions.php
@@ -0,0 +1,124 @@
+<?php
+
+namespace App\Livewire\Project\Service;
+
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\ScheduledVolumeBackupExecution;
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Collection;
+use Livewire\Component;
+
+class BackupExecutions extends Component
+{
+    use AuthorizesRequests;
+
+    public Service $service;
+
+    public bool $executionModalOpen = false;
+
+    public ?array $selectedExecution = null;
+
+    public function getListeners(): array
+    {
+        $teamId = currentTeam()->id;
+
+        return [
+            'modalClosed' => 'closeExecutionModal',
+            "echo-private:team.{$teamId},BackupCreated" => '$refresh',
+        ];
+    }
+
+    public function mount(Service $service): void
+    {
+        abort_unless($service->environment?->project?->team_id === currentTeam()->id, 404);
+        $this->service = $service;
+        $this->authorize('view', $this->service);
+    }
+
+    public function openExecution(string $executionUuid): void
+    {
+        $this->selectedExecution = $this->executions()->firstWhere('uuid', $executionUuid);
+        abort_unless($this->selectedExecution, 404);
+        $this->executionModalOpen = true;
+    }
+
+    public function closeExecutionModal(): void
+    {
+        $this->executionModalOpen = false;
+        $this->selectedExecution = null;
+    }
+
+    public function render(): View
+    {
+        return view('livewire.project.service.backup-executions', [
+            'executions' => $this->executions(),
+        ]);
+    }
+
+    private function executions(): Collection
+    {
+        $databaseScheduleIds = ScheduledDatabaseBackup::query()
+            ->where('database_type', (new ServiceDatabase)->getMorphClass())
+            ->whereHasMorph('database', [ServiceDatabase::class], fn ($query) => $query->where('service_id', $this->service->id))
+            ->pluck('id');
+
+        $databaseExecutions = ScheduledDatabaseBackupExecution::query()
+            ->with('scheduledDatabaseBackup.database')
+            ->whereIn('scheduled_database_backup_id', $databaseScheduleIds)
+            ->latest()
+            ->limit(100)
+            ->get()
+            ->map(fn (ScheduledDatabaseBackupExecution $execution): array => [
+                'id' => 'database:'.$execution->id,
+                'uuid' => $execution->uuid,
+                'target' => $execution->scheduledDatabaseBackup->database->human_name ?: $execution->scheduledDatabaseBackup->database->name,
+                'type' => 'Database',
+                'schedule' => $execution->scheduledDatabaseBackup->frequency,
+                'status' => $execution->status,
+                'started_at' => $execution->created_at,
+                'size' => $execution->size,
+                'message' => $execution->message,
+                'filename' => $execution->filename,
+                'download_url' => $execution->status === 'success' && ! $execution->local_storage_deleted
+                    ? route('download.backup', $execution->id)
+                    : null,
+            ]);
+
+        $volumeSchedules = ScheduledVolumeBackup::query()
+            ->with('backupable.resource')
+            ->forService($this->service)
+            ->get()
+            ->keyBy('id');
+        $volumeExecutions = ScheduledVolumeBackupExecution::query()
+            ->whereIn('scheduled_volume_backup_id', $volumeSchedules->keys())
+            ->latest()
+            ->limit(100)
+            ->get()
+            ->map(function (ScheduledVolumeBackupExecution $execution) use ($volumeSchedules): array {
+                $schedule = $volumeSchedules->get($execution->scheduled_volume_backup_id);
+
+                return [
+                    'id' => 'storage:'.$execution->id,
+                    'uuid' => $execution->uuid,
+                    'target' => $schedule->targetName(),
+                    'type' => $schedule->targetType(),
+                    'schedule' => $schedule->frequency,
+                    'status' => $execution->status,
+                    'started_at' => $execution->created_at,
+                    'size' => $execution->size,
+                    'message' => $execution->message,
+                    'filename' => $execution->filename,
+                    'download_url' => $execution->status === 'success' && ! $execution->local_storage_deleted
+                        ? route('download.volume-backup', $execution->id)
+                        : null,
+                ];
+            });
+
+        return $databaseExecutions->concat($volumeExecutions)->sortByDesc('started_at')->values();
+    }
+}
diff --git a/app/Livewire/Project/Service/DatabaseBackups.php b/app/Livewire/Project/Service/DatabaseBackups.php
index 90907abc6..8535584dd 100644
--- a/app/Livewire/Project/Service/DatabaseBackups.php
+++ b/app/Livewire/Project/Service/DatabaseBackups.php
@@ -22,8 +22,6 @@ class DatabaseBackups extends Component
 
     public array $query;
 
-    public bool $isImportSupported = false;
-
     public ?ScheduledDatabaseBackup $backup = null;
 
     public string $section = 'index';
@@ -32,7 +30,7 @@ class DatabaseBackups extends Component
 
     protected $listeners = ['refreshScheduledBackups' => '$refresh'];
 
-    public function mount()
+    public function mount(): mixed
     {
         try {
             $this->parameters = array_filter(
@@ -67,10 +65,13 @@ public function mount()
                 return redirect()->route('project.service.index', $this->parameters);
             }
 
-            // Check if import is supported for this database type
-            $dbType = $this->serviceDatabase->databaseType();
-            $supportedTypes = ['mysql', 'mariadb', 'postgres', 'mongo'];
-            $this->isImportSupported = collect($supportedTypes)->contains(fn ($type) => str_contains($dbType, $type));
+            if (! request()->route('backup_uuid')) {
+                return redirect()->route('project.service.volume-backups.index', [
+                    'project_uuid' => $this->parameters['project_uuid'],
+                    'environment_uuid' => $this->parameters['environment_uuid'],
+                    'service_uuid' => $this->parameters['service_uuid'],
+                ]);
+            }
 
             if (request()->route('backup_uuid')) {
                 $this->backup = $this->serviceDatabase->scheduledBackups()
@@ -85,6 +86,14 @@ public function mount()
                     'project.service.database.backup.danger' => 'danger',
                     default => 'general',
                 };
+
+                $routeParameters = [
+                    'project_uuid' => $this->parameters['project_uuid'],
+                    'environment_uuid' => $this->parameters['environment_uuid'],
+                    'service_uuid' => $this->parameters['service_uuid'],
+                ];
+
+                return redirect()->route('project.service.volume-backups.index', $routeParameters);
             }
         } catch (\Throwable $e) {
             return handleError($e, $this);
diff --git a/app/Livewire/Project/Service/ImportBackup.php b/app/Livewire/Project/Service/ImportBackup.php
new file mode 100644
index 000000000..29e8d9f35
--- /dev/null
+++ b/app/Livewire/Project/Service/ImportBackup.php
@@ -0,0 +1,80 @@
+<?php
+
+namespace App\Livewire\Project\Service;
+
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Collection;
+use Livewire\Component;
+
+class ImportBackup extends Component
+{
+    use AuthorizesRequests;
+
+    public Service $service;
+
+    public Collection $databases;
+
+    public ?ServiceDatabase $selectedDatabase = null;
+
+    public string $selectedDatabaseUuid = '';
+
+    public array $parameters;
+
+    public function mount(): mixed
+    {
+        $this->parameters = get_route_parameters();
+        $project = currentTeam()->projects()->whereUuid($this->parameters['project_uuid'])->firstOrFail();
+        $environment = $project->environments()->whereUuid($this->parameters['environment_uuid'])->firstOrFail();
+        $this->service = $environment->services()->whereUuid($this->parameters['service_uuid'])->firstOrFail();
+        $this->authorize('update', $this->service);
+
+        $this->databases = $this->service->databases
+            ->filter(fn (ServiceDatabase $database): bool => $this->supportsImport($database))
+            ->values();
+
+        $databaseUuid = request()->route('stack_service_uuid');
+        if ($databaseUuid) {
+            $selectedDatabase = $this->databases->firstWhere('uuid', $databaseUuid);
+            abort_unless($selectedDatabase instanceof ServiceDatabase, 404);
+            $this->authorize('update', $selectedDatabase);
+            $this->selectedDatabase = $selectedDatabase;
+            $this->selectedDatabaseUuid = $selectedDatabase->uuid;
+
+            if (request()->routeIs('project.service.database.import')) {
+                return redirect()->route('project.service.import-backup.database', $this->parameters);
+            }
+        } elseif ($this->databases->count() === 1) {
+            return redirect()->route('project.service.import-backup.database', [
+                ...$this->parameters,
+                'stack_service_uuid' => $this->databases->first()->uuid,
+            ]);
+        }
+
+        return null;
+    }
+
+    public function updatedSelectedDatabaseUuid(): mixed
+    {
+        $database = $this->databases->firstWhere('uuid', $this->selectedDatabaseUuid);
+        abort_unless($database instanceof ServiceDatabase, 404);
+        $this->authorize('update', $database);
+
+        return redirect()->route('project.service.import-backup.database', [
+            ...$this->parameters,
+            'stack_service_uuid' => $database->uuid,
+        ]);
+    }
+
+    public function render(): View
+    {
+        return view('livewire.project.service.import-backup');
+    }
+
+    private function supportsImport(ServiceDatabase $database): bool
+    {
+        return str($database->databaseType())->contains(['mysql', 'mariadb', 'postgres', 'mongo']);
+    }
+}
diff --git a/app/Livewire/Project/Service/Index.php b/app/Livewire/Project/Service/Index.php
index 6193f14b5..23ee6a096 100644
--- a/app/Livewire/Project/Service/Index.php
+++ b/app/Livewire/Project/Service/Index.php
@@ -59,8 +59,6 @@ class Index extends Component
 
     public bool $isLogDrainEnabled = false;
 
-    public bool $isImportSupported = false;
-
     // Application-specific properties
     public $docker_cleanup = true;
 
@@ -153,10 +151,6 @@ private function initializeDatabaseProperties(): void
         $this->refreshFileStorages();
         $this->syncDatabaseData(false);
 
-        // Check if import is supported for this database type
-        $dbType = $this->serviceDatabase->databaseType();
-        $supportedTypes = ['mysql', 'mariadb', 'postgres', 'mongo'];
-        $this->isImportSupported = collect($supportedTypes)->contains(fn ($type) => str_contains($dbType, $type));
     }
 
     private function syncDatabaseData(bool $toModel = false): void
diff --git a/app/Livewire/Project/Service/VolumeBackup/Index.php b/app/Livewire/Project/Service/VolumeBackup/Index.php
index 49da9e21f..e856d1373 100644
--- a/app/Livewire/Project/Service/VolumeBackup/Index.php
+++ b/app/Livewire/Project/Service/VolumeBackup/Index.php
@@ -2,11 +2,14 @@
 
 namespace App\Livewire\Project\Service\VolumeBackup;
 
+use App\Jobs\DatabaseBackupJob;
+use App\Jobs\VolumeBackupJob;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ScheduledVolumeBackup;
 use App\Models\Service;
 use App\Models\ServiceDatabase;
 use Illuminate\Contracts\View\View;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
@@ -20,14 +23,70 @@ class Index extends Component
 
     public string $search = '';
 
-    protected $listeners = ['refreshVolumeBackups' => '$refresh'];
+    public bool $scheduleModalOpen = false;
 
-    public function mount(): void
+    public ?ScheduledDatabaseBackup $selectedDatabaseBackup = null;
+
+    public ?ScheduledVolumeBackup $selectedVolumeBackup = null;
+
+    public ?Collection $s3s = null;
+
+    public function getListeners(): array
     {
-        $this->service = $this->findService();
+        $teamId = currentTeam()->id;
+
+        return [
+            'refreshVolumeBackups' => '$refresh',
+            'modalClosed' => 'closeScheduleModal',
+            "echo-private:team.{$teamId},BackupCreated" => '$refresh',
+        ];
+    }
+
+    public function mount(?Service $service = null): void
+    {
+        $this->service = $service ?? $this->findService();
         $this->authorize('view', $this->service);
         $this->parameters = get_route_parameters();
         $this->search = request()->string('search')->toString();
+
+    }
+
+    public function openSchedule(string $backupUuid): void
+    {
+        $this->loadSelectedSchedule($backupUuid);
+        $this->s3s = currentTeam()->s3s;
+        $this->scheduleModalOpen = true;
+    }
+
+    public function closeScheduleModal(): void
+    {
+        $this->scheduleModalOpen = false;
+        $this->selectedDatabaseBackup = null;
+        $this->selectedVolumeBackup = null;
+    }
+
+    public function backupNow(string $type, string $backupUuid): void
+    {
+        try {
+            if ($type === 'database') {
+                $this->loadSelectedSchedule($backupUuid);
+                abort_unless($this->selectedDatabaseBackup, 404);
+                $this->authorize('manageBackups', $this->selectedDatabaseBackup->database);
+                DatabaseBackupJob::dispatch($this->selectedDatabaseBackup);
+            } else {
+                abort_unless($type === 'storage', 404);
+                $this->loadSelectedSchedule($backupUuid);
+                abort_unless($this->selectedVolumeBackup, 404);
+                $this->authorize('update', $this->selectedVolumeBackup->targetResource());
+                VolumeBackupJob::dispatch($this->selectedVolumeBackup);
+            }
+
+            $this->selectedDatabaseBackup = null;
+            $this->selectedVolumeBackup = null;
+            $this->dispatch('success', 'Backup queued.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
     }
 
     public function render(): View
@@ -68,4 +127,24 @@ private function findService(): Service
             ->where('uuid', request()->route('service_uuid'))
             ->firstOrFail();
     }
+
+    private function loadSelectedSchedule(string $backupUuid): void
+    {
+        $this->selectedDatabaseBackup = ScheduledDatabaseBackup::query()
+            ->with('database')
+            ->whereUuid($backupUuid)
+            ->where('database_type', (new ServiceDatabase)->getMorphClass())
+            ->whereHasMorph('database', [ServiceDatabase::class], fn ($query) => $query->where('service_id', $this->service->id))
+            ->first();
+
+        if ($this->selectedDatabaseBackup) {
+            return;
+        }
+
+        $this->selectedVolumeBackup = ScheduledVolumeBackup::query()
+            ->with('backupable.resource')
+            ->whereUuid($backupUuid)
+            ->forService($this->service)
+            ->firstOrFail();
+    }
 }
diff --git a/app/Livewire/Project/Service/VolumeBackup/Show.php b/app/Livewire/Project/Service/VolumeBackup/Show.php
index eec60497f..10abeb3bf 100644
--- a/app/Livewire/Project/Service/VolumeBackup/Show.php
+++ b/app/Livewire/Project/Service/VolumeBackup/Show.php
@@ -20,7 +20,7 @@ class Show extends Component
 
     public string $section = 'general';
 
-    public function mount(): void
+    public function mount(): mixed
     {
         $project = currentTeam()->projects()->where('uuid', request()->route('project_uuid'))->firstOrFail();
         $environment = $project->environments()->where('uuid', request()->route('environment_uuid'))->firstOrFail();
@@ -43,6 +43,10 @@ public function mount(): void
             'project.service.volume-backups.danger' => 'danger',
             default => 'general',
         };
+
+        $routeParameters = collect($this->parameters)->except('backup_uuid')->all();
+
+        return redirect()->route('project.service.volume-backups.index', $routeParameters);
     }
 
     public function render(): View
diff --git a/resources/css/app.css b/resources/css/app.css
index b1ae74c09..40af521c6 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -2521,8 +2521,25 @@ .backup-table-grid {
 }
 
 .service-backup-table-grid {
-    grid-template-columns: minmax(10rem, 1.7fr) 6rem minmax(7rem, 0.8fr) 7.5rem 6.5rem minmax(8rem, 1fr);
-    min-width: 45rem;
+    grid-template-columns: minmax(10rem, 1.7fr) 6rem minmax(7rem, 0.8fr) 7.5rem 6.5rem minmax(8rem, 1fr) 7.5rem;
+    width: 100%;
+}
+
+.data-table-row.service-backup-table-grid {
+    background: var(--coollabs-base);
+    border-bottom: 1px solid var(--coollabs-fill);
+}
+
+.data-table-row.service-backup-table-grid:last-child {
+    border-bottom: 0;
+}
+
+.data-table-row.service-backup-table-grid:hover {
+    background: color-mix(in srgb, var(--coollabs-base) 98%, black);
+}
+
+.dark .data-table-row.service-backup-table-grid:hover {
+    background: color-mix(in srgb, var(--coollabs-base) 98%, white);
 }
 
 /* Persistent storage volumes: Name | Source | Destination | [PR suffix] | Backup | [Actions] */
diff --git a/resources/views/components/backup-sidebar.blade.php b/resources/views/components/backup-sidebar.blade.php
index 90c86ddb5..a2177b690 100644
--- a/resources/views/components/backup-sidebar.blade.php
+++ b/resources/views/components/backup-sidebar.blade.php
@@ -15,7 +15,7 @@
             'danger' => 'project.application.backup.danger',
         ],
         'service' => [
-            'back' => 'project.service.database.backups',
+            'back' => 'project.service.volume-backups.index',
             'general' => 'project.service.database.backup.show',
             's3' => 'project.service.database.backup.s3',
             'retention' => 'project.service.database.backup.retention',
@@ -48,9 +48,11 @@
         ['key' => 'danger', 'label' => 'Danger Zone', 'icon' => 'shield-alert'],
     ];
     $backLabel = $context === 'database' ? 'Back to database' : 'Back to backups';
-    $backParameters = $context === 'database'
-        ? collect($parameters)->except('backup_uuid')->all()
-        : $parameters;
+    $backParameters = match ($context) {
+        'database' => collect($parameters)->except('backup_uuid')->all(),
+        'service' => collect($parameters)->except(['stack_service_uuid', 'backup_uuid'])->all(),
+        default => $parameters,
+    };
 @endphp
 
 <aside class="application-settings-navigation min-w-0 xl:self-start">
diff --git a/resources/views/components/backup-tabs.blade.php b/resources/views/components/backup-tabs.blade.php
new file mode 100644
index 000000000..4898a29ed
--- /dev/null
+++ b/resources/views/components/backup-tabs.blade.php
@@ -0,0 +1,62 @@
+@props([
+    'context',
+    'parameters',
+    'section',
+])
+
+@php
+    $routes = match ($context) {
+        'service-schedule' => [
+            'general' => true,
+            's3' => true,
+            'retention' => true,
+            'danger' => true,
+        ],
+        'service' => [
+            'general' => 'project.service.database.backup.show',
+            's3' => 'project.service.database.backup.s3',
+            'retention' => 'project.service.database.backup.retention',
+            'executions' => 'project.service.database.backup.executions',
+            'danger' => 'project.service.database.backup.danger',
+        ],
+        'service-volume' => [
+            'general' => 'project.service.volume-backups.show',
+            's3' => 'project.service.volume-backups.s3',
+            'retention' => 'project.service.volume-backups.retention',
+            'executions' => 'project.service.volume-backups.executions',
+            'danger' => 'project.service.volume-backups.danger',
+        ],
+    };
+
+    $items = collect([
+        ['key' => 'general', 'label' => 'General'],
+        ['key' => 's3', 'label' => 'S3 storage'],
+        ['key' => 'retention', 'label' => 'Retention'],
+        ['key' => 'executions', 'label' => 'Executions'],
+        ['key' => 'danger', 'label' => 'Danger Zone'],
+    ])->filter(fn (array $item): bool => isset($routes[$item['key']]));
+@endphp
+
+<nav aria-label="Backup sections"
+    class="flex min-w-0 flex-wrap gap-1 border-b border-neutral-200 pb-2 dark:border-white/[0.08]">
+    @foreach ($items as $item)
+        @if ($context === 'service-schedule')
+            <button type="button" @click="activeSection = '{{ $item['key'] }}'"
+                :class="activeSection === '{{ $item['key'] }}'
+                    ? 'bg-coollabs/10 text-coollabs ring-1 ring-coollabs/25 dark:bg-warning/15 dark:text-warning dark:ring-warning/25'
+                    : 'text-neutral-500 hover:bg-black/5 hover:text-neutral-900 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg'"
+                class="inline-flex h-8 shrink-0 cursor-pointer items-center rounded-md px-3 text-[13px] font-medium transition-colors">
+                {{ $item['label'] }}
+            </button>
+        @else
+            <a @class([
+                'inline-flex h-8 shrink-0 items-center rounded-md px-3 text-[13px] font-medium transition-colors',
+                'bg-coollabs/10 text-coollabs ring-1 ring-coollabs/25 dark:bg-warning/15 dark:text-warning dark:ring-warning/25' => $section === $item['key'],
+                'text-neutral-500 hover:bg-black/5 hover:text-neutral-900 dark:text-fg-dim dark:hover:bg-white/[0.06] dark:hover:text-fg' => $section !== $item['key'],
+            ])
+                {{ wireNavigate() }} href="{{ route($routes[$item['key']], $parameters) }}">
+                {{ $item['label'] }}
+            </a>
+        @endif
+    @endforeach
+</nav>
diff --git a/resources/views/components/service-database/sidebar.blade.php b/resources/views/components/service-database/sidebar.blade.php
index 610cbd949..756cc6068 100644
--- a/resources/views/components/service-database/sidebar.blade.php
+++ b/resources/views/components/service-database/sidebar.blade.php
@@ -1,11 +1,9 @@
 @props([
     'parameters',
     'serviceDatabase',
-    'isImportSupported' => false,
 ])
 
 @php
-    $serviceParameters = \Illuminate\Support\Arr::except($parameters, ['stack_service_uuid']);
     $items = [
         [
             'label' => 'General',
@@ -19,22 +17,6 @@
             'icon' => 'grid',
             'active' => request()->routeIs('project.service.index.advanced'),
         ],
-        [
-            'label' => 'Backups',
-            'route' => 'project.service.volume-backups.index',
-            'parameters' => $serviceParameters,
-            'icon' => 'storages',
-            'active' => request()->routeIs('project.service.database.backup*'),
-            'visible' => $serviceDatabase?->isBackupSolutionAvailable() || $serviceDatabase?->is_migrated,
-        ],
-        [
-            'label' => 'Import Backup',
-            'route' => 'project.service.database.import',
-            'icon' => 'upload',
-            'active' => request()->routeIs('project.service.database.import'),
-            'visible' => $isImportSupported,
-            'navigate' => false,
-        ],
     ];
 
     $items = array_values(array_filter($items, fn (array $item): bool => $item['visible'] ?? true));
diff --git a/resources/views/components/service/configuration-sidebar.blade.php b/resources/views/components/service/configuration-sidebar.blade.php
index 49dbff49a..5e58b99b0 100644
--- a/resources/views/components/service/configuration-sidebar.blade.php
+++ b/resources/views/components/service/configuration-sidebar.blade.php
@@ -13,6 +13,7 @@
         ['label' => 'Environment Variables', 'route' => 'project.service.environment-variables', 'icon' => 'variables', 'hasWarning' => ! $service->isDeployable],
         ['label' => 'Persistent Storage', 'route' => 'project.service.storages', 'icon' => 'storages'],
         ['label' => 'Backups', 'route' => 'project.service.volume-backups.index', 'icon' => 'database'],
+        ['label' => 'Import Backup', 'route' => 'project.service.import-backup', 'icon' => 'upload', 'navigate' => false],
         ['label' => 'Runtime Logs', 'route' => 'project.service.logs', 'icon' => 'unordered-list', 'navigate' => false],
         ['label' => 'Terminal', 'route' => 'project.service.command', 'icon' => 'browser-terminal', 'navigate' => false, 'visible' => auth()->user()?->can('canAccessTerminal')],
         ['label' => 'Scheduled Tasks', 'route' => 'project.service.scheduled-tasks.show', 'icon' => 'calendar'],
@@ -27,13 +28,15 @@
                 || ($item['route'] === 'project.service.scheduled-tasks.show'
                     && str($currentRoute)->startsWith('project.service.scheduled-tasks'))
                 || ($item['route'] === 'project.service.volume-backups.index'
-                    && str($currentRoute)->startsWith('project.service.volume-backups')),
+                    && str($currentRoute)->startsWith('project.service.volume-backups'))
+                || ($item['route'] === 'project.service.import-backup'
+                    && str($currentRoute)->startsWith('project.service.import-backup')),
         ]);
 
     $menuGroups = [
         'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage'],
         'Observe & troubleshoot' => ['Runtime Logs', 'Terminal'],
-        'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups'],
+        'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups', 'Import Backup'],
         'Operations' => ['Resource Operations', 'Tags', 'Danger Zone'],
     ];
 
diff --git a/resources/views/livewire/project/service/backup-executions.blade.php b/resources/views/livewire/project/service/backup-executions.blade.php
new file mode 100644
index 000000000..b5c2057cf
--- /dev/null
+++ b/resources/views/livewire/project/service/backup-executions.blade.php
@@ -0,0 +1,64 @@
+<div>
+    @if ($selectedExecution)
+        <x-modal-input title="Backup execution" wireOpen="executionModalOpen" :wireIgnore="false" isLarge>
+            <x-slot:content><span></span></x-slot:content>
+            <div class="flex flex-col gap-5">
+                <div class="grid gap-4 sm:grid-cols-2 lg:grid-cols-4">
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Target</p><p class="mt-1 text-sm font-medium">{{ $selectedExecution['target'] }}</p></div>
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Status</p><p class="mt-1 text-sm font-medium">{{ str($selectedExecution['status'])->headline() }}</p></div>
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Started</p><p class="mt-1 text-sm font-medium">{{ $selectedExecution['started_at']->diffForHumans() }}</p></div>
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Size</p><p class="mt-1 text-sm font-medium">{{ $selectedExecution['size'] ? formatBytes($selectedExecution['size']) : '-' }}</p></div>
+                </div>
+                @if ($selectedExecution['filename'])
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Backup path</p><code class="mt-1 block overflow-x-auto rounded-md bg-neutral-100 p-3 text-xs dark:bg-black/20">{{ $selectedExecution['filename'] }}</code></div>
+                @endif
+                @if ($selectedExecution['message'])
+                    <div><p class="text-xs text-neutral-500 dark:text-fg-dim">Output</p><pre class="mt-1 max-h-80 overflow-auto rounded-md bg-neutral-100 p-3 font-mono text-xs whitespace-pre-wrap dark:bg-black/20">{{ $selectedExecution['message'] }}</pre></div>
+                @endif
+            </div>
+        </x-modal-input>
+    @endif
+
+    <x-application.settings-section title="Executions"
+        helper="Review backup runs across every database and storage target in this service." flush>
+        @if ($executions->isEmpty())
+            <x-empty size="sm" title="No backup executions"
+                description="Execution history appears here after a backup schedule runs." icon-name="browser-terminal" />
+        @else
+            <div class="data-table w-full overflow-x-auto">
+                <div class="data-table-header grid min-w-[820px] grid-cols-[minmax(150px,1.4fr)_100px_100px_110px_110px_90px_48px]">
+                    <span>Target</span><span>Type</span><span>Schedule</span><span>Status</span><span>Started</span><span>Size</span><span class="text-right">Actions</span>
+                </div>
+                @foreach ($executions as $execution)
+                    @php
+                        $statusType = match ($execution['status']) {
+                            'success' => 'success',
+                            'failed' => 'error',
+                            'running' => 'warning',
+                            default => 'neutral',
+                        };
+                    @endphp
+                    <div wire:key="service-backup-execution-{{ $execution['id'] }}"
+                        wire:click="openExecution('{{ $execution['uuid'] }}')"
+                        wire:keydown.enter="openExecution('{{ $execution['uuid'] }}')" role="button" tabindex="0"
+                        class="data-table-row grid min-w-[820px] cursor-pointer grid-cols-[minmax(150px,1.4fr)_100px_100px_110px_110px_90px_48px] text-left text-[13px] text-neutral-700 dark:text-fg-dim">
+                        <span class="truncate font-medium text-neutral-950 dark:text-fg" title="{{ $execution['target'] }}">{{ $execution['target'] }}</span>
+                        <span>{{ $execution['type'] }}</span><span>{{ $execution['schedule'] }}</span>
+                        <span><x-status-badge :status="str($execution['status'])->headline()" :type="$statusType" /></span>
+                        <span>{{ $execution['started_at']->diffForHumans() }}</span>
+                        <span>{{ $execution['size'] ? formatBytes($execution['size']) : '-' }}</span>
+                        <span class="flex justify-end">
+                            @if ($execution['download_url'])
+                                <a href="{{ $execution['download_url'] }}" target="_blank" rel="noopener"
+                                    @click.stop class="icon-button shrink-0" title="Download backup"
+                                    aria-label="Download backup">
+                                    <x-reicon name="upload" class="size-3.5 rotate-180" />
+                                </a>
+                            @endif
+                        </span>
+                    </div>
+                @endforeach
+            </div>
+        @endif
+    </x-application.settings-section>
+</div>
diff --git a/resources/views/livewire/project/service/configuration.blade.php b/resources/views/livewire/project/service/configuration.blade.php
index 4afbcbc6a..bb5057535 100644
--- a/resources/views/livewire/project/service/configuration.blade.php
+++ b/resources/views/livewire/project/service/configuration.blade.php
@@ -18,6 +18,7 @@
             ['label' => 'Environment Variables', 'route' => 'project.service.environment-variables', 'icon' => 'variables', 'hasWarning' => ! $service->isDeployable],
             ['label' => 'Persistent Storage', 'route' => 'project.service.storages', 'icon' => 'storages'],
             ['label' => 'Backups', 'route' => 'project.service.volume-backups.index', 'icon' => 'database'],
+            ['label' => 'Import Backup', 'route' => 'project.service.import-backup', 'icon' => 'upload', 'navigate' => false],
             ['label' => 'Runtime Logs', 'route' => 'project.service.logs', 'icon' => 'unordered-list', 'navigate' => false],
             ['label' => 'Terminal', 'route' => 'project.service.command', 'icon' => 'browser-terminal', 'navigate' => false, 'visible' => auth()->user()?->can('canAccessTerminal')],
             ['label' => 'Scheduled Tasks', 'route' => 'project.service.scheduled-tasks.show', 'icon' => 'calendar'],
@@ -35,7 +36,7 @@
         $menuGroups = [
             'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage'],
             'Observe & troubleshoot' => ['Runtime Logs', 'Terminal'],
-            'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups'],
+            'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups', 'Import Backup'],
             'Operations' => ['Resource Operations', 'Tags', 'Danger Zone'],
         ];
 
diff --git a/resources/views/livewire/project/service/database-backups.blade.php b/resources/views/livewire/project/service/database-backups.blade.php
index 9740b215a..7db3174af 100644
--- a/resources/views/livewire/project/service/database-backups.blade.php
+++ b/resources/views/livewire/project/service/database-backups.blade.php
@@ -8,24 +8,41 @@
 
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-            @if ($backup)
-                <x-backup-sidebar context="service" :parameters="$backupParameters" :section="$section" />
-            @else
-                <x-service-database.sidebar :parameters="$parameters" :serviceDatabase="$serviceDatabase"
-                    :isImportSupported="$isImportSupported" />
-            @endif
+            <x-service.configuration-sidebar :service="$service"
+                current-route="project.service.volume-backups.index" />
 
             <div class="min-w-0">
                 @if ($backup)
-                    @if ($section === 'executions')
-                        <livewire:project.database.backup-executions :backup="$backup"
-                            :database="$serviceDatabase" />
-                    @else
-                        <livewire:project.database.backup-edit :backup="$backup"
-                            :available-s3-storages="$s3s" :status="data_get($serviceDatabase, 'status')"
-                            :section="$section"
-                            wire:key="service-database-backup-{{ $backup->uuid }}-{{ $section }}" />
-                    @endif
+                    <div class="flex min-w-0 flex-col gap-6">
+                        <div class="flex min-w-0 flex-col gap-4">
+                            <div>
+                                <a class="inline-flex items-center gap-1.5 text-xs text-neutral-500 hover:text-neutral-900 dark:text-fg-dim dark:hover:text-fg"
+                                    {{ wireNavigate() }}
+                                    href="{{ route('project.service.volume-backups.index', collect($parameters)->except(['stack_service_uuid', 'backup_uuid'])->all()) }}">
+                                    <x-reicon name="arrow-right" class="size-3.5 rotate-180" />
+                                    Back to backups
+                                </a>
+                                <h1 class="mt-2 text-xl font-semibold text-neutral-950 dark:text-fg">
+                                    {{ $serviceDatabase->human_name ?: $serviceDatabase->name }} backup
+                                </h1>
+                                <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">
+                                    {{ $backup->frequency }} schedule
+                                </p>
+                            </div>
+
+                            <x-backup-tabs context="service" :parameters="$backupParameters" :section="$section" />
+                        </div>
+
+                        @if ($section === 'executions')
+                            <livewire:project.database.backup-executions :backup="$backup"
+                                :database="$serviceDatabase" />
+                        @else
+                            <livewire:project.database.backup-edit :backup="$backup"
+                                :available-s3-storages="$s3s" :status="data_get($serviceDatabase, 'status')"
+                                :section="$section"
+                                wire:key="service-database-backup-{{ $backup->uuid }}-{{ $section }}" />
+                        @endif
+                    </div>
                 @else
                     <section class="application-settings-section">
                         <div class="application-settings-section-header">
diff --git a/resources/views/livewire/project/service/import-backup.blade.php b/resources/views/livewire/project/service/import-backup.blade.php
new file mode 100644
index 000000000..802ca7d10
--- /dev/null
+++ b/resources/views/livewire/project/service/import-backup.blade.php
@@ -0,0 +1,39 @@
+<div>
+    <x-slot:title>
+        {{ data_get_str($service, 'name')->limit(10) }} > Import Backup | Coolify
+    </x-slot>
+
+    <livewire:project.service.heading :service="$service" :parameters="$parameters" :query="request()->query()"
+        wire:key="service-heading-import-backup" />
+
+    <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
+        <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
+            <x-service.configuration-sidebar :service="$service" current-route="project.service.import-backup" />
+
+            <div class="application-settings-form min-w-0 flex flex-col gap-6">
+                @if ($databases->isEmpty())
+                    <x-application.settings-section title="Import Backup"
+                        helper="Restore a backup into a database in this service.">
+                        <x-empty title="No compatible databases"
+                            description="This service does not contain a database that supports backup imports."
+                            icon-name="database" size="sm" />
+                    </x-application.settings-section>
+                @else
+                    <x-application.settings-section title="Import Backup"
+                        helper="Choose the database that should receive the backup.">
+                        <x-forms.listbox id="selectedDatabaseUuid" label="Database" live required canGate="update"
+                            :canResource="$service"
+                            :options="$databases->map(fn ($database) => [
+                                'value' => $database->uuid,
+                                'label' => $database->human_name ?: $database->name,
+                            ])->all()" />
+                    </x-application.settings-section>
+
+                    @if ($selectedDatabase)
+                        <livewire:project.database.import :key="'service-import-' . $selectedDatabase->uuid" />
+                    @endif
+                @endif
+            </div>
+        </div>
+    </section>
+</div>
diff --git a/resources/views/livewire/project/service/index.blade.php b/resources/views/livewire/project/service/index.blade.php
index 8faf4cfda..a14acbd69 100644
--- a/resources/views/livewire/project/service/index.blade.php
+++ b/resources/views/livewire/project/service/index.blade.php
@@ -3,7 +3,7 @@
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
         @if ($resourceType === 'database')
-            <x-service-database.sidebar :parameters="$parameters" :serviceDatabase="$serviceDatabase" :isImportSupported="$isImportSupported" />
+            <x-service-database.sidebar :parameters="$parameters" :serviceDatabase="$serviceDatabase" />
         @else
             <aside class="application-settings-navigation min-w-0 xl:self-start">
                 <nav aria-label="Compose resource settings"
diff --git a/resources/views/livewire/project/service/volume-backup/index.blade.php b/resources/views/livewire/project/service/volume-backup/index.blade.php
index 9fa11f1f8..f69d3f0db 100644
--- a/resources/views/livewire/project/service/volume-backup/index.blade.php
+++ b/resources/views/livewire/project/service/volume-backup/index.blade.php
@@ -56,6 +56,44 @@
     <livewire:project.service.heading :service="$service" :parameters="$parameters" :query="request()->query()"
         wire:key="service-heading-volume-backup-index" />
 
+    @if ($selectedDatabaseBackup || $selectedVolumeBackup)
+        @php
+            $selectedSchedule = $selectedDatabaseBackup ?: $selectedVolumeBackup;
+        @endphp
+        <x-modal-input :title="'Edit backup schedule'" wireOpen="scheduleModalOpen" :wireIgnore="false" isLarge
+            canGate="update" :canResource="$service">
+            <x-slot:content><span></span></x-slot:content>
+
+            <div x-data="{ activeSection: 'general' }" class="flex min-w-0 flex-col gap-6">
+                <div>
+                    <h2 class="text-base font-semibold text-neutral-950 dark:text-fg">
+                        {{ $selectedDatabaseBackup
+                            ? ($selectedDatabaseBackup->database->human_name ?: $selectedDatabaseBackup->database->name)
+                            : $selectedVolumeBackup->targetName() }}
+                    </h2>
+                    <p class="mt-1 text-xs text-neutral-500 dark:text-fg-dim">{{ $selectedSchedule->frequency }} schedule</p>
+                </div>
+
+                <x-backup-tabs context="service-schedule" :parameters="$parameters" section="general" />
+
+                @foreach (['general', 's3', 'retention', 'danger'] as $modalSection)
+                    <div x-show="activeSection === '{{ $modalSection }}'" x-cloak>
+                        @if ($selectedDatabaseBackup)
+                            <livewire:project.database.backup-edit :backup="$selectedDatabaseBackup"
+                                :available-s3-storages="$s3s" :status="data_get($selectedDatabaseBackup->database, 'status')"
+                                :section="$modalSection"
+                                wire:key="service-database-backup-modal-{{ $selectedDatabaseBackup->uuid }}-{{ $modalSection }}" />
+                        @else
+                            <livewire:project.shared.storages.volume-backups :storage="$selectedVolumeBackup->backupable"
+                                :resource="$service" :section="$modalSection"
+                                wire:key="service-volume-backup-modal-{{ $selectedVolumeBackup->uuid }}-{{ $modalSection }}" />
+                        @endif
+                    </div>
+                @endforeach
+            </div>
+        </x-modal-input>
+    @endif
+
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
             <x-service.configuration-sidebar :service="$service"
@@ -190,9 +228,11 @@ class="flex h-8 w-full items-center rounded-md px-2 text-left text-[12px] text-n
         </div>
 
         <div @class([
-            'application-settings-section-body w-full',
+            'application-settings-section-body relative w-full',
             'is-flush' => $backups->isNotEmpty() || $databaseBackups->isNotEmpty(),
         ])>
+            <x-table.loading target="openSchedule" text="Loading schedule..." />
+
             <div x-cloak x-show="backups.length > 0 && filteredBackups.length === 0">
                 <x-empty size="sm" title="No backups found"
                     description="No scheduled backups match your search." />
@@ -200,6 +240,7 @@ class="flex h-8 w-full items-center rounded-md px-2 text-left text-[12px] text-n
 
             @if ($backups->isNotEmpty() || $databaseBackups->isNotEmpty())
                 <div class="data-table w-full overflow-x-auto" x-show="filteredBackups.length > 0">
+                    <div class="min-w-[59rem]">
                     <div class="data-table-header backup-table-grid service-backup-table-grid">
                         <span>Target</span>
                         <span>Type</span>
@@ -207,6 +248,7 @@ class="flex h-8 w-full items-center rounded-md px-2 text-left text-[12px] text-n
                         <span>Status</span>
                         <span>S3</span>
                         <span>Last run</span>
+                        <span class="text-right">Actions</span>
                     </div>
 
                     @foreach ($databaseBackups as $databaseBackup)
@@ -227,16 +269,12 @@ class="flex h-8 w-full items-center rounded-md px-2 text-left text-[12px] text-n
                             };
                             $databaseBackupId = 'database:'.$databaseBackup->id;
                         @endphp
-                        <a wire:key="database-backup-{{ $databaseBackup->uuid }}"
+                        <div wire:key="database-backup-{{ $databaseBackup->uuid }}"
                             x-show="isVisible(@js($databaseBackupId))"
                             x-bind:style="{ order: backupOrder(@js($databaseBackupId)) }"
-                            href="{{ route('project.service.database.backup.show', [
-                                ...$parameters,
-                                'stack_service_uuid' => $databaseBackup->database->uuid,
-                                'backup_uuid' => $databaseBackup->uuid,
-                            ]) }}"
-                            {{ wireNavigate() }}
-                            class="data-table-row backup-table-grid text-[13px] text-neutral-700 service-backup-table-grid dark:text-fg-dim">
+                            wire:click="openSchedule('{{ $databaseBackup->uuid }}')"
+                            wire:keydown.enter="openSchedule('{{ $databaseBackup->uuid }}')" role="button" tabindex="0"
+                            class="data-table-row backup-table-grid cursor-pointer text-left text-[13px] text-neutral-700 service-backup-table-grid dark:text-fg-dim">
                             <span class="min-w-0 truncate font-medium text-neutral-950 dark:text-fg">
                                 {{ $databaseBackup->database->human_name ?: $databaseBackup->database->name }}
                             </span>
@@ -248,7 +286,12 @@ class="data-table-row backup-table-grid text-[13px] text-neutral-700 service-bac
                                     :type="$databaseBackup->save_s3 ? ($databaseBackup->s3 ? 'success' : 'error') : 'neutral'" />
                             </span>
                             <span>{{ $latestExecution?->finished_at?->diffForHumans() ?? ($status === 'running' ? 'Running now' : 'Never') }}</span>
-                        </a>
+                            <span class="flex justify-end">
+                                <x-forms.button type="button" canGate="update" :canResource="$service"
+                                    wire:click.stop="backupNow('database', '{{ $databaseBackup->uuid }}')"
+                                    wire:target="backupNow('database', '{{ $databaseBackup->uuid }}')">Back up now</x-forms.button>
+                            </span>
+                        </div>
                     @endforeach
 
                     @foreach ($backups as $backup)
@@ -268,12 +311,12 @@ class="data-table-row backup-table-grid text-[13px] text-neutral-700 service-bac
                                 default => 'neutral',
                             };
                         @endphp
-                        <a wire:key="volume-backup-{{ $backup->uuid }}"
+                        <div wire:key="volume-backup-{{ $backup->uuid }}"
                             x-show="isVisible(@js('storage:'.$backup->id))"
                             x-bind:style="{ order: backupOrder(@js('storage:'.$backup->id)) }"
-                            href="{{ route('project.service.volume-backups.show', [...$parameters, 'backup_uuid' => $backup->uuid]) }}"
-                            {{ wireNavigate() }}
-                            class="data-table-row backup-table-grid text-[13px] text-neutral-700 service-backup-table-grid dark:text-fg-dim">
+                            wire:click="openSchedule('{{ $backup->uuid }}')"
+                            wire:keydown.enter="openSchedule('{{ $backup->uuid }}')" role="button" tabindex="0"
+                            class="data-table-row backup-table-grid cursor-pointer text-left text-[13px] text-neutral-700 service-backup-table-grid dark:text-fg-dim">
                             <span class="min-w-0 truncate font-medium text-neutral-950 dark:text-fg"
                                 title="{{ $backup->targetName() }}">
                                 {{ $backup->targetName() }}
@@ -288,8 +331,14 @@ class="data-table-row backup-table-grid text-[13px] text-neutral-700 service-bac
                             <span>
                                 {{ $latestExecution?->finished_at?->diffForHumans() ?? ($status === 'running' ? 'Running now' : 'Never') }}
                             </span>
-                        </a>
+                            <span class="flex justify-end">
+                                <x-forms.button type="button" canGate="update" :canResource="$service"
+                                    wire:click.stop="backupNow('storage', '{{ $backup->uuid }}')"
+                                    wire:target="backupNow('storage', '{{ $backup->uuid }}')">Back up now</x-forms.button>
+                            </span>
+                        </div>
                     @endforeach
+                    </div>
                 </div>
             @else
                 <x-empty size="sm" title="No scheduled backups"
@@ -297,6 +346,8 @@ class="data-table-row backup-table-grid text-[13px] text-neutral-700 service-bac
                     icon-name="storages" />
             @endif
         </div>
+        <livewire:project.service.backup-executions :service="$service"
+            wire:key="service-backup-executions-{{ $service->id }}" />
             </div>
         </div>
     </section>
diff --git a/resources/views/livewire/project/service/volume-backup/show.blade.php b/resources/views/livewire/project/service/volume-backup/show.blade.php
index e23a8a94c..393822467 100644
--- a/resources/views/livewire/project/service/volume-backup/show.blade.php
+++ b/resources/views/livewire/project/service/volume-backup/show.blade.php
@@ -8,9 +8,29 @@
 
     <section class="application-settings-workspace mt-4 w-full max-w-none lg:mt-0">
         <div class="grid min-w-0 gap-8 xl:grid-cols-[210px_minmax(0,1fr)] xl:gap-8">
-            <x-backup-sidebar context="service-volume" :parameters="$parameters" :section="$section" />
+            <x-service.configuration-sidebar :service="$service"
+                current-route="project.service.volume-backups.index" />
+
+            <div class="flex min-w-0 flex-col gap-6">
+                <div class="flex min-w-0 flex-col gap-4">
+                    <div>
+                        <a class="inline-flex items-center gap-1.5 text-xs text-neutral-500 hover:text-neutral-900 dark:text-fg-dim dark:hover:text-fg"
+                            {{ wireNavigate() }}
+                            href="{{ route('project.service.volume-backups.index', collect($parameters)->except('backup_uuid')->all()) }}">
+                            <x-reicon name="arrow-right" class="size-3.5 rotate-180" />
+                            Back to backups
+                        </a>
+                        <h1 class="mt-2 text-xl font-semibold text-neutral-950 dark:text-fg">
+                            {{ $backup->targetName() }} backup
+                        </h1>
+                        <p class="mt-1 text-[13px] text-neutral-500 dark:text-fg-dim">
+                            {{ $backup->frequency }} schedule
+                        </p>
+                    </div>
+
+                    <x-backup-tabs context="service-volume" :parameters="$parameters" :section="$section" />
+                </div>
 
-            <div class="min-w-0">
                 <livewire:project.shared.storages.volume-backups :storage="$backup->backupable"
                     :resource="$service" :section="$section"
                     wire:key="service-volume-backup-{{ $backup->uuid }}-{{ $section }}" />
diff --git a/routes/web.php b/routes/web.php
index dddb0353b..cdf816179 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -37,6 +37,7 @@
 use App\Livewire\Project\Resource\Index as ResourceIndex;
 use App\Livewire\Project\Service\Configuration as ServiceConfiguration;
 use App\Livewire\Project\Service\DatabaseBackups as ServiceDatabaseBackups;
+use App\Livewire\Project\Service\ImportBackup as ServiceImportBackup;
 use App\Livewire\Project\Service\Index as ServiceIndex;
 use App\Livewire\Project\Service\VolumeBackup\Index;
 use App\Livewire\Project\Service\VolumeBackup\Show;
@@ -322,6 +323,8 @@
         Route::get('/logs', Logs::class)->name('project.service.logs');
         Route::get('/environment-variables', ServiceConfiguration::class)->name('project.service.environment-variables');
         Route::get('/storages', ServiceConfiguration::class)->name('project.service.storages');
+        Route::get('/import-backup', ServiceImportBackup::class)->name('project.service.import-backup')->middleware('can.update.resource');
+        Route::get('/import-backup/{stack_service_uuid}', ServiceImportBackup::class)->name('project.service.import-backup.database')->middleware('can.update.resource');
         Route::get('/storage-backups', Index::class)->name('project.service.volume-backups.index');
         Route::get('/storage-backups/{backup_uuid}', Show::class)->name('project.service.volume-backups.show');
         Route::get('/storage-backups/{backup_uuid}/s3', Show::class)->name('project.service.volume-backups.s3');
@@ -340,7 +343,7 @@
         Route::get('/{stack_service_uuid}/backups/{backup_uuid}/retention', ServiceDatabaseBackups::class)->name('project.service.database.backup.retention');
         Route::get('/{stack_service_uuid}/backups/{backup_uuid}/executions', ServiceDatabaseBackups::class)->name('project.service.database.backup.executions');
         Route::get('/{stack_service_uuid}/backups/{backup_uuid}/danger', ServiceDatabaseBackups::class)->name('project.service.database.backup.danger');
-        Route::get('/{stack_service_uuid}/import', ServiceIndex::class)->name('project.service.database.import')->middleware('can.update.resource');
+        Route::get('/{stack_service_uuid}/import', ServiceImportBackup::class)->name('project.service.database.import')->middleware('can.update.resource');
         Route::get('/{stack_service_uuid}/advanced', ServiceIndex::class)->name('project.service.index.advanced');
         Route::get('/{stack_service_uuid}', ServiceIndex::class)->name('project.service.index');
         Route::get('/tasks/{task_uuid}', ServiceConfiguration::class)->name('project.service.scheduled-tasks');
diff --git a/tests/Feature/ImportBackupUploadIconTest.php b/tests/Feature/ImportBackupUploadIconTest.php
index 2729278de..6fc9158be 100644
--- a/tests/Feature/ImportBackupUploadIconTest.php
+++ b/tests/Feature/ImportBackupUploadIconTest.php
@@ -28,11 +28,11 @@
         ->toContain("'icon' => 'upload'");
 });
 
-it('uses the upload reicon for import backup in service database sidebar', function () {
-    $contents = file_get_contents(resource_path('views/components/service-database/sidebar.blade.php'));
+it('uses the upload reicon for import backup in service navigation', function () {
+    $contents = file_get_contents(resource_path('views/components/service/configuration-sidebar.blade.php'));
 
     expect($contents)
         ->toContain("'label' => 'Import Backup'")
         ->toContain("'icon' => 'upload'")
-        ->not->toMatch("/'label' => 'Import Backup',\s*'route' => 'project\.service\.database\.import',\s*'icon' => 'storages'/s");
+        ->toContain("'route' => 'project.service.import-backup'");
 });
diff --git a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
index 9d6e19a98..aa1fbda4f 100644
--- a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
+++ b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
@@ -69,6 +69,20 @@
     );
 });
 
+it('declares update authorization on service backup mutation controls', function () {
+    $importBackupView = file_get_contents(resource_path('views/livewire/project/service/import-backup.blade.php'));
+    $volumeBackupView = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+
+    expect($importBackupView)->toMatch(
+        '/<x-forms\.listbox(?=[^>]*id="selectedDatabaseUuid")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$service")[^>]*>/'
+    );
+
+    expect($volumeBackupView)
+        ->toMatch('/<x-modal-input(?=[^>]*:title="\'Edit backup schedule\'")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$service")[^>]*>/')
+        ->toMatch('/<x-forms\.button(?=[^>]*wire:click\.stop="backupNow\(\'database\',[^"]+")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$service")[^>]*>/')
+        ->toMatch('/<x-forms\.button(?=[^>]*wire:click\.stop="backupNow\(\'storage\',[^"]+")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$service")[^>]*>/');
+});
+
 it('keeps mutable Livewire components behind authorization checks', function (string $path, array $requiredNeedles) {
     $source = file_get_contents(base_path($path));
 
diff --git a/tests/Feature/ServiceDatabaseVerticalNavigationTest.php b/tests/Feature/ServiceDatabaseVerticalNavigationTest.php
index f2b5758db..bdb7b77a1 100644
--- a/tests/Feature/ServiceDatabaseVerticalNavigationTest.php
+++ b/tests/Feature/ServiceDatabaseVerticalNavigationTest.php
@@ -1,5 +1,7 @@
 <?php
 
+use App\Livewire\Project\Service\DatabaseBackups;
+
 it('moves service and database page navigation into their sidebars', function () {
     $serviceHeading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
     $databaseHeading = file_get_contents(resource_path('views/livewire/project/database/heading.blade.php'));
@@ -58,7 +60,7 @@
         expect($serviceSidebar)
             ->toContain("'Settings' => ['General', 'Domains', 'Environment Variables', 'Persistent Storage']")
             ->toContain("'Observe & troubleshoot' => ['Runtime Logs', 'Terminal']")
-            ->toContain("'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups']")
+            ->toContain("'Automation' => ['Scheduled Tasks', 'Webhooks', 'Backups', 'Import Backup']")
             ->toContain("'Operations' => ['Resource Operations', 'Tags', 'Danger Zone']");
     }
 });
@@ -110,7 +112,7 @@
         ->toContain('class="data-table w-full overflow-x-auto"')
         ->toContain('backup-table-grid service-backup-table-grid')
         ->not->toContain('<span class="text-right">Executions</span>')
-        ->toContain('class="data-table-row backup-table-grid text-[13px]')
+        ->toMatch('/class="(?=[^"]*\\bdata-table-row\\b)(?=[^"]*\\bbackup-table-grid\\b)(?=[^"]*text-\\[13px\\])[^\"]*"/')
         ->toContain('class="listbox-option justify-start! gap-2.5!"')
         ->toContain('x-data="{ dropdownOpen: false }"')
         ->toContain('class="listbox-panel left-0! right-auto! z-[90]! w-52! min-w-52! sm:left-auto! sm:right-0!"')
@@ -119,15 +121,147 @@
     expect($styles)->toContain('.service-backup-table-grid');
 });
 
-it('links compose database backups to the unified service backups page', function () {
+it('keeps backup navigation out of compose database settings', function () {
     $sidebar = file_get_contents(resource_path('views/components/service-database/sidebar.blade.php'));
 
     expect($sidebar)
-        ->toContain("'route' => 'project.service.volume-backups.index'")
-        ->toContain("'parameters' => \$serviceParameters")
+        ->not->toContain("'label' => 'Backups'")
+        ->not->toContain("'label' => 'Import Backup'")
         ->not->toContain("'route' => 'project.service.database.backups'");
 });
 
+it('links service backup details back to the unified service backups page', function () {
+    $sidebar = file_get_contents(resource_path('views/components/backup-sidebar.blade.php'));
+
+    expect($sidebar)->toContain("'back' => 'project.service.volume-backups.index'");
+});
+
+it('declares the database backup mount return type', function () {
+    $returnType = (new ReflectionMethod(DatabaseBackups::class, 'mount'))->getReturnType();
+
+    expect($returnType)->not->toBeNull()
+        ->and($returnType->getName())->toBe('mixed');
+});
+
+it('keeps service navigation visible on backup detail pages and uses section tabs', function () {
+    $databaseBackup = file_get_contents(resource_path('views/livewire/project/service/database-backups.blade.php'));
+    $storageBackup = file_get_contents(resource_path('views/livewire/project/service/volume-backup/show.blade.php'));
+
+    foreach ([$databaseBackup, $storageBackup] as $view) {
+        expect($view)
+            ->toContain('<x-service.configuration-sidebar :service="$service"')
+            ->toContain('<x-backup-tabs')
+            ->not->toContain('<x-backup-sidebar');
+    }
+
+    expect($databaseBackup)->toContain('context="service"')
+        ->and($storageBackup)->toContain('context="service-volume"');
+});
+
+it('opens service backup schedules in place without navigating', function () {
+    $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+
+    expect($index)
+        ->toContain('wire:click="openSchedule(')
+        ->toContain('wireOpen="scheduleModalOpen"')
+        ->toContain('<x-backup-tabs')
+        ->not->toContain("route('project.service.backups.schedule.show'");
+});
+
+it('shows service backup executions below schedules without a separate view tab', function () {
+    $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+    $executions = file_get_contents(resource_path('views/livewire/project/service/backup-executions.blade.php'));
+
+    expect($index)
+        ->toContain('<livewire:project.service.backup-executions :service="$service"')
+        ->not->toContain('aria-label="Backup views"')
+        ->not->toContain("route('project.service.backups.executions'");
+
+    expect($executions)
+        ->toContain('title="Executions"')
+        ->toContain('flush>');
+});
+
+it('wraps backup modal tabs and shows schedule loading feedback', function () {
+    $tabs = file_get_contents(resource_path('views/components/backup-tabs.blade.php'));
+    $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+
+    expect($tabs)
+        ->toContain('flex-wrap')
+        ->not->toContain('overflow-x-auto');
+
+    expect($index)
+        ->toContain('<x-table.loading target="openSchedule" text="Loading schedule..."')
+        ->not->toContain('Loading schedule\n');
+});
+
+it('loads every backup editor section when the modal opens and switches tabs locally', function () {
+    $tabs = file_get_contents(resource_path('views/components/backup-tabs.blade.php'));
+    $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+
+    expect($index)
+        ->toContain("x-data=\"{ activeSection: 'general' }\"")
+        ->toContain("@foreach (['general', 's3', 'retention', 'danger'] as \$modalSection)")
+        ->toContain("x-show=\"activeSection === '{{ \$modalSection }}'\"");
+
+    expect($tabs)
+        ->toContain("@click=\"activeSection = '{{ \$item['key'] }}'\"")
+        ->not->toContain('wire:click="selectScheduleSection');
+});
+
+it('adds a back up now action to every service backup schedule row', function () {
+    $index = file_get_contents(resource_path('views/livewire/project/service/volume-backup/index.blade.php'));
+    $styles = file_get_contents(resource_path('css/app.css'));
+
+    expect($index)
+        ->toContain('<span class="text-right">Actions</span>')
+        ->toContain('<div class="min-w-[59rem]">')
+        ->toContain("wire:click.stop=\"backupNow('database',")
+        ->toContain("wire:click.stop=\"backupNow('storage',")
+        ->toContain('<x-forms.button')
+        ->toContain('Back up now</x-forms.button>')
+        ->not->toContain('class="icon-button shrink-0"')
+        ->not->toContain('class="contents cursor-pointer"');
+
+    expect($styles)
+        ->toContain('.service-backup-table-grid')
+        ->toContain('width: 100%;')
+        ->toContain('.data-table-row.service-backup-table-grid {')
+        ->not->toContain('.data-table-header.service-backup-table-grid > :last-child')
+        ->not->toContain('.data-table-row.service-backup-table-grid > :last-child');
+});
+
+it('refreshes backup executions from backup broadcasts on the current team channel', function () {
+    $serviceExecutions = file_get_contents(app_path('Livewire/Project/Service/BackupExecutions.php'));
+    $serviceBackups = file_get_contents(app_path('Livewire/Project/Service/VolumeBackup/Index.php'));
+    $databaseExecutions = file_get_contents(app_path('Livewire/Project/Database/BackupExecutions.php'));
+    $databaseBackupJob = file_get_contents(app_path('Jobs/DatabaseBackupJob.php'));
+
+    expect($serviceExecutions)
+        ->toContain('echo-private:team.{$teamId},BackupCreated')
+        ->toContain("=> '\$refresh'")
+        ->and($serviceBackups)
+        ->toContain('echo-private:team.{$teamId},BackupCreated')
+        ->and($databaseExecutions)
+        ->toContain('$teamId = currentTeam()->id')
+        ->not->toContain('$userId = Auth::id()')
+        ->and(strpos($databaseBackupJob, "'finished_at' => Carbon::now()->toImmutable()"))
+        ->toBeLessThan(strrpos($databaseBackupJob, 'BackupCreated::dispatch($this->team->id)'));
+});
+
+it('offers downloads from the service backup executions list', function () {
+    $component = file_get_contents(app_path('Livewire/Project/Service/BackupExecutions.php'));
+    $view = file_get_contents(resource_path('views/livewire/project/service/backup-executions.blade.php'));
+
+    expect($component)
+        ->toContain("route('download.backup'")
+        ->toContain("route('download.volume-backup'")
+        ->and($view)
+        ->toContain('<span class="text-right">Actions</span>')
+        ->toContain('aria-label="Download backup"')
+        ->toContain('@click.stop');
+});
+
 it('uses a distinct backup icon across resource sidebars', function () {
     $sidebars = [
         resource_path('views/components/application/configuration-sidebar.blade.php'),
diff --git a/tests/Feature/ServiceResourceRoutingTest.php b/tests/Feature/ServiceResourceRoutingTest.php
index da730d97d..9d5ac5a8a 100644
--- a/tests/Feature/ServiceResourceRoutingTest.php
+++ b/tests/Feature/ServiceResourceRoutingTest.php
@@ -1,11 +1,16 @@
 <?php
 
+use App\Jobs\DatabaseBackupJob;
+use App\Jobs\VolumeBackupJob;
 use App\Livewire\Project\Database\Import as DatabaseImport;
 use App\Livewire\Project\Service\Heading;
+use App\Livewire\Project\Service\VolumeBackup\Index as ServiceVolumeBackupIndex;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
+use App\Models\LocalPersistentVolume;
 use App\Models\Project;
 use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledDatabaseBackupExecution;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
@@ -16,6 +21,7 @@
 use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Config;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Once;
 use Livewire\Livewire;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
@@ -113,6 +119,14 @@
     ]));
 })->throws(NotFoundHttpException::class);
 
+test('does not open service import backup route from another team', function () {
+    $this->get(route('project.service.import-backup', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->otherService->uuid,
+    ]))->assertForbidden();
+});
+
 test('does not resolve service database import component from another team', function () {
     $component = app(DatabaseImport::class);
     $component->parameters = [
@@ -141,7 +155,7 @@
         ->assertOk();
 });
 
-test('service database backup schedules use dedicated general retention and executions urls', function () {
+test('legacy service database backup detail urls redirect to unified backup views', function () {
     $backup = ScheduledDatabaseBackup::create([
         'team_id' => $this->teamA->id,
         'frequency' => 'daily',
@@ -156,51 +170,254 @@
         'stack_service_uuid' => $this->ownServiceDatabase->uuid,
     ]);
     $generalUrl = $listUrl.'/'.$backup->uuid;
+    $parameters = [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ];
 
-    $this->get($listUrl)
-        ->assertOk()
-        ->assertSee('href="'.$generalUrl.'"', false);
+    $this->get($generalUrl)->assertRedirect(route('project.service.volume-backups.index', $parameters));
+    $this->get($generalUrl.'/s3')->assertRedirect(route('project.service.volume-backups.index', $parameters));
+    $this->get($generalUrl.'/retention')->assertRedirect(route('project.service.volume-backups.index', $parameters));
+    $this->get($generalUrl.'/danger')->assertRedirect(route('project.service.volume-backups.index', $parameters));
+    $this->get($generalUrl.'/executions')->assertRedirect(route('project.service.volume-backups.index', $parameters));
+});
 
-    $this->get($generalUrl)
-        ->assertOk()
-        ->assertSee('Frequency')
-        ->assertDontSee('S3 Enabled')
-        ->assertDontSee('Number of backups to keep')
-        ->assertDontSee('Cleanup Failed Backups')
-        ->assertDontSee('Delete Backups and Schedule');
+test('legacy service database backup list redirects to unified service backups', function () {
+    $legacyUrl = route('project.service.database.backups', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+    ]);
+    $centralBackupsUrl = route('project.service.volume-backups.index', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]);
 
-    $this->get($generalUrl.'/s3')
-        ->assertOk()
-        ->assertSee('S3 Storage')
-        ->assertDontSee('S3 Storage Retention')
-        ->assertDontSee('Local Backup Retention')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Cleanup Failed Backups');
+    $this->get($legacyUrl)->assertRedirect($centralBackupsUrl);
+});
 
-    $this->get($generalUrl.'/retention')
-        ->assertOk()
-        ->assertSee('Local Backup Retention')
-        ->assertSee('S3 Storage Retention')
-        ->assertSee('Number of backups to keep')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Cleanup Failed Backups');
+test('service backup schedules open in place from the unified view', function () {
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
 
-    $this->get($generalUrl.'/executions')
+    $this->get(route('project.service.volume-backups.index', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]))
         ->assertOk()
-        ->assertSee('<h2 class="py-0">Executions</h2>', false)
-        ->assertDontSee('Executions <span', false)
-        ->assertSee('Cleanup Failed Backups')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Number of backups to keep');
+        ->assertSee("wire:click=\"openSchedule('{$backup->uuid}')\"", false);
+});
 
-    $this->get($generalUrl.'/danger')
+test('service database backup schedules open in the Livewire component', function () {
+    Queue::fake();
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+
+    Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->call('openSchedule', $backup->uuid)
+        ->assertSet('scheduleModalOpen', true)
+        ->assertSet('selectedDatabaseBackup.uuid', $backup->uuid)
+        ->assertSet('selectedVolumeBackup', null);
+});
+
+test('service database backups can be queued from the Livewire component', function () {
+    Queue::fake();
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+
+    Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->call('backupNow', 'database', $backup->uuid)
+        ->assertDispatched('success', 'Backup queued.');
+
+    Queue::assertPushed(DatabaseBackupJob::class, fn (DatabaseBackupJob $job): bool => $job->backup->is($backup));
+});
+
+test('service storage backups can be queued from the Livewire component', function () {
+    Queue::fake();
+    $volume = LocalPersistentVolume::create([
+        'name' => 'service-data',
+        'mount_path' => '/data',
+        'resource_id' => $this->ownServiceDatabase->id,
+        'resource_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $backup = $volume->scheduledBackups()->create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+    ]);
+
+    Livewire::test(ServiceVolumeBackupIndex::class, ['service' => $this->ownService])
+        ->call('backupNow', 'storage', $backup->uuid)
+        ->assertDispatched('success', 'Backup queued.');
+
+    Queue::assertPushed(VolumeBackupJob::class, fn (VolumeBackupJob $job): bool => $job->backup->is($backup));
+});
+
+test('service backup executions combine database execution history', function () {
+    $backup = ScheduledDatabaseBackup::create([
+        'team_id' => $this->teamA->id,
+        'frequency' => 'daily',
+        'database_id' => $this->ownServiceDatabase->id,
+        'database_type' => $this->ownServiceDatabase->getMorphClass(),
+    ]);
+    $execution = ScheduledDatabaseBackupExecution::create([
+        'scheduled_database_backup_id' => $backup->id,
+        'status' => 'success',
+        'database_name' => 'coolify',
+        'size' => 2048,
+        'finished_at' => now(),
+    ]);
+
+    $this->get(route('project.service.volume-backups.index', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]))
         ->assertOk()
-        ->assertSee('Danger Zone')
-        ->assertSee('Delete Scheduled Backup')
-        ->assertSee('Delete Backups and Schedule')
-        ->assertDontSee('Frequency')
-        ->assertDontSee('Number of backups to keep')
-        ->assertDontSee('Cleanup Failed Backups');
+        ->assertSee('own-db')
+        ->assertSee('Success')
+        ->assertSee('2 KB');
+
+    $this->get(route('project.service.volume-backups.index', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]))->assertSee("wire:click=\"openExecution('{$execution->uuid}')\"", false);
+});
+
+test('service import backup page selects from compatible databases', function () {
+    $secondDatabase = ServiceDatabase::create([
+        'service_id' => $this->ownService->id,
+        'name' => 'analytics-db',
+        'image' => 'mysql:8',
+        'custom_type' => 'mysql',
+    ]);
+    $importUrl = route('project.service.import-backup', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]);
+
+    $this->get($importUrl)
+        ->assertOk()
+        ->assertSee('Import Backup')
+        ->assertSee('own-db')
+        ->assertSee('analytics-db');
+
+    $this->get($importUrl.'/'.$secondDatabase->uuid)
+        ->assertOk()
+        ->assertSee('analytics-db')
+        ->assertSee('Start the database first');
+});
+
+test('service import backup redirects when exactly one compatible database exists', function () {
+    $this->get(route('project.service.import-backup', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]))->assertRedirectToRoute('project.service.import-backup.database', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+    ]);
+});
+
+test('service import backup excludes unsupported databases', function () {
+    $unsupportedDatabase = ServiceDatabase::create([
+        'service_id' => $this->ownService->id,
+        'name' => 'cache-db',
+        'image' => 'redis:7-alpine',
+        'custom_type' => 'redis',
+    ]);
+
+    $this->get(route('project.service.import-backup', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ]))
+        ->assertRedirectToRoute('project.service.import-backup.database', [
+            'project_uuid' => $this->projectA->uuid,
+            'environment_uuid' => $this->environmentA->uuid,
+            'service_uuid' => $this->ownService->uuid,
+            'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+        ]);
+
+    $this->get(route('project.service.import-backup.database', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $unsupportedDatabase->uuid,
+    ]))->assertNotFound();
+});
+
+test('service import backup opens the selected compatible database', function () {
+    $secondDatabase = ServiceDatabase::create([
+        'service_id' => $this->ownService->id,
+        'name' => 'analytics-db',
+        'image' => 'mysql:8',
+        'custom_type' => 'mysql',
+    ]);
+
+    $this->get(route('project.service.import-backup.database', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $secondDatabase->uuid,
+    ]))
+        ->assertOk()
+        ->assertSee('analytics-db')
+        ->assertSee('Start the database first');
+});
+
+test('service import backup requires update authorization for the service and selected database', function () {
+    $member = User::factory()->create();
+    $member->teams()->attach($this->teamA, ['role' => 'member']);
+    $this->actingAs($member);
+
+    $parameters = [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+    ];
+
+    $this->get(route('project.service.import-backup', $parameters))->assertForbidden();
+    $this->get(route('project.service.import-backup.database', [
+        ...$parameters,
+        'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+    ]))->assertForbidden();
+});
+
+test('legacy service database import redirects to the service import page with its database selected', function () {
+    $legacyUrl = route('project.service.database.import', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+    ]);
+    $selectedImportUrl = route('project.service.import-backup.database', [
+        'project_uuid' => $this->projectA->uuid,
+        'environment_uuid' => $this->environmentA->uuid,
+        'service_uuid' => $this->ownService->uuid,
+        'stack_service_uuid' => $this->ownServiceDatabase->uuid,
+    ]);
+
+    $this->get($legacyUrl)->assertRedirect($selectedImportUrl);
 });
 
 test('service storage backups page includes schedules from all compose databases', function () {
@@ -211,15 +428,15 @@
         'custom_type' => 'postgresql',
     ]);
 
-    foreach ([$this->ownServiceDatabase, $secondDatabase] as $database) {
-        ScheduledDatabaseBackup::create([
+    $backups = collect([$this->ownServiceDatabase, $secondDatabase])->map(function (ServiceDatabase $database) {
+        return ScheduledDatabaseBackup::create([
             'team_id' => $this->teamA->id,
             'description' => $database->name.' backup',
             'frequency' => 'daily',
             'database_id' => $database->id,
             'database_type' => $database->getMorphClass(),
         ]);
-    }
+    });
 
     $this->get(route('project.service.volume-backups.index', [
         'project_uuid' => $this->projectA->uuid,
@@ -230,10 +447,6 @@
         ->assertSee('>Database</span>', false)
         ->assertSee('own-db')
         ->assertSee('analytics-db')
-        ->assertSee(route('project.service.database.backups', [
-            'project_uuid' => $this->projectA->uuid,
-            'environment_uuid' => $this->environmentA->uuid,
-            'service_uuid' => $this->ownService->uuid,
-            'stack_service_uuid' => $this->ownServiceDatabase->uuid,
-        ]), false);
+        ->assertSee("wire:click=\"openSchedule('{$backups->first()->uuid}')\"", false)
+        ->assertSee("wire:click=\"backupNow('database', '{$backups->first()->uuid}')\"", false);
 });
diff --git a/tests/Feature/VolumeBackupTest.php b/tests/Feature/VolumeBackupTest.php
index aa7da543b..b24b45dca 100644
--- a/tests/Feature/VolumeBackupTest.php
+++ b/tests/Feature/VolumeBackupTest.php
@@ -7,6 +7,7 @@
 use App\Livewire\Project\Application\Backup\Create as CreateScheduledVolumeBackup;
 use App\Livewire\Project\Service\FileStorage;
 use App\Livewire\Project\Service\VolumeBackup\Create as CreateServiceVolumeBackup;
+use App\Livewire\Project\Service\VolumeBackup\Index as ServiceVolumeBackupIndex;
 use App\Livewire\Project\Shared\Storages\Show;
 use App\Livewire\Project\Shared\Storages\VolumeBackups;
 use App\Models\Application;
@@ -26,6 +27,7 @@
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
+use Illuminate\Database\Eloquent\Collection;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Queue\Middleware\WithoutOverlapping;
@@ -44,6 +46,14 @@
 
 uses(RefreshDatabase::class);
 
+it('types service backup S3 storage state as a nullable Eloquent collection', function () {
+    $property = new ReflectionProperty(ServiceVolumeBackupIndex::class, 's3s');
+
+    expect($property->getType()?->getName())->toBe(Collection::class)
+        ->and($property->getType()?->allowsNull())->toBeTrue()
+        ->and($property->getDefaultValue())->toBeNull();
+});
+
 it('provides the volume backup domain classes and relationship', function () {
     expect(class_exists(ScheduledVolumeBackup::class))->toBeTrue()
         ->and(class_exists(ScheduledVolumeBackupExecution::class))->toBeTrue()

From 2018e7f32910de6ee059fd153ae1172fc3300594 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 1 Sep 2026 11:14:24 +0200
Subject: [PATCH 24/55] Validate build-time environment variable names before
 writing the build .env file (#11575)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
---
 app/Jobs/ApplicationDeploymentJob.php         | 241 ++++++++++--
 app/Support/ValidationPatterns.php            |  42 ++
 ...ationDeploymentControlVarFilteringTest.php | 359 +++++++++++++++++-
 tests/Unit/ValidationPatternsTest.php         |  27 ++
 4 files changed, 625 insertions(+), 44 deletions(-)

diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index 6d68160ce..88036f519 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -44,6 +44,10 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     public const BUILD_TIME_ENV_PATH = '/artifacts/build-time.env';
 
+    public const BUILD_TIME_SHELL_ENV_PATH = '/artifacts/build-time-shell.env';
+
+    public const BUILD_TIME_ENV_LAUNCHER_PATH = '/artifacts/run-with-build-time-env';
+
     private const BUILD_SCRIPT_PATH = '/artifacts/build.sh';
 
     private const NIXPACKS_PLAN_PATH = '/artifacts/thegameplan.json';
@@ -201,6 +205,10 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     private bool $dockerSecretsSupported = false;
 
+    private bool $dockerSecretsAvailable = false;
+
+    private bool $useBuildtimeEnvironmentLauncher = false;
+
     private bool $skip_build = false;
 
     private Collection|string $build_secrets;
@@ -418,6 +426,11 @@ public function handle(): void
 
     private function detectBuildKitCapabilities(): void
     {
+        $this->dockerBuildkitSupported = false;
+        $this->dockerBuildxAvailable = false;
+        $this->dockerSecretsSupported = false;
+        $this->dockerSecretsAvailable = false;
+
         $serverToCheck = $this->use_build_server ? $this->build_server : $this->server;
         $serverName = $this->use_build_server ? "build server ({$serverToCheck->name})" : "deployment server ({$serverToCheck->name})";
 
@@ -468,18 +481,19 @@ private function detectBuildKitCapabilities(): void
                 }
             }
 
-            // If build secrets are enabled and BuildKit is available, verify --secret flag support
-            if ($this->application->settings->use_build_secrets && $this->dockerBuildkitSupported) {
+            if ($this->dockerBuildkitSupported) {
                 $secretsTest = instant_remote_process(
                     ["docker build --help 2>&1 | grep -q 'secret' && echo 'supported' || echo 'not-supported'"],
                     $serverToCheck
                 );
 
                 if (trim($secretsTest) === 'supported') {
-                    $this->dockerSecretsSupported = true;
-                    $this->application_deployment_queue->addLogEntry('Build secrets are enabled and will be used for enhanced security.');
-                } else {
-                    $this->dockerSecretsSupported = false;
+                    $this->dockerSecretsAvailable = true;
+                    if ($this->application->settings->use_build_secrets) {
+                        $this->dockerSecretsSupported = true;
+                        $this->application_deployment_queue->addLogEntry('Build secrets are enabled and will be used for enhanced security.');
+                    }
+                } elseif ($this->application->settings->use_build_secrets) {
                     $this->application_deployment_queue->addLogEntry("Docker on {$serverName} does not support build secrets. Using traditional build arguments.");
                 }
             }
@@ -487,6 +501,7 @@ private function detectBuildKitCapabilities(): void
             $this->dockerBuildkitSupported = false;
             $this->dockerBuildxAvailable = false;
             $this->dockerSecretsSupported = false;
+            $this->dockerSecretsAvailable = false;
             $this->application_deployment_queue->addLogEntry("Could not detect BuildKit capabilities on {$serverName}: {$e->getMessage()}");
         }
     }
@@ -1631,11 +1646,14 @@ private function generate_buildtime_environment_variables()
                 }
 
                 foreach ($planVariables as $key => $value) {
+                    $key = (string) $key;
+
                     // Skip COOLIFY_* and SERVICE_* - they'll be added later with higher priority
                     if (str_starts_with($key, 'COOLIFY_') || str_starts_with($key, 'SERVICE_')) {
                         continue;
                     }
 
+                    $key = $this->validatedBuildtimeEnvironmentVariableKey($key, 'the Nixpacks plan');
                     $escapedValue = escapeBashEnvValue($value);
                     $envs_dict[$key] = $escapedValue;
 
@@ -1823,6 +1841,7 @@ private function generate_buildtime_environment_variables()
         // Convert dictionary back to collection in KEY=VALUE format
         $envs = collect([]);
         foreach ($envs_dict as $key => $value) {
+            $key = $this->validatedBuildtimeEnvironmentVariableKey((string) $key, 'the build-time environment');
             $envs->push($key.'='.$value);
         }
 
@@ -1836,44 +1855,130 @@ private function generate_buildtime_environment_variables()
         return $envs;
     }
 
-    private function save_buildtime_environment_variables()
+    private function validatedBuildtimeEnvironmentVariableKey(string $key, string $origin): string
     {
-        // Generate build-time environment variables locally
-        $environment_variables = $this->generate_buildtime_environment_variables();
-
-        // Save .env file for build phase in /artifacts to prevent it from being copied into Docker images
-        if ($environment_variables->isNotEmpty()) {
-            $envs_base64 = base64_encode($environment_variables->implode("\n"));
-
-            $this->application_deployment_queue->addLogEntry('Creating build-time .env file in /artifacts (outside Docker context).', hidden: true);
-
-            $this->execute_remote_command(
-                [
-                    executeInDocker($this->deployment_uuid, "echo '$envs_base64' | base64 -d | tee ".self::BUILD_TIME_ENV_PATH.' > /dev/null'),
-                ]
-            );
-
-            if (isDev()) {
-                $this->execute_remote_command(
-                    [
-                        executeInDocker($this->deployment_uuid, 'cat '.self::BUILD_TIME_ENV_PATH),
-                        'hidden' => true,
-                    ]
-                );
+        try {
+            if (! ValidationPatterns::isValidEnvironmentVariableKey($key)) {
+                throw new \InvalidArgumentException('Invalid build-time environment variable key.');
             }
-        } elseif (in_array($this->build_pack, ['dockercompose', 'dockerfile', 'railpack'], true)) {
-            // For build packs that source the build-time .env file, create an empty file even if there are no build-time variables
-            // This ensures the file exists when referenced in build commands
-            $this->application_deployment_queue->addLogEntry('Creating empty build-time .env file in /artifacts (no build-time variables defined).', hidden: true);
 
-            $this->execute_remote_command(
-                [
-                    executeInDocker($this->deployment_uuid, 'touch '.self::BUILD_TIME_ENV_PATH),
-                ]
+            return $key;
+        } catch (\InvalidArgumentException $exception) {
+            $this->logInvalidBuildtimeEnvironmentVariableKey($key, $origin);
+
+            throw new DeploymentException(
+                "Invalid environment variable name from {$origin}: ".ValidationPatterns::displayShellEnvironmentVariableKey($key).'. Names must start with a letter or underscore and contain only letters, numbers, underscores, and dots.',
+                previous: $exception,
             );
         }
     }
 
+    private function logInvalidBuildtimeEnvironmentVariableKey(string $key, string $origin): void
+    {
+        $displayKey = ValidationPatterns::displayShellEnvironmentVariableKey($key);
+
+        $this->application_deployment_queue->addLogEntry('----------------------------------------', 'stderr');
+        $this->application_deployment_queue->addLogEntry("⚠️ Invalid environment variable name from {$origin}: {$displayKey}", 'stderr');
+        $this->application_deployment_queue->addLogEntry('Build-time variable names must start with a letter or underscore and contain only letters, numbers, underscores, and dots.', 'stderr');
+        $this->application_deployment_queue->addLogEntry('💡 How to fix:', type: 'info');
+
+        if ($origin === 'the Nixpacks plan') {
+            $this->application_deployment_queue->addLogEntry('   1. Open nixpacks.toml and check the [variables] section. Quoted keys can contain characters that are not valid environment variable names.', type: 'info');
+            $this->application_deployment_queue->addLogEntry('   2. Rename the key to a plain name like MY_VARIABLE (no spaces, shell syntax, or command substitutions).', type: 'info');
+            $this->logSuggestedShellEnvironmentVariableKey($key);
+            $this->application_deployment_queue->addLogEntry('   3. Commit, push, and redeploy.', type: 'info');
+            $this->application_deployment_queue->addLogEntry('Docs: https://nixpacks.com/docs/configuration/file', type: 'info');
+        } else {
+            $this->application_deployment_queue->addLogEntry('   Rename the environment variable to use only letters, numbers, and underscores, then redeploy.', type: 'info');
+            $this->logSuggestedShellEnvironmentVariableKey($key);
+        }
+
+        $this->application_deployment_queue->addLogEntry('----------------------------------------', 'stderr');
+    }
+
+    private function logSuggestedShellEnvironmentVariableKey(string $key): void
+    {
+        $suggestedKey = str_replace('.', '_', $key);
+        if ($suggestedKey === $key || preg_match(ValidationPatterns::SHELL_ENVIRONMENT_VARIABLE_KEY_PATTERN, $suggestedKey) !== 1) {
+            return;
+        }
+
+        $displaySuggestedKey = ValidationPatterns::displayShellEnvironmentVariableKey($suggestedKey);
+
+        $this->application_deployment_queue->addLogEntry("   Suggested name: {$displaySuggestedKey}", type: 'info');
+    }
+
+    private function save_buildtime_environment_variables()
+    {
+        $environment_variables = $this->generate_buildtime_environment_variables();
+        [$shell_environment_variables, $dotted_environment_variables] = $environment_variables->partition(function (string $environmentVariable): bool {
+            [$key] = explode('=', $environmentVariable, 2);
+
+            return preg_match(ValidationPatterns::SHELL_ENVIRONMENT_VARIABLE_KEY_PATTERN, $key) === 1;
+        });
+
+        if ($dotted_environment_variables->isEmpty()) {
+            $this->useBuildtimeEnvironmentLauncher = false;
+
+            if ($environment_variables->isNotEmpty()) {
+                $envs_base64 = base64_encode($environment_variables->implode("\n"));
+
+                $this->application_deployment_queue->addLogEntry('Creating build-time .env file in /artifacts (outside Docker context).', hidden: true);
+                $this->execute_remote_command([
+                    executeInDocker($this->deployment_uuid, "echo '$envs_base64' | base64 -d | tee ".self::BUILD_TIME_ENV_PATH.' > /dev/null'),
+                ]);
+
+                if (isDev()) {
+                    $this->execute_remote_command([
+                        executeInDocker($this->deployment_uuid, 'cat '.self::BUILD_TIME_ENV_PATH),
+                        'hidden' => true,
+                    ]);
+                }
+            } elseif (in_array($this->build_pack, ['dockercompose', 'dockerfile', 'railpack'], true)) {
+                $this->application_deployment_queue->addLogEntry('Creating empty build-time .env file in /artifacts (no build-time variables defined).', hidden: true);
+                $this->execute_remote_command([
+                    executeInDocker($this->deployment_uuid, 'touch '.self::BUILD_TIME_ENV_PATH),
+                ]);
+            }
+
+            return;
+        }
+
+        $this->useBuildtimeEnvironmentLauncher = true;
+
+        $launcher = [
+            '#!/bin/bash',
+            'set -a',
+            'source '.self::BUILD_TIME_SHELL_ENV_PATH,
+            'set +a',
+        ];
+
+        $launcher[] = 'exec env \\';
+        foreach ($dotted_environment_variables as $environmentVariable) {
+            $launcher[] = "    {$environmentVariable} \\";
+        }
+        $launcher[] = '    "$@"';
+
+        $files = [
+            self::BUILD_TIME_ENV_PATH => $environment_variables->implode("\n"),
+            self::BUILD_TIME_SHELL_ENV_PATH => $shell_environment_variables->implode("\n"),
+            self::BUILD_TIME_ENV_LAUNCHER_PATH => implode("\n", $launcher)."\n",
+        ];
+
+        $this->application_deployment_queue->addLogEntry('Creating build-time environment files in /artifacts (outside Docker context).', hidden: true);
+
+        foreach ($files as $path => $contents) {
+            $contents_base64 = base64_encode($contents);
+            $this->execute_remote_command([
+                executeInDocker($this->deployment_uuid, "echo '$contents_base64' | base64 -d | tee {$path} > /dev/null"),
+            ]);
+        }
+
+        $this->execute_remote_command([
+            executeInDocker($this->deployment_uuid, 'chmod 700 '.self::BUILD_TIME_ENV_LAUNCHER_PATH),
+        ]);
+    }
+
     private function elixir_finetunes()
     {
         if ($this->pull_request_id === 0) {
@@ -3653,7 +3758,13 @@ private function build_static_image()
      */
     private function wrap_build_command_with_env_export(string $build_command): string
     {
-        return "cd {$this->workdir} && set -a && source ".self::BUILD_TIME_ENV_PATH." && set +a && {$build_command}";
+        if (! $this->useBuildtimeEnvironmentLauncher) {
+            return "cd {$this->workdir} && set -a && source ".self::BUILD_TIME_ENV_PATH." && set +a && {$build_command}";
+        }
+
+        $escapedBuildCommand = escapeBashEnvValue($build_command);
+
+        return "cd {$this->workdir} && bash ".self::BUILD_TIME_ENV_LAUNCHER_PATH." /bin/bash -c {$escapedBuildCommand}";
     }
 
     private function build_image()
@@ -4176,6 +4287,21 @@ private function generate_build_env_variables()
             $this->analyzeBuildTimeVariables($variables);
         }
 
+        $requiresDottedEnvironmentSecrets = $this->application->build_pack === 'nixpacks'
+            && $variables->keys()->contains(fn ($key): bool => str_contains((string) $key, '.'));
+
+        if ($requiresDottedEnvironmentSecrets) {
+            if (! $this->dockerSecretsAvailable) {
+                $dottedKeys = $variables->keys()
+                    ->filter(fn ($key): bool => str_contains((string) $key, '.'))
+                    ->implode(', ');
+
+                throw new DeploymentException("Dotted Nixpacks build-time environment variable names require Docker BuildKit secret support: {$dottedKeys}. Rename these keys to use underscores instead of dots, or upgrade Docker on the build server.");
+            }
+
+            $this->dockerSecretsSupported = true;
+        }
+
         if ($this->dockerSecretsSupported) {
             $this->generate_build_secrets($variables);
             $this->build_args = '';
@@ -4440,7 +4566,7 @@ private function add_build_env_variables_to_dockerfile()
     private function modify_dockerfile_for_secrets($dockerfile_path)
     {
         // Only process if build secrets are enabled and we have secrets to mount
-        if (! $this->application->settings->use_build_secrets || empty($this->build_secrets)) {
+        if (empty($this->build_secrets)) {
             return;
         }
 
@@ -4464,18 +4590,51 @@ private function modify_dockerfile_for_secrets($dockerfile_path)
             $this->generate_env_variables();
         }
 
-        $variables = $this->env_args;
+        $variables = $this->application->build_pack === 'nixpacks'
+            ? collect($this->nixpacks_plan_json->get('variables'))
+            : $this->env_args;
         if ($variables->isEmpty()) {
             return;
         }
 
+        $dottedKeys = $variables->keys()
+            ->map(fn ($key): string => (string) $key)
+            ->filter(fn (string $key): bool => str_contains($key, '.'));
+
+        if ($dottedKeys->isNotEmpty()) {
+            $originalDockerfile = $dockerfile;
+            $dockerfile = $dockerfile->map(function (string $line) use ($dottedKeys): ?string {
+                $trimmedLine = trim($line);
+
+                if (! str_starts_with($trimmedLine, 'ARG ') && ! str_starts_with($trimmedLine, 'ENV ')) {
+                    return $line;
+                }
+
+                [$instruction, $arguments] = explode(' ', $trimmedLine, 2);
+                $filteredArguments = collect(preg_split('/\s+/', $arguments))
+                    ->reject(function (string $argument) use ($dottedKeys): bool {
+                        $key = str($argument)->before('=')->toString();
+
+                        return $dottedKeys->contains($key);
+                    });
+
+                if ($filteredArguments->isEmpty()) {
+                    return null;
+                }
+
+                return $instruction.' '.$filteredArguments->implode(' ');
+            })->filter()->values();
+
+            $modified = $dockerfile->all() !== $originalDockerfile->values()->all();
+        }
+
         // Generate mount strings for all secrets
         $mountStrings = $variables->map(fn ($value, $key) => "--mount=type=secret,id={$key},env={$key}")->implode(' ');
 
         // Add mount for the secrets hash to ensure cache invalidation
         $mountStrings .= ' --mount=type=secret,id=COOLIFY_BUILD_SECRETS_HASH,env=COOLIFY_BUILD_SECRETS_HASH';
 
-        $modified = false;
+        $modified ??= false;
         $dockerfile = $dockerfile->map(function ($line) use ($mountStrings, &$modified) {
             $trimmed = ltrim($line);
 
diff --git a/app/Support/ValidationPatterns.php b/app/Support/ValidationPatterns.php
index 5c02b8426..cb1a0de62 100644
--- a/app/Support/ValidationPatterns.php
+++ b/app/Support/ValidationPatterns.php
@@ -108,6 +108,11 @@ class ValidationPatterns
      */
     public const ENVIRONMENT_VARIABLE_KEY_PATTERN = '/\A[A-Za-z_][A-Za-z0-9_.]*\z/u';
 
+    /**
+     * Pattern for environment variable keys written to shell-sourced files.
+     */
+    public const SHELL_ENVIRONMENT_VARIABLE_KEY_PATTERN = '/\A[A-Za-z_][A-Za-z0-9_]*\z/u';
+
     /**
      * Characters that are valid in some URL positions but unsafe for values
      * that are later reused in shell assignment contexts.
@@ -192,6 +197,43 @@ public static function isValidEnvironmentVariableKey(string $value): bool
         return preg_match(self::ENVIRONMENT_VARIABLE_KEY_PATTERN, $value) === 1;
     }
 
+    /**
+     * Make an environment variable key safe to show in deployment logs.
+     *
+     * Control characters are escaped and long values are truncated so an
+     * unexpected key cannot corrupt or overflow the deployment log output.
+     */
+    public static function displayShellEnvironmentVariableKey(string $value, int $maxLength = 80): string
+    {
+        $printable = str($value)
+            ->replace(["\0", "\r", "\n", "\t"], ['\\0', '\\r', '\\n', '\\t'])
+            ->value();
+
+        $printable = preg_replace_callback(
+            '/[\x00-\x1F\x7F]/',
+            fn (array $matches): string => sprintf('\\x%02X', ord($matches[0])),
+            $printable,
+        );
+
+        if ($printable === '') {
+            return '(empty)';
+        }
+
+        return str($printable)->limit($maxLength)->value();
+    }
+
+    /**
+     * Validate an environment variable key before writing it to a shell-sourced file.
+     */
+    public static function validatedShellEnvironmentVariableKey(string $value): string
+    {
+        if (preg_match(self::SHELL_ENVIRONMENT_VARIABLE_KEY_PATTERN, $value) !== 1) {
+            throw new \InvalidArgumentException('Invalid environment variable name '.self::displayShellEnvironmentVariableKey($value).'. Names must start with a letter or underscore and contain only letters, numbers, and underscores.');
+        }
+
+        return $value;
+    }
+
     /**
      * Check if a string is a valid S3 bucket name.
      */
diff --git a/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php b/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
index 83244c567..87b3407cb 100644
--- a/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
+++ b/tests/Feature/ApplicationDeploymentControlVarFilteringTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Exceptions\DeploymentException;
 use App\Jobs\ApplicationDeploymentJob;
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
@@ -11,6 +12,7 @@
 use App\Models\Team;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Collection;
+use Symfony\Component\Process\Process;
 
 uses(RefreshDatabase::class);
 
@@ -18,6 +20,10 @@ class TestableControlVarFilteringDeploymentJob extends ApplicationDeploymentJob
 {
     public array $recordedCommands = [];
 
+    public array $recordedLogEntries = [];
+
+    public array $writtenArtifacts = [];
+
     public ?string $writtenDockerfile = null;
 
     public function __construct() {}
@@ -36,6 +42,10 @@ public function execute_remote_command(...$commands)
             if (preg_match('/echo .*?([A-Za-z0-9+\\/=]{16,}).*?\\| base64 -d \\| tee \\/artifacts\\/test-app\\/Dockerfile > \\/dev\\/null/', $commandString, $matches) === 1) {
                 $this->writtenDockerfile = base64_decode($matches[1]) ?: null;
             }
+
+            if (preg_match('~echo .*?([A-Za-z0-9+/=]{8,}).*?\\| base64 -d \\| tee (/artifacts/[^ ]+) > /dev/null~', $commandString, $matches) === 1) {
+                $this->writtenArtifacts[$matches[2]] = base64_decode($matches[1]);
+            }
         }
     }
 }
@@ -92,7 +102,11 @@ function makeControlVarFilteringJob(Application $application, Server $server, ar
     $reflection = new ReflectionClass(ApplicationDeploymentJob::class);
 
     $queue = Mockery::mock(ApplicationDeploymentQueue::class);
-    $queue->shouldReceive('addLogEntry')->andReturnNull();
+    $queue->shouldReceive('addLogEntry')->andReturnUsing(function (string $message, string $type = 'stdout', bool $hidden = false) use ($job) {
+        $job->recordedLogEntries[] = $message;
+
+        return null;
+    });
 
     $properties = [
         'application' => $application->fresh(),
@@ -130,12 +144,12 @@ function makeControlVarFilteringJob(Application $application, Server $server, ar
     return [$job, $reflection];
 }
 
-function invokeDeploymentJobMethod(object $job, ReflectionClass $reflection, string $method): mixed
+function invokeDeploymentJobMethod(object $job, ReflectionClass $reflection, string $method, mixed ...$arguments): mixed
 {
     $reflectionMethod = $reflection->getMethod($method);
     $reflectionMethod->setAccessible(true);
 
-    return $reflectionMethod->invoke($job);
+    return $reflectionMethod->invoke($job, ...$arguments);
 }
 
 function readDeploymentJobProperty(object $job, ReflectionClass $reflection, string $property): mixed
@@ -205,6 +219,345 @@ function readDeploymentJobProperty(object $job, ReflectionClass $reflection, str
     expect($buildtimeEnvs->contains(fn (string $env) => str($env)->startsWith('RAILPACK_NODE_VERSION=')))->toBeFalse();
 });
 
+it('rejects unsafe Nixpacks plan variable keys before writing the build-time env file', function (string $key) {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                $key => 'value',
+            ],
+        ]),
+    ]);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables'))
+        ->toThrow(DeploymentException::class);
+})->with([
+    'command substitution' => 'X$(id)',
+    'backticks' => 'X`id`',
+    'newline' => "X\nid",
+    'shell assignment' => 'X=value',
+    'semicolon' => 'X;id',
+    'pipe' => 'X|id',
+    'ampersand' => 'X&id',
+    'leading dollar' => '$(id)',
+    'command substitution with arguments' => 'X$(docker run --rm -v /:/mnt alpine true)',
+]);
+
+it('keeps persisted dotted user build-time variable keys', function () {
+    [$application, $server] = makeDeploymentControlVarFixture();
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'X.VALUE',
+        'value' => 'unsafe',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server);
+
+    /** @var Collection $buildtimeEnvs */
+    $buildtimeEnvs = invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables');
+
+    expect($buildtimeEnvs)->toContain('X.VALUE="unsafe"');
+});
+
+it('loads shell variables and passes dotted variables through the build-time environment launcher', function () {
+    $temporaryDirectory = sys_get_temp_dir().'/coolify-build-env-'.str()->random(8);
+    expect(mkdir($temporaryDirectory))->toBeTrue();
+    $shellEnvironmentPath = $temporaryDirectory.'/build-time-shell.env';
+    $launcherPath = $temporaryDirectory.'/run-with-build-time-env';
+    $injectionMarkerPath = $temporaryDirectory.'/injection-marker';
+
+    try {
+        [$application, $server] = makeDeploymentControlVarFixture();
+
+        createApplicationEnvironmentVariable($application, [
+            'key' => 'BASE_VALUE',
+            'value' => 'expanded',
+        ]);
+        createApplicationEnvironmentVariable($application, [
+            'key' => 'X.VALUE',
+            'value' => '$BASE_VALUE',
+        ]);
+        createApplicationEnvironmentVariable($application, [
+            'key' => 'DOTTED.VALUE',
+            'value' => "$(touch {$injectionMarkerPath})",
+        ]);
+
+        [$job, $reflection] = makeControlVarFilteringJob($application, $server);
+
+        invokeDeploymentJobMethod($job, $reflection, 'save_buildtime_environment_variables');
+
+        expect($job->writtenArtifacts[ApplicationDeploymentJob::BUILD_TIME_ENV_PATH])
+            ->toContain('BASE_VALUE="expanded"')
+            ->toContain('X.VALUE="$BASE_VALUE"');
+        expect($job->writtenArtifacts[ApplicationDeploymentJob::BUILD_TIME_SHELL_ENV_PATH])
+            ->toContain('BASE_VALUE="expanded"')
+            ->not->toContain('X.VALUE');
+        expect($job->writtenArtifacts[ApplicationDeploymentJob::BUILD_TIME_ENV_LAUNCHER_PATH])
+            ->toContain('source '.ApplicationDeploymentJob::BUILD_TIME_SHELL_ENV_PATH)
+            ->toContain('X.VALUE="$BASE_VALUE"')
+            ->toContain('exec env');
+
+        $wrappedCommand = invokeDeploymentJobMethod($job, $reflection, 'wrap_build_command_with_env_export', 'printenv X.VALUE');
+
+        expect($wrappedCommand)
+            ->toContain(ApplicationDeploymentJob::BUILD_TIME_ENV_LAUNCHER_PATH)
+            ->toContain("/bin/bash -c 'printenv X.VALUE'")
+            ->not->toContain('source '.ApplicationDeploymentJob::BUILD_TIME_ENV_PATH);
+
+        file_put_contents($shellEnvironmentPath, $job->writtenArtifacts[ApplicationDeploymentJob::BUILD_TIME_SHELL_ENV_PATH]);
+        file_put_contents(
+            $launcherPath,
+            str_replace(
+                'source '.ApplicationDeploymentJob::BUILD_TIME_SHELL_ENV_PATH,
+                'source '.$shellEnvironmentPath,
+                $job->writtenArtifacts[ApplicationDeploymentJob::BUILD_TIME_ENV_LAUNCHER_PATH],
+            ),
+        );
+        chmod($launcherPath, 0700);
+
+        $process = new Process(['/bin/bash', $launcherPath, '/bin/bash', '-c', 'printenv X.VALUE; printenv DOTTED.VALUE']);
+        $process->mustRun();
+
+        expect($process->getOutput())
+            ->toContain("expanded\n")
+            ->toContain("$(touch {$injectionMarkerPath})");
+        expect(file_exists($injectionMarkerPath))->toBeFalse();
+    } finally {
+        @unlink($launcherPath);
+        @unlink($shellEnvironmentPath);
+        @unlink($injectionMarkerPath);
+        @rmdir($temporaryDirectory);
+    }
+});
+
+it('keeps the original sourced environment path when build-time keys are shell safe', function () {
+    [$application, $server] = makeDeploymentControlVarFixture();
+
+    createApplicationEnvironmentVariable($application, [
+        'key' => 'SAFE_VALUE',
+        'value' => 'safe',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server);
+
+    invokeDeploymentJobMethod($job, $reflection, 'save_buildtime_environment_variables');
+
+    expect($job->writtenArtifacts)
+        ->toHaveKey(ApplicationDeploymentJob::BUILD_TIME_ENV_PATH)
+        ->not->toHaveKey(ApplicationDeploymentJob::BUILD_TIME_SHELL_ENV_PATH)
+        ->not->toHaveKey(ApplicationDeploymentJob::BUILD_TIME_ENV_LAUNCHER_PATH);
+
+    $wrappedCommand = invokeDeploymentJobMethod($job, $reflection, 'wrap_build_command_with_env_export', 'docker build .');
+
+    expect($wrappedCommand)
+        ->toContain('set -a && source '.ApplicationDeploymentJob::BUILD_TIME_ENV_PATH.' && set +a && docker build .')
+        ->not->toContain(ApplicationDeploymentJob::BUILD_TIME_ENV_LAUNCHER_PATH);
+});
+
+it('uses BuildKit secrets for dotted Nixpacks variables instead of invalid Dockerfile expansion', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'dockerBuildkitSupported' => true,
+        'dockerSecretsAvailable' => true,
+        'env_args' => collect(['X.VALUE' => 'dotted-buildtime-ok']),
+        'nixpacks_plan_json' => collect([
+            'variables' => ['X.VALUE' => 'dotted-buildtime-ok'],
+        ]),
+        'saved_outputs' => collect([
+            'dockerfile_content' => "FROM alpine\nARG SAFE X.VALUE\nENV SAFE=\$SAFE X.VALUE=\$X.VALUE\nRUN printenv X.VALUE",
+        ]),
+    ]);
+
+    invokeDeploymentJobMethod($job, $reflection, 'generate_build_env_variables');
+
+    expect(readDeploymentJobProperty($job, $reflection, 'dockerSecretsSupported'))->toBeTrue();
+    expect(readDeploymentJobProperty($job, $reflection, 'build_secrets'))->toContain('--secret id=X.VALUE,env=X.VALUE');
+
+    invokeDeploymentJobMethod($job, $reflection, 'modify_dockerfile_for_secrets', '/artifacts/test-app/.nixpacks/Dockerfile');
+
+    $dockerfile = $job->writtenArtifacts['/artifacts/test-app/.nixpacks/Dockerfile'];
+
+    expect($dockerfile)
+        ->not->toContain('ARG X.VALUE')
+        ->not->toContain('X.VALUE=$X.VALUE')
+        ->toContain('ARG SAFE')
+        ->toContain('ENV SAFE=$SAFE')
+        ->toContain('RUN --mount=type=secret,id=X.VALUE,env=X.VALUE')
+        ->toContain('printenv X.VALUE');
+});
+
+it('rejects dotted Nixpacks variables when Docker build secrets are unavailable', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'dockerBuildkitSupported' => true,
+        'dockerSecretsAvailable' => false,
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                'X.VALUE' => 'dotted-buildtime-ok',
+                'ANOTHER.DOTTED.VALUE' => 'also-dotted',
+            ],
+        ]),
+    ]);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'generate_build_env_variables'))
+        ->toThrow(
+            DeploymentException::class,
+            'Dotted Nixpacks build-time environment variable names require Docker BuildKit secret support: X.VALUE, ANOTHER.DOTTED.VALUE. Rename these keys to use underscores instead of dots, or upgrade Docker on the build server.'
+        );
+});
+
+it('writes dotted Nixpacks ARG and ENV removal when the Dockerfile has no run command', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'env_args' => collect(['X.VALUE' => 'dotted-buildtime-ok']),
+        'nixpacks_plan_json' => collect([
+            'variables' => ['X.VALUE' => 'dotted-buildtime-ok'],
+        ]),
+        'build_secrets' => '--secret id=X.VALUE,env=X.VALUE',
+        'saved_outputs' => collect([
+            'dockerfile_content' => "FROM alpine\nARG X.VALUE=default\nENV X.VALUE=\$X.VALUE",
+        ]),
+    ]);
+
+    invokeDeploymentJobMethod($job, $reflection, 'modify_dockerfile_for_secrets', '/artifacts/test-app/.nixpacks/Dockerfile');
+
+    expect($job->writtenArtifacts['/artifacts/test-app/.nixpacks/Dockerfile'])
+        ->not->toContain('X.VALUE');
+});
+
+it('skips unsafe reserved Nixpacks plan variable keys before validation', function (string $key) {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                $key => 'value',
+            ],
+        ]),
+    ]);
+
+    /** @var Collection $buildtimeEnvs */
+    $buildtimeEnvs = invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables');
+
+    expect($buildtimeEnvs->contains(fn (string $env) => str($env)->startsWith($key.'=')))->toBeFalse();
+})->with([
+    'Coolify key' => 'COOLIFY_$(id)',
+    'service key' => 'SERVICE_$(id)',
+]);
+
+it('explains invalid Nixpacks plan variable keys in deployment logs', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                'XPACK;SECURITY;ENABLED' => 'true',
+            ],
+        ]),
+    ]);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables'))
+        ->toThrow(DeploymentException::class, 'Invalid environment variable name from the Nixpacks plan: XPACK;SECURITY;ENABLED');
+
+    $logs = implode("\n", $job->recordedLogEntries);
+
+    expect($logs)
+        ->toContain('Invalid environment variable name from the Nixpacks plan: XPACK;SECURITY;ENABLED')
+        ->toContain('must start with a letter or underscore')
+        ->toContain('How to fix')
+        ->toContain('nixpacks.toml')
+        ->toContain('https://nixpacks.com/docs/configuration/file');
+});
+
+it('truncates long Nixpacks plan variable keys in deployment logs', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    $key = 'X$(docker run --rm alpine sh -c "'.str_repeat('a', 200).'TAIL_SHOULD_BE_TRUNCATED")';
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                $key => 'x',
+            ],
+        ]),
+    ]);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables'))
+        ->toThrow(DeploymentException::class);
+
+    $logs = implode("\n", $job->recordedLogEntries);
+
+    expect($logs)
+        ->toContain('Invalid environment variable name from the Nixpacks plan: X$(docker run --rm')
+        ->toContain('...')
+        ->not->toContain('TAIL_SHOULD_BE_TRUNCATED')
+        ->toContain('nixpacks.toml');
+});
+
+it('bounds every deployment log entry for long invalid Nixpacks variable keys', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    $key = 'X'.str_repeat('$', 10_000);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                $key => 'x',
+            ],
+        ]),
+    ]);
+
+    expect(fn () => invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables'))
+        ->toThrow(DeploymentException::class);
+
+    $longestLogEntryLength = max(array_map(strlen(...), $job->recordedLogEntries));
+
+    expect($longestLogEntryLength)->toBeLessThanOrEqual(200);
+});
+
+it('keeps shell-safe Nixpacks plan variables in the build-time env file', function () {
+    [$application, $server] = makeDeploymentControlVarFixture([
+        'build_pack' => 'nixpacks',
+    ]);
+
+    [$job, $reflection] = makeControlVarFilteringJob($application, $server, [
+        'nixpacks_plan_json' => collect([
+            'variables' => [
+                'APP_NAME' => 'coolify',
+                '_PRIVATE_VALUE' => 'secret',
+                'X.VALUE' => 'dotted',
+            ],
+        ]),
+    ]);
+
+    /** @var Collection $buildtimeEnvs */
+    $buildtimeEnvs = invokeDeploymentJobMethod($job, $reflection, 'generate_buildtime_environment_variables');
+
+    expect($buildtimeEnvs)->toContain("APP_NAME='coolify'")
+        ->toContain("_PRIVATE_VALUE='secret'")
+        ->toContain("X.VALUE='dotted'");
+});
+
 it('does not let preview docker compose service names override generated build-time service names', function () {
     $compose = <<<'YAML'
 services:
diff --git a/tests/Unit/ValidationPatternsTest.php b/tests/Unit/ValidationPatternsTest.php
index 0b3252d7e..c0591cb6a 100644
--- a/tests/Unit/ValidationPatternsTest.php
+++ b/tests/Unit/ValidationPatternsTest.php
@@ -161,6 +161,33 @@
     'empty' => '',
 ]);
 
+it('accepts shell-safe keys for sourced build-time env files', function (string $key) {
+    expect(ValidationPatterns::validatedShellEnvironmentVariableKey($key))->toBe($key);
+})->with([
+    'letters' => 'APP_ENV',
+    'leading underscore' => '_TOKEN',
+    'digits after first character' => 'NODE_VERSION_20',
+]);
+
+it('rejects keys that bash would interpret when sourcing a build-time env file', function (string $key) {
+    expect(fn () => ValidationPatterns::validatedShellEnvironmentVariableKey($key))
+        ->toThrow(InvalidArgumentException::class);
+})->with([
+    'command substitution' => 'X$(id)',
+    'dot notation' => 'X.VALUE',
+    'command substitution with arguments' => 'X$(docker run --rm -v /:/mnt alpine true)',
+]);
+
+it('makes unsafe environment variable keys safe to show in logs', function () {
+    expect(ValidationPatterns::displayShellEnvironmentVariableKey('APP_ENV'))->toBe('APP_ENV');
+    expect(ValidationPatterns::displayShellEnvironmentVariableKey("X\nid"))->toBe('X\\nid');
+    expect(ValidationPatterns::displayShellEnvironmentVariableKey("X\e[2Jid\x7F"))->toBe('X\\x1B[2Jid\\x7F');
+    expect(ValidationPatterns::displayShellEnvironmentVariableKey(''))->toBe('(empty)');
+    expect(ValidationPatterns::displayShellEnvironmentVariableKey(str_repeat('A', 100)))
+        ->toEndWith('...')
+        ->toBe(str_repeat('A', 80).'...');
+});
+
 it('generates environment variable key rules with correct defaults', function () {
     $rules = ValidationPatterns::environmentVariableKeyRules();
 

From 7c3b05e2d2e12b947ec5e608ce260a9948fa7341 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 1 Sep 2026 18:44:18 +0200
Subject: [PATCH 25/55] refactor(livewire): make data-sync helpers private
 (#11578)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
---
 app/Livewire/Destination/Show.php             |   2 +-
 app/Livewire/Notifications/Discord.php        |   7 +-
 app/Livewire/Notifications/Email.php          |   5 +-
 app/Livewire/Notifications/Pushover.php       |   7 +-
 app/Livewire/Notifications/Slack.php          |   7 +-
 app/Livewire/Notifications/Telegram.php       |   7 +-
 app/Livewire/Notifications/Webhook.php        |   7 +-
 app/Livewire/Project/Application/Advanced.php |   2 +-
 app/Livewire/Project/Application/General.php  |   2 +-
 app/Livewire/Project/Application/Source.php   |   2 +-
 app/Livewire/Project/Application/Swarm.php    |   2 +-
 app/Livewire/Project/Database/BackupEdit.php  |   2 +-
 .../Project/Database/Clickhouse/General.php   |   3 +-
 .../Project/Database/Dragonfly/General.php    |   3 +-
 app/Livewire/Project/Database/Health.php      |   2 +-
 .../Project/Database/Keydb/General.php        |   3 +-
 .../Project/Database/Mariadb/General.php      |   3 +-
 .../Project/Database/Mongodb/General.php      |   3 +-
 .../Project/Database/Mysql/General.php        |   3 +-
 .../Project/Database/Postgresql/General.php   |   3 +-
 .../Project/Database/Redis/General.php        |   3 +-
 app/Livewire/Project/Edit.php                 |   2 +-
 app/Livewire/Project/EnvironmentEdit.php      |   2 +-
 app/Livewire/Project/Service/EditDomain.php   |   2 +-
 app/Livewire/Project/Service/FileStorage.php  |   2 +-
 .../Shared/EnvironmentVariable/Show.php       |   2 +-
 app/Livewire/Project/Shared/HealthChecks.php  |   2 +-
 .../Project/Shared/ScheduledTask/Add.php      |   2 +-
 .../Project/Shared/ScheduledTask/Show.php     |   2 +-
 app/Livewire/Server/Advanced.php              |   5 +-
 app/Livewire/Server/DockerCleanup.php         |   5 +-
 app/Livewire/Server/LogDrains.php             |   8 +-
 .../Server/Security/TerminalAccess.php        |   3 +-
 app/Livewire/Server/Sentinel.php              |   5 +-
 app/Livewire/Server/Show.php                  |   7 +-
 app/Livewire/Server/Swarm.php                 |   4 +-
 app/Livewire/SettingsEmail.php                |   2 +-
 .../ApplicationConfigAuthorizationTest.php    |  16 ++
 .../NotificationAuthorizationTest.php         |  64 +++---
 .../ScheduledTaskSyncAuthorizationTest.php    | 180 ++++++++++++++++
 .../Authorization/ServerAuthorizationTest.php |  16 ++
 .../LivewireSyncDataAuthorizationTest.php     | 196 ++++++++++++++++++
 42 files changed, 525 insertions(+), 80 deletions(-)
 create mode 100644 tests/Feature/Authorization/ScheduledTaskSyncAuthorizationTest.php
 create mode 100644 tests/Unit/LivewireSyncDataAuthorizationTest.php

diff --git a/app/Livewire/Destination/Show.php b/app/Livewire/Destination/Show.php
index 63ceebef4..b0ab4d183 100644
--- a/app/Livewire/Destination/Show.php
+++ b/app/Livewire/Destination/Show.php
@@ -43,7 +43,7 @@ public function mount(string $destination_uuid)
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Notifications/Discord.php b/app/Livewire/Notifications/Discord.php
index 71c24e238..8ea4bbc95 100644
--- a/app/Livewire/Notifications/Discord.php
+++ b/app/Livewire/Notifications/Discord.php
@@ -85,11 +85,10 @@ public function mount()
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-            $this->authorize('update', $this->settings);
             $this->settings->discord_enabled = $this->discordEnabled;
             $this->settings->discord_webhook_url = $this->discordWebhookUrl;
 
@@ -174,6 +173,7 @@ public function instantSaveDiscordEnabled()
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -184,6 +184,7 @@ public function submit()
     {
         try {
             $this->resetErrorBag();
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
             $this->saveModel();
         } catch (\Throwable $e) {
@@ -193,6 +194,8 @@ public function submit()
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         refreshSession();
         $this->dispatch('success', 'Settings saved.');
diff --git a/app/Livewire/Notifications/Email.php b/app/Livewire/Notifications/Email.php
index 530583db5..5bd55137b 100644
--- a/app/Livewire/Notifications/Email.php
+++ b/app/Livewire/Notifications/Email.php
@@ -132,12 +132,11 @@ public function mount()
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
             $this->validate(['smtpEhloDomain' => ['nullable', 'string', new ValidHostname]]);
-            $this->authorize('update', $this->settings);
             $this->settings->smtp_enabled = $this->smtpEnabled;
             $this->settings->smtp_from_address = $this->smtpFromAddress;
             $this->settings->smtp_from_name = $this->smtpFromName;
@@ -224,6 +223,8 @@ public function submit()
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         $this->dispatch('success', 'Email notifications settings updated.');
     }
diff --git a/app/Livewire/Notifications/Pushover.php b/app/Livewire/Notifications/Pushover.php
index 04cd82756..7caacdb91 100644
--- a/app/Livewire/Notifications/Pushover.php
+++ b/app/Livewire/Notifications/Pushover.php
@@ -89,11 +89,10 @@ public function mount()
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-            $this->authorize('update', $this->settings);
             $this->settings->pushover_enabled = $this->pushoverEnabled;
             $this->settings->pushover_user_key = $this->pushoverUserKey;
             $this->settings->pushover_api_token = $this->pushoverApiToken;
@@ -167,6 +166,7 @@ public function instantSavePushoverEnabled()
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -179,6 +179,7 @@ public function submit()
     {
         try {
             $this->resetErrorBag();
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
             $this->saveModel();
         } catch (\Throwable $e) {
@@ -188,6 +189,8 @@ public function submit()
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         refreshSession();
         $this->dispatch('success', 'Settings saved.');
diff --git a/app/Livewire/Notifications/Slack.php b/app/Livewire/Notifications/Slack.php
index f4323875f..fe84710bd 100644
--- a/app/Livewire/Notifications/Slack.php
+++ b/app/Livewire/Notifications/Slack.php
@@ -87,11 +87,10 @@ public function mount()
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-            $this->authorize('update', $this->settings);
             $this->settings->slack_enabled = $this->slackEnabled;
             $this->settings->slack_webhook_url = $this->slackWebhookUrl;
 
@@ -158,6 +157,7 @@ public function instantSaveSlackEnabled()
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -170,6 +170,7 @@ public function submit()
     {
         try {
             $this->resetErrorBag();
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
             $this->saveModel();
         } catch (\Throwable $e) {
@@ -179,6 +180,8 @@ public function submit()
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         refreshSession();
         $this->dispatch('success', 'Settings saved.');
diff --git a/app/Livewire/Notifications/Telegram.php b/app/Livewire/Notifications/Telegram.php
index f77b3c3a8..51239b862 100644
--- a/app/Livewire/Notifications/Telegram.php
+++ b/app/Livewire/Notifications/Telegram.php
@@ -134,11 +134,10 @@ public function mount()
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-            $this->authorize('update', $this->settings);
             $this->settings->telegram_enabled = $this->telegramEnabled;
             $this->settings->telegram_token = $this->telegramToken;
             $this->settings->telegram_chat_id = $this->telegramChatId;
@@ -223,6 +222,7 @@ public function syncData(bool $toModel = false)
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -235,6 +235,7 @@ public function submit()
     {
         try {
             $this->resetErrorBag();
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
             $this->saveModel();
         } catch (\Throwable $e) {
@@ -264,6 +265,8 @@ public function instantSaveTelegramEnabled()
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         refreshSession();
         $this->dispatch('success', 'Settings saved.');
diff --git a/app/Livewire/Notifications/Webhook.php b/app/Livewire/Notifications/Webhook.php
index 3461503d4..a3480ada6 100644
--- a/app/Livewire/Notifications/Webhook.php
+++ b/app/Livewire/Notifications/Webhook.php
@@ -82,11 +82,10 @@ public function mount()
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-            $this->authorize('update', $this->settings);
             $this->settings->webhook_enabled = $this->webhookEnabled;
             $this->settings->webhook_url = $this->webhookUrl;
 
@@ -152,6 +151,7 @@ public function instantSaveWebhookEnabled()
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -162,6 +162,7 @@ public function submit()
     {
         try {
             $this->resetErrorBag();
+            $this->authorize('update', $this->settings);
             $this->syncData(true);
             $this->saveModel();
         } catch (\Throwable $e) {
@@ -171,6 +172,8 @@ public function submit()
 
     public function saveModel()
     {
+        $this->authorize('update', $this->settings);
+
         $this->syncData(true);
         refreshSession();
 
diff --git a/app/Livewire/Project/Application/Advanced.php b/app/Livewire/Project/Application/Advanced.php
index bf84f385d..45e284c5d 100644
--- a/app/Livewire/Project/Application/Advanced.php
+++ b/app/Livewire/Project/Application/Advanced.php
@@ -99,7 +99,7 @@ public function mount()
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Application/General.php b/app/Livewire/Project/Application/General.php
index 0c424631f..bb6bcf5f5 100644
--- a/app/Livewire/Project/Application/General.php
+++ b/app/Livewire/Project/Application/General.php
@@ -330,7 +330,7 @@ public function mount()
         $this->syncData();
     }
 
-    public function syncData(bool $toModel = false): void
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Application/Source.php b/app/Livewire/Project/Application/Source.php
index 29f798d59..60a795573 100644
--- a/app/Livewire/Project/Application/Source.php
+++ b/app/Livewire/Project/Application/Source.php
@@ -65,7 +65,7 @@ public function updatedGitCommitSha()
         $this->gitCommitSha = trim($this->gitCommitSha);
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Application/Swarm.php b/app/Livewire/Project/Application/Swarm.php
index 661578fb3..ac867e69a 100644
--- a/app/Livewire/Project/Application/Swarm.php
+++ b/app/Livewire/Project/Application/Swarm.php
@@ -31,7 +31,7 @@ public function mount()
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Database/BackupEdit.php b/app/Livewire/Project/Database/BackupEdit.php
index 2cd0d7673..28f7e0255 100644
--- a/app/Livewire/Project/Database/BackupEdit.php
+++ b/app/Livewire/Project/Database/BackupEdit.php
@@ -128,7 +128,7 @@ public function refreshStatus(): void
         $this->status = $database->status;
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->backup->enabled = $this->backupEnabled;
diff --git a/app/Livewire/Project/Database/Clickhouse/General.php b/app/Livewire/Project/Database/Clickhouse/General.php
index ad5e45b3f..1d8354a4f 100644
--- a/app/Livewire/Project/Database/Clickhouse/General.php
+++ b/app/Livewire/Project/Database/Clickhouse/General.php
@@ -121,7 +121,7 @@ protected function messages(): array
         );
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -199,6 +199,7 @@ public function instantSave()
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Dragonfly/General.php b/app/Livewire/Project/Database/Dragonfly/General.php
index 2f5b84484..a8bde2f00 100644
--- a/app/Livewire/Project/Database/Dragonfly/General.php
+++ b/app/Livewire/Project/Database/Dragonfly/General.php
@@ -115,7 +115,7 @@ protected function messages(): array
         );
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -191,6 +191,7 @@ public function instantSave()
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Health.php b/app/Livewire/Project/Database/Health.php
index 8943e6316..07373bdba 100644
--- a/app/Livewire/Project/Database/Health.php
+++ b/app/Livewire/Project/Database/Health.php
@@ -34,7 +34,7 @@ public function mount(): void
         $this->syncData();
     }
 
-    public function syncData(bool $toModel = false): void
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Database/Keydb/General.php b/app/Livewire/Project/Database/Keydb/General.php
index b2d9bce91..0398362bb 100644
--- a/app/Livewire/Project/Database/Keydb/General.php
+++ b/app/Livewire/Project/Database/Keydb/General.php
@@ -118,7 +118,7 @@ protected function messages(): array
         );
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -196,6 +196,7 @@ public function instantSave()
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Mariadb/General.php b/app/Livewire/Project/Database/Mariadb/General.php
index 61280a34b..4d2dd9d8c 100644
--- a/app/Livewire/Project/Database/Mariadb/General.php
+++ b/app/Livewire/Project/Database/Mariadb/General.php
@@ -136,7 +136,7 @@ public function mount()
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -244,6 +244,7 @@ public function instantSave()
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Mongodb/General.php b/app/Livewire/Project/Database/Mongodb/General.php
index f68ba82c7..d3545564e 100644
--- a/app/Livewire/Project/Database/Mongodb/General.php
+++ b/app/Livewire/Project/Database/Mongodb/General.php
@@ -128,7 +128,7 @@ public function mount()
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -237,6 +237,7 @@ public function instantSave()
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Mysql/General.php b/app/Livewire/Project/Database/Mysql/General.php
index 1adfe2ea7..ce7fc01ec 100644
--- a/app/Livewire/Project/Database/Mysql/General.php
+++ b/app/Livewire/Project/Database/Mysql/General.php
@@ -136,7 +136,7 @@ public function mount()
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -244,6 +244,7 @@ public function instantSave()
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Postgresql/General.php b/app/Livewire/Project/Database/Postgresql/General.php
index 83d6e97df..3d0406956 100644
--- a/app/Livewire/Project/Database/Postgresql/General.php
+++ b/app/Livewire/Project/Database/Postgresql/General.php
@@ -149,7 +149,7 @@ public function mount()
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -240,6 +240,7 @@ public function instantSave(?bool $isPublic = null)
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Database/Redis/General.php b/app/Livewire/Project/Database/Redis/General.php
index d431b1506..7c6313c8d 100644
--- a/app/Livewire/Project/Database/Redis/General.php
+++ b/app/Livewire/Project/Database/Redis/General.php
@@ -127,7 +127,7 @@ public function mount()
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
@@ -235,6 +235,7 @@ public function instantSave()
             }
             $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
+            $this->authorize('update', $this->database);
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
 
diff --git a/app/Livewire/Project/Edit.php b/app/Livewire/Project/Edit.php
index 91b0444f5..0d42c71e9 100644
--- a/app/Livewire/Project/Edit.php
+++ b/app/Livewire/Project/Edit.php
@@ -77,7 +77,7 @@ public function mount(string $project_uuid)
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/EnvironmentEdit.php b/app/Livewire/Project/EnvironmentEdit.php
index 9b9a3670d..35db3167d 100644
--- a/app/Livewire/Project/EnvironmentEdit.php
+++ b/app/Livewire/Project/EnvironmentEdit.php
@@ -48,7 +48,7 @@ public function mount(string $project_uuid, string $environment_uuid)
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Service/EditDomain.php b/app/Livewire/Project/Service/EditDomain.php
index 96fe6a62c..bfcd04ac5 100644
--- a/app/Livewire/Project/Service/EditDomain.php
+++ b/app/Livewire/Project/Service/EditDomain.php
@@ -46,7 +46,7 @@ public function mount()
         $this->syncData();
     }
 
-    public function syncData(bool $toModel = false): void
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Service/FileStorage.php b/app/Livewire/Project/Service/FileStorage.php
index 4520876d1..d6ab2ac15 100644
--- a/app/Livewire/Project/Service/FileStorage.php
+++ b/app/Livewire/Project/Service/FileStorage.php
@@ -120,7 +120,7 @@ public function refreshBackupStatus(): void
             : route('project.application.backup.show', [...$parameters, 'backup_uuid' => $backup->uuid]);
     }
 
-    public function syncData(bool $toModel = false): void
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             if ($this->fileStorage->is_too_large) {
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
index cd86d8670..0e0851aaa 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
@@ -162,7 +162,7 @@ public function loadValues(): void
         $this->valuesLoaded = true;
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->key = ValidationPatterns::normalizeEnvironmentVariableKey($this->key);
diff --git a/app/Livewire/Project/Shared/HealthChecks.php b/app/Livewire/Project/Shared/HealthChecks.php
index 6a128a142..70633fe03 100644
--- a/app/Livewire/Project/Shared/HealthChecks.php
+++ b/app/Livewire/Project/Shared/HealthChecks.php
@@ -86,7 +86,7 @@ public function mount()
         }
     }
 
-    public function syncData(bool $toModel = false): void
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Project/Shared/ScheduledTask/Add.php b/app/Livewire/Project/Shared/ScheduledTask/Add.php
index 61bc6b0fb..f170a0a6f 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Add.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Add.php
@@ -102,7 +102,7 @@ public function submit()
         }
     }
 
-    public function saveScheduledTask()
+    private function saveScheduledTask(): mixed
     {
         try {
             $task = new ScheduledTask;
diff --git a/app/Livewire/Project/Shared/ScheduledTask/Show.php b/app/Livewire/Project/Shared/ScheduledTask/Show.php
index 4eb5c071c..30d102462 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Show.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Show.php
@@ -87,7 +87,7 @@ public function mount()
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/app/Livewire/Server/Advanced.php b/app/Livewire/Server/Advanced.php
index a94881b12..895ce34e7 100644
--- a/app/Livewire/Server/Advanced.php
+++ b/app/Livewire/Server/Advanced.php
@@ -42,10 +42,9 @@ public function mount(string $server_uuid)
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
-            $this->authorize('update', $this->server);
             $this->validate();
             $this->server->settings->concurrent_builds = $this->concurrentBuilds;
             $this->server->settings->dynamic_timeout = $this->dynamicTimeout;
@@ -67,6 +66,7 @@ public function syncData(bool $toModel = false)
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Server updated.');
         } catch (\Throwable $e) {
@@ -81,6 +81,7 @@ public function submit()
                 $this->serverDiskUsageCheckFrequency = $this->server->settings->getOriginal('server_disk_usage_check_frequency');
                 throw new \Exception('Invalid Cron / Human expression for Disk Usage Check Frequency.');
             }
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Server updated.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Server/DockerCleanup.php b/app/Livewire/Server/DockerCleanup.php
index 12d111d21..40dd92d87 100644
--- a/app/Livewire/Server/DockerCleanup.php
+++ b/app/Livewire/Server/DockerCleanup.php
@@ -97,10 +97,9 @@ public function mount(string $server_uuid)
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
-            $this->authorize('update', $this->server);
             $this->validate();
             $this->server->settings->force_docker_cleanup = $this->forceDockerCleanup;
             $this->server->settings->docker_cleanup_frequency = $this->dockerCleanupFrequency;
@@ -122,6 +121,7 @@ public function syncData(bool $toModel = false)
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Server updated.');
         } catch (\Throwable $e) {
@@ -147,6 +147,7 @@ public function submit()
                 $this->dockerCleanupFrequency = $this->server->settings->getOriginal('docker_cleanup_frequency');
                 throw new \Exception('Invalid Cron / Human expression for Docker Cleanup Frequency.');
             }
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Server updated.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Server/LogDrains.php b/app/Livewire/Server/LogDrains.php
index 3af0a2261..5ce657f00 100644
--- a/app/Livewire/Server/LogDrains.php
+++ b/app/Livewire/Server/LogDrains.php
@@ -52,7 +52,7 @@ public function mount(string $server_uuid)
         }
     }
 
-    public function syncDataNewRelic(bool $toModel = false)
+    private function syncDataNewRelic(bool $toModel = false): void
     {
         if ($toModel) {
             $this->server->settings->is_logdrain_newrelic_enabled = $this->isLogDrainNewRelicEnabled;
@@ -65,7 +65,7 @@ public function syncDataNewRelic(bool $toModel = false)
         }
     }
 
-    public function syncDataAxiom(bool $toModel = false)
+    private function syncDataAxiom(bool $toModel = false): void
     {
         if ($toModel) {
             $this->server->settings->is_logdrain_axiom_enabled = $this->isLogDrainAxiomEnabled;
@@ -78,7 +78,7 @@ public function syncDataAxiom(bool $toModel = false)
         }
     }
 
-    public function syncDataCustom(bool $toModel = false)
+    private function syncDataCustom(bool $toModel = false): void
     {
         if ($toModel) {
             $this->server->settings->is_logdrain_custom_enabled = $this->isLogDrainCustomEnabled;
@@ -91,7 +91,7 @@ public function syncDataCustom(bool $toModel = false)
         }
     }
 
-    public function syncData(bool $toModel = false, ?string $type = null)
+    private function syncData(bool $toModel = false, ?string $type = null): void
     {
         if ($toModel) {
             $this->customValidation();
diff --git a/app/Livewire/Server/Security/TerminalAccess.php b/app/Livewire/Server/Security/TerminalAccess.php
index b4b99a3e7..999482dcf 100644
--- a/app/Livewire/Server/Security/TerminalAccess.php
+++ b/app/Livewire/Server/Security/TerminalAccess.php
@@ -62,10 +62,9 @@ public function toggleTerminal($password, $selectedActions = [])
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
-            $this->authorize('update', $this->server);
             $this->validate();
             // No other fields to sync for terminal access
         } else {
diff --git a/app/Livewire/Server/Sentinel.php b/app/Livewire/Server/Sentinel.php
index a69eb3f80..2d4742eb6 100644
--- a/app/Livewire/Server/Sentinel.php
+++ b/app/Livewire/Server/Sentinel.php
@@ -54,10 +54,9 @@ public function mount()
         $this->syncData();
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
-            $this->authorize('update', $this->server);
             $this->validate();
             $this->server->settings->is_metrics_enabled = $this->isMetricsEnabled;
             $this->server->settings->sentinel_token = $this->sentinelToken;
@@ -145,6 +144,7 @@ public function regenerateSentinelToken()
     public function submit()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Sentinel settings updated. Restarting Sentinel.');
         } catch (\Throwable $e) {
@@ -155,6 +155,7 @@ public function submit()
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->restartSentinel();
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Server/Show.php b/app/Livewire/Server/Show.php
index 017beb371..38bbe24e7 100644
--- a/app/Livewire/Server/Show.php
+++ b/app/Livewire/Server/Show.php
@@ -230,12 +230,10 @@ public function timezones(): array
             ->toArray();
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
-
-            $this->authorize('update', $this->server);
             $foundServer = Server::where('ip', $this->ip)
                 ->where('id', '!=', $this->server->id)
                 ->first();
@@ -363,6 +361,7 @@ public function validateServer($install = true)
     public function checkLocalhostConnection()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             ['uptime' => $uptime, 'error' => $error] = $this->server->validateConnection();
             if ($uptime) {
@@ -479,6 +478,7 @@ public function regenerateSentinelToken()
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -694,6 +694,7 @@ public function refreshServerMetadata(): void
     public function submit()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Server settings updated.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/Server/Swarm.php b/app/Livewire/Server/Swarm.php
index e3e441ea0..af785a8c2 100644
--- a/app/Livewire/Server/Swarm.php
+++ b/app/Livewire/Server/Swarm.php
@@ -29,10 +29,9 @@ public function mount(string $server_uuid)
         }
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
-            $this->authorize('update', $this->server);
             $this->server->settings->is_swarm_manager = $this->isSwarmManager;
             $this->server->settings->is_swarm_worker = $this->isSwarmWorker;
             $this->server->settings->save();
@@ -45,6 +44,7 @@ public function syncData(bool $toModel = false)
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->server);
             $this->syncData(true);
             $this->dispatch('success', 'Swarm settings updated.');
         } catch (\Throwable $e) {
diff --git a/app/Livewire/SettingsEmail.php b/app/Livewire/SettingsEmail.php
index 9bca0db2e..4b5857db5 100644
--- a/app/Livewire/SettingsEmail.php
+++ b/app/Livewire/SettingsEmail.php
@@ -74,7 +74,7 @@ public function mount()
         $this->testEmailAddress = auth()->user()->email;
     }
 
-    public function syncData(bool $toModel = false)
+    private function syncData(bool $toModel = false): void
     {
         if ($toModel) {
             $this->validate();
diff --git a/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php b/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php
index 31c30c124..584276990 100644
--- a/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php
+++ b/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php
@@ -13,6 +13,7 @@
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
+use Livewire\Exceptions\MethodNotFoundException;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
@@ -188,6 +189,21 @@
         ->assertDispatched('error');
 });
 
+test('the private application advanced syncData helper is not remotely callable', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $original = (bool) $this->application->settings->is_force_https_enabled;
+
+    $component = Livewire::test(ApplicationAdvanced::class, ['application' => $this->application])
+        ->set('isForceHttpsEnabled', ! $original);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
+
+    expect((bool) $this->application->settings->fresh()->is_force_https_enabled)->toBe($original);
+});
+
 // --- Application Rollback Livewire actions ---
 
 test('member cannot save rollback settings', function () {
diff --git a/tests/Feature/Authorization/NotificationAuthorizationTest.php b/tests/Feature/Authorization/NotificationAuthorizationTest.php
index 84b4ace6f..d4fa8dfc9 100644
--- a/tests/Feature/Authorization/NotificationAuthorizationTest.php
+++ b/tests/Feature/Authorization/NotificationAuthorizationTest.php
@@ -10,6 +10,7 @@
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Exceptions\MethodNotFoundException;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
@@ -43,13 +44,14 @@
         ->assertDispatched('error');
 });
 
-test('member cannot update discord notification settings', function () {
+test('the private discord syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(DiscordNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(DiscordNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('admin can update discord notification settings', function () {
@@ -78,13 +80,14 @@
         ->assertDispatched('error');
 });
 
-test('member cannot update slack notification settings', function () {
+test('the private slack syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(SlackNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(SlackNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('admin can update slack notification settings', function () {
@@ -114,13 +117,14 @@
         ->assertDispatched('error');
 });
 
-test('member cannot update telegram notification settings', function () {
+test('the private telegram syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(TelegramNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(TelegramNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('admin can update telegram notification settings', function () {
@@ -138,7 +142,7 @@
 
     Livewire::test(TelegramNotification::class)
         ->set('telegramNotificationsRestartLimitReachedThreadId', str_repeat('a', 255))
-        ->call('syncData', true)
+        ->call('submit')
         ->assertHasNoErrors(['telegramNotificationsRestartLimitReachedThreadId']);
 
     expect($this->team->telegramNotificationSettings->fresh()->telegram_notifications_restart_limit_reached_thread_id)
@@ -151,8 +155,11 @@
 
     Livewire::test(TelegramNotification::class)
         ->set('telegramNotificationsRestartLimitReachedThreadId', str_repeat('a', 256))
-        ->call('syncData', true)
-        ->assertHasErrors(['telegramNotificationsRestartLimitReachedThreadId' => 'max']);
+        ->call('submit')
+        ->assertDispatched('error');
+
+    expect($this->team->telegramNotificationSettings->fresh()->telegram_notifications_restart_limit_reached_thread_id)
+        ->not->toBe(str_repeat('a', 256));
 });
 
 test('member cannot view telegram thread ids', function () {
@@ -226,13 +233,14 @@
         ->assertDispatched('error');
 });
 
-test('member cannot update email notification settings', function () {
+test('the private email syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(EmailNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(EmailNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('member cannot update smtp email transport directly', function () {
@@ -330,13 +338,14 @@
         ->assertDispatched('error');
 });
 
-test('member cannot update pushover notification settings', function () {
+test('the private pushover syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(PushoverNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(PushoverNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('admin can update pushover notification settings', function () {
@@ -365,13 +374,14 @@
         ->assertDispatched('error');
 });
 
-test('member cannot update webhook notification settings', function () {
+test('the private webhook syncData helper is not remotely callable', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    Livewire::test(WebhookNotification::class)
-        ->call('syncData', true)
-        ->assertForbidden();
+    $component = Livewire::test(WebhookNotification::class);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
 });
 
 test('admin can update webhook notification settings', function () {
diff --git a/tests/Feature/Authorization/ScheduledTaskSyncAuthorizationTest.php b/tests/Feature/Authorization/ScheduledTaskSyncAuthorizationTest.php
new file mode 100644
index 000000000..5a44b26c4
--- /dev/null
+++ b/tests/Feature/Authorization/ScheduledTaskSyncAuthorizationTest.php
@@ -0,0 +1,180 @@
+<?php
+
+use App\Livewire\Project\Shared\ScheduledTask\Add;
+use App\Livewire\Project\Shared\ScheduledTask\Show;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\ScheduledTask;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Routing\Events\RouteMatched;
+use Illuminate\Support\Facades\Event;
+use Livewire\Exceptions\MethodNotFoundException;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->owner = User::factory()->create();
+    $this->owner->teams()->attach($this->team, ['role' => 'owner']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = $this->project->environments()->first();
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->task = ScheduledTask::factory()->create([
+        'team_id' => $this->team->id,
+        'application_id' => $this->application->id,
+        'name' => 'validate-benign',
+        'command' => 'echo scheduled-ok',
+        'frequency' => '0 0 * * *',
+        'timeout' => 300,
+        'enabled' => true,
+    ]);
+});
+
+afterEach(function () {
+    Event::forget(RouteMatched::class);
+});
+
+function bindApplicationScheduledTaskRoute(Application $application, ScheduledTask $task): void
+{
+    $application->loadMissing('environment.project');
+
+    Event::listen(RouteMatched::class, function (RouteMatched $event) use ($application, $task): void {
+        $event->route->setParameter('task_uuid', $task->uuid);
+        $event->route->setParameter('project_uuid', $application->environment->project->uuid);
+        $event->route->setParameter('environment_uuid', $application->environment->uuid);
+        $event->route->setParameter('application_uuid', $application->uuid);
+    });
+}
+
+function originalScheduledTaskState(ScheduledTask $task): array
+{
+    return $task->only(['name', 'command', 'frequency', 'timeout', 'enabled', 'container']);
+}
+
+test('read-only member can view an existing scheduled task', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+    bindApplicationScheduledTaskRoute($this->application, $this->task);
+
+    Livewire::test(Show::class)
+        ->assertSuccessful()
+        ->assertSet('name', 'validate-benign')
+        ->assertSet('command', 'echo scheduled-ok')
+        ->assertSet('frequency', '0 0 * * *');
+});
+
+test('the private syncData helper is not remotely callable through Livewire', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+    bindApplicationScheduledTaskRoute($this->application, $this->task);
+
+    $original = originalScheduledTaskState($this->task);
+
+    $component = Livewire::test(Show::class)
+        ->set('name', 'member-edited')
+        ->set('command', 'echo member-edited')
+        ->set('frequency', '* * * * *')
+        ->set('timeout', 120)
+        ->set('isEnabled', true);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
+
+    expect(originalScheduledTaskState($this->task->fresh()))->toBe($original);
+});
+
+test('read-only member cannot persist scheduled task changes through submit', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+    bindApplicationScheduledTaskRoute($this->application, $this->task);
+
+    $original = originalScheduledTaskState($this->task);
+
+    Livewire::test(Show::class)
+        ->set('name', 'member-edited')
+        ->set('command', 'echo member-edited')
+        ->set('frequency', '* * * * *')
+        ->call('submit');
+
+    expect(originalScheduledTaskState($this->task->fresh()))->toBe($original);
+});
+
+test('the private saveScheduledTask helper is not remotely callable through Livewire', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(Add::class, [
+        'id' => (string) $this->application->id,
+        'type' => 'application',
+        'containerNames' => collect(),
+    ])
+        ->set('name', 'member-created')
+        ->set('command', 'id')
+        ->set('frequency', '* * * * *')
+        ->set('timeout', 300);
+
+    expect(fn () => $component->call('saveScheduledTask'))
+        ->toThrow(MethodNotFoundException::class);
+
+    expect(ScheduledTask::query()->where('name', 'member-created')->exists())->toBeFalse();
+});
+
+test('read-only member cannot create a scheduled task through submit', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Add::class, [
+        'id' => (string) $this->application->id,
+        'type' => 'application',
+        'containerNames' => collect(),
+    ])
+        ->set('name', 'member-created')
+        ->set('command', 'id')
+        ->set('frequency', '* * * * *')
+        ->set('timeout', 300)
+        ->call('submit');
+
+    expect(ScheduledTask::query()->where('name', 'member-created')->exists())->toBeFalse();
+});
+
+test('admin can persist scheduled task changes through submit', function () {
+    $this->actingAs($this->owner);
+    session(['currentTeam' => $this->team]);
+    bindApplicationScheduledTaskRoute($this->application, $this->task);
+
+    Livewire::test(Show::class)
+        ->set('name', 'updated-by-admin')
+        ->set('command', 'echo admin-ok')
+        ->set('frequency', '0 1 * * *')
+        ->set('timeout', 600)
+        ->call('submit')
+        ->assertSuccessful();
+
+    $this->task->refresh();
+
+    expect($this->task->name)->toBe('updated-by-admin')
+        ->and($this->task->command)->toBe('echo admin-ok')
+        ->and($this->task->frequency)->toBe('0 1 * * *')
+        ->and($this->task->timeout)->toBe(600);
+});
diff --git a/tests/Feature/Authorization/ServerAuthorizationTest.php b/tests/Feature/Authorization/ServerAuthorizationTest.php
index c9e7ec10d..63e15be2f 100644
--- a/tests/Feature/Authorization/ServerAuthorizationTest.php
+++ b/tests/Feature/Authorization/ServerAuthorizationTest.php
@@ -3,6 +3,7 @@
 use App\Http\Middleware\PreventRequestsDuringMaintenance;
 use App\Livewire\Server\Create as ServerCreate;
 use App\Livewire\Server\Index as ServerIndex;
+use App\Livewire\Server\LogDrains;
 use App\Livewire\Server\Navbar as ServerNavbar;
 use App\Models\CloudProviderToken;
 use App\Models\InstanceSettings;
@@ -12,6 +13,7 @@
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
+use Livewire\Exceptions\MethodNotFoundException;
 use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
@@ -79,6 +81,20 @@
     expect($this->member->can('view', $this->server))->toBeTrue();
 });
 
+test('the private log drain syncData helper is not remotely callable', function () {
+    $this->withoutVite();
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $component = Livewire::test(LogDrains::class, ['server_uuid' => $this->server->uuid])
+        ->set('isLogDrainAxiomEnabled', true);
+
+    expect(fn () => $component->call('syncData', true))
+        ->toThrow(MethodNotFoundException::class);
+
+    expect((bool) $this->server->settings->fresh()->is_logdrain_axiom_enabled)->toBeFalse();
+});
+
 // --- Server Policy: manageProxy ---
 
 test('admin can manage proxy', function () {
diff --git a/tests/Unit/LivewireSyncDataAuthorizationTest.php b/tests/Unit/LivewireSyncDataAuthorizationTest.php
new file mode 100644
index 000000000..7ac6136d5
--- /dev/null
+++ b/tests/Unit/LivewireSyncDataAuthorizationTest.php
@@ -0,0 +1,196 @@
+<?php
+
+use PhpParser\Node;
+use PhpParser\Node\Expr\ConstFetch;
+use PhpParser\Node\Expr\MethodCall;
+use PhpParser\Node\Identifier;
+use PhpParser\Node\Stmt\ClassMethod;
+use PhpParser\Node\Stmt\If_;
+use PhpParser\Node\Stmt\Return_;
+use PhpParser\Node\Stmt\TryCatch;
+use PhpParser\NodeFinder;
+use PhpParser\ParserFactory;
+
+/** @return list<array{path: string, method: ClassMethod}> */
+function livewireSyncDataMethods(string $directory): array
+{
+    $methods = [];
+    $iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($directory));
+    $parser = (new ParserFactory)->createForNewestSupportedVersion();
+    $finder = new NodeFinder;
+
+    foreach ($iterator as $file) {
+        if (! $file->isFile() || $file->getExtension() !== 'php') {
+            continue;
+        }
+        $path = $file->getPathname();
+        $contents = file_get_contents($path);
+        if ($contents === false) {
+            continue;
+        }
+        foreach ($finder->findInstanceOf($parser->parse($contents) ?? [], ClassMethod::class) as $method) {
+            if (preg_match('/^sync(Data|DatabaseData|ApplicationData)/', $method->name->toString())) {
+                $methods[] = ['path' => $path, 'method' => $method];
+            }
+        }
+    }
+
+    usort($methods, fn (array $a, array $b): int => [$a['path'], $a['method']->name->toString()] <=> [$b['path'], $b['method']->name->toString()]);
+
+    return $methods;
+}
+
+function livewireMethodCallName(MethodCall $call): ?string
+{
+    return $call->name instanceof Identifier ? $call->name->toString() : null;
+}
+
+function livewireIsWriteSyncCall(MethodCall $call, string $syncMethod): bool
+{
+    if (livewireMethodCallName($call) !== $syncMethod) {
+        return false;
+    }
+    foreach ($call->args as $position => $argument) {
+        if (($position === 0 || $argument->name?->toString() === 'toModel') && $argument->value instanceof ConstFetch && $argument->value->name->toLowerString() === 'true') {
+            return true;
+        }
+    }
+
+    return false;
+}
+
+/** @param list<Node\Stmt> $statements @param list<int> $unauthorizedLines */
+function livewireScanStatements(array $statements, string $syncMethod, bool $authorized, array &$unauthorizedLines): bool
+{
+    foreach ($statements as $statement) {
+        $authorized = livewireScanNode($statement, $syncMethod, $authorized, $unauthorizedLines);
+    }
+
+    return $authorized;
+}
+
+/** @param list<int> $unauthorizedLines */
+function livewireScanNode(mixed $node, string $syncMethod, bool $authorized, array &$unauthorizedLines): bool
+{
+    if (! $node instanceof Node && ! is_array($node)) {
+        return $authorized;
+    }
+    if (is_array($node)) {
+        return livewireScanStatements($node, $syncMethod, $authorized, $unauthorizedLines);
+    }
+    if ($node instanceof TryCatch) {
+        $tryAuthorized = livewireScanStatements($node->stmts, $syncMethod, $authorized, $unauthorizedLines);
+        $allCatchesTerminate = $node->catches !== [];
+        foreach ($node->catches as $catch) {
+            livewireScanStatements($catch->stmts, $syncMethod, $authorized, $unauthorizedLines);
+            $allCatchesTerminate = $allCatchesTerminate && collect($catch->stmts)->contains(fn (Node\Stmt $statement): bool => $statement instanceof Return_);
+        }
+        if ($node->finally !== null) {
+            livewireScanStatements($node->finally->stmts, $syncMethod, $authorized, $unauthorizedLines);
+        }
+
+        return $allCatchesTerminate ? $tryAuthorized : $authorized;
+    }
+    if ($node instanceof If_) {
+        livewireScanNode($node->cond, $syncMethod, $authorized, $unauthorizedLines);
+        livewireScanStatements($node->stmts, $syncMethod, $authorized, $unauthorizedLines);
+        foreach ($node->elseifs as $elseif) {
+            livewireScanNode($elseif->cond, $syncMethod, $authorized, $unauthorizedLines);
+            livewireScanStatements($elseif->stmts, $syncMethod, $authorized, $unauthorizedLines);
+        }
+        if ($node->else !== null) {
+            livewireScanStatements($node->else->stmts, $syncMethod, $authorized, $unauthorizedLines);
+        }
+
+        return $authorized;
+    }
+    if ($node instanceof MethodCall) {
+        $name = livewireMethodCallName($node);
+        if ($name === 'authorize') {
+            return true;
+        }
+        if (livewireIsWriteSyncCall($node, $syncMethod) && ! $authorized) {
+            $unauthorizedLines[] = $node->getStartLine();
+        }
+    }
+    foreach ($node->getSubNodeNames() as $name) {
+        $authorized = livewireScanNode($node->{$name}, $syncMethod, $authorized, $unauthorizedLines);
+    }
+
+    return $authorized;
+}
+
+/** @return list<int> */
+function livewireUnauthorizedSyncWriteLines(ClassMethod $method, string $syncMethod): array
+{
+    $lines = [];
+    livewireScanStatements($method->stmts ?? [], $syncMethod, false, $lines);
+
+    return $lines;
+}
+
+function livewireMethodFromSource(string $source, string $method): ClassMethod
+{
+    $nodes = (new ParserFactory)->createForNewestSupportedVersion()->parse($source) ?? [];
+
+    return (new NodeFinder)->findFirst($nodes, fn (Node $node): bool => $node instanceof ClassMethod && $node->name->toString() === $method);
+}
+
+it('keeps every Livewire syncData helper private', function () {
+    $violations = [];
+    foreach (livewireSyncDataMethods(dirname(__DIR__, 2).'/app/Livewire') as $syncMethod) {
+        if (! $syncMethod['method']->isPrivate()) {
+            $relative = str_replace(dirname(__DIR__, 2).'/', '', $syncMethod['path']);
+            $violations[] = "{$relative}::{$syncMethod['method']->name}() is not private";
+        }
+    }
+    expect($violations)->toBeEmpty("Livewire syncData helpers must be private:\n".implode("\n", $violations));
+});
+
+it('discovers files that only define syncApplicationData helpers', function () {
+    $directory = sys_get_temp_dir().'/livewire-sync-'.uniqid();
+    mkdir($directory);
+    file_put_contents($directory.'/Example.php', '<?php class Example { private function syncApplicationData(bool $toModel = false) {} }');
+
+    $methods = livewireSyncDataMethods($directory);
+
+    unlink($directory.'/Example.php');
+    rmdir($directory);
+
+    expect($methods)->toHaveCount(1)
+        ->and($methods[0]['method']->name->toString())->toBe('syncApplicationData');
+});
+
+it('detects named write arguments and does not carry authorization into catch paths', function () {
+    $method = livewireMethodFromSource(<<<'PHP'
+        <?php
+        class Example {
+            public function instantSave() {
+                try {
+                    $this->authorize('update', $this->resource);
+                    $this->syncData(toModel: true);
+                } catch (Throwable $exception) {
+                    $this->syncData(toModel: true);
+                }
+            }
+        }
+        PHP, 'instantSave');
+
+    expect(livewireUnauthorizedSyncWriteLines($method, 'syncData'))->toHaveCount(1);
+});
+
+it('authorizes before every syncData write call', function () {
+    $violations = [];
+    $root = dirname(__DIR__, 2);
+    foreach (livewireSyncDataMethods($root.'/app/Livewire') as $syncMethod) {
+        $contents = file_get_contents($syncMethod['path']);
+        $nodes = (new ParserFactory)->createForNewestSupportedVersion()->parse($contents) ?? [];
+        foreach ((new NodeFinder)->findInstanceOf($nodes, ClassMethod::class) as $caller) {
+            foreach (livewireUnauthorizedSyncWriteLines($caller, $syncMethod['method']->name->toString()) as $line) {
+                $relative = str_replace($root.'/', '', $syncMethod['path']);
+                $violations[] = "{$relative}:{$line}::{$caller->name}() calls {$syncMethod['method']->name}(true) without prior authorization";
+            }
+        }
+    }
+    expect($violations)->toBeEmpty("Missing authorization before syncData write calls:\n".implode("\n", array_unique($violations)));
+});

From f06aadc4a0483bab7d771849e5a040d89ef38262 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 1 Sep 2026 20:33:50 +0200
Subject: [PATCH 26/55] fix(service): warn before removing required ports

---
 .../project/service/domains.blade.php         | 42 +++++++++++++++++++
 tests/Feature/ServiceDomainsTest.php          |  5 ++-
 2 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/resources/views/livewire/project/service/domains.blade.php b/resources/views/livewire/project/service/domains.blade.php
index c228f39e5..9a3a59482 100644
--- a/resources/views/livewire/project/service/domains.blade.php
+++ b/resources/views/livewire/project/service/domains.blade.php
@@ -283,4 +283,46 @@ class="application-settings-form application-settings-section relative flex max-
 
     <x-domain-conflict-modal :conflicts="$domainConflicts" :showModal="$showDomainConflictModal"
         confirmAction="confirmDomainUsage" />
+
+    @if ($showPortWarningModal)
+        <div x-data="{ modalOpen: true }"
+            @keydown.escape.window="modalOpen = false; $wire.call('cancelRemovePort')"
+            :class="{ 'z-40': modalOpen }" class="relative">
+            <template x-teleport="body">
+                <div x-show="modalOpen"
+                    class="fixed inset-0 z-99 flex min-h-full items-center justify-center overflow-y-auto p-4" x-cloak>
+                    <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]"></div>
+                    <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
+                        class="application-settings-form application-settings-section relative w-full lg:min-w-[36rem] lg:max-w-2xl"
+                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
+                        <header>
+                            <h3>Remove required port?</h3>
+                            <button type="button"
+                                @click="modalOpen = false; $wire.call('cancelRemovePort')"
+                                class="icon-button" aria-label="Close">
+                                <x-reicon name="x" class="size-4" />
+                            </button>
+                        </header>
+                        <div class="application-settings-section-body">
+                            <x-callout type="warning" title="Port requirement" class="mb-4">
+                                This service requires port <strong>{{ $requiredPort }}</strong> to function correctly.
+                                One or more of your domains are missing a port number.
+                            </x-callout>
+
+                            <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+                                <x-forms.button type="button"
+                                    @click="modalOpen = false; $wire.call('cancelRemovePort')">
+                                    Keep port
+                                </x-forms.button>
+                                <x-forms.button type="button" wire:click="confirmRemovePort"
+                                    @click="modalOpen = false" isError>
+                                    Remove port anyway
+                                </x-forms.button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </template>
+        </div>
+    @endif
 </div>
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index bbcc3a2c8..066d0598a 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -525,7 +525,10 @@
         ->call('confirmDomainUsage')
         ->assertSet('showDomainConflictModal', false)
         ->assertSet('showPortWarningModal', true)
-        ->assertSet('forceSaveDomains', true);
+        ->assertSet('forceSaveDomains', true)
+        ->assertSee('Remove required port?')
+        ->assertSee('Keep port')
+        ->assertSee('Remove port anyway');
 
     $component
         ->call('confirmRemovePort')

From 8ace0d18e36d07e10efe17c0e11b84e916450462 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 1 Sep 2026 20:48:39 +0200
Subject: [PATCH 27/55] fix(database): warn about PostgreSQL password overwrite
 on full restore

---
 .../livewire/project/database/import-form.blade.php    |  4 ++++
 tests/Feature/DatabaseRestoreDialogTest.php            | 10 ++++++++++
 2 files changed, 14 insertions(+)

diff --git a/resources/views/livewire/project/database/import-form.blade.php b/resources/views/livewire/project/database/import-form.blade.php
index a8087bd8e..dd57b121c 100644
--- a/resources/views/livewire/project/database/import-form.blade.php
+++ b/resources/views/livewire/project/database/import-form.blade.php
@@ -57,6 +57,10 @@
                 <div class="space-y-4">
             @if ($resourceDbType === 'standalone-postgresql')
                 @if ($dumpAll)
+                            <x-callout type="warning" title="Full restore overwrites administrator passwords">
+                                The backup replaces PostgreSQL administrator role passwords, including the destination administrator password.
+                                <span class="mt-1 block">If the administrator password changes, update it in Coolify's database configuration after the restore.</span>
+                            </x-callout>
                             <x-forms.textarea rows="6" readonly label="Import command"
                                 wire:model="restoreCommandText" canGate="update"
                                 :canResource="$this->resource" />
diff --git a/tests/Feature/DatabaseRestoreDialogTest.php b/tests/Feature/DatabaseRestoreDialogTest.php
index 0086a6cf2..5f78706a8 100644
--- a/tests/Feature/DatabaseRestoreDialogTest.php
+++ b/tests/Feature/DatabaseRestoreDialogTest.php
@@ -8,3 +8,13 @@
         ->toContain('<livewire:activity-monitor wire:key="database-restore-{{ $resourceUuid }}" header="Logs" fullHeight />')
         ->not->toContain('<x-slide-over @databaserestore.window="slideOverOpen = true"');
 });
+
+test('postgresql dump all restore warns that administrator passwords are overwritten', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/database/import-form.blade.php'));
+
+    expect($view)
+        ->toContain('@if ($dumpAll)')
+        ->toContain('Full restore overwrites administrator passwords')
+        ->toContain('The backup replaces PostgreSQL administrator role passwords, including the destination administrator password.')
+        ->toContain("If the administrator password changes, update it in Coolify's database configuration after the restore.");
+});

From 7a7564e6b383a009b65d2421cea0397f765ad94d Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Wed, 2 Sep 2026 10:22:44 +0200
Subject: [PATCH 28/55] fix(ui): improve compose editor layout on mobile
 screens

---
 .../views/components/modal-input.blade.php    | 13 +++++++-----
 .../project/service/edit-compose.blade.php    |  2 +-
 .../project/service/stack-form.blade.php      |  2 +-
 tests/Feature/ComposeEditorLayoutTest.php     | 21 +++++++++++++++++++
 4 files changed, 31 insertions(+), 7 deletions(-)

diff --git a/resources/views/components/modal-input.blade.php b/resources/views/components/modal-input.blade.php
index b80e3d649..588032e03 100644
--- a/resources/views/components/modal-input.blade.php
+++ b/resources/views/components/modal-input.blade.php
@@ -47,7 +47,7 @@ class="fixed inset-0 z-99 overflow-y-auto">
                 x-transition:enter-end="opacity-100" x-transition:leave="ease-in duration-100"
                 x-transition:leave-start="opacity-100" x-transition:leave-end="opacity-0"
                 class="absolute inset-0 w-full h-full bg-black/50 backdrop-blur-[2px]"></div>
-            <div @if ($closeOutside) @click.self="modalOpen=false" @endif class="relative flex min-h-full items-start justify-center p-4 sm:items-center">
+            <div @if ($closeOutside) @click.self="modalOpen=false" @endif class="relative flex min-h-full items-start justify-center p-2 sm:items-center sm:p-4">
                 <div id="{{ $modalId }}" x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
                     x-transition:enter="ease-out duration-100"
                     x-transition:enter-start="opacity-0 -translate-y-2 sm:scale-95"
@@ -61,19 +61,22 @@ class="absolute inset-0 w-full h-full bg-black/50 backdrop-blur-[2px]"></div>
                         'lg:w-auto lg:min-w-2xl lg:max-w-4xl' => ! $isLarge,
                     ])
                     style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
-                    <header class="flex-nowrap!">
+                    <header class="flex-wrap! sm:flex-nowrap!">
                         <h3 class="min-w-0 flex-1 truncate">{{ $title }}</h3>
                         @isset($headerActions)
-                            <div class="flex shrink-0 items-center gap-2">
+                            <div class="order-3 w-full sm:order-none sm:w-auto flex shrink-0 items-center gap-2">
                                 {{ $headerActions }}
                             </div>
                         @endisset
                         <button type="button" @click="modalOpen=false"
-                            class="flex size-7 shrink-0 cursor-pointer items-center justify-center rounded-md text-neutral-500 outline-0 transition-colors hover:bg-neutral-100 hover:text-black focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg">
+                            class="order-2 sm:order-none flex size-7 shrink-0 cursor-pointer items-center justify-center rounded-md text-neutral-500 outline-0 transition-colors hover:bg-neutral-100 hover:text-black focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg">
                             <x-reicon name="x" class="size-4" />
                         </button>
                     </header>
-                    <div class="application-settings-section-body min-h-0 flex-1 overflow-y-auto"
+                    <div @class([
+                        'application-settings-section-body min-h-0 flex-1 overflow-y-auto',
+                        'mt-2 sm:mt-0' => isset($headerActions),
+                    ])
                         style="-webkit-overflow-scrolling: touch;">
                         {{ $slot }}
                     </div>
diff --git a/resources/views/livewire/project/service/edit-compose.blade.php b/resources/views/livewire/project/service/edit-compose.blade.php
index 78400cb76..47b3e732f 100644
--- a/resources/views/livewire/project/service/edit-compose.blade.php
+++ b/resources/views/livewire/project/service/edit-compose.blade.php
@@ -25,7 +25,7 @@ class="flex min-h-0 flex-col gap-3">
     </div>
 
     <div
-        class="flex flex-wrap items-center gap-2 rounded-lg border border-neutral-200 bg-neutral-50 p-1 dark:border-white/[0.08] dark:bg-white/[0.025]">
+        class="flex flex-col items-stretch gap-2 rounded-lg border border-neutral-200 bg-neutral-50 p-1 sm:flex-row sm:flex-wrap sm:items-center dark:border-white/[0.08] dark:bg-white/[0.025]">
         <x-forms.checkbox label="Escape special characters in labels"
             helper="By default, $ (and other characters) is escaped. A $ in a label is saved as $$. Turn this off to use environment variables inside labels."
             id="isContainerLabelEscapeEnabled" instantSave />
diff --git a/resources/views/livewire/project/service/stack-form.blade.php b/resources/views/livewire/project/service/stack-form.blade.php
index 423ea0aaf..d42c2a575 100644
--- a/resources/views/livewire/project/service/stack-form.blade.php
+++ b/resources/views/livewire/project/service/stack-form.blade.php
@@ -14,7 +14,7 @@
                         <x-slot:headerActions>
                             <div x-data="{ preview: false, validating: false, saving: false }"
                                 @compose-validate-finished.window="validating = false"
-                                @compose-save-finished.window="saving = false" class="flex items-center gap-2">
+                                @compose-save-finished.window="saving = false" class="flex w-full items-center gap-2 overflow-x-auto sm:w-auto">
                                 <x-forms.button
                                     @click="preview = !preview; $dispatch('compose-preview-toggle')">
                                     <x-reicon name="eye" class="size-3.5" />
diff --git a/tests/Feature/ComposeEditorLayoutTest.php b/tests/Feature/ComposeEditorLayoutTest.php
index d8538e82d..d3fe92e45 100644
--- a/tests/Feature/ComposeEditorLayoutTest.php
+++ b/tests/Feature/ComposeEditorLayoutTest.php
@@ -48,6 +48,27 @@
         ->not->toContain('Show Deployable Compose');
 });
 
+it('keeps the compose modal usable on mobile screens', function () {
+    $stackForm = file_get_contents(resource_path('views/livewire/project/service/stack-form.blade.php'));
+    $editor = file_get_contents(resource_path('views/livewire/project/service/edit-compose.blade.php'));
+    $modal = file_get_contents(resource_path('views/components/modal-input.blade.php'));
+
+    expect($modal)
+        ->toContain('justify-center p-2')
+        ->toContain('sm:p-4')
+        ->toContain('flex-wrap! sm:flex-nowrap!')
+        ->toContain('order-3 w-full sm:order-none sm:w-auto')
+        ->toContain('order-2 sm:order-none')
+        ->toContain("'mt-2 sm:mt-0' => isset(\$headerActions)");
+
+    expect($stackForm)
+        ->toContain('w-full items-center gap-2 overflow-x-auto sm:w-auto');
+
+    expect($editor)
+        ->toContain('flex-col items-stretch')
+        ->toContain('sm:flex-row sm:flex-wrap sm:items-center');
+});
+
 it('keeps the save button loading until the parent compose save finishes', function () {
     $component = file_get_contents(app_path('Livewire/Project/Service/StackForm.php'));
 

From e2e91fbb853fd7260eaf74659675519f67e8b233 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Wed, 2 Sep 2026 19:39:19 +0200
Subject: [PATCH 29/55] feat(domains): support per-domain internal port
 overrides (#11594)

---
 .../UpdateServiceApplicationFromApi.php       |   2 +-
 .../Api/ApplicationsController.php            | 258 ++++++-
 app/Livewire/Project/Application/Domains.php  | 244 ++++++-
 .../Project/Application/PreviewDomains.php    | 193 ++++-
 app/Livewire/Project/Service/Domains.php      |  94 ++-
 app/Livewire/Project/Service/EditDomain.php   |  38 +-
 app/Livewire/Project/Service/Index.php        |  54 +-
 app/Models/Application.php                    |  48 ++
 app/Models/ApplicationPreview.php             |  87 ++-
 app/Models/Service.php                        |  18 +-
 app/Models/ServiceApplication.php             | 110 ++-
 .../ApplicationConfigurationSnapshot.php      |   2 +
 app/Support/DomainPortOverrides.php           |  91 +++
 app/Support/ServiceComposeUrl.php             |  10 +-
 app/Support/ValidationPatterns.php            |   7 +
 app/Traits/HasNoindexDomains.php              |  16 +-
 bootstrap/helpers/docker.php                  |  18 +-
 bootstrap/helpers/parsers.php                 |  69 +-
 bootstrap/helpers/shared.php                  |  74 +-
 ...verrides_to_service_applications_table.php |  28 +
 ...n_port_overrides_to_applications_table.php |  28 +
 ...verrides_to_application_previews_table.php |  28 +
 .../project/application/domains.blade.php     |  44 ++
 .../project/application/general.blade.php     |  24 +-
 .../application/partials/domain-row.blade.php |  11 +
 .../application/preview-domains.blade.php     |  55 ++
 .../project/service/domains.blade.php         |   8 +-
 .../project/service/edit-domain.blade.php     |   8 +-
 .../livewire/project/service/index.blade.php  |   8 +-
 .../service/partials/domain-table.blade.php   |   6 +
 routes/api.php                                |   1 +
 templates/compose/appsmith.yaml               |   1 +
 templates/compose/appwrite.yaml               |   1 +
 templates/compose/babybuddy.yaml              |   1 +
 templates/compose/budge.yaml                  |   1 +
 .../compose/classicpress-with-mariadb.yaml    |   1 +
 .../compose/classicpress-with-mysql.yaml      |   1 +
 .../classicpress-without-database.yaml        |   1 +
 templates/compose/dokuwiki.yaml               |   1 +
 templates/compose/drupal-with-postgresql.yaml |   1 +
 templates/compose/grocy.yaml                  |   1 +
 templates/compose/heimdall.yaml               |   1 +
 templates/compose/logto.yaml                  |   1 +
 templates/compose/phpmyadmin.yaml             |   1 +
 templates/compose/snapdrop.yaml               |   1 +
 templates/compose/wordpress-with-mariadb.yaml |   1 +
 templates/compose/wordpress-with-mysql.yaml   |   1 +
 .../compose/wordpress-without-database.yaml   |   1 +
 templates/service-templates-latest.json       |  75 +-
 templates/service-templates.json              |  75 +-
 .../Api/ApplicationSettingsApiTest.php        |  55 ++
 .../ApplicationConfigurationChangedTest.php   |  41 ++
 tests/Feature/ApplicationDomainsTest.php      | 587 ++++++++++++++-
 ...pplicationGeneralBuildpackSelectorTest.php |  29 +
 ...licationParserDockerComposeDomainsTest.php | 145 ++++
 tests/Feature/ApplicationPreviewApiTest.php   | 272 +++++++
 ...bleLivewireComponentsAuthorizationTest.php |  21 +
 .../PreviewDomainPortOverridesTest.php        | 674 ++++++++++++++++++
 .../Service/EditDomainPortValidationTest.php  |  86 ++-
 tests/Feature/ServiceApplicationsApiTest.php  |  59 ++
 .../ServiceDomainPortCorruptionTest.php       |   3 +-
 tests/Feature/ServiceDomainsTest.php          | 229 +++++-
 .../ServiceTemplatePortCoverageTest.php       |  48 ++
 .../Feature/ServiceTemplatePortLookupTest.php |  27 +
 tests/Unit/DockerComposeLabelParsingTest.php  |   8 +
 tests/Unit/DomainPortOverridesTest.php        |  36 +
 tests/Unit/FqdnLabelsNoindexTest.php          |  52 ++
 tests/Unit/ServiceRequiredPortTest.php        |  41 ++
 tests/Unit/TraefikServiceNameSegmentTest.php  |  46 ++
 tests/Unit/ValidationPatternsTest.php         |  14 +
 70 files changed, 4025 insertions(+), 297 deletions(-)
 create mode 100644 app/Support/DomainPortOverrides.php
 create mode 100644 database/migrations/2026_09_01_210751_add_domain_port_overrides_to_service_applications_table.php
 create mode 100644 database/migrations/2026_09_02_064120_add_domain_port_overrides_to_applications_table.php
 create mode 100644 database/migrations/2026_09_02_132544_add_domain_port_overrides_to_application_previews_table.php
 create mode 100644 tests/Feature/PreviewDomainPortOverridesTest.php
 create mode 100644 tests/Feature/ServiceTemplatePortCoverageTest.php
 create mode 100644 tests/Feature/ServiceTemplatePortLookupTest.php
 create mode 100644 tests/Unit/DomainPortOverridesTest.php

diff --git a/app/Actions/Service/UpdateServiceApplicationFromApi.php b/app/Actions/Service/UpdateServiceApplicationFromApi.php
index 123b752c0..004403975 100644
--- a/app/Actions/Service/UpdateServiceApplicationFromApi.php
+++ b/app/Actions/Service/UpdateServiceApplicationFromApi.php
@@ -56,7 +56,7 @@ public function execute(ServiceApplication $serviceApplication, Request $request
                 }
             }
 
-            $serviceApplication->fqdn = $parsed['normalized'];
+            $serviceApplication->setEditableUrls($parsed['normalized']);
         }
 
         if (array_key_exists('noindex_domains', $payload)) {
diff --git a/app/Http/Controllers/Api/ApplicationsController.php b/app/Http/Controllers/Api/ApplicationsController.php
index a0e1714ad..487d319e1 100644
--- a/app/Http/Controllers/Api/ApplicationsController.php
+++ b/app/Http/Controllers/Api/ApplicationsController.php
@@ -23,6 +23,7 @@
 use App\Rules\ValidGitBranch;
 use App\Rules\ValidGitRepositoryUrl;
 use App\Services\DockerImageParser;
+use App\Support\DomainPortOverrides;
 use App\Support\ValidationPatterns;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -2487,6 +2488,256 @@ public function logs_by_uuid(Request $request)
         ]);
     }
 
+    #[OA\Patch(
+        summary: 'Update Preview Domains',
+        description: 'Replace domains for a preview deployment. Use domains for regular applications or docker_compose_domains for Docker Compose applications. Ports are stored as internal overrides while public domains remain portless.',
+        path: '/applications/{uuid}/previews/{pull_request_id}',
+        operationId: 'update-preview-domains-by-pull-request-id',
+        security: [['bearerAuth' => []]],
+        tags: ['Applications'],
+        parameters: [
+            new OA\Parameter(name: 'uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
+            new OA\Parameter(name: 'pull_request_id', in: 'path', required: true, schema: new OA\Schema(type: 'integer')),
+        ],
+        requestBody: new OA\RequestBody(required: true, content: new OA\JsonContent(
+            properties: [
+                new OA\Property(property: 'domains', type: 'string', nullable: true, example: 'https://pr.example.com:3000'),
+                new OA\Property(
+                    property: 'docker_compose_domains',
+                    type: 'array',
+                    nullable: true,
+                    items: new OA\Items(properties: [
+                        new OA\Property(property: 'name', type: 'string'),
+                        new OA\Property(property: 'domain', type: 'string', nullable: true),
+                        new OA\Property(property: 'redirect', type: 'string', nullable: true, enum: ['www', 'non-www', 'both']),
+                    ], type: 'object'),
+                ),
+                new OA\Property(property: 'force_domain_override', type: 'boolean', default: false),
+            ],
+        )),
+        responses: [
+            new OA\Response(response: 200, description: 'Preview domains updated.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, ref: '#/components/responses/403'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 409, description: 'Domain conflict.'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ],
+    )]
+    public function update_preview_by_pull_request_id(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $application = Application::ownedByCurrentTeamAPI($teamId)->where('uuid', $request->uuid)->first();
+        if (! $application) {
+            return response()->json(['message' => 'Application not found.'], 404);
+        }
+
+        $this->authorize('update', $application);
+
+        $pullRequestIdRaw = $request->route('pull_request_id');
+        if (! ctype_digit((string) $pullRequestIdRaw) || (int) $pullRequestIdRaw <= 0) {
+            return response()->json(['message' => 'Invalid pull_request_id.'], 422);
+        }
+
+        $preview = ApplicationPreview::where('application_id', $application->id)
+            ->where('pull_request_id', (int) $pullRequestIdRaw)
+            ->first();
+        if (! $preview) {
+            return response()->json(['message' => 'Preview not found.'], 404);
+        }
+
+        $isCompose = $application->build_pack === BuildPackTypes::DOCKERCOMPOSE->value;
+        $validationRules = ['force_domain_override' => 'boolean'];
+        if ($isCompose) {
+            $validationRules = array_merge($validationRules, [
+                'domains' => 'missing',
+                'docker_compose_domains' => 'present|array',
+                'docker_compose_domains.*' => 'array:name,domain,redirect',
+                'docker_compose_domains.*.name' => 'required|string|distinct',
+                'docker_compose_domains.*.domain' => ValidationPatterns::applicationDomainRules(),
+                'docker_compose_domains.*.redirect' => 'nullable|string|in:www,non-www,both',
+            ]);
+        } else {
+            $validationRules['domains'] = ['present', ...ValidationPatterns::applicationDomainRules()];
+            $validationRules['docker_compose_domains'] = 'missing';
+        }
+
+        $validator = Validator::make($request->all(), $validationRules);
+        if ($validator->fails()) {
+            return response()->json(['message' => 'Validation failed.', 'errors' => $validator->errors()], 422);
+        }
+
+        $dockerComposeDomains = null;
+        $dockerComposeDomainsResponse = null;
+        if ($isCompose) {
+            try {
+                $compose = Yaml::parse($application->docker_compose_raw ?? '');
+            } catch (\Throwable) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['docker_compose_domains' => 'The Docker Compose configuration could not be parsed.'],
+                ], 422);
+            }
+
+            $services = data_get($compose, 'services');
+            if (! is_array($services) || $services === []) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['docker_compose_domains' => 'The Docker Compose configuration must define at least one service.'],
+                ], 422);
+            }
+
+            $composeServices = collect($services)
+                ->reject(fn (mixed $service): bool => isDatabaseImage(data_get($service, 'image')))
+                ->keys()
+                ->map(fn (mixed $name): string => (string) $name)
+                ->values();
+            $requestedServices = collect($request->input('docker_compose_domains'))->pluck('name');
+            if ($requestedServices->diff($composeServices)->isNotEmpty()) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['docker_compose_domains' => 'One or more Docker Compose services are invalid.'],
+                ], 422);
+            }
+
+            $existingComposeDomains = json_decode($preview->docker_compose_domains ?? '[]', true) ?: [];
+            $dockerComposeDomains = $composeServices
+                ->mapWithKeys(function (string $service) use ($existingComposeDomains): array {
+                    $entry = ['domain' => ''];
+                    $redirect = $existingComposeDomains[$service]['redirect'] ?? null;
+                    if (in_array($redirect, ['www', 'non-www', 'both'], true)) {
+                        $entry['redirect'] = $redirect;
+                    }
+
+                    return [$service => $entry];
+                })
+                ->all();
+            foreach ($request->input('docker_compose_domains') as $item) {
+                $entry = ['domain' => ValidationPatterns::normalizeApplicationDomains(data_get($item, 'domain')) ?? ''];
+                $redirect = array_key_exists('redirect', $item)
+                    ? data_get($item, 'redirect')
+                    : ($existingComposeDomains[data_get($item, 'name')]['redirect'] ?? null);
+                if (in_array($redirect, ['www', 'non-www', 'both'], true)) {
+                    $entry['redirect'] = $redirect;
+                }
+                $dockerComposeDomains[data_get($item, 'name')] = $entry;
+            }
+            $domains = collect($dockerComposeDomains)
+                ->pluck('domain')
+                ->filter()
+                ->implode(',') ?: null;
+        } else {
+            $domains = ValidationPatterns::normalizeApplicationDomains($request->input('domains'));
+        }
+
+        $submittedUrls = collect(ValidationPatterns::applicationDomainList($domains))
+            ->map(fn (string $domain): string => DomainPortOverrides::withoutPort($domain));
+        if ($submittedUrls->duplicates()->isNotEmpty()) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => [
+                    $isCompose ? 'docker_compose_domains' : 'domains' => 'The same domain cannot be configured more than once.',
+                ],
+            ], 422);
+        }
+
+        $normalized = DomainPortOverrides::normalize($domains, null);
+        $portlessDomains = $normalized['fqdn'];
+        if ($isCompose) {
+            foreach ($dockerComposeDomains as $service => $entry) {
+                $dockerComposeDomains[$service]['domain'] = collect(ValidationPatterns::applicationDomainList($entry['domain']))
+                    ->map(fn (string $domain): string => DomainPortOverrides::withoutPort($domain))
+                    ->implode(',');
+            }
+            $dockerComposeDomainsResponse = collect($dockerComposeDomains)
+                ->map(fn (array $entry, string $name): array => ['name' => $name, ...$entry])
+                ->values()
+                ->all();
+        }
+        $urls = collect(ValidationPatterns::applicationDomainList($portlessDomains));
+        $conflicts = checkIfDomainIsAlreadyUsedViaAPI($urls, $teamId);
+        if (isset($conflicts['error'])) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => [$isCompose ? 'docker_compose_domains' : 'domains' => $conflicts['error']],
+            ], 422);
+        }
+        if ($conflicts['hasConflicts'] && ! $request->boolean('force_domain_override')) {
+            return response()->json([
+                'message' => 'Domain conflicts detected. Use force_domain_override=true to proceed.',
+                'conflicts' => $conflicts['conflicts'],
+                'warning' => 'Using the same domain for multiple resources can cause routing conflicts and unpredictable behavior.',
+            ], 409);
+        }
+
+        $hostCandidates = $urls
+            ->map(fn (string $url): string => (string) parse_url($url, PHP_URL_HOST))
+            ->filter();
+        $conflictingPreview = null;
+        if ($hostCandidates->isNotEmpty()) {
+            $conflictingPreview = ApplicationPreview::query()
+                ->whereIn('application_id', Application::ownedByCurrentTeamAPI($teamId)
+                    ->withoutGlobalScope('withRelations')
+                    ->reorder()
+                    ->select('applications.id'))
+                ->whereKeyNot($preview->id)
+                ->whereNotNull('fqdn')
+                ->where(function ($query) use ($hostCandidates): void {
+                    foreach ($hostCandidates as $host) {
+                        $query->orWhere('fqdn', 'like', '%'.$host.'%');
+                    }
+                })
+                ->get(['uuid', 'pull_request_id', 'fqdn'])
+                ->first(fn (ApplicationPreview $otherPreview): bool => collect(ValidationPatterns::applicationDomainList($otherPreview->fqdn))
+                    ->map(fn (string $domain): string => DomainPortOverrides::withoutPort($domain))
+                    ->intersect($urls)
+                    ->isNotEmpty());
+        }
+
+        if ($conflictingPreview && ! $request->boolean('force_domain_override')) {
+            return response()->json([
+                'message' => 'Domain conflicts detected. Use force_domain_override=true to proceed.',
+                'conflicts' => [[
+                    'domain' => collect(ValidationPatterns::applicationDomainList($conflictingPreview->fqdn))
+                        ->map(fn (string $domain): string => DomainPortOverrides::withoutPort($domain))
+                        ->intersect($urls)
+                        ->first(),
+                    'resource_name' => 'Preview deployment #'.$conflictingPreview->pull_request_id,
+                    'resource_uuid' => $conflictingPreview->uuid,
+                    'resource_type' => 'application',
+                    'message' => 'Domain is already in use by another preview deployment.',
+                ]],
+                'warning' => 'Using the same domain for multiple resources can cause routing conflicts and unpredictable behavior.',
+            ], 409);
+        }
+
+        $preview->domain_port_overrides = $normalized['overrides'];
+        $preview->fqdn = $portlessDomains;
+        if ($isCompose) {
+            $preview->docker_compose_domains = json_encode($dockerComposeDomains);
+        }
+        $preview->save();
+
+        auditLog('api.application.preview_updated', [
+            'team_id' => $teamId,
+            'application_uuid' => $application->uuid,
+            'pull_request_id' => $preview->pull_request_id,
+            'changed_fields' => [$isCompose ? 'docker_compose_domains' : 'domains'],
+        ]);
+
+        return response()->json([
+            'uuid' => $preview->uuid,
+            'pull_request_id' => $preview->pull_request_id,
+            'domains' => $preview->fqdn,
+            'docker_compose_domains' => $dockerComposeDomainsResponse,
+            'domain_port_overrides' => $preview->domain_port_overrides,
+        ]);
+    }
+
     #[OA\Delete(
         summary: 'Delete',
         description: 'Delete application by UUID.',
@@ -2818,6 +3069,7 @@ public function update_by_uuid(Request $request)
             'http_basic_auth_username' => 'string',
             'http_basic_auth_password' => 'string',
             'include_source_commit_in_build' => 'boolean',
+            'ports_exposes' => 'nullable|string|regex:/^(\d+)(,\d+)*$/',
         ];
         $validationRules = array_merge(sharedDataApplications(), $validationRules);
         $validationMessages = [
@@ -2826,10 +3078,10 @@ public function update_by_uuid(Request $request)
         $validator = Validator::make($request->all(), $validationRules, $validationMessages);
 
         // Validate ports_exposes
-        if ($request->has('ports_exposes')) {
+        if ($request->filled('ports_exposes')) {
             $ports = explode(',', $request->ports_exposes);
             foreach ($ports as $port) {
-                if (! is_numeric($port)) {
+                if (! is_numeric($port) || (int) $port < 1 || (int) $port > 65535) {
                     return response()->json([
                         'message' => 'Validation failed.',
                         'errors' => [
@@ -5152,7 +5404,7 @@ public function delete_preview_by_pull_request_id(Request $request): JsonRespons
         $this->authorize('delete', $application);
 
         $pullRequestIdRaw = $request->route('pull_request_id');
-        if (! is_numeric($pullRequestIdRaw) || (int) $pullRequestIdRaw <= 0) {
+        if (! ctype_digit((string) $pullRequestIdRaw) || (int) $pullRequestIdRaw <= 0) {
             return response()->json(['message' => 'Invalid pull_request_id.'], 422);
         }
         $pullRequestId = (int) $pullRequestIdRaw;
diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index d736ec385..9f1e7fc17 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -8,6 +8,7 @@
 use App\Livewire\Project\Shared\ConfigurationChecker;
 use App\Models\Application;
 use App\Models\Server;
+use App\Support\DomainPortOverrides;
 use App\Support\DomainUrlParts;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
@@ -57,7 +58,7 @@ class Domains extends Component
 
     public ?string $editingService = null;
 
-    /** @var array<int, array{url: string, service: ?string, dns_status: string, dns_message: string, expected_ip: ?string, checked_at?: ?string, is_suggested?: bool, suggested_for?: ?string, suggestion_label?: ?string, needs_force_add?: bool}> */
+    /** @var array<int, array{url: string, service: ?string, dns_status: string, dns_message: string, expected_ip: ?string, checked_at?: ?string, is_suggested?: bool, suggested_for?: ?string, suggestion_label?: ?string, needs_force_add?: bool, internal_port?: ?int, has_port_override?: bool}> */
     public array $domainRows = [];
 
     /** When set, the next addSuggestedDomain call for this index skips the DNS block. */
@@ -70,6 +71,14 @@ class Domains extends Component
 
     public bool $showDomainConflictModal = false;
 
+    public bool $showPortWarningModal = false;
+
+    public bool $forceUseUnknownPort = false;
+
+    public ?int $unrecognizedPort = null;
+
+    public ?string $pendingPortAction = null;
+
     public bool $forceSaveDomains = false;
 
     public bool $forceSaveDns = false;
@@ -485,32 +494,19 @@ protected function suggestedDomainMeta(bool $suggestedIsWww, ?string $redirectOv
 
     /**
      * @param  array<string, array{status?: string, message?: string, expected_ip?: ?string, checked_at?: ?string}>  $stored
-     * @return array{url: string, service: ?string, dns_status: string, dns_message: string, expected_ip: ?string, checked_at: ?string, is_suggested: bool, suggested_for: ?string, suggestion_label: ?string, needs_force_add: bool}
+     * @return array{url: string, service: ?string, dns_status: string, dns_message: string, expected_ip: ?string, checked_at: ?string, is_suggested: bool, suggested_for: ?string, suggestion_label: ?string, needs_force_add: bool, internal_port: ?int, has_port_override: bool}
      */
     protected function domainRowFromStored(string $url, ?string $service, array $stored): array
     {
         $key = $this->domainDnsStatusKey($url, $service);
         $entry = $stored[$key] ?? null;
+        $port = $this->effectiveDomainInternalPort($url);
 
-        if (is_array($entry) && filled(data_get($entry, 'status'))) {
-            return [
-                'url' => $url,
-                'service' => $service,
-                'dns_status' => (string) data_get($entry, 'status', 'pending'),
-                'dns_message' => (string) data_get($entry, 'message', 'Not checked yet.'),
-                'expected_ip' => data_get($entry, 'expected_ip') ?: $this->serverIp,
-                'checked_at' => data_get($entry, 'checked_at'),
-                'check_id' => data_get($entry, 'check_id'),
-                'is_suggested' => false,
-                'suggested_for' => null,
-                'suggestion_label' => null,
-                'needs_force_add' => false,
-            ];
-        }
-
-        return [
+        $row = [
             'url' => $url,
             'service' => $service,
+            'internal_port' => $port['internal_port'],
+            'has_port_override' => $port['has_port_override'],
             'dns_status' => 'pending',
             'dns_message' => 'Not checked yet.',
             'expected_ip' => $this->serverIp,
@@ -521,6 +517,104 @@ protected function domainRowFromStored(string $url, ?string $service, array $sto
             'suggestion_label' => null,
             'needs_force_add' => false,
         ];
+
+        if (is_array($entry) && filled(data_get($entry, 'status'))) {
+            $row['dns_status'] = (string) data_get($entry, 'status', 'pending');
+            $row['dns_message'] = (string) data_get($entry, 'message', 'Not checked yet.');
+            $row['expected_ip'] = data_get($entry, 'expected_ip') ?: $this->serverIp;
+            $row['checked_at'] = data_get($entry, 'checked_at');
+            $row['check_id'] = data_get($entry, 'check_id');
+        }
+
+        return $row;
+    }
+
+    /**
+     * @return array{internal_port: ?int, has_port_override: bool}
+     */
+    protected function effectiveDomainInternalPort(string $url): array
+    {
+        $canonical = DomainPortOverrides::withoutPort($url);
+        $overrides = $this->application->domain_port_overrides ?? [];
+        $legacyPortPart = DomainUrlParts::split($url)['port'] ?? '';
+        $legacyPort = $legacyPortPart !== '' ? (int) $legacyPortPart : null;
+        $hasMapEntry = array_key_exists($canonical, $overrides);
+
+        if ($hasMapEntry) {
+            return [
+                'internal_port' => (int) $overrides[$canonical],
+                'has_port_override' => true,
+            ];
+        }
+
+        if ($legacyPort !== null) {
+            return [
+                'internal_port' => $legacyPort,
+                'has_port_override' => true,
+            ];
+        }
+
+        if ($this->application->settings?->is_static) {
+            return [
+                'internal_port' => 80,
+                'has_port_override' => false,
+            ];
+        }
+
+        $exposed = $this->application->ports_exposes_array;
+        $defaultPort = isset($exposed[0]) && is_numeric($exposed[0]) && (int) $exposed[0] > 0
+            ? (int) $exposed[0]
+            : null;
+
+        return [
+            'internal_port' => $defaultPort,
+            'has_port_override' => false,
+        ];
+    }
+
+    /**
+     * @param  array{scheme: string, host: string, port: string, path: string}  $parts
+     */
+    protected function portFromParts(array $parts): ?int
+    {
+        $port = trim((string) ($parts['port'] ?? ''));
+        if ($port === '' || ! ctype_digit($port) || (int) $port <= 0) {
+            return null;
+        }
+
+        return (int) $port;
+    }
+
+    protected function currentRowPort(string $url): ?int
+    {
+        $canonical = DomainPortOverrides::withoutPort($url);
+        $override = ($this->application->domain_port_overrides ?? [])[$canonical] ?? null;
+        if (filled($override) && (int) $override > 0) {
+            return (int) $override;
+        }
+
+        $legacy = DomainUrlParts::split($url)['port'] ?? '';
+
+        return $legacy !== '' && ctype_digit($legacy) ? (int) $legacy : null;
+    }
+
+    protected function shouldConfirmPort(?int $port, ?int $currentPort = null): bool
+    {
+        if ($this->forceUseUnknownPort || $port === null) {
+            return false;
+        }
+        if ($currentPort !== null && $port === $currentPort) {
+            return false;
+        }
+
+        return $this->application->portRequiresConfirmation($port);
+    }
+
+    protected function openPortWarning(?int $port, string $action): void
+    {
+        $this->unrecognizedPort = $port;
+        $this->pendingPortAction = $action;
+        $this->showPortWarningModal = true;
     }
 
     /**
@@ -824,6 +918,31 @@ public function confirmDomainUsage(): void
         $this->addDomain();
     }
 
+    public function confirmUseUnknownPort(): void
+    {
+        $this->authorize('update', $this->application);
+        $this->forceUseUnknownPort = true;
+        $this->showPortWarningModal = false;
+        $action = $this->pendingPortAction;
+        $this->pendingPortAction = null;
+
+        if ($action === 'update') {
+            $this->updateDomain();
+
+            return;
+        }
+
+        $this->addDomain();
+    }
+
+    public function cancelUseUnknownPort(): void
+    {
+        $this->showPortWarningModal = false;
+        $this->forceUseUnknownPort = false;
+        $this->unrecognizedPort = null;
+        $this->pendingPortAction = null;
+    }
+
     /**
      * Clear pending conflict state when the modal is dismissed without confirmation.
      * confirmDomainUsage sets forceSaveDomains before closing the modal.
@@ -848,7 +967,7 @@ public function addDomain(): void
                 return;
             }
 
-            if ($this->newDomainPartsChanged) {
+            if ($this->newDomainPartsChanged || filled($this->newDomainParts['host'] ?? null)) {
                 $this->newDomain = DomainUrlParts::compose(...$this->newDomainParts);
             }
             $this->validateOnly('newDomain');
@@ -867,15 +986,24 @@ public function addDomain(): void
                 ->values()
                 ->all();
             $current = $this->currentDomainList($this->newDomainService);
+            $currentCanonicalDomains = $current->map(
+                fn (string $url): string => DomainPortOverrides::withoutPort($url)
+            );
 
             foreach ($newUrls as $url) {
-                if ($current->contains($url)) {
+                if ($currentCanonicalDomains->contains(DomainPortOverrides::withoutPort($url))) {
                     $this->addError('newDomain', "Domain {$url} is already configured.");
 
                     return;
                 }
             }
 
+            if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts))) {
+                $this->openPortWarning($this->portFromParts($this->newDomainParts), 'add');
+
+                return;
+            }
+
             $merged = $current->merge($newUrls)->merge($pairedUrls)->unique()->values();
             $this->pendingAction = 'add';
             if (! $this->saveDomainList($merged, $this->newDomainService)) {
@@ -884,6 +1012,7 @@ public function addDomain(): void
 
             $this->forceSaveDomains = false;
             $this->pendingAction = null;
+            $this->forceUseUnknownPort = false;
             $serviceForCheck = $this->newDomainService;
             $this->resetAddDomainForm();
             $this->dispatch('close-modal');
@@ -1110,6 +1239,11 @@ public function startEdit(int $index): void
         $this->editingIndex = $index;
         $this->editingDomain = $this->domainRows[$index]['url'];
         $this->editingDomainParts = DomainUrlParts::split($this->editingDomain);
+        $canonical = DomainPortOverrides::withoutPort($this->editingDomain);
+        $savedPort = ($this->application->domain_port_overrides ?? [])[$canonical] ?? null;
+        if (filled($savedPort)) {
+            $this->editingDomainParts['port'] = (string) $savedPort;
+        }
         $this->editingDomainPartsChanged = false;
         $this->editingService = $this->domainRows[$index]['service'];
         $this->resetEditDomainDnsGate();
@@ -1227,7 +1361,7 @@ public function updateDomain(): void
                 return;
             }
 
-            if ($this->editingDomainPartsChanged) {
+            if ($this->editingDomainPartsChanged || filled($this->editingDomainParts['host'] ?? null)) {
                 $this->editingDomain = DomainUrlParts::compose(...$this->editingDomainParts);
             }
             $this->validateOnly('editingDomain');
@@ -1244,13 +1378,29 @@ public function updateDomain(): void
             $service = $this->editingService;
             $wasNoindexed = $this->application->isDomainNoindexed($oldUrl);
 
+            if (blank(DomainUrlParts::split($newUrl)['port'] ?? null)) {
+                $portOverrides = $this->application->domain_port_overrides ?? [];
+                unset($portOverrides[DomainPortOverrides::withoutPort($oldUrl)]);
+                unset($portOverrides[DomainPortOverrides::withoutPort($newUrl)]);
+                $this->application->domain_port_overrides = $portOverrides ?: null;
+            }
+
             $current = $this->currentDomainList($service);
-            if ($newUrl !== $oldUrl && $current->contains($newUrl)) {
+            $otherCanonicalDomains = $current
+                ->reject(fn (string $url): bool => $url === $oldUrl)
+                ->map(fn (string $url): string => DomainPortOverrides::withoutPort($url));
+            if ($otherCanonicalDomains->contains(DomainPortOverrides::withoutPort($newUrl))) {
                 $this->addError('editingDomain', "Domain {$newUrl} is already configured.");
 
                 return;
             }
 
+            if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl))) {
+                $this->openPortWarning($this->portFromParts($this->editingDomainParts), 'update');
+
+                return;
+            }
+
             if (! $this->forceSaveEditDns && $this->shouldValidateDnsForAdd()) {
                 $dnsFailure = $this->findDnsFailureMessage([$newUrl]);
                 if ($dnsFailure !== null) {
@@ -1278,6 +1428,7 @@ public function updateDomain(): void
 
             $this->forceSaveDomains = false;
             $this->pendingAction = null;
+            $this->forceUseUnknownPort = false;
             $this->cancelEdit();
             $this->dispatch('edit-domain-saved');
             $this->dispatch('success', 'Domain updated.');
@@ -1823,6 +1974,8 @@ protected function saveDomainList(
             }
         }
 
+        $intendedComposeOverrides = null;
+
         if ($this->isCompose) {
             if (blank($serviceName)) {
                 $this->dispatch('error', 'A service is required for compose domains.');
@@ -1838,6 +1991,15 @@ protected function saveDomainList(
                 $allDomains = [];
             }
 
+            $previousServiceUrls = $this->currentDomainList($serviceName);
+            $normalizedPorts = DomainPortOverrides::normalize($domainString, $this->application->domain_port_overrides);
+            $domainString = $normalizedPorts['fqdn'];
+            $intendedComposeOverrides = $this->mergeComposeDomainPortOverrides(
+                $previousServiceUrls,
+                $domainString,
+                $normalizedPorts['overrides'] ?? null,
+            );
+
             $existing = is_array($allDomains[$serviceName] ?? null) ? $allDomains[$serviceName] : [];
             // Preserve stored redirect only — pending Direction dropdown values must not
             // persist until setServiceRedirect() runs.
@@ -1846,6 +2008,7 @@ protected function saveDomainList(
             ]);
 
             $this->application->docker_compose_domains = json_encode($allDomains);
+            $this->application->domain_port_overrides = $intendedComposeOverrides;
             $this->application->fqdn = null;
         } else {
             $this->application->fqdn = $domainString;
@@ -1872,12 +2035,47 @@ protected function saveDomainList(
         }
 
         $this->application->save();
+
+        if ($this->isCompose && ($this->application->domain_port_overrides ?? null) !== $intendedComposeOverrides) {
+            $this->application->domain_port_overrides = $intendedComposeOverrides;
+            $this->application->save();
+        }
+
         $this->resetDefaultLabels();
         $this->dispatch('configurationChanged');
 
         return true;
     }
 
+    /**
+     * @param  Collection<int, string>  $previousServiceUrls
+     * @param  array<string, int>|null  $incomingOverrides
+     * @return array<string, int>|null
+     */
+    protected function mergeComposeDomainPortOverrides(
+        Collection $previousServiceUrls,
+        ?string $newDomainString,
+        ?array $incomingOverrides,
+    ): ?array {
+        $merged = $this->application->domain_port_overrides ?? [];
+        $newCanonical = collect($this->splitDomains($newDomainString))
+            ->map(fn (string $url): string => DomainPortOverrides::withoutPort($url))
+            ->all();
+
+        foreach ($previousServiceUrls as $url) {
+            $canonical = DomainPortOverrides::withoutPort($url);
+            if (! in_array($canonical, $newCanonical, true)) {
+                unset($merged[$canonical]);
+            }
+        }
+
+        foreach ($incomingOverrides ?? [] as $url => $port) {
+            $merged[$url] = (int) $port;
+        }
+
+        return $merged ?: null;
+    }
+
     protected function resetDefaultLabels(): void
     {
         try {
diff --git a/app/Livewire/Project/Application/PreviewDomains.php b/app/Livewire/Project/Application/PreviewDomains.php
index f2557e4f5..21296978f 100644
--- a/app/Livewire/Project/Application/PreviewDomains.php
+++ b/app/Livewire/Project/Application/PreviewDomains.php
@@ -5,12 +5,12 @@
 use App\Actions\Shared\CheckDomainDns;
 use App\Jobs\CheckDomainDnsJob;
 use App\Models\ApplicationPreview;
+use App\Support\DomainPortOverrides;
 use App\Support\DomainUrlParts;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\DB;
 use Livewire\Component;
-use Spatie\Url\Url;
 
 class PreviewDomains extends Component
 {
@@ -28,6 +28,14 @@ class PreviewDomains extends Component
 
     public ?int $editingIndex = null;
 
+    public bool $showPortWarningModal = false;
+
+    public bool $forceUseUnknownPort = false;
+
+    public ?int $unrecognizedPort = null;
+
+    public ?string $pendingPortAction = null;
+
     public function mount(): void
     {
         $this->refreshDomains();
@@ -57,11 +65,20 @@ public function addDomain(): void
         if ($domain === null) {
             return;
         }
-        if (collect($this->domainRows)->contains(fn (array $row): bool => $row['url'] === $domain && $row['service'] === $this->newDomainService)) {
+        $canonicalDomain = DomainPortOverrides::withoutPort($domain);
+        if (collect($this->domainRows)->contains(
+            fn (array $row): bool => DomainPortOverrides::withoutPort($row['url']) === $canonicalDomain
+                && $row['service'] === $this->newDomainService
+        )) {
             $this->addError('newDomainParts.host', 'This domain is already configured.');
 
             return;
         }
+        if ($this->shouldConfirmPort($this->portFromParts($this->newDomainParts))) {
+            $this->openPortWarning($this->portFromParts($this->newDomainParts), 'add');
+
+            return;
+        }
         $this->domainRows[] = $this->makeRow($domain, $this->newDomainService);
         $index = array_key_last($this->domainRows);
         $checkId = new_public_id();
@@ -71,10 +88,12 @@ public function addDomain(): void
         if (! $this->persistDomains()) {
             return;
         }
+        $domain = $this->domainRows[$index]['url'] ?? DomainPortOverrides::withoutPort($domain);
         $this->newDomainParts = DomainUrlParts::empty();
         $this->newDomainService = $this->preview->application->build_pack === 'dockercompose'
             ? ($this->composeServices()[0] ?? null)
             : null;
+        $this->forceUseUnknownPort = false;
         $this->dispatch('close-modal');
 
         try {
@@ -109,7 +128,8 @@ public function generateDomain(): void
                 $service = $this->newDomainService ?? data_get($this->domainRows, '0.service');
                 foreach ($this->generateComposeDomains((string) $service) as $domain) {
                     $alreadyExists = collect($this->domainRows)->contains(
-                        fn (array $row): bool => $row['url'] === $domain && $row['service'] === $service
+                        fn (array $row): bool => DomainPortOverrides::withoutPort($row['url']) === DomainPortOverrides::withoutPort($domain)
+                            && $row['service'] === $service
                     );
                     if (! $alreadyExists) {
                         $this->domainRows[] = $this->makeRow($domain, $service);
@@ -134,6 +154,11 @@ public function startEdit(int $index): void
         }
         $this->editingIndex = $index;
         $this->editingDomainParts = DomainUrlParts::split($this->domainRows[$index]['url']);
+        $canonical = DomainPortOverrides::withoutPort($this->domainRows[$index]['url']);
+        $savedPort = ($this->preview->domain_port_overrides ?? [])[$canonical] ?? null;
+        if (filled($savedPort)) {
+            $this->editingDomainParts['port'] = (string) $savedPort;
+        }
         $this->dispatch('open-preview-domain-edit');
     }
 
@@ -147,6 +172,18 @@ public function updateDomain(): void
         if ($domain === null) {
             return;
         }
+        $oldUrl = $this->domainRows[$this->editingIndex]['url'];
+        if ($this->shouldConfirmPort($this->portFromParts($this->editingDomainParts), $this->currentRowPort($oldUrl))) {
+            $this->openPortWarning($this->portFromParts($this->editingDomainParts), 'update');
+
+            return;
+        }
+        if (blank(DomainUrlParts::split($domain)['port'] ?? null)) {
+            $portOverrides = $this->preview->domain_port_overrides ?? [];
+            unset($portOverrides[DomainPortOverrides::withoutPort($oldUrl)]);
+            unset($portOverrides[DomainPortOverrides::withoutPort($domain)]);
+            $this->preview->domain_port_overrides = $portOverrides ?: null;
+        }
         $this->domainRows[$this->editingIndex]['url'] = $domain;
         $this->domainRows[$this->editingIndex]['dns_status'] = 'pending';
         $this->domainRows[$this->editingIndex]['dns_message'] = 'DNS has not been checked yet.';
@@ -155,11 +192,37 @@ public function updateDomain(): void
         if (! $this->persistDomains()) {
             return;
         }
+        $this->forceUseUnknownPort = false;
         $this->dispatch('close-preview-domain-edit');
         $this->dispatch('success', 'Domain updated.');
         $this->checkDomainDns($index);
     }
 
+    public function confirmUseUnknownPort(): void
+    {
+        $this->authorize('update', $this->preview->application);
+        $this->forceUseUnknownPort = true;
+        $this->showPortWarningModal = false;
+        $action = $this->pendingPortAction;
+        $this->pendingPortAction = null;
+
+        if ($action === 'update') {
+            $this->updateDomain();
+
+            return;
+        }
+
+        $this->addDomain();
+    }
+
+    public function cancelUseUnknownPort(): void
+    {
+        $this->showPortWarningModal = false;
+        $this->forceUseUnknownPort = false;
+        $this->unrecognizedPort = null;
+        $this->pendingPortAction = null;
+    }
+
     public function removeDomain(int $index): void
     {
         $this->authorize('update', $this->preview->application);
@@ -299,8 +362,24 @@ private function persistDomains(): bool
         } else {
             $this->preview->fqdn = collect($this->domainRows)->pluck('url')->implode(',') ?: null;
         }
+        $normalized = DomainPortOverrides::normalize($this->preview->fqdn, $this->preview->domain_port_overrides);
+        $this->preview->fqdn = $normalized['fqdn'];
+        $this->preview->domain_port_overrides = $normalized['overrides'];
+        if ($this->preview->application->build_pack === 'dockercompose' && is_array($domains ?? null)) {
+            foreach ($domains as $service => $entry) {
+                $serviceDomains = $this->splitDomains(composeDomainEntryString($entry));
+                $domains[$service]['domain'] = collect($serviceDomains)
+                    ->map(fn (string $url): string => DomainPortOverrides::withoutPort($url))
+                    ->implode(',');
+            }
+            $this->preview->docker_compose_domains = json_encode($domains);
+        }
+        foreach ($this->domainRows as $index => $row) {
+            $this->domainRows[$index]['url'] = DomainPortOverrides::withoutPort($row['url']);
+        }
         $this->preview->save();
         $this->persistDnsStatuses();
+        $this->refreshDomains();
         $this->dispatch('update_links');
         $this->dispatch('previewDomainsChanged');
 
@@ -360,16 +439,107 @@ private function validatedDomain(array $parts, string $errorKey): ?string
     private function makeRow(string $url, ?string $service, array $statuses = []): array
     {
         $status = $statuses[$this->statusKey($url, $service)] ?? [];
+        $port = $this->effectiveDomainInternalPort($url);
 
         return [
             'url' => $url,
             'service' => $service,
+            'internal_port' => $port['internal_port'],
+            'has_port_override' => $port['has_port_override'],
             'dns_status' => $status['status'] ?? 'pending',
             'dns_message' => $status['message'] ?? 'DNS has not been checked yet.',
             'check_id' => $status['check_id'] ?? null,
         ];
     }
 
+    /**
+     * @param  array{scheme: string, host: string, port: string, path: string}  $parts
+     */
+    private function portFromParts(array $parts): ?int
+    {
+        $port = trim((string) ($parts['port'] ?? ''));
+        if ($port === '' || ! ctype_digit($port) || (int) $port <= 0) {
+            return null;
+        }
+
+        return (int) $port;
+    }
+
+    private function currentRowPort(string $url): ?int
+    {
+        $canonical = DomainPortOverrides::withoutPort($url);
+        $override = ($this->preview->domain_port_overrides ?? [])[$canonical] ?? null;
+        if (filled($override) && (int) $override > 0) {
+            return (int) $override;
+        }
+
+        $legacy = DomainUrlParts::split($url)['port'] ?? '';
+
+        return $legacy !== '' && ctype_digit($legacy) ? (int) $legacy : null;
+    }
+
+    private function shouldConfirmPort(?int $port, ?int $currentPort = null): bool
+    {
+        if ($this->forceUseUnknownPort || $port === null) {
+            return false;
+        }
+        if ($currentPort !== null && $port === $currentPort) {
+            return false;
+        }
+
+        return $this->preview->application->portRequiresConfirmation($port);
+    }
+
+    private function openPortWarning(?int $port, string $action): void
+    {
+        $this->unrecognizedPort = $port;
+        $this->pendingPortAction = $action;
+        $this->showPortWarningModal = true;
+    }
+
+    /**
+     * @return array{internal_port: ?int, has_port_override: bool}
+     */
+    private function effectiveDomainInternalPort(string $url): array
+    {
+        $canonical = DomainPortOverrides::withoutPort($url);
+        $overrides = $this->preview->domain_port_overrides ?? [];
+        $legacyPortPart = DomainUrlParts::split($url)['port'] ?? '';
+        $legacyPort = $legacyPortPart !== '' ? (int) $legacyPortPart : null;
+        $hasMapEntry = array_key_exists($canonical, $overrides);
+
+        if ($hasMapEntry) {
+            return [
+                'internal_port' => (int) $overrides[$canonical],
+                'has_port_override' => true,
+            ];
+        }
+
+        if ($legacyPort !== null) {
+            return [
+                'internal_port' => $legacyPort,
+                'has_port_override' => true,
+            ];
+        }
+
+        if ($this->preview->application->settings?->is_static) {
+            return [
+                'internal_port' => 80,
+                'has_port_override' => false,
+            ];
+        }
+
+        $exposed = $this->preview->application->ports_exposes_array;
+        $defaultPort = isset($exposed[0]) && is_numeric($exposed[0]) && (int) $exposed[0] > 0
+            ? (int) $exposed[0]
+            : null;
+
+        return [
+            'internal_port' => $defaultPort,
+            'has_port_override' => false,
+        ];
+    }
+
     private function statusKey(string $url, ?string $service): string
     {
         return hash('sha256', $url.'|'.($service ?? ''));
@@ -393,14 +563,14 @@ private function generateComposeDomains(string $service): array
         }
 
         return collect($this->splitDomains($domainString))->map(function (string $domain): string {
-            $url = Url::fromString($domain);
-            $generatedDomain = str_replace('{{random}}', new_public_id(), $this->preview->application->preview_url_template);
-            $generatedDomain = str_replace('{{domain}}', $url->getHost(), $generatedDomain);
-            $generatedDomain = str_replace('{{pr_id}}', (string) $this->preview->pull_request_id, $generatedDomain);
-            $port = $url->getPort() !== null ? ':'.$url->getPort() : '';
-            $path = ! in_array($url->getPath(), ['', '/'], true) ? $url->getPath() : '';
+            $generated = $this->preview->generatedPreviewDomain($domain);
+            if (filled($generated['port'])) {
+                $overrides = $this->preview->domain_port_overrides ?? [];
+                $overrides[$generated['url']] = $generated['port'];
+                $this->preview->domain_port_overrides = $overrides;
+            }
 
-            return "{$url->getScheme()}://{$generatedDomain}{$port}{$path}";
+            return $generated['url'];
         })->all();
     }
 
@@ -413,7 +583,6 @@ private function composeServices(bool $failOnError = false): array
                 return [];
             }
 
-            $usesLegacyServiceKeys = (int) $this->preview->application->compose_parsing_version < 3;
             $previewSuffix = '-pr-'.$this->preview->pull_request_id;
             $serviceNames = [];
             foreach ($services as $serviceName => $service) {
@@ -422,7 +591,7 @@ private function composeServices(bool $failOnError = false): array
                 }
 
                 $serviceName = (string) $serviceName;
-                if ($usesLegacyServiceKeys && str_ends_with($serviceName, $previewSuffix)) {
+                if (str_ends_with($serviceName, $previewSuffix)) {
                     $serviceName = substr($serviceName, 0, -strlen($previewSuffix));
                 }
                 $serviceNames[] = $serviceName;
diff --git a/app/Livewire/Project/Service/Domains.php b/app/Livewire/Project/Service/Domains.php
index b5ca45b87..d5254e093 100644
--- a/app/Livewire/Project/Service/Domains.php
+++ b/app/Livewire/Project/Service/Domains.php
@@ -9,6 +9,7 @@
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
+use App\Support\DomainPortOverrides;
 use App\Support\DomainUrlParts;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
@@ -306,30 +307,15 @@ protected function domainRowFromStored(string $url, ServiceApplication $app, arr
     {
         $entry = $stored[$url] ?? null;
         $displayName = $app->human_name ?: $app->name;
+        $port = $this->effectiveDomainInternalPort($url, $app);
 
-        if (is_array($entry) && filled(data_get($entry, 'status'))) {
-            return [
-                'service_application_id' => $app->id,
-                'service_name' => $displayName,
-                'service_image' => $app->image,
-                'url' => $url,
-                'dns_status' => (string) data_get($entry, 'status', 'pending'),
-                'dns_message' => (string) data_get($entry, 'message', 'Not checked yet.'),
-                'expected_ip' => data_get($entry, 'expected_ip') ?: $this->serverIp,
-                'checked_at' => data_get($entry, 'checked_at'),
-                'check_id' => data_get($entry, 'check_id'),
-                'is_suggested' => false,
-                'suggested_for' => null,
-                'suggestion_label' => null,
-                'needs_force_add' => false,
-            ];
-        }
-
-        return [
+        $row = [
             'service_application_id' => $app->id,
             'service_name' => $displayName,
             'service_image' => $app->image,
             'url' => $url,
+            'internal_port' => $port['internal_port'],
+            'has_port_override' => $port['has_port_override'],
             'dns_status' => 'pending',
             'dns_message' => 'Not checked yet.',
             'expected_ip' => $this->serverIp,
@@ -340,6 +326,48 @@ protected function domainRowFromStored(string $url, ServiceApplication $app, arr
             'suggestion_label' => null,
             'needs_force_add' => false,
         ];
+
+        if (is_array($entry) && filled(data_get($entry, 'status'))) {
+            $row['dns_status'] = (string) data_get($entry, 'status', 'pending');
+            $row['dns_message'] = (string) data_get($entry, 'message', 'Not checked yet.');
+            $row['expected_ip'] = data_get($entry, 'expected_ip') ?: $this->serverIp;
+            $row['checked_at'] = data_get($entry, 'checked_at');
+            $row['check_id'] = data_get($entry, 'check_id');
+        }
+
+        return $row;
+    }
+
+    /**
+     * @return array{internal_port: ?int, has_port_override: bool}
+     */
+    protected function effectiveDomainInternalPort(string $url, ServiceApplication $app): array
+    {
+        $canonical = DomainPortOverrides::withoutPort($url);
+        $overrides = $app->domain_port_overrides ?? [];
+        $legacyPortPart = DomainUrlParts::split($url)['port'] ?? '';
+        $legacyPort = $legacyPortPart !== '' ? (int) $legacyPortPart : null;
+
+        if (array_key_exists($canonical, $overrides)) {
+            return [
+                'internal_port' => (int) $overrides[$canonical],
+                'has_port_override' => true,
+            ];
+        }
+
+        if ($legacyPort !== null && $legacyPort > 0) {
+            return [
+                'internal_port' => $legacyPort,
+                'has_port_override' => true,
+            ];
+        }
+
+        $requiredPort = $app->getRequiredPort();
+
+        return [
+            'internal_port' => ($requiredPort !== null && $requiredPort > 0) ? $requiredPort : null,
+            'has_port_override' => false,
+        ];
     }
 
     /**
@@ -990,8 +1018,11 @@ public function addDomain(): void
                     ->all()
                 : [];
             $current = collect($this->splitDomains($app->fqdn));
+            $currentCanonicalDomains = $current->map(
+                fn (string $url): string => DomainPortOverrides::withoutPort($url)
+            );
             foreach ($newUrls as $url) {
-                if ($current->contains($url)) {
+                if ($currentCanonicalDomains->contains(DomainPortOverrides::withoutPort($url))) {
                     $this->addError('newDomain', "Domain {$url} is already configured for this service.");
 
                     return;
@@ -1111,6 +1142,12 @@ public function startEdit(int $index): void
         $this->editingIndex = $index;
         $this->editingDomain = $this->domainRows[$index]['url'];
         $this->editingDomainParts = DomainUrlParts::split($this->editingDomain);
+        $app = $this->findServiceApp((int) $this->domainRows[$index]['service_application_id']);
+        $canonical = DomainPortOverrides::withoutPort($this->editingDomain);
+        $savedPort = ($app?->domain_port_overrides ?? [])[$canonical] ?? null;
+        if (filled($savedPort)) {
+            $this->editingDomainParts['port'] = (string) $savedPort;
+        }
         $this->editingDomainPartsChanged = false;
         $this->editingServiceApplicationId = (int) $this->domainRows[$index]['service_application_id'];
         $this->editDomainDnsFailed = false;
@@ -1144,7 +1181,7 @@ public function updateDomain(): void
                 return;
             }
 
-            if ($this->editingDomainPartsChanged) {
+            if ($this->editingDomainPartsChanged || filled($this->editingDomainParts['host'] ?? null)) {
                 $this->editingDomain = DomainUrlParts::compose(...$this->editingDomainParts);
             }
             $this->validateOnly('editingDomain');
@@ -1166,7 +1203,17 @@ public function updateDomain(): void
             $current = collect($this->splitDomains($app->fqdn));
             $wasNoindexed = $app->isDomainNoindexed($oldUrl);
 
-            if ($newUrl !== $oldUrl && $current->contains($newUrl)) {
+            if (blank(DomainUrlParts::split($newUrl)['port'] ?? null)) {
+                $portOverrides = $app->domain_port_overrides ?? [];
+                unset($portOverrides[DomainPortOverrides::withoutPort($oldUrl)]);
+                unset($portOverrides[DomainPortOverrides::withoutPort($newUrl)]);
+                $app->domain_port_overrides = $portOverrides ?: null;
+            }
+
+            $otherCanonicalDomains = $current
+                ->reject(fn (string $url): bool => $url === $oldUrl)
+                ->map(fn (string $url): string => DomainPortOverrides::withoutPort($url));
+            if ($otherCanonicalDomains->contains(DomainPortOverrides::withoutPort($newUrl))) {
                 $this->addError('editingDomain', "Domain {$newUrl} is already configured for this service.");
 
                 return;
@@ -1398,8 +1445,9 @@ protected function saveDomainListForApp(
         if (! $this->forceRemovePort) {
             $requiredPort = $app->getRequiredPort();
             if ($requiredPort !== null && $domainString) {
+                $previousFqdn = $app->getOriginal('fqdn');
                 foreach ($this->splitDomains($domainString) as $fqdn) {
-                    if (ServiceApplication::extractPortFromUrl($fqdn) === null) {
+                    if ($app->portRequiresConfirmation($fqdn, $requiredPort, is_string($previousFqdn) ? $previousFqdn : null)) {
                         $this->requiredPort = $requiredPort;
                         $this->showPortWarningModal = true;
                         $app->refresh();
diff --git a/app/Livewire/Project/Service/EditDomain.php b/app/Livewire/Project/Service/EditDomain.php
index bfcd04ac5..f09989153 100644
--- a/app/Livewire/Project/Service/EditDomain.php
+++ b/app/Livewire/Project/Service/EditDomain.php
@@ -52,12 +52,12 @@ private function syncData(bool $toModel = false): void
             $this->validate();
 
             // Sync to model
-            $this->application->fqdn = $this->fqdn;
+            $this->application->setEditableUrls($this->fqdn);
 
             $this->application->save();
         } else {
             // Sync from model
-            $this->fqdn = $this->application->fqdn;
+            $this->fqdn = $this->application->url;
         }
     }
 
@@ -84,6 +84,10 @@ public function cancelRemovePort()
     public function submit()
     {
         try {
+            $persistedApplication = $this->application->fresh();
+            $previousEditableUrls = $persistedApplication->url;
+            $previousFqdn = $persistedApplication->fqdn;
+            $previousPortOverrides = $persistedApplication->domain_port_overrides;
             $this->authorize('update', $this->application);
             $this->validate();
 
@@ -93,7 +97,7 @@ public function submit()
                 $this->dispatch('warning', __('warning.sslipdomain'));
             }
             // Sync to model for domain conflict check (without validation)
-            $this->application->fqdn = $this->fqdn;
+            $this->application->setEditableUrls($this->fqdn);
             // Check for domain conflicts if not forcing save
             if (! $this->forceSaveDomains) {
                 $result = checkDomainUsage(resource: $this->application);
@@ -113,29 +117,21 @@ public function submit()
                 $requiredPort = $this->application->getRequiredPort();
 
                 if ($requiredPort !== null) {
-                    // Check if all FQDNs have a port
-                    $fqdns = str($this->fqdn)->trim()->explode(',');
-                    $missingPort = false;
-
-                    foreach ($fqdns as $fqdn) {
-                        $fqdn = trim($fqdn);
-                        if (empty($fqdn)) {
+                    foreach (str($this->fqdn)->trim()->explode(',') as $fqdn) {
+                        $fqdn = trim((string) $fqdn);
+                        if ($fqdn === '') {
                             continue;
                         }
 
-                        $port = ServiceApplication::extractPortFromUrl($fqdn);
-                        if ($port === null) {
-                            $missingPort = true;
-                            break;
+                        if ($this->application->portRequiresConfirmation($fqdn, $requiredPort, $previousEditableUrls)) {
+                            $this->requiredPort = $requiredPort;
+                            $this->showPortWarningModal = true;
+                            $this->application->fqdn = $previousFqdn;
+                            $this->application->domain_port_overrides = $previousPortOverrides;
+
+                            return;
                         }
                     }
-
-                    if ($missingPort) {
-                        $this->requiredPort = $requiredPort;
-                        $this->showPortWarningModal = true;
-
-                        return;
-                    }
                 }
             } else {
                 // Reset the force flag after using it
diff --git a/app/Livewire/Project/Service/Index.php b/app/Livewire/Project/Service/Index.php
index 23ee6a096..7980e0705 100644
--- a/app/Livewire/Project/Service/Index.php
+++ b/app/Livewire/Project/Service/Index.php
@@ -99,10 +99,27 @@ class Index extends Component
         'isStripprefixEnabled' => 'nullable|boolean',
     ];
 
-    public function mount()
+    public function mount(?ServiceApplication $serviceApplication = null)
     {
         try {
             $this->services = collect([]);
+            if ($serviceApplication) {
+                $this->service = $serviceApplication->service;
+                $this->authorize('view', $this->service);
+                $this->parameters = [
+                    'project_uuid' => $this->service->environment->project->uuid,
+                    'environment_uuid' => $this->service->environment->uuid,
+                    'service_uuid' => $this->service->uuid,
+                    'stack_service_uuid' => $serviceApplication->uuid,
+                ];
+                $this->query = request()->query();
+                $this->serviceApplication = $serviceApplication;
+                $this->resourceType = 'application';
+                $this->initializeApplicationProperties();
+                $this->s3s = currentTeam()->s3s;
+
+                return;
+            }
             $this->parameters = get_route_parameters();
             $this->query = request()->query();
             $this->currentRoute = request()->route()->getName();
@@ -350,7 +367,7 @@ private function syncApplicationData(bool $toModel = false): void
         if ($toModel) {
             $this->serviceApplication->human_name = $this->humanName;
             $this->serviceApplication->description = $this->description;
-            $this->serviceApplication->fqdn = $this->fqdn;
+            $this->serviceApplication->setEditableUrls($this->fqdn);
             $this->serviceApplication->image = $this->image;
             $this->serviceApplication->exclude_from_status = $this->excludeFromStatus;
             $this->serviceApplication->is_log_drain_enabled = $this->isLogDrainEnabled;
@@ -359,7 +376,7 @@ private function syncApplicationData(bool $toModel = false): void
         } else {
             $this->humanName = $this->serviceApplication->human_name;
             $this->description = $this->serviceApplication->description;
-            $this->fqdn = $this->serviceApplication->fqdn;
+            $this->fqdn = $this->serviceApplication->url;
             $this->image = $this->serviceApplication->image;
             $this->excludeFromStatus = data_get($this->serviceApplication, 'exclude_from_status', false);
             $this->isLogDrainEnabled = data_get($this->serviceApplication, 'is_log_drain_enabled', false);
@@ -485,6 +502,10 @@ public function cancelRemovePort()
     public function submitApplication()
     {
         try {
+            $persistedApplication = $this->serviceApplication->fresh();
+            $previousEditableUrls = $persistedApplication->url;
+            $previousFqdn = $persistedApplication->fqdn;
+            $previousPortOverrides = $persistedApplication->domain_port_overrides;
             $this->authorize('update', $this->serviceApplication);
             $this->validate([
                 'fqdn' => ValidationPatterns::applicationDomainRules(),
@@ -514,28 +535,21 @@ public function submitApplication()
                 $requiredPort = $this->serviceApplication->getRequiredPort();
 
                 if ($requiredPort !== null) {
-                    $fqdns = str($this->fqdn)->trim()->explode(',');
-                    $missingPort = false;
-
-                    foreach ($fqdns as $fqdn) {
-                        $fqdn = trim($fqdn);
-                        if (empty($fqdn)) {
+                    foreach (str($this->fqdn)->trim()->explode(',') as $fqdn) {
+                        $fqdn = trim((string) $fqdn);
+                        if ($fqdn === '') {
                             continue;
                         }
 
-                        $port = ServiceApplication::extractPortFromUrl($fqdn);
-                        if ($port === null) {
-                            $missingPort = true;
-                            break;
+                        if ($this->serviceApplication->portRequiresConfirmation($fqdn, $requiredPort, $previousEditableUrls)) {
+                            $this->requiredPort = $requiredPort;
+                            $this->showPortWarningModal = true;
+                            $this->serviceApplication->fqdn = $previousFqdn;
+                            $this->serviceApplication->domain_port_overrides = $previousPortOverrides;
+
+                            return;
                         }
                     }
-
-                    if ($missingPort) {
-                        $this->requiredPort = $requiredPort;
-                        $this->showPortWarningModal = true;
-
-                        return;
-                    }
                 }
             } else {
                 $this->forceRemovePort = false;
diff --git a/app/Models/Application.php b/app/Models/Application.php
index 4873a9146..f8eb75a5a 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -7,6 +7,8 @@
 use App\Services\DeploymentConfiguration\ApplicationConfigurationSnapshot;
 use App\Services\DeploymentConfiguration\ConfigurationDiff;
 use App\Services\DeploymentConfiguration\ConfigurationDiffer;
+use App\Support\DomainPortOverrides;
+use App\Support\DomainUrlParts;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasConfiguration;
 use App\Traits\HasMetrics;
@@ -135,6 +137,7 @@ class Application extends BaseModel
         'description',
         'fqdn',
         'noindex_domains',
+        'domain_port_overrides',
         'git_repository',
         'git_branch',
         'git_commit_sha',
@@ -246,6 +249,7 @@ class Application extends BaseModel
         'docker_compose_raw',
         'custom_labels',
         'domain_dns_statuses',
+        'domain_port_overrides',
     ];
 
     protected function casts(): array
@@ -258,6 +262,7 @@ protected function casts(): array
             'manual_webhook_secret_gitea' => 'encrypted',
             'noindex_domains' => 'array',
             'domain_dns_statuses' => 'array',
+            'domain_port_overrides' => 'array',
             'restart_count' => 'integer',
             'max_restart_count' => 'integer',
             'restart_limit_reached' => 'boolean',
@@ -286,6 +291,9 @@ protected static function booted()
                 if ($application->fqdn === '') {
                     $application->fqdn = null;
                 }
+                $normalized = DomainPortOverrides::normalize($application->fqdn, $application->domain_port_overrides);
+                $application->fqdn = $normalized['fqdn'];
+                $application->domain_port_overrides = $normalized['overrides'];
                 $payload['fqdn'] = $application->fqdn;
                 $application->syncNoindexDomains();
             }
@@ -974,6 +982,46 @@ public function main_port()
         return $this->settings->is_static ? [80] : $this->ports_exposes_array;
     }
 
+    /**
+     * Ports the container is expected to listen on: Ports Exposes plus ports already used by application domains.
+     *
+     * @return list<int>
+     */
+    public function availableInternalPorts(): array
+    {
+        $ports = collect($this->settings?->is_static ? [80] : $this->ports_exposes_array)
+            ->filter(fn (mixed $port): bool => is_numeric($port) && (int) $port > 0)
+            ->map(fn (mixed $port): int => (int) $port);
+
+        foreach ($this->domain_port_overrides ?? [] as $port) {
+            if (is_numeric($port) && (int) $port > 0) {
+                $ports->push((int) $port);
+            }
+        }
+
+        foreach (explode(',', (string) $this->fqdn) as $url) {
+            $url = trim($url);
+            if ($url === '') {
+                continue;
+            }
+            $legacyPort = DomainUrlParts::split($url)['port'] ?? '';
+            if ($legacyPort !== '' && is_numeric($legacyPort) && (int) $legacyPort > 0) {
+                $ports->push((int) $legacyPort);
+            }
+        }
+
+        return $ports->unique()->sort()->values()->all();
+    }
+
+    public function portRequiresConfirmation(?int $port): bool
+    {
+        if ($port === null || $port <= 0) {
+            return false;
+        }
+
+        return ! in_array($port, $this->availableInternalPorts(), true);
+    }
+
     public function detectPortFromEnvironment(?bool $isPreview = false): ?int
     {
         $envVars = $isPreview
diff --git a/app/Models/ApplicationPreview.php b/app/Models/ApplicationPreview.php
index 381e71817..bffbdab62 100644
--- a/app/Models/ApplicationPreview.php
+++ b/app/Models/ApplicationPreview.php
@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Support\DomainPortOverrides;
 use App\Support\ValidationPatterns;
 use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\SoftDeletes;
@@ -25,11 +26,17 @@ class ApplicationPreview extends BaseModel
         'docker_registry_image_tag',
         'last_online_at',
         'domain_dns_statuses',
+        'domain_port_overrides',
+    ];
+
+    protected $hidden = [
+        'domain_port_overrides',
     ];
 
     protected $casts = [
         'pull_request_id' => 'integer',
         'domain_dns_statuses' => 'array',
+        'domain_port_overrides' => 'array',
     ];
 
     protected static function booted(): void
@@ -85,6 +92,14 @@ protected static function booted(): void
             if ($preview->isDirty('status')) {
                 $preview->last_online_at = now();
             }
+            if ($preview->isDirty('fqdn')) {
+                if ($preview->fqdn === '') {
+                    $preview->fqdn = null;
+                }
+                $normalized = DomainPortOverrides::normalize($preview->fqdn, $preview->domain_port_overrides);
+                $preview->fqdn = $normalized['fqdn'];
+                $preview->domain_port_overrides = $normalized['overrides'];
+            }
         });
     }
 
@@ -124,24 +139,14 @@ public function generate_preview_fqdn(bool $generateWithoutApplicationDomain = f
         }
 
         if ($applicationFqdn) {
-            if (str($applicationFqdn)->contains(',')) {
-                $url = Url::fromString(str($applicationFqdn)->explode(',')[0]);
-            } else {
-                $url = Url::fromString($applicationFqdn);
-            }
-            $template = $this->application->preview_url_template;
-            $host = $url->getHost();
-            $schema = $url->getScheme();
-            $portInt = $url->getPort();
-            $port = $portInt !== null ? ':'.$portInt : '';
-            $urlPath = $url->getPath();
-            $path = ($urlPath !== '' && $urlPath !== '/') ? $urlPath : '';
-            $random = new_public_id();
-            $preview_fqdn = str_replace('{{random}}', $random, $template);
-            $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
-            $preview_fqdn = str_replace('{{pr_id}}', $this->pull_request_id, $preview_fqdn);
-            $preview_fqdn = "$schema://$preview_fqdn{$port}{$path}";
-            $this->fqdn = $preview_fqdn;
+            $sourceDomain = str($applicationFqdn)->contains(',')
+                ? str($applicationFqdn)->explode(',')[0]
+                : $applicationFqdn;
+            $generated = $this->generatedPreviewDomain((string) $sourceDomain);
+            $this->fqdn = $generated['url'];
+            $this->domain_port_overrides = filled($generated['port'])
+                ? [$generated['url'] => $generated['port']]
+                : null;
             $this->save();
         }
 
@@ -187,6 +192,7 @@ public function generate_preview_fqdn_compose(bool $generateWithoutApplicationDo
             ->all();
 
         $docker_compose_domains = [];
+        $previewPortOverrides = [];
         foreach ($serviceNames as $service_name) {
             $domain_string = getComposeServiceDomainString($applicationDomains, $service_name);
 
@@ -218,20 +224,11 @@ public function generate_preview_fqdn_compose(bool $generateWithoutApplicationDo
                     continue;
                 }
 
-                $url = Url::fromString($domain);
-                $template = $this->application->preview_url_template;
-                $host = $url->getHost();
-                $schema = $url->getScheme();
-                $portInt = $url->getPort();
-                $port = $portInt !== null ? ':'.$portInt : '';
-                $urlPath = $url->getPath();
-                $path = ($urlPath !== '' && $urlPath !== '/') ? $urlPath : '';
-                $random = new_public_id();
-                $preview_fqdn = str_replace('{{random}}', $random, $template);
-                $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
-                $preview_fqdn = str_replace('{{pr_id}}', $this->pull_request_id, $preview_fqdn);
-                $preview_fqdn = "$schema://$preview_fqdn{$port}{$path}";
-                $preview_domains[] = $preview_fqdn;
+                $generated = $this->generatedPreviewDomain((string) $domain);
+                $preview_domains[] = $generated['url'];
+                if (filled($generated['port'])) {
+                    $previewPortOverrides[$generated['url']] = $generated['port'];
+                }
             }
 
             $docker_compose_domains = putComposeServiceDomain(
@@ -255,10 +252,36 @@ public function generate_preview_fqdn_compose(bool $generateWithoutApplicationDo
             ->implode(',');
 
         $this->fqdn = ! empty($allDomains) ? $allDomains : null;
+        $this->domain_port_overrides = $previewPortOverrides ?: null;
 
         $this->save();
     }
 
+    /**
+     * @return array{url: string, port: ?int}
+     */
+    public function generatedPreviewDomain(string $sourceDomain): array
+    {
+        $url = Url::fromString($sourceDomain);
+        $template = $this->application->preview_url_template;
+        $host = $url->getHost();
+        $schema = $url->getScheme();
+        $urlPath = $url->getPath();
+        $path = ($urlPath !== '' && $urlPath !== '/') ? $urlPath : '';
+        $random = new_public_id();
+        $previewFqdn = str_replace('{{random}}', $random, $template);
+        $previewFqdn = str_replace('{{domain}}', $host, $previewFqdn);
+        $previewFqdn = str_replace('{{pr_id}}', (string) $this->pull_request_id, $previewFqdn);
+        $previewUrl = "{$schema}://{$previewFqdn}{$path}";
+        $sourceCanonical = DomainPortOverrides::withoutPort($sourceDomain);
+        $port = $url->getPort() ?? ($this->application->domain_port_overrides[$sourceCanonical] ?? null);
+
+        return [
+            'url' => $previewUrl,
+            'port' => $port !== null ? (int) $port : null,
+        ];
+    }
+
     /**
      * Original compose service names for this preview (PR suffix stripped), excluding database images.
      *
diff --git a/app/Models/Service.php b/app/Models/Service.php
index 0da97b301..66c67ca8d 100644
--- a/app/Models/Service.php
+++ b/app/Models/Service.php
@@ -4,6 +4,7 @@
 
 use App\Enums\ProcessStatus;
 use App\Services\ContainerStatusAggregator;
+use App\Support\DomainPortOverrides;
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -92,11 +93,18 @@ protected static function booted()
 
     public function isConfigurationChanged(bool $save = false)
     {
-        $domains = $this->applications()->get()->pluck('fqdn')->sort()->toArray();
+        $applications = $this->applications()->get();
+        $domains = $applications->pluck('fqdn')->sort()->toArray();
         $domains = implode(',', $domains);
-        $noindexDomains = $this->applications()->get()->pluck('noindex_domains')->flatten()->filter()->sort()->implode(',');
+        $noindexDomains = $applications->pluck('noindex_domains')->flatten()->filter()->sort()->implode(',');
+        $domainPortOverrides = $applications
+            ->mapWithKeys(fn (ServiceApplication $application): array => [
+                $application->id => DomainPortOverrides::sorted($application->domain_port_overrides),
+            ])
+            ->sortKeys()
+            ->all();
 
-        $applicationImages = $this->applications()->get()->pluck('image')->sort();
+        $applicationImages = $applications->pluck('image')->sort();
         $databaseImages = $this->databases()->get()->pluck('image')->sort();
         $images = $applicationImages->merge($databaseImages);
         $images = implode(',', $images->toArray());
@@ -105,7 +113,7 @@ public function isConfigurationChanged(bool $save = false)
         $databaseStorages = $this->databases()->get()->pluck('persistentStorages')->flatten()->sortBy('id');
         $storages = $applicationStorages->merge($databaseStorages)->implode('updated_at');
 
-        $newConfigHash = $images.$domains.$images.$storages.$noindexDomains;
+        $newConfigHash = $images.$domains.$images.$storages.$noindexDomains.json_encode($domainPortOverrides);
         $newConfigHash .= json_encode($this->environment_variables()->get('value')->makeVisible('value')->sort());
         $newConfigHash = md5($newConfigHash);
         $oldConfigHash = data_get($this, 'config_hash');
@@ -1496,7 +1504,7 @@ public function getRequiredPort(): ?int
     {
         try {
             $services = get_service_templates();
-            $serviceName = str($this->name)->beforeLast('-')->value();
+            $serviceName = $this->service_type ?: str($this->name)->beforeLast('-')->value();
             $service = data_get($services, $serviceName, []);
             $port = data_get($service, 'port');
 
diff --git a/app/Models/ServiceApplication.php b/app/Models/ServiceApplication.php
index f6284ecbf..cf0faef5b 100644
--- a/app/Models/ServiceApplication.php
+++ b/app/Models/ServiceApplication.php
@@ -2,6 +2,8 @@
 
 namespace App\Models;
 
+use App\Support\DomainPortOverrides;
+use App\Support\DomainUrlParts;
 use App\Traits\HasNoindexDomains;
 use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\Casts\Attribute;
@@ -13,6 +15,8 @@ class ServiceApplication extends BaseModel
 {
     use HasFactory, HasNoindexDomains, HasRestartLimit, SoftDeletes;
 
+    protected $appends = ['url'];
+
     protected $fillable = [
         'service_id',
         'name',
@@ -22,6 +26,7 @@ class ServiceApplication extends BaseModel
         'noindex_domains',
         'redirect',
         'domain_dns_statuses',
+        'domain_port_overrides',
         'ports',
         'exposes',
         'status',
@@ -44,6 +49,7 @@ class ServiceApplication extends BaseModel
      */
     protected $hidden = [
         'domain_dns_statuses',
+        'domain_port_overrides',
     ];
 
     protected $attributes = [
@@ -54,6 +60,7 @@ protected function casts(): array
     {
         return [
             'domain_dns_statuses' => 'array',
+            'domain_port_overrides' => 'array',
             'noindex_domains' => 'array',
             'is_force_https_enabled' => 'boolean',
         ];
@@ -71,6 +78,7 @@ protected static function booted()
                 $service->last_online_at = now();
             }
             if ($service->isDirty('fqdn')) {
+                $service->normalizeDomainPortOverrides();
                 $service->syncNoindexDomains();
             }
         });
@@ -192,6 +200,45 @@ public function fqdns(): Attribute
         );
     }
 
+    /**
+     * Return the public URLs with their persisted internal port overrides.
+     */
+    protected function url(): Attribute
+    {
+        return Attribute::make(
+            get: function (): ?string {
+                if (blank($this->fqdn)) {
+                    return null;
+                }
+
+                $overrides = $this->domain_port_overrides ?? [];
+
+                return collect(explode(',', $this->fqdn))
+                    ->map(function (string $url) use ($overrides): string {
+                        $url = trim($url);
+                        $canonical = DomainPortOverrides::withoutPort($url);
+                        $port = $overrides[$canonical] ?? null;
+
+                        if ($port === null) {
+                            return $canonical;
+                        }
+
+                        $parts = DomainUrlParts::split($canonical);
+
+                        return DomainUrlParts::compose($parts['scheme'], $parts['host'], (string) $port, $parts['path']);
+                    })
+                    ->implode(',');
+            },
+        );
+    }
+
+    public function setEditableUrls(?string $urls): void
+    {
+        $normalized = DomainPortOverrides::normalize($urls, null);
+        $this->fqdn = $normalized['fqdn'];
+        $this->domain_port_overrides = $normalized['overrides'];
+    }
+
     /**
      * Extract port number from a given FQDN URL.
      * Returns null if no port is specified.
@@ -213,6 +260,58 @@ public static function extractPortFromUrl(string $url): ?int
         }
     }
 
+    /**
+     * True when saving this URL should confirm that it does not use the required template port.
+     */
+    public function portRequiresConfirmation(string $fqdn, ?int $requiredPort, ?string $previousFqdn = null): bool
+    {
+        if ($requiredPort === null) {
+            return false;
+        }
+
+        $fqdn = trim($fqdn);
+        if ($fqdn === '') {
+            return false;
+        }
+
+        $canonical = DomainPortOverrides::withoutPort($fqdn);
+        $explicit = self::extractPortFromUrl($fqdn);
+
+        if ($explicit === $requiredPort) {
+            return false;
+        }
+
+        if ($explicit === null) {
+            $previous = collect(explode(',', (string) $previousFqdn))
+                ->filter();
+            $previousUrl = $previous->first(
+                fn (string $url): bool => DomainPortOverrides::withoutPort(trim($url)) === $canonical
+            );
+
+            if (is_string($previousUrl) && self::extractPortFromUrl($previousUrl) !== null) {
+                return true;
+            }
+
+            return $previousUrl === null;
+        }
+
+        $existingOverride = $this->domain_port_overrides[$canonical] ?? null;
+
+        return (int) $existingOverride !== $explicit;
+    }
+
+    public static function withoutPort(string $url): string
+    {
+        return DomainPortOverrides::withoutPort($url);
+    }
+
+    protected function normalizeDomainPortOverrides(): void
+    {
+        $normalized = DomainPortOverrides::normalize($this->fqdn, $this->domain_port_overrides);
+        $this->fqdn = $normalized['fqdn'];
+        $this->domain_port_overrides = $normalized['overrides'];
+    }
+
     /**
      * Check if all FQDNs have a port specified.
      */
@@ -277,6 +376,7 @@ public function getRequiredPort(): ?int
             // Extract SERVICE_URL and SERVICE_FQDN variables DIRECTLY DECLARED in this service's environment
             // (not variables that are merely referenced with ${VAR} syntax)
             $portFound = null;
+            $declaresHttpUrl = false;
             foreach ($environment as $key => $value) {
                 if (is_int($key) && is_string($value)) {
                     // List-style: "- SERVICE_URL_APP_3000" or "- SERVICE_URL_APP_3000=value"
@@ -285,6 +385,7 @@ public function getRequiredPort(): ?int
 
                     // Only process direct declarations
                     if ($envVarName->startsWith('SERVICE_FQDN_') || $envVarName->startsWith('SERVICE_URL_')) {
+                        $declaresHttpUrl = true;
                         // Parse to check if it has a port suffix
                         $parsed = parseServiceEnvironmentVariable($envVarName->value());
                         if ($parsed['has_port'] && $parsed['port']) {
@@ -299,6 +400,7 @@ public function getRequiredPort(): ?int
 
                     // Only process direct declarations
                     if ($envVarName->startsWith('SERVICE_FQDN_') || $envVarName->startsWith('SERVICE_URL_')) {
+                        $declaresHttpUrl = true;
                         // Parse to check if it has a port suffix
                         $parsed = parseServiceEnvironmentVariable($envVarName->value());
                         if ($parsed['has_port'] && $parsed['port']) {
@@ -315,8 +417,12 @@ public function getRequiredPort(): ?int
                 return $portFound;
             }
 
-            // No port-specific variables found for this service, return null
-            // (DO NOT fall back to service-level port, as that applies to all services)
+            // HTTP-facing compose services that only declare SERVICE_URL/FQDN (no _PORT
+            // suffix), such as WordPress, inherit the one-click template `# port:`.
+            if ($declaresHttpUrl) {
+                return $this->service->getRequiredPort();
+            }
+
             return null;
         } catch (\Throwable $e) {
             return null;
diff --git a/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php b/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php
index 386bdd5bb..e3ba77163 100644
--- a/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php
+++ b/app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php
@@ -7,6 +7,7 @@
 use App\Models\LocalFileVolume;
 use App\Models\LocalPersistentVolume;
 use App\Services\DeploymentConfiguration\Concerns\SummarizesDiffText;
+use App\Support\DomainPortOverrides;
 use Illuminate\Support\Arr;
 
 class ApplicationConfigurationSnapshot
@@ -194,6 +195,7 @@ private function domainItems(): array
     {
         return [
             $this->item('fqdn', 'Domains', $this->application->fqdn, 'redeploy'),
+            $this->item('domain_port_overrides', 'Domain port overrides', DomainPortOverrides::sorted($this->application->domain_port_overrides), 'redeploy'),
             $this->item('noindex_domains', 'Search engine indexing', $this->application->noindexDomains()->all(), 'redeploy'),
             $this->item('docker_compose_domains', 'Service domains', $this->decodedComposeDomains(), 'redeploy', displayValue: $this->summarizeText($this->composeDomainsText()), displayFull: $this->composeDomainsText(), diffMode: 'lines'),
             $this->item('redirect', 'Redirect', $this->application->redirect, 'redeploy'),
diff --git a/app/Support/DomainPortOverrides.php b/app/Support/DomainPortOverrides.php
new file mode 100644
index 000000000..320540ad6
--- /dev/null
+++ b/app/Support/DomainPortOverrides.php
@@ -0,0 +1,91 @@
+<?php
+
+namespace App\Support;
+
+class DomainPortOverrides
+{
+    /**
+     * @param  array<string, int|string>|null  $overrides
+     * @return array<string, int|string>
+     */
+    public static function sorted(?array $overrides): array
+    {
+        return collect($overrides ?? [])->sortKeys()->all();
+    }
+
+    public static function withoutPort(string $url): string
+    {
+        $parts = DomainUrlParts::split($url);
+
+        return DomainUrlParts::compose($parts['scheme'], $parts['host'], path: $parts['path']);
+    }
+
+    /**
+     * @param  array<string, int|string>|null  $existing
+     * @return array{fqdn: ?string, overrides: ?array<string, int>}
+     */
+    public static function normalize(?string $fqdn, ?array $existing): array
+    {
+        if (blank($fqdn)) {
+            return ['fqdn' => null, 'overrides' => null];
+        }
+
+        $existingOverrides = $existing ?? [];
+        $normalizedDomains = collect(explode(',', $fqdn))
+            ->map(fn (string $domain): string => trim($domain))
+            ->filter()
+            ->map(function (string $domain) use ($existingOverrides): array {
+                $portlessDomain = self::withoutPort($domain);
+                $parts = DomainUrlParts::split($domain);
+                $port = $parts['port'] !== ''
+                    ? (int) $parts['port']
+                    : ($existingOverrides[$portlessDomain] ?? null);
+
+                return ['domain' => $portlessDomain, 'port' => $port];
+            })
+            ->keyBy('domain')
+            ->values();
+
+        $effectiveOverrides = $normalizedDomains
+            ->filter(fn (array $domain): bool => filled($domain['port']))
+            ->mapWithKeys(fn (array $domain): array => [$domain['domain'] => (int) $domain['port']]);
+
+        $normalizedDomains = $normalizedDomains->map(function (array $domain) use ($effectiveOverrides): array {
+            if (filled($domain['port'])) {
+                return $domain;
+            }
+
+            $counterpart = self::wwwCounterpart($domain['domain']);
+            $domain['port'] = $counterpart === null ? null : $effectiveOverrides->get($counterpart);
+
+            return $domain;
+        });
+
+        $normalizedFqdn = $normalizedDomains->pluck('domain')->implode(',');
+        $overrides = $normalizedDomains
+            ->filter(fn (array $domain): bool => filled($domain['port']))
+            ->mapWithKeys(fn (array $domain): array => [$domain['domain'] => (int) $domain['port']])
+            ->all();
+
+        return [
+            'fqdn' => $normalizedFqdn === '' ? null : $normalizedFqdn,
+            'overrides' => $overrides ?: null,
+        ];
+    }
+
+    private static function wwwCounterpart(string $url): ?string
+    {
+        $parts = DomainUrlParts::split($url);
+        $host = $parts['host'];
+
+        if ($host === '') {
+            return null;
+        }
+
+        $counterpartHost = str_starts_with(strtolower($host), 'www.')
+            ? substr($host, 4)
+            : 'www.'.$host;
+
+        return DomainUrlParts::compose($parts['scheme'], $counterpartHost, path: $parts['path']);
+    }
+}
diff --git a/app/Support/ServiceComposeUrl.php b/app/Support/ServiceComposeUrl.php
index cdeb75e58..5d3ded154 100644
--- a/app/Support/ServiceComposeUrl.php
+++ b/app/Support/ServiceComposeUrl.php
@@ -25,15 +25,7 @@ public static function validateUrlString(?string $urlValue, bool $forceDomainOve
             ->map(fn ($url) => trim((string) $url))
             ->filter();
 
-        foreach ($urls as $url) {
-            if (! filter_var($url, FILTER_VALIDATE_URL)) {
-                $errors[] = "Invalid URL: {$url}";
-            }
-            $scheme = parse_url($url, PHP_URL_SCHEME) ?? '';
-            if (! in_array(strtolower($scheme), ['http', 'https'], true)) {
-                $errors[] = "Invalid URL scheme: {$scheme} for URL: {$url}. Only http and https are supported.";
-            }
-        }
+        $errors = ValidationPatterns::validateApplicationDomains($urls->implode(','));
 
         $duplicates = $urls->duplicates()->unique()->values();
         if ($duplicates->isNotEmpty() && ! $forceDomainOverride) {
diff --git a/app/Support/ValidationPatterns.php b/app/Support/ValidationPatterns.php
index cb1a0de62..4656406fc 100644
--- a/app/Support/ValidationPatterns.php
+++ b/app/Support/ValidationPatterns.php
@@ -619,6 +619,13 @@ public static function validateApplicationDomains(mixed $value): array
                 continue;
             }
 
+            $port = parse_url($url, PHP_URL_PORT);
+            if ($port !== null && ($port < 1 || $port > 65535)) {
+                $errors[] = "Invalid port for URL: {$url}. The port must be between 1 and 65535.";
+
+                continue;
+            }
+
             $unwrappedHost = trim((string) $host, '[]');
             if (! str_contains($unwrappedHost, '.') && filter_var($unwrappedHost, FILTER_VALIDATE_IP) === false) {
                 $errors[] = "Invalid URL: {$url}. The hostname must be a fully qualified domain name.";
diff --git a/app/Traits/HasNoindexDomains.php b/app/Traits/HasNoindexDomains.php
index c3ba8a7d8..7afe0d4f2 100644
--- a/app/Traits/HasNoindexDomains.php
+++ b/app/Traits/HasNoindexDomains.php
@@ -2,6 +2,7 @@
 
 namespace App\Traits;
 
+use App\Support\DomainPortOverrides;
 use App\Support\ValidationPatterns;
 use Illuminate\Support\Collection;
 
@@ -19,7 +20,7 @@ public function noindexDomains(): Collection
     {
         return collect($this->noindex_domains ?? [])
             ->filter(fn ($domain) => is_string($domain) && filled($domain))
-            ->map(fn (string $domain) => ValidationPatterns::normalizeApplicationDomainUrl($domain))
+            ->map(fn (string $domain) => $this->normalizeNoindexDomain($domain))
             ->unique()
             ->values();
     }
@@ -27,7 +28,7 @@ public function noindexDomains(): Collection
     public function isDomainNoindexed(string $domain): bool
     {
         return $this->noindexDomains()->contains(
-            ValidationPatterns::normalizeApplicationDomainUrl($domain)
+            $this->normalizeNoindexDomain($domain)
         );
     }
 
@@ -35,7 +36,7 @@ public function setNoindexDomains(iterable $domains): void
     {
         $this->noindex_domains = collect($domains)
             ->filter(fn ($domain) => is_string($domain) && filled($domain))
-            ->map(fn (string $domain) => ValidationPatterns::normalizeApplicationDomainUrl($domain))
+            ->map(fn (string $domain) => $this->normalizeNoindexDomain($domain))
             ->intersect($this->currentDomains())
             ->unique()
             ->values()
@@ -58,6 +59,13 @@ public function syncNoindexDomains(): void
     private function currentDomains(): Collection
     {
         return collect(ValidationPatterns::applicationDomainList($this->fqdn))
-            ->map(fn (string $domain) => ValidationPatterns::normalizeApplicationDomainUrl($domain));
+            ->map(fn (string $domain) => $this->normalizeNoindexDomain($domain));
+    }
+
+    private function normalizeNoindexDomain(string $domain): string
+    {
+        return DomainPortOverrides::withoutPort(
+            ValidationPatterns::normalizeApplicationDomainUrl($domain)
+        );
     }
 }
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index 00300d26a..f80fccafb 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -530,7 +530,7 @@ function isNoindexDomain(string $domain, ?Collection $noindex_domains): bool
         ->contains(ValidationPatterns::normalizeApplicationDomainUrl($domain));
 }
 
-function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, ?string $image = null, string $redirect_direction = 'both', ?string $predefinedPort = null, bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null)
+function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, ?string $image = null, string $redirect_direction = 'both', ?string $predefinedPort = null, bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, array $domainPortOverrides = [])
 {
     $labels = collect([]);
     if ($serviceLabels) {
@@ -554,7 +554,8 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
         if ($schema === 'https' && ! $is_force_https_enabled) {
             $siteAddress = "http://{$host}, https://{$host}";
         }
-        $port = $url->getPort();
+        $portlessDomain = ServiceApplication::withoutPort($domain);
+        $port = $url->getPort() ?? ($domainPortOverrides[$portlessDomain] ?? null);
         $handle = 'handle_path';
         if (! $is_stripprefix_enabled) {
             $handle = 'handle';
@@ -600,7 +601,7 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
     return $labels->sort();
 }
 
-function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $escape_redirect_replacement_for_compose = true)
+function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $escape_redirect_replacement_for_compose = true, array $domainPortOverrides = [])
 {
     $labels = collect([]);
     $labels->push('traefik.enable=true');
@@ -655,7 +656,8 @@ function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_
             $host = $url->getHost();
             $path = $url->getPath();
             $schema = $url->getScheme();
-            $port = $url->getPort();
+            $portlessDomain = ServiceApplication::withoutPort($domain);
+            $port = $url->getPort() ?? ($domainPortOverrides[$portlessDomain] ?? null);
             if (is_null($port) && ! is_null($onlyPort)) {
                 $port = $onlyPort;
             }
@@ -898,6 +900,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                             http_basic_auth_username: $application->http_basic_auth_username,
                             http_basic_auth_password: $application->http_basic_auth_password,
                             noindex_domains: $noindexDomains,
+                            domainPortOverrides: $application->domain_port_overrides ?? [],
                         ));
                         break;
                     case ProxyTypes::CADDY->value:
@@ -914,6 +917,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                             http_basic_auth_username: $application->http_basic_auth_username,
                             http_basic_auth_password: $application->http_basic_auth_password,
                             noindex_domains: $noindexDomains,
+                            domainPortOverrides: $application->domain_port_overrides ?? [],
                         ));
                         break;
                 }
@@ -931,6 +935,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                     http_basic_auth_password: $application->http_basic_auth_password,
                     noindex_domains: $noindexDomains,
                     escape_redirect_replacement_for_compose: false,
+                    domainPortOverrides: $application->domain_port_overrides ?? [],
                 ));
                 $labels = $labels->merge(fqdnLabelsForCaddy(
                     network: $application->destination->network,
@@ -945,6 +950,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                     http_basic_auth_username: $application->http_basic_auth_username,
                     http_basic_auth_password: $application->http_basic_auth_password,
                     noindex_domains: $noindexDomains,
+                    domainPortOverrides: $application->domain_port_overrides ?? [],
                 ));
             }
         }
@@ -972,6 +978,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                         http_basic_auth_password: $application->http_basic_auth_password,
                         noindex_domains: $noindexDomains,
                         escape_redirect_replacement_for_compose: false,
+                        domainPortOverrides: $preview->domain_port_overrides ?? [],
                     ));
                     break;
                 case ProxyTypes::CADDY->value:
@@ -987,6 +994,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                         http_basic_auth_username: $application->http_basic_auth_username,
                         http_basic_auth_password: $application->http_basic_auth_password,
                         noindex_domains: $noindexDomains,
+                        domainPortOverrides: $preview->domain_port_overrides ?? [],
                     ));
                     break;
             }
@@ -1003,6 +1011,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                 http_basic_auth_password: $application->http_basic_auth_password,
                 noindex_domains: $noindexDomains,
                 escape_redirect_replacement_for_compose: false,
+                domainPortOverrides: $preview->domain_port_overrides ?? [],
             ));
             $labels = $labels->merge(fqdnLabelsForCaddy(
                 network: $application->destination->network,
@@ -1016,6 +1025,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                 http_basic_auth_username: $application->http_basic_auth_username,
                 http_basic_auth_password: $application->http_basic_auth_password,
                 noindex_domains: $noindexDomains,
+                domainPortOverrides: $preview->domain_port_overrides ?? [],
             ));
         }
     }
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index b47e57047..f65b62698 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -1265,24 +1265,16 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                         $fqdns = collect([]);
                     }
                 } else {
-                    $fqdns = $fqdns->map(function ($fqdn) use ($pullRequestId, $resource) {
-                        $preview = ApplicationPreview::findPreviewByApplicationAndPullId($resource->id, $pullRequestId);
-                        $url = Url::fromString($fqdn);
-                        $template = $resource->preview_url_template;
-                        $host = $url->getHost();
-                        $schema = $url->getScheme();
-                        $portInt = $url->getPort();
-                        $port = $portInt !== null ? ':'.$portInt : '';
-                        $random = new_public_id();
-                        $preview_fqdn = str_replace('{{random}}', $random, $template);
-                        $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
-                        $preview_fqdn = str_replace('{{pr_id}}', $pullRequestId, $preview_fqdn);
-                        $preview_fqdn = "$schema://$preview_fqdn{$port}";
-                        $preview->fqdn = $preview_fqdn;
-                        $preview->save();
-
-                        return $preview_fqdn;
-                    });
+                    $generatedDomains = $fqdns->map(
+                        fn ($fqdn) => $preview->generatedPreviewDomain((string) $fqdn)
+                    );
+                    $fqdns = $generatedDomains->pluck('url');
+                    $preview->fqdn = $fqdns->implode(',');
+                    $preview->domain_port_overrides = $generatedDomains
+                        ->filter(fn (array $generated): bool => filled($generated['port']))
+                        ->mapWithKeys(fn (array $generated): array => [$generated['url'] => $generated['port']])
+                        ->all();
+                    $preview->save();
                 }
             }
         }
@@ -1359,6 +1351,14 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
             $redirectDirection = in_array($composeRedirect, ['www', 'non-www', 'both'], true)
                 ? $composeRedirect
                 : 'both';
+            $previewForPorts = $isPullRequest
+                ? ($resource->previews()->find($preview_id) ?? ApplicationPreview::where('application_id', $resource->id)->where('pull_request_id', $pullRequestId)->first())
+                : null;
+            $domainPortOverrides = $isPullRequest
+                ? ($previewForPorts?->domain_port_overrides ?? [])
+                : ($originalResource->domain_port_overrides ?? []);
+            $exposedPorts = $originalResource->settings->is_static ? [80] : $originalResource->ports_exposes_array;
+            $onlyPort = count($exposedPorts) > 0 ? $exposedPorts[0] : null;
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
             }
@@ -1374,8 +1374,10 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                             is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                             service_name: $serviceName,
                             image: $image,
+                            onlyPort: $onlyPort,
                             noindex_domains: $noindexDomains,
-                            redirect_direction: $redirectDirection
+                            redirect_direction: $redirectDirection,
+                            domainPortOverrides: $domainPortOverrides,
                         ));
                         break;
                     case ProxyTypes::CADDY->value:
@@ -1389,9 +1391,11 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                             is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                             service_name: $serviceName,
                             image: $image,
+                            onlyPort: $onlyPort,
                             predefinedPort: $predefinedPort,
                             noindex_domains: $noindexDomains,
-                            redirect_direction: $redirectDirection
+                            redirect_direction: $redirectDirection,
+                            domainPortOverrides: $domainPortOverrides,
                         ));
                         break;
                 }
@@ -1405,8 +1409,10 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                     is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                     service_name: $serviceName,
                     image: $image,
+                    onlyPort: $onlyPort,
                     noindex_domains: $noindexDomains,
-                    redirect_direction: $redirectDirection
+                    redirect_direction: $redirectDirection,
+                    domainPortOverrides: $domainPortOverrides,
                 ));
                 $serviceLabels = $serviceLabels->merge(fqdnLabelsForCaddy(
                     network: $labelNetwork,
@@ -1418,9 +1424,11 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                     is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                     service_name: $serviceName,
                     image: $image,
+                    onlyPort: $onlyPort,
                     predefinedPort: $predefinedPort,
                     noindex_domains: $noindexDomains,
-                    redirect_direction: $redirectDirection
+                    redirect_direction: $redirectDirection,
+                    domainPortOverrides: $domainPortOverrides,
                 ));
             }
         }
@@ -1849,11 +1857,7 @@ function serviceParser(Service $resource): Collection
                 // Only save fqdn to ServiceApplication, not ServiceDatabase
                 if ($isServiceApplication && is_null($savedService->fqdn)) {
                     // Save URL (with scheme) to database, not FQDN
-                    if ((int) $resource->compose_parsing_version >= 5 && version_compare(config('constants.coolify.version'), '4.0.0-beta.420.7', '>=')) {
-                        $savedService->fqdn = $urlWithPort;
-                    } else {
-                        $savedService->fqdn = $urlWithPort;
-                    }
+                    $savedService->fqdn = $url;
                     $savedService->save();
                 }
 
@@ -2636,6 +2640,9 @@ function serviceParser(Service $resource): Collection
             $redirectDirection = in_array(data_get($originalResource, 'redirect'), ['www', 'non-www', 'both'], true)
                 ? data_get($originalResource, 'redirect')
                 : 'both';
+            $onlyPort = $originalResource instanceof ServiceApplication
+                ? ($originalResource->getRequiredPort() ?? $predefinedPort)
+                : $predefinedPort;
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
             }
@@ -2651,6 +2658,8 @@ function serviceParser(Service $resource): Collection
                             is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                             service_name: $serviceName,
                             image: $image,
+                            onlyPort: $onlyPort,
+                            domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                             noindex_domains: $noindexDomains,
                             redirect_direction: $redirectDirection
                         ));
@@ -2666,7 +2675,9 @@ function serviceParser(Service $resource): Collection
                             is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                             service_name: $serviceName,
                             image: $image,
+                            onlyPort: $onlyPort,
                             predefinedPort: $predefinedPort,
+                            domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                             noindex_domains: $noindexDomains,
                             redirect_direction: $redirectDirection
                         ));
@@ -2682,6 +2693,8 @@ function serviceParser(Service $resource): Collection
                     is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                     service_name: $serviceName,
                     image: $image,
+                    onlyPort: $onlyPort,
+                    domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                     noindex_domains: $noindexDomains,
                     redirect_direction: $redirectDirection
                 ));
@@ -2695,7 +2708,9 @@ function serviceParser(Service $resource): Collection
                     is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
                     service_name: $serviceName,
                     image: $image,
+                    onlyPort: $onlyPort,
                     predefinedPort: $predefinedPort,
+                    domainPortOverrides: $originalResource->domain_port_overrides ?? [],
                     noindex_domains: $noindexDomains,
                     redirect_direction: $redirectDirection
                 ));
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index f4dd3d185..9f18c466d 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -3103,6 +3103,12 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                         $redirectDirection = in_array(data_get($savedService, 'redirect'), ['www', 'non-www', 'both'], true)
                             ? data_get($savedService, 'redirect')
                             : 'both';
+                        $domainPortOverrides = $savedService instanceof ServiceApplication
+                            ? ($savedService->domain_port_overrides ?? [])
+                            : [];
+                        $onlyPort = $savedService instanceof ServiceApplication
+                            ? ($savedService->getRequiredPort() ?? $predefinedPort)
+                            : $predefinedPort;
                         if ($shouldGenerateLabelsExactly) {
                             switch ($resource->server->proxyType()) {
                                 case ProxyTypes::TRAEFIK->value:
@@ -3115,8 +3121,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                         is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
                                         service_name: $serviceName,
                                         image: data_get($service, 'image'),
+                                        onlyPort: $onlyPort,
                                         noindex_domains: $noindexDomains,
-                                        redirect_direction: $redirectDirection
+                                        redirect_direction: $redirectDirection,
+                                        domainPortOverrides: $domainPortOverrides,
                                     ));
                                     break;
                                 case ProxyTypes::CADDY->value:
@@ -3130,8 +3138,11 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                         is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
                                         service_name: $serviceName,
                                         image: data_get($service, 'image'),
+                                        onlyPort: $onlyPort,
+                                        predefinedPort: $predefinedPort,
                                         noindex_domains: $noindexDomains,
-                                        redirect_direction: $redirectDirection
+                                        redirect_direction: $redirectDirection,
+                                        domainPortOverrides: $domainPortOverrides,
                                     ));
                                     break;
                             }
@@ -3145,8 +3156,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                 is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
                                 service_name: $serviceName,
                                 image: data_get($service, 'image'),
+                                onlyPort: $onlyPort,
                                 noindex_domains: $noindexDomains,
-                                redirect_direction: $redirectDirection
+                                redirect_direction: $redirectDirection,
+                                domainPortOverrides: $domainPortOverrides,
                             ));
                             $serviceLabels = $serviceLabels->merge(fqdnLabelsForCaddy(
                                 network: $resource->destination->network,
@@ -3158,8 +3171,11 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                 is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
                                 service_name: $serviceName,
                                 image: data_get($service, 'image'),
+                                onlyPort: $onlyPort,
+                                predefinedPort: $predefinedPort,
                                 noindex_domains: $noindexDomains,
-                                redirect_direction: $redirectDirection
+                                redirect_direction: $redirectDirection,
+                                domainPortOverrides: $domainPortOverrides,
                             ));
                         }
                     }
@@ -3858,6 +3874,13 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                         $fqdns = str($fqdns)->explode(',');
                         if ($pull_request_id !== 0) {
                             $preview = $resource->previews()->find($preview_id);
+                            if (! $preview) {
+                                try {
+                                    $preview = ApplicationPreview::findPreviewByApplicationAndPullId($resource->id, $pull_request_id);
+                                } catch (ModelNotFoundException) {
+                                    throw new RuntimeException('Preview not found.');
+                                }
+                            }
                             $docker_compose_domains = json_decode(data_get($preview, 'docker_compose_domains') ?: '[]', true) ?: [];
                             if (count($docker_compose_domains) > 0) {
                                 $found_fqdn = getComposeServiceDomainString($docker_compose_domains, (string) $serviceName);
@@ -3867,22 +3890,20 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                     $fqdns = collect([]);
                                 }
                             } else {
-                                $fqdns = $fqdns->map(function ($fqdn) use ($pull_request_id, $resource) {
-                                    $preview = ApplicationPreview::findPreviewByApplicationAndPullId($resource->id, $pull_request_id);
-                                    $url = Url::fromString($fqdn);
-                                    $template = $resource->preview_url_template;
-                                    $host = $url->getHost();
-                                    $schema = $url->getScheme();
-                                    $random = new_public_id();
-                                    $preview_fqdn = str_replace('{{random}}', $random, $template);
-                                    $preview_fqdn = str_replace('{{domain}}', $host, $preview_fqdn);
-                                    $preview_fqdn = str_replace('{{pr_id}}', $pull_request_id, $preview_fqdn);
-                                    $preview_fqdn = "$schema://$preview_fqdn";
-                                    $preview->fqdn = $preview_fqdn;
-                                    $preview->save();
-
-                                    return $preview_fqdn;
-                                });
+                                $generatedDomains = $fqdns->map(
+                                    fn ($fqdn) => $preview->generatedPreviewDomain((string) $fqdn)
+                                );
+                                $fqdns = $generatedDomains->pluck('url');
+                                $preview->fqdn = $fqdns->implode(',');
+                                $generatedOverrides = $generatedDomains
+                                    ->filter(fn (array $generated): bool => filled($generated['port']))
+                                    ->mapWithKeys(fn (array $generated): array => [$generated['url'] => $generated['port']])
+                                    ->all();
+                                $preview->domain_port_overrides = array_replace(
+                                    $preview->domain_port_overrides ?? [],
+                                    $generatedOverrides,
+                                );
+                                $preview->save();
                             }
                         }
                         $noindexDomains = $pull_request_id !== 0 ? $fqdns : $resource->noindexDomains();
@@ -3891,6 +3912,11 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                         $redirectDirection = in_array($composeRedirect, ['www', 'non-www', 'both'], true)
                             ? $composeRedirect
                             : 'both';
+                        $domainPortOverrides = $pull_request_id === 0
+                            ? ($resource->domain_port_overrides ?? [])
+                            : ($preview?->domain_port_overrides ?? []);
+                        $exposedPorts = $resource->settings->is_static ? [80] : $resource->ports_exposes_array;
+                        $onlyPort = count($exposedPorts) > 0 ? $exposedPorts[0] : null;
                         if ($shouldGenerateLabelsExactly) {
                             switch ($server->proxyType()) {
                                 case ProxyTypes::TRAEFIK->value:
@@ -3904,8 +3930,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                             is_force_https_enabled: $resource->isForceHttpsEnabled(),
                                             is_gzip_enabled: $resource->isGzipEnabled(),
                                             is_stripprefix_enabled: $resource->isStripprefixEnabled(),
+                                            onlyPort: $onlyPort,
                                             noindex_domains: $noindexDomains,
                                             redirect_direction: $redirectDirection,
+                                            domainPortOverrides: $domainPortOverrides,
                                         )
                                     );
                                     break;
@@ -3920,8 +3948,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                             is_force_https_enabled: $resource->isForceHttpsEnabled(),
                                             is_gzip_enabled: $resource->isGzipEnabled(),
                                             is_stripprefix_enabled: $resource->isStripprefixEnabled(),
+                                            onlyPort: $onlyPort,
                                             noindex_domains: $noindexDomains,
                                             redirect_direction: $redirectDirection,
+                                            domainPortOverrides: $domainPortOverrides,
                                         )
                                     );
                                     break;
@@ -3937,8 +3967,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                     is_force_https_enabled: $resource->isForceHttpsEnabled(),
                                     is_gzip_enabled: $resource->isGzipEnabled(),
                                     is_stripprefix_enabled: $resource->isStripprefixEnabled(),
+                                    onlyPort: $onlyPort,
                                     noindex_domains: $noindexDomains,
                                     redirect_direction: $redirectDirection,
+                                    domainPortOverrides: $domainPortOverrides,
                                 )
                             );
                             $serviceLabels = $serviceLabels->merge(
@@ -3951,8 +3983,10 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                     is_force_https_enabled: $resource->isForceHttpsEnabled(),
                                     is_gzip_enabled: $resource->isGzipEnabled(),
                                     is_stripprefix_enabled: $resource->isStripprefixEnabled(),
+                                    onlyPort: $onlyPort,
                                     noindex_domains: $noindexDomains,
                                     redirect_direction: $redirectDirection,
+                                    domainPortOverrides: $domainPortOverrides,
                                 )
                             );
                         }
diff --git a/database/migrations/2026_09_01_210751_add_domain_port_overrides_to_service_applications_table.php b/database/migrations/2026_09_01_210751_add_domain_port_overrides_to_service_applications_table.php
new file mode 100644
index 000000000..c51551e79
--- /dev/null
+++ b/database/migrations/2026_09_01_210751_add_domain_port_overrides_to_service_applications_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('service_applications', function (Blueprint $table) {
+            $table->json('domain_port_overrides')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('service_applications', function (Blueprint $table) {
+            $table->dropColumn('domain_port_overrides');
+        });
+    }
+};
diff --git a/database/migrations/2026_09_02_064120_add_domain_port_overrides_to_applications_table.php b/database/migrations/2026_09_02_064120_add_domain_port_overrides_to_applications_table.php
new file mode 100644
index 000000000..f208c5865
--- /dev/null
+++ b/database/migrations/2026_09_02_064120_add_domain_port_overrides_to_applications_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->json('domain_port_overrides')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('applications', function (Blueprint $table) {
+            $table->dropColumn('domain_port_overrides');
+        });
+    }
+};
diff --git a/database/migrations/2026_09_02_132544_add_domain_port_overrides_to_application_previews_table.php b/database/migrations/2026_09_02_132544_add_domain_port_overrides_to_application_previews_table.php
new file mode 100644
index 000000000..80fc8a061
--- /dev/null
+++ b/database/migrations/2026_09_02_132544_add_domain_port_overrides_to_application_previews_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->json('domain_port_overrides')->nullable();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('application_previews', function (Blueprint $table) {
+            $table->dropColumn('domain_port_overrides');
+        });
+    }
+};
diff --git a/resources/views/livewire/project/application/domains.blade.php b/resources/views/livewire/project/application/domains.blade.php
index 128f2f262..b80085b9d 100644
--- a/resources/views/livewire/project/application/domains.blade.php
+++ b/resources/views/livewire/project/application/domains.blade.php
@@ -366,4 +366,48 @@ class="icon-button shrink-0" aria-label="Close">
 
     <x-domain-conflict-modal :conflicts="$domainConflicts" :showModal="$showDomainConflictModal"
         confirmAction="confirmDomainUsage" />
+
+    @if ($showPortWarningModal)
+        <div x-data="{ modalOpen: true }"
+            @keydown.escape.window="modalOpen = false; $wire.call('cancelUseUnknownPort')"
+            class="relative z-40">
+            <template x-teleport="body">
+                <div x-show="modalOpen"
+                    class="fixed inset-0 z-99 flex min-h-full items-center justify-center overflow-y-auto p-4" x-cloak>
+                    <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]"></div>
+                    <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
+                        class="application-settings-form application-settings-section relative w-full lg:min-w-[36rem] lg:max-w-2xl"
+                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
+                        <header>
+                            <h3>Use a different port?</h3>
+                            <button type="button"
+                                @click="modalOpen = false; $wire.call('cancelUseUnknownPort')"
+                                class="icon-button" aria-label="Close">
+                                <x-reicon name="x" class="size-4" />
+                            </button>
+                        </header>
+                        <div class="application-settings-section-body">
+                            <x-callout type="warning" title="Unrecognized internal port" class="mb-4">
+                                Port <strong>{{ $unrecognizedPort }}</strong> is not listed in Ports Exposes
+                                and is not used by any application domain. The proxy will still route to it,
+                                but the container may not be listening there.
+                            </x-callout>
+
+                            <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+                                <x-forms.button type="button" canGate="update" :canResource="$application"
+                                    @click="modalOpen = false; $wire.call('cancelUseUnknownPort')">
+                                    Cancel
+                                </x-forms.button>
+                                <x-forms.button type="button" wire:click="confirmUseUnknownPort" canGate="update"
+                                    :canResource="$application"
+                                    @click="modalOpen = false" isError>
+                                    Use this port anyway
+                                </x-forms.button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </template>
+        </div>
+    @endif
 </div>
diff --git a/resources/views/livewire/project/application/general.blade.php b/resources/views/livewire/project/application/general.blade.php
index d301b55b5..6c455c197 100644
--- a/resources/views/livewire/project/application/general.blade.php
+++ b/resources/views/livewire/project/application/general.blade.php
@@ -398,7 +398,15 @@ class="underline" href="https://coolify.io/docs/knowledge-base/docker/registry"
             @endif
 
             @if ($buildPack !== 'dockercompose')
-                <x-application.settings-section id="networking-section" title="Networking" helper="Ports the container exposes, host port mappings and internal network aliases.">
+                @php
+                    $applicationDomainsUrl = route('project.application.domains', [
+                        'project_uuid' => $application->environment->project->uuid,
+                        'environment_uuid' => $application->environment->uuid,
+                        'application_uuid' => $application->uuid,
+                    ]);
+                    $portsExposesDomainHint = "You can also set a different internal port for each domain on the <a class='underline dark:text-white' href='{$applicationDomainsUrl}'>Domains</a> page.";
+                @endphp
+                <x-application.settings-section id="networking-section" title="Networking" helper="Ports the container exposes, host port mappings and internal network aliases. You can also set an internal port per domain.">
                 @if ($this->detectedPortInfo)
                     @if ($this->detectedPortInfo['isEmpty'])
                         <div
@@ -460,20 +468,30 @@ class="flex items-start gap-2 p-4 mb-4 text-sm rounded-lg bg-blue-50 dark:bg-blu
                     </x-callout>
                 @endif
                 <div class="grid gap-4 lg:grid-cols-[14rem_16rem_minmax(0,1fr)]">
+                    <div class="min-w-0">
                     @if ($isStatic || $buildPack === 'static')
                         <x-forms.input id="portsExposes" label="Ports exposes" readonly
+                            :helper="$portsExposesDomainHint"
+                            canGate="update" :canResource="$application"
                             x-bind:disabled="!canUpdate" />
                     @else
                         @if ($application->settings->is_container_label_readonly_enabled === false)
                             <x-forms.input placeholder="3000,3001" id="portsExposes" label="Ports exposes" readonly
-                                helper="Readonly labels are disabled. You can set the ports manually in the labels section."
+                                :helper="'Readonly labels are disabled. You can set the ports manually in the labels section.<br><br>'.$portsExposesDomainHint"
+                                canGate="update" :canResource="$application"
                                 x-bind:disabled="!canUpdate" />
                         @else
                             <x-forms.input placeholder="3000,3001" id="portsExposes" label="Ports exposes"
-                                helper="A comma separated list of ports your application uses. The first port will be used as default healthcheck port if nothing defined in the Healthcheck menu. Be sure to set this correctly."
+                                :helper="'A comma separated list of ports your application uses. The first port will be used as default healthcheck port if nothing defined in the Healthcheck menu. Be sure to set this correctly.<br><br>'.$portsExposesDomainHint"
+                                canGate="update" :canResource="$application"
                                 x-bind:disabled="!canUpdate" />
                         @endif
                     @endif
+                    <p class="mt-1.5 text-xs text-neutral-500 dark:text-fg-dim">
+                        You can also set an internal port per domain on
+                        <a class="underline dark:text-white" href="{{ $applicationDomainsUrl }}" {{ wireNavigate() }}>Domains</a>.
+                    </p>
+                    </div>
                     @if (!$application->destination->server->isSwarm())
                         <x-forms.input placeholder="3000:3000" id="portsMappings" label="Port mappings"
                             helper="A comma separated list of ports you would like to map to the host system. Useful when you do not want to use domains.<br><br><span class='inline-block font-bold dark:text-warning'>Format:</span> host:container<br><br><span class='inline-block font-bold dark:text-warning'>Example:</span> 3000:3000,3002:3002<br><br>Rolling update is not supported if you have a port mapped to the host."
diff --git a/resources/views/livewire/project/application/partials/domain-row.blade.php b/resources/views/livewire/project/application/partials/domain-row.blade.php
index b41d3a431..cf8970d81 100644
--- a/resources/views/livewire/project/application/partials/domain-row.blade.php
+++ b/resources/views/livewire/project/application/partials/domain-row.blade.php
@@ -74,6 +74,17 @@ class="min-w-0 flex-1 text-[13px] text-black underline decoration-neutral-300 un
                         title="{{ $row['url'] }}">
                         {{ $row['url'] }}
                     </a>
+                    @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
+                        <span class="table-badge shrink-0"
+                            title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from Ports Exposes' }}">
+                            Internal port {{ $row['internal_port'] }}
+                        </span>
+                    @else
+                        <span class="table-badge table-badge-danger shrink-0"
+                            title="Set Ports Exposes or a per-domain internal port so the proxy can route this domain.">
+                            No internal port
+                        </span>
+                    @endif
                 @endif
                 @if ($isSuggested && ! empty($row['suggestion_label']))
                     <span class="table-badge table-badge-warning shrink-0">{{ $row['suggestion_label'] }}</span>
diff --git a/resources/views/livewire/project/application/preview-domains.blade.php b/resources/views/livewire/project/application/preview-domains.blade.php
index 766d0f64a..2a131e43c 100644
--- a/resources/views/livewire/project/application/preview-domains.blade.php
+++ b/resources/views/livewire/project/application/preview-domains.blade.php
@@ -76,6 +76,17 @@
                                 <a href="{{ getFqdnWithoutPort($row['url']) }}" target="_blank"
                                     class="min-w-0 flex-1 text-[13px] text-black underline decoration-neutral-300 underline-offset-2 hover:decoration-coollabs sm:truncate dark:text-fg dark:decoration-white/20 dark:hover:decoration-warning"
                                     title="{{ $row['url'] }}">{{ $row['url'] }}</a>
+                                @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
+                                    <span class="table-badge shrink-0"
+                                        title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from Ports Exposes' }}">
+                                        Internal port {{ $row['internal_port'] }}
+                                    </span>
+                                @else
+                                    <span class="table-badge table-badge-danger shrink-0"
+                                        title="Set Ports Exposes or a per-domain internal port so the proxy can route this domain.">
+                                        No internal port
+                                    </span>
+                                @endif
                                 @if (filled($row['service']))
                                     <span class="table-badge shrink-0">{{ $row['service'] }}</span>
                                 @endif
@@ -149,4 +160,48 @@ class="application-settings-form application-settings-section relative w-full ma
             </div>
         </div>
     </template>
+
+    @if ($showPortWarningModal)
+        <div x-data="{ modalOpen: true }"
+            @keydown.escape.window="modalOpen = false; $wire.call('cancelUseUnknownPort')"
+            class="relative z-40">
+            <template x-teleport="body">
+                <div x-show="modalOpen"
+                    class="fixed inset-0 z-99 flex min-h-full items-center justify-center overflow-y-auto p-4" x-cloak>
+                    <div class="absolute inset-0 bg-black/50 backdrop-blur-[2px]"></div>
+                    <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen"
+                        class="application-settings-form application-settings-section relative w-full lg:min-w-[36rem] lg:max-w-2xl"
+                        style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
+                        <header>
+                            <h3>Use a different port?</h3>
+                            <button type="button"
+                                @click="modalOpen = false; $wire.call('cancelUseUnknownPort')"
+                                class="icon-button" aria-label="Close">
+                                <x-reicon name="x" class="size-4" />
+                            </button>
+                        </header>
+                        <div class="application-settings-section-body">
+                            <x-callout type="warning" title="Unrecognized internal port" class="mb-4">
+                                Port <strong>{{ $unrecognizedPort }}</strong> is not listed in Ports Exposes
+                                and is not used by any application domain. The proxy will still route to it,
+                                but the container may not be listening there.
+                            </x-callout>
+
+                            <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
+                                <x-forms.button type="button" canGate="update" :canResource="$preview->application"
+                                    @click="modalOpen = false; $wire.call('cancelUseUnknownPort')">
+                                    Cancel
+                                </x-forms.button>
+                                <x-forms.button type="button" wire:click="confirmUseUnknownPort" canGate="update"
+                                    :canResource="$preview->application"
+                                    @click="modalOpen = false" isError>
+                                    Use this port anyway
+                                </x-forms.button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+            </template>
+        </div>
+    @endif
 </div>
diff --git a/resources/views/livewire/project/service/domains.blade.php b/resources/views/livewire/project/service/domains.blade.php
index 9a3a59482..a02d5ae75 100644
--- a/resources/views/livewire/project/service/domains.blade.php
+++ b/resources/views/livewire/project/service/domains.blade.php
@@ -296,7 +296,7 @@ class="fixed inset-0 z-99 flex min-h-full items-center justify-center overflow-y
                         class="application-settings-form application-settings-section relative w-full lg:min-w-[36rem] lg:max-w-2xl"
                         style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
                         <header>
-                            <h3>Remove required port?</h3>
+                            <h3>Use a different port?</h3>
                             <button type="button"
                                 @click="modalOpen = false; $wire.call('cancelRemovePort')"
                                 class="icon-button" aria-label="Close">
@@ -306,17 +306,17 @@ class="icon-button" aria-label="Close">
                         <div class="application-settings-section-body">
                             <x-callout type="warning" title="Port requirement" class="mb-4">
                                 This service requires port <strong>{{ $requiredPort }}</strong> to function correctly.
-                                One or more of your domains are missing a port number.
+                                One or more of your domains use a different port, or none.
                             </x-callout>
 
                             <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
                                 <x-forms.button type="button"
                                     @click="modalOpen = false; $wire.call('cancelRemovePort')">
-                                    Keep port
+                                    Keep required port
                                 </x-forms.button>
                                 <x-forms.button type="button" wire:click="confirmRemovePort"
                                     @click="modalOpen = false" isError>
-                                    Remove port anyway
+                                    Use this port anyway
                                 </x-forms.button>
                             </div>
                         </div>
diff --git a/resources/views/livewire/project/service/edit-domain.blade.php b/resources/views/livewire/project/service/edit-domain.blade.php
index 52474c8d9..91518194c 100644
--- a/resources/views/livewire/project/service/edit-domain.blade.php
+++ b/resources/views/livewire/project/service/edit-domain.blade.php
@@ -44,7 +44,7 @@ class="fixed inset-0 z-99 flex min-h-full items-center justify-center overflow-y
                         class="application-settings-form application-settings-section relative w-full lg:min-w-[36rem] lg:max-w-2xl"
                         style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
                         <header>
-                            <h3>Remove required port?</h3>
+                            <h3>Use a different port?</h3>
                             <button @click="modalOpen = false; $wire.call('cancelRemovePort')"
                                 class="flex size-7 items-center justify-center rounded-md text-neutral-500 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg">
                                 <x-reicon name="x" class="size-4" />
@@ -53,7 +53,7 @@ class="flex size-7 items-center justify-center rounded-md text-neutral-500 trans
                         <div class="application-settings-section-body">
                             <x-callout type="warning" title="Port requirement" class="mb-4">
                                 This service requires port <strong>{{ $requiredPort }}</strong> to function correctly.
-                                One or more of your domains are missing a port number.
+                                One or more of your domains use a different port, or none.
                             </x-callout>
 
                             <x-callout type="danger" title="What will happen if you continue?" class="mb-4">
@@ -68,11 +68,11 @@ class="flex size-7 items-center justify-center rounded-md text-neutral-500 trans
                             <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
                                 <x-forms.button @click="modalOpen = false; $wire.call('cancelRemovePort')"
                                     class="w-auto">
-                                    Keep port
+                                    Keep required port
                                 </x-forms.button>
                                 <x-forms.button wire:click="confirmRemovePort" @click="modalOpen = false" class="w-auto"
                                     isError>
-                                    Remove port anyway
+                                    Use this port anyway
                                 </x-forms.button>
                             </div>
                         </div>
diff --git a/resources/views/livewire/project/service/index.blade.php b/resources/views/livewire/project/service/index.blade.php
index a14acbd69..acd3f57f7 100644
--- a/resources/views/livewire/project/service/index.blade.php
+++ b/resources/views/livewire/project/service/index.blade.php
@@ -175,7 +175,7 @@ class="fixed inset-0 z-99 flex min-h-full items-center justify-center overflow-y
                                         class="application-settings-form application-settings-section relative w-full lg:min-w-[36rem] lg:max-w-2xl"
                                         style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal)">
                                         <header>
-                                            <h3>Remove required port?</h3>
+                                            <h3>Use a different port?</h3>
                                             <button @click="modalOpen = false; $wire.call('cancelRemovePort')"
                                                 class="flex size-7 items-center justify-center rounded-md text-neutral-500 transition-colors hover:bg-neutral-100 hover:text-black dark:text-fg-faint dark:hover:bg-white/[0.06] dark:hover:text-fg">
                                                 <x-reicon name="x" class="size-4" />
@@ -184,7 +184,7 @@ class="flex size-7 items-center justify-center rounded-md text-neutral-500 trans
                                         <div class="application-settings-section-body">
                                             <x-callout type="warning" title="Port requirement" class="mb-4">
                                                 This service requires port <strong>{{ $requiredPort }}</strong> to function correctly.
-                                                One or more of your domains are missing a port number.
+                                                One or more of your domains use a different port, or none.
                                             </x-callout>
 
                                             <x-callout type="danger" title="What will happen if you continue?" class="mb-4">
@@ -199,11 +199,11 @@ class="flex size-7 items-center justify-center rounded-md text-neutral-500 trans
                                             <div class="mt-4 flex flex-wrap justify-end gap-2 border-t border-neutral-200 pt-4 dark:border-white/[0.08]">
                                                 <x-forms.button @click="modalOpen = false; $wire.call('cancelRemovePort')"
                                                     class="w-auto">
-                                                    Keep port
+                                                    Keep required port
                                                 </x-forms.button>
                                                 <x-forms.button wire:click="confirmRemovePort" @click="modalOpen = false" class="w-auto"
                                                     isError>
-                                                    Remove port anyway
+                                                    Use this port anyway
                                                 </x-forms.button>
                                             </div>
                                         </div>
diff --git a/resources/views/livewire/project/service/partials/domain-table.blade.php b/resources/views/livewire/project/service/partials/domain-table.blade.php
index f6bda32c6..444d1bfd2 100644
--- a/resources/views/livewire/project/service/partials/domain-table.blade.php
+++ b/resources/views/livewire/project/service/partials/domain-table.blade.php
@@ -98,6 +98,12 @@ class="min-w-0 flex-1 text-[13px] text-black underline decoration-neutral-300 un
                                 title="{{ $row['url'] }}">
                                 {{ $row['url'] }}
                             </a>
+                            @if (filled($row['internal_port'] ?? null) && (int) $row['internal_port'] > 0)
+                                <span class="table-badge shrink-0"
+                                    title="{{ ($row['has_port_override'] ?? false) ? 'Custom internal port for this domain' : 'Inherited from the Coolify service port' }}">
+                                    Internal port {{ $row['internal_port'] }}
+                                </span>
+                            @endif
                         @endif
                         @if ($isSuggested && ! empty($row['suggestion_label']))
                             <span class="table-badge table-badge-warning shrink-0">{{ $row['suggestion_label'] }}</span>
diff --git a/routes/api.php b/routes/api.php
index 2d19ae96d..e7ee9d4ec 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -277,6 +277,7 @@
     Route::post('/applications/{uuid}/restart', [ApplicationsController::class, 'action_restart'])->middleware(['api.ability:deploy']);
     Route::post('/applications/{uuid}/stop', [ApplicationsController::class, 'action_stop'])->middleware(['api.ability:deploy']);
 
+    Route::patch('/applications/{uuid}/previews/{pull_request_id}', [ApplicationsController::class, 'update_preview_by_pull_request_id'])->middleware(['api.ability:write']);
     Route::delete('/applications/{uuid}/previews/{pull_request_id}', [ApplicationsController::class, 'delete_preview_by_pull_request_id'])->middleware(['api.ability:write']);
 
     Route::get('/github-apps', [GithubController::class, 'list_github_apps'])->middleware(['api.ability:read']);
diff --git a/templates/compose/appsmith.yaml b/templates/compose/appsmith.yaml
index d4a05accc..70f85fb08 100644
--- a/templates/compose/appsmith.yaml
+++ b/templates/compose/appsmith.yaml
@@ -3,6 +3,7 @@
 # category: productivity
 # tags: lowcode, nocode, no, low, platform
 # logo: svgs/appsmith.svg
+# port: 80
 
 services:
   appsmith:
diff --git a/templates/compose/appwrite.yaml b/templates/compose/appwrite.yaml
index 2a8e90d18..4f60baa11 100644
--- a/templates/compose/appwrite.yaml
+++ b/templates/compose/appwrite.yaml
@@ -3,6 +3,7 @@
 # category: backend
 # tags: backend, backend-as-a-service, platform
 # logo: svgs/appwrite.svg
+# port: 3003
 
 services:
   appwrite:
diff --git a/templates/compose/babybuddy.yaml b/templates/compose/babybuddy.yaml
index a3b52ff98..af07b2282 100644
--- a/templates/compose/babybuddy.yaml
+++ b/templates/compose/babybuddy.yaml
@@ -3,6 +3,7 @@
 # category: productivity
 # tags: baby, parents, health, growth, activities
 # logo: svgs/babybuddy.png
+# port: 8000
 
 services:
   babybuddy:
diff --git a/templates/compose/budge.yaml b/templates/compose/budge.yaml
index 3d98408fc..d4b782854 100644
--- a/templates/compose/budge.yaml
+++ b/templates/compose/budge.yaml
@@ -3,6 +3,7 @@
 # category: finance
 # tags: personal finance, budgeting, expense tracking
 # logo: svgs/budge.png
+# port: 80
 
 services:
   budge:
diff --git a/templates/compose/classicpress-with-mariadb.yaml b/templates/compose/classicpress-with-mariadb.yaml
index 20cc9518a..19ee86e42 100644
--- a/templates/compose/classicpress-with-mariadb.yaml
+++ b/templates/compose/classicpress-with-mariadb.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management
 # logo: svgs/classicpress.svg
+# port: 80
 
 services:
   classicpress:
diff --git a/templates/compose/classicpress-with-mysql.yaml b/templates/compose/classicpress-with-mysql.yaml
index ed880538c..2d90e046c 100644
--- a/templates/compose/classicpress-with-mysql.yaml
+++ b/templates/compose/classicpress-with-mysql.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management
 # logo: svgs/classicpress.svg
+# port: 80
 
 services:
   classicpress:
diff --git a/templates/compose/classicpress-without-database.yaml b/templates/compose/classicpress-without-database.yaml
index b2d6d5175..c52fc3860 100644
--- a/templates/compose/classicpress-without-database.yaml
+++ b/templates/compose/classicpress-without-database.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management
 # logo: svgs/classicpress.svg
+# port: 80
 
 services:
    classicpress:
diff --git a/templates/compose/dokuwiki.yaml b/templates/compose/dokuwiki.yaml
index d428877ee..32ce13b29 100644
--- a/templates/compose/dokuwiki.yaml
+++ b/templates/compose/dokuwiki.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: wiki, documentation, knowledge, base
 # logo: svgs/dokuwiki.png
+# port: 80
 
 services:
   dokuwiki:
diff --git a/templates/compose/drupal-with-postgresql.yaml b/templates/compose/drupal-with-postgresql.yaml
index 832997068..419f0e300 100644
--- a/templates/compose/drupal-with-postgresql.yaml
+++ b/templates/compose/drupal-with-postgresql.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management, postgresql
 # logo: svgs/drupal.svg
+# port: 80
 
 services:
   drupal:
diff --git a/templates/compose/grocy.yaml b/templates/compose/grocy.yaml
index a78373fdf..fc96d272d 100644
--- a/templates/compose/grocy.yaml
+++ b/templates/compose/grocy.yaml
@@ -3,6 +3,7 @@
 # category: productivity
 # tags: groceries, household, management, grocery, shopping
 # logo: svgs/grocy.svg
+# port: 80
 
 services:
   grocy:
diff --git a/templates/compose/heimdall.yaml b/templates/compose/heimdall.yaml
index 5fbdf763c..56e193f1c 100644
--- a/templates/compose/heimdall.yaml
+++ b/templates/compose/heimdall.yaml
@@ -3,6 +3,7 @@
 # category: productivity
 # tags: dashboard, server, applications, interface
 # logo: svgs/heimdall.svg
+# port: 80
 
 services:
   heimdall:
diff --git a/templates/compose/logto.yaml b/templates/compose/logto.yaml
index ce83a2ec3..7aa840f6d 100644
--- a/templates/compose/logto.yaml
+++ b/templates/compose/logto.yaml
@@ -3,6 +3,7 @@
 # category: auth
 # tags: logto,identity,login,authentication,oauth,oidc,openid
 # logo: svgs/logto_dark.svg
+# port: 3001
 
 services:
   logto:
diff --git a/templates/compose/phpmyadmin.yaml b/templates/compose/phpmyadmin.yaml
index 5732cdae0..6c95948e0 100644
--- a/templates/compose/phpmyadmin.yaml
+++ b/templates/compose/phpmyadmin.yaml
@@ -3,6 +3,7 @@
 # category: database
 # tags: database management
 # logo: svgs/phpmyadmin.svg
+# port: 80
 
 services:
   phpmyadmin:
diff --git a/templates/compose/snapdrop.yaml b/templates/compose/snapdrop.yaml
index 74d53b007..6fba2adbb 100644
--- a/templates/compose/snapdrop.yaml
+++ b/templates/compose/snapdrop.yaml
@@ -2,6 +2,7 @@
 # slogan: A self-hosted file-sharing service for secure and convenient file transfers, whether on a local network or the internet.
 # category: productivity
 # tags: file, sharing, transfer, local, network, internet
+# port: 80
 
 services:
   snapdrop:
diff --git a/templates/compose/wordpress-with-mariadb.yaml b/templates/compose/wordpress-with-mariadb.yaml
index 952aa0498..7822a0553 100644
--- a/templates/compose/wordpress-with-mariadb.yaml
+++ b/templates/compose/wordpress-with-mariadb.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management, mariadb
 # logo: svgs/wordpress.svg
+# port: 80
 
 services:
   wordpress:
diff --git a/templates/compose/wordpress-with-mysql.yaml b/templates/compose/wordpress-with-mysql.yaml
index 34ad36d65..269208e51 100644
--- a/templates/compose/wordpress-with-mysql.yaml
+++ b/templates/compose/wordpress-with-mysql.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management, mysql
 # logo: svgs/wordpress.svg
+# port: 80
 
 services:
   wordpress:
diff --git a/templates/compose/wordpress-without-database.yaml b/templates/compose/wordpress-without-database.yaml
index f45108036..cb9a459b5 100644
--- a/templates/compose/wordpress-without-database.yaml
+++ b/templates/compose/wordpress-without-database.yaml
@@ -3,6 +3,7 @@
 # category: cms
 # tags: cms, blog, content, management
 # logo: svgs/wordpress.svg
+# port: 80
 
 services:
   wordpress:
diff --git a/templates/service-templates-latest.json b/templates/service-templates-latest.json
index b6a452e75..3098e5269 100644
--- a/templates/service-templates-latest.json
+++ b/templates/service-templates-latest.json
@@ -138,7 +138,8 @@
         "category": "productivity",
         "logo": "svgs/appsmith.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "appwrite": {
         "documentation": "https://appwrite.io/docs?utm_source=coolify.io",
@@ -152,7 +153,8 @@
         "category": "backend",
         "logo": "svgs/appwrite.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-10-23T19:52:21+05:30"
+        "template_last_updated_at": "2025-10-23T19:52:21+05:30",
+        "port": "3003"
     },
     "argilla": {
         "documentation": "https://docs.argilla.io/latest/?utm_source=coolify.io",
@@ -219,7 +221,7 @@
     },
     "autobase": {
         "documentation": "https://autobase.tech/docs/?utm_source=coolify.io",
-        "slogan": "Autobase for PostgreSQL\u00ae is an open-source alternative to cloud-managed databases (self-hosted DBaaS).",
+        "slogan": "Autobase for PostgreSQL® is an open-source alternative to cloud-managed databases (self-hosted DBaaS).",
         "compose": "c2VydmljZXM6CiAgYXV0b2Jhc2U6CiAgICBpbWFnZTogJ2F1dG9iYXNlL2NvbnNvbGVfdWk6Mi41LjInCiAgICBwbGF0Zm9ybTogbGludXgvYW1kNjQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9BVVRPQkFTRV84MAogICAgICAtICdQR19DT05TT0xFX0FVVEhPUklaQVRJT05fVE9LRU49JHtTRVJWSUNFX1BBU1NXT1JEX1VJfScKICAgICAgLSBQR19DT05TT0xFX0FQSV9IT1NUPWF1dG9iYXNlLWFwaQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgwLycKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICBkZXBlbmRzX29uOgogICAgICBhdXRvYmFzZS1hcGk6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBhdXRvYmFzZS1kYjoKICAgIGltYWdlOiAnYXV0b2Jhc2UvY29uc29sZV9kYjoyLjUuMicKICAgIHBsYXRmb3JtOiBsaW51eC9hbWQ2NAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICB2b2x1bWVzOgogICAgICAtICdhdXRvYmFzZS1kYi1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgcG9zdGdyZXMnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogIGF1dG9iYXNlLWFwaToKICAgIGltYWdlOiAnYXV0b2Jhc2UvY29uc29sZV9hcGk6Mi41LjInCiAgICBwbGF0Zm9ybTogbGludXgvYW1kNjQKICAgIGVudmlyb25tZW50OgogICAgICAtIFBHX0NPTlNPTEVfREJfSE9TVD1hdXRvYmFzZS1kYgogICAgICAtICdQR19DT05TT0xFX0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BHX0NPTlNPTEVfQVVUSE9SSVpBVElPTl9UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfVUl9JwogICAgICAtICdQR19DT05TT0xFX0VOQ1JZUFRJT05LRVk9JHtTRVJWSUNFX0JBU0U2NF9FTkNSWVBUSU9OS0VZfScKICAgICAgLSAnUEdfQ09OU09MRV9MT0dHRVJfTEVWRUw9JHtQR19DT05TT0xFX0xPR0dFUl9MRVZFTDotaW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICcvdmFyL3J1bi9kb2NrZXIuc29jazovdmFyL3J1bi9kb2NrZXIuc29jaycKICAgICAgLSAnL3RtcC9hbnNpYmxlOi90bXAvYW5zaWJsZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWZzUycKICAgICAgICAtICctSCcKICAgICAgICAtICdhY2NlcHQ6IGFwcGxpY2F0aW9uL2pzb24nCiAgICAgICAgLSAnLUgnCiAgICAgICAgLSAnQXV0aG9yaXphdGlvbjogQmVhcmVyICR7U0VSVklDRV9QQVNTV09SRF9VSX0nCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4MDgwL2FwaS92MS92ZXJzaW9uJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgIGRlcGVuZHNfb246CiAgICAgIGF1dG9iYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5Cg==",
         "tags": [
             "database",
@@ -248,7 +250,8 @@
         "category": "productivity",
         "logo": "svgs/babybuddy.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "8000"
     },
     "bento-pdf": {
         "documentation": "https://bentopdf.com/docs?utm_source=coolify.io",
@@ -377,7 +380,8 @@
         "category": "finance",
         "logo": "svgs/budge.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00"
+        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
+        "port": "80"
     },
     "budibase": {
         "documentation": "https://docs.budibase.com/docs/docker-compose?utm_source=coolify.io",
@@ -679,7 +683,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "classicpress-with-mysql": {
         "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
@@ -694,7 +699,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "classicpress-without-database": {
         "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
@@ -709,7 +715,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "cloudbeaver": {
         "documentation": "https://dbeaver.com/docs/cloudbeaver/?utm_source=coolify.io",
@@ -1070,7 +1077,8 @@
         "category": "cms",
         "logo": "svgs/dokuwiki.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "dolibarr": {
         "documentation": "https://www.dolibarr.org/documentation-home.php?utm_source=coolify.io",
@@ -1149,7 +1157,8 @@
         "category": "cms",
         "logo": "svgs/drupal.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "duplicati": {
         "documentation": "https://duplicati.readthedocs.io?utm_source=coolify.io",
@@ -1794,7 +1803,7 @@
     },
     "getoutline": {
         "documentation": "https://docs.getoutline.com/s/hosting/doc/hosting-outline-nipGaCRBDu?utm_source=coolify.io",
-        "slogan": "Your team\u2019s knowledge base",
+        "slogan": "Your team’s knowledge base",
         "compose": "c2VydmljZXM6CiAgb3V0bGluZToKICAgIGltYWdlOiAnZG9ja2VyLmdldG91dGxpbmUuY29tL291dGxpbmV3aWtpL291dGxpbmU6bGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnc3RvcmFnZS1kYXRhOi92YXIvbGliL291dGxpbmUvZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9PVVRMSU5FXzMwMDAKICAgICAgLSBOT0RFX0VOVj1wcm9kdWN0aW9uCiAgICAgIC0gJ1NFQ1JFVF9LRVk9JHtTRVJWSUNFX0hFWF82NF9PVVRMSU5FfScKICAgICAgLSAnVVRJTFNfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF82NF9PVVRMSU5FfScKICAgICAgLSAnREFUQUJBU0VfVVJMPXBvc3RncmVzOi8vJHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9OiR7U0VSVklDRV9QQVNTV09SRF82NF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi8ke1BPU1RHUkVTX0RBVEFCQVNFOi1vdXRsaW5lfScKICAgICAgLSAnUkVESVNfVVJMPXJlZGlzOi8vOiR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU31AcmVkaXM6NjM3OScKICAgICAgLSAnVVJMPSR7U0VSVklDRV9VUkxfT1VUTElORX0nCiAgICAgIC0gJ1BPUlQ9JHtPVVRMSU5FX1BPUlQ6LTMwMDB9JwogICAgICAtICdGSUxFX1NUT1JBR0U9JHtGSUxFX1NUT1JBR0U6LWxvY2FsfScKICAgICAgLSAnRklMRV9TVE9SQUdFX0xPQ0FMX1JPT1RfRElSPSR7RklMRV9TVE9SQUdFX0xPQ0FMX1JPT1RfRElSOi0vdmFyL2xpYi9vdXRsaW5lL2RhdGF9JwogICAgICAtICdGSUxFX1NUT1JBR0VfVVBMT0FEX01BWF9TSVpFPSR7RklMRV9TVE9SQUdFX1VQTE9BRF9NQVhfU0laRTotMjAwMH0nCiAgICAgIC0gJ0ZJTEVfU1RPUkFHRV9JTVBPUlRfTUFYX1NJWkU9JHtGSUxFX1NUT1JBR0VfSU1QT1JUX01BWF9TSVpFOi0xMDB9JwogICAgICAtICdGSUxFX1NUT1JBR0VfV09SS1NQQUNFX0lNUE9SVF9NQVhfU0laRT0ke0ZJTEVfU1RPUkFHRV9XT1JLU1BBQ0VfSU1QT1JUX01BWF9TSVpFfScKICAgICAgLSAnQVdTX0FDQ0VTU19LRVlfSUQ9JHtBV1NfQUNDRVNTX0tFWV9JRH0nCiAgICAgIC0gJ0FXU19TRUNSRVRfQUNDRVNTX0tFWT0ke0FXU19TRUNSRVRfQUNDRVNTX0tFWX0nCiAgICAgIC0gJ0FXU19SRUdJT049JHtBV1NfUkVHSU9OfScKICAgICAgLSAnQVdTX1MzX0FDQ0VMRVJBVEVfVVJMPSR7QVdTX1MzX0FDQ0VMRVJBVEVfVVJMfScKICAgICAgLSAnQVdTX1MzX1VQTE9BRF9CVUNLRVRfVVJMPSR7QVdTX1MzX1VQTE9BRF9CVUNLRVRfVVJMfScKICAgICAgLSAnQVdTX1MzX1VQTE9BRF9CVUNLRVRfTkFNRT0ke0FXU19TM19VUExPQURfQlVDS0VUX05BTUV9JwogICAgICAtICdBV1NfUzNfRk9SQ0VfUEFUSF9TVFlMRT0ke0FXU19TM19GT1JDRV9QQVRIX1NUWUxFOi10cnVlfScKICAgICAgLSAnQVdTX1MzX0FDTD0ke0FXU19TM19BQ0w6LXByaXZhdGV9JwogICAgICAtICdTTEFDS19DTElFTlRfSUQ9JHtTTEFDS19DTElFTlRfSUR9JwogICAgICAtICdTTEFDS19DTElFTlRfU0VDUkVUPSR7U0xBQ0tfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ0dPT0dMRV9DTElFTlRfSUQ9JHtHT09HTEVfQ0xJRU5UX0lEfScKICAgICAgLSAnR09PR0xFX0NMSUVOVF9TRUNSRVQ9JHtHT09HTEVfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ0FaVVJFX0NMSUVOVF9JRD0ke0FaVVJFX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0FaVVJFX0NMSUVOVF9TRUNSRVQ9JHtBWlVSRV9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnQVpVUkVfUkVTT1VSQ0VfQVBQX0lEPSR7QVpVUkVfUkVTT1VSQ0VfQVBQX0lEfScKICAgICAgLSAnT0lEQ19DTElFTlRfSUQ9JHtPSURDX0NMSUVOVF9JRH0nCiAgICAgIC0gJ09JRENfQ0xJRU5UX1NFQ1JFVD0ke09JRENfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ09JRENfQVVUSF9VUkk9JHtPSURDX0FVVEhfVVJJfScKICAgICAgLSAnT0lEQ19UT0tFTl9VUkk9JHtPSURDX1RPS0VOX1VSSX0nCiAgICAgIC0gJ09JRENfVVNFUklORk9fVVJJPSR7T0lEQ19VU0VSSU5GT19VUkl9JwogICAgICAtICdPSURDX0xPR09VVF9VUkk9JHtPSURDX0xPR09VVF9VUkl9JwogICAgICAtICdPSURDX1VTRVJOQU1FX0NMQUlNPSR7T0lEQ19VU0VSTkFNRV9DTEFJTX0nCiAgICAgIC0gJ09JRENfRElTUExBWV9OQU1FPSR7T0lEQ19ESVNQTEFZX05BTUV9JwogICAgICAtICdPSURDX1NDT1BFUz0ke09JRENfU0NPUEVTfScKICAgICAgLSAnR0lUSFVCX0NMSUVOVF9JRD0ke0dJVEhVQl9DTElFTlRfSUR9JwogICAgICAtICdHSVRIVUJfQ0xJRU5UX1NFQ1JFVD0ke0dJVEhVQl9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnR0lUSFVCX0FQUF9OQU1FPSR7R0lUSFVCX0FQUF9OQU1FfScKICAgICAgLSAnR0lUSFVCX0FQUF9JRD0ke0dJVEhVQl9BUFBfSUR9JwogICAgICAtICdHSVRIVUJfQVBQX1BSSVZBVEVfS0VZPSR7R0lUSFVCX0FQUF9QUklWQVRFX0tFWX0nCiAgICAgIC0gJ0RJU0NPUkRfQ0xJRU5UX0lEPSR7RElTQ09SRF9DTElFTlRfSUR9JwogICAgICAtICdESVNDT1JEX0NMSUVOVF9TRUNSRVQ9JHtESVNDT1JEX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdESVNDT1JEX1NFUlZFUl9JRD0ke0RJU0NPUkRfU0VSVkVSX0lEfScKICAgICAgLSAnRElTQ09SRF9TRVJWRVJfUk9MRVM9JHtESVNDT1JEX1NFUlZFUl9ST0xFU30nCiAgICAgIC0gJ1BHU1NMTU9ERT0ke1BHU1NMTU9ERTotZGlzYWJsZX0nCiAgICAgIC0gJ0ZPUkNFX0hUVFBTPSR7Rk9SQ0VfSFRUUFM6LXRydWV9JwogICAgICAtICdTTVRQX0hPU1Q9JHtTTVRQX0hPU1R9JwogICAgICAtICdTTVRQX1BPUlQ9JHtTTVRQX1BPUlR9JwogICAgICAtICdTTVRQX1VTRVJOQU1FPSR7U01UUF9VU0VSTkFNRX0nCiAgICAgIC0gJ1NNVFBfUEFTU1dPUkQ9JHtTTVRQX1BBU1NXT1JEfScKICAgICAgLSAnU01UUF9GUk9NX0VNQUlMPSR7U01UUF9GUk9NX0VNQUlMfScKICAgICAgLSAnU01UUF9SRVBMWV9FTUFJTD0ke1NNVFBfUkVQTFlfRU1BSUx9JwogICAgICAtICdTTVRQX1RMU19DSVBIRVJTPSR7U01UUF9UTFNfQ0lQSEVSU30nCiAgICAgIC0gJ1NNVFBfU0VDVVJFPSR7U01UUF9TRUNVUkV9JwogICAgICAtICdTTVRQX05BTUU9JHtTTVRQX05BTUV9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIGRpc2FibGU6IHRydWUKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6YWxwaW5lJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1JFRElTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU30nCiAgICBjb21tYW5kOgogICAgICAtIHJlZGlzLXNlcnZlcgogICAgICAtICctLXJlcXVpcmVwYXNzJwogICAgICAtICcke1NFUlZJQ0VfUEFTU1dPUkRfNjRfUkVESVN9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gJy1hJwogICAgICAgIC0gJyR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU30nCiAgICAgICAgLSBQSU5HCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogMzBzCiAgICAgIHJldHJpZXM6IDMKICBwb3N0Z3JlczoKICAgIGltYWdlOiAncG9zdGdyZXM6MTItYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnZGF0YWJhc2UtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF82NF9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREFUQUJBU0U6LW91dGxpbmV9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHBnX2lzcmVhZHkKICAgICAgICAtICctVScKICAgICAgICAtICcke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgICAgLSAnLWQnCiAgICAgICAgLSAnJHtQT1NUR1JFU19EQVRBQkFTRTotb3V0bGluZX0nCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDMK",
         "tags": [
             "knowledge base",
@@ -2171,7 +2180,8 @@
         "category": "productivity",
         "logo": "svgs/grocy.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-05-12T09:10:44+02:00"
+        "template_last_updated_at": "2026-05-12T09:10:44+02:00",
+        "port": "80"
     },
     "hatchet": {
         "documentation": "https://docs.hatchet.run/self-hosting/docker-compose?utm_source=coolify.io",
@@ -2221,11 +2231,12 @@
         "category": "productivity",
         "logo": "svgs/heimdall.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "hermes-agent-with-webui": {
         "documentation": "https://github.com/nesquena/hermes-webui?utm_source=coolify.io",
-        "slogan": "Hermes Agent \u2014 autonomous AI agent with persistent memory, scheduling, and a self-hosted web chat UI.",
+        "slogan": "Hermes Agent — autonomous AI agent with persistent memory, scheduling, and a self-hosted web chat UI.",
         "compose": "c2VydmljZXM6CiAgaGVybWVzLWFnZW50OgogICAgaW1hZ2U6ICdub3VzcmVzZWFyY2gvaGVybWVzLWFnZW50QHNoYTI1NjoyZjFmMmYxNzI1ZTVkYzlhNjFjZjZhMmRlYTVhY2E1MmE3NzZlYzRkMDIyY2IyOTY3OWU2YWEzZmYzMDNlNzdhJwogICAgY29tbWFuZDogJ2dhdGV3YXkgcnVuJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gSEVSTUVTX0hPTUU9L2hvbWUvaGVybWVzLy5oZXJtZXMKICAgICAgLSBIRVJNRVNfVUlEPTEwMDAKICAgICAgLSBIRVJNRVNfR0lEPTEwMDAKICAgICAgLSAnT1BFTlJPVVRFUl9BUElfS0VZPSR7T1BFTlJPVVRFUl9BUElfS0VZfScKICAgICAgLSAnQU5USFJPUElDX0FQSV9LRVk9JHtBTlRIUk9QSUNfQVBJX0tFWX0nCiAgICAgIC0gJ09QRU5BSV9BUElfS0VZPSR7T1BFTkFJX0FQSV9LRVl9JwogICAgICAtICdHT09HTEVfQVBJX0tFWT0ke0dPT0dMRV9BUElfS0VZfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2hlcm1lcy1ob21lOi9ob21lL2hlcm1lcy8uaGVybWVzJwogICAgICAtICdoZXJtZXMtYWdlbnQtc3JjOi9vcHQvaGVybWVzJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICd0ZXN0IC1kIC9ob21lL2hlcm1lcy8uaGVybWVzIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgaGVybWVzLXdlYnVpOgogICAgaW1hZ2U6ICdnaGNyLmlvL25lc3F1ZW5hL2hlcm1lcy13ZWJ1aTowLjUxLjkyJwogICAgZGVwZW5kc19vbjoKICAgICAgLSBoZXJtZXMtYWdlbnQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0hFUk1FU1dFQlVJXzg3ODcKICAgICAgLSBIRVJNRVNfV0VCVUlfSE9TVD0wLjAuMC4wCiAgICAgIC0gSEVSTUVTX1dFQlVJX1BPUlQ9ODc4NwogICAgICAtIEhFUk1FU19XRUJVSV9TVEFURV9ESVI9L2hvbWUvaGVybWVzd2VidWkvLmhlcm1lcy93ZWJ1aQogICAgICAtIFdBTlRFRF9VSUQ9MTAwMAogICAgICAtIFdBTlRFRF9HSUQ9MTAwMAogICAgICAtICdIRVJNRVNfV0VCVUlfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0hFUk1FU1dFQlVJfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2hlcm1lcy1ob21lOi9ob21lL2hlcm1lc3dlYnVpLy5oZXJtZXMnCiAgICAgIC0gJ2hlcm1lcy1hZ2VudC1zcmM6L2hvbWUvaGVybWVzd2VidWkvLmhlcm1lcy9oZXJtZXMtYWdlbnQ6cm8nCiAgICAgIC0gJ2hlcm1lcy13b3Jrc3BhY2U6L3dvcmtzcGFjZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4Nzg3L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCg==",
         "tags": [
             "ai",
@@ -2524,7 +2535,7 @@
     },
     "jitsi": {
         "documentation": "https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker/?utm_source=coolify.io",
-        "slogan": "Self-hosted Jitsi Meet \u2014 open-source video conferencing platform",
+        "slogan": "Self-hosted Jitsi Meet — open-source video conferencing platform",
         "compose": "c2VydmljZXM6CiAgaml0c2ktd2ViOgogICAgaW1hZ2U6ICdqaXRzaS93ZWI6c3RhYmxlLTEwODg4JwogICAgcmVzdGFydDogdW5sZXNzLXN0b3BwZWQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0pJVFNJCiAgICAgIC0gUFVCTElDX1VSTD0kU0VSVklDRV9VUkxfSklUU0kKICAgICAgLSBFTkFCTEVfQVVUSD0wCiAgICAgIC0gRU5BQkxFX0dVRVNUUz0xCiAgICAgIC0gRU5BQkxFX0xFVFNFTkNSWVBUPTAKICAgICAgLSBFTkFCTEVfSFRUUF9SRURJUkVDVD0wCiAgICAgIC0gRElTQUJMRV9IVFRQUz0xCiAgICAgIC0gWE1QUF9ET01BSU49bWVldC5qaXRzaQogICAgICAtIFhNUFBfQVVUSF9ET01BSU49YXV0aC5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9HVUVTVF9ET01BSU49Z3Vlc3QubWVldC5qaXRzaQogICAgICAtIFhNUFBfTVVDX0RPTUFJTj1jb25mZXJlbmNlLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX0lOVEVSTkFMX01VQ19ET01BSU49aW50ZXJuYWwuYXV0aC5tZWV0LmppdHNpCiAgICAgIC0gJ1hNUFBfQk9TSF9VUkxfQkFTRT1odHRwOi8vcHJvc29keTo1MjgwJwogICAgICAtIEpWQl9CUkVXRVJZX01VQz1qdmJicmV3ZXJ5CiAgICAgIC0gJ0pJQ09GT19DT01QT05FTlRfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KSUNPRk99JwogICAgICAtICdKSUNPRk9fQVVUSF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSklDT0ZPfScKICAgICAgLSAnSlZCX0FVVEhfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pWQn0nCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICBkZXBlbmRzX29uOgogICAgICAtIHByb3NvZHkKICAgICAgLSBqaWNvZm8KICAgICAgLSBqdmIKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ppdHNpLXdlYjovY29uZmlnJwogICAgbmV0d29ya3M6CiAgICAgIG1lZXQuaml0c2k6CiAgICAgICAgYWxpYXNlczoKICAgICAgICAgIC0gbWVldC5qaXRzaQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgcHJvc29keToKICAgIGltYWdlOiAnaml0c2kvcHJvc29keTpzdGFibGUtMTA4ODgnCiAgICByZXN0YXJ0OiB1bmxlc3Mtc3RvcHBlZAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQVVUSF9UWVBFPWludGVybmFsCiAgICAgIC0gRU5BQkxFX0FVVEg9MAogICAgICAtIEVOQUJMRV9HVUVTVFM9MQogICAgICAtIFhNUFBfRE9NQUlOPW1lZXQuaml0c2kKICAgICAgLSBYTVBQX0FVVEhfRE9NQUlOPWF1dGgubWVldC5qaXRzaQogICAgICAtIFhNUFBfR1VFU1RfRE9NQUlOPWd1ZXN0Lm1lZXQuaml0c2kKICAgICAgLSBYTVBQX01VQ19ET01BSU49Y29uZmVyZW5jZS5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9JTlRFUk5BTF9NVUNfRE9NQUlOPWludGVybmFsLmF1dGgubWVldC5qaXRzaQogICAgICAtICdKSUNPRk9fQ09NUE9ORU5UX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfSklDT0ZPfScKICAgICAgLSAnSklDT0ZPX0FVVEhfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pJQ09GT30nCiAgICAgIC0gJ0pWQl9BVVRIX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9KVkJ9JwogICAgICAtIFBVQkxJQ19VUkw9JFNFUlZJQ0VfVVJMX0pJVFNJCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICAgIC0gJ0xPR19MRVZFTD0ke0xPR19MRVZFTDotaW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICdqaXRzaS1wcm9zb2R5Oi9jb25maWcnCiAgICBuZXR3b3JrczoKICAgICAgbWVldC5qaXRzaToKICAgICAgICBhbGlhc2VzOgogICAgICAgICAgLSB4bXBwLm1lZXQuaml0c2kKICAgICAgICAgIC0gYXV0aC5tZWV0LmppdHNpCiAgICAgICAgICAtIGd1ZXN0Lm1lZXQuaml0c2kKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo1MjgwL2h0dHAtYmluZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGppY29mbzoKICAgIGltYWdlOiAnaml0c2kvamljb2ZvOnN0YWJsZS0xMDg4OCcKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBBVVRIX1RZUEU9aW50ZXJuYWwKICAgICAgLSBFTkFCTEVfQVVUSD0wCiAgICAgIC0gWE1QUF9ET01BSU49bWVldC5qaXRzaQogICAgICAtIFhNUFBfQVVUSF9ET01BSU49YXV0aC5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9JTlRFUk5BTF9NVUNfRE9NQUlOPWludGVybmFsLmF1dGgubWVldC5qaXRzaQogICAgICAtIFhNUFBfTVVDX0RPTUFJTj1jb25mZXJlbmNlLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX1NFUlZFUj1wcm9zb2R5CiAgICAgIC0gJ0pJQ09GT19DT01QT05FTlRfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KSUNPRk99JwogICAgICAtICdKSUNPRk9fQVVUSF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSklDT0ZPfScKICAgICAgLSBKVkJfQlJFV0VSWV9NVUM9anZiYnJld2VyeQogICAgICAtIEpJQ09GT19FTkFCTEVfSEVBTFRIX0NIRUNLUz0xCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICBkZXBlbmRzX29uOgogICAgICAtIHByb3NvZHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ppdHNpLWppY29mbzovY29uZmlnJwogICAgbmV0d29ya3M6CiAgICAgIG1lZXQuaml0c2k6IG51bGwKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4ODg4L2Fib3V0L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGp2YjoKICAgIGltYWdlOiAnaml0c2kvanZiOnN0YWJsZS0xMDg4OCcKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBwb3J0czoKICAgICAgLSAnMTAwMDA6MTAwMDAvdWRwJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gWE1QUF9TRVJWRVI9cHJvc29keQogICAgICAtIFhNUFBfRE9NQUlOPW1lZXQuaml0c2kKICAgICAgLSBYTVBQX0FVVEhfRE9NQUlOPWF1dGgubWVldC5qaXRzaQogICAgICAtIFhNUFBfSU5URVJOQUxfTVVDX0RPTUFJTj1pbnRlcm5hbC5hdXRoLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX01VQ19ET01BSU49Y29uZmVyZW5jZS5tZWV0LmppdHNpCiAgICAgIC0gSlZCX0FVVEhfVVNFUj1qdmIKICAgICAgLSAnSlZCX0FVVEhfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pWQn0nCiAgICAgIC0gSlZCX0JSRVdFUllfTVVDPWp2YmJyZXdlcnkKICAgICAgLSBKVkJfUE9SVD0xMDAwMAogICAgICAtICdKVkJfQURWRVJUSVNFX0lQUz0ke0pWQl9BRFZFUlRJU0VfSVBTOi19JwogICAgICAtICdKVkJfU1RVTl9TRVJWRVJTPSR7SlZCX1NUVU5fU0VSVkVSUzotc3R1bi5sLmdvb2dsZS5jb206MTkzMDJ9JwogICAgICAtIFBVQkxJQ19VUkw9JFNFUlZJQ0VfVVJMX0pJVFNJCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICBkZXBlbmRzX29uOgogICAgICAtIHByb3NvZHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ppdHNpLWp2YjovY29uZmlnJwogICAgbmV0d29ya3M6CiAgICAgIG1lZXQuaml0c2k6IG51bGwKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4MDgwL2Fib3V0L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQpuZXR3b3JrczoKICBtZWV0LmppdHNpOiBudWxsCg==",
         "tags": [
             "jitsi",
@@ -2975,7 +2986,8 @@
         "category": "auth",
         "logo": "svgs/logto_dark.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-01T13:19:47Z"
+        "template_last_updated_at": "2026-04-01T13:19:47Z",
+        "port": "3001"
     },
     "lowcoder": {
         "documentation": "https://docs.lowcoder.cloud/?utm_source=coolify.io",
@@ -3283,7 +3295,7 @@
     },
     "moodle": {
         "documentation": "https://moodle.org?utm_source=coolify.io",
-        "slogan": "Moodle is the world\u2019s most customisable and trusted eLearning solution that empowers educators to improve our world.",
+        "slogan": "Moodle is the world’s most customisable and trusted eLearning solution that empowers educators to improve our world.",
         "compose": "c2VydmljZXM6CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMS4xJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQUxMT1dfRU1QVFlfUEFTU1dPUkQ9bm8KICAgICAgLSBNWVNRTF9ST09UX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1JPT1QKICAgICAgLSBNWVNRTF9EQVRBQkFTRT1iaXRuYW1pX21vb2RsZQogICAgICAtIE1ZU1FMX1VTRVI9JFNFUlZJQ0VfVVNFUl9NQVJJQURCCiAgICAgIC0gTVlTUUxfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQgogICAgICAtIE1BUklBREJfQ0hBUkFDVEVSX1NFVD11dGY4bWI0CiAgICAgIC0gTUFSSUFEQl9DT0xMQVRFPXV0ZjhtYjRfdW5pY29kZV9jaQogICAgdm9sdW1lczoKICAgICAgLSAnbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJiYXNoIC1jICc8L2Rldi90Y3AvbG9jYWxob3N0LzMzMDYnIgogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICBtb29kbGU6CiAgICBpbWFnZTogJ2RvY2tlci5pby9iaXRuYW1pbGVnYWN5L21vb2RsZTo0LjMnCiAgICBkZXBlbmRzX29uOgogICAgICAtIG1hcmlhZGIKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX01PT0RMRV84MDgwCiAgICAgIC0gTU9PRExFX0RBVEFCQVNFX0hPU1Q9bWFyaWFkYgogICAgICAtIE1PT0RMRV9EQVRBQkFTRV9QT1JUX05VTUJFUj0zMzA2CiAgICAgIC0gTU9PRExFX0RBVEFCQVNFX1VTRVI9JFNFUlZJQ0VfVVNFUl9NQVJJQURCCiAgICAgIC0gTU9PRExFX0RBVEFCQVNFX05BTUU9Yml0bmFtaV9tb29kbGUKICAgICAgLSBNT09ETEVfREFUQUJBU0VfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQgogICAgICAtIEFMTE9XX0VNUFRZX1BBU1NXT1JEPW5vCiAgICAgIC0gJ01PT0RMRV9VU0VSTkFNRT0ke01PT0RMRV9VU0VSTkFNRTotdXNlcn0nCiAgICAgIC0gTU9PRExFX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX01PT0RMRQogICAgICAtIE1PT0RMRV9FTUFJTD11c2VyQGV4YW1wbGUuY29tCiAgICAgIC0gJ01PT0RMRV9TSVRFX05BTUU9JHtNT09ETEVfU0lURV9OQU1FOi1OZXcgU2l0ZX0nCiAgICB2b2x1bWVzOgogICAgICAtICdtb29kbGUtZGF0YTovYml0bmFtaS9tb29kbGUnCiAgICAgIC0gJ21vb2RsZWRhdGEtZGF0YTovYml0bmFtaS9tb29kbGVkYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHBocAogICAgICAgIC0gJy1yJwogICAgICAgIC0gImV4aXQoZmlsZV9leGlzdHMoJy9vcHQvYml0bmFtaS9tb29kbGUvY29uZmlnLnBocCcpID8gMCA6IDEpOyIKICAgICAgaW50ZXJ2YWw6IDIwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogNQo=",
         "tags": [
             "moodle",
@@ -3410,7 +3422,7 @@
     },
     "netbird-client": {
         "documentation": "https://docs.netbird.io/how-to/examples#net-bird-client-in-docker?utm_source=coolify.io",
-        "slogan": "Connect your devices into a secure WireGuard\u00ae-based overlay network with SSO, MFA and granular access controls.",
+        "slogan": "Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.",
         "compose": "c2VydmljZXM6CiAgbmV0YmlyZC1jbGllbnQ6CiAgICBpbWFnZTogJ25ldGJpcmRpby9uZXRiaXJkOmxhdGVzdCcKICAgIG5ldHdvcmtfbW9kZTogaG9zdAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ05CX1NFVFVQX0tFWT0ke05CX1NFVFVQX0tFWX0nCiAgICAgIC0gJ05CX0VOQUJMRV9ST1NFTlBBU1M9JHtOQl9FTkFCTEVfUk9TRU5QQVNTOi1mYWxzZX0nCiAgICAgIC0gJ05CX0VOQUJMRV9FWFBFUklNRU5UQUxfTEFaWV9DT05OPSR7TkJfRU5BQkxFX0VYUEVSSU1FTlRBTF9MQVpZX0NPTk46LWZhbHNlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25ldGJpcmQtY2xpZW50Oi92YXIvbGliL25ldGJpcmQnCiAgICBjYXBfYWRkOgogICAgICAtIE5FVF9BRE1JTgogICAgICAtIFNZU19BRE1JTgogICAgICAtIFNZU19SRVNPVVJDRQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5ldGJpcmQKICAgICAgICAtIHZlcnNpb24KICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
         "tags": [
             "wireguard",
@@ -3847,7 +3859,7 @@
     },
     "openobserve": {
         "documentation": "https://openobserve.ai/docs/?utm_source=coolify.io",
-        "slogan": "Cloud-native observability platform for logs, metrics, traces, RUM, errors and session replays \u2014 a 140x cheaper alternative to Elasticsearch, Splunk and Datadog.",
+        "slogan": "Cloud-native observability platform for logs, metrics, traces, RUM, errors and session replays — a 140x cheaper alternative to Elasticsearch, Splunk and Datadog.",
         "compose": "c2VydmljZXM6CiAgb3Blbm9ic2VydmU6CiAgICBpbWFnZTogJ3B1YmxpYy5lY3IuYXdzL3ppbmNsYWJzL29wZW5vYnNlcnZlOnYwLjkwLjAnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9PUEVOT0JTRVJWRV81MDgwCiAgICAgIC0gWk9fREFUQV9ESVI9L2RhdGEKICAgICAgLSAnWk9fUk9PVF9VU0VSX0VNQUlMPSR7Wk9fUk9PVF9VU0VSX0VNQUlMOi1yb290QGV4YW1wbGUuY29tfScKICAgICAgLSAnWk9fUk9PVF9VU0VSX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9PUEVOT0JTRVJWRX0nCiAgICAgIC0gJ1pPX1RFTEVNRVRSWT0ke1pPX1RFTEVNRVRSWTotZmFsc2V9JwogICAgICAtICdaT19DT09LSUVfU0VDVVJFX09OTFk9JHtaT19DT09LSUVfU0VDVVJFX09OTFk6LXRydWV9JwogICAgdm9sdW1lczoKICAgICAgLSAnb3Blbm9ic2VydmUtZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSAvb3Blbm9ic2VydmUKICAgICAgICAtIG5vZGUKICAgICAgICAtIHN0YXR1cwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgICAgc3RhcnRfcGVyaW9kOiA2MHMK",
         "tags": [
             "logs",
@@ -4130,7 +4142,8 @@
         "category": "database",
         "logo": "svgs/phpmyadmin.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "pi-hole": {
         "documentation": "https://pi-hole.net/?utm_source=coolify.io",
@@ -4329,7 +4342,7 @@
     },
     "prowlarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/prowlarr?utm_source=coolify.io",
-        "slogan": "Prowlarr\u2060 is a indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.",
+        "slogan": "Prowlarr⁠ is a indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.",
         "compose": "c2VydmljZXM6CiAgcHJvd2xhcnI6CiAgICBpbWFnZTogJ2xzY3IuaW8vbGludXhzZXJ2ZXIvcHJvd2xhcnI6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfUFJPV0xBUlJfOTY5NgogICAgICAtIF9BUFBfVVJMPSRTRVJWSUNFX1VSTF9QUk9XTEFSUgogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgICAtICdUWj0ke1RaOi1BbWVyaWNhL1Rvcm9udG99JwogICAgdm9sdW1lczoKICAgICAgLSAncHJvd2xhcnItY29uZmlnOi9jb25maWcnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6OTY5Ni9waW5nJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1Cg==",
         "tags": [
             "media",
@@ -4364,7 +4377,7 @@
     },
     "qbittorrent": {
         "documentation": "https://docs.linuxserver.io/images/docker-qbittorrent/?utm_source=coolify.io",
-        "slogan": "The qBittorrent project aims to provide an open-source software alternative to \u03bcTorrent.",
+        "slogan": "The qBittorrent project aims to provide an open-source software alternative to μTorrent.",
         "compose": "c2VydmljZXM6CiAgcWJpdDoKICAgIGltYWdlOiAnbHNjci5pby9saW51eHNlcnZlci9xYml0dG9ycmVudDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnV0VCVUlfUE9SVD0ke1dFQlVJX1BPUlQ6LTgwODB9JwogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgdm9sdW1lczoKICAgICAgLSAncWJpdHRvcnJlbnQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ3FiaXR0b3JyZW50LWRvd25sb2FkczovZG93bmxvYWRzJwogICAgICAtICdxYml0dG9ycmVudC10b3JyZW50czovdG9ycmVudHMnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy1xJwogICAgICAgIC0gJy0tc3BpZGVyJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODA4MC8nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICB2dWV0b3JyZW50LWJhY2tlbmQ6CiAgICBpbWFnZTogJ2doY3IuaW8vdnVldG9ycmVudC92dWV0b3JyZW50LWJhY2tlbmQ6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfUUJJVE9SUkVOVF84MDgwCiAgICAgIC0gJ1BPUlQ9JHtXRUJVSV9QT1JUOi04MDgwfScKICAgICAgLSAnUUJJVF9CQVNFPSR7U0VSVklDRV9VUkxfUUJJVE9SUkVOVH0nCiAgICAgIC0gJ1JFTEVBU0VfVFlQRT0ke1JFTEVBU0VfVFlQRTotc3RhYmxlfScKICAgICAgLSAnVVBEQVRFX1ZUX0NST049JHtVUERBVEVfVlRfQ1JPTjotIjAgKiAqICogKiJ9JwogICAgdm9sdW1lczoKICAgICAgLSAndnVldG9ycmVudC1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSB3Z2V0CiAgICAgICAgLSAnLXEnCiAgICAgICAgLSAnLS1zcGlkZXInCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MDgwLycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
         "tags": [
             "torrent",
@@ -4418,7 +4431,7 @@
     },
     "radarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/radarr?utm_source=coolify.io",
-        "slogan": "Radarr\u2060 - A fork of Sonarr to work with movies \u00e0 la Couchpotato.",
+        "slogan": "Radarr⁠ - A fork of Sonarr to work with movies à la Couchpotato.",
         "compose": "c2VydmljZXM6CiAgcmFkYXJyOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL3JhZGFycjpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9SQURBUlJfNzg3OAogICAgICAtIF9BUFBfVVJMPSRTRVJWSUNFX1VSTF9SQURBUlIKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotQW1lcmljYS9Ub3JvbnRvfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3JhZGFyci1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo3ODc4L3BpbmcnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
         "tags": [
             "media",
@@ -4821,7 +4834,8 @@
         "category": "productivity",
         "logo": "svgs/default.webp",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "soju": {
         "documentation": "https://soju.im/?utm_source=coolify.io",
@@ -4874,7 +4888,7 @@
     },
     "sonarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/sonarr?utm_source=coolify.io",
-        "slogan": "Sonarr\u2060 (formerly NZBdrone) is a PVR for usenet and bittorrent users. It can monitor multiple RSS feeds for new episodes of your favorite shows and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.",
+        "slogan": "Sonarr⁠ (formerly NZBdrone) is a PVR for usenet and bittorrent users. It can monitor multiple RSS feeds for new episodes of your favorite shows and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.",
         "compose": "c2VydmljZXM6CiAgc29uYXJyOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL3NvbmFycjpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9TT05BUlJfODk4OQogICAgICAtIF9BUFBfVVJMPSRTRVJWSUNFX1VSTF9TT05BUlIKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotQW1lcmljYS9Ub3JvbnRvfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3NvbmFyci1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4OTg5L3BpbmcnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
         "tags": [
             "media",
@@ -5786,7 +5800,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "wordpress-with-mysql": {
         "documentation": "https://wordpress.org?utm_source=coolify.io",
@@ -5802,7 +5817,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "wordpress-without-database": {
         "documentation": "https://wordpress.org?utm_source=coolify.io",
@@ -5817,7 +5833,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "yamtrack-with-postgresql": {
         "documentation": "https://github.com/FuzzyGrim/Yamtrack/wiki?utm_source=coolify.io",
@@ -5900,7 +5917,7 @@
     },
     "marimo": {
         "documentation": "https://marimo.io/?utm_source=coolify.io",
-        "slogan": "An open-source reactive notebook for Python \u2014 reproducible, git-friendly, SQL built-in, executable as a script, and shareable as an app.",
+        "slogan": "An open-source reactive notebook for Python — reproducible, git-friendly, SQL built-in, executable as a script, and shareable as an app.",
         "compose": "c2VydmljZXM6CiAgbWFyaW1vOgogICAgaW1hZ2U6ICdnaGNyLmlvL21hcmltby10ZWFtL21hcmltbzpsYXRlc3Qtc3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfTUFSSU1PXzgwODAKICAgICAgLSBUT0tFTl9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NQVJJTU8KICAgIHZvbHVtZXM6CiAgICAgIC0gJ21hcmltbzovYXBwJwogICAgY29tbWFuZDoKICAgICAgLSBtYXJpbW8KICAgICAgLSBlZGl0CiAgICAgIC0gJy0tdG9rZW4tcGFzc3dvcmQnCiAgICAgIC0gJyR7U0VSVklDRV9QQVNTV09SRF9NQVJJTU99JwogICAgICAtICctLXBvcnQnCiAgICAgIC0gJzgwODAnCiAgICAgIC0gJy0taG9zdCcKICAgICAgLSAwLjAuMC4wCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gdXZ4CiAgICAgICAgLSAnLS13aXRoJwogICAgICAgIC0gJ2h0dHB4W2NsaV0nCiAgICAgICAgLSBodHRweAogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9oZWFsdGgnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAzCg==",
         "tags": [
             "notebook",
diff --git a/templates/service-templates.json b/templates/service-templates.json
index d279a6a33..1574f7768 100644
--- a/templates/service-templates.json
+++ b/templates/service-templates.json
@@ -138,7 +138,8 @@
         "category": "productivity",
         "logo": "svgs/appsmith.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "appwrite": {
         "documentation": "https://appwrite.io/docs?utm_source=coolify.io",
@@ -152,7 +153,8 @@
         "category": "backend",
         "logo": "svgs/appwrite.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-10-23T19:52:21+05:30"
+        "template_last_updated_at": "2025-10-23T19:52:21+05:30",
+        "port": "3003"
     },
     "argilla": {
         "documentation": "https://docs.argilla.io/latest/?utm_source=coolify.io",
@@ -219,7 +221,7 @@
     },
     "autobase": {
         "documentation": "https://autobase.tech/docs/?utm_source=coolify.io",
-        "slogan": "Autobase for PostgreSQL\u00ae is an open-source alternative to cloud-managed databases (self-hosted DBaaS).",
+        "slogan": "Autobase for PostgreSQL® is an open-source alternative to cloud-managed databases (self-hosted DBaaS).",
         "compose": "c2VydmljZXM6CiAgYXV0b2Jhc2U6CiAgICBpbWFnZTogJ2F1dG9iYXNlL2NvbnNvbGVfdWk6Mi41LjInCiAgICBwbGF0Zm9ybTogbGludXgvYW1kNjQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9BVVRPQkFTRV84MAogICAgICAtICdQR19DT05TT0xFX0FVVEhPUklaQVRJT05fVE9LRU49JHtTRVJWSUNFX1BBU1NXT1JEX1VJfScKICAgICAgLSBQR19DT05TT0xFX0FQSV9IT1NUPWF1dG9iYXNlLWFwaQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgwLycKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICBkZXBlbmRzX29uOgogICAgICBhdXRvYmFzZS1hcGk6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBhdXRvYmFzZS1kYjoKICAgIGltYWdlOiAnYXV0b2Jhc2UvY29uc29sZV9kYjoyLjUuMicKICAgIHBsYXRmb3JtOiBsaW51eC9hbWQ2NAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICB2b2x1bWVzOgogICAgICAtICdhdXRvYmFzZS1kYi1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgcG9zdGdyZXMnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogIGF1dG9iYXNlLWFwaToKICAgIGltYWdlOiAnYXV0b2Jhc2UvY29uc29sZV9hcGk6Mi41LjInCiAgICBwbGF0Zm9ybTogbGludXgvYW1kNjQKICAgIGVudmlyb25tZW50OgogICAgICAtIFBHX0NPTlNPTEVfREJfSE9TVD1hdXRvYmFzZS1kYgogICAgICAtICdQR19DT05TT0xFX0RCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BHX0NPTlNPTEVfQVVUSE9SSVpBVElPTl9UT0tFTj0ke1NFUlZJQ0VfUEFTU1dPUkRfVUl9JwogICAgICAtICdQR19DT05TT0xFX0VOQ1JZUFRJT05LRVk9JHtTRVJWSUNFX0JBU0U2NF9FTkNSWVBUSU9OS0VZfScKICAgICAgLSAnUEdfQ09OU09MRV9MT0dHRVJfTEVWRUw9JHtQR19DT05TT0xFX0xPR0dFUl9MRVZFTDotaW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICcvdmFyL3J1bi9kb2NrZXIuc29jazovdmFyL3J1bi9kb2NrZXIuc29jaycKICAgICAgLSAnL3RtcC9hbnNpYmxlOi90bXAvYW5zaWJsZScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWZzUycKICAgICAgICAtICctSCcKICAgICAgICAtICdhY2NlcHQ6IGFwcGxpY2F0aW9uL2pzb24nCiAgICAgICAgLSAnLUgnCiAgICAgICAgLSAnQXV0aG9yaXphdGlvbjogQmVhcmVyICR7U0VSVklDRV9QQVNTV09SRF9VSX0nCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4MDgwL2FwaS92MS92ZXJzaW9uJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICAgIGRlcGVuZHNfb246CiAgICAgIGF1dG9iYXNlLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5Cg==",
         "tags": [
             "database",
@@ -248,7 +250,8 @@
         "category": "productivity",
         "logo": "svgs/babybuddy.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "8000"
     },
     "bento-pdf": {
         "documentation": "https://bentopdf.com/docs?utm_source=coolify.io",
@@ -377,7 +380,8 @@
         "category": "finance",
         "logo": "svgs/budge.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-06T11:35:16-05:00"
+        "template_last_updated_at": "2026-04-06T11:35:16-05:00",
+        "port": "80"
     },
     "budibase": {
         "documentation": "https://docs.budibase.com/docs/docker-compose?utm_source=coolify.io",
@@ -679,7 +683,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "classicpress-with-mysql": {
         "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
@@ -694,7 +699,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "classicpress-without-database": {
         "documentation": "https://www.classicpress.net/?utm_source=coolify.io",
@@ -709,7 +715,8 @@
         "category": "cms",
         "logo": "svgs/classicpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "cloudbeaver": {
         "documentation": "https://dbeaver.com/docs/cloudbeaver/?utm_source=coolify.io",
@@ -1070,7 +1077,8 @@
         "category": "cms",
         "logo": "svgs/dokuwiki.png",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "dolibarr": {
         "documentation": "https://www.dolibarr.org/documentation-home.php?utm_source=coolify.io",
@@ -1149,7 +1157,8 @@
         "category": "cms",
         "logo": "svgs/drupal.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "duplicati": {
         "documentation": "https://duplicati.readthedocs.io?utm_source=coolify.io",
@@ -1794,7 +1803,7 @@
     },
     "getoutline": {
         "documentation": "https://docs.getoutline.com/s/hosting/doc/hosting-outline-nipGaCRBDu?utm_source=coolify.io",
-        "slogan": "Your team\u2019s knowledge base",
+        "slogan": "Your team’s knowledge base",
         "compose": "c2VydmljZXM6CiAgb3V0bGluZToKICAgIGltYWdlOiAnZG9ja2VyLmdldG91dGxpbmUuY29tL291dGxpbmV3aWtpL291dGxpbmU6bGF0ZXN0JwogICAgdm9sdW1lczoKICAgICAgLSAnc3RvcmFnZS1kYXRhOi92YXIvbGliL291dGxpbmUvZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fT1VUTElORV8zMDAwCiAgICAgIC0gTk9ERV9FTlY9cHJvZHVjdGlvbgogICAgICAtICdTRUNSRVRfS0VZPSR7U0VSVklDRV9IRVhfNjRfT1VUTElORX0nCiAgICAgIC0gJ1VUSUxTX1NFQ1JFVD0ke1NFUlZJQ0VfUEFTU1dPUkRfNjRfT1VUTElORX0nCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD1wb3N0Z3JlczovLyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfToke1NFUlZJQ0VfUEFTU1dPUkRfNjRfUE9TVEdSRVN9QHBvc3RncmVzOjU0MzIvJHtQT1NUR1JFU19EQVRBQkFTRTotb3V0bGluZX0nCiAgICAgIC0gJ1JFRElTX1VSTD1yZWRpczovLzoke1NFUlZJQ0VfUEFTU1dPUkRfNjRfUkVESVN9QHJlZGlzOjYzNzknCiAgICAgIC0gJ1VSTD0ke1NFUlZJQ0VfRlFETl9PVVRMSU5FfScKICAgICAgLSAnUE9SVD0ke09VVExJTkVfUE9SVDotMzAwMH0nCiAgICAgIC0gJ0ZJTEVfU1RPUkFHRT0ke0ZJTEVfU1RPUkFHRTotbG9jYWx9JwogICAgICAtICdGSUxFX1NUT1JBR0VfTE9DQUxfUk9PVF9ESVI9JHtGSUxFX1NUT1JBR0VfTE9DQUxfUk9PVF9ESVI6LS92YXIvbGliL291dGxpbmUvZGF0YX0nCiAgICAgIC0gJ0ZJTEVfU1RPUkFHRV9VUExPQURfTUFYX1NJWkU9JHtGSUxFX1NUT1JBR0VfVVBMT0FEX01BWF9TSVpFOi0yMDAwfScKICAgICAgLSAnRklMRV9TVE9SQUdFX0lNUE9SVF9NQVhfU0laRT0ke0ZJTEVfU1RPUkFHRV9JTVBPUlRfTUFYX1NJWkU6LTEwMH0nCiAgICAgIC0gJ0ZJTEVfU1RPUkFHRV9XT1JLU1BBQ0VfSU1QT1JUX01BWF9TSVpFPSR7RklMRV9TVE9SQUdFX1dPUktTUEFDRV9JTVBPUlRfTUFYX1NJWkV9JwogICAgICAtICdBV1NfQUNDRVNTX0tFWV9JRD0ke0FXU19BQ0NFU1NfS0VZX0lEfScKICAgICAgLSAnQVdTX1NFQ1JFVF9BQ0NFU1NfS0VZPSR7QVdTX1NFQ1JFVF9BQ0NFU1NfS0VZfScKICAgICAgLSAnQVdTX1JFR0lPTj0ke0FXU19SRUdJT059JwogICAgICAtICdBV1NfUzNfQUNDRUxFUkFURV9VUkw9JHtBV1NfUzNfQUNDRUxFUkFURV9VUkx9JwogICAgICAtICdBV1NfUzNfVVBMT0FEX0JVQ0tFVF9VUkw9JHtBV1NfUzNfVVBMT0FEX0JVQ0tFVF9VUkx9JwogICAgICAtICdBV1NfUzNfVVBMT0FEX0JVQ0tFVF9OQU1FPSR7QVdTX1MzX1VQTE9BRF9CVUNLRVRfTkFNRX0nCiAgICAgIC0gJ0FXU19TM19GT1JDRV9QQVRIX1NUWUxFPSR7QVdTX1MzX0ZPUkNFX1BBVEhfU1RZTEU6LXRydWV9JwogICAgICAtICdBV1NfUzNfQUNMPSR7QVdTX1MzX0FDTDotcHJpdmF0ZX0nCiAgICAgIC0gJ1NMQUNLX0NMSUVOVF9JRD0ke1NMQUNLX0NMSUVOVF9JRH0nCiAgICAgIC0gJ1NMQUNLX0NMSUVOVF9TRUNSRVQ9JHtTTEFDS19DTElFTlRfU0VDUkVUfScKICAgICAgLSAnR09PR0xFX0NMSUVOVF9JRD0ke0dPT0dMRV9DTElFTlRfSUR9JwogICAgICAtICdHT09HTEVfQ0xJRU5UX1NFQ1JFVD0ke0dPT0dMRV9DTElFTlRfU0VDUkVUfScKICAgICAgLSAnQVpVUkVfQ0xJRU5UX0lEPSR7QVpVUkVfQ0xJRU5UX0lEfScKICAgICAgLSAnQVpVUkVfQ0xJRU5UX1NFQ1JFVD0ke0FaVVJFX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdBWlVSRV9SRVNPVVJDRV9BUFBfSUQ9JHtBWlVSRV9SRVNPVVJDRV9BUFBfSUR9JwogICAgICAtICdPSURDX0NMSUVOVF9JRD0ke09JRENfQ0xJRU5UX0lEfScKICAgICAgLSAnT0lEQ19DTElFTlRfU0VDUkVUPSR7T0lEQ19DTElFTlRfU0VDUkVUfScKICAgICAgLSAnT0lEQ19BVVRIX1VSST0ke09JRENfQVVUSF9VUkl9JwogICAgICAtICdPSURDX1RPS0VOX1VSST0ke09JRENfVE9LRU5fVVJJfScKICAgICAgLSAnT0lEQ19VU0VSSU5GT19VUkk9JHtPSURDX1VTRVJJTkZPX1VSSX0nCiAgICAgIC0gJ09JRENfTE9HT1VUX1VSST0ke09JRENfTE9HT1VUX1VSSX0nCiAgICAgIC0gJ09JRENfVVNFUk5BTUVfQ0xBSU09JHtPSURDX1VTRVJOQU1FX0NMQUlNfScKICAgICAgLSAnT0lEQ19ESVNQTEFZX05BTUU9JHtPSURDX0RJU1BMQVlfTkFNRX0nCiAgICAgIC0gJ09JRENfU0NPUEVTPSR7T0lEQ19TQ09QRVN9JwogICAgICAtICdHSVRIVUJfQ0xJRU5UX0lEPSR7R0lUSFVCX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0dJVEhVQl9DTElFTlRfU0VDUkVUPSR7R0lUSFVCX0NMSUVOVF9TRUNSRVR9JwogICAgICAtICdHSVRIVUJfQVBQX05BTUU9JHtHSVRIVUJfQVBQX05BTUV9JwogICAgICAtICdHSVRIVUJfQVBQX0lEPSR7R0lUSFVCX0FQUF9JRH0nCiAgICAgIC0gJ0dJVEhVQl9BUFBfUFJJVkFURV9LRVk9JHtHSVRIVUJfQVBQX1BSSVZBVEVfS0VZfScKICAgICAgLSAnRElTQ09SRF9DTElFTlRfSUQ9JHtESVNDT1JEX0NMSUVOVF9JRH0nCiAgICAgIC0gJ0RJU0NPUkRfQ0xJRU5UX1NFQ1JFVD0ke0RJU0NPUkRfQ0xJRU5UX1NFQ1JFVH0nCiAgICAgIC0gJ0RJU0NPUkRfU0VSVkVSX0lEPSR7RElTQ09SRF9TRVJWRVJfSUR9JwogICAgICAtICdESVNDT1JEX1NFUlZFUl9ST0xFUz0ke0RJU0NPUkRfU0VSVkVSX1JPTEVTfScKICAgICAgLSAnUEdTU0xNT0RFPSR7UEdTU0xNT0RFOi1kaXNhYmxlfScKICAgICAgLSAnRk9SQ0VfSFRUUFM9JHtGT1JDRV9IVFRQUzotdHJ1ZX0nCiAgICAgIC0gJ1NNVFBfSE9TVD0ke1NNVFBfSE9TVH0nCiAgICAgIC0gJ1NNVFBfUE9SVD0ke1NNVFBfUE9SVH0nCiAgICAgIC0gJ1NNVFBfVVNFUk5BTUU9JHtTTVRQX1VTRVJOQU1FfScKICAgICAgLSAnU01UUF9QQVNTV09SRD0ke1NNVFBfUEFTU1dPUkR9JwogICAgICAtICdTTVRQX0ZST01fRU1BSUw9JHtTTVRQX0ZST01fRU1BSUx9JwogICAgICAtICdTTVRQX1JFUExZX0VNQUlMPSR7U01UUF9SRVBMWV9FTUFJTH0nCiAgICAgIC0gJ1NNVFBfVExTX0NJUEhFUlM9JHtTTVRQX1RMU19DSVBIRVJTfScKICAgICAgLSAnU01UUF9TRUNVUkU9JHtTTVRQX1NFQ1VSRX0nCiAgICAgIC0gJ1NNVFBfTkFNRT0ke1NNVFBfTkFNRX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgZGlzYWJsZTogdHJ1ZQogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczphbHBpbmUnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUkVESVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X1JFRElTfScKICAgIGNvbW1hbmQ6CiAgICAgIC0gcmVkaXMtc2VydmVyCiAgICAgIC0gJy0tcmVxdWlyZXBhc3MnCiAgICAgIC0gJyR7U0VSVklDRV9QQVNTV09SRF82NF9SRURJU30nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSAnLWEnCiAgICAgICAgLSAnJHtTRVJWSUNFX1BBU1NXT1JEXzY0X1JFRElTfScKICAgICAgICAtIFBJTkcKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiAzMHMKICAgICAgcmV0cmllczogMwogIHBvc3RncmVzOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxMi1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICdkYXRhYmFzZS1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEXzY0X1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQVRBQkFTRTotb3V0bGluZX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcGdfaXNyZWFkeQogICAgICAgIC0gJy1VJwogICAgICAgIC0gJyR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgICAtICctZCcKICAgICAgICAtICcke1BPU1RHUkVTX0RBVEFCQVNFOi1vdXRsaW5lfScKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMwo=",
         "tags": [
             "knowledge base",
@@ -2171,7 +2180,8 @@
         "category": "productivity",
         "logo": "svgs/grocy.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-05-12T09:10:44+02:00"
+        "template_last_updated_at": "2026-05-12T09:10:44+02:00",
+        "port": "80"
     },
     "hatchet": {
         "documentation": "https://docs.hatchet.run/self-hosting/docker-compose?utm_source=coolify.io",
@@ -2221,11 +2231,12 @@
         "category": "productivity",
         "logo": "svgs/heimdall.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "hermes-agent-with-webui": {
         "documentation": "https://github.com/nesquena/hermes-webui?utm_source=coolify.io",
-        "slogan": "Hermes Agent \u2014 autonomous AI agent with persistent memory, scheduling, and a self-hosted web chat UI.",
+        "slogan": "Hermes Agent — autonomous AI agent with persistent memory, scheduling, and a self-hosted web chat UI.",
         "compose": "c2VydmljZXM6CiAgaGVybWVzLWFnZW50OgogICAgaW1hZ2U6ICdub3VzcmVzZWFyY2gvaGVybWVzLWFnZW50QHNoYTI1NjoyZjFmMmYxNzI1ZTVkYzlhNjFjZjZhMmRlYTVhY2E1MmE3NzZlYzRkMDIyY2IyOTY3OWU2YWEzZmYzMDNlNzdhJwogICAgY29tbWFuZDogJ2dhdGV3YXkgcnVuJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gSEVSTUVTX0hPTUU9L2hvbWUvaGVybWVzLy5oZXJtZXMKICAgICAgLSBIRVJNRVNfVUlEPTEwMDAKICAgICAgLSBIRVJNRVNfR0lEPTEwMDAKICAgICAgLSAnT1BFTlJPVVRFUl9BUElfS0VZPSR7T1BFTlJPVVRFUl9BUElfS0VZfScKICAgICAgLSAnQU5USFJPUElDX0FQSV9LRVk9JHtBTlRIUk9QSUNfQVBJX0tFWX0nCiAgICAgIC0gJ09QRU5BSV9BUElfS0VZPSR7T1BFTkFJX0FQSV9LRVl9JwogICAgICAtICdHT09HTEVfQVBJX0tFWT0ke0dPT0dMRV9BUElfS0VZfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2hlcm1lcy1ob21lOi9ob21lL2hlcm1lcy8uaGVybWVzJwogICAgICAtICdoZXJtZXMtYWdlbnQtc3JjOi9vcHQvaGVybWVzJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICd0ZXN0IC1kIC9ob21lL2hlcm1lcy8uaGVybWVzIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgaGVybWVzLXdlYnVpOgogICAgaW1hZ2U6ICdnaGNyLmlvL25lc3F1ZW5hL2hlcm1lcy13ZWJ1aTowLjUxLjkyJwogICAgZGVwZW5kc19vbjoKICAgICAgLSBoZXJtZXMtYWdlbnQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9IRVJNRVNXRUJVSV84Nzg3CiAgICAgIC0gSEVSTUVTX1dFQlVJX0hPU1Q9MC4wLjAuMAogICAgICAtIEhFUk1FU19XRUJVSV9QT1JUPTg3ODcKICAgICAgLSBIRVJNRVNfV0VCVUlfU1RBVEVfRElSPS9ob21lL2hlcm1lc3dlYnVpLy5oZXJtZXMvd2VidWkKICAgICAgLSBXQU5URURfVUlEPTEwMDAKICAgICAgLSBXQU5URURfR0lEPTEwMDAKICAgICAgLSAnSEVSTUVTX1dFQlVJX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9IRVJNRVNXRUJVSX0nCiAgICB2b2x1bWVzOgogICAgICAtICdoZXJtZXMtaG9tZTovaG9tZS9oZXJtZXN3ZWJ1aS8uaGVybWVzJwogICAgICAtICdoZXJtZXMtYWdlbnQtc3JjOi9ob21lL2hlcm1lc3dlYnVpLy5oZXJtZXMvaGVybWVzLWFnZW50OnJvJwogICAgICAtICdoZXJtZXMtd29ya3NwYWNlOi93b3Jrc3BhY2UnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODc4Ny9oZWFsdGgnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwo=",
         "tags": [
             "ai",
@@ -2524,7 +2535,7 @@
     },
     "jitsi": {
         "documentation": "https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker/?utm_source=coolify.io",
-        "slogan": "Self-hosted Jitsi Meet \u2014 open-source video conferencing platform",
+        "slogan": "Self-hosted Jitsi Meet — open-source video conferencing platform",
         "compose": "c2VydmljZXM6CiAgaml0c2ktd2ViOgogICAgaW1hZ2U6ICdqaXRzaS93ZWI6c3RhYmxlLTEwODg4JwogICAgcmVzdGFydDogdW5sZXNzLXN0b3BwZWQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9KSVRTSQogICAgICAtIFBVQkxJQ19VUkw9JFNFUlZJQ0VfRlFETl9KSVRTSQogICAgICAtIEVOQUJMRV9BVVRIPTAKICAgICAgLSBFTkFCTEVfR1VFU1RTPTEKICAgICAgLSBFTkFCTEVfTEVUU0VOQ1JZUFQ9MAogICAgICAtIEVOQUJMRV9IVFRQX1JFRElSRUNUPTAKICAgICAgLSBESVNBQkxFX0hUVFBTPTEKICAgICAgLSBYTVBQX0RPTUFJTj1tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9BVVRIX0RPTUFJTj1hdXRoLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX0dVRVNUX0RPTUFJTj1ndWVzdC5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9NVUNfRE9NQUlOPWNvbmZlcmVuY2UubWVldC5qaXRzaQogICAgICAtIFhNUFBfSU5URVJOQUxfTVVDX0RPTUFJTj1pbnRlcm5hbC5hdXRoLm1lZXQuaml0c2kKICAgICAgLSAnWE1QUF9CT1NIX1VSTF9CQVNFPWh0dHA6Ly9wcm9zb2R5OjUyODAnCiAgICAgIC0gSlZCX0JSRVdFUllfTVVDPWp2YmJyZXdlcnkKICAgICAgLSAnSklDT0ZPX0NPTVBPTkVOVF9TRUNSRVQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pJQ09GT30nCiAgICAgIC0gJ0pJQ09GT19BVVRIX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9KSUNPRk99JwogICAgICAtICdKVkJfQVVUSF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSlZCfScKICAgICAgLSAnVFo9JHtUWjotVVRDfScKICAgIGRlcGVuZHNfb246CiAgICAgIC0gcHJvc29keQogICAgICAtIGppY29mbwogICAgICAtIGp2YgogICAgdm9sdW1lczoKICAgICAgLSAnaml0c2ktd2ViOi9jb25maWcnCiAgICBuZXR3b3JrczoKICAgICAgbWVldC5qaXRzaToKICAgICAgICBhbGlhc2VzOgogICAgICAgICAgLSBtZWV0LmppdHNpCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3QnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBwcm9zb2R5OgogICAgaW1hZ2U6ICdqaXRzaS9wcm9zb2R5OnN0YWJsZS0xMDg4OCcKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBBVVRIX1RZUEU9aW50ZXJuYWwKICAgICAgLSBFTkFCTEVfQVVUSD0wCiAgICAgIC0gRU5BQkxFX0dVRVNUUz0xCiAgICAgIC0gWE1QUF9ET01BSU49bWVldC5qaXRzaQogICAgICAtIFhNUFBfQVVUSF9ET01BSU49YXV0aC5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9HVUVTVF9ET01BSU49Z3Vlc3QubWVldC5qaXRzaQogICAgICAtIFhNUFBfTVVDX0RPTUFJTj1jb25mZXJlbmNlLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX0lOVEVSTkFMX01VQ19ET01BSU49aW50ZXJuYWwuYXV0aC5tZWV0LmppdHNpCiAgICAgIC0gJ0pJQ09GT19DT01QT05FTlRfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KSUNPRk99JwogICAgICAtICdKSUNPRk9fQVVUSF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSklDT0ZPfScKICAgICAgLSAnSlZCX0FVVEhfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pWQn0nCiAgICAgIC0gUFVCTElDX1VSTD0kU0VSVklDRV9GUUROX0pJVFNJCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICAgIC0gJ0xPR19MRVZFTD0ke0xPR19MRVZFTDotaW5mb30nCiAgICB2b2x1bWVzOgogICAgICAtICdqaXRzaS1wcm9zb2R5Oi9jb25maWcnCiAgICBuZXR3b3JrczoKICAgICAgbWVldC5qaXRzaToKICAgICAgICBhbGlhc2VzOgogICAgICAgICAgLSB4bXBwLm1lZXQuaml0c2kKICAgICAgICAgIC0gYXV0aC5tZWV0LmppdHNpCiAgICAgICAgICAtIGd1ZXN0Lm1lZXQuaml0c2kKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo1MjgwL2h0dHAtYmluZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGppY29mbzoKICAgIGltYWdlOiAnaml0c2kvamljb2ZvOnN0YWJsZS0xMDg4OCcKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBBVVRIX1RZUEU9aW50ZXJuYWwKICAgICAgLSBFTkFCTEVfQVVUSD0wCiAgICAgIC0gWE1QUF9ET01BSU49bWVldC5qaXRzaQogICAgICAtIFhNUFBfQVVUSF9ET01BSU49YXV0aC5tZWV0LmppdHNpCiAgICAgIC0gWE1QUF9JTlRFUk5BTF9NVUNfRE9NQUlOPWludGVybmFsLmF1dGgubWVldC5qaXRzaQogICAgICAtIFhNUFBfTVVDX0RPTUFJTj1jb25mZXJlbmNlLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX1NFUlZFUj1wcm9zb2R5CiAgICAgIC0gJ0pJQ09GT19DT01QT05FTlRfU0VDUkVUPSR7U0VSVklDRV9QQVNTV09SRF9KSUNPRk99JwogICAgICAtICdKSUNPRk9fQVVUSF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfSklDT0ZPfScKICAgICAgLSBKVkJfQlJFV0VSWV9NVUM9anZiYnJld2VyeQogICAgICAtIEpJQ09GT19FTkFCTEVfSEVBTFRIX0NIRUNLUz0xCiAgICAgIC0gJ1RaPSR7VFo6LVVUQ30nCiAgICBkZXBlbmRzX29uOgogICAgICAtIHByb3NvZHkKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2ppdHNpLWppY29mbzovY29uZmlnJwogICAgbmV0d29ya3M6CiAgICAgIG1lZXQuaml0c2k6IG51bGwKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo4ODg4L2Fib3V0L2hlYWx0aCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIGp2YjoKICAgIGltYWdlOiAnaml0c2kvanZiOnN0YWJsZS0xMDg4OCcKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgICBwb3J0czoKICAgICAgLSAnMTAwMDA6MTAwMDAvdWRwJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gWE1QUF9TRVJWRVI9cHJvc29keQogICAgICAtIFhNUFBfRE9NQUlOPW1lZXQuaml0c2kKICAgICAgLSBYTVBQX0FVVEhfRE9NQUlOPWF1dGgubWVldC5qaXRzaQogICAgICAtIFhNUFBfSU5URVJOQUxfTVVDX0RPTUFJTj1pbnRlcm5hbC5hdXRoLm1lZXQuaml0c2kKICAgICAgLSBYTVBQX01VQ19ET01BSU49Y29uZmVyZW5jZS5tZWV0LmppdHNpCiAgICAgIC0gSlZCX0FVVEhfVVNFUj1qdmIKICAgICAgLSAnSlZCX0FVVEhfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0pWQn0nCiAgICAgIC0gSlZCX0JSRVdFUllfTVVDPWp2YmJyZXdlcnkKICAgICAgLSBKVkJfUE9SVD0xMDAwMAogICAgICAtICdKVkJfQURWRVJUSVNFX0lQUz0ke0pWQl9BRFZFUlRJU0VfSVBTOi19JwogICAgICAtICdKVkJfU1RVTl9TRVJWRVJTPSR7SlZCX1NUVU5fU0VSVkVSUzotc3R1bi5sLmdvb2dsZS5jb206MTkzMDJ9JwogICAgICAtIFBVQkxJQ19VUkw9JFNFUlZJQ0VfRlFETl9KSVRTSQogICAgICAtICdUWj0ke1RaOi1VVEN9JwogICAgZGVwZW5kc19vbjoKICAgICAgLSBwcm9zb2R5CiAgICB2b2x1bWVzOgogICAgICAtICdqaXRzaS1qdmI6L2NvbmZpZycKICAgIG5ldHdvcmtzOgogICAgICBtZWV0LmppdHNpOiBudWxsCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly9sb2NhbGhvc3Q6ODA4MC9hYm91dC9oZWFsdGgnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKbmV0d29ya3M6CiAgbWVldC5qaXRzaTogbnVsbAo=",
         "tags": [
             "jitsi",
@@ -2975,7 +2986,8 @@
         "category": "auth",
         "logo": "svgs/logto_dark.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-04-01T13:19:47Z"
+        "template_last_updated_at": "2026-04-01T13:19:47Z",
+        "port": "3001"
     },
     "lowcoder": {
         "documentation": "https://docs.lowcoder.cloud/?utm_source=coolify.io",
@@ -3283,7 +3295,7 @@
     },
     "moodle": {
         "documentation": "https://moodle.org?utm_source=coolify.io",
-        "slogan": "Moodle is the world\u2019s most customisable and trusted eLearning solution that empowers educators to improve our world.",
+        "slogan": "Moodle is the world’s most customisable and trusted eLearning solution that empowers educators to improve our world.",
         "compose": "c2VydmljZXM6CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMS4xJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gQUxMT1dfRU1QVFlfUEFTU1dPUkQ9bm8KICAgICAgLSBNWVNRTF9ST09UX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX1JPT1QKICAgICAgLSBNWVNRTF9EQVRBQkFTRT1iaXRuYW1pX21vb2RsZQogICAgICAtIE1ZU1FMX1VTRVI9JFNFUlZJQ0VfVVNFUl9NQVJJQURCCiAgICAgIC0gTVlTUUxfUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQgogICAgICAtIE1BUklBREJfQ0hBUkFDVEVSX1NFVD11dGY4bWI0CiAgICAgIC0gTUFSSUFEQl9DT0xMQVRFPXV0ZjhtYjRfdW5pY29kZV9jaQogICAgdm9sdW1lczoKICAgICAgLSAnbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICJiYXNoIC1jICc8L2Rldi90Y3AvbG9jYWxob3N0LzMzMDYnIgogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDUKICBtb29kbGU6CiAgICBpbWFnZTogJ2RvY2tlci5pby9iaXRuYW1pbGVnYWN5L21vb2RsZTo0LjMnCiAgICBkZXBlbmRzX29uOgogICAgICAtIG1hcmlhZGIKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9NT09ETEVfODA4MAogICAgICAtIE1PT0RMRV9EQVRBQkFTRV9IT1NUPW1hcmlhZGIKICAgICAgLSBNT09ETEVfREFUQUJBU0VfUE9SVF9OVU1CRVI9MzMwNgogICAgICAtIE1PT0RMRV9EQVRBQkFTRV9VU0VSPSRTRVJWSUNFX1VTRVJfTUFSSUFEQgogICAgICAtIE1PT0RMRV9EQVRBQkFTRV9OQU1FPWJpdG5hbWlfbW9vZGxlCiAgICAgIC0gTU9PRExFX0RBVEFCQVNFX1BBU1NXT1JEPSRTRVJWSUNFX1BBU1NXT1JEX01BUklBREIKICAgICAgLSBBTExPV19FTVBUWV9QQVNTV09SRD1ubwogICAgICAtICdNT09ETEVfVVNFUk5BTUU9JHtNT09ETEVfVVNFUk5BTUU6LXVzZXJ9JwogICAgICAtIE1PT0RMRV9QQVNTV09SRD0kU0VSVklDRV9QQVNTV09SRF9NT09ETEUKICAgICAgLSBNT09ETEVfRU1BSUw9dXNlckBleGFtcGxlLmNvbQogICAgICAtICdNT09ETEVfU0lURV9OQU1FPSR7TU9PRExFX1NJVEVfTkFNRTotTmV3IFNpdGV9JwogICAgdm9sdW1lczoKICAgICAgLSAnbW9vZGxlLWRhdGE6L2JpdG5hbWkvbW9vZGxlJwogICAgICAtICdtb29kbGVkYXRhLWRhdGE6L2JpdG5hbWkvbW9vZGxlZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBwaHAKICAgICAgICAtICctcicKICAgICAgICAtICJleGl0KGZpbGVfZXhpc3RzKCcvb3B0L2JpdG5hbWkvbW9vZGxlL2NvbmZpZy5waHAnKSA/IDAgOiAxKTsiCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDUK",
         "tags": [
             "moodle",
@@ -3410,7 +3422,7 @@
     },
     "netbird-client": {
         "documentation": "https://docs.netbird.io/how-to/examples#net-bird-client-in-docker?utm_source=coolify.io",
-        "slogan": "Connect your devices into a secure WireGuard\u00ae-based overlay network with SSO, MFA and granular access controls.",
+        "slogan": "Connect your devices into a secure WireGuard®-based overlay network with SSO, MFA and granular access controls.",
         "compose": "c2VydmljZXM6CiAgbmV0YmlyZC1jbGllbnQ6CiAgICBpbWFnZTogJ25ldGJpcmRpby9uZXRiaXJkOmxhdGVzdCcKICAgIG5ldHdvcmtfbW9kZTogaG9zdAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ05CX1NFVFVQX0tFWT0ke05CX1NFVFVQX0tFWX0nCiAgICAgIC0gJ05CX0VOQUJMRV9ST1NFTlBBU1M9JHtOQl9FTkFCTEVfUk9TRU5QQVNTOi1mYWxzZX0nCiAgICAgIC0gJ05CX0VOQUJMRV9FWFBFUklNRU5UQUxfTEFaWV9DT05OPSR7TkJfRU5BQkxFX0VYUEVSSU1FTlRBTF9MQVpZX0NPTk46LWZhbHNlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25ldGJpcmQtY2xpZW50Oi92YXIvbGliL25ldGJpcmQnCiAgICBjYXBfYWRkOgogICAgICAtIE5FVF9BRE1JTgogICAgICAtIFNZU19BRE1JTgogICAgICAtIFNZU19SRVNPVVJDRQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5ldGJpcmQKICAgICAgICAtIHZlcnNpb24KICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
         "tags": [
             "wireguard",
@@ -3847,7 +3859,7 @@
     },
     "openobserve": {
         "documentation": "https://openobserve.ai/docs/?utm_source=coolify.io",
-        "slogan": "Cloud-native observability platform for logs, metrics, traces, RUM, errors and session replays \u2014 a 140x cheaper alternative to Elasticsearch, Splunk and Datadog.",
+        "slogan": "Cloud-native observability platform for logs, metrics, traces, RUM, errors and session replays — a 140x cheaper alternative to Elasticsearch, Splunk and Datadog.",
         "compose": "c2VydmljZXM6CiAgb3Blbm9ic2VydmU6CiAgICBpbWFnZTogJ3B1YmxpYy5lY3IuYXdzL3ppbmNsYWJzL29wZW5vYnNlcnZlOnYwLjkwLjAnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fT1BFTk9CU0VSVkVfNTA4MAogICAgICAtIFpPX0RBVEFfRElSPS9kYXRhCiAgICAgIC0gJ1pPX1JPT1RfVVNFUl9FTUFJTD0ke1pPX1JPT1RfVVNFUl9FTUFJTDotcm9vdEBleGFtcGxlLmNvbX0nCiAgICAgIC0gJ1pPX1JPT1RfVVNFUl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfT1BFTk9CU0VSVkV9JwogICAgICAtICdaT19URUxFTUVUUlk9JHtaT19URUxFTUVUUlk6LWZhbHNlfScKICAgICAgLSAnWk9fQ09PS0lFX1NFQ1VSRV9PTkxZPSR7Wk9fQ09PS0lFX1NFQ1VSRV9PTkxZOi10cnVlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ29wZW5vYnNlcnZlLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gL29wZW5vYnNlcnZlCiAgICAgICAgLSBub2RlCiAgICAgICAgLSBzdGF0dXMKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICAgIHN0YXJ0X3BlcmlvZDogNjBzCg==",
         "tags": [
             "logs",
@@ -4130,7 +4142,8 @@
         "category": "database",
         "logo": "svgs/phpmyadmin.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "pi-hole": {
         "documentation": "https://pi-hole.net/?utm_source=coolify.io",
@@ -4329,7 +4342,7 @@
     },
     "prowlarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/prowlarr?utm_source=coolify.io",
-        "slogan": "Prowlarr\u2060 is a indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.",
+        "slogan": "Prowlarr⁠ is a indexer manager/proxy built on the popular arr .net/reactjs base stack to integrate with your various PVR apps.",
         "compose": "c2VydmljZXM6CiAgcHJvd2xhcnI6CiAgICBpbWFnZTogJ2xzY3IuaW8vbGludXhzZXJ2ZXIvcHJvd2xhcnI6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1BST1dMQVJSXzk2OTYKICAgICAgLSBfQVBQX1VSTD0kU0VSVklDRV9GUUROX1BST1dMQVJSCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUFtZXJpY2EvVG9yb250b30nCiAgICB2b2x1bWVzOgogICAgICAtICdwcm93bGFyci1jb25maWc6L2NvbmZpZycKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovL2xvY2FsaG9zdDo5Njk2L3BpbmcnCiAgICAgIGludGVydmFsOiAycwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
         "tags": [
             "media",
@@ -4364,7 +4377,7 @@
     },
     "qbittorrent": {
         "documentation": "https://docs.linuxserver.io/images/docker-qbittorrent/?utm_source=coolify.io",
-        "slogan": "The qBittorrent project aims to provide an open-source software alternative to \u03bcTorrent.",
+        "slogan": "The qBittorrent project aims to provide an open-source software alternative to μTorrent.",
         "compose": "c2VydmljZXM6CiAgcWJpdDoKICAgIGltYWdlOiAnbHNjci5pby9saW51eHNlcnZlci9xYml0dG9ycmVudDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnV0VCVUlfUE9SVD0ke1dFQlVJX1BPUlQ6LTgwODB9JwogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgdm9sdW1lczoKICAgICAgLSAncWJpdHRvcnJlbnQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ3FiaXR0b3JyZW50LWRvd25sb2FkczovZG93bmxvYWRzJwogICAgICAtICdxYml0dG9ycmVudC10b3JyZW50czovdG9ycmVudHMnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gd2dldAogICAgICAgIC0gJy1xJwogICAgICAgIC0gJy0tc3BpZGVyJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODA4MC8nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICB2dWV0b3JyZW50LWJhY2tlbmQ6CiAgICBpbWFnZTogJ2doY3IuaW8vdnVldG9ycmVudC92dWV0b3JyZW50LWJhY2tlbmQ6bGF0ZXN0JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX1FCSVRPUlJFTlRfODA4MAogICAgICAtICdQT1JUPSR7V0VCVUlfUE9SVDotODA4MH0nCiAgICAgIC0gJ1FCSVRfQkFTRT0ke1NFUlZJQ0VfRlFETl9RQklUT1JSRU5UfScKICAgICAgLSAnUkVMRUFTRV9UWVBFPSR7UkVMRUFTRV9UWVBFOi1zdGFibGV9JwogICAgICAtICdVUERBVEVfVlRfQ1JPTj0ke1VQREFURV9WVF9DUk9OOi0iMCAqICogKiAqIn0nCiAgICB2b2x1bWVzOgogICAgICAtICd2dWV0b3JyZW50LWNvbmZpZzovY29uZmlnJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHdnZXQKICAgICAgICAtICctcScKICAgICAgICAtICctLXNwaWRlcicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwODAvJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
         "tags": [
             "torrent",
@@ -4418,7 +4431,7 @@
     },
     "radarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/radarr?utm_source=coolify.io",
-        "slogan": "Radarr\u2060 - A fork of Sonarr to work with movies \u00e0 la Couchpotato.",
+        "slogan": "Radarr⁠ - A fork of Sonarr to work with movies à la Couchpotato.",
         "compose": "c2VydmljZXM6CiAgcmFkYXJyOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL3JhZGFycjpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fUkFEQVJSXzc4NzgKICAgICAgLSBfQVBQX1VSTD0kU0VSVklDRV9GUUROX1JBREFSUgogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgICAtICdUWj0ke1RaOi1BbWVyaWNhL1Rvcm9udG99JwogICAgdm9sdW1lczoKICAgICAgLSAncmFkYXJyLWNvbmZpZzovY29uZmlnJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0Ojc4NzgvcGluZycKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
         "tags": [
             "media",
@@ -4821,7 +4834,8 @@
         "category": "productivity",
         "logo": "svgs/default.webp",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "soju": {
         "documentation": "https://soju.im/?utm_source=coolify.io",
@@ -4874,7 +4888,7 @@
     },
     "sonarr": {
         "documentation": "https://hub.docker.com/r/linuxserver/sonarr?utm_source=coolify.io",
-        "slogan": "Sonarr\u2060 (formerly NZBdrone) is a PVR for usenet and bittorrent users. It can monitor multiple RSS feeds for new episodes of your favorite shows and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.",
+        "slogan": "Sonarr⁠ (formerly NZBdrone) is a PVR for usenet and bittorrent users. It can monitor multiple RSS feeds for new episodes of your favorite shows and will grab, sort and rename them. It can also be configured to automatically upgrade the quality of files already downloaded when a better quality format becomes available.",
         "compose": "c2VydmljZXM6CiAgc29uYXJyOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL3NvbmFycjpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fU09OQVJSXzg5ODkKICAgICAgLSBfQVBQX1VSTD0kU0VSVklDRV9GUUROX1NPTkFSUgogICAgICAtIFBVSUQ9MTAwMAogICAgICAtIFBHSUQ9MTAwMAogICAgICAtICdUWj0ke1RaOi1BbWVyaWNhL1Rvcm9udG99JwogICAgdm9sdW1lczoKICAgICAgLSAnc29uYXJyLWNvbmZpZzovY29uZmlnJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0Ojg5ODkvcGluZycKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
         "tags": [
             "media",
@@ -5786,7 +5800,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "wordpress-with-mysql": {
         "documentation": "https://wordpress.org?utm_source=coolify.io",
@@ -5802,7 +5817,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "wordpress-without-database": {
         "documentation": "https://wordpress.org?utm_source=coolify.io",
@@ -5817,7 +5833,8 @@
         "category": "cms",
         "logo": "svgs/wordpress.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2025-08-17T18:23:57+02:00"
+        "template_last_updated_at": "2025-08-17T18:23:57+02:00",
+        "port": "80"
     },
     "yamtrack-with-postgresql": {
         "documentation": "https://github.com/FuzzyGrim/Yamtrack/wiki?utm_source=coolify.io",
@@ -5900,7 +5917,7 @@
     },
     "marimo": {
         "documentation": "https://marimo.io/?utm_source=coolify.io",
-        "slogan": "An open-source reactive notebook for Python \u2014 reproducible, git-friendly, SQL built-in, executable as a script, and shareable as an app.",
+        "slogan": "An open-source reactive notebook for Python — reproducible, git-friendly, SQL built-in, executable as a script, and shareable as an app.",
         "compose": "c2VydmljZXM6CiAgbWFyaW1vOgogICAgaW1hZ2U6ICdnaGNyLmlvL21hcmltby10ZWFtL21hcmltbzpsYXRlc3Qtc3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX01BUklNT184MDgwCiAgICAgIC0gVE9LRU5fUEFTU1dPUkQ9JFNFUlZJQ0VfUEFTU1dPUkRfTUFSSU1PCiAgICB2b2x1bWVzOgogICAgICAtICdtYXJpbW86L2FwcCcKICAgIGNvbW1hbmQ6CiAgICAgIC0gbWFyaW1vCiAgICAgIC0gZWRpdAogICAgICAtICctLXRva2VuLXBhc3N3b3JkJwogICAgICAtICcke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSU1PfScKICAgICAgLSAnLS1wb3J0JwogICAgICAtICc4MDgwJwogICAgICAtICctLWhvc3QnCiAgICAgIC0gMC4wLjAuMAogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHV2eAogICAgICAgIC0gJy0td2l0aCcKICAgICAgICAtICdodHRweFtjbGldJwogICAgICAgIC0gaHR0cHgKICAgICAgICAtICdodHRwOi8vbG9jYWxob3N0OjgwODAvaGVhbHRoJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMwo=",
         "tags": [
             "notebook",
diff --git a/tests/Feature/Api/ApplicationSettingsApiTest.php b/tests/Feature/Api/ApplicationSettingsApiTest.php
index c1d08bf38..55d25927a 100644
--- a/tests/Feature/Api/ApplicationSettingsApiTest.php
+++ b/tests/Feature/Api/ApplicationSettingsApiTest.php
@@ -138,6 +138,33 @@ function recommendedApplicationSettingsPayload(): array
     expect(base64_decode($this->application->fresh()->custom_labels))->not->toContain('sentinel-label=true');
 });
 
+test('changing a domain port regenerates managed labels with the requested port', function () {
+    $this->application->settings->update(['is_container_label_readonly_enabled' => true]);
+    $this->application->update([
+        'fqdn' => 'https://app.example.com',
+        'ports_exposes' => '80',
+        'domain_port_overrides' => [
+            'https://app.example.com' => 3000,
+        ],
+    ]);
+
+    $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'domains' => 'https://app.example.com:8080',
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+    $labels = $application->parseContainerLabels();
+
+    expect($application->fqdn)->toBe('https://app.example.com')
+        ->and($application->domain_port_overrides)->toBe([
+            'https://app.example.com' => 8080,
+        ])
+        ->and($labels)->toContain('loadbalancer.server.port=8080')
+        ->and($labels)->not->toContain('loadbalancer.server.port=3000');
+});
+
 test('http basic auth updates regenerate managed labels', function () {
     $this->application->settings->update(['is_container_label_readonly_enabled' => true]);
     $this->application->update([
@@ -279,6 +306,34 @@ function advancedApplicationSettingsPayload(): array
         ->and($application->max_restart_count)->toBe(5);
 });
 
+test('PATCH /api/v1/applications/{uuid} clears ports_exposes with null or an empty string', function (mixed $portsExposes) {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'ports_exposes' => $portsExposes,
+        ])
+        ->assertOk();
+
+    expect($this->application->fresh()->ports_exposes)->toBeNull();
+})->with([
+    'null' => null,
+    'empty string' => '',
+]);
+
+test('PATCH /api/v1/applications/{uuid} rejects invalid exposed ports', function (string $portsExposes) {
+    $this->withHeaders(applicationSettingsApiHeaders($this->bearerToken))
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'ports_exposes' => $portsExposes,
+        ])
+        ->assertUnprocessable()
+        ->assertJsonValidationErrors('ports_exposes');
+})->with([
+    'not numeric' => '80,abc',
+    'zero' => '0',
+    'above TCP range' => '65536',
+]);
+
 test('GET /api/v1/applications/{uuid} includes advanced settings', function () {
     $this->application->settings->update(advancedApplicationSettingsPayload());
     $this->application->update([
diff --git a/tests/Feature/ApplicationConfigurationChangedTest.php b/tests/Feature/ApplicationConfigurationChangedTest.php
index d9d365b96..4650e2b12 100644
--- a/tests/Feature/ApplicationConfigurationChangedTest.php
+++ b/tests/Feature/ApplicationConfigurationChangedTest.php
@@ -77,6 +77,47 @@ function configurationChangedDeployment(Application $application): ApplicationDe
         ->and($change['impact'])->toBe('redeploy');
 });
 
+it('reports domain port-only changes as requiring a redeploy', function () {
+    $application = configurationChangedTestApplication([
+        'fqdn' => 'https://app.example.com',
+        'domain_port_overrides' => ['https://app.example.com' => 3000],
+    ]);
+    $deployment = configurationChangedDeployment($application);
+    $application->markDeploymentConfigurationApplied($deployment);
+
+    $application->update([
+        'domain_port_overrides' => ['https://app.example.com' => 8080],
+    ]);
+
+    $diff = $application->refresh()->pendingDeploymentConfigurationDiff();
+    $change = collect($diff->changes())->firstWhere('key', 'domains.domain_port_overrides');
+
+    expect($diff->isChanged())->toBeTrue()
+        ->and($change)->not->toBeNull()
+        ->and($change['impact'])->toBe('redeploy');
+});
+
+it('keeps application deployment snapshots stable when port overrides are reordered', function () {
+    $application = configurationChangedTestApplication([
+        'fqdn' => 'https://one.example.com,https://two.example.com',
+        'domain_port_overrides' => [
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ],
+    ]);
+    $deployment = configurationChangedDeployment($application);
+    $application->markDeploymentConfigurationApplied($deployment);
+
+    $application->update([
+        'domain_port_overrides' => [
+            'https://two.example.com' => 8080,
+            'https://one.example.com' => 3000,
+        ],
+    ]);
+
+    expect($application->refresh()->pendingDeploymentConfigurationDiff()->isChanged())->toBeFalse();
+});
+
 it('does not flag applications whose older snapshot omitted noindex domains', function () {
     $application = configurationChangedTestApplication([
         'fqdn' => 'https://app.example.com',
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index 8e6775134..9d0739d1c 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -24,6 +24,7 @@
 
 beforeEach(function () {
     $this->withoutVite();
+    config(['app.maintenance.driver' => 'file']);
 
     InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(
         ['id' => 0],
@@ -744,9 +745,14 @@
         ->assertHasNoErrors()
         ->assertDispatched('success');
 
-    expect(explode(',', (string) $this->application->fresh()->fqdn))->toBe([
-        'https://www.example.com:3000',
-        'https://example.com:3000',
+    $application = $this->application->fresh();
+
+    expect(explode(',', (string) $application->fqdn))->toBe([
+        'https://www.example.com',
+        'https://example.com',
+    ])->and($application->domain_port_overrides)->toBe([
+        'https://www.example.com' => 3000,
+        'https://example.com' => 3000,
     ]);
 });
 
@@ -821,7 +827,8 @@
         ->assertSet('editingDomain', 'https://old.example.com')
         ->assertSee('Direction')
         ->assertSee('Search engine indexing')
-        ->set('editingDomain', 'https://new.example.com')
+        ->set('editingDomainParts.scheme', 'https')
+        ->set('editingDomainParts.host', 'new.example.com')
         ->call('updateDomain')
         ->assertHasNoErrors()
         ->assertSet('showEditDomainModal', false)
@@ -845,7 +852,8 @@
 
     $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
         ->call('startEdit', 0)
-        ->set('editingDomain', 'https://this-domain-should-not-resolve-for-coolify-tests.invalid')
+        ->set('editingDomainParts.scheme', 'https')
+        ->set('editingDomainParts.host', 'this-domain-should-not-resolve-for-coolify-tests.invalid')
         ->call('updateDomain')
         ->assertSet('editDomainDnsFailed', true)
         ->assertSet('showEditDomainModal', true)
@@ -1693,7 +1701,10 @@
         ->assertSet('pendingAction', null)
         ->assertDispatched('success');
 
-    expect($this->application->fresh()->fqdn)->toBe('https://shared.example.com');
+    expect(explode(',', (string) $this->application->fresh()->fqdn))->toBe([
+        'https://shared.example.com',
+        'https://www.shared.example.com',
+    ]);
 });
 
 it('saves after confirming a domain conflict on edit', function () {
@@ -1711,7 +1722,8 @@
 
     Livewire::test(Domains::class, ['application' => $this->application->fresh()])
         ->call('startEdit', 0)
-        ->set('editingDomain', 'https://taken.example.com')
+        ->set('editingDomainParts.scheme', 'https')
+        ->set('editingDomainParts.host', 'taken.example.com')
         ->call('updateDomain')
         ->assertSet('showDomainConflictModal', true)
         ->assertSet('pendingAction', 'update')
@@ -1966,6 +1978,72 @@
         ->and($webDomains)->toContain('https://www.web.example.com');
 });
 
+it('saves domain port overrides separately from the public FQDN', function () {
+    $this->application->update([
+        'fqdn' => 'https://one.example.com:3000,https://two.example.com:8080',
+    ]);
+
+    $this->application->refresh();
+
+    expect($this->application->fqdn)
+        ->toBe('https://one.example.com,https://two.example.com')
+        ->and($this->application->domain_port_overrides)
+        ->toBe([
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ]);
+});
+
+it('retains an existing domain port override when saving a portless domain', function () {
+    $this->application->update([
+        'fqdn' => 'https://one.example.com:3000',
+    ]);
+
+    $this->application->update([
+        'fqdn' => 'https://one.example.com',
+    ]);
+
+    expect($this->application->fresh()->fqdn)
+        ->toBe('https://one.example.com')
+        ->and($this->application->fresh()->domain_port_overrides)
+        ->toBe(['https://one.example.com' => 3000]);
+});
+
+it('prunes a domain port override when that domain is removed', function () {
+    $this->application->update([
+        'fqdn' => 'https://one.example.com:3000,https://two.example.com:8080',
+    ]);
+
+    $this->application->update([
+        'fqdn' => 'https://two.example.com',
+    ]);
+
+    expect($this->application->fresh()->fqdn)
+        ->toBe('https://two.example.com')
+        ->and($this->application->fresh()->domain_port_overrides)
+        ->toBe(['https://two.example.com' => 8080]);
+});
+
+it('keeps a legacy port-bearing application domain after refresh and reparse', function () {
+    $this->application->update([
+        'fqdn' => 'https://legacy.example.com',
+    ]);
+
+    DB::table('applications')->where('id', $this->application->id)->update([
+        'fqdn' => 'https://legacy.example.com:9090',
+    ]);
+
+    $application = Application::find($this->application->id);
+    $application->refresh();
+
+    expect($application->fqdn)->toBe('https://legacy.example.com:9090');
+
+    applicationParser($application);
+    $application->update(['description' => 'unrelated reparse']);
+
+    expect($application->fresh()->fqdn)->toBe('https://legacy.example.com:9090');
+});
+
 it('updates search engine indexing from the domains view', function () {
     $this->application->update(['fqdn' => 'https://app.example.com,https://staging.example.com']);
 
@@ -1987,3 +2065,498 @@
     expect($this->application->refresh()->noindexDomains()->all())
         ->toBe(['https://staging.example.com']);
 });
+
+it('keeps noindex domains when normalizing a custom domain port', function () {
+    $this->application->update([
+        'fqdn' => 'https://staging.example.com:8080',
+        'noindex_domains' => ['https://staging.example.com:8080'],
+    ]);
+
+    expect($this->application->refresh())
+        ->fqdn->toBe('https://staging.example.com')
+        ->noindex_domains->toBe(['https://staging.example.com'])
+        ->and($this->application->domain_port_overrides)
+        ->toBe(['https://staging.example.com' => 8080]);
+});
+
+it('saves a port override from the segmented add-domain form', function () {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertDispatched('success')
+        ->assertSee('Internal port 8080')
+        ->assertDontSee('https://example.com:8080');
+
+    $this->application->refresh();
+
+    expect(explode(',', (string) $this->application->fqdn))
+        ->toContain('https://example.com')
+        ->not->toContain('https://example.com:8080')
+        ->and($this->application->domain_port_overrides['https://example.com'] ?? null)
+        ->toBe(8080);
+});
+
+it('rejects adding a domain whose portless URL is already configured', function () {
+    $this->application->update([
+        'fqdn' => 'https://example.com:3000',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasErrors('newDomain');
+
+    expect($this->application->fresh()->fqdn)->toBe('https://example.com')
+        ->and($this->application->fresh()->domain_port_overrides)
+        ->toBe(['https://example.com' => 3000]);
+});
+
+it('rejects renaming a domain to a port variant of another configured domain', function () {
+    $this->application->update([
+        'fqdn' => 'https://first.example.com:3000,https://second.example.com:4000',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 1)
+        ->set('editingDomainParts.host', 'first.example.com')
+        ->set('editingDomainParts.port', '8080')
+        ->call('updateDomain')
+        ->assertHasErrors('editingDomain');
+
+    expect($this->application->fresh()->fqdn)
+        ->toBe('https://first.example.com,https://second.example.com')
+        ->and($this->application->fresh()->domain_port_overrides)
+        ->toBe([
+            'https://first.example.com' => 3000,
+            'https://second.example.com' => 4000,
+        ]);
+});
+
+it('composes segmented add-domain fields into a port override when the changed flag is false', function () {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '8080')
+        ->set('newDomainPartsChanged', false)
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    expect($this->application->fresh()->fqdn)
+        ->toContain('https://example.com')
+        ->not->toContain(':8080')
+        ->and($this->application->fresh()->domain_port_overrides)
+        ->toHaveKey('https://example.com', 8080);
+});
+
+it('retains different port overrides for two application domains', function () {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'one.example.com')
+        ->set('newDomainParts.port', '3000')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->set('newDomainParts.host', 'two.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasNoErrors();
+
+    $this->application->refresh();
+
+    expect($this->application->domain_port_overrides['https://one.example.com'] ?? null)->toBe(3000)
+        ->and($this->application->domain_port_overrides['https://two.example.com'] ?? null)->toBe(8080)
+        ->and(explode(',', (string) $this->application->fqdn))
+        ->toContain('https://one.example.com')
+        ->toContain('https://two.example.com')
+        ->not->toContain('https://one.example.com:3000')
+        ->not->toContain('https://two.example.com:8080');
+});
+
+it('reopens edit with the saved domain port override', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://example.com:8080',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.url', 'https://example.com')
+        ->assertSet('domainRows.0.internal_port', 8080)
+        ->assertSet('domainRows.0.has_port_override', true)
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->assertSet('editingDomainParts.host', 'example.com');
+});
+
+it('does not prefill the default internal port when editing a domain without a port override', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.internal_port', 3000)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '');
+});
+
+it('clears a domain port override and shows the default internal port', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://one.example.com:8080,https://two.example.com:9090',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSee('Internal port 8080')
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->set('editingDomainParts.port', '')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSee('Internal port 3000')
+        ->assertSee('Internal port 9090')
+        ->assertDontSee('Internal port 8080');
+
+    $this->application->refresh();
+
+    expect($this->application->fqdn)
+        ->toContain('https://one.example.com')
+        ->and($this->application->domain_port_overrides)
+        ->not->toHaveKey('https://one.example.com')
+        ->toHaveKey('https://two.example.com', 9090);
+});
+
+it('prunes a domain port override when removing the domain from the ui', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://one.example.com:8080,https://two.example.com:3000',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('removeDomain', 0)
+        ->assertDispatched('success');
+
+    $this->application->refresh();
+
+    expect($this->application->fqdn)->toBe('https://two.example.com')
+        ->and($this->application->domain_port_overrides)
+        ->toBe(['https://two.example.com' => 3000]);
+});
+
+it('renders a portless domain link with an internal port badge for overrides', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://example.com:8080',
+    ]);
+
+    $html = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSee('Internal port 8080')
+        ->assertSee('https://example.com')
+        ->assertDontSee('https://example.com:8080')
+        ->html();
+
+    expect($html)
+        ->toContain('href="'.getFqdnWithoutPort('https://example.com').'"')
+        ->not->toContain('href="https://example.com:8080"')
+        ->toContain('Custom internal port for this domain')
+        ->not->toContain('Inherited from Ports Exposes');
+});
+
+it('shows an error badge when a domain has no internal port and ports exposes is empty', function () {
+    $this->application->update([
+        'ports_exposes' => null,
+        'fqdn' => 'https://example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.internal_port', null)
+        ->assertSee('No internal port')
+        ->assertDontSee('Internal port ')
+        ->assertSee('table-badge-danger', false);
+});
+
+it('keeps the internal port badge when a domain override exists without ports exposes', function () {
+    $this->application->update([
+        'ports_exposes' => null,
+        'fqdn' => 'https://example.com',
+        'domain_port_overrides' => [
+            'https://example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSee('Internal port 8080')
+        ->assertDontSee('No internal port');
+});
+
+it('distinguishes an inherited internal port from a domain port override', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSee('Internal port 3000')
+        ->assertSee('Inherited from Ports Exposes', false)
+        ->assertDontSee('Custom internal port for this domain', false);
+});
+
+it('keeps a legacy port-bearing url port in the edit field as an internal port override', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://legacy.example.com',
+    ]);
+
+    DB::table('applications')->where('id', $this->application->id)->update([
+        'fqdn' => 'https://legacy.example.com:9090',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.url', 'https://legacy.example.com:9090')
+        ->assertSet('domainRows.0.internal_port', 9090)
+        ->assertSet('domainRows.0.has_port_override', true)
+        ->assertSee('Internal port 9090')
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '9090');
+});
+
+it('stores compose domain port overrides without wiping other services', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'fqdn' => null,
+        'ports_exposes' => '3000,8080',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: node:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'api' => ['domain' => 'https://api.example.com', 'redirect' => 'both'],
+        ]),
+        'domain_port_overrides' => [
+            'https://api.example.com' => 4000,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainService', 'web')
+        ->set('newDomainParts.host', 'web.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->set('newDomainPartsChanged', false)
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertSee('Internal port 8080');
+
+    $this->application->refresh();
+    $domains = json_decode($this->application->docker_compose_domains, true);
+
+    expect(data_get($domains, 'web.domain'))
+        ->toContain('https://web.example.com')
+        ->not->toContain(':8080')
+        ->and($this->application->fqdn)->toBeNull()
+        ->and($this->application->domain_port_overrides)
+        ->toHaveKey('https://web.example.com', 8080)
+        ->toHaveKey('https://api.example.com', 4000);
+});
+
+it('prunes a compose domain port override when that domain is removed', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'fqdn' => null,
+        'ports_exposes' => '3000,8080',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: node:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://web.example.com', 'redirect' => 'both'],
+            'api' => ['domain' => 'https://api.example.com', 'redirect' => 'both'],
+        ]),
+        'domain_port_overrides' => [
+            'https://web.example.com' => 8080,
+            'https://api.example.com' => 4000,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('removeDomain', 0)
+        ->assertDispatched('success');
+
+    $this->application->refresh();
+
+    expect($this->application->domain_port_overrides)
+        ->not->toHaveKey('https://web.example.com')
+        ->toHaveKey('https://api.example.com', 4000)
+        ->and($this->application->fqdn)->toBeNull();
+});
+
+function applicationDomainPortOverrideApiToken(User $user, Team $team): string
+{
+    $plainTextToken = Str::random(40);
+    $token = $user->tokens()->create([
+        'name' => 'application-domain-port-override-api',
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => ['*'],
+        'team_id' => $team->id,
+    ]);
+    auth()->logout();
+
+    return $token->getKey().'|'.$plainTextToken;
+}
+
+it('application domain port override API update containing a port persists a portless FQDN and override', function () {
+    $bearer = applicationDomainPortOverrideApiToken($this->user, $this->team);
+
+    $this->withToken($bearer)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'domains' => 'https://example.com:8080',
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+
+    expect($application->fqdn)->toBe('https://example.com')
+        ->and($application->domain_port_overrides)
+        ->toBe(['https://example.com' => 8080]);
+});
+
+it('application domain port override API update omitting ports preserves overrides for unchanged domains', function () {
+    $this->application->update([
+        'fqdn' => 'https://one.example.com:3000,https://two.example.com:8080',
+    ]);
+
+    $bearer = applicationDomainPortOverrideApiToken($this->user, $this->team);
+
+    $this->withToken($bearer)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'domains' => 'https://one.example.com,https://two.example.com',
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+
+    expect($application->fqdn)->toBe('https://one.example.com,https://two.example.com')
+        ->and($application->domain_port_overrides)
+        ->toBe([
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ]);
+});
+
+it('application domain port override API domain removal prunes the override', function () {
+    $this->application->update([
+        'fqdn' => 'https://one.example.com:3000,https://two.example.com:8080',
+    ]);
+
+    $bearer = applicationDomainPortOverrideApiToken($this->user, $this->team);
+
+    $this->withToken($bearer)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'domains' => 'https://two.example.com',
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+
+    expect($application->fqdn)->toBe('https://two.example.com')
+        ->and($application->domain_port_overrides)
+        ->toBe(['https://two.example.com' => 8080]);
+});
+
+it('application domain port override API update of an unrelated field does not rewrite a legacy FQDN', function () {
+    $this->application->update([
+        'fqdn' => 'https://legacy.example.com',
+        'description' => 'before',
+    ]);
+
+    DB::table('applications')->where('id', $this->application->id)->update([
+        'fqdn' => 'https://legacy.example.com:9090',
+    ]);
+
+    $bearer = applicationDomainPortOverrideApiToken($this->user, $this->team);
+
+    $this->withToken($bearer)
+        ->getJson("/api/v1/applications/{$this->application->uuid}")
+        ->assertOk();
+
+    expect($this->application->fresh()->fqdn)->toBe('https://legacy.example.com:9090');
+
+    $this->withToken($bearer)
+        ->patchJson("/api/v1/applications/{$this->application->uuid}", [
+            'description' => 'unrelated',
+        ])
+        ->assertOk();
+
+    $application = $this->application->fresh();
+
+    expect($application->fqdn)->toBe('https://legacy.example.com:9090')
+        ->and($application->description)->toBe('unrelated')
+        ->and($application->domain_port_overrides)->toBeNull();
+});
+
+it('treats ports exposes and existing domain ports as available internal ports', function () {
+    $this->application->update([
+        'ports_exposes' => '3000,8080',
+        'fqdn' => 'https://one.example.com:9090',
+    ]);
+
+    $application = $this->application->fresh();
+
+    expect($application->availableInternalPorts())->toBe([3000, 8080, 9090])
+        ->and($application->portRequiresConfirmation(3000))->toBeFalse()
+        ->and($application->portRequiresConfirmation(8080))->toBeFalse()
+        ->and($application->portRequiresConfirmation(9090))->toBeFalse()
+        ->and($application->portRequiresConfirmation(5555))->toBeTrue()
+        ->and($application->portRequiresConfirmation(null))->toBeFalse();
+});
+
+it('shows a port warning when an application domain uses a port that is not exposed or already used', function () {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '5555')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->assertSet('unrecognizedPort', 5555)
+        ->assertSee('Use a different port?');
+
+    expect($this->application->fresh()->fqdn)->toBeNull();
+});
+
+it('saves an unrecognized application domain port after confirming the warning', function () {
+    $this->application->update(['ports_exposes' => '3000,8080']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '5555')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('confirmUseUnknownPort')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    $application = $this->application->fresh();
+
+    expect(explode(',', (string) $application->fqdn))
+        ->toContain('https://example.com')
+        ->and($application->domain_port_overrides['https://example.com'] ?? null)->toBe(5555);
+});
+
+it('does not warn when editing an application domain to a port already used by another domain', function () {
+    $this->application->update([
+        'ports_exposes' => '3000',
+        'fqdn' => 'https://one.example.com:9090,https://two.example.com',
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('startEdit', 1)
+        ->set('editingDomainParts.port', '9090')
+        ->call('updateDomain')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+});
diff --git a/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php b/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php
index 1e341933e..54183b930 100644
--- a/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php
+++ b/tests/Feature/ApplicationGeneralBuildpackSelectorTest.php
@@ -120,3 +120,32 @@ public function submit($showToaster = true): void
     expect($application->refresh()->fqdn)
         ->toBe('https://example.com,https://www.example.com');
 });
+
+test('networking section hints that internal ports can be set per domain', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'nixpacks',
+        'static_image' => 'nginx:alpine',
+        'base_directory' => '/',
+        'ports_exposes' => '3000,3001',
+        'is_http_basic_auth_enabled' => false,
+        'redirect' => 'no',
+    ]);
+
+    $domainsUrl = route('project.application.domains', [
+        'project_uuid' => $application->environment->project->uuid,
+        'environment_uuid' => $application->environment->uuid,
+        'application_uuid' => $application->uuid,
+    ]);
+
+    Livewire::test(General::class, ['application' => $application])
+        ->assertSuccessful()
+        ->assertSeeInOrder([
+            'Ports exposes',
+            'You can also set an internal port per domain on',
+            'Port mappings',
+        ])
+        ->assertSee($domainsUrl, false);
+});
diff --git a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
index ebcb51fe1..0c40d4a86 100644
--- a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
+++ b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
@@ -10,10 +10,20 @@
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
 use phpseclib3\Crypt\EC;
 
 uses(RefreshDatabase::class);
 
+function disableExactProxyLabels(Application $application): Application
+{
+    $settings = $application->destination->server->settings;
+    $settings->generate_exact_labels = false;
+    $settings->save();
+
+    return $application;
+}
+
 beforeEach(function () {
     $this->user = User::factory()->create();
     $this->team = Team::factory()->create();
@@ -454,3 +464,138 @@
         ->toContain('traefik.docker.network=custom-network')
         ->not->toContain("traefik.docker.network={$application->uuid}");
 });
+
+test('generateLabelsApplication routes portless domains to saved internal port overrides for Traefik and Caddy', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'ports_exposes' => '80',
+        'fqdn' => 'https://one.example.com,https://two.example.com',
+        'domain_port_overrides' => [
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ],
+        'redirect' => 'both',
+        'is_http_basic_auth_enabled' => false,
+    ]));
+
+    $labels = collect(generateLabelsApplication($application));
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-'.$application->uuid.'.rule=Host(`one.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-'.$application->uuid.'.loadbalancer.server.port=3000')
+        ->toContain('traefik.http.routers.https-1-'.$application->uuid.'.rule=Host(`two.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-1-'.$application->uuid.'.loadbalancer.server.port=8080')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}')
+        ->toContain('caddy_1.handle_path.1_reverse_proxy={{upstreams 8080}}')
+        ->not->toContain('Host(`one.example.com:3000`)')
+        ->not->toContain('Host(`two.example.com:8080`)');
+});
+
+test('generateLabelsApplication uses the first ports_exposes value when a portless domain has no override', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'ports_exposes' => '4000,5000',
+        'fqdn' => 'https://plain.example.com',
+        'domain_port_overrides' => null,
+        'redirect' => 'both',
+        'is_http_basic_auth_enabled' => false,
+    ]));
+
+    $labels = collect(generateLabelsApplication($application));
+
+    expect($labels)
+        ->toContain('traefik.http.services.https-0-'.$application->uuid.'.loadbalancer.server.port=4000')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 4000}}');
+});
+
+test('generateLabelsApplication keeps routing a legacy port-bearing FQDN without an override map', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'ports_exposes' => '80',
+        'fqdn' => 'https://legacy.example.com',
+        'redirect' => 'both',
+        'is_http_basic_auth_enabled' => false,
+    ]));
+
+    DB::table('applications')->where('id', $application->id)->update([
+        'fqdn' => 'https://legacy.example.com:9090',
+        'domain_port_overrides' => null,
+    ]);
+
+    $labels = collect(generateLabelsApplication($application->fresh()));
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-'.$application->uuid.'.rule=Host(`legacy.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-'.$application->uuid.'.loadbalancer.server.port=9090')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 9090}}');
+});
+
+test('applicationParser compose labels receive the application domain port override map', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: myapp/frontend:latest
+YAML,
+        'fqdn' => null,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+    ]));
+
+    $application->update([
+        'domain_port_overrides' => [
+            'https://frontend.example.com' => 8080,
+        ],
+    ]);
+
+    $parsedCompose = applicationParser($application->fresh());
+    $labels = collect(data_get($parsedCompose, 'services.frontend.labels'));
+
+    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=8080')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 8080}}')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'Host(`frontend.example.com`)')))
+        ->toBeTrue();
+});
+
+test('applicationParser compose labels use the first ports_exposes value when a portless domain has no override', function () {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000,8080',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: myapp/frontend:latest
+YAML,
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+    ]));
+
+    $parsedCompose = applicationParser($application->fresh());
+    $labels = collect(data_get($parsedCompose, 'services.frontend.labels'));
+
+    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=3000')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 3000}}')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'Host(`frontend.example.com`)')))
+        ->toBeTrue();
+});
diff --git a/tests/Feature/ApplicationPreviewApiTest.php b/tests/Feature/ApplicationPreviewApiTest.php
index bc405d48b..a99483399 100644
--- a/tests/Feature/ApplicationPreviewApiTest.php
+++ b/tests/Feature/ApplicationPreviewApiTest.php
@@ -12,6 +12,7 @@
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
 use Visus\Cuid2\Cuid2;
 
@@ -19,6 +20,7 @@
 
 beforeEach(function () {
     Bus::fake();
+    config()->set('app.maintenance.store', 'array');
     InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
 
     $this->team = Team::factory()->create();
@@ -130,3 +132,273 @@ function createPreview(Application $application, int $pullRequestId): Applicatio
         $response->assertForbidden();
     });
 });
+
+describe('PATCH /api/v1/applications/{uuid}/previews/{pull_request_id}', function () {
+    test('stores preview domain ports separately from portless public domains', function () {
+        $preview = createPreview($this->application, 42);
+
+        $response = $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/42", [
+                'domains' => 'https://one.example.com:3000,https://two.example.com:8080',
+            ])
+            ->assertOk()
+            ->assertJsonPath('domains', 'https://one.example.com,https://two.example.com');
+
+        expect($response->json('domain_port_overrides'))->toBe([
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ]);
+
+        expect($preview->fresh()->fqdn)->toBe('https://one.example.com,https://two.example.com')
+            ->and($preview->fresh()->domain_port_overrides)->toBe([
+                'https://one.example.com' => 3000,
+                'https://two.example.com' => 8080,
+            ]);
+    });
+
+    test('clears an existing preview domain override when the submitted domain is portless', function () {
+        $preview = createPreview($this->application, 43);
+        $preview->update(['fqdn' => 'https://preview.example.com:8080']);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/43", [
+                'domains' => 'https://preview.example.com',
+            ])
+            ->assertOk()
+            ->assertJsonPath('domain_port_overrides', null);
+
+        expect($preview->fresh()->fqdn)->toBe('https://preview.example.com')
+            ->and($preview->fresh()->domain_port_overrides)->toBeNull();
+    });
+
+    test('rejects invalid preview domains', function () {
+        createPreview($this->application, 44);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/44", [
+                'domains' => 'not-a-domain',
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('domains');
+    });
+
+    test('rejects preview domain ports outside the valid TCP range', function (string $domain) {
+        createPreview($this->application, 59);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/59", [
+                'domains' => $domain,
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('domains');
+    })->with([
+        'zero' => 'https://preview.example.com:0',
+        'above maximum' => 'https://preview.example.com:65536',
+    ]);
+
+    test('returns 403 when token lacks write ability', function () {
+        $readOnlyToken = createTeamApiToken($this->user, $this->team, ['read']);
+        createPreview($this->application, 45);
+
+        $this->withHeaders(previewAuthHeaders($readOnlyToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/45", [
+                'domains' => 'https://preview.example.com:3000',
+            ])
+            ->assertForbidden();
+    });
+
+    test('rejects a non-integer pull request id', function () {
+        createPreview($this->application, 1);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/1.9", [
+                'domains' => 'https://preview.example.com:3000',
+            ])
+            ->assertUnprocessable()
+            ->assertJson(['message' => 'Invalid pull_request_id.']);
+    });
+
+    test('detects conflicts after removing the submitted internal port', function () {
+        $otherApplication = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+            'fqdn' => 'https://taken.example.com',
+        ]);
+        createPreview($this->application, 46);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/46", [
+                'domains' => 'https://taken.example.com:3000',
+            ])
+            ->assertConflict()
+            ->assertJsonPath('conflicts.0.resource_uuid', $otherApplication->uuid);
+    });
+
+    test('detects conflicts with another preview domain', function () {
+        createPreview($this->application, 47)->update(['fqdn' => 'https://taken-preview.example.com:3000']);
+        createPreview($this->application, 48);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/48", [
+                'domains' => 'https://taken-preview.example.com:8080',
+            ])
+            ->assertConflict();
+    });
+
+    test('filters preview conflict candidates in the database', function () {
+        createPreview($this->application, 56)->update(['fqdn' => 'https://taken-preview.example.com']);
+        createPreview($this->application, 57)->update(['fqdn' => 'https://current-preview.example.com']);
+        createPreview($this->application, 58)->update(['fqdn' => 'https://unrelated.example.com']);
+
+        $queries = collect();
+        DB::listen(function ($query) use ($queries): void {
+            if (str_contains($query->sql, 'from "application_previews"')) {
+                $queries->push($query->sql);
+            }
+        });
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/57", [
+                'domains' => 'https://taken-preview.example.com',
+            ])
+            ->assertConflict();
+
+        expect($queries->first(fn (string $sql): bool => str_contains($sql, '"application_id" in (select')
+            && str_contains($sql, '"fqdn" is not null')
+            && str_contains($sql, '"fqdn" like ?')))->not->toBeNull();
+    });
+
+    test('updates Docker Compose preview domains with per-domain ports', function () {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        ]);
+        $preview = createPreview($this->application, 49);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/49", [
+                'docker_compose_domains' => [
+                    ['name' => 'web', 'domain' => 'https://web-preview.example.com:8080'],
+                    ['name' => 'api', 'domain' => 'https://api-preview.example.com:3000'],
+                ],
+            ])
+            ->assertOk()
+            ->assertJsonPath('docker_compose_domains.0.name', 'web')
+            ->assertJsonPath('docker_compose_domains.0.domain', 'https://web-preview.example.com')
+            ->assertJsonPath('docker_compose_domains.1.name', 'api')
+            ->assertJsonPath('docker_compose_domains.1.domain', 'https://api-preview.example.com');
+
+        $preview->refresh();
+
+        expect(json_decode($preview->docker_compose_domains, true))->toBe([
+            'web' => ['domain' => 'https://web-preview.example.com'],
+            'api' => ['domain' => 'https://api-preview.example.com'],
+        ])->and($preview->fqdn)->toBe('https://web-preview.example.com,https://api-preview.example.com')
+            ->and($preview->domain_port_overrides)->toBe([
+                'https://web-preview.example.com' => 8080,
+                'https://api-preview.example.com' => 3000,
+            ]);
+    });
+
+    test('clears Docker Compose preview port overrides with portless domains', function () {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+        ]);
+        $preview = createPreview($this->application, 50);
+        $preview->update([
+            'fqdn' => 'https://web-preview.example.com:8080',
+            'docker_compose_domains' => json_encode(['web' => ['domain' => 'https://web-preview.example.com']]),
+        ]);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/50", [
+                'docker_compose_domains' => [
+                    ['name' => 'web', 'domain' => 'https://web-preview.example.com'],
+                ],
+            ])
+            ->assertOk()
+            ->assertJsonPath('domain_port_overrides', null);
+
+        expect($preview->fresh()->domain_port_overrides)->toBeNull();
+    });
+
+    test('rejects unknown Docker Compose preview services', function () {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+        ]);
+        createPreview($this->application, 51);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/51", [
+                'docker_compose_domains' => [
+                    ['name' => 'unknown', 'domain' => 'https://unknown.example.com:8080'],
+                ],
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('docker_compose_domains');
+    });
+
+    test('rejects the same Docker Compose preview domain on different internal ports', function () {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        ]);
+        createPreview($this->application, 52);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/52", [
+                'docker_compose_domains' => [
+                    ['name' => 'web', 'domain' => 'https://duplicate.example.com:8080'],
+                    ['name' => 'api', 'domain' => 'https://duplicate.example.com:3000'],
+                ],
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('docker_compose_domains');
+    });
+
+    test('rejects missing Compose services without changing the preview', function () {
+        $this->application->update(['build_pack' => 'dockercompose', 'docker_compose_raw' => '']);
+        $preview = createPreview($this->application, 53);
+        $originalFqdn = $preview->fresh()->fqdn;
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/53", [
+                'docker_compose_domains' => [],
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('docker_compose_domains');
+
+        expect($preview->fresh()->fqdn)->toBe($originalFqdn);
+    });
+
+    test('rejects the domain field for Compose previews', function () {
+        $this->application->update([
+            'build_pack' => 'dockercompose',
+            'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n",
+        ]);
+        createPreview($this->application, 54);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/54", [
+                'domains' => 'https://ignored.example.com',
+                'docker_compose_domains' => [],
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('domains');
+    });
+
+    test('rejects Docker Compose domains for non-Compose previews', function () {
+        createPreview($this->application, 55);
+
+        $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->patchJson("/api/v1/applications/{$this->application->uuid}/previews/55", [
+                'domains' => 'https://preview.example.com',
+                'docker_compose_domains' => [],
+            ])
+            ->assertUnprocessable()
+            ->assertJsonValidationErrors('docker_compose_domains');
+    });
+});
diff --git a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
index aa1fbda4f..cdc96c2bb 100644
--- a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
+++ b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
@@ -83,6 +83,27 @@
         ->toMatch('/<x-forms\.button(?=[^>]*wire:click\.stop="backupNow\(\'storage\',[^"]+")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$service")[^>]*>/');
 });
 
+it('declares update authorization on application port controls', function () {
+    $domainsView = file_get_contents(resource_path('views/livewire/project/application/domains.blade.php'));
+    $previewDomainsView = file_get_contents(resource_path('views/livewire/project/application/preview-domains.blade.php'));
+    $generalView = file_get_contents(resource_path('views/livewire/project/application/general.blade.php'));
+
+    expect($domainsView)
+        ->toMatch('/<x-forms\.button(?=[^>]*canGate="update")(?=[^>]*:canResource="\$application")[^>]*>\s*Cancel/s')
+        ->toMatch('/<x-forms\.button(?=[^>]*wire:click="confirmUseUnknownPort")(?=[^>]*canGate="update")(?=[^>]*:canResource="\$application")[^>]*>/s');
+
+    expect($previewDomainsView)
+        ->toMatch('/<x-forms\.button[^\n]*canGate="update" :canResource="\$preview->application"[\s\S]{0,150}?Cancel/')
+        ->toMatch('/<x-forms\.button[^\n]*wire:click="confirmUseUnknownPort" canGate="update"\s+:canResource="\$preview->application"/');
+
+    $portsExposesControls = str($generalView)
+        ->after("@if (\$isStatic || \$buildPack === 'static')")
+        ->before('<p class="mt-1.5 text-xs');
+
+    expect($portsExposesControls->substrCount('id="portsExposes"'))->toBe(3)
+        ->and($portsExposesControls->substrCount('canGate="update" :canResource="$application"'))->toBe(3);
+});
+
 it('keeps mutable Livewire components behind authorization checks', function (string $path, array $requiredNeedles) {
     $source = file_get_contents(base_path($path));
 
diff --git a/tests/Feature/PreviewDomainPortOverridesTest.php b/tests/Feature/PreviewDomainPortOverridesTest.php
new file mode 100644
index 000000000..b40193cb2
--- /dev/null
+++ b/tests/Feature/PreviewDomainPortOverridesTest.php
@@ -0,0 +1,674 @@
+<?php
+
+use App\Livewire\Project\Application\PreviewDomains;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    config(['app.maintenance.driver' => 'file']);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        [
+            'id' => 0,
+            'is_dns_validation_enabled' => false,
+        ]
+    ));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+        'ip' => '203.0.113.10',
+    ]);
+
+    $this->server->settings()->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'generate_exact_labels' => false,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Preview Port App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'fqdn' => null,
+        'redirect' => 'both',
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000,8080',
+        'is_http_basic_auth_enabled' => false,
+    ]);
+});
+
+function createPreviewForPortTests(Application $application, int $pullRequestId, array $attributes = []): ApplicationPreview
+{
+    return ApplicationPreview::create(array_merge([
+        'application_id' => $application->id,
+        'pull_request_id' => $pullRequestId,
+        'pull_request_html_url' => "https://github.com/coollabsio/coolify/pull/{$pullRequestId}",
+    ], $attributes));
+}
+
+it('saves preview domain port overrides separately from the public FQDN', function () {
+    $preview = createPreviewForPortTests($this->application, 101);
+
+    $preview->update([
+        'fqdn' => 'https://one-pr-101.example.com:3000,https://two-pr-101.example.com:8080',
+    ]);
+
+    $preview->refresh();
+
+    expect($preview->fqdn)
+        ->toBe('https://one-pr-101.example.com,https://two-pr-101.example.com')
+        ->and($preview->domain_port_overrides)
+        ->toBe([
+            'https://one-pr-101.example.com' => 3000,
+            'https://two-pr-101.example.com' => 8080,
+        ]);
+});
+
+it('retains an existing preview port override when saving a portless domain', function () {
+    $preview = createPreviewForPortTests($this->application, 102, [
+        'fqdn' => 'https://one-pr-102.example.com:3000',
+    ]);
+
+    $preview->update([
+        'fqdn' => 'https://one-pr-102.example.com',
+    ]);
+
+    expect($preview->fresh()->fqdn)
+        ->toBe('https://one-pr-102.example.com')
+        ->and($preview->fresh()->domain_port_overrides)
+        ->toBe(['https://one-pr-102.example.com' => 3000]);
+});
+
+it('saves a preview port override from the add-domain form', function () {
+    $preview = createPreviewForPortTests($this->application, 103);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertDispatched('success')
+        ->assertSee('Internal port 8080')
+        ->assertDontSee('https://preview.example.com:8080');
+
+    $preview->refresh();
+
+    expect($preview->fqdn)
+        ->toBe('https://preview.example.com')
+        ->and($preview->domain_port_overrides['https://preview.example.com'] ?? null)
+        ->toBe(8080);
+});
+
+it('retains different port overrides for two preview domains', function () {
+    $preview = createPreviewForPortTests($this->application, 104);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'one-preview.example.com')
+        ->set('newDomainParts.port', '3000')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->set('newDomainParts.host', 'two-preview.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasNoErrors();
+
+    $preview->refresh();
+
+    expect($preview->domain_port_overrides['https://one-preview.example.com'] ?? null)->toBe(3000)
+        ->and($preview->domain_port_overrides['https://two-preview.example.com'] ?? null)->toBe(8080)
+        ->and(explode(',', (string) $preview->fqdn))
+        ->toContain('https://one-preview.example.com')
+        ->toContain('https://two-preview.example.com')
+        ->not->toContain('https://one-preview.example.com:3000')
+        ->not->toContain('https://two-preview.example.com:8080');
+});
+
+it('reopens preview domain edit with the saved port override', function () {
+    $preview = createPreviewForPortTests($this->application, 105, [
+        'fqdn' => 'https://preview.example.com:8080',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.url', 'https://preview.example.com')
+        ->assertSet('domainRows.0.internal_port', 8080)
+        ->assertSet('domainRows.0.has_port_override', true)
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->assertSet('editingDomainParts.host', 'preview.example.com');
+});
+
+it('does not prefill the default internal port when editing a preview domain without an override', function () {
+    $preview = createPreviewForPortTests($this->application, 106, [
+        'fqdn' => 'https://preview.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.internal_port', 3000)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '');
+});
+
+it('clears a preview domain port override and shows the default internal port', function () {
+    $preview = createPreviewForPortTests($this->application, 107, [
+        'fqdn' => 'https://one-preview.example.com:8080,https://two-preview.example.com:9090',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSee('Internal port 8080')
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->set('editingDomainParts.port', '')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSee('Internal port 3000')
+        ->assertSee('Internal port 9090')
+        ->assertDontSee('Internal port 8080');
+
+    $preview->refresh();
+
+    expect($preview->fqdn)
+        ->toContain('https://one-preview.example.com')
+        ->and($preview->domain_port_overrides)
+        ->not->toHaveKey('https://one-preview.example.com')
+        ->toHaveKey('https://two-preview.example.com', 9090);
+});
+
+it('prunes a preview domain port override when removing the domain', function () {
+    $preview = createPreviewForPortTests($this->application, 108, [
+        'fqdn' => 'https://one-preview.example.com:8080,https://two-preview.example.com:3000',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('removeDomain', 0)
+        ->assertDispatched('success');
+
+    $preview->refresh();
+
+    expect($preview->fqdn)->toBe('https://two-preview.example.com')
+        ->and($preview->domain_port_overrides)
+        ->toBe(['https://two-preview.example.com' => 3000]);
+});
+
+it('shows an error badge when a preview domain has no internal port and ports exposes is empty', function () {
+    $this->application->update([
+        'ports_exposes' => null,
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 109, [
+        'fqdn' => 'https://preview.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSee('No internal port')
+        ->assertDontSee('Internal port');
+});
+
+it('rejects adding a preview domain whose portless URL is already configured', function () {
+    $preview = createPreviewForPortTests($this->application, 110, [
+        'fqdn' => 'https://preview.example.com:3000',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasErrors('newDomainParts.host');
+
+    expect($preview->fresh()->fqdn)->toBe('https://preview.example.com')
+        ->and($preview->fresh()->domain_port_overrides)
+        ->toBe(['https://preview.example.com' => 3000]);
+});
+
+it('saves compose preview domain port overrides per service without putting the port in the public URL', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n  api:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => null,
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 111);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainService', 'web')
+        ->set('newDomainParts.host', 'web-preview.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->set('newDomainService', 'api')
+        ->set('newDomainParts.host', 'api-preview.example.com')
+        ->set('newDomainParts.port', '3000')
+        ->call('addDomain')
+        ->assertHasNoErrors();
+
+    $preview->refresh();
+    $composeDomains = json_decode($preview->docker_compose_domains, true);
+
+    expect(data_get($composeDomains, 'web.domain'))->toBe('https://web-preview.example.com')
+        ->and(data_get($composeDomains, 'api.domain'))->toBe('https://api-preview.example.com')
+        ->and($preview->domain_port_overrides)
+        ->toBe([
+            'https://web-preview.example.com' => 8080,
+            'https://api-preview.example.com' => 3000,
+        ]);
+});
+
+it('copies the parent domain port override onto a generated preview domain', function () {
+    $this->application->update([
+        'fqdn' => 'https://app.example.com:8080',
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 112);
+    $preview->generate_preview_fqdn();
+    $preview->refresh();
+
+    expect($preview->fqdn)
+        ->toContain('112.')
+        ->not->toContain(':8080')
+        ->and($preview->domain_port_overrides)
+        ->toHaveCount(1)
+        ->and(array_values($preview->domain_port_overrides))
+        ->toBe([8080]);
+});
+
+it('saves generated preview domains once in the application parser', function () {
+    $parser = file_get_contents(base_path('bootstrap/helpers/parsers.php'));
+    $previewGeneration = Str::of($parser)
+        ->after('// If the domain is set, we need to generate the FQDNs for the preview')
+        ->before('$defaultLabels = defaultLabels');
+
+    expect($previewGeneration->substrCount('$preview->save();'))->toBe(1)
+        ->and((string) $previewGeneration)->toContain('$preview->fqdn = $fqdns->implode(\',\');');
+});
+
+it('keeps every generated preview domain port override in the legacy compose parser', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '2',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: nginx:alpine
+YAML,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://one.example.com:3000,https://two.example.com:8080'],
+        ]),
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 124);
+
+    parseDockerComposeFile($this->application->fresh(), pull_request_id: 124, preview_id: $preview->id);
+
+    $preview->refresh();
+
+    $previewDomains = explode(',', (string) $preview->fqdn);
+
+    expect($previewDomains)->toHaveCount(2)
+        ->and(collect($previewDomains)
+            ->filter(fn (string $domain): bool => parse_url($domain, PHP_URL_PORT) !== null))
+        ->toBeEmpty()
+        ->and($preview->domain_port_overrides)->toHaveCount(2)
+        ->and(array_keys($preview->domain_port_overrides))->toBe($previewDomains)
+        ->and(array_values($preview->domain_port_overrides))->toBe([3000, 8080]);
+});
+
+it('finds the legacy compose preview by pull request when its id is unavailable', function (?int $previewId) {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '2',
+        'docker_compose_raw' => "services:\n  frontend:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://app.example.com:3000'],
+        ]),
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 125);
+
+    parseDockerComposeFile($this->application->fresh(), pull_request_id: 125, preview_id: $previewId);
+
+    expect($preview->fresh()->fqdn)->not->toBeNull();
+})->with([
+    'missing id' => null,
+    'stale id' => PHP_INT_MAX,
+]);
+
+it('throws a controlled exception when the legacy compose preview does not exist', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '2',
+        'docker_compose_raw' => "services:\n  frontend:\n    image: nginx:alpine\n",
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://app.example.com:3000'],
+        ]),
+    ]);
+
+    expect(fn () => parseDockerComposeFile(
+        $this->application->fresh(),
+        pull_request_id: 126,
+        preview_id: PHP_INT_MAX,
+    ))->toThrow(RuntimeException::class, 'Preview not found.');
+});
+
+it('preserves an existing preview port override in the legacy compose parser', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '2',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: nginx:alpine
+YAML,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 126, [
+        'fqdn' => 'https://126.frontend.example.com',
+        'domain_port_overrides' => [
+            'https://126.frontend.example.com' => 8080,
+        ],
+    ]);
+
+    parseDockerComposeFile($this->application->fresh(), pull_request_id: 126, preview_id: $preview->id);
+
+    expect($preview->fresh()->domain_port_overrides)
+        ->toBe(['https://126.frontend.example.com' => 8080]);
+});
+
+it('does not copy production domain port overrides onto preview proxy labels', function () {
+    $this->application->update([
+        'fqdn' => 'https://app.example.com',
+        'domain_port_overrides' => [
+            'https://app.example.com' => 9090,
+        ],
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 113, [
+        'fqdn' => 'https://113.app.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    $labels = collect(generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+
+    expect($labels)
+        ->toContain('traefik.http.services.https-0-'.$this->application->uuid.'-pr-113.loadbalancer.server.port=3000')
+        ->not->toContain('loadbalancer.server.port=9090');
+});
+
+it('routes portless preview domains to saved preview internal port overrides', function () {
+    $preview = createPreviewForPortTests($this->application, 114, [
+        'fqdn' => 'https://one-pr.example.com,https://two-pr.example.com',
+        'domain_port_overrides' => [
+            'https://one-pr.example.com' => 3000,
+            'https://two-pr.example.com' => 8080,
+        ],
+    ]);
+
+    $labels = collect(generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+    $uuid = $this->application->uuid.'-pr-114';
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-'.$uuid.'.rule=Host(`one-pr.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-'.$uuid.'.loadbalancer.server.port=3000')
+        ->toContain('traefik.http.routers.https-1-'.$uuid.'.rule=Host(`two-pr.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-1-'.$uuid.'.loadbalancer.server.port=8080')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}')
+        ->toContain('caddy_1.handle_path.1_reverse_proxy={{upstreams 8080}}')
+        ->not->toContain('Host(`one-pr.example.com:3000`)')
+        ->not->toContain('Host(`two-pr.example.com:8080`)');
+});
+
+it('uses the first ports_exposes value for a portless preview domain without an override', function () {
+    $preview = createPreviewForPortTests($this->application, 115, [
+        'fqdn' => 'https://plain-pr.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    $labels = collect(generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+
+    expect($labels)
+        ->toContain('traefik.http.services.https-0-'.$this->application->uuid.'-pr-115.loadbalancer.server.port=3000')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}');
+});
+
+it('keeps routing a legacy port-bearing preview FQDN without an override map', function () {
+    $preview = createPreviewForPortTests($this->application, 116, [
+        'fqdn' => 'https://legacy-pr.example.com',
+    ]);
+
+    DB::table('application_previews')->where('id', $preview->id)->update([
+        'fqdn' => 'https://legacy-pr.example.com:9090',
+        'domain_port_overrides' => null,
+    ]);
+
+    $labels = collect(generateLabelsApplication($this->application->fresh(), $preview->fresh()));
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-'.$this->application->uuid.'-pr-116.rule=Host(`legacy-pr.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-'.$this->application->uuid.'-pr-116.loadbalancer.server.port=9090')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 9090}}');
+});
+
+it('passes preview domain port overrides into compose pull-request labels', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '3',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: myapp/frontend:latest
+YAML,
+        'fqdn' => null,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+        'domain_port_overrides' => [
+            'https://frontend.example.com' => 80,
+        ],
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 117, [
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://117.frontend.example.com'],
+        ]),
+        'fqdn' => 'https://117.frontend.example.com',
+        'domain_port_overrides' => [
+            'https://117.frontend.example.com' => 8080,
+        ],
+    ]);
+
+    $parsedCompose = applicationParser($this->application->fresh(), 117, $preview->id);
+    $labels = collect(data_get($parsedCompose, 'services.frontend-pr-117.labels'));
+
+    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=8080')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 8080}}')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'Host(`117.frontend.example.com`)')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=80')))
+        ->toBeFalse();
+});
+
+it('uses ports_exposes as the compose preview fallback when a domain has no override', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'compose_parsing_version' => '3',
+        'ports_exposes' => '4000,5000',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  frontend:
+    image: myapp/frontend:latest
+YAML,
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 118, [
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://118.frontend.example.com'],
+        ]),
+        'fqdn' => 'https://118.frontend.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    $parsedCompose = applicationParser($this->application->fresh(), 118, $preview->id);
+    $labels = collect(data_get($parsedCompose, 'services.frontend-pr-118.labels'));
+
+    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=4000')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 4000}}')))
+        ->toBeTrue();
+});
+
+it('shows a port warning when a preview domain uses a port that is not exposed or used by the application', function () {
+    $preview = createPreviewForPortTests($this->application, 119);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '9090')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->assertSet('unrecognizedPort', 9090)
+        ->assertSee('Use a different port?')
+        ->assertSee('9090');
+
+    expect($preview->fresh()->fqdn)->toBeNull();
+});
+
+it('does not warn when a preview domain port is listed in ports exposes', function () {
+    $preview = createPreviewForPortTests($this->application, 120);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '8080')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+});
+
+it('does not warn when a preview domain port is already used by an application domain', function () {
+    $this->application->update([
+        'ports_exposes' => '3000',
+        'fqdn' => 'https://app.example.com:9090',
+    ]);
+
+    $preview = createPreviewForPortTests($this->application, 121);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '9090')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+});
+
+it('saves an unrecognized preview domain port after confirming the warning', function () {
+    $preview = createPreviewForPortTests($this->application, 122);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '9090')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('confirmUseUnknownPort')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    expect($preview->fresh()->fqdn)->toBe('https://preview.example.com')
+        ->and($preview->fresh()->domain_port_overrides)
+        ->toBe(['https://preview.example.com' => 9090]);
+});
+
+it('cancels an unrecognized preview domain port without saving', function () {
+    $preview = createPreviewForPortTests($this->application, 123);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->set('newDomainParts.host', 'preview.example.com')
+        ->set('newDomainParts.port', '9090')
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('cancelUseUnknownPort')
+        ->assertSet('showPortWarningModal', false);
+
+    expect($preview->fresh()->fqdn)->toBeNull();
+});
+
+it('warns when editing a preview domain to an unrecognized port', function () {
+    $preview = createPreviewForPortTests($this->application, 124, [
+        'fqdn' => 'https://preview.example.com:3000',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.port', '5555')
+        ->call('updateDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->assertSet('unrecognizedPort', 5555);
+
+    expect($preview->fresh()->domain_port_overrides)
+        ->toBe(['https://preview.example.com' => 3000]);
+});
+
+it('does not warn when re-saving a preview domain with the same custom port', function () {
+    $preview = createPreviewForPortTests($this->application, 125, [
+        'fqdn' => 'https://preview.example.com:9090',
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->call('startEdit', 0)
+        ->set('editingDomainParts.port', '9090')
+        ->call('updateDomain')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+});
diff --git a/tests/Feature/Service/EditDomainPortValidationTest.php b/tests/Feature/Service/EditDomainPortValidationTest.php
index c86fdca4d..0d569574f 100644
--- a/tests/Feature/Service/EditDomainPortValidationTest.php
+++ b/tests/Feature/Service/EditDomainPortValidationTest.php
@@ -2,7 +2,9 @@
 
 use App\Livewire\Project\Service\Domains;
 use App\Livewire\Project\Service\EditDomain;
+use App\Livewire\Project\Service\Index;
 use App\Models\Environment;
+use App\Models\InstanceSettings;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\Service;
@@ -10,14 +12,21 @@
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
 use Livewire\Livewire;
 
+uses(RefreshDatabase::class);
+
 beforeEach(function () {
+    $this->withoutVite();
+    InstanceSettings::forceCreate(['id' => 0]);
+
     // Create user and team
     $this->user = User::factory()->create();
     $this->team = Team::factory()->create();
     $this->user->teams()->attach($this->team, ['role' => 'owner']);
     $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
 
     // Create server
     $this->server = Server::factory()->create([
@@ -25,9 +34,7 @@
     ]);
 
     // Create standalone docker destination
-    $this->destination = StandaloneDocker::factory()->create([
-        'server_id' => $this->server->id,
-    ]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
 
     // Create project and environment
     $this->project = Project::factory()->create([
@@ -48,8 +55,10 @@
     ]);
 
     // Create service application
-    $this->serviceApplication = ServiceApplication::factory()->create([
+    $this->serviceApplication = ServiceApplication::create([
         'service_id' => $this->service->id,
+        'name' => 'web',
+        'image' => 'nginx:alpine',
         'fqdn' => 'http://example.com:8000',
     ]);
 
@@ -68,6 +77,42 @@ function get_service_templates_mock()
     }
 });
 
+it('loads a persisted port override in the service application editor', function () {
+    $this->serviceApplication->update([
+        'fqdn' => 'https://web.example.com',
+        'domain_port_overrides' => [
+            'https://web.example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(Index::class, [
+        'serviceApplication' => $this->serviceApplication->fresh(),
+        'parameters' => [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'service_uuid' => $this->service->uuid,
+            'stack_service_uuid' => $this->serviceApplication->uuid,
+        ],
+        'query' => [],
+    ])
+        ->assertSet('fqdn', 'https://web.example.com:8080')
+        ->assertOk();
+});
+
+it('initializes route state when mounting a service application directly', function () {
+    Livewire::test(Index::class, [
+        'serviceApplication' => $this->serviceApplication,
+    ])
+        ->assertSet('parameters', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+            'service_uuid' => $this->service->uuid,
+            'stack_service_uuid' => $this->serviceApplication->uuid,
+        ])
+        ->assertSet('query', [])
+        ->assertOk();
+});
+
 it('loads the EditDomain component with required port', function () {
     Livewire::test(EditDomain::class, ['applicationId' => $this->serviceApplication->id])
         ->assertSet('requiredPort', 8000)
@@ -75,6 +120,28 @@ function get_service_templates_mock()
         ->assertOk();
 });
 
+it('loads a persisted port override and moves it when the hostname changes', function () {
+    $this->serviceApplication->update([
+        'fqdn' => 'https://old.example.com',
+        'domain_port_overrides' => [
+            'https://old.example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(EditDomain::class, ['applicationId' => $this->serviceApplication->id])
+        ->assertSet('fqdn', 'https://old.example.com:8080')
+        ->set('fqdn', 'https://new.example.com:8080')
+        ->call('submit')
+        ->assertSet('showPortWarningModal', false)
+        ->assertSet('fqdn', 'https://new.example.com:8080');
+
+    expect($this->serviceApplication->fresh())
+        ->fqdn->toBe('https://new.example.com')
+        ->domain_port_overrides->toBe([
+            'https://new.example.com' => 8080,
+        ]);
+});
+
 it('marks noindex changes as pending configuration', function () {
     $this->service->isConfigurationChanged(save: true);
 
@@ -107,7 +174,7 @@ function get_service_templates_mock()
 });
 
 it('cancels port removal when user cancels', function () {
-    $originalFqdn = $this->serviceApplication->fqdn;
+    $originalFqdn = $this->serviceApplication->url;
 
     Livewire::test(EditDomain::class, ['applicationId' => $this->serviceApplication->id])
         ->set('fqdn', 'http://example.com') // Remove port
@@ -126,7 +193,10 @@ function get_service_templates_mock()
 
     // Verify the FQDN was updated
     $this->serviceApplication->refresh();
-    expect($this->serviceApplication->fqdn)->toBe('http://example.com:3000');
+    expect($this->serviceApplication->fqdn)->toBe('http://example.com')
+        ->and($this->serviceApplication->domain_port_overrides)->toBe([
+            'http://example.com' => 3000,
+        ]);
 });
 
 it('allows saving when all domains have ports (multiple domains)', function () {
@@ -153,8 +223,10 @@ function get_service_templates_mock()
         'environment_id' => $this->environment->id,
     ]);
 
-    $appWithoutPort = ServiceApplication::factory()->create([
+    $appWithoutPort = ServiceApplication::create([
         'service_id' => $serviceWithoutPort->id,
+        'name' => 'web',
+        'image' => 'nginx:alpine',
         'fqdn' => 'http://example.com',
     ]);
 
diff --git a/tests/Feature/ServiceApplicationsApiTest.php b/tests/Feature/ServiceApplicationsApiTest.php
index c8dd33a46..d6c687fbc 100644
--- a/tests/Feature/ServiceApplicationsApiTest.php
+++ b/tests/Feature/ServiceApplicationsApiTest.php
@@ -20,6 +20,7 @@
 
 beforeEach(function () {
     Queue::fake();
+    config()->set('app.maintenance.store', 'array');
     InstanceSettings::forceCreate(['id' => 0, 'is_api_enabled' => true]);
 
     $this->team = Team::factory()->create();
@@ -173,6 +174,23 @@ function createServiceWithoutApplicationsForApiTest(object $ctx): Service
         $response->assertStatus(200);
         $response->assertJsonFragment(['uuid' => $ctx->serviceApplication->uuid, 'name' => 'web']);
     });
+
+    test('returns an editable url with persisted port overrides', function () {
+        $ctx = createServiceWithApplicationForApiTest($this);
+        $ctx->serviceApplication->update([
+            'fqdn' => 'https://web.example.com',
+            'domain_port_overrides' => [
+                'https://web.example.com' => 8080,
+            ],
+        ]);
+
+        $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->getJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}")
+            ->assertSuccessful()
+            ->assertJsonPath('url', 'https://web.example.com:8080')
+            ->assertJsonMissingPath('domain_port_overrides');
+    });
 });
 
 describe('PATCH /api/v1/services/{uuid}/applications/{app_uuid}', function () {
@@ -199,6 +217,34 @@ function createServiceWithoutApplicationsForApiTest(object $ctx): Service
         expect($ctx->serviceApplication->human_name)->toBe('Web UI');
     });
 
+    test('round trips and moves a port override when renaming a domain', function () {
+        $ctx = createServiceWithApplicationForApiTest($this);
+        $ctx->serviceApplication->update([
+            'fqdn' => 'https://old.example.com',
+            'domain_port_overrides' => [
+                'https://old.example.com' => 8080,
+            ],
+        ]);
+
+        $url = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->getJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}")
+            ->json('url');
+
+        $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
+            'url' => str_replace('old.example.com', 'new.example.com', $url),
+        ])->assertSuccessful()
+            ->assertJsonPath('url', 'https://new.example.com:8080');
+
+        expect($ctx->serviceApplication->fresh())
+            ->fqdn->toBe('https://new.example.com')
+            ->domain_port_overrides->toBe([
+                'https://new.example.com' => 8080,
+            ]);
+    });
+
     test('updates the HTTP to HTTPS redirect setting', function () {
         config(['app.maintenance.driver' => 'file']);
         $ctx = createServiceWithApplicationForApiTest($this);
@@ -225,6 +271,19 @@ function createServiceWithoutApplicationsForApiTest(object $ctx): Service
         $response->assertStatus(422);
     });
 
+    test('returns 422 for a url port outside the valid TCP range', function (string $url) {
+        $ctx = createServiceWithApplicationForApiTest($this);
+
+        $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
+            'url' => $url,
+        ])->assertUnprocessable();
+    })->with([
+        'zero' => 'https://example.com:0',
+        'above maximum' => 'https://example.com:65536',
+    ]);
+
     test('returns 422 when enabling log drain but server has no log drain', function () {
         $ctx = createServiceWithApplicationForApiTest($this);
 
diff --git a/tests/Feature/ServiceDomainPortCorruptionTest.php b/tests/Feature/ServiceDomainPortCorruptionTest.php
index 89a4b6bc2..37be302f9 100644
--- a/tests/Feature/ServiceDomainPortCorruptionTest.php
+++ b/tests/Feature/ServiceDomainPortCorruptionTest.php
@@ -63,7 +63,8 @@
 
     $serviceApp->refresh();
 
-    expect($serviceApp->fqdn)->toBe('http://git.example.com:80')
+    expect($serviceApp->fqdn)->toBe('http://git.example.com')
+        ->and($serviceApp->domain_port_overrides['http://git.example.com'] ?? null)->toBe(80)
         ->and($serviceApp->fqdn)->not->toContain('//:80')
         ->and(fn () => Url::fromString($serviceApp->fqdn))->not->toThrow(Throwable::class);
 
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index 066d0598a..4f825f8e2 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -92,6 +92,40 @@
     ]);
 });
 
+it('marks service application port-only changes as pending configuration', function () {
+    $this->webApp->update([
+        'fqdn' => 'http://example.com',
+        'domain_port_overrides' => ['http://example.com' => 8000],
+    ]);
+    $this->service->isConfigurationChanged(save: true);
+
+    $this->webApp->update([
+        'domain_port_overrides' => ['http://example.com' => 3000],
+    ]);
+
+    expect($this->service->refresh()->isConfigurationChanged())->toBeTrue();
+});
+
+it('does not mark reordered service application port overrides as changed', function () {
+    $this->webApp->update([
+        'fqdn' => 'http://one.example.com,http://two.example.com',
+        'domain_port_overrides' => [
+            'http://one.example.com' => 8000,
+            'http://two.example.com' => 3000,
+        ],
+    ]);
+    $this->service->isConfigurationChanged(save: true);
+
+    $this->webApp->update([
+        'domain_port_overrides' => [
+            'http://two.example.com' => 3000,
+            'http://one.example.com' => 8000,
+        ],
+    ]);
+
+    expect($this->service->refresh()->isConfigurationChanged())->toBeFalse();
+});
+
 it('groups configured domains and shows redirect settings in the table', function () {
     $this->apiApp->update([
         'fqdn' => 'https://api.example.com,https://admin.example.com',
@@ -504,6 +538,133 @@
         ->and($this->apiApp->domain_dns_statuses['https://api.example.com']['message'] ?? null)->not->toBe('Stale DNS result.');
 });
 
+it('shows the port warning modal when adding a domain with a non-default port', function () {
+    $this->service->update([
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    environment:
+      - SERVICE_FQDN_WEB_8000
+  api:
+    image: node:alpine
+YAML,
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('newServiceApplicationId', $this->webApp->id)
+        ->set('newDomainParts.host', 'web.example.com')
+        ->set('newDomainParts.port', '3000')
+        ->set('newDomainPartsChanged', true)
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->assertSet('requiredPort', 8000)
+        ->assertSee('Use a different port?');
+
+    expect($this->webApp->fresh()->fqdn)->toBeNull();
+});
+
+it('saves a non-default domain port after confirming the warning', function () {
+    $this->service->update([
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    environment:
+      - SERVICE_FQDN_WEB_8000
+  api:
+    image: node:alpine
+YAML,
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('newServiceApplicationId', $this->webApp->id)
+        ->set('newDomainParts.host', 'web.example.com')
+        ->set('newDomainParts.port', '3000')
+        ->set('newDomainPartsChanged', true)
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', true)
+        ->call('confirmRemovePort')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+
+    $this->webApp->refresh();
+
+    expect($this->webApp->fqdn)->toContain('https://web.example.com')
+        ->and($this->webApp->domain_port_overrides['https://web.example.com'] ?? null)->toBe(3000);
+});
+
+it('clears a service domain port override when saving without a port', function () {
+    $this->service->update([
+        'docker_compose_raw' => <<<'YAML'
+services:
+  api:
+    image: node:alpine
+    environment:
+      - SERVICE_FQDN_API_3000
+  web:
+    image: nginx:alpine
+YAML,
+    ]);
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com',
+        'domain_port_overrides' => [
+            'https://api.example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->set('editingDomainParts.port', '')
+        ->call('updateDomain')
+        ->assertHasNoErrors()
+        ->assertSee('Internal port 3000')
+        ->assertDontSee('Internal port 8080');
+
+    expect($this->apiApp->fresh()->domain_port_overrides ?? [])
+        ->not->toHaveKey('https://api.example.com');
+});
+
+it('reopens service domain edit with the saved port override', function () {
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com',
+        'domain_port_overrides' => [
+            'https://api.example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSet('domainRows.0.url', 'https://api.example.com')
+        ->assertSet('domainRows.0.internal_port', 8080)
+        ->call('startEdit', 0)
+        ->assertSet('editingDomainParts.port', '8080')
+        ->assertSet('editingDomainParts.host', 'api.example.com');
+});
+
+it('does not show the port warning modal when the domain uses the required port', function () {
+    $this->service->update([
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    environment:
+      - SERVICE_FQDN_WEB_8000
+  api:
+    image: node:alpine
+YAML,
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('newServiceApplicationId', $this->webApp->id)
+        ->set('newDomainParts.host', 'web.example.com')
+        ->set('newDomainParts.port', '8000')
+        ->set('newDomainPartsChanged', true)
+        ->call('addDomain')
+        ->assertSet('showPortWarningModal', false)
+        ->assertDispatched('success');
+});
+
 it('saves after confirming both a domain conflict and a missing required port', function () {
     $this->service->update([
         'docker_compose_raw' => <<<'YAML'
@@ -526,9 +687,9 @@
         ->assertSet('showDomainConflictModal', false)
         ->assertSet('showPortWarningModal', true)
         ->assertSet('forceSaveDomains', true)
-        ->assertSee('Remove required port?')
-        ->assertSee('Keep port')
-        ->assertSee('Remove port anyway');
+        ->assertSee('Use a different port?')
+        ->assertSee('Keep required port')
+        ->assertSee('Use this port anyway');
 
     $component
         ->call('confirmRemovePort')
@@ -690,3 +851,65 @@
     expect(file_get_contents(resource_path('views/livewire/project/service/partials/domain-table.blade.php')))
         ->not->toContain('<select');
 });
+
+it('keeps noindex domains when normalizing a custom service domain port', function () {
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com:8080',
+        'noindex_domains' => ['https://api.example.com:8080'],
+    ]);
+
+    expect($this->apiApp->refresh())
+        ->fqdn->toBe('https://api.example.com')
+        ->noindex_domains->toBe(['https://api.example.com'])
+        ->and($this->apiApp->domain_port_overrides)
+        ->toBe(['https://api.example.com' => 8080]);
+});
+
+it('shows an inherited internal port badge from the coolify service env port', function () {
+    $this->service->update([
+        'docker_compose_raw' => "services:\n  api:\n    image: node:alpine\n    environment:\n      - SERVICE_FQDN_API_3000\n",
+    ]);
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSet('domainRows.0.internal_port', 3000)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->assertSee('Internal port 3000')
+        ->assertSee('Inherited from the Coolify service port', false)
+        ->assertDontSee('No internal port');
+});
+
+it('shows a custom internal port badge for a service domain override', function () {
+    $this->service->update([
+        'docker_compose_raw' => "services:\n  api:\n    image: node:alpine\n    environment:\n      - SERVICE_FQDN_API_3000\n",
+    ]);
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com',
+        'domain_port_overrides' => [
+            'https://api.example.com' => 8080,
+        ],
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSet('domainRows.0.internal_port', 8080)
+        ->assertSet('domainRows.0.has_port_override', true)
+        ->assertSee('Internal port 8080')
+        ->assertSee('Custom internal port for this domain', false)
+        ->assertDontSee('Internal port 3000');
+});
+
+it('does not show an internal port badge when the service has no env port', function () {
+    $this->apiApp->update([
+        'fqdn' => 'https://api.example.com',
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSet('domainRows.0.internal_port', null)
+        ->assertDontSee('No internal port')
+        ->assertDontSee('Internal port ')
+        ->assertDontSee('table-badge-danger', false);
+});
diff --git a/tests/Feature/ServiceTemplatePortCoverageTest.php b/tests/Feature/ServiceTemplatePortCoverageTest.php
new file mode 100644
index 000000000..4cf832bea
--- /dev/null
+++ b/tests/Feature/ServiceTemplatePortCoverageTest.php
@@ -0,0 +1,48 @@
+<?php
+
+/**
+ * One-click templates that expose SERVICE_URL / SERVICE_FQDN without a _PORT
+ * suffix (WordPress-style) must declare `# port:` so getRequiredPort() can
+ * fall back for the badge and proxy.
+ */
+it('requires a template port for HTTP compose services that omit SERVICE_*_PORT', function () {
+    $templates = get_service_templates();
+    $missing = [];
+
+    foreach (glob(base_path('templates/compose/*.{yaml,yml}'), GLOB_BRACE) as $file) {
+        $name = pathinfo($file, PATHINFO_FILENAME);
+        if (! $templates->has($name)) {
+            continue;
+        }
+
+        $text = file_get_contents($file);
+        $declaresHttpUrlWithoutPort = false;
+        foreach (preg_split("/\r\n|\n|\r/", $text) as $line) {
+            $line = trim($line);
+            if (! preg_match('/^- SERVICE_(?:URL|FQDN)_([A-Z0-9_]+)$/', $line, $match)
+                && ! preg_match('/^SERVICE_(?:URL|FQDN)_([A-Z0-9_]+):/', $line, $match)) {
+                continue;
+            }
+            if (! preg_match('/_\d+$/', $match[1])) {
+                $declaresHttpUrlWithoutPort = true;
+                break;
+            }
+        }
+
+        if (! $declaresHttpUrlWithoutPort) {
+            continue;
+        }
+
+        $yamlPort = null;
+        if (preg_match('/^#\s*port:\s*(\d+)/m', $text, $portMatch)) {
+            $yamlPort = $portMatch[1];
+        }
+        $jsonPort = data_get($templates, "{$name}.port");
+
+        if (! $yamlPort || ! filled($jsonPort)) {
+            $missing[] = $name;
+        }
+    }
+
+    expect($missing)->toBeEmpty('HTTP templates without SERVICE_*_PORT need # port: and JSON port: '.implode(', ', $missing));
+});
diff --git a/tests/Feature/ServiceTemplatePortLookupTest.php b/tests/Feature/ServiceTemplatePortLookupTest.php
new file mode 100644
index 000000000..1e228811d
--- /dev/null
+++ b/tests/Feature/ServiceTemplatePortLookupTest.php
@@ -0,0 +1,27 @@
+<?php
+
+use App\Models\Service;
+use App\Models\ServiceApplication;
+
+it('resolves the wordpress template port from service_type even when the display name differs', function () {
+    expect(data_get(get_service_templates(), 'wordpress-without-database.port'))->toBe('80');
+
+    $service = new Service([
+        'name' => 'api-smoke-wp',
+        'service_type' => 'wordpress-without-database',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  wordpress:
+    image: wordpress:latest
+    environment:
+      - SERVICE_URL_WORDPRESS
+YAML,
+    ]);
+
+    expect($service->getRequiredPort())->toBe(80);
+
+    $app = new ServiceApplication(['name' => 'wordpress']);
+    $app->setRelation('service', $service);
+
+    expect($app->getRequiredPort())->toBe(80);
+});
diff --git a/tests/Unit/DockerComposeLabelParsingTest.php b/tests/Unit/DockerComposeLabelParsingTest.php
index a2a3c0883..7f3c18c1e 100644
--- a/tests/Unit/DockerComposeLabelParsingTest.php
+++ b/tests/Unit/DockerComposeLabelParsingTest.php
@@ -29,6 +29,14 @@
         ->toContain('$removedLabel = (string) collect($removedLabel)->first();');
 });
 
+it('falls back to the template port for service application proxy labels', function () {
+    $sharedFile = file_get_contents(__DIR__.'/../../bootstrap/helpers/shared.php');
+
+    expect($sharedFile)->toContain(
+        '? ($savedService->getRequiredPort() ?? $predefinedPort)'
+    );
+});
+
 it('verifies label parsing array check occurs before preg_match', function () {
     // Read the parseDockerComposeFile function from shared.php
     $sharedFile = file_get_contents(__DIR__.'/../../bootstrap/helpers/shared.php');
diff --git a/tests/Unit/DomainPortOverridesTest.php b/tests/Unit/DomainPortOverridesTest.php
new file mode 100644
index 000000000..42345e5df
--- /dev/null
+++ b/tests/Unit/DomainPortOverridesTest.php
@@ -0,0 +1,36 @@
+<?php
+
+use App\Support\DomainPortOverrides;
+
+it('copies the source port override to an automatically paired domain', function (string $source, string $counterpart) {
+    $result = DomainPortOverrides::normalize(
+        "$source,$counterpart",
+        [$source => 8080],
+    );
+
+    expect($result['overrides'])->toBe([
+        $source => 8080,
+        $counterpart => 8080,
+    ]);
+})->with([
+    'www redirect' => ['https://example.com', 'https://www.example.com'],
+    'non-www redirect' => ['https://www.example.com', 'https://example.com'],
+]);
+
+it('keeps an explicit override on the paired domain', function (string $source, string $counterpart) {
+    $result = DomainPortOverrides::normalize(
+        "$source,$counterpart",
+        [
+            $source => 8080,
+            $counterpart => 9090,
+        ],
+    );
+
+    expect($result['overrides'])->toBe([
+        $source => 8080,
+        $counterpart => 9090,
+    ]);
+})->with([
+    'www redirect' => ['https://example.com', 'https://www.example.com'],
+    'non-www redirect' => ['https://www.example.com', 'https://example.com'],
+]);
diff --git a/tests/Unit/FqdnLabelsNoindexTest.php b/tests/Unit/FqdnLabelsNoindexTest.php
index 332d54898..49e9a6e8f 100644
--- a/tests/Unit/FqdnLabelsNoindexTest.php
+++ b/tests/Unit/FqdnLabelsNoindexTest.php
@@ -232,3 +232,55 @@ function middlewaresOf(array $labels, string $router): array
         )->all())->toBeEmpty();
     });
 });
+
+test('fqdnLabelsForCaddy routes each portless domain to its override port', function () {
+    $labels = fqdnLabelsForCaddy(
+        network: 'testnetwork',
+        uuid: 'appuuid',
+        domains: collect(['https://one.example.com', 'https://two.example.com']),
+        onlyPort: 80,
+        is_force_https_enabled: true,
+        domainPortOverrides: [
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ],
+    )->values()->all();
+
+    expect($labels)
+        ->toContain('caddy_0=https://one.example.com')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 3000}}')
+        ->toContain('caddy_1=https://two.example.com')
+        ->toContain('caddy_1.handle_path.1_reverse_proxy={{upstreams 8080}}')
+        ->not->toContain('caddy_0=https://one.example.com:3000')
+        ->not->toContain('caddy_1=https://two.example.com:8080');
+});
+
+test('fqdnLabelsForCaddy uses onlyPort when a portless domain has no override', function () {
+    $labels = fqdnLabelsForCaddy(
+        network: 'testnetwork',
+        uuid: 'appuuid',
+        domains: collect(['https://plain.example.com']),
+        onlyPort: 4000,
+        is_force_https_enabled: true,
+        domainPortOverrides: [],
+    )->values()->all();
+
+    expect($labels)
+        ->toContain('caddy_0=https://plain.example.com')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 4000}}');
+});
+
+test('fqdnLabelsForCaddy keeps routing a legacy port-bearing FQDN without an override map', function () {
+    $labels = fqdnLabelsForCaddy(
+        network: 'testnetwork',
+        uuid: 'appuuid',
+        domains: collect(['https://legacy.example.com:9090']),
+        onlyPort: 80,
+        is_force_https_enabled: true,
+        domainPortOverrides: [],
+    )->values()->all();
+
+    expect($labels)
+        ->toContain('caddy_0=https://legacy.example.com')
+        ->toContain('caddy_0.handle_path.0_reverse_proxy={{upstreams 9090}}');
+});
diff --git a/tests/Unit/ServiceRequiredPortTest.php b/tests/Unit/ServiceRequiredPortTest.php
index 6ef5bf030..f6a7d7638 100644
--- a/tests/Unit/ServiceRequiredPortTest.php
+++ b/tests/Unit/ServiceRequiredPortTest.php
@@ -198,6 +198,47 @@
     expect($result)->toBe(3000);
 });
 
+it('falls back to the one-click template port when SERVICE_URL has no port suffix', function () {
+    $yaml = <<<'YAML'
+services:
+  wordpress:
+    environment:
+      - SERVICE_URL_WORDPRESS
+      - WORDPRESS_DB_HOST=mysql
+YAML;
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->docker_compose_raw = $yaml;
+    $service->shouldReceive('getRequiredPort')->andReturn(80);
+
+    $app = Mockery::mock(ServiceApplication::class)->makePartial();
+    $app->name = 'wordpress';
+    $app->shouldReceive('getAttribute')->with('service')->andReturn($service);
+    $app->service = $service;
+
+    expect($app->getRequiredPort())->toBe(80);
+});
+
+it('does not apply the template port to a container without SERVICE_URL or SERVICE_FQDN', function () {
+    $yaml = <<<'YAML'
+services:
+  mysql:
+    environment:
+      - MYSQL_DATABASE=wordpress
+YAML;
+
+    $service = Mockery::mock(Service::class)->makePartial();
+    $service->docker_compose_raw = $yaml;
+    $service->shouldReceive('getRequiredPort')->andReturn(80);
+
+    $app = Mockery::mock(ServiceApplication::class)->makePartial();
+    $app->name = 'mysql';
+    $app->shouldReceive('getAttribute')->with('service')->andReturn($service);
+    $app->service = $service;
+
+    expect($app->getRequiredPort())->toBeNull();
+});
+
 it('returns null for map-style environment without port', function () {
     $yaml = <<<'YAML'
 services:
diff --git a/tests/Unit/TraefikServiceNameSegmentTest.php b/tests/Unit/TraefikServiceNameSegmentTest.php
index ef882961e..2a639d76d 100644
--- a/tests/Unit/TraefikServiceNameSegmentTest.php
+++ b/tests/Unit/TraefikServiceNameSegmentTest.php
@@ -107,3 +107,49 @@
     expect($labels)
         ->toContain('traefik.http.middlewares.0-application-uuid-to-www.redirectregex.replacement=${1}://www.${2}');
 });
+
+test('fqdnLabelsForTraefik routes each portless domain to its override port', function () {
+    $labels = fqdnLabelsForTraefik(
+        uuid: 'appuuid',
+        domains: collect(['https://one.example.com', 'https://two.example.com']),
+        onlyPort: 80,
+        domainPortOverrides: [
+            'https://one.example.com' => 3000,
+            'https://two.example.com' => 8080,
+        ],
+    );
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-appuuid.rule=Host(`one.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-appuuid.loadbalancer.server.port=3000')
+        ->toContain('traefik.http.routers.https-1-appuuid.rule=Host(`two.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-1-appuuid.loadbalancer.server.port=8080')
+        ->not->toContain('Host(`one.example.com:3000`)')
+        ->not->toContain('Host(`two.example.com:8080`)');
+});
+
+test('fqdnLabelsForTraefik uses onlyPort when a portless domain has no override', function () {
+    $labels = fqdnLabelsForTraefik(
+        uuid: 'appuuid',
+        domains: collect(['https://plain.example.com']),
+        onlyPort: 4000,
+        domainPortOverrides: [],
+    );
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-appuuid.rule=Host(`plain.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-appuuid.loadbalancer.server.port=4000');
+});
+
+test('fqdnLabelsForTraefik keeps routing a legacy port-bearing FQDN without an override map', function () {
+    $labels = fqdnLabelsForTraefik(
+        uuid: 'appuuid',
+        domains: collect(['https://legacy.example.com:9090']),
+        onlyPort: 80,
+        domainPortOverrides: [],
+    );
+
+    expect($labels)
+        ->toContain('traefik.http.routers.https-0-appuuid.rule=Host(`legacy.example.com`) && PathPrefix(`/`)')
+        ->toContain('traefik.http.services.https-0-appuuid.loadbalancer.server.port=9090');
+});
diff --git a/tests/Unit/ValidationPatternsTest.php b/tests/Unit/ValidationPatternsTest.php
index c0591cb6a..21145c5e7 100644
--- a/tests/Unit/ValidationPatternsTest.php
+++ b/tests/Unit/ValidationPatternsTest.php
@@ -224,3 +224,17 @@
         ->and(ValidationPatterns::validateApplicationDomains('https://localhost'))->not->toBeEmpty()
         ->and(ValidationPatterns::validateApplicationDomains('http://192.0.2.10:8000'))->toBeEmpty();
 });
+
+it('rejects application domain ports outside the valid TCP range', function (string $domain) {
+    expect(ValidationPatterns::validateApplicationDomains($domain))->not->toBeEmpty();
+})->with([
+    'zero' => 'https://example.com:0',
+    'above maximum' => 'https://example.com:65536',
+]);
+
+it('accepts application domain ports at the TCP range boundaries', function (string $domain) {
+    expect(ValidationPatterns::validateApplicationDomains($domain))->toBeEmpty();
+})->with([
+    'minimum' => 'https://example.com:1',
+    'maximum' => 'https://example.com:65535',
+]);

From b8866b87e8e855e041c21330352ca615521afed3 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Wed, 2 Sep 2026 19:58:28 +0200
Subject: [PATCH 30/55] fix(livewire): authorize exposed resource mutations
 (#11596)

---
 app/Livewire/Project/Application/General.php  |  2 +
 app/Livewire/Project/Database/Heading.php     |  6 ++
 .../Shared/EnvironmentVariable/Show.php       |  2 +
 app/Livewire/Project/Shared/GetLogs.php       |  7 +++
 app/Livewire/Security/CloudInitScripts.php    |  2 +
 .../Security/CloudProviderTokenForm.php       |  1 +
 app/Livewire/Server/ValidateAndInstall.php    | 10 ++++
 .../ApplicationConfigAuthorizationTest.php    | 58 +++++++++++++++++++
 .../DatabaseConfigAuthorizationTest.php       | 16 ++++-
 .../SecurityAuthorizationTest.php             | 57 ++++++++++++++++++
 .../Authorization/ServerAuthorizationTest.php | 19 ++++++
 11 files changed, 179 insertions(+), 1 deletion(-)
 create mode 100644 tests/Feature/Authorization/SecurityAuthorizationTest.php

diff --git a/app/Livewire/Project/Application/General.php b/app/Livewire/Project/Application/General.php
index bb6bcf5f5..8f0bb2385 100644
--- a/app/Livewire/Project/Application/General.php
+++ b/app/Livewire/Project/Application/General.php
@@ -651,6 +651,8 @@ public function generateNginxConfiguration($type = 'static')
 
     public function resetDefaultLabels($manualReset = false)
     {
+        $this->authorize('update', $this->application);
+
         try {
             if (! $this->isContainerLabelReadonlyEnabled && ! $manualReset) {
                 return;
diff --git a/app/Livewire/Project/Database/Heading.php b/app/Livewire/Project/Database/Heading.php
index 943f22702..f2f8fa387 100644
--- a/app/Livewire/Project/Database/Heading.php
+++ b/app/Livewire/Project/Database/Heading.php
@@ -35,6 +35,12 @@ public function getListeners()
 
     public function activityFinished()
     {
+        if (auth()->user()->cannot('update', $this->database)) {
+            $this->dispatch('refresh');
+
+            return;
+        }
+
         try {
             // Only set started_at if database is actually running
             if ($this->database->isRunning()) {
diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
index 0e0851aaa..8350cffa4 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/Show.php
@@ -145,6 +145,8 @@ public function refresh()
      */
     public function loadValues(): void
     {
+        $this->authorize('update', $this->env);
+
         if ($this->valuesLoaded) {
             return;
         }
diff --git a/app/Livewire/Project/Shared/GetLogs.php b/app/Livewire/Project/Shared/GetLogs.php
index 67a040ef7..e1e541371 100644
--- a/app/Livewire/Project/Shared/GetLogs.php
+++ b/app/Livewire/Project/Shared/GetLogs.php
@@ -17,12 +17,15 @@
 use App\Models\StandalonePostgresql;
 use App\Models\StandaloneRedis;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Process;
 use Livewire\Attributes\Locked;
 use Livewire\Component;
 
 class GetLogs extends Component
 {
+    use AuthorizesRequests;
+
     public const MAX_LOG_LINES = 50000;
 
     public const MAX_DISPLAY_SIZE_BYTES = 5 * 1024 * 1024;
@@ -82,6 +85,10 @@ public function mount()
     public function instantSave()
     {
         if (! is_null($this->resource)) {
+            if (auth()->user()->cannot('update', $this->resource)) {
+                return;
+            }
+
             if ($this->resource->getMorphClass() === Application::class) {
                 $this->resource->settings->is_include_timestamps = $this->showTimeStamps;
                 $this->resource->settings->save();
diff --git a/app/Livewire/Security/CloudInitScripts.php b/app/Livewire/Security/CloudInitScripts.php
index b6d448e90..0d26d1d66 100644
--- a/app/Livewire/Security/CloudInitScripts.php
+++ b/app/Livewire/Security/CloudInitScripts.php
@@ -28,6 +28,8 @@ public function getListeners()
 
     public function loadScripts()
     {
+        $this->authorize('viewAny', CloudInitScript::class);
+
         CloudInitScript::ownedByCurrentTeam()
             ->whereNull('uuid')
             ->get()
diff --git a/app/Livewire/Security/CloudProviderTokenForm.php b/app/Livewire/Security/CloudProviderTokenForm.php
index ba2655b43..2c31d2203 100644
--- a/app/Livewire/Security/CloudProviderTokenForm.php
+++ b/app/Livewire/Security/CloudProviderTokenForm.php
@@ -94,6 +94,7 @@ private function validateToken(string $provider, string $token): bool
 
     public function addToken()
     {
+        $this->authorize('create', CloudProviderToken::class);
         $this->validate();
 
         try {
diff --git a/app/Livewire/Server/ValidateAndInstall.php b/app/Livewire/Server/ValidateAndInstall.php
index c39f868ba..db62bff2d 100644
--- a/app/Livewire/Server/ValidateAndInstall.php
+++ b/app/Livewire/Server/ValidateAndInstall.php
@@ -53,6 +53,8 @@ class ValidateAndInstall extends Component
 
     public function init(int $data = 0)
     {
+        $this->authorize('update', $this->server);
+
         if (! $this->server->canBeValidated()) {
             $this->error = 'This server was transferred to another Coolify instance and cannot be revalidated here.';
             $this->server->update([
@@ -160,6 +162,8 @@ public function validateConnection()
 
     public function validateOS()
     {
+        $this->authorize('update', $this->server);
+
         $this->supported_os_type = $this->server->validateOS();
         if (! $this->supported_os_type) {
             $this->error = 'Server OS type is not supported. Please install Docker manually before continuing: <a target="_blank" class="underline" href="https://docs.docker.com/engine/install/#server">documentation</a>.';
@@ -174,6 +178,8 @@ public function validateOS()
 
     public function validatePrerequisites()
     {
+        $this->authorize('update', $this->server);
+
         $validationResult = $this->server->validatePrerequisites();
         $this->prerequisites_installed = $validationResult['success'];
         if (! $validationResult['success']) {
@@ -212,6 +218,8 @@ public function validatePrerequisites()
 
     public function validateDockerEngine()
     {
+        $this->authorize('update', $this->server);
+
         $this->docker_installed = $this->server->validateDockerEngine();
         $this->docker_compose_installed = $this->server->validateDockerCompose();
         if (! $this->docker_installed || ! $this->docker_compose_installed) {
@@ -248,6 +256,8 @@ public function validateDockerEngine()
 
     public function validateDockerVersion()
     {
+        $this->authorize('update', $this->server);
+
         if ($this->server->isSwarm()) {
             $swarmInstalled = $this->server->validateDockerSwarm();
             if ($swarmInstalled) {
diff --git a/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php b/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php
index 584276990..eb331a775 100644
--- a/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php
+++ b/tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php
@@ -1,8 +1,11 @@
 <?php
 
 use App\Livewire\Project\Application\Advanced as ApplicationAdvanced;
+use App\Livewire\Project\Application\General as ApplicationGeneral;
 use App\Livewire\Project\Application\Heading as ApplicationHeading;
 use App\Livewire\Project\Application\Rollback as ApplicationRollback;
+use App\Livewire\Project\Shared\EnvironmentVariable\Show as EnvironmentVariableShow;
+use App\Livewire\Project\Shared\GetLogs;
 use App\Models\Application;
 use App\Models\InstanceSettings;
 use App\Models\Project;
@@ -10,6 +13,7 @@
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
@@ -169,6 +173,60 @@
     expect($this->member->can('update', $this->application))->toBeFalse();
 });
 
+test('member cannot reset application labels', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $originalLabels = $this->application->custom_labels;
+
+    $component = app(ApplicationGeneral::class);
+    $component->application = $this->application;
+    $component->isContainerLabelReadonlyEnabled = true;
+
+    expect(fn () => $component->resetDefaultLabels(true))
+        ->toThrow(AuthorizationException::class);
+
+    expect($this->application->fresh()->custom_labels)->toBe($originalLabels);
+});
+
+test('member cannot load application environment variable values', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $environmentVariable = $this->application->environment_variables()->create([
+        'key' => 'SECRET_KEY',
+        'value' => 'super-secret-value',
+        'is_preview' => false,
+    ]);
+
+    Livewire::test(EnvironmentVariableShow::class, [
+        'env' => $environmentVariable,
+        'type' => 'application',
+    ])
+        ->call('loadValues')
+        ->assertForbidden()
+        ->assertSet('valuesLoaded', false)
+        ->assertSet('value', null);
+});
+
+test('member cannot save application log timestamp settings', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $originalValue = $this->application->settings->is_include_timestamps;
+
+    Livewire::test(GetLogs::class, [
+        'resource' => $this->application,
+        'server' => $this->server,
+        'container' => $this->application->uuid,
+    ])
+        ->set('showTimeStamps', ! $originalValue)
+        ->call('instantSave')
+        ->assertSuccessful();
+
+    expect($this->application->settings->fresh()->is_include_timestamps)->toBe($originalValue);
+});
+
 // --- Application Advanced Livewire actions ---
 
 test('member cannot save application advanced settings', function () {
diff --git a/tests/Feature/Authorization/DatabaseConfigAuthorizationTest.php b/tests/Feature/Authorization/DatabaseConfigAuthorizationTest.php
index 89c3d5e2f..7807f00a2 100644
--- a/tests/Feature/Authorization/DatabaseConfigAuthorizationTest.php
+++ b/tests/Feature/Authorization/DatabaseConfigAuthorizationTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Livewire\Project\Database\Heading;
 use App\Models\InstanceSettings;
 use App\Models\Project;
 use App\Models\Server;
@@ -10,11 +11,12 @@
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Str;
+use Livewire\Livewire;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::updateOrCreate(['id' => 0]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
 
     $this->team = Team::factory()->create();
 
@@ -89,6 +91,18 @@
     expect($this->member->can('update', $this->database))->toBeFalse();
 });
 
+test('member cannot persist database activity status', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(Heading::class, ['database' => $this->database])
+        ->call('activityFinished')
+        ->assertSuccessful()
+        ->assertDispatched('refresh');
+
+    expect($this->database->fresh()->started_at)->toBeNull();
+});
+
 // --- Database Policy: delete ---
 
 test('admin can delete database', function () {
diff --git a/tests/Feature/Authorization/SecurityAuthorizationTest.php b/tests/Feature/Authorization/SecurityAuthorizationTest.php
new file mode 100644
index 000000000..b36bcc3e4
--- /dev/null
+++ b/tests/Feature/Authorization/SecurityAuthorizationTest.php
@@ -0,0 +1,57 @@
+<?php
+
+use App\Livewire\Security\CloudInitScripts;
+use App\Livewire\Security\CloudProviderTokenForm;
+use App\Models\CloudInitScript;
+use App\Models\CloudProviderToken;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+});
+
+test('member cannot create a cloud provider token through the public action', function () {
+    Http::fake(['*' => Http::response([], 200)]);
+
+    Livewire::test(CloudProviderTokenForm::class)
+        ->set('provider', 'hetzner')
+        ->set('token', 'secret-token')
+        ->set('name', 'Unauthorized token')
+        ->call('addToken')
+        ->assertForbidden();
+
+    expect(CloudProviderToken::query()->count())->toBe(0);
+});
+
+test('member cannot load cloud-init scripts through the public action', function () {
+    $script = CloudInitScript::query()->create([
+        'team_id' => $this->team->id,
+        'name' => 'Protected script',
+        'script' => '#cloud-config',
+    ]);
+
+    CloudInitScript::query()->whereKey($script)->update(['uuid' => null]);
+
+    $component = app(CloudInitScripts::class);
+
+    expect(fn () => $component->loadScripts())
+        ->toThrow(AuthorizationException::class);
+
+    expect($script->refresh()->uuid)->toBeNull();
+});
diff --git a/tests/Feature/Authorization/ServerAuthorizationTest.php b/tests/Feature/Authorization/ServerAuthorizationTest.php
index 63e15be2f..353c6a687 100644
--- a/tests/Feature/Authorization/ServerAuthorizationTest.php
+++ b/tests/Feature/Authorization/ServerAuthorizationTest.php
@@ -5,6 +5,7 @@
 use App\Livewire\Server\Index as ServerIndex;
 use App\Livewire\Server\LogDrains;
 use App\Livewire\Server\Navbar as ServerNavbar;
+use App\Livewire\Server\ValidateAndInstall;
 use App\Models\CloudProviderToken;
 use App\Models\InstanceSettings;
 use App\Models\Server;
@@ -61,6 +62,24 @@
     expect($this->member->can('update', $this->server))->toBeFalse();
 });
 
+test('member cannot invoke server validation write steps', function (string $method) {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+    $before = $this->server->fresh()->getAttributes();
+
+    Livewire::test(ValidateAndInstall::class, ['server' => $this->server])
+        ->call($method)
+        ->assertForbidden();
+
+    expect($this->server->fresh()->getAttributes())->toBe($before);
+})->with([
+    'init',
+    'validateOS',
+    'validatePrerequisites',
+    'validateDockerEngine',
+    'validateDockerVersion',
+]);
+
 // --- Server Policy: delete ---
 
 test('admin can delete server', function () {

From a1a2d7551cd81c804b425126100630604755a25e Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Thu, 3 Sep 2026 17:05:06 +0200
Subject: [PATCH 31/55] chore(deps): cleanup version constraint

---
 composer.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/composer.json b/composer.json
index 871c6f010..416b5e8f6 100644
--- a/composer.json
+++ b/composer.json
@@ -21,7 +21,7 @@
         "laravel/mcp": "^0.6.7",
         "laravel/nightwatch": "^1.28.6",
         "laravel/pail": "^1.2.7",
-        "laravel/prompts": "^0.3.22|^0.3.22|^0.3.22",
+        "laravel/prompts": "^0.3.22",
         "laravel/sanctum": "^4.3.3",
         "laravel/socialite": "^5.29.0",
         "laravel/tinker": "^2.11.1",

From ba19435af32ebb76b9ef06184fb433175b631659 Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Thu, 3 Sep 2026 17:05:35 +0200
Subject: [PATCH 32/55] fix: update livewire to fix wire:dirty reactivity

---
 composer.lock | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/composer.lock b/composer.lock
index c2c42ba71..e5718b31b 100644
--- a/composer.lock
+++ b/composer.lock
@@ -3644,16 +3644,16 @@
         },
         {
             "name": "livewire/livewire",
-            "version": "v3.8.3",
+            "version": "v3.8.7",
             "source": {
                 "type": "git",
                 "url": "https://github.com/livewire/livewire.git",
-                "reference": "ab9c2ac9305008aa9ab0f1beecec8ed6c3a591b2"
+                "reference": "ff019f8f6f48b7a2315922e45a70ad8fd75d1934"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/livewire/livewire/zipball/ab9c2ac9305008aa9ab0f1beecec8ed6c3a591b2",
-                "reference": "ab9c2ac9305008aa9ab0f1beecec8ed6c3a591b2",
+                "url": "https://api.github.com/repos/livewire/livewire/zipball/ff019f8f6f48b7a2315922e45a70ad8fd75d1934",
+                "reference": "ff019f8f6f48b7a2315922e45a70ad8fd75d1934",
                 "shasum": ""
             },
             "require": {
@@ -3708,7 +3708,7 @@
             "description": "A front-end framework for Laravel.",
             "support": {
                 "issues": "https://github.com/livewire/livewire/issues",
-                "source": "https://github.com/livewire/livewire/tree/v3.8.3"
+                "source": "https://github.com/livewire/livewire/tree/v3.8.7"
             },
             "funding": [
                 {
@@ -3716,7 +3716,7 @@
                     "type": "github"
                 }
             ],
-            "time": "2026-07-31T00:08:18+00:00"
+            "time": "2026-08-31T15:40:46+00:00"
         },
         {
             "name": "log1x/laravel-webfonts",

From 2fc73bc357ab864401c1bd3b99a5a9bfccc034a9 Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Thu, 3 Sep 2026 17:23:17 +0200
Subject: [PATCH 33/55] fix(ux): show api token description inline

---
 resources/views/livewire/security/api-tokens.blade.php | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/resources/views/livewire/security/api-tokens.blade.php b/resources/views/livewire/security/api-tokens.blade.php
index 38db6aa3a..acc36f526 100644
--- a/resources/views/livewire/security/api-tokens.blade.php
+++ b/resources/views/livewire/security/api-tokens.blade.php
@@ -107,9 +107,13 @@ class="listbox-panel top-full! mt-1! w-full!" role="listbox">
             @endcan
 
             @if (session()->has('token'))
-                <x-application.settings-section title="Copy your token"
-                    description="This value will not be shown again after you leave this page.">
-                    <x-forms.copy-button :text="session('token')" />
+                <x-application.settings-section title="Copy your token">
+                    <div class="flex flex-col gap-3">
+                        <p class="text-sm text-neutral-500 dark:text-fg-dim">
+                            This value will not be shown again after you leave this page.
+                        </p>
+                        <x-forms.copy-button :text="session('token')" />
+                    </div>
                 </x-application.settings-section>
             @endif
 

From 76414296a6eb2bff60e5969e4ef02e35b11d1922 Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Thu, 3 Sep 2026 18:12:06 +0200
Subject: [PATCH 34/55] fix(ui): typo on storage delete modal (#11541)

---
 app/Livewire/Project/Service/FileStorage.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/Livewire/Project/Service/FileStorage.php b/app/Livewire/Project/Service/FileStorage.php
index d6ab2ac15..cd209f6ae 100644
--- a/app/Livewire/Project/Service/FileStorage.php
+++ b/app/Livewire/Project/Service/FileStorage.php
@@ -308,10 +308,10 @@ public function render()
     {
         return view('livewire.project.service.file-storage', [
             'directoryDeletionCheckboxes' => [
-                ['id' => 'permanently_delete', 'label' => 'The selected directory and all its contents will be permantely deleted form the server.'],
+                ['id' => 'permanently_delete', 'label' => 'The selected directory and all its contents will be permanently deleted from the server.'],
             ],
             'fileDeletionCheckboxes' => [
-                ['id' => 'permanently_delete', 'label' => 'The selected file will be permanently deleted form the server.'],
+                ['id' => 'permanently_delete', 'label' => 'The selected file will be permanently deleted from the server.'],
             ],
             'hostFileDeletionCheckboxes' => [
                 ['id' => 'permanently_delete', 'label' => 'Only the mount configuration will be removed. The host file will not be deleted.'],

From 45466b50695f231851c83fcd57c5dd0a9606e547 Mon Sep 17 00:00:00 2001
From: Devin Dissanayaka <dsdissanayaka2002@gmail.com>
Date: Thu, 3 Sep 2026 22:05:07 +0530
Subject: [PATCH 35/55] fix(notifications): send traefik outdated alerts to the
 correct topic id (#11526)

---
 .../Channels/TelegramChannel.php              |  3 +-
 .../TelegramNotificationThreadRoutingTest.php | 89 +++++++++++++++++++
 2 files changed, 91 insertions(+), 1 deletion(-)
 create mode 100644 tests/Feature/TelegramNotificationThreadRoutingTest.php

diff --git a/app/Notifications/Channels/TelegramChannel.php b/app/Notifications/Channels/TelegramChannel.php
index 4f311bf68..a52feda08 100644
--- a/app/Notifications/Channels/TelegramChannel.php
+++ b/app/Notifications/Channels/TelegramChannel.php
@@ -17,6 +17,7 @@
 use App\Notifications\Server\HighDiskUsage;
 use App\Notifications\Server\Reachable;
 use App\Notifications\Server\ServerPatchCheck;
+use App\Notifications\Server\TraefikVersionOutdated;
 use App\Notifications\Server\Unreachable;
 
 class TelegramChannel
@@ -50,7 +51,7 @@ public function send($notifiable, $notification): void
             Unreachable::class => $settings->telegram_notifications_server_unreachable_thread_id,
             Reachable::class => $settings->telegram_notifications_server_reachable_thread_id,
             ServerPatchCheck::class => $settings->telegram_notifications_server_patch_thread_id,
-
+            TraefikVersionOutdated::class => $settings->telegram_notifications_traefik_outdated_thread_id,
             default => null,
         };
 
diff --git a/tests/Feature/TelegramNotificationThreadRoutingTest.php b/tests/Feature/TelegramNotificationThreadRoutingTest.php
new file mode 100644
index 000000000..474d2b157
--- /dev/null
+++ b/tests/Feature/TelegramNotificationThreadRoutingTest.php
@@ -0,0 +1,89 @@
+<?php
+
+use App\Jobs\SendMessageToTelegramJob;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Notifications\Channels\TelegramChannel;
+use App\Notifications\Server\ServerPatchCheck;
+use App\Notifications\Server\TraefikVersionOutdated;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->team->telegramNotificationSettings->update([
+        'telegram_enabled' => true,
+        'telegram_token' => 'test-token',
+        'telegram_chat_id' => '-1001234567890',
+    ]);
+
+    Queue::fake();
+});
+
+function telegramTestServer(Team $team): Server
+{
+    return Server::factory()->make([
+        'name' => 'Test Server',
+        'uuid' => 'test-uuid',
+        'team_id' => $team->id,
+    ]);
+}
+
+function outdatedTraefikServer(Team $team): Server
+{
+    $server = telegramTestServer($team);
+
+    $server->outdatedInfo = [
+        'current' => '3.5.0',
+        'latest' => '3.5.6',
+        'type' => 'patch_update',
+    ];
+
+    return $server;
+}
+
+it('sends the traefik outdated notification to its configured topic', function () {
+    $this->team->telegramNotificationSettings->update([
+        'telegram_notifications_traefik_outdated_thread_id' => '42',
+    ]);
+
+    $notification = new TraefikVersionOutdated(collect([outdatedTraefikServer($this->team)]));
+
+    (new TelegramChannel)->send($this->team->fresh(), $notification);
+
+    Queue::assertPushed(
+        SendMessageToTelegramJob::class,
+        fn (SendMessageToTelegramJob $job) => $job->threadId === '42'
+    );
+});
+
+it('sends the server patch notification to its configured topic', function () {
+    $this->team->telegramNotificationSettings->update([
+        'telegram_notifications_server_patch_thread_id' => '7',
+    ]);
+
+    $notification = new ServerPatchCheck(telegramTestServer($this->team), ['total_updates' => 3]);
+
+    (new TelegramChannel)->send($this->team->fresh(), $notification);
+
+    Queue::assertPushed(
+        SendMessageToTelegramJob::class,
+        fn (SendMessageToTelegramJob $job) => $job->threadId === '7'
+    );
+});
+
+it('falls back to the main chat when no topic is configured', function () {
+    $notification = new TraefikVersionOutdated(collect([outdatedTraefikServer($this->team)]));
+
+    (new TelegramChannel)->send($this->team->fresh(), $notification);
+
+    Queue::assertPushed(
+        SendMessageToTelegramJob::class,
+        fn (SendMessageToTelegramJob $job) => $job->threadId === null
+    );
+});

From 1d0d6b4a79f3280584ffb57409bdc4e309cb7dd0 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 3 Sep 2026 19:23:08 +0200
Subject: [PATCH 36/55] fix(scheduler): run stuck resource cleanup in
 background at 03:17

Bump the Coolify release version to 4.3.16 and update schedule coverage.
---
 app/Console/Kernel.php                     | 5 +++--
 config/constants.php                       | 2 +-
 other/nightly/versions.json                | 2 +-
 tests/Feature/ScheduleOnOneServerTest.php  | 8 +++++---
 tests/Unit/ProductionImageWorkflowTest.php | 4 ++--
 versions.json                              | 2 +-
 6 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/app/Console/Kernel.php b/app/Console/Kernel.php
index 8d4d017c8..8eb010b8a 100644
--- a/app/Console/Kernel.php
+++ b/app/Console/Kernel.php
@@ -47,9 +47,10 @@ protected function schedule(Schedule $schedule): void
             ->when(fn () => config('constants.ssh.mux_enabled') && ! config('constants.coolify.is_windows_docker_desktop'));
         $this->scheduleInstance->command('cleanup:redis --clear-locks')->daily();
         $this->scheduleInstance->command('cleanup:stucked-resources')
-            ->daily()
+            ->dailyAt('03:17')
             ->onOneServer()
-            ->withoutOverlapping(60);
+            ->withoutOverlapping(60)
+            ->runInBackground();
         $this->scheduleInstance->command('sanctum:prune-expired --hours=1')->hourly()->onOneServer();
         $this->scheduleInstance->job(new ApiTokenExpirationWarningJob)->hourly()->onOneServer();
 
diff --git a/config/constants.php b/config/constants.php
index 457a8a1ff..d2e2a9f33 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.15',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.16',
         'helper_version' => '1.0.16',
         'realtime_version' => '1.0.18',
         'railpack_version' => '0.23.0',
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index 455918fdc..a3a660f9c 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.15"
+            "version": "4.3.16"
         },
         "nightly": {
             "version": "4.4-rc.1"
diff --git a/tests/Feature/ScheduleOnOneServerTest.php b/tests/Feature/ScheduleOnOneServerTest.php
index ef2d80e64..3ad380863 100644
--- a/tests/Feature/ScheduleOnOneServerTest.php
+++ b/tests/Feature/ScheduleOnOneServerTest.php
@@ -59,7 +59,7 @@
     expect($event)->toBeNull();
 });
 
-it('schedules stuck resource cleanup once per day on one server', function () {
+it('schedules stuck resource cleanup in the background once per day', function () {
     $schedule = app(Schedule::class);
 
     $event = collect($schedule->events())->first(
@@ -67,6 +67,8 @@
     );
 
     expect($event)->not->toBeNull()
-        ->and($event->expression)->toBe('0 0 * * *')
-        ->and($event->onOneServer)->toBeTrue();
+        ->and($event->expression)->toBe('17 3 * * *')
+        ->and($event->onOneServer)->toBeTrue()
+        ->and($event->withoutOverlapping)->toBeTrue()
+        ->and($event->runInBackground)->toBeTrue();
 });
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index 293c9422e..4e6229d07 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,8 +23,8 @@
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.15'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.15')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.16'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.16')
         ->and($versions['coolify']['nightly']['version'])->toBe('4.4-rc.1')
         ->and($nightlyVersions)->toBe($versions);
 });
diff --git a/versions.json b/versions.json
index 455918fdc..a3a660f9c 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.15"
+            "version": "4.3.16"
         },
         "nightly": {
             "version": "4.4-rc.1"

From 986ece457d4e13304c30a6f81c27717ac800280b Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 3 Sep 2026 20:38:19 +0200
Subject: [PATCH 37/55] fix(domains): use Compose service ports for internal
 routing

Detect Docker Compose service ports for domain internal ports and proxy labels, with application ports as a fallback.
---
 app/Livewire/Project/Application/Domains.php  | 12 +++++-
 .../Project/Application/PreviewDomains.php    | 12 +++++-
 bootstrap/helpers/docker.php                  | 33 +++++++++++++++
 bootstrap/helpers/parsers.php                 |  2 +-
 bootstrap/helpers/shared.php                  |  2 +-
 tests/Feature/ApplicationDomainsTest.php      | 42 +++++++++++++++++++
 ...licationParserDockerComposeDomainsTest.php | 32 ++++++++++++++
 7 files changed, 129 insertions(+), 6 deletions(-)

diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index 9f1e7fc17..d7797935f 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -500,7 +500,7 @@ protected function domainRowFromStored(string $url, ?string $service, array $sto
     {
         $key = $this->domainDnsStatusKey($url, $service);
         $entry = $stored[$key] ?? null;
-        $port = $this->effectiveDomainInternalPort($url);
+        $port = $this->effectiveDomainInternalPort($url, $service);
 
         $row = [
             'url' => $url,
@@ -532,7 +532,7 @@ protected function domainRowFromStored(string $url, ?string $service, array $sto
     /**
      * @return array{internal_port: ?int, has_port_override: bool}
      */
-    protected function effectiveDomainInternalPort(string $url): array
+    protected function effectiveDomainInternalPort(string $url, ?string $service = null): array
     {
         $canonical = DomainPortOverrides::withoutPort($url);
         $overrides = $this->application->domain_port_overrides ?? [];
@@ -561,6 +561,14 @@ protected function effectiveDomainInternalPort(string $url): array
             ];
         }
 
+        $composePort = dockerComposeServicePort($this->application->docker_compose_raw, $service);
+        if ($composePort !== null) {
+            return [
+                'internal_port' => $composePort,
+                'has_port_override' => false,
+            ];
+        }
+
         $exposed = $this->application->ports_exposes_array;
         $defaultPort = isset($exposed[0]) && is_numeric($exposed[0]) && (int) $exposed[0] > 0
             ? (int) $exposed[0]
diff --git a/app/Livewire/Project/Application/PreviewDomains.php b/app/Livewire/Project/Application/PreviewDomains.php
index 21296978f..e6e9f5d60 100644
--- a/app/Livewire/Project/Application/PreviewDomains.php
+++ b/app/Livewire/Project/Application/PreviewDomains.php
@@ -439,7 +439,7 @@ private function validatedDomain(array $parts, string $errorKey): ?string
     private function makeRow(string $url, ?string $service, array $statuses = []): array
     {
         $status = $statuses[$this->statusKey($url, $service)] ?? [];
-        $port = $this->effectiveDomainInternalPort($url);
+        $port = $this->effectiveDomainInternalPort($url, $service);
 
         return [
             'url' => $url,
@@ -500,7 +500,7 @@ private function openPortWarning(?int $port, string $action): void
     /**
      * @return array{internal_port: ?int, has_port_override: bool}
      */
-    private function effectiveDomainInternalPort(string $url): array
+    private function effectiveDomainInternalPort(string $url, ?string $service = null): array
     {
         $canonical = DomainPortOverrides::withoutPort($url);
         $overrides = $this->preview->domain_port_overrides ?? [];
@@ -529,6 +529,14 @@ private function effectiveDomainInternalPort(string $url): array
             ];
         }
 
+        $composePort = dockerComposeServicePort($this->preview->application->docker_compose_raw, $service);
+        if ($composePort !== null) {
+            return [
+                'internal_port' => $composePort,
+                'has_port_override' => false,
+            ];
+        }
+
         $exposed = $this->preview->application->ports_exposes_array;
         $defaultPort = isset($exposed[0]) && is_numeric($exposed[0]) && (int) $exposed[0] > 0
             ? (int) $exposed[0]
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index f80fccafb..84232a8d7 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -601,6 +601,39 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
     return $labels->sort();
 }
 
+function firstDockerComposeServicePort(mixed $service): ?int
+{
+    $portDefinitions = collect(data_get($service, 'expose', []))
+        ->merge(data_get($service, 'ports', []));
+
+    foreach ($portDefinitions as $definition) {
+        $port = is_array($definition)
+            ? data_get($definition, 'target')
+            : str((string) $definition)->before('/')->afterLast(':')->value();
+
+        if (is_numeric($port) && (int) $port >= 1 && (int) $port <= 65535) {
+            return (int) $port;
+        }
+    }
+
+    return null;
+}
+
+function dockerComposeServicePort(?string $compose, ?string $serviceName): ?int
+{
+    if (blank($compose) || blank($serviceName)) {
+        return null;
+    }
+
+    try {
+        $services = data_get(Yaml::parse($compose), 'services', []);
+    } catch (Throwable) {
+        return null;
+    }
+
+    return firstDockerComposeServicePort(is_array($services) ? ($services[$serviceName] ?? null) : null);
+}
+
 function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $escape_redirect_replacement_for_compose = true, array $domainPortOverrides = [])
 {
     $labels = collect([]);
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index f65b62698..590b68d16 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -1358,7 +1358,7 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                 ? ($previewForPorts?->domain_port_overrides ?? [])
                 : ($originalResource->domain_port_overrides ?? []);
             $exposedPorts = $originalResource->settings->is_static ? [80] : $originalResource->ports_exposes_array;
-            $onlyPort = count($exposedPorts) > 0 ? $exposedPorts[0] : null;
+            $onlyPort = firstDockerComposeServicePort($service) ?? ($exposedPorts[0] ?? null);
             if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
                 $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
             }
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index 9f18c466d..f9bf44dff 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -3916,7 +3916,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                             ? ($resource->domain_port_overrides ?? [])
                             : ($preview?->domain_port_overrides ?? []);
                         $exposedPorts = $resource->settings->is_static ? [80] : $resource->ports_exposes_array;
-                        $onlyPort = count($exposedPorts) > 0 ? $exposedPorts[0] : null;
+                        $onlyPort = firstDockerComposeServicePort($service) ?? ($exposedPorts[0] ?? null);
                         if ($shouldGenerateLabelsExactly) {
                             switch ($server->proxyType()) {
                                 case ProxyTypes::TRAEFIK->value:
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index 9d0739d1c..19dca7966 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -2311,6 +2311,48 @@
         ->assertDontSee('Custom internal port for this domain', false);
 });
 
+it('shows the detected compose service port as the inherited internal port', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    expose:\n      - '8069'\n",
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://example.com'],
+        ]),
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+    ]);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('domainRows.0.internal_port', 8069)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->assertSee('Internal port 8069')
+        ->assertDontSee('Internal port 3000');
+});
+
+it('shows the detected compose service port for preview domains', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => "services:\n  web:\n    image: nginx:alpine\n    ports:\n      - '18069:8069'\n",
+    ]);
+
+    $preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 8069,
+        'pull_request_html_url' => 'https://github.com/coollabsio/coolify/pull/8069',
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://preview.example.com'],
+        ]),
+    ]);
+
+    Livewire::test(PreviewDomains::class, ['preview' => $preview])
+        ->assertSet('domainRows.0.internal_port', 8069)
+        ->assertSet('domainRows.0.has_port_override', false)
+        ->assertSee('Internal port 8069')
+        ->assertDontSee('Internal port 3000');
+});
+
 it('keeps a legacy port-bearing url port in the edit field as an internal port override', function () {
     $this->application->update([
         'ports_exposes' => '3000,8080',
diff --git a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
index 0c40d4a86..30305ef59 100644
--- a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
+++ b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
@@ -599,3 +599,35 @@ function disableExactProxyLabels(Application $application): Application
         ->and($labels->contains(fn (string $label): bool => str_contains($label, 'Host(`frontend.example.com`)')))
         ->toBeTrue();
 });
+
+test('applicationParser compose labels prefer the service exposed port over application ports_exposes', function (string $portConfiguration) {
+    $application = disableExactProxyLabels(Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'build_pack' => 'dockercompose',
+        'ports_exposes' => '3000',
+        'docker_compose_raw' => <<<YAML
+services:
+  frontend:
+    image: myapp/frontend:latest
+{$portConfiguration}
+YAML,
+        'fqdn' => null,
+        'domain_port_overrides' => null,
+        'docker_compose_domains' => json_encode([
+            'frontend' => ['domain' => 'https://frontend.example.com'],
+        ]),
+    ]));
+
+    $labels = collect(data_get(applicationParser($application->fresh()), 'services.frontend.labels'));
+
+    expect($labels->contains(fn (string $label): bool => str_ends_with($label, '.loadbalancer.server.port=8069')))
+        ->toBeTrue()
+        ->and($labels->contains(fn (string $label): bool => str_contains($label, 'reverse_proxy={{upstreams 8069}}')))
+        ->toBeTrue();
+})->with([
+    'expose' => "    expose:\n      - '8069'",
+    'short port syntax' => "    ports:\n      - '18069:8069'",
+    'long port syntax' => "    ports:\n      - target: 8069\n        published: 18069",
+]);

From d0b77b26375a94e0e5e530d8312d6d23b63c453b Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 3 Sep 2026 21:51:53 +0200
Subject: [PATCH 38/55] chore(release): bump Coolify version to 4.3.17

---
 config/constants.php                       | 2 +-
 other/nightly/versions.json                | 2 +-
 tests/Unit/ProductionImageWorkflowTest.php | 4 ++--
 versions.json                              | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index d2e2a9f33..7ad0c4594 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.16',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.17',
         'helper_version' => '1.0.16',
         'realtime_version' => '1.0.18',
         'railpack_version' => '0.23.0',
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index a3a660f9c..0e83c0cf7 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.16"
+            "version": "4.3.17"
         },
         "nightly": {
             "version": "4.4-rc.1"
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index 4e6229d07..140a6276f 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,8 +23,8 @@
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.16'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.16')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.17'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.17')
         ->and($versions['coolify']['nightly']['version'])->toBe('4.4-rc.1')
         ->and($nightlyVersions)->toBe($versions);
 });
diff --git a/versions.json b/versions.json
index a3a660f9c..0e83c0cf7 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.16"
+            "version": "4.3.17"
         },
         "nightly": {
             "version": "4.4-rc.1"

From 89a66dd255262f9a105dc9d4007c8aefe9f8456a Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 06:30:35 +0200
Subject: [PATCH 39/55] fix(service): show disabled deploy action when
 variables are missing

---
 .../views/livewire/project/service/heading.blade.php   |  6 ++++++
 tests/Feature/ResourceHeadingUnifiedNavbarTest.php     | 10 +++++++++-
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index e7da50c80..79899e879 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -188,6 +188,12 @@ class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="me
                 </div>
                 @endcan
             @else
+                @can('deploy', $service)
+                    <button type="button" class="button mb-2 w-full justify-between" disabled>
+                        <span>Deploy</span>
+                        <span class="text-xs font-normal opacity-70">Fill required variables first</span>
+                    </button>
+                @endcan
                 <a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
                     class="mb-3 inline-flex" aria-label="Open required environment variables">
                     <x-status-badge status="Required variables missing" type="error" />
diff --git a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
index 330afa7ed..ce69f26ef 100644
--- a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
+++ b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
@@ -84,11 +84,19 @@
 
 it('links the service header missing variables warning to environment variables', function () {
     $heading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
+    $mobileActions = str($heading)
+        ->after('<div class="w-full xl:hidden">')
+        ->before("@teleport('#resource-action-hud-slot')")
+        ->toString();
 
     expect($heading)
         ->toContain("route('project.service.environment-variables'")
         ->toContain('Required variables missing')
-        ->toContain('href="{{ $environmentVariablesUrl }}"');
+        ->toContain('href="{{ $environmentVariablesUrl }}"')
+        ->and($mobileActions)
+        ->toContain('Fill required variables first')
+        ->toContain('disabled')
+        ->toContain('Deploy');
 });
 
 it('places the account menu beside the desktop sidebar toggle while retaining it on mobile', function () {

From 6abbf84520bdfc245c3346661fd6b7fd1b50e113 Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:43:07 +0200
Subject: [PATCH 40/55] fix(notifications): build api token expiry notification
 link from the instance url

---
 app/Notifications/ApiTokenExpiringNotification.php |  2 +-
 tests/Feature/ApiTokenExpirationWarningTest.php    | 13 +++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/app/Notifications/ApiTokenExpiringNotification.php b/app/Notifications/ApiTokenExpiringNotification.php
index 451dd312a..40bd3ead0 100644
--- a/app/Notifications/ApiTokenExpiringNotification.php
+++ b/app/Notifications/ApiTokenExpiringNotification.php
@@ -21,7 +21,7 @@ public function __construct(public PersonalAccessToken $token)
         $this->onQueue('high');
         $this->tokenName = $token->name;
         $this->expiresAt = $token->expires_at?->format('Y-m-d H:i:s') ?? '';
-        $this->manageUrl = route('security.api-tokens');
+        $this->manageUrl = base_url().'/security/api-tokens';
     }
 
     public function via(object $notifiable): array
diff --git a/tests/Feature/ApiTokenExpirationWarningTest.php b/tests/Feature/ApiTokenExpirationWarningTest.php
index 92c207607..a6bbffbbc 100644
--- a/tests/Feature/ApiTokenExpirationWarningTest.php
+++ b/tests/Feature/ApiTokenExpirationWarningTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Jobs\ApiTokenExpirationWarningJob;
+use App\Models\InstanceSettings;
 use App\Models\PersonalAccessToken;
 use App\Models\Team;
 use App\Models\User;
@@ -14,6 +15,7 @@
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0]);
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
     $this->team->members()->attach($this->user->id, ['role' => 'owner']);
@@ -137,4 +139,15 @@ function createTokenExpiring(User $user, Team $team, ?Carbon $expiresAt, ?Carbon
         Notification::assertNothingSent();
         expect($token->fresh()->api_token_expiration_warning_sent_at)->toBeNull();
     });
+
+    test('manage url uses the instance fqdn when configured', function () {
+        InstanceSettings::query()->update(['fqdn' => 'https://coolify.example.com']);
+        $token = createTokenExpiring($this->user, $this->team, Carbon::now()->addHours(12));
+
+        $notification = new ApiTokenExpiringNotification($token);
+
+        expect($notification->toSlack()->description)
+            ->toContain('https://coolify.example.com/security/api-tokens')
+            ->not->toContain('localhost');
+    });
 });

From 306d4833a99f58cb2931b2f35628e9fe9989a0ca Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:45:40 +0200
Subject: [PATCH 41/55] fix(notifications): build restart limit links from the
 instance url

---
 .../Application/RestartLimitReached.php       | 22 ++++++---
 ...pplicationStoppedAfterRestartLimitTest.php | 49 +++++++++++++++----
 2 files changed, 55 insertions(+), 16 deletions(-)

diff --git a/app/Notifications/Application/RestartLimitReached.php b/app/Notifications/Application/RestartLimitReached.php
index 687fd3086..de9de1f98 100644
--- a/app/Notifications/Application/RestartLimitReached.php
+++ b/app/Notifications/Application/RestartLimitReached.php
@@ -2,8 +2,11 @@
 
 namespace App\Notifications\Application;
 
+use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\BaseModel;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
 use App\Notifications\CustomEmailNotification;
 use App\Notifications\Dto\DiscordMessage;
 use App\Notifications\Dto\PushoverMessage;
@@ -49,14 +52,19 @@ public function __construct(public BaseModel $resource)
         if (str($this->fqdn)->explode(',')->count() > 1) {
             $this->fqdn = str($this->fqdn)->explode(',')->first();
         }
-        $service = data_get($resource, 'service');
-        $this->resource_url = match (true) {
-            method_exists($this->resource, 'link') => $this->resource->link(),
-            $resource instanceof ApplicationPreview => $resource->application->link(),
-            is_object($service) && method_exists($service, 'link') => $service->link(),
-            default => null,
+        $this->resource_url = $this->resolveResourceUrl($resource);
+    }
+
+    private function resolveResourceUrl(BaseModel $resource): string
+    {
+        [$type, $uuid] = match (true) {
+            $resource instanceof Application => ['application', $resource->uuid],
+            $resource instanceof ApplicationPreview => ['application', $resource->application->uuid],
+            $resource instanceof ServiceApplication, $resource instanceof ServiceDatabase => ['service', $resource->service->uuid],
+            default => ['database', $resource->uuid],
         };
-        $this->resource_url ??= base_url()."/project/{$this->project_uuid}/environment/{$this->environment_uuid}";
+
+        return base_url()."/project/{$this->project_uuid}/environment/{$this->environment_uuid}/{$type}/{$uuid}";
     }
 
     public function via(object $notifiable): array
diff --git a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
index 3e6e04629..58ebb8c70 100644
--- a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
+++ b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
@@ -6,10 +6,21 @@
 use App\Models\Application;
 use App\Models\ApplicationPreview;
 use App\Models\BaseModel;
+use App\Models\InstanceSettings;
 use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\StandalonePostgresql;
 use App\Notifications\Application\RestartLimitReached;
+use Illuminate\Foundation\Testing\RefreshDatabase;
 use Mockery\MockInterface;
 
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::forceCreate(['id' => 0, 'fqdn' => 'https://coolify.test']);
+});
+
 function applicationWithRestartState(array $attributes = []): Application
 {
     $application = new Application;
@@ -161,14 +172,8 @@ function applicationWithRestartState(array $attributes = []): Application
         ->and($sentinelJob)->toContain('if ($application->stoppedAfterRestartLimit() && $containerStatuses->every(');
 });
 
-it('uses the application link for restart limit notifications', function () {
-    $application = new class extends Application
-    {
-        public function link()
-        {
-            return 'https://coolify.test/project/link-from-model';
-        }
-    };
+it('builds restart limit notification urls from the instance base url', function () {
+    $application = new Application;
     $application->forceFill([
         'name' => 'crashy-app',
         'uuid' => 'application-uuid',
@@ -183,7 +188,33 @@ public function link()
 
     $notification = new RestartLimitReached($application);
 
-    expect($notification->resource_url)->toBe('https://coolify.test/project/link-from-model');
+    expect($notification->resource_url)->toBe('https://coolify.test/project/project-uuid/environment/environment-uuid/application/application-uuid');
+});
+
+it('links preview, service resource and database restart limit notifications to their pages', function () {
+    $environment = (object) ['uuid' => 'environment-uuid', 'name' => 'production', 'project' => (object) ['uuid' => 'project-uuid']];
+
+    $application = new Application;
+    $application->forceFill(['name' => 'app', 'uuid' => 'application-uuid']);
+    $application->setRelation('environment', $environment);
+    $preview = new ApplicationPreview;
+    $preview->forceFill(['uuid' => 'preview-uuid', 'pull_request_id' => 42, 'restart_count' => 2, 'max_restart_count' => 2]);
+    $preview->setRelation('application', $application);
+
+    $service = new Service;
+    $service->forceFill(['uuid' => 'service-uuid']);
+    $service->setRelation('environment', $environment);
+    $serviceApplication = new ServiceApplication;
+    $serviceApplication->forceFill(['name' => 'database', 'uuid' => 'service-application-uuid', 'restart_count' => 2, 'max_restart_count' => 2]);
+    $serviceApplication->setRelation('service', $service);
+
+    $database = new StandalonePostgresql;
+    $database->forceFill(['name' => 'postgres', 'uuid' => 'database-uuid', 'restart_count' => 2, 'max_restart_count' => 2]);
+    $database->setRelation('environment', $environment);
+
+    expect((new RestartLimitReached($preview))->resource_url)->toBe('https://coolify.test/project/project-uuid/environment/environment-uuid/application/application-uuid')
+        ->and((new RestartLimitReached($serviceApplication))->resource_url)->toBe('https://coolify.test/project/project-uuid/environment/environment-uuid/service/service-uuid')
+        ->and((new RestartLimitReached($database))->resource_url)->toBe('https://coolify.test/project/project-uuid/environment/environment-uuid/database/database-uuid');
 });
 
 it('uses the resolved environment project name in Slack restart limit notifications', function () {

From 85ec70643f4a5960b5ccce694b8de7b5425a563c Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 14:48:16 +0200
Subject: [PATCH 42/55] refactor(notifications): build scheduled task links
 from the instance url

- replace the taskLink() helpers on Application and Service with links built from base_url() in the task notifications
---
 app/Models/Application.php                    | 26 ------------------
 app/Models/Service.php                        | 27 -------------------
 .../ScheduledTask/TaskFailed.php              |  9 ++++---
 .../ScheduledTask/TaskSuccess.php             |  9 ++++---
 4 files changed, 10 insertions(+), 61 deletions(-)

diff --git a/app/Models/Application.php b/app/Models/Application.php
index f8eb75a5a..6bfbb6de7 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -621,32 +621,6 @@ public function stoppedAfterRestartLimit(): bool
             && $this->restart_limit_reached === true;
     }
 
-    public function taskLink($task_uuid)
-    {
-        if (data_get($this, 'environment.project.uuid')) {
-            $route = route('project.application.scheduled-tasks', [
-                'project_uuid' => data_get($this, 'environment.project.uuid'),
-                'environment_uuid' => data_get($this, 'environment.uuid'),
-                'application_uuid' => data_get($this, 'uuid'),
-                'task_uuid' => $task_uuid,
-            ]);
-            $settings = instanceSettings();
-            if (data_get($settings, 'fqdn')) {
-                $url = Url::fromString($route);
-                $url = $url->withPort(null);
-                $fqdn = data_get($settings, 'fqdn');
-                $fqdn = str_replace(['http://', 'https://'], '', $fqdn);
-                $url = $url->withHost($fqdn);
-
-                return $url->__toString();
-            }
-
-            return $route;
-        }
-
-        return null;
-    }
-
     public function settings()
     {
         return $this->hasOne(ApplicationSetting::class);
diff --git a/app/Models/Service.php b/app/Models/Service.php
index 66c67ca8d..1e6a33ad6 100644
--- a/app/Models/Service.php
+++ b/app/Models/Service.php
@@ -15,7 +15,6 @@
 use Illuminate\Support\Facades\Storage;
 use OpenApi\Attributes as OA;
 use Spatie\Activitylog\Models\Activity;
-use Spatie\Url\Url;
 use Symfony\Component\Yaml\Yaml;
 
 #[OA\Schema(
@@ -1463,32 +1462,6 @@ public function link()
         return null;
     }
 
-    public function taskLink($task_uuid)
-    {
-        if (data_get($this, 'environment.project.uuid')) {
-            $route = route('project.service.scheduled-tasks', [
-                'project_uuid' => data_get($this, 'environment.project.uuid'),
-                'environment_uuid' => data_get($this, 'environment.uuid'),
-                'service_uuid' => data_get($this, 'uuid'),
-                'task_uuid' => $task_uuid,
-            ]);
-            $settings = InstanceSettings::get();
-            if (data_get($settings, 'fqdn')) {
-                $url = Url::fromString($route);
-                $url = $url->withPort(null);
-                $fqdn = data_get($settings, 'fqdn');
-                $fqdn = str_replace(['http://', 'https://'], '', $fqdn);
-                $url = $url->withHost($fqdn);
-
-                return $url->__toString();
-            }
-
-            return $route;
-        }
-
-        return null;
-    }
-
     public function documentation()
     {
         $services = get_service_templates();
diff --git a/app/Notifications/ScheduledTask/TaskFailed.php b/app/Notifications/ScheduledTask/TaskFailed.php
index bd060112a..2ca3874ba 100644
--- a/app/Notifications/ScheduledTask/TaskFailed.php
+++ b/app/Notifications/ScheduledTask/TaskFailed.php
@@ -2,6 +2,7 @@
 
 namespace App\Notifications\ScheduledTask;
 
+use App\Models\Application;
 use App\Models\ScheduledTask;
 use App\Notifications\CustomEmailNotification;
 use App\Notifications\Dto\DiscordMessage;
@@ -16,10 +17,10 @@ class TaskFailed extends CustomEmailNotification
     public function __construct(public ScheduledTask $task, public string $output)
     {
         $this->onQueue('high');
-        if ($task->application) {
-            $this->url = $task->application->taskLink($task->uuid);
-        } elseif ($task->service) {
-            $this->url = $task->service->taskLink($task->uuid);
+        $resource = $task->application ?? $task->service;
+        if ($resource) {
+            $type = $resource instanceof Application ? 'application' : 'service';
+            $this->url = base_url().'/project/'.data_get($resource, 'environment.project.uuid').'/environment/'.data_get($resource, 'environment.uuid')."/{$type}/{$resource->uuid}/tasks/{$task->uuid}";
         }
     }
 
diff --git a/app/Notifications/ScheduledTask/TaskSuccess.php b/app/Notifications/ScheduledTask/TaskSuccess.php
index 58c959bd8..2978eaed3 100644
--- a/app/Notifications/ScheduledTask/TaskSuccess.php
+++ b/app/Notifications/ScheduledTask/TaskSuccess.php
@@ -2,6 +2,7 @@
 
 namespace App\Notifications\ScheduledTask;
 
+use App\Models\Application;
 use App\Models\ScheduledTask;
 use App\Notifications\CustomEmailNotification;
 use App\Notifications\Dto\DiscordMessage;
@@ -16,10 +17,10 @@ class TaskSuccess extends CustomEmailNotification
     public function __construct(public ScheduledTask $task, public string $output)
     {
         $this->onQueue('high');
-        if ($task->application) {
-            $this->url = $task->application->taskLink($task->uuid);
-        } elseif ($task->service) {
-            $this->url = $task->service->taskLink($task->uuid);
+        $resource = $task->application ?? $task->service;
+        if ($resource) {
+            $type = $resource instanceof Application ? 'application' : 'service';
+            $this->url = base_url().'/project/'.data_get($resource, 'environment.project.uuid').'/environment/'.data_get($resource, 'environment.uuid')."/{$type}/{$resource->uuid}/tasks/{$task->uuid}";
         }
     }
 

From 0eb9d5e5a8952552d8a81bb8472bf4207035776d Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:07:26 +0200
Subject: [PATCH 43/55] fix(notifications): urls for ssl renewal notifications

---
 app/Jobs/RegenerateSslCertJob.php             |  5 ++-
 .../SslExpirationNotification.php             | 37 ++-----------------
 2 files changed, 7 insertions(+), 35 deletions(-)

diff --git a/app/Jobs/RegenerateSslCertJob.php b/app/Jobs/RegenerateSslCertJob.php
index 6f49cf30b..ed2d1c454 100644
--- a/app/Jobs/RegenerateSslCertJob.php
+++ b/app/Jobs/RegenerateSslCertJob.php
@@ -66,7 +66,10 @@ public function handle()
                     caCert: $caCert->ssl_certificate,
                     caKey: $caCert->ssl_private_key,
                 );
-                $regenerated->push($certificate);
+                $resource = $certificate->database;
+                if ($resource) {
+                    $regenerated->push($resource);
+                }
             } catch (\Exception $e) {
                 Log::error('Failed to regenerate SSL certificate: '.$e->getMessage());
             }
diff --git a/app/Notifications/SslExpirationNotification.php b/app/Notifications/SslExpirationNotification.php
index 78e1e8be9..023031ddd 100644
--- a/app/Notifications/SslExpirationNotification.php
+++ b/app/Notifications/SslExpirationNotification.php
@@ -7,7 +7,6 @@
 use App\Notifications\Dto\SlackMessage;
 use Illuminate\Notifications\Messages\MailMessage;
 use Illuminate\Support\Collection;
-use Spatie\Url\Url;
 
 class SslExpirationNotification extends CustomEmailNotification
 {
@@ -19,39 +18,9 @@ public function __construct(array|Collection $resources)
     {
         $this->onQueue('high');
         $this->resources = collect($resources);
-
-        // Collect URLs for each resource
-        $this->resources->each(function ($resource) {
-            if (data_get($resource, 'environment.project.uuid')) {
-                $routeName = match ($resource->type()) {
-                    'application' => 'project.application.configuration',
-                    'database' => 'project.database.configuration',
-                    'service' => 'project.service.configuration',
-                    default => null
-                };
-
-                if ($routeName) {
-                    $route = route($routeName, [
-                        'project_uuid' => data_get($resource, 'environment.project.uuid'),
-                        'environment_uuid' => data_get($resource, 'environment.uuid'),
-                        $resource->type().'_uuid' => data_get($resource, 'uuid'),
-                    ]);
-
-                    $settings = instanceSettings();
-                    if (data_get($settings, 'fqdn')) {
-                        $url = Url::fromString($route);
-                        $url = $url->withPort(null);
-                        $fqdn = data_get($settings, 'fqdn');
-                        $fqdn = str_replace(['http://', 'https://'], '', $fqdn);
-                        $url = $url->withHost($fqdn);
-
-                        $this->urls[$resource->name] = $url->__toString();
-                    } else {
-                        $this->urls[$resource->name] = $route;
-                    }
-                }
-            }
-        });
+        $this->urls = $this->resources->mapWithKeys(fn ($resource) => [
+            $resource->name => base_url().'/project/'.data_get($resource, 'environment.project.uuid').'/environment/'.data_get($resource, 'environment.uuid')."/database/{$resource->uuid}",
+        ])->all();
     }
 
     public function via(object $notifiable): array

From 94995c2a0e8d60ee4adbcb71aab0ff9ecf5855d2 Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:08:08 +0200
Subject: [PATCH 44/55] fix(deployments): build deployment log links from the
 instance url

---
 app/Jobs/ApplicationDeploymentJob.php | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index 88036f519..01a365a0c 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -2362,12 +2362,8 @@ private function deploy_to_additional_destinations()
                 destination: $destination,
                 no_questions_asked: true,
             );
-            $this->application_deployment_queue->addLogEntry("Deployment to {$server->name}. Logs: ".route('project.application.deployment.show', [
-                'project_uuid' => data_get($this->application, 'environment.project.uuid'),
-                'application_uuid' => data_get($this->application, 'uuid'),
-                'deployment_uuid' => $deployment_uuid,
-                'environment_uuid' => data_get($this->application, 'environment.uuid'),
-            ]));
+            $deployment_url = base_url().'/project/'.data_get($this->application, 'environment.project.uuid').'/environment/'.data_get($this->application, 'environment.uuid').'/application/'.data_get($this->application, 'uuid')."/deployment/{$deployment_uuid}";
+            $this->application_deployment_queue->addLogEntry("Deployment to {$server->name}. Logs: {$deployment_url}");
         }
     }
 

From 51cab061be1cda01b9b0708979f7e6a51abd333f Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:19:21 +0200
Subject: [PATCH 45/55] fix(domains): sync Docker Compose domains for noindex
 settings

---
 app/Traits/HasNoindexDomains.php         | 11 ++++++++++-
 tests/Feature/ApplicationDomainsTest.php | 22 ++++++++++++++++++++++
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/app/Traits/HasNoindexDomains.php b/app/Traits/HasNoindexDomains.php
index 7afe0d4f2..f3858cc61 100644
--- a/app/Traits/HasNoindexDomains.php
+++ b/app/Traits/HasNoindexDomains.php
@@ -58,7 +58,16 @@ public function syncNoindexDomains(): void
 
     private function currentDomains(): Collection
     {
-        return collect(ValidationPatterns::applicationDomainList($this->fqdn))
+        $domains = collect(ValidationPatterns::applicationDomainList($this->fqdn));
+        $composeDomains = json_decode((string) ($this->getAttributes()['docker_compose_domains'] ?? null), true);
+
+        if (is_array($composeDomains)) {
+            foreach ($composeDomains as $entry) {
+                $domains->push(...ValidationPatterns::applicationDomainList(composeDomainEntryString($entry)));
+            }
+        }
+
+        return $domains
             ->map(fn (string $domain) => $this->normalizeNoindexDomain($domain));
     }
 
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index 19dca7966..a13b5fdbf 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -2066,6 +2066,28 @@
         ->toBe(['https://staging.example.com']);
 });
 
+it('updates search engine indexing for a git docker compose domain', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'fqdn' => null,
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://compose.example.com'],
+        ]),
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->call('toggleNoindexDomain', 'https://compose.example.com', 'noindex')
+        ->assertDispatched('configurationChanged')
+        ->assertDispatched('success');
+
+    expect($this->application->refresh()->noindexDomains()->all())
+        ->toBe(['https://compose.example.com']);
+
+    $component->call('toggleNoindexDomain', 'https://compose.example.com', 'index');
+
+    expect($this->application->refresh()->noindexDomains()->all())->toBe([]);
+});
+
 it('keeps noindex domains when normalizing a custom domain port', function () {
     $this->application->update([
         'fqdn' => 'https://staging.example.com:8080',

From 8dc35e2b5fe958086dcba6acca79847c8efcf9a3 Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:27:24 +0200
Subject: [PATCH 46/55] fix: TypeError when adding a new scheduled task

---
 app/Livewire/Project/Shared/ScheduledTask/Add.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/app/Livewire/Project/Shared/ScheduledTask/Add.php b/app/Livewire/Project/Shared/ScheduledTask/Add.php
index f170a0a6f..717007bc0 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Add.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Add.php
@@ -102,7 +102,7 @@ public function submit()
         }
     }
 
-    private function saveScheduledTask(): mixed
+    private function saveScheduledTask(): void
     {
         try {
             $task = new ScheduledTask;
@@ -128,7 +128,7 @@ private function saveScheduledTask(): mixed
             $this->dispatch('refreshTasks');
             $this->dispatch('success', 'Scheduled task added.');
         } catch (\Throwable $e) {
-            return handleError($e, $this);
+            handleError($e, $this);
         }
     }
 

From 053b030c4280471d2b3867fa103da42575e4f10e Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:42:26 +0200
Subject: [PATCH 47/55] fix: remove database restart limits and clear stale
 Traefik state

Drop restart-limit fields and enforcement from database resources, clear cached Traefik version data when proxies change, and show missing service environment variables from disabled deploy actions.
---
 app/Actions/Database/StartDatabase.php        |  6 +-
 app/Actions/Database/StopDatabase.php         |  6 +-
 app/Actions/Docker/GetContainersStatus.php    | 20 ++---
 app/Actions/Service/StartService.php          |  1 -
 app/Actions/Service/StopService.php           |  1 -
 .../Service/StopServiceApplication.php        |  2 +-
 app/Jobs/CheckTraefikVersionForServerJob.php  | 12 ++-
 app/Jobs/CheckTraefikVersionJob.php           | 14 ++++
 app/Jobs/PushServerUpdateJob.php              | 25 ++----
 app/Livewire/Server/Proxy.php                 |  2 +
 app/Models/Server.php                         |  2 +
 app/Models/ServiceDatabase.php                |  3 +-
 app/Models/StandaloneClickhouse.php           |  3 +-
 app/Models/StandaloneDragonfly.php            |  3 +-
 app/Models/StandaloneKeydb.php                |  3 +-
 app/Models/StandaloneMariadb.php              |  3 +-
 app/Models/StandaloneMongodb.php              |  3 +-
 app/Models/StandaloneMysql.php                |  3 +-
 app/Models/StandalonePostgresql.php           |  3 +-
 app/Models/StandaloneRedis.php                |  3 +-
 ...7_remove_restart_limits_from_databases.php | 56 +++++++++++++
 .../restart-limit-warning.blade.php           |  2 +-
 .../project/service/heading.blade.php         | 53 +++++++++---
 .../Feature/AllResourceRestartLimitsTest.php  | 84 ++++++++++++++-----
 .../ResourceHeadingUnifiedNavbarTest.php      | 26 ++++--
 tests/Feature/TraefikVersionStateTest.php     | 82 +++++++++++++++++-
 tests/Unit/StopActionsPersistStatusTest.php   |  2 +-
 27 files changed, 326 insertions(+), 97 deletions(-)
 create mode 100644 database/migrations/2026_09_04_132827_remove_restart_limits_from_databases.php

diff --git a/app/Actions/Database/StartDatabase.php b/app/Actions/Database/StartDatabase.php
index 7735c77d8..cd7e08328 100644
--- a/app/Actions/Database/StartDatabase.php
+++ b/app/Actions/Database/StartDatabase.php
@@ -28,7 +28,11 @@ public function handle(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|St
         if (! $server->isFunctional()) {
             return 'Server is not functional';
         }
-        $database->resetRestartLimit();
+        $database->update([
+            'restart_count' => 0,
+            'last_restart_at' => null,
+            'last_restart_type' => null,
+        ]);
         switch ($database->getMorphClass()) {
             case StandalonePostgresql::class:
                 $activity = StartPostgresql::run($database);
diff --git a/app/Actions/Database/StopDatabase.php b/app/Actions/Database/StopDatabase.php
index f3c591acf..8005311b5 100644
--- a/app/Actions/Database/StopDatabase.php
+++ b/app/Actions/Database/StopDatabase.php
@@ -32,7 +32,11 @@ public function handle(StandaloneRedis|StandalonePostgresql|StandaloneMongodb|St
             // Reset restart tracking when database is manually stopped
             $database->update(['status' => 'exited']);
             if ($resetRestartCount) {
-                $database->resetRestartLimit();
+                $database->update([
+                    'restart_count' => 0,
+                    'last_restart_at' => null,
+                    'last_restart_type' => null,
+                ]);
             }
 
             if ($dockerCleanup) {
diff --git a/app/Actions/Docker/GetContainersStatus.php b/app/Actions/Docker/GetContainersStatus.php
index be098e481..c69bd1855 100644
--- a/app/Actions/Docker/GetContainersStatus.php
+++ b/app/Actions/Docker/GetContainersStatus.php
@@ -5,7 +5,6 @@
 use App\Actions\Application\StopApplication;
 use App\Actions\Application\StopApplicationPreview;
 use App\Actions\Database\StartDatabaseProxy;
-use App\Actions\Database\StopDatabase;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Actions\Service\StopServiceApplication;
 use App\Actions\Shared\ComplexStatusCheck;
@@ -249,9 +248,12 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
 
                             $database->update($updateData);
 
-                            if ($database->trackRestartCount((int) $restartCount)) {
-                                StopDatabase::dispatch($database, false, false, false);
-                                $database->team()?->notify(new ApplicationRestartLimitReached($database));
+                            if ($restartCount > ($database->restart_count ?? 0)) {
+                                $database->update([
+                                    'restart_count' => (int) $restartCount,
+                                    'last_restart_at' => now(),
+                                    'last_restart_type' => 'crash',
+                                ]);
                             }
 
                             if ($isPublic) {
@@ -357,7 +359,9 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
                 continue;
             }
 
-            if (! $exitedService->stoppedAfterRestartLimit()) {
+            if ($exitedService instanceof ServiceDatabase) {
+                $exitedService->update(['status' => 'exited']);
+            } elseif (! $exitedService->stoppedAfterRestartLimit()) {
                 $exitedService->update([
                     'status' => 'exited',
                     'restart_count' => 0,
@@ -424,9 +428,6 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
         $notRunningDatabases = $databases->pluck('id')->diff($foundDatabases);
         foreach ($notRunningDatabases as $database) {
             $database = $databases->where('id', $database)->first();
-            if ($database->stoppedAfterRestartLimit()) {
-                continue;
-            }
             if (str($database->status)->startsWith('exited')) {
                 continue;
             }
@@ -442,7 +443,6 @@ public function handle(Server $server, ?Collection $containers = null, ?Collecti
                 'restart_count' => 0,
                 'last_restart_at' => null,
                 'last_restart_type' => null,
-                'restart_limit_reached' => false,
             ]);
 
             // Stop proxy if database was public
@@ -582,7 +582,7 @@ private function aggregateServiceContainerStatuses($services)
             $restartCount = isset($this->serviceContainerRestartCounts)
                 ? ($this->serviceContainerRestartCounts->get($key)?->max() ?? 0)
                 : 0;
-            if ($subResource->trackRestartCount($restartCount)) {
+            if (! $subResource instanceof ServiceDatabase && $subResource->trackRestartCount($restartCount)) {
                 StopServiceApplication::dispatch($subResource, false, false);
                 $subResource->team()?->notify(new ApplicationRestartLimitReached($subResource));
 
diff --git a/app/Actions/Service/StartService.php b/app/Actions/Service/StartService.php
index 13371d126..3dc5c98b3 100644
--- a/app/Actions/Service/StartService.php
+++ b/app/Actions/Service/StartService.php
@@ -25,7 +25,6 @@ public function handle(Service $service, bool $pullLatestImages = false, bool $s
         $service->saveComposeConfigs();
         $service->isConfigurationChanged(save: true);
         $service->applications()->get()->each->resetRestartLimit();
-        $service->databases()->get()->each->resetRestartLimit();
         $workdir = $service->workdir();
         // $commands[] = "cd {$workdir}";
         $commands[] = "echo 'Saved configuration files to {$workdir}.'";
diff --git a/app/Actions/Service/StopService.php b/app/Actions/Service/StopService.php
index 341687d0d..52d9edda1 100644
--- a/app/Actions/Service/StopService.php
+++ b/app/Actions/Service/StopService.php
@@ -55,7 +55,6 @@ public function handle(Service $service, bool $deleteConnectedNetworks = false,
             });
             $dbs->each(function ($database): void {
                 $database->update(['status' => 'exited']);
-                $database->resetRestartLimit();
             });
 
             if ($deleteConnectedNetworks) {
diff --git a/app/Actions/Service/StopServiceApplication.php b/app/Actions/Service/StopServiceApplication.php
index fa93a7880..11ad337ed 100644
--- a/app/Actions/Service/StopServiceApplication.php
+++ b/app/Actions/Service/StopServiceApplication.php
@@ -30,7 +30,7 @@ public function handle(ServiceApplication|ServiceDatabase $serviceApplication, b
         instant_remote_process($commands, $server, throwError: ! $removeContainer);
 
         $serviceApplication->update(['status' => 'exited']);
-        if ($resetRestartCount) {
+        if ($resetRestartCount && $serviceApplication instanceof ServiceApplication) {
             $serviceApplication->resetRestartLimit();
         }
         ServiceStatusChanged::dispatch($service->environment->project->team->id);
diff --git a/app/Jobs/CheckTraefikVersionForServerJob.php b/app/Jobs/CheckTraefikVersionForServerJob.php
index 054a739bc..e56b93c9e 100644
--- a/app/Jobs/CheckTraefikVersionForServerJob.php
+++ b/app/Jobs/CheckTraefikVersionForServerJob.php
@@ -2,6 +2,8 @@
 
 namespace App\Jobs;
 
+use App\Enums\ProxyStatus;
+use App\Enums\ProxyTypes;
 use App\Events\ProxyStatusChangedUI;
 use App\Models\Server;
 use App\Notifications\Server\TraefikVersionOutdated;
@@ -33,8 +35,13 @@ public function __construct(
      */
     public function handle(): void
     {
+        $this->server->refresh();
         $this->clearOutdatedInfo();
 
+        if ($this->server->proxyType() !== ProxyTypes::TRAEFIK->value || $this->server->proxy->get('status') !== ProxyStatus::RUNNING->value) {
+            return;
+        }
+
         // Detect current version (makes SSH call)
         $currentVersion = getTraefikVersionFromDockerCompose($this->server);
 
@@ -116,7 +123,10 @@ public function handle(): void
 
     private function clearOutdatedInfo(): void
     {
-        $this->server->update(['traefik_outdated_info' => null]);
+        $this->server->update([
+            'detected_traefik_version' => null,
+            'traefik_outdated_info' => null,
+        ]);
     }
 
     /**
diff --git a/app/Jobs/CheckTraefikVersionJob.php b/app/Jobs/CheckTraefikVersionJob.php
index ac94aa23f..0a9eeba00 100644
--- a/app/Jobs/CheckTraefikVersionJob.php
+++ b/app/Jobs/CheckTraefikVersionJob.php
@@ -19,6 +19,20 @@ class CheckTraefikVersionJob implements ShouldBeEncrypted, ShouldQueue
 
     public function handle(): void
     {
+        Server::query()
+            ->where(function ($query) {
+                $query->whereNull('proxy')
+                    ->orWhere('proxy->type', '!=', ProxyTypes::TRAEFIK->value);
+            })
+            ->where(function ($query) {
+                $query->whereNotNull('detected_traefik_version')
+                    ->orWhereNotNull('traefik_outdated_info');
+            })
+            ->update([
+                'detected_traefik_version' => null,
+                'traefik_outdated_info' => null,
+            ]);
+
         // Load versions from cached data
         $traefikVersions = get_traefik_versions();
 
diff --git a/app/Jobs/PushServerUpdateJob.php b/app/Jobs/PushServerUpdateJob.php
index 0e73ee41b..ef83d1944 100644
--- a/app/Jobs/PushServerUpdateJob.php
+++ b/app/Jobs/PushServerUpdateJob.php
@@ -5,7 +5,6 @@
 use App\Actions\Application\StopApplication;
 use App\Actions\Application\StopApplicationPreview;
 use App\Actions\Database\StartDatabaseProxy;
-use App\Actions\Database\StopDatabase;
 use App\Actions\Database\StopDatabaseProxy;
 use App\Actions\Proxy\CheckProxy;
 use App\Actions\Proxy\StartProxy;
@@ -483,7 +482,7 @@ private function loadServices(): Collection
             ])
             ->with([
                 'applications:id,service_id,status,last_online_at,restart_count,max_restart_count,restart_limit_reached,last_restart_at,last_restart_type',
-                'databases:id,service_id,status,last_online_at,is_public,name,restart_count,max_restart_count,restart_limit_reached,last_restart_at,last_restart_type',
+                'databases:id,service_id,status,last_online_at,is_public,name',
             ])
             ->get();
     }
@@ -506,8 +505,6 @@ private function loadDatabases(): Collection
             'restart_count',
             'last_restart_at',
             'last_restart_type',
-            'max_restart_count',
-            'restart_limit_reached',
         ];
 
         return collect([
@@ -675,7 +672,7 @@ private function aggregateServiceContainerStatuses()
             }
 
             $restartCount = $this->serviceContainerRestartCounts->get($key)?->max() ?? 0;
-            if ($subResource->trackRestartCount($restartCount)) {
+            if (! $subResource instanceof ServiceDatabase && $subResource->trackRestartCount($restartCount)) {
                 StopServiceApplication::dispatch($subResource, false, false);
                 $subResource->team()?->notify(new ApplicationRestartLimitReached($subResource));
 
@@ -821,11 +818,12 @@ private function updateDatabaseStatus(string $databaseUuid, string $containerSta
             $database->status = $containerStatus;
             $database->save();
         }
-        if (is_numeric($restartCount) && $database->trackRestartCount((int) $restartCount)) {
-            StopDatabase::dispatch($database, false, false, false);
-            $database->team()?->notify(new ApplicationRestartLimitReached($database));
-
-            return;
+        if (is_numeric($restartCount) && $restartCount > ($database->restart_count ?? 0)) {
+            $database->update([
+                'restart_count' => (int) $restartCount,
+                'last_restart_at' => now(),
+                'last_restart_type' => 'crash',
+            ]);
         }
         if (! $this->isCompleteSnapshot()) {
             return;
@@ -883,16 +881,12 @@ private function updateNotFoundDatabaseStatus()
         $notFoundDatabaseUuids->each(function ($databaseUuid) {
             $database = $this->databasesByUuid->get($databaseUuid);
             if ($database) {
-                if ($database->stoppedAfterRestartLimit()) {
-                    return;
-                }
                 if (! str($database->status)->startsWith('exited')) {
                     $database->update([
                         'status' => 'exited',
                         'restart_count' => 0,
                         'last_restart_at' => null,
                         'last_restart_type' => null,
-                        'restart_limit_reached' => false,
                     ]);
                 }
                 if ($database->is_public) {
@@ -918,9 +912,8 @@ private function updateNotFoundServiceStatus()
         // Batch update service databases
         if ($notFoundServiceDatabaseIds->isNotEmpty()) {
             ServiceDatabase::whereIn('id', $notFoundServiceDatabaseIds)
-                ->where('restart_limit_reached', false)
                 ->where('status', '!=', 'exited')
-                ->update(['status' => 'exited', 'restart_count' => 0, 'last_restart_at' => null, 'last_restart_type' => null]);
+                ->update(['status' => 'exited']);
         }
     }
 
diff --git a/app/Livewire/Server/Proxy.php b/app/Livewire/Server/Proxy.php
index 68cb52a92..296fd4da5 100644
--- a/app/Livewire/Server/Proxy.php
+++ b/app/Livewire/Server/Proxy.php
@@ -106,6 +106,8 @@ public function changeProxy()
         try {
             $this->authorize('update', $this->server);
             $this->server->proxy = null;
+            $this->server->detected_traefik_version = null;
+            $this->server->traefik_outdated_info = null;
             $this->server->save();
 
             $this->dispatch('reloadWindow');
diff --git a/app/Models/Server.php b/app/Models/Server.php
index f7a4bf20c..dccbed15e 100644
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -1812,6 +1812,8 @@ public function changeProxy(string $proxyType, bool $async = true)
             $this->proxy->set('last_saved_proxy_configuration', null);
             $this->proxy->set('last_saved_settings', null);
             $this->proxy->set('last_applied_settings', null);
+            $this->detected_traefik_version = null;
+            $this->traefik_outdated_info = null;
             $this->save();
             if ($this->proxySet()) {
                 if ($async) {
diff --git a/app/Models/ServiceDatabase.php b/app/Models/ServiceDatabase.php
index c932791a7..603d11a7f 100644
--- a/app/Models/ServiceDatabase.php
+++ b/app/Models/ServiceDatabase.php
@@ -2,13 +2,12 @@
 
 namespace App\Models;
 
-use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\SoftDeletes;
 
 class ServiceDatabase extends BaseModel
 {
-    use HasFactory, HasRestartLimit, SoftDeletes;
+    use HasFactory, SoftDeletes;
 
     protected $fillable = [
         'service_id',
diff --git a/app/Models/StandaloneClickhouse.php b/app/Models/StandaloneClickhouse.php
index ee8558bb0..7ca45cc3b 100644
--- a/app/Models/StandaloneClickhouse.php
+++ b/app/Models/StandaloneClickhouse.php
@@ -5,7 +5,6 @@
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,7 +12,7 @@
 
 class StandaloneClickhouse extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneDragonfly.php b/app/Models/StandaloneDragonfly.php
index c72841955..769d9f00c 100644
--- a/app/Models/StandaloneDragonfly.php
+++ b/app/Models/StandaloneDragonfly.php
@@ -5,7 +5,6 @@
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,7 +12,7 @@
 
 class StandaloneDragonfly extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneKeydb.php b/app/Models/StandaloneKeydb.php
index 9c4e4aa66..15a1fe2f8 100644
--- a/app/Models/StandaloneKeydb.php
+++ b/app/Models/StandaloneKeydb.php
@@ -5,7 +5,6 @@
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,7 +12,7 @@
 
 class StandaloneKeydb extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMariadb.php b/app/Models/StandaloneMariadb.php
index 4eada8a00..378d36395 100644
--- a/app/Models/StandaloneMariadb.php
+++ b/app/Models/StandaloneMariadb.php
@@ -5,7 +5,6 @@
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -14,7 +13,7 @@
 
 class StandaloneMariadb extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMongodb.php b/app/Models/StandaloneMongodb.php
index d0a68d4e7..1010ca5f3 100644
--- a/app/Models/StandaloneMongodb.php
+++ b/app/Models/StandaloneMongodb.php
@@ -5,7 +5,6 @@
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,7 +12,7 @@
 
 class StandaloneMongodb extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneMysql.php b/app/Models/StandaloneMysql.php
index 4f9e73719..90828bf01 100644
--- a/app/Models/StandaloneMysql.php
+++ b/app/Models/StandaloneMysql.php
@@ -5,7 +5,6 @@
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,7 +12,7 @@
 
 class StandaloneMysql extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandalonePostgresql.php b/app/Models/StandalonePostgresql.php
index 602728855..e7db81285 100644
--- a/app/Models/StandalonePostgresql.php
+++ b/app/Models/StandalonePostgresql.php
@@ -5,7 +5,6 @@
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,7 +12,7 @@
 
 class StandalonePostgresql extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/app/Models/StandaloneRedis.php b/app/Models/StandaloneRedis.php
index 8a74824be..326261190 100644
--- a/app/Models/StandaloneRedis.php
+++ b/app/Models/StandaloneRedis.php
@@ -5,7 +5,6 @@
 use App\Traits\ClearsGlobalSearchCache;
 use App\Traits\HasDatabaseHealthCheck;
 use App\Traits\HasMetrics;
-use App\Traits\HasRestartLimit;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -13,7 +12,7 @@
 
 class StandaloneRedis extends BaseModel
 {
-    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasRestartLimit, HasSafeStringAttribute, SoftDeletes;
+    use ClearsGlobalSearchCache, HasDatabaseHealthCheck, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
     protected $fillable = [
         'uuid',
diff --git a/database/migrations/2026_09_04_132827_remove_restart_limits_from_databases.php b/database/migrations/2026_09_04_132827_remove_restart_limits_from_databases.php
new file mode 100644
index 000000000..710578fd9
--- /dev/null
+++ b/database/migrations/2026_09_04_132827_remove_restart_limits_from_databases.php
@@ -0,0 +1,56 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    private const STANDALONE_DATABASE_TABLES = [
+        'standalone_postgresqls',
+        'standalone_redis',
+        'standalone_mongodbs',
+        'standalone_mysqls',
+        'standalone_mariadbs',
+        'standalone_keydbs',
+        'standalone_dragonflies',
+        'standalone_clickhouses',
+    ];
+
+    public function up(): void
+    {
+        foreach (self::STANDALONE_DATABASE_TABLES as $tableName) {
+            Schema::table($tableName, function (Blueprint $table) {
+                $table->dropColumn(['max_restart_count', 'restart_limit_reached']);
+            });
+        }
+
+        Schema::table('service_databases', function (Blueprint $table) {
+            $table->dropColumn([
+                'restart_count',
+                'max_restart_count',
+                'restart_limit_reached',
+                'last_restart_at',
+                'last_restart_type',
+            ]);
+        });
+    }
+
+    public function down(): void
+    {
+        foreach (self::STANDALONE_DATABASE_TABLES as $tableName) {
+            Schema::table($tableName, function (Blueprint $table) {
+                $table->integer('max_restart_count')->default(10);
+                $table->boolean('restart_limit_reached')->default(false);
+            });
+        }
+
+        Schema::table('service_databases', function (Blueprint $table) {
+            $table->integer('restart_count')->default(0);
+            $table->integer('max_restart_count')->default(10);
+            $table->boolean('restart_limit_reached')->default(false);
+            $table->timestamp('last_restart_at')->nullable();
+            $table->string('last_restart_type', 10)->nullable();
+        });
+    }
+};
diff --git a/resources/views/components/application/restart-limit-warning.blade.php b/resources/views/components/application/restart-limit-warning.blade.php
index 3d08c803d..5a35623fc 100644
--- a/resources/views/components/application/restart-limit-warning.blade.php
+++ b/resources/views/components/application/restart-limit-warning.blade.php
@@ -1,6 +1,6 @@
 @props(['application'])
 
-@if ($application->stoppedAfterRestartLimit())
+@if (method_exists($application, 'stoppedAfterRestartLimit') && $application->stoppedAfterRestartLimit())
     @php($restartLimit = method_exists($application, 'restartLimitMaximum') ? $application->restartLimitMaximum() : ($application->max_restart_count ?? 0))
     @php($displayRestartCount = max($application->restart_count ?? 0, $restartLimit))
     <x-status-badge
diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index 79899e879..22ce7dab3 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -189,15 +189,28 @@ class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="me
                 @endcan
             @else
                 @can('deploy', $service)
-                    <button type="button" class="button mb-2 w-full justify-between" disabled>
-                        <span>Deploy</span>
-                        <span class="text-xs font-normal opacity-70">Fill required variables first</span>
-                    </button>
+                    <div id="service-mobile-actions" class="relative mb-3"
+                        x-data="{ open: false }" @click.outside="open = false"
+                        @keydown.escape.window="open = false">
+                        <button type="button" class="button w-full justify-between" @click="open = !open"
+                            :aria-expanded="open" aria-haspopup="menu">
+                            <span>Actions</span>
+                            <span class="inline-flex transition-transform" :class="open && 'rotate-180'">
+                                <x-reicon name="chevron-down" class="size-3 opacity-55" />
+                            </span>
+                        </button>
+
+                        <div x-cloak x-show="open" x-transition.origin.top.left
+                            class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="menu">
+                            <div class="listbox-option cursor-default! justify-start! gap-2.5! text-neutral-400! dark:text-fg-faint!"
+                                role="menuitem" aria-disabled="true">
+                                <x-reicon name="play-circle" class="size-3.5 opacity-70" />
+                                <span>Deploy (<a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
+                                        class="cursor-pointer underline underline-offset-2">missing required env vars</a>)</span>
+                            </div>
+                        </div>
+                    </div>
                 @endcan
-                <a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
-                    class="mb-3 inline-flex" aria-label="Open required environment variables">
-                    <x-status-badge status="Required variables missing" type="error" />
-                </a>
             @endif
 
         </div>
@@ -287,10 +300,26 @@ class="listbox-panel top-full! right-0! left-auto! mt-1! w-64! min-w-0!" role="m
                         </div>
                         @endcan
                     @else
-                        <a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
-                            aria-label="Open required environment variables">
-                            <x-status-badge status="Required variables missing" type="error" />
-                        </a>
+                        @can('deploy', $service)
+                            <div id="service-desktop-actions" class="relative" x-data="{ open: false }"
+                                x-effect="$dispatch('resource-actions-toggled', { open })"
+                                @click.outside="open = false" @keydown.escape.window="open = false">
+                                <button type="button" class="button button-highlighted" @click="open = !open"
+                                    :aria-expanded="open" aria-haspopup="menu">
+                                    Actions
+                                    <x-reicon name="chevron-down" class="size-3 opacity-55" />
+                                </button>
+                                <div x-cloak x-show="open" x-transition.origin.top.right
+                                    class="listbox-panel top-full! right-0! left-auto! mt-1! w-64! min-w-0!" role="menu">
+                                    <div class="listbox-option cursor-default! justify-start! gap-2.5! text-neutral-400! dark:text-fg-faint!"
+                                        role="menuitem" aria-disabled="true">
+                                        <x-reicon name="play-circle" class="size-3.5 opacity-70" />
+                                        <span>Deploy (<a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
+                                                class="cursor-pointer underline underline-offset-2">missing required env vars</a>)</span>
+                                    </div>
+                                </div>
+                            </div>
+                        @endcan
                     @endif
                 </div>
             </div>
diff --git a/tests/Feature/AllResourceRestartLimitsTest.php b/tests/Feature/AllResourceRestartLimitsTest.php
index 8418b552c..7da82f7d6 100644
--- a/tests/Feature/AllResourceRestartLimitsTest.php
+++ b/tests/Feature/AllResourceRestartLimitsTest.php
@@ -1,5 +1,8 @@
 <?php
 
+use App\Actions\Docker\GetContainersStatus;
+use App\Actions\Service\StopServiceApplication;
+use App\Jobs\PushServerUpdateJob;
 use App\Models\ApplicationPreview;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
@@ -14,9 +17,10 @@
 use App\Traits\HasRestartLimit;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Blade;
 use Illuminate\Support\Facades\Schema;
 
-it('gives every independently runnable non-application resource restart limit state', function (string $modelClass) {
+it('gives independently runnable application resources restart limit state', function (string $modelClass) {
     expect(class_uses_recursive($modelClass))->toContain(HasRestartLimit::class);
 
     $resource = new $modelClass;
@@ -34,17 +38,8 @@
         'last_restart_at' => 'datetime',
     ]);
 })->with([
-    ApplicationPreview::class,
-    ServiceApplication::class,
-    ServiceDatabase::class,
-    StandaloneClickhouse::class,
-    StandaloneDragonfly::class,
-    StandaloneKeydb::class,
-    StandaloneMariadb::class,
-    StandaloneMongodb::class,
-    StandaloneMysql::class,
-    StandalonePostgresql::class,
-    StandaloneRedis::class,
+    [ApplicationPreview::class],
+    [ServiceApplication::class],
 ]);
 
 it('collects restart counts for preview and service containers from both status sources', function () {
@@ -157,7 +152,7 @@
         ->toContain('Application::query()');
 });
 
-it('adds restart limit columns to previews services and standalone databases', function () {
+it('limits restarts only for applications', function () {
     $migrations = collect(glob(database_path('migrations/*.php')))
         ->map(fn (string $path): string => file_get_contents($path))
         ->implode("\n");
@@ -165,19 +160,62 @@
     expect($migrations)
         ->toContain("'application_previews'")
         ->toContain("'service_applications'")
-        ->toContain("'service_databases'")
         ->toContain("'max_restart_count'")
-        ->toContain("'restart_limit_reached'");
+        ->toContain("'restart_limit_reached'")
+        ->toContain("dropColumn(['max_restart_count', 'restart_limit_reached'])");
 
-    $restartLimitMigrations = collect(glob(database_path('migrations/*_add_restart_limit_to_*.php')));
+    $databaseModels = [
+        ServiceDatabase::class,
+        StandalonePostgresql::class,
+        StandaloneRedis::class,
+        StandaloneMongodb::class,
+        StandaloneMysql::class,
+        StandaloneMariadb::class,
+        StandaloneKeydb::class,
+        StandaloneDragonfly::class,
+        StandaloneClickhouse::class,
+    ];
 
-    expect($restartLimitMigrations)->toHaveCount(11);
-    expect($restartLimitMigrations->map(
-        fn (string $path): string => substr(basename($path), 0, 17)
-    )->unique())->toHaveCount(11);
-    $restartLimitMigrations->each(function (string $path): void {
-        expect(file_get_contents($path))->not->toContain('foreach (');
-    });
+    foreach ($databaseModels as $databaseModel) {
+        expect(class_uses_recursive($databaseModel))->not->toContain(HasRestartLimit::class);
+    }
+
+    foreach ([
+        'service_databases',
+        'standalone_postgresqls',
+        'standalone_redis',
+        'standalone_mongodbs',
+        'standalone_mysqls',
+        'standalone_mariadbs',
+        'standalone_keydbs',
+        'standalone_dragonflies',
+        'standalone_clickhouses',
+    ] as $databaseTable) {
+        expect(Schema::hasColumn($databaseTable, 'max_restart_count'))->toBeFalse()
+            ->and(Schema::hasColumn($databaseTable, 'restart_limit_reached'))->toBeFalse();
+    }
+
+    foreach ([GetContainersStatus::class, PushServerUpdateJob::class] as $statusUpdater) {
+        $source = file_get_contents((new ReflectionClass($statusUpdater))->getFileName());
+
+        expect($source)
+            ->not->toContain('$database->trackRestartCount')
+            ->not->toContain('$database->stoppedAfterRestartLimit()');
+    }
+
+    $stopServiceResource = file_get_contents((new ReflectionClass(StopServiceApplication::class))->getFileName());
+
+    expect($stopServiceResource)
+        ->toContain('$resetRestartCount && $serviceApplication instanceof ServiceApplication');
+});
+
+it('does not render restart limit warnings for service databases', function () {
+    $html = Blade::render(
+        '<x-application.restart-limit-warning :application="$database" />',
+        ['database' => new ServiceDatabase],
+    );
+
+    expect(trim($html))->toBeEmpty();
 });
 
 it('atomically claims a resource restart limit once and can reset it', function () {
diff --git a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
index ce69f26ef..f7951e93a 100644
--- a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
+++ b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
@@ -82,21 +82,31 @@
     }
 });
 
-it('links the service header missing variables warning to environment variables', function () {
+it('shows disabled deploy actions when service variables are missing', function () {
     $heading = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
     $mobileActions = str($heading)
         ->after('<div class="w-full xl:hidden">')
         ->before("@teleport('#resource-action-hud-slot')")
         ->toString();
+    $desktopActions = str($heading)
+        ->after("@teleport('#resource-action-hud-slot')")
+        ->before('@endteleport')
+        ->toString();
 
-    expect($heading)
-        ->toContain("route('project.service.environment-variables'")
-        ->toContain('Required variables missing')
+    expect($mobileActions)
+        ->toContain('id="service-mobile-actions"')
+        ->toContain('aria-disabled="true"')
+        ->toContain('Deploy')
+        ->toContain('missing required env vars')
         ->toContain('href="{{ $environmentVariablesUrl }}"')
-        ->and($mobileActions)
-        ->toContain('Fill required variables first')
-        ->toContain('disabled')
-        ->toContain('Deploy');
+        ->toContain('underline')
+        ->and($desktopActions)
+        ->toContain('id="service-desktop-actions"')
+        ->toContain('aria-disabled="true"')
+        ->toContain('Deploy')
+        ->toContain('missing required env vars')
+        ->toContain('href="{{ $environmentVariablesUrl }}"')
+        ->toContain('underline');
 });
 
 it('places the account menu beside the desktop sidebar toggle while retaining it on mobile', function () {
diff --git a/tests/Feature/TraefikVersionStateTest.php b/tests/Feature/TraefikVersionStateTest.php
index 3dad5423e..de3cf8e17 100644
--- a/tests/Feature/TraefikVersionStateTest.php
+++ b/tests/Feature/TraefikVersionStateTest.php
@@ -1,12 +1,16 @@
 <?php
 
 use App\Enums\ProxyTypes;
+use App\Events\ProxyStatusChangedUI;
 use App\Jobs\CheckTraefikVersionForServerJob;
+use App\Jobs\CheckTraefikVersionJob;
 use App\Livewire\Server\Proxy;
 use App\Models\Server;
 use App\Models\Team;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
 use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Event;
 
 uses(RefreshDatabase::class);
 
@@ -185,7 +189,7 @@
     expect($server->hasCurrentTraefikOutdatedInfo())->toBeTrue();
 });
 
-it('clears stale outdated information before detecting the current version', function () {
+it('clears stale Traefik version state before detecting the current version', function () {
     $team = Team::factory()->create();
     $server = Server::factory()->create([
         'team_id' => $team->id,
@@ -204,6 +208,80 @@
 
     $server->refresh();
 
-    expect($server->detected_traefik_version)->toBe('3.6.23')
+    expect($server->detected_traefik_version)->toBeNull()
         ->and($server->traefik_outdated_info)->toBeNull();
 });
+
+it('clears Traefik version state when the proxy changes', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'proxy' => [
+            'type' => ProxyTypes::TRAEFIK->value,
+            'status' => 'running',
+        ],
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+        ],
+    ]);
+
+    $server->changeProxy(ProxyTypes::NONE->value);
+
+    expect($server->refresh()->detected_traefik_version)->toBeNull()
+        ->and($server->traefik_outdated_info)->toBeNull();
+});
+
+it('cleans stale Traefik version state while selecting servers to check', function () {
+    Bus::fake();
+    Cache::put('coolify:versions:all', [
+        'traefik' => ['v3.7' => '3.7.8'],
+    ]);
+
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'proxy' => [
+            'type' => ProxyTypes::NONE->value,
+            'status' => 'exited',
+        ],
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+        ],
+    ]);
+
+    (new CheckTraefikVersionJob)->handle();
+
+    expect($server->refresh()->detected_traefik_version)->toBeNull()
+        ->and($server->traefik_outdated_info)->toBeNull();
+});
+
+it('does not inspect a server after its Traefik proxy has been disabled', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'proxy' => [
+            'type' => ProxyTypes::NONE->value,
+            'status' => 'exited',
+        ],
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+        ],
+    ]);
+    Event::fake();
+
+    (new CheckTraefikVersionForServerJob($server, ['v3.7' => '3.7.8']))->handle();
+
+    expect($server->refresh()->detected_traefik_version)->toBeNull()
+        ->and($server->traefik_outdated_info)->toBeNull();
+
+    Event::assertNotDispatched(ProxyStatusChangedUI::class);
+});
diff --git a/tests/Unit/StopActionsPersistStatusTest.php b/tests/Unit/StopActionsPersistStatusTest.php
index 35b6052dd..67a7a8c6f 100644
--- a/tests/Unit/StopActionsPersistStatusTest.php
+++ b/tests/Unit/StopActionsPersistStatusTest.php
@@ -21,7 +21,7 @@
         ->toContain("\$application->update(['status' => 'exited']);")
         ->toContain('$application->resetRestartLimit();')
         ->toContain("\$database->update(['status' => 'exited']);")
-        ->toContain('$database->resetRestartLimit();');
+        ->not->toContain('$database->resetRestartLimit();');
 });
 
 it('persists exited status when stopping an individual service resource', function () {

From 2ebbc5113ec8ab4e329e3c14daf9cacc3b0d5155 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:44:18 +0200
Subject: [PATCH 48/55] fix: return null for invalid repository URLs

---
 app/Models/Application.php                  |  6 +++++-
 tests/Unit/ApplicationGitCommitLinkTest.php | 11 +++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/app/Models/Application.php b/app/Models/Application.php
index 6bfbb6de7..7f7ce5ea1 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -714,7 +714,7 @@ public function gitCommits(): Attribute
         );
     }
 
-    public function gitCommitLink($link): string
+    public function gitCommitLink($link): ?string
     {
         if (! is_null(data_get($this, 'source.html_url')) && ! is_null(data_get($this, 'git_repository')) && ! is_null(data_get($this, 'git_branch'))) {
             if (str($this->source->html_url)->contains('bitbucket')) {
@@ -731,6 +731,10 @@ public function gitCommitLink($link): string
             $git_repository = 'https://'.parse_url($git_repository, PHP_URL_HOST).parse_url($git_repository, PHP_URL_PATH);
         }
 
+        if (! filter_var($git_repository, FILTER_VALIDATE_URL)) {
+            return null;
+        }
+
         $url = Url::fromString(Str::replaceEnd('.git', '', $git_repository));
         $url = $url->withUserInfo('');
         $commitPath = str($git_repository)->contains('bitbucket') ? 'commits' : 'commit';
diff --git a/tests/Unit/ApplicationGitCommitLinkTest.php b/tests/Unit/ApplicationGitCommitLinkTest.php
index e1a15e714..378384fe8 100644
--- a/tests/Unit/ApplicationGitCommitLinkTest.php
+++ b/tests/Unit/ApplicationGitCommitLinkTest.php
@@ -26,3 +26,14 @@
         'https://bitbucket.org/coollabsio/coolify/commits/1234567890abcdef',
     ],
 ]);
+
+it('does not generate commit links from incomplete repository URLs', function (string $repository) {
+    $application = new Application;
+    $application->setRelation('source', null);
+    $application->git_repository = $repository;
+
+    expect($application->gitCommitLink('1234567890abcdef'))->toBeNull();
+})->with([
+    'missing host' => 'https://',
+    'missing scheme' => 'github.com/coollabsio/coolify',
+]);

From 89814743c8233fa856d58fcb72a2f04ecc9e600c Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:45:55 +0200
Subject: [PATCH 49/55] fix(applications): TypeError when stopping an
 application

---
 app/Actions/Application/StopApplication.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/app/Actions/Application/StopApplication.php b/app/Actions/Application/StopApplication.php
index 3feb5117d..fcf1e1d0f 100644
--- a/app/Actions/Application/StopApplication.php
+++ b/app/Actions/Application/StopApplication.php
@@ -78,5 +78,7 @@ public function handle(Application $application, bool $previewDeployments = fals
         $application->update($status);
 
         ServiceStatusChanged::dispatch($application->environment->project->team->id);
+
+        return null;
     }
 }

From aafef73aa651366d4ec14f8fa2a1d426817eb105 Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 15:53:49 +0200
Subject: [PATCH 50/55] fix(docker): match helper containers at any registry
 depth

---
 app/Jobs/CleanupHelperContainersJob.php       | 2 +-
 tests/Unit/CleanupHelperContainersJobTest.php | 7 ++++++-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/app/Jobs/CleanupHelperContainersJob.php b/app/Jobs/CleanupHelperContainersJob.php
index 425dd2591..52b4064fe 100644
--- a/app/Jobs/CleanupHelperContainersJob.php
+++ b/app/Jobs/CleanupHelperContainersJob.php
@@ -21,7 +21,7 @@ public function __construct(public Server $server) {}
 
     private static function helperContainersCommand(): string
     {
-        return 'docker container ps --format \'{{json .}}\' | jq -s \'map(select(.Image|test("^([^/]+/)?coollabsio/coolify-helper(:|@)")))\'';
+        return 'docker container ps --format \'{{json .}}\' | jq -s \'map(select(.Image|test("(^|/)coollabsio/coolify-helper(:|@)")))\'';
     }
 
     public function handle(): void
diff --git a/tests/Unit/CleanupHelperContainersJobTest.php b/tests/Unit/CleanupHelperContainersJobTest.php
index a649985d2..bd3e2e175 100644
--- a/tests/Unit/CleanupHelperContainersJobTest.php
+++ b/tests/Unit/CleanupHelperContainersJobTest.php
@@ -13,6 +13,11 @@
         'docker.io/coollabsio/coolify-helper:1.0.16',
         'ghcr.io/coollabsio/coolify-helper@sha256:abc',
         'registry.example/team/coollabsio/coolify-helper:latest',
+        'coollabsio/coolify:latest',
+        'coollabsio/coolify:4.3.12',
+        'coollabsio/coolify-realtime:1.0.10',
+        'coolify-helper:latest',
+        'someone/coolify-helper:1.0.16',
         'evil/coollabsio/coolify-helper-copy:latest',
         'coollabsio/not-coolify-helper:latest',
     ];
@@ -31,7 +36,7 @@
         $process->mustRun();
 
         expect(array_column(json_decode($process->getOutput(), true, flags: JSON_THROW_ON_ERROR), 'Image'))
-            ->toBe(array_slice($images, 0, 3));
+            ->toBe(array_slice($images, 0, 4));
     } finally {
         unlink($docker);
         rmdir($directory);

From 92c0035002d977cea4925984999e1895766910fd Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 4 Sep 2026 16:34:40 +0200
Subject: [PATCH 51/55] ci: sync main to next once a day instead of on every
 push

merging main into next after every commit clutters the next branch with too many merge commits.
---
 .github/workflows/sync-main-to-next.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/sync-main-to-next.yml b/.github/workflows/sync-main-to-next.yml
index 595a21e79..b9b8b361f 100644
--- a/.github/workflows/sync-main-to-next.yml
+++ b/.github/workflows/sync-main-to-next.yml
@@ -1,8 +1,8 @@
 name: Sync main to next
 
 on:
-  push:
-    branches: [main]
+  schedule:
+    - cron: '0 3 * * *'
   workflow_dispatch:
 
 permissions:

From a04c2ecb442c3ed8a4eac60a6bb9e3413111d13c Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 16:38:24 +0200
Subject: [PATCH 52/55] fix(docker): preserve restart policies when stopping
 containers

---
 app/Actions/Application/StopApplication.php           |  2 --
 app/Actions/Application/StopApplicationPreview.php    |  2 --
 app/Actions/Database/StopDatabase.php                 |  2 --
 app/Actions/Service/StopServiceApplication.php        |  5 +----
 .../ApplicationStoppedAfterRestartLimitTest.php       |  2 +-
 tests/Unit/StopActionsPersistStatusTest.php           | 11 +++++++++++
 6 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/app/Actions/Application/StopApplication.php b/app/Actions/Application/StopApplication.php
index fcf1e1d0f..12ac56900 100644
--- a/app/Actions/Application/StopApplication.php
+++ b/app/Actions/Application/StopApplication.php
@@ -44,8 +44,6 @@ public function handle(Application $application, bool $previewDeployments = fals
                     $commands = [dockerStopCommand($timeout, $containerName, $server)];
                     if ($removeContainers) {
                         $commands[] = "docker rm -f $containerName";
-                    } else {
-                        array_unshift($commands, "docker update --restart=no $containerName");
                     }
 
                     instant_remote_process(command: $commands, server: $server, throwError: false);
diff --git a/app/Actions/Application/StopApplicationPreview.php b/app/Actions/Application/StopApplicationPreview.php
index af5f3fc0f..8bb3a3dc0 100644
--- a/app/Actions/Application/StopApplicationPreview.php
+++ b/app/Actions/Application/StopApplicationPreview.php
@@ -20,8 +20,6 @@ public function handle(ApplicationPreview $preview, bool $resetRestartCount = tr
             $commands = [dockerStopCommand($application->settings->stopGracePeriodSeconds(), $containerName, $server)];
             if ($removeContainer) {
                 $commands[] = "docker rm -f $containerName";
-            } else {
-                array_unshift($commands, "docker update --restart=no $containerName");
             }
             instant_remote_process($commands, $server, false);
         }
diff --git a/app/Actions/Database/StopDatabase.php b/app/Actions/Database/StopDatabase.php
index 8005311b5..d3c6fafc4 100644
--- a/app/Actions/Database/StopDatabase.php
+++ b/app/Actions/Database/StopDatabase.php
@@ -62,8 +62,6 @@ private function stopContainer(BaseModel $database, string $containerName, int $
         $commands = [dockerStopCommand($timeout, $containerName, $server)];
         if ($removeContainer) {
             $commands[] = "docker rm -f $containerName";
-        } else {
-            array_unshift($commands, "docker update --restart=no $containerName");
         }
         instant_remote_process(command: $commands, server: $server, throwError: false);
     }
diff --git a/app/Actions/Service/StopServiceApplication.php b/app/Actions/Service/StopServiceApplication.php
index 11ad337ed..1b5347265 100644
--- a/app/Actions/Service/StopServiceApplication.php
+++ b/app/Actions/Service/StopServiceApplication.php
@@ -22,10 +22,7 @@ public function handle(ServiceApplication|ServiceDatabase $serviceApplication, b
         if ($removeContainer) {
             $commands = ["docker rm -f {$containerName}"];
         } else {
-            $commands = [
-                "docker update --restart=no {$containerName}",
-                "docker stop {$containerName}",
-            ];
+            $commands = ["docker stop {$containerName}"];
         }
         instant_remote_process($commands, $server, throwError: ! $removeContainer);
 
diff --git a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
index 58ebb8c70..f5875adb2 100644
--- a/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
+++ b/tests/Feature/ApplicationStoppedAfterRestartLimitTest.php
@@ -126,7 +126,7 @@ function applicationWithRestartState(array $attributes = []): Application
 
     expect($removeContainers)->not->toBeNull()
         ->and($removeContainers->getDefaultValue())->toBeTrue()
-        ->and($action)->toContain('docker update --restart=no')
+        ->and($action)->not->toContain('docker update --restart=no')
         ->and($action)->toContain('if ($removeContainers)');
 });
 
diff --git a/tests/Unit/StopActionsPersistStatusTest.php b/tests/Unit/StopActionsPersistStatusTest.php
index 67a7a8c6f..a6d8d2fc1 100644
--- a/tests/Unit/StopActionsPersistStatusTest.php
+++ b/tests/Unit/StopActionsPersistStatusTest.php
@@ -6,6 +6,17 @@
     expect($action)->toContain("'status' => 'exited'");
 });
 
+it('does not change Docker restart policies when retaining stopped containers', function (string $actionPath) {
+    $action = file_get_contents(__DIR__.'/../../'.$actionPath);
+
+    expect($action)->not->toContain('docker update --restart=no');
+})->with([
+    'applications' => 'app/Actions/Application/StopApplication.php',
+    'application previews' => 'app/Actions/Application/StopApplicationPreview.php',
+    'service applications' => 'app/Actions/Service/StopServiceApplication.php',
+    'standalone databases' => 'app/Actions/Database/StopDatabase.php',
+]);
+
 it('persists exited status for every full application stop path', function () {
     $action = file_get_contents(__DIR__.'/../../app/Actions/Application/StopApplication.php');
 

From 851a902346aa1f1b847ce9dd4fa79d2a2513f941 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 16:47:12 +0200
Subject: [PATCH 53/55] fix(domains): preserve removed compose service domains

---
 bootstrap/helpers/domains.php            | 20 ++++++++++++++++++
 bootstrap/helpers/parsers.php            |  7 ++----
 tests/Feature/ApplicationDomainsTest.php | 27 ++++++++++++++++++++++++
 3 files changed, 49 insertions(+), 5 deletions(-)

diff --git a/bootstrap/helpers/domains.php b/bootstrap/helpers/domains.php
index 4e4ad73e6..28ff41b3d 100644
--- a/bootstrap/helpers/domains.php
+++ b/bootstrap/helpers/domains.php
@@ -443,6 +443,26 @@ function getComposeServiceDomainString(array|Collection $domains, string $servic
     return $matches[0]['domain'];
 }
 
+/**
+ * Determine whether a compose service already has a domain-map entry, including
+ * an explicitly empty entry left when a user removes its generated domain.
+ *
+ * @param  array<string, mixed>|Collection<string, mixed>  $domains
+ */
+function hasComposeServiceDomainEntry(array|Collection $domains, string $serviceName): bool
+{
+    $normalized = normalizeComposeServiceName($serviceName);
+
+    foreach (collect($domains)->keys() as $key) {
+        $key = (string) $key;
+        if ($key === $serviceName || normalizeComposeServiceName($key) === $normalized) {
+            return true;
+        }
+    }
+
+    return false;
+}
+
 function composeDomainEntryString(mixed $entry): ?string
 {
     if (is_object($entry)) {
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index 590b68d16..03ebf5af7 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -525,8 +525,7 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                 $originalServiceName = findComposeServiceName($normalizedServiceName, array_keys($services));
                 if ($originalServiceName !== null) {
                     $domains = json_decode(data_get($resource, 'docker_compose_domains') ?: '[]', true) ?: [];
-                    $domainExists = getComposeServiceDomainString($domains, $originalServiceName);
-                    if (is_null($domainExists)) {
+                    if (! hasComposeServiceDomainEntry($domains, $originalServiceName)) {
                         $serviceNameForDomain = str($parsed['service_name'])->replace('_', '-')->value();
                         $domainValue = generateUrl(server: $server, random: "$serviceNameForDomain-$uuid");
                         if ($value && get_class($value) === Stringable::class && $value->startsWith('/')) {
@@ -648,12 +647,10 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
                         // Only add domain if the service exists
                         if ($composeServiceName !== null) {
                             $domains = json_decode(data_get($resource, 'docker_compose_domains') ?: '[]', true) ?: [];
-                            $domainExists = getComposeServiceDomainString($domains, $composeServiceName);
-
                             // Update domain using URL with port if applicable
                             $domainValue = $port ? $urlWithPort : $url;
 
-                            if (is_null($domainExists)) {
+                            if (! hasComposeServiceDomainEntry($domains, $composeServiceName)) {
                                 $resource->docker_compose_domains = json_encode(putComposeServiceDomain(
                                     $domains,
                                     $composeServiceName,
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index a13b5fdbf..f2beb22f1 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -111,6 +111,33 @@
     expect($this->application->fresh()->fqdn)->toBeNull();
 });
 
+it('keeps a compose domain removed when the service declares a magic URL variable', function () {
+    $this->application->update([
+        'build_pack' => 'dockercompose',
+        'docker_compose_raw' => <<<'YAML'
+services:
+  web:
+    image: nginx:alpine
+    environment:
+      SERVICE_URL_WEB: /api
+YAML,
+        'docker_compose_domains' => json_encode([
+            'web' => ['domain' => 'https://web.example.com/api'],
+        ]),
+    ]);
+
+    $component = Livewire::test(Domains::class, ['application' => $this->application->fresh()]);
+    $domainKey = hash('sha256', 'https://web.example.com/api|web');
+
+    $component
+        ->call('removeDomainByKey', $domainKey)
+        ->assertDispatched('success')
+        ->assertSet('domainRows', []);
+
+    expect(json_decode($this->application->fresh()->docker_compose_domains, true))
+        ->toMatchArray(['web' => ['domain' => null]]);
+});
+
 it('generates a preview domain when the application has no domain', function () {
     $preview = ApplicationPreview::create([
         'application_id' => $this->application->id,

From 5ff21103974a30e107ce046190fb478658a214e7 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 17:01:42 +0200
Subject: [PATCH 54/55] fix(environment-variables): preserve generated Compose
 variables

Exclude protected Compose variables from bulk deletion and developer views, and propagate deletion failures correctly.
---
 .../Shared/EnvironmentVariable/All.php        | 42 +++++++-----
 .../EnvironmentVariableAsyncLoadTest.php      | 66 +++++++++++++++++++
 2 files changed, 90 insertions(+), 18 deletions(-)

diff --git a/app/Livewire/Project/Shared/EnvironmentVariable/All.php b/app/Livewire/Project/Shared/EnvironmentVariable/All.php
index ea8394c1b..47080cd86 100644
--- a/app/Livewire/Project/Shared/EnvironmentVariable/All.php
+++ b/app/Livewire/Project/Shared/EnvironmentVariable/All.php
@@ -818,19 +818,21 @@ private function formatEnvironmentVariables($variables)
     {
         $isMember = auth()->user()?->isMember();
 
-        return $variables->map(function ($item) use ($isMember) {
-            if ($isMember) {
-                return "$item->key=(Hidden, only admins can view)";
-            }
-            if ($item->is_shown_once) {
-                return "$item->key=(Locked Secret, delete and add again to change)";
-            }
-            if ($item->is_multiline) {
-                return "$item->key=(Multiline environment variable, edit in normal view)";
-            }
+        return $variables
+            ->reject(fn ($item): bool => $this->isProtectedEnvironmentVariable($item->key))
+            ->map(function ($item) use ($isMember) {
+                if ($isMember) {
+                    return "$item->key=(Hidden, only admins can view)";
+                }
+                if ($item->is_shown_once) {
+                    return "$item->key=(Locked Secret, delete and add again to change)";
+                }
+                if ($item->is_multiline) {
+                    return "$item->key=(Multiline environment variable, edit in normal view)";
+                }
 
-            return "$item->key=$item->value";
-        })->join("\n");
+                return "$item->key=$item->value";
+            })->join("\n");
     }
 
     public function switch()
@@ -908,8 +910,7 @@ private function handleBulkSubmit()
         $deletedCount = $this->deleteRemovedVariables(false, $variables);
         if ($deletedCount > 0) {
             $changesMade = true;
-        } elseif ($deletedCount === 0 && $this->resource->environment_variables()->whereNotIn('key', array_keys($variables))->exists()) {
-            // If we tried to delete but couldn't (due to Docker Compose), mark as error
+        } elseif ($deletedCount < 0) {
             $errorOccurred = true;
         }
 
@@ -926,8 +927,7 @@ private function handleBulkSubmit()
             $deletedPreviewCount = $this->deleteRemovedVariables(true, $previewVariables);
             if ($deletedPreviewCount > 0) {
                 $changesMade = true;
-            } elseif ($deletedPreviewCount === 0 && $this->resource->environment_variables_preview()->whereNotIn('key', array_keys($previewVariables))->exists()) {
-                // If we tried to delete but couldn't (due to Docker Compose), mark as error
+            } elseif ($deletedPreviewCount < 0) {
                 $errorOccurred = true;
             }
 
@@ -988,6 +988,12 @@ private function deleteRemovedVariables($isPreview, $variables)
         // Get all environment variables that will be deleted
         $variablesToDelete = $this->resource->$method()->whereNotIn('key', array_keys($variables))->get();
 
+        // Generated Compose variables are managed by Coolify and must survive a bulk
+        // replacement even when they are omitted from the pasted environment file.
+        $variablesToDelete = $variablesToDelete->reject(
+            fn (EnvironmentVariable $environmentVariable): bool => $this->isProtectedEnvironmentVariable($environmentVariable->key)
+        );
+
         // If there are no variables to delete, return 0
         if ($variablesToDelete->isEmpty()) {
             return 0;
@@ -1001,13 +1007,13 @@ private function deleteRemovedVariables($isPreview, $variables)
                 if ($isUsed) {
                     $this->dispatch('error', "Cannot delete environment variable '{$envVar->key}' <br><br>Please remove it from the Docker Compose file first.");
 
-                    return 0;
+                    return -1;
                 }
             }
         }
 
         // If we get here, no variables are used in Docker Compose, so we can delete them
-        $this->resource->$method()->whereNotIn('key', array_keys($variables))->delete();
+        $this->resource->$method()->whereKey($variablesToDelete->modelKeys())->delete();
 
         return $variablesToDelete->count();
     }
diff --git a/tests/Feature/EnvironmentVariableAsyncLoadTest.php b/tests/Feature/EnvironmentVariableAsyncLoadTest.php
index 2cbc5537a..4d83862b6 100644
--- a/tests/Feature/EnvironmentVariableAsyncLoadTest.php
+++ b/tests/Feature/EnvironmentVariableAsyncLoadTest.php
@@ -121,3 +121,69 @@
     expect($component->instance()->environmentVariables->pluck('key')->all())
         ->toContain('API_KEY');
 });
+
+it('preserves generated compose variables during bulk replacement', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'build_pack' => 'dockercompose',
+        'docker_compose' => <<<'YAML'
+services:
+  api:
+    image: nginx:alpine
+    environment:
+      SERVICE_URL_API: /api
+YAML,
+    ]);
+
+    foreach ([
+        'SERVICE_URL_API' => 'https://api.example.com/api',
+        'SERVICE_FQDN_API' => 'api.example.com/api',
+        'OLD_VARIABLE' => 'remove-me',
+    ] as $key => $value) {
+        EnvironmentVariable::create([
+            'key' => $key,
+            'value' => $value,
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+        ]);
+    }
+
+    Livewire::test(All::class, ['resource' => $application])
+        ->set('variables', 'NEW_VARIABLE=keep-me')
+        ->call('submit')
+        ->assertDispatched('success')
+        ->assertNotDispatched('error');
+
+    expect($application->environment_variables()->pluck('value', 'key')->all())
+        ->toBe([
+            'SERVICE_URL_API' => 'https://api.example.com/api',
+            'SERVICE_FQDN_API' => 'api.example.com/api',
+            'NEW_VARIABLE' => 'keep-me',
+        ]);
+});
+
+it('hides generated compose variables from developer view', function () {
+    $application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'build_pack' => 'dockercompose',
+    ]);
+
+    foreach ([
+        'SERVICE_URL_API' => 'https://api.example.com',
+        'SERVICE_FQDN_API' => 'api.example.com',
+        'API_URL' => '$SERVICE_URL_API',
+    ] as $key => $value) {
+        EnvironmentVariable::create([
+            'key' => $key,
+            'value' => $value,
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+        ]);
+    }
+
+    $component = Livewire::test(All::class, ['resource' => $application])
+        ->call('switch');
+
+    expect($component->get('variables'))
+        ->toBe('API_URL=$SERVICE_URL_API');
+});

From dba3d114e5ed2be9a466c030c8cbc2ec58b498d9 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 4 Sep 2026 18:09:53 +0200
Subject: [PATCH 55/55] chore(release): bump Coolify version to 4.3.18

---
 config/constants.php                       | 2 +-
 other/nightly/versions.json                | 2 +-
 tests/Unit/ProductionImageWorkflowTest.php | 4 ++--
 versions.json                              | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index 7ad0c4594..22d5e1011 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.17',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.18',
         'helper_version' => '1.0.16',
         'realtime_version' => '1.0.18',
         'railpack_version' => '0.23.0',
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index 0e83c0cf7..97ab3b3a6 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.17"
+            "version": "4.3.18"
         },
         "nightly": {
             "version": "4.4-rc.1"
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index 140a6276f..206cf5f34 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,8 +23,8 @@
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.17'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.17')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.18'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.18')
         ->and($versions['coolify']['nightly']['version'])->toBe('4.4-rc.1')
         ->and($nightlyVersions)->toBe($versions);
 });
diff --git a/versions.json b/versions.json
index 0e83c0cf7..97ab3b3a6 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.17"
+            "version": "4.3.18"
         },
         "nightly": {
             "version": "4.4-rc.1"