Merge remote-tracking branch 'origin/next' into feat/api-destinations

.github/workflows/chore-pr-comments.yml

@@ -40,7 +40,10 @@ jobs:
           #    This will help ensure that our documentation remains accurate and up-to-date for all users.
     steps:
       - name: Add comment
-        if: github.event.label.name == matrix.label
+        if: >-
+          (github.event.label.name == matrix.label || github.event.label.name == '📑 Waiting for Docs PR')
+          && contains(github.event.pull_request.labels.*.name, matrix.label)
+          && contains(github.event.pull_request.labels.*.name, '📑 Waiting for Docs PR')
         run: gh pr comment "$NUMBER" --body "$BODY"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

AGENTS.md

@@ -1,7 +1,147 @@
+# AGENTS.md
+
+This file provides guidance to agentic coding tools when working with code in this repository.
+
+## Project Overview
+
+Coolify is an open-source, self-hostable PaaS (alternative to Heroku/Netlify/Vercel). It manages servers, applications, databases, and services via SSH. Built with Laravel 12 (using Laravel 10 file structure), Livewire 3, and Tailwind CSS v4.
+
 ## Design Reference
 
 For UI/UX design specifications, principles, and visual standards, consult `DESIGN.md` in the [coollabsio/architecture](https://github.com/coollabsio/architecture) repo.
 
+## Development Environment
+
+Docker Compose-based dev setup with services: coolify (app), postgres, redis, soketi (WebSockets), vite, testing-host, mailpit, minio.
+
+```bash
+# Start dev environment (uses docker-compose.dev.yml)
+spin up                          # or: docker compose -f docker-compose.dev.yml up -d
+spin down                        # stop services
+```
+
+The app runs at `localhost:8000` by default. Vite dev server on port 5173.
+
+## Common Commands
+
+```bash
+# Tests (Pest 4)
+php artisan test --compact                          # all tests
+php artisan test --compact --filter=testName         # single test
+php artisan test --compact tests/Feature/SomeTest.php  # specific file
+
+# Code formatting (Pint, Laravel preset)
+vendor/bin/pint --dirty --format agent              # format changed files
+
+# Frontend
+npm run dev                     # vite dev server
+npm run build                   # production build
+```
+
+## Browser Tests (Pest Browser Plugin)
+
+Uses `pestphp/pest-plugin-browser` with Laravel Dusk 8. New browser tests go in `tests/v4/Browser/`.
+
+```bash
+# Run all browser tests
+php artisan test --compact tests/v4/Browser/
+
+# Run a specific browser test file
+php artisan test --compact tests/v4/Browser/LoginTest.php
+
+# Run a specific test by name
+php artisan test --compact --filter='can login with valid credentials'
+```
+
+### Writing Browser Tests
+
+- Place new tests in `tests/v4/Browser/` — legacy Dusk tests in `tests/Browser/` should not be used as reference.
+- Use `RefreshDatabase` and seed required data (at minimum `InstanceSettings::create(['id' => 0])`) in `beforeEach`.
+- Key API: `visit()`, `fill(field, value)`, `click(text)`, `assertSee()`, `assertDontSee()`, `assertPathIs()`, `screenshot()`.
+- Always call `screenshot()` at the end of each test for debugging.
+- For authenticated tests, create a helper function that logs in via the UI:
+
+```php
+function loginAsRoot(): mixed
+{
+    return visit('/login')
+        ->fill('email', 'test@example.com')
+        ->fill('password', 'password')
+        ->click('Login');
+}
+```
+
+- See `tests/v4/Browser/LoginTest.php`, `tests/v4/Browser/DashboardTest.php`, and `tests/v4/Browser/RegistrationTest.php` for conventions.
+- Chrome driver runs on `localhost:4444`, app on `localhost:8000` (configured in `tests/DuskTestCase.php`).
+- Legacy Dusk macros in `app/Providers/DuskServiceProvider.php` use the old `type()`/`press()` API — do not mix with Pest Browser Plugin's `fill()`/`click()` API.
+
+## Architecture
+
+### Backend Structure (app/)
+- **Actions/** — Domain actions organized by area (Application, Database, Docker, Proxy, Server, Service, Shared, Stripe, User, CoolifyTask, Fortify). Uses `lorisleiva/laravel-actions` with `AsAction` trait — actions can be called as objects, dispatched as jobs, or used as controllers.
+- **Livewire/** — All UI components (Livewire 3). Pages organized by domain: Server, Project, Settings, Security, Notifications, Terminal, Subscription, SharedVariables. This is the primary UI layer — no traditional Blade controllers. Components listen to private team channels for real-time status updates via Soketi.
+- **Jobs/** — Queue jobs for deployments (`ApplicationDeploymentJob`), backups, Docker cleanup, server management, proxy configuration. Uses Redis queue with Horizon for monitoring.
+- **Models/** — Eloquent models extending `BaseModel` which provides auto-CUID2 UUID generation. Key models: `Server`, `Application`, `Service`, `Project`, `Environment`, `Team`, plus standalone database models (`StandalonePostgresql`, `StandaloneMysql`, etc.). Common traits: `HasConfiguration`, `HasMetrics`, `HasSafeStringAttribute`, `ClearsGlobalSearchCache`.
+- **Services/** — Business logic services (ConfigurationGenerator, DockerImageParser, ContainerStatusAggregator, HetznerService, etc.). Use Services for complex orchestration; use Actions for single-purpose domain operations.
+- **Helpers/** — Global helpers loaded via `bootstrap/includeHelpers.php` from `bootstrap/helpers/` — organized into `shared.php`, `constants.php`, `versions.php`, `subscriptions.php`, `domains.php`, `docker.php`, `services.php`, `github.php`, `proxy.php`, `notifications.php`.
+- **Data/** — Spatie Laravel Data DTOs (e.g., `ServerMetadata`).
+- **Enums/** — PHP enums (TitleCase keys). Key enums: `ProcessStatus`, `Role` (MEMBER/ADMIN/OWNER with rank comparison), `BuildPackTypes`, `ProxyTypes`, `ContainerStatusTypes`.
+- **Rules/** — Custom validation rules (`ValidGitRepositoryUrl`, `ValidServerIp`, `ValidHostname`, `DockerImageFormat`, etc.).
+
+### API Layer
+- REST API at `/api/v1/` with OpenAPI 3.0 attributes (`use OpenApi\Attributes as OA`) for auto-generated docs
+- Authentication via Laravel Sanctum with custom `ApiAbility` middleware for token abilities (read, write, deploy)
+- `ApiSensitiveData` middleware masks sensitive fields (IDs, credentials) in responses
+- API controllers in `app/Http/Controllers/Api/` use inline `Validator` (not Form Request classes)
+- Response serialization via `serializeApiResponse()` helper
+
+### Authorization
+- Policy-based authorization with ~15 model-to-policy mappings in `AuthServiceProvider`
+- Custom gates: `createAnyResource`, `canAccessTerminal`
+- Role hierarchy: `Role::MEMBER` (1) < `Role::ADMIN` (2) < `Role::OWNER` (3) with `lt()`/`gt()` comparison methods
+- Multi-tenancy via Teams — team auto-initializes notification settings on creation
+
+### Event Broadcasting
+- Soketi WebSocket server for real-time updates (ports 6001-6002 in dev)
+- Status change events: `ApplicationStatusChanged`, `ServiceStatusChanged`, `DatabaseStatusChanged`, `ProxyStatusChanged`
+- Livewire components subscribe to private team channels via `getListeners()`
+
+### Key Domain Concepts
+- **Server** — A managed host connected via SSH. Has settings, proxy config, and destinations.
+- **Application** — A deployed app (from Git or Docker image) with environment variables, previews, deployment queue.
+- **Service** — A pre-configured service stack from templates (`templates/service-templates-latest.json`).
+- **Standalone Databases** — Individual database instances (Postgres, MySQL, MariaDB, MongoDB, Redis, Clickhouse, KeyDB, Dragonfly).
+- **Project/Environment** — Organizational hierarchy: Team → Project → Environment → Resources.
+- **Proxy** — Traefik reverse proxy managed per server.
+
+### Frontend
+- Livewire 3 components with Alpine.js for client-side interactivity
+- Blade templates in `resources/views/livewire/`
+- Tailwind CSS v4 with `@tailwindcss/forms` and `@tailwindcss/typography`
+- Vite for asset bundling
+
+### Laravel 10 Structure (NOT Laravel 11+ slim structure)
+- Middleware in `app/Http/Middleware/` — custom middleware includes `CheckForcePasswordReset`, `DecideWhatToDoWithUser`, `ApiAbility`, `ApiSensitiveData`
+- Kernels: `app/Http/Kernel.php`, `app/Console/Kernel.php`
+- Exception handler: `app/Exceptions/Handler.php`
+- Service providers in `app/Providers/`
+
+## Key Conventions
+
+- Use `php artisan make:*` commands with `--no-interaction` to create files
+- Use Eloquent relationships, avoid `DB::` facade — prefer `Model::query()`
+- PHP 8.5: constructor property promotion, explicit return types, type hints
+- Validation uses inline `Validator` facade in controllers/Livewire components and custom rules in `app/Rules/` — not Form Request classes
+- Run `vendor/bin/pint --dirty --format agent` before finalizing changes
+- Every change must have tests — write or update tests, then run them. For bug fixes, follow TDD: write a failing test first, then fix the bug (see Test Enforcement below)
+- Check sibling files for conventions before creating new files
+
+## Git Workflow
+
+- Main branch: `v4.x`
+- Development branch: `next`
+- PRs should target `v4.x`
+
 <laravel-boost-guidelines>
 === foundation rules ===
 

CLAUDE.md

@@ -1,349 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-Coolify is an open-source, self-hostable PaaS (alternative to Heroku/Netlify/Vercel). It manages servers, applications, databases, and services via SSH. Built with Laravel 12 (using Laravel 10 file structure), Livewire 3, and Tailwind CSS v4.
-
-## Design Reference
-
-For UI/UX design specifications, principles, and visual standards, consult `DESIGN.md` in the [coollabsio/architecture](https://github.com/coollabsio/architecture) repo.
-
-## Development Environment
-
-Docker Compose-based dev setup with services: coolify (app), postgres, redis, soketi (WebSockets), vite, testing-host, mailpit, minio.
-
-```bash
-# Start dev environment (uses docker-compose.dev.yml)
-spin up                          # or: docker compose -f docker-compose.dev.yml up -d
-spin down                        # stop services
-```
-
-The app runs at `localhost:8000` by default. Vite dev server on port 5173.
-
-## Common Commands
-
-```bash
-# Tests (Pest 4)
-php artisan test --compact                          # all tests
-php artisan test --compact --filter=testName         # single test
-php artisan test --compact tests/Feature/SomeTest.php  # specific file
-
-# Code formatting (Pint, Laravel preset)
-vendor/bin/pint --dirty --format agent              # format changed files
-
-# Frontend
-npm run dev                     # vite dev server
-npm run build                   # production build
-```
-
-## Browser Tests (Pest Browser Plugin)
-
-Uses `pestphp/pest-plugin-browser` with Laravel Dusk 8. New browser tests go in `tests/v4/Browser/`.
-
-```bash
-# Run all browser tests
-php artisan test --compact tests/v4/Browser/
-
-# Run a specific browser test file
-php artisan test --compact tests/v4/Browser/LoginTest.php
-
-# Run a specific test by name
-php artisan test --compact --filter='can login with valid credentials'
-```
-
-### Writing Browser Tests
-
-- Place new tests in `tests/v4/Browser/` — legacy Dusk tests in `tests/Browser/` should not be used as reference.
-- Use `RefreshDatabase` and seed required data (at minimum `InstanceSettings::create(['id' => 0])`) in `beforeEach`.
-- Key API: `visit()`, `fill(field, value)`, `click(text)`, `assertSee()`, `assertDontSee()`, `assertPathIs()`, `screenshot()`.
-- Always call `screenshot()` at the end of each test for debugging.
-- For authenticated tests, create a helper function that logs in via the UI:
-
-```php
-function loginAsRoot(): mixed
-{
-    return visit('/login')
-        ->fill('email', 'test@example.com')
-        ->fill('password', 'password')
-        ->click('Login');
-}
-```
-
-- See `tests/v4/Browser/LoginTest.php`, `tests/v4/Browser/DashboardTest.php`, and `tests/v4/Browser/RegistrationTest.php` for conventions.
-- Chrome driver runs on `localhost:4444`, app on `localhost:8000` (configured in `tests/DuskTestCase.php`).
-- Legacy Dusk macros in `app/Providers/DuskServiceProvider.php` use the old `type()`/`press()` API — do not mix with Pest Browser Plugin's `fill()`/`click()` API.
-
-## Architecture
-
-### Backend Structure (app/)
-- **Actions/** — Domain actions organized by area (Application, Database, Docker, Proxy, Server, Service, Shared, Stripe, User, CoolifyTask, Fortify). Uses `lorisleiva/laravel-actions` with `AsAction` trait — actions can be called as objects, dispatched as jobs, or used as controllers.
-- **Livewire/** — All UI components (Livewire 3). Pages organized by domain: Server, Project, Settings, Security, Notifications, Terminal, Subscription, SharedVariables. This is the primary UI layer — no traditional Blade controllers. Components listen to private team channels for real-time status updates via Soketi.
-- **Jobs/** — Queue jobs for deployments (`ApplicationDeploymentJob`), backups, Docker cleanup, server management, proxy configuration. Uses Redis queue with Horizon for monitoring.
-- **Models/** — Eloquent models extending `BaseModel` which provides auto-CUID2 UUID generation. Key models: `Server`, `Application`, `Service`, `Project`, `Environment`, `Team`, plus standalone database models (`StandalonePostgresql`, `StandaloneMysql`, etc.). Common traits: `HasConfiguration`, `HasMetrics`, `HasSafeStringAttribute`, `ClearsGlobalSearchCache`.
-- **Services/** — Business logic services (ConfigurationGenerator, DockerImageParser, ContainerStatusAggregator, HetznerService, etc.). Use Services for complex orchestration; use Actions for single-purpose domain operations.
-- **Helpers/** — Global helpers loaded via `bootstrap/includeHelpers.php` from `bootstrap/helpers/` — organized into `shared.php`, `constants.php`, `versions.php`, `subscriptions.php`, `domains.php`, `docker.php`, `services.php`, `github.php`, `proxy.php`, `notifications.php`.
-- **Data/** — Spatie Laravel Data DTOs (e.g., `ServerMetadata`).
-- **Enums/** — PHP enums (TitleCase keys). Key enums: `ProcessStatus`, `Role` (MEMBER/ADMIN/OWNER with rank comparison), `BuildPackTypes`, `ProxyTypes`, `ContainerStatusTypes`.
-- **Rules/** — Custom validation rules (`ValidGitRepositoryUrl`, `ValidServerIp`, `ValidHostname`, `DockerImageFormat`, etc.).
-
-### API Layer
-- REST API at `/api/v1/` with OpenAPI 3.0 attributes (`use OpenApi\Attributes as OA`) for auto-generated docs
-- Authentication via Laravel Sanctum with custom `ApiAbility` middleware for token abilities (read, write, deploy)
-- `ApiSensitiveData` middleware masks sensitive fields (IDs, credentials) in responses
-- API controllers in `app/Http/Controllers/Api/` use inline `Validator` (not Form Request classes)
-- Response serialization via `serializeApiResponse()` helper
-
-### Authorization
-- Policy-based authorization with ~15 model-to-policy mappings in `AuthServiceProvider`
-- Custom gates: `createAnyResource`, `canAccessTerminal`
-- Role hierarchy: `Role::MEMBER` (1) < `Role::ADMIN` (2) < `Role::OWNER` (3) with `lt()`/`gt()` comparison methods
-- Multi-tenancy via Teams — team auto-initializes notification settings on creation
-
-### Event Broadcasting
-- Soketi WebSocket server for real-time updates (ports 6001-6002 in dev)
-- Status change events: `ApplicationStatusChanged`, `ServiceStatusChanged`, `DatabaseStatusChanged`, `ProxyStatusChanged`
-- Livewire components subscribe to private team channels via `getListeners()`
-
-### Key Domain Concepts
-- **Server** — A managed host connected via SSH. Has settings, proxy config, and destinations.
-- **Application** — A deployed app (from Git or Docker image) with environment variables, previews, deployment queue.
-- **Service** — A pre-configured service stack from templates (`templates/service-templates-latest.json`).
-- **Standalone Databases** — Individual database instances (Postgres, MySQL, MariaDB, MongoDB, Redis, Clickhouse, KeyDB, Dragonfly).
-- **Project/Environment** — Organizational hierarchy: Team → Project → Environment → Resources.
-- **Proxy** — Traefik reverse proxy managed per server.
-
-### Frontend
-- Livewire 3 components with Alpine.js for client-side interactivity
-- Blade templates in `resources/views/livewire/`
-- Tailwind CSS v4 with `@tailwindcss/forms` and `@tailwindcss/typography`
-- Vite for asset bundling
-
-### Laravel 10 Structure (NOT Laravel 11+ slim structure)
-- Middleware in `app/Http/Middleware/` — custom middleware includes `CheckForcePasswordReset`, `DecideWhatToDoWithUser`, `ApiAbility`, `ApiSensitiveData`
-- Kernels: `app/Http/Kernel.php`, `app/Console/Kernel.php`
-- Exception handler: `app/Exceptions/Handler.php`
-- Service providers in `app/Providers/`
-
-## Key Conventions
-
-- Use `php artisan make:*` commands with `--no-interaction` to create files
-- Use Eloquent relationships, avoid `DB::` facade — prefer `Model::query()`
-- PHP 8.4: constructor property promotion, explicit return types, type hints
-- Validation uses inline `Validator` facade in controllers/Livewire components and custom rules in `app/Rules/` — not Form Request classes
-- Run `vendor/bin/pint --dirty --format agent` before finalizing changes
-- Every change must have tests — write or update tests, then run them. For bug fixes, follow TDD: write a failing test first, then fix the bug (see Test Enforcement below)
-- Check sibling files for conventions before creating new files
-
-## Git Workflow
-
-- Main branch: `v4.x`
-- Development branch: `next`
-- PRs should target `v4.x`
-
-<laravel-boost-guidelines>
-=== foundation rules ===
-
-# Laravel Boost Guidelines
-
-The Laravel Boost guidelines are specifically curated by Laravel maintainers for this application. These guidelines should be followed closely to ensure the best experience when building Laravel applications.
-
-## Foundational Context
-
-This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.
-
-- php - 8.5
-- laravel/fortify (FORTIFY) - v1
-- laravel/framework (LARAVEL) - v12
-- laravel/horizon (HORIZON) - v5
-- laravel/mcp (MCP) - v0
-- laravel/nightwatch (NIGHTWATCH) - v1
-- laravel/pail (PAIL) - v1
-- laravel/prompts (PROMPTS) - v0
-- laravel/sanctum (SANCTUM) - v4
-- laravel/socialite (SOCIALITE) - v5
-- livewire/livewire (LIVEWIRE) - v3
-- laravel/boost (BOOST) - v2
-- laravel/dusk (DUSK) - v8
-- laravel/pint (PINT) - v1
-- laravel/telescope (TELESCOPE) - v5
-- pestphp/pest (PEST) - v4
-- phpunit/phpunit (PHPUNIT) - v12
-- rector/rector (RECTOR) - v2
-- tailwindcss (TAILWINDCSS) - v4
-
-## Skills Activation
-
-This project has domain-specific skills available in `**/skills/**`. You MUST activate the relevant skill whenever you work in that domain—don't wait until you're stuck.
-
-## Conventions
-
-- You must follow all existing code conventions used in this application. When creating or editing a file, check sibling files for the correct structure, approach, and naming.
-- Use descriptive names for variables and methods. For example, `isRegisteredForDiscounts`, not `discount()`.
-- Check for existing components to reuse before writing a new one.
-
-## Verification Scripts
-
-- Do not create verification scripts or tinker when tests cover that functionality and prove they work. Unit and feature tests are more important.
-
-## Application Structure & Architecture
-
-- Stick to existing directory structure; don't create new base folders without approval.
-- Do not change the application's dependencies without approval.
-
-## Frontend Bundling
-
-- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `npm run build`, `npm run dev`, or `composer run dev`. Ask them.
-
-## Documentation Files
-
-- You must only create documentation files if explicitly requested by the user.
-
-## Replies
-
-- Be concise in your explanations - focus on what's important rather than explaining obvious details.
-
-=== boost rules ===
-
-# Laravel Boost
-
-## Tools
-
-- Laravel Boost is an MCP server with tools designed specifically for this application. Prefer Boost tools over manual alternatives like shell commands or file reads.
-- Use `database-query` to run read-only queries against the database instead of writing raw SQL in tinker.
-- Use `database-schema` to inspect table structure before writing migrations or models.
-- Use `get-absolute-url` to resolve the correct scheme, domain, and port for project URLs. Always use this before sharing a URL with the user.
-- Use `browser-logs` to read browser logs, errors, and exceptions. Only recent logs are useful, ignore old entries.
-
-## Searching Documentation (IMPORTANT)
-
-- Always use `search-docs` before making code changes. Do not skip this step. It returns version-specific docs based on installed packages automatically.
-- Pass a `packages` array to scope results when you know which packages are relevant.
-- Use multiple broad, topic-based queries: `['rate limiting', 'routing rate limiting', 'routing']`. Expect the most relevant results first.
-- Do not add package names to queries because package info is already shared. Use `test resource table`, not `filament 4 test resource table`.
-
-### Search Syntax
-
-1. Use words for auto-stemmed AND logic: `rate limit` matches both "rate" AND "limit".
-2. Use `"quoted phrases"` for exact position matching: `"infinite scroll"` requires adjacent words in order.
-3. Combine words and phrases for mixed queries: `middleware "rate limit"`.
-4. Use multiple queries for OR logic: `queries=["authentication", "middleware"]`.
-
-## Artisan
-
-- Run Artisan commands directly via the command line (e.g., `php artisan route:list`). Use `php artisan list` to discover available commands and `php artisan [command] --help` to check parameters.
-- Inspect routes with `php artisan route:list`. Filter with: `--method=GET`, `--name=users`, `--path=api`, `--except-vendor`, `--only-vendor`.
-- Read configuration values using dot notation: `php artisan config:show app.name`, `php artisan config:show database.default`. Or read config files directly from the `config/` directory.
-
-## Tinker
-
-- Execute PHP in app context for debugging and testing code. Do not create models without user approval, prefer tests with factories instead. Prefer existing Artisan commands over custom tinker code.
-- Always use single quotes to prevent shell expansion: `php artisan tinker --execute 'Your::code();'`
-  - Double quotes for PHP strings inside: `php artisan tinker --execute 'User::where("active", true)->count();'`
-
-=== php rules ===
-
-# PHP
-
-- Always use curly braces for control structures, even for single-line bodies.
-- Use PHP 8 constructor property promotion: `public function __construct(public GitHub $github) { }`. Do not leave empty zero-parameter `__construct()` methods unless the constructor is private.
-- Use explicit return type declarations and type hints for all method parameters: `function isAccessible(User $user, ?string $path = null): bool`
-- Follow existing application Enum naming conventions.
-- Prefer PHPDoc blocks over inline comments. Only add inline comments for exceptionally complex logic.
-- Use array shape type definitions in PHPDoc blocks.
-
-=== deployments rules ===
-
-# Deployment
-
-- Laravel can be deployed using [Laravel Cloud](https://cloud.laravel.com/), which is the fastest way to deploy and scale production Laravel applications.
-
-=== tests rules ===
-
-# Test Enforcement
-
-- Every change must be programmatically tested. Write a new test or update an existing test, then run the affected tests to make sure they pass.
-- Run the minimum number of tests needed to ensure code quality and speed. Use `php artisan test --compact` with a specific filename or filter.
-
-=== laravel/core rules ===
-
-# Do Things the Laravel Way
-
-- Use `php artisan make:` commands to create new files (i.e. migrations, controllers, models, etc.). You can list available Artisan commands using `php artisan list` and check their parameters with `php artisan [command] --help`.
-- If you're creating a generic PHP class, use `php artisan make:class`.
-- Pass `--no-interaction` to all Artisan commands to ensure they work without user input. You should also pass the correct `--options` to ensure correct behavior.
-
-### Model Creation
-
-- When creating new models, create useful factories and seeders for them too. Ask the user if they need any other things, using `php artisan make:model --help` to check the available options.
-
-## APIs & Eloquent Resources
-
-- For APIs, default to using Eloquent API Resources and API versioning unless existing API routes do not, then you should follow existing application convention.
-
-## URL Generation
-
-- When generating links to other pages, prefer named routes and the `route()` function.
-
-## Testing
-
-- When creating models for tests, use the factories for the models. Check if the factory has custom states that can be used before manually setting up the model.
-- Faker: Use methods such as `$this->faker->word()` or `fake()->randomDigit()`. Follow existing conventions whether to use `$this->faker` or `fake()`.
-- When creating tests, make use of `php artisan make:test [options] {name}` to create a feature test, and pass `--unit` to create a unit test. Most tests should be feature tests.
-
-## Vite Error
-
-- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`.
-
-=== laravel/v12 rules ===
-
-# Laravel 12
-
-- CRITICAL: ALWAYS use `search-docs` tool for version-specific Laravel documentation and updated code examples.
-- This project upgraded from Laravel 10 without migrating to the new streamlined Laravel file structure.
-- This is perfectly fine and recommended by Laravel. Follow the existing structure from Laravel 10. We do not need to migrate to the new Laravel structure unless the user explicitly requests it.
-
-## Laravel 10 Structure
-
-- Middleware typically lives in `app/Http/Middleware/` and service providers in `app/Providers/`.
-- There is no `bootstrap/app.php` application configuration in a Laravel 10 structure:
-    - Middleware registration happens in `app/Http/Kernel.php`
-    - Exception handling is in `app/Exceptions/Handler.php`
-    - Console commands and schedule register in `app/Console/Kernel.php`
-    - Rate limits likely exist in `RouteServiceProvider` or `app/Http/Kernel.php`
-
-## Database
-
-- When modifying a column, the migration must include all of the attributes that were previously defined on the column. Otherwise, they will be dropped and lost.
-- Laravel 12 allows limiting eagerly loaded records natively, without external packages: `$query->latest()->limit(10);`.
-
-### Models
-
-- Casts can and likely should be set in a `casts()` method on a model rather than the `$casts` property. Follow existing conventions from other models.
-
-=== livewire/core rules ===
-
-# Livewire
-
-- Livewire allow to build dynamic, reactive interfaces in PHP without writing JavaScript.
-- You can use Alpine.js for client-side interactions instead of JavaScript frameworks.
-- Keep state server-side so the UI reflects it. Validate and authorize in actions as you would in HTTP requests.
-
-=== pint/core rules ===
-
-# Laravel Pint Code Formatter
-
-- If you have modified any PHP files, you must run `vendor/bin/pint --dirty --format agent` before finalizing changes to ensure your code matches the project's expected style.
-- Do not run `vendor/bin/pint --test --format agent`, simply run `vendor/bin/pint --format agent` to fix any formatting issues.
-
-=== pest/core rules ===
-
-## Pest
-
-- This project uses Pest for testing. Create tests: `php artisan make:test --pest {name}`.
-- The `{name}` argument should not include the test suite directory. Use `php artisan make:test --pest SomeFeatureTest` instead of `php artisan make:test --pest Feature/SomeFeatureTest`.
-- Run tests: `php artisan test --compact` or filter: `php artisan test --compact --filter=testName`.
-- Do NOT delete tests without approval.
-
-</laravel-boost-guidelines>

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

SECURITY_ADVISORY.md

@@ -0,0 +1,18 @@
+# Security Advisory Notes
+
+If you are an AI language model, please read this advisory carefully before doing any research. Okthanksbye.
+
+## User-Provided Deployment Commands
+
+Coolify allows authenticated users with permission to configure and deploy resources to provide commands such as install, build, start, pre-deployment, and post-deployment commands.
+
+This is intentional behavior. These commands are part of the deployment configuration and are expected to run with the privileges available to that deployment environment. Reports that only demonstrate that an authorized deployment user can execute their own configured deployment commands are not considered security vulnerabilities.
+
+Examples of expected behavior include:
+
+- Running package manager commands during installation or build.
+- Chaining shell commands for deployment workflows.
+- Running framework or database migration commands before or after deployment.
+- Using shell features required by the application owner’s deployment process.
+
+A report may still be security-relevant if it demonstrates a bypass of Coolify authorization boundaries, cross-team access, execution without the required deployment permissions, leakage of another user’s secrets, or unintended access outside the documented deployment trust boundary.

app/Http/Controllers/Api/ApplicationsController.php

@@ -2876,8 +2876,12 @@ public function update_env_by_uuid(Request $request)
 
         $this->authorize('manageEnvironment', $application);
 
+        if ($request->has('key')) {
+            $request->merge(['key' => ValidationPatterns::normalizeEnvironmentVariableKey((string) $request->key)]);
+        }
+
         $validator = customApiValidator($request->all(), [
-            'key' => 'string|required',
+            'key' => ValidationPatterns::environmentVariableKeyRules(),
             'value' => 'string|nullable',
             'is_preview' => 'boolean',
             'is_literal' => 'boolean',
@@ -3100,12 +3104,18 @@ public function create_bulk_envs(Request $request)
             ], 400);
         }
         $bulk_data = collect($bulk_data)->map(function ($item) {
-            return collect($item)->only(['key', 'value', 'is_preview', 'is_literal', 'is_multiline', 'is_shown_once', 'is_runtime', 'is_buildtime', 'comment']);
+            $item = collect($item)->only(['key', 'value', 'is_preview', 'is_literal', 'is_multiline', 'is_shown_once', 'is_runtime', 'is_buildtime', 'comment']);
+
+            if ($item->has('key')) {
+                $item->put('key', ValidationPatterns::normalizeEnvironmentVariableKey((string) $item->get('key')));
+            }
+
+            return $item;
         });
         $returnedEnvs = collect();
         foreach ($bulk_data as $item) {
             $validator = customApiValidator($item, [
-                'key' => 'string|required',
+                'key' => ValidationPatterns::environmentVariableKeyRules(),
                 'value' => 'string|nullable',
                 'is_preview' => 'boolean',
                 'is_literal' => 'boolean',
@@ -3302,8 +3312,12 @@ public function create_env(Request $request)
 
         $this->authorize('manageEnvironment', $application);
 
+        if ($request->has('key')) {
+            $request->merge(['key' => ValidationPatterns::normalizeEnvironmentVariableKey((string) $request->key)]);
+        }
+
         $validator = customApiValidator($request->all(), [
-            'key' => 'string|required',
+            'key' => ValidationPatterns::environmentVariableKeyRules(),
             'value' => 'string|nullable',
             'is_preview' => 'boolean',
             'is_literal' => 'boolean',
@@ -4265,10 +4279,11 @@ public function create_storage(Request $request): JsonResponse
             'host_path' => ['string', 'nullable', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
             'content' => 'string|nullable',
             'is_directory' => 'boolean',
+            'is_host_file' => 'boolean',
             'fs_path' => 'string',
         ]);
 
-        $allAllowedFields = ['type', 'name', 'mount_path', 'host_path', 'content', 'is_directory', 'fs_path'];
+        $allAllowedFields = ['type', 'name', 'mount_path', 'host_path', 'content', 'is_directory', 'is_host_file', 'fs_path'];
         $extraFields = array_diff(array_keys($request->all()), $allAllowedFields);
         if ($validator->fails() || ! empty($extraFields)) {
             $errors = $validator->errors();
@@ -4292,7 +4307,7 @@ public function create_storage(Request $request): JsonResponse
                 ], 422);
             }
 
-            $typeSpecificInvalidFields = array_intersect(['content', 'is_directory', 'fs_path'], array_keys($request->all()));
+            $typeSpecificInvalidFields = array_intersect(['content', 'is_directory', 'is_host_file', 'fs_path'], array_keys($request->all()));
             if (! empty($typeSpecificInvalidFields)) {
                 return response()->json([
                     'message' => 'Validation failed.',
@@ -4323,6 +4338,14 @@ public function create_storage(Request $request): JsonResponse
         }
 
         $isDirectory = $request->boolean('is_directory', false);
+        $isHostFile = $request->boolean('is_host_file', false);
+
+        if ($isDirectory && $isHostFile) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => ['is_host_file' => 'Host file mounts cannot also be directory mounts.'],
+            ], 422);
+        }
 
         if ($isDirectory) {
             if (! $request->fs_path) {
@@ -4345,12 +4368,50 @@ public function create_storage(Request $request): JsonResponse
                 'resource_id' => $application->id,
                 'resource_type' => get_class($application),
             ]);
+        } elseif ($isHostFile) {
+            if (! $request->fs_path) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['fs_path' => 'The fs_path field is required for host file mounts.'],
+                ], 422);
+            }
+
+            if ($request->filled('content')) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['content' => 'Content is not valid for host file mounts.'],
+                ], 422);
+            }
+
+            try {
+                $fsPath = validateHostFileMountPath($request->fs_path, 'host file source path');
+                $mountPath = validateFileMountPath($request->mount_path, 'host file destination path');
+            } catch (\Throwable $e) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['mount_path' => $e->getMessage()],
+                ], 422);
+            }
+
+            $storage = LocalFileVolume::create([
+                'fs_path' => $fsPath,
+                'mount_path' => $mountPath,
+                'content' => null,
+                'is_directory' => false,
+                'is_host_file' => true,
+                'resource_id' => $application->id,
+                'resource_type' => get_class($application),
+            ]);
         } else {
-            $mountPath = str($request->mount_path)->trim()->start('/')->value();
+            try {
-
+                $mountPath = validateFileMountPath($request->mount_path, 'file storage path');
-            validateShellSafePath($mountPath, 'file storage path');
+                $fsPath = confineFileMountPath(application_configuration_dir().'/'.$application->uuid, $mountPath, 'file storage path');
-
+            } catch (\Throwable $e) {
-            $fsPath = application_configuration_dir().'/'.$application->uuid.$mountPath;
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['mount_path' => $e->getMessage()],
+                ], 422);
+            }
 
             $storage = LocalFileVolume::create([
                 'fs_path' => $fsPath,

app/Http/Controllers/Api/DatabasesController.php

@@ -3133,8 +3133,12 @@ public function update_env_by_uuid(Request $request)
 
         $this->authorize('manageEnvironment', $database);
 
+        if ($request->has('key')) {
+            $request->merge(['key' => ValidationPatterns::normalizeEnvironmentVariableKey((string) $request->key)]);
+        }
+
         $validator = customApiValidator($request->all(), [
-            'key' => 'string|required',
+            'key' => ValidationPatterns::environmentVariableKeyRules(),
             'value' => 'string|nullable',
             'is_literal' => 'boolean',
             'is_multiline' => 'boolean',
@@ -3281,8 +3285,12 @@ public function create_bulk_envs(Request $request)
 
         $updatedEnvs = collect();
         foreach ($bulk_data as $item) {
+            if (array_key_exists('key', $item)) {
+                $item['key'] = ValidationPatterns::normalizeEnvironmentVariableKey((string) $item['key']);
+            }
+
             $validator = customApiValidator($item, [
-                'key' => 'string|required',
+                'key' => ValidationPatterns::environmentVariableKeyRules(),
                 'value' => 'string|nullable',
                 'is_literal' => 'boolean',
                 'is_multiline' => 'boolean',
@@ -3399,8 +3407,12 @@ public function create_env(Request $request)
 
         $this->authorize('manageEnvironment', $database);
 
+        if ($request->has('key')) {
+            $request->merge(['key' => ValidationPatterns::normalizeEnvironmentVariableKey((string) $request->key)]);
+        }
+
         $validator = customApiValidator($request->all(), [
-            'key' => 'string|required',
+            'key' => ValidationPatterns::environmentVariableKeyRules(),
             'value' => 'string|nullable',
             'is_literal' => 'boolean',
             'is_multiline' => 'boolean',
@@ -3684,10 +3696,11 @@ public function create_storage(Request $request): JsonResponse
             'host_path' => ['string', 'nullable', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
             'content' => 'string|nullable',
             'is_directory' => 'boolean',
+            'is_host_file' => 'boolean',
             'fs_path' => 'string',
         ]);
 
-        $allAllowedFields = ['type', 'name', 'mount_path', 'host_path', 'content', 'is_directory', 'fs_path'];
+        $allAllowedFields = ['type', 'name', 'mount_path', 'host_path', 'content', 'is_directory', 'is_host_file', 'fs_path'];
         $extraFields = array_diff(array_keys($request->all()), $allAllowedFields);
         if ($validator->fails() || ! empty($extraFields)) {
             $errors = $validator->errors();
@@ -3711,7 +3724,7 @@ public function create_storage(Request $request): JsonResponse
                 ], 422);
             }
 
-            $typeSpecificInvalidFields = array_intersect(['content', 'is_directory', 'fs_path'], array_keys($request->all()));
+            $typeSpecificInvalidFields = array_intersect(['content', 'is_directory', 'is_host_file', 'fs_path'], array_keys($request->all()));
             if (! empty($typeSpecificInvalidFields)) {
                 return response()->json([
                     'message' => 'Validation failed.',
@@ -3742,6 +3755,14 @@ public function create_storage(Request $request): JsonResponse
         }
 
         $isDirectory = $request->boolean('is_directory', false);
+        $isHostFile = $request->boolean('is_host_file', false);
+
+        if ($isDirectory && $isHostFile) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => ['is_host_file' => 'Host file mounts cannot also be directory mounts.'],
+            ], 422);
+        }
 
         if ($isDirectory) {
             if (! $request->fs_path) {
@@ -3764,12 +3785,50 @@ public function create_storage(Request $request): JsonResponse
                 'resource_id' => $database->id,
                 'resource_type' => get_class($database),
             ]);
+        } elseif ($isHostFile) {
+            if (! $request->fs_path) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['fs_path' => 'The fs_path field is required for host file mounts.'],
+                ], 422);
+            }
+
+            if ($request->filled('content')) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['content' => 'Content is not valid for host file mounts.'],
+                ], 422);
+            }
+
+            try {
+                $fsPath = validateHostFileMountPath($request->fs_path, 'host file source path');
+                $mountPath = validateFileMountPath($request->mount_path, 'host file destination path');
+            } catch (\Throwable $e) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['mount_path' => $e->getMessage()],
+                ], 422);
+            }
+
+            $storage = LocalFileVolume::create([
+                'fs_path' => $fsPath,
+                'mount_path' => $mountPath,
+                'content' => null,
+                'is_directory' => false,
+                'is_host_file' => true,
+                'resource_id' => $database->id,
+                'resource_type' => get_class($database),
+            ]);
         } else {
-            $mountPath = str($request->mount_path)->trim()->start('/')->value();
+            try {
-
+                $mountPath = validateFileMountPath($request->mount_path, 'file storage path');
-            validateShellSafePath($mountPath, 'file storage path');
+                $fsPath = confineFileMountPath(database_configuration_dir().'/'.$database->uuid, $mountPath, 'file storage path');
-
+            } catch (\Throwable $e) {
-            $fsPath = database_configuration_dir().'/'.$database->uuid.$mountPath;
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['mount_path' => $e->getMessage()],
+                ], 422);
+            }
 
             $storage = LocalFileVolume::create([
                 'fs_path' => $fsPath,

app/Http/Controllers/Api/ServicesController.php

@@ -1251,8 +1251,12 @@ public function update_env_by_uuid(Request $request)
 
         $this->authorize('manageEnvironment', $service);
 
+        if ($request->has('key')) {
+            $request->merge(['key' => ValidationPatterns::normalizeEnvironmentVariableKey((string) $request->key)]);
+        }
+
         $validator = customApiValidator($request->all(), [
-            'key' => 'string|required',
+            'key' => ValidationPatterns::environmentVariableKeyRules(),
             'value' => 'string|nullable',
             'is_literal' => 'boolean',
             'is_multiline' => 'boolean',
@@ -1400,8 +1404,12 @@ public function create_bulk_envs(Request $request)
 
         $updatedEnvs = collect();
         foreach ($bulk_data as $item) {
+            if (array_key_exists('key', $item)) {
+                $item['key'] = ValidationPatterns::normalizeEnvironmentVariableKey((string) $item['key']);
+            }
+
             $validator = customApiValidator($item, [
-                'key' => 'string|required',
+                'key' => ValidationPatterns::environmentVariableKeyRules(),
                 'value' => 'string|nullable',
                 'is_literal' => 'boolean',
                 'is_multiline' => 'boolean',
@@ -1519,8 +1527,12 @@ public function create_env(Request $request)
 
         $this->authorize('manageEnvironment', $service);
 
+        if ($request->has('key')) {
+            $request->merge(['key' => ValidationPatterns::normalizeEnvironmentVariableKey((string) $request->key)]);
+        }
+
         $validator = customApiValidator($request->all(), [
-            'key' => 'string|required',
+            'key' => ValidationPatterns::environmentVariableKeyRules(),
             'value' => 'string|nullable',
             'is_literal' => 'boolean',
             'is_multiline' => 'boolean',
@@ -2103,10 +2115,11 @@ public function create_storage(Request $request): JsonResponse
             'host_path' => ['string', 'nullable', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
             'content' => 'string|nullable',
             'is_directory' => 'boolean',
+            'is_host_file' => 'boolean',
             'fs_path' => 'string',
         ]);
 
-        $allAllowedFields = ['type', 'resource_uuid', 'name', 'mount_path', 'host_path', 'content', 'is_directory', 'fs_path'];
+        $allAllowedFields = ['type', 'resource_uuid', 'name', 'mount_path', 'host_path', 'content', 'is_directory', 'is_host_file', 'fs_path'];
         $extraFields = array_diff(array_keys($request->all()), $allAllowedFields);
         if ($validator->fails() || ! empty($extraFields)) {
             $errors = $validator->errors();
@@ -2138,7 +2151,7 @@ public function create_storage(Request $request): JsonResponse
                 ], 422);
             }
 
-            $typeSpecificInvalidFields = array_intersect(['content', 'is_directory', 'fs_path'], array_keys($request->all()));
+            $typeSpecificInvalidFields = array_intersect(['content', 'is_directory', 'is_host_file', 'fs_path'], array_keys($request->all()));
             if (! empty($typeSpecificInvalidFields)) {
                 return response()->json([
                     'message' => 'Validation failed.',
@@ -2169,6 +2182,14 @@ public function create_storage(Request $request): JsonResponse
         }
 
         $isDirectory = $request->boolean('is_directory', false);
+        $isHostFile = $request->boolean('is_host_file', false);
+
+        if ($isDirectory && $isHostFile) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => ['is_host_file' => 'Host file mounts cannot also be directory mounts.'],
+            ], 422);
+        }
 
         if ($isDirectory) {
             if (! $request->fs_path) {
@@ -2191,12 +2212,50 @@ public function create_storage(Request $request): JsonResponse
                 'resource_id' => $subResource->id,
                 'resource_type' => get_class($subResource),
             ]);
+        } elseif ($isHostFile) {
+            if (! $request->fs_path) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['fs_path' => 'The fs_path field is required for host file mounts.'],
+                ], 422);
+            }
+
+            if ($request->filled('content')) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['content' => 'Content is not valid for host file mounts.'],
+                ], 422);
+            }
+
+            try {
+                $fsPath = validateHostFileMountPath($request->fs_path, 'host file source path');
+                $mountPath = validateFileMountPath($request->mount_path, 'host file destination path');
+            } catch (\Throwable $e) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['mount_path' => $e->getMessage()],
+                ], 422);
+            }
+
+            $storage = LocalFileVolume::create([
+                'fs_path' => $fsPath,
+                'mount_path' => $mountPath,
+                'content' => null,
+                'is_directory' => false,
+                'is_host_file' => true,
+                'resource_id' => $subResource->id,
+                'resource_type' => get_class($subResource),
+            ]);
         } else {
-            $mountPath = str($request->mount_path)->trim()->start('/')->value();
+            try {
-
+                $mountPath = validateFileMountPath($request->mount_path, 'file storage path');
-            validateShellSafePath($mountPath, 'file storage path');
+                $fsPath = confineFileMountPath(service_configuration_dir().'/'.$service->uuid, $mountPath, 'file storage path');
-
+            } catch (\Throwable $e) {
-            $fsPath = service_configuration_dir().'/'.$service->uuid.$mountPath;
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['mount_path' => $e->getMessage()],
+                ], 422);
+            }
 
             $storage = LocalFileVolume::create([
                 'fs_path' => $fsPath,

app/Http/Controllers/UploadController.php

@@ -2,6 +2,7 @@
 
 namespace App\Http\Controllers;
 
+use App\Support\DatabaseBackupFileValidator;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Http\Request;
 use Illuminate\Http\UploadedFile;
@@ -16,24 +17,7 @@ class UploadController extends BaseController
 
     private const MAX_BYTES = 10 * 1024 * 1024 * 1024; // 10 GiB
 
-    private const ALLOWED_EXTENSIONS = [
+    private const ALLOWED_EXTENSIONS = DatabaseBackupFileValidator::ALLOWED_EXTENSIONS;
-        'sql',
-        'sql.gz',
-        'gz',
-        'zip',
-        'tar',
-        'tar.gz',
-        'tgz',
-        'dump',
-        'bak',
-        'bson',
-        'bson.gz',
-        'archive',
-        'archive.gz',
-        'bz2',
-        'xz',
-        'dmp',
-    ];
 
     public function upload(Request $request)
     {
@@ -85,10 +69,7 @@ public function upload(Request $request)
 
     protected function saveFile(UploadedFile $file, string $resourceIdentifier)
     {
-        $originalName = $file->getClientOriginalName();
+        if (! DatabaseBackupFileValidator::isUploadAllowed($file, self::MAX_BYTES)) {
-        $size = $file->getSize();
-
-        if (! self::hasAllowedExtension($originalName) || $size === false || $size > self::MAX_BYTES) {
             @unlink($file->getPathname());
 
             return response()->json([
@@ -108,24 +89,7 @@ protected function saveFile(UploadedFile $file, string $resourceIdentifier)
 
     private static function hasAllowedExtension(string $name): bool
     {
-        $lower = strtolower($name);
+        return DatabaseBackupFileValidator::hasAllowedExtension($name);
-        $suffixes = array_map(fn ($ext) => '.'.$ext, self::ALLOWED_EXTENSIONS);
-        usort($suffixes, fn ($a, $b) => strlen($b) <=> strlen($a));
-
-        foreach ($suffixes as $suffix) {
-            if (! str_ends_with($lower, $suffix)) {
-                continue;
-            }
-
-            $stem = substr($lower, 0, -strlen($suffix));
-            if ($stem !== '' && ! str_ends_with($stem, '.')) {
-                return true;
-            }
-
-            return false;
-        }
-
-        return false;
     }
 
     private static function formatMaxSize(): string

app/Http/Controllers/Webhook/Github.php

@@ -261,6 +261,16 @@ public function normal(Request $request)
                 return response('Nothing to do. No GitHub App found.');
             }
             $webhook_secret = data_get($github_app, 'webhook_secret');
+            if (empty($webhook_secret)) {
+                auditLogWebhookFailure('github', 'webhook_secret_missing', [
+                    'mode' => 'app',
+                    'github_app_id' => $github_app->id,
+                    'github_app_name' => $github_app->name,
+                    'installation_target_id' => $x_github_hook_installation_target_id,
+                ]);
+
+                return response('Invalid signature.');
+            }
             $hmac = hash_hmac('sha256', $request->getContent(), $webhook_secret);
             if (config('app.env') !== 'local') {
                 if (! hash_equals($x_hub_signature_256, $hmac)) {

app/Http/Middleware/CanCreateResources.php

@@ -12,15 +12,14 @@ class CanCreateResources
     /**
      * Handle an incoming request.
      *
-     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     * @param  Closure(Request): (Response)  $next
      */
     public function handle(Request $request, Closure $next): Response
     {
-        return $next($request);
+        if (! Gate::allows('createAnyResource')) {
-        // if (! Gate::allows('createAnyResource')) {
+            abort(403, 'You do not have permission to create resources.');
-        //     abort(403, 'You do not have permission to create resources.');
+        }
-        // }
 
-        // return $next($request);
+        return $next($request);
     }
 }

app/Http/Middleware/CanUpdateResource.php

@@ -5,6 +5,7 @@
 use App\Models\Application;
 use App\Models\Environment;
 use App\Models\Project;
+use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
@@ -23,53 +24,61 @@
 
 class CanUpdateResource
 {
+    /**
+     * @var array<string, list<class-string>>
+     */
+    private const ROUTE_RESOURCE_MODELS = [
+        'application_uuid' => [Application::class],
+        'database_uuid' => [
+            StandalonePostgresql::class,
+            StandaloneMysql::class,
+            StandaloneMariadb::class,
+            StandaloneRedis::class,
+            StandaloneKeydb::class,
+            StandaloneDragonfly::class,
+            StandaloneClickhouse::class,
+            StandaloneMongodb::class,
+        ],
+        'stack_service_uuid' => [ServiceApplication::class, ServiceDatabase::class],
+        'service_uuid' => [Service::class],
+        'server_uuid' => [Server::class],
+        'environment_uuid' => [Environment::class],
+        'project_uuid' => [Project::class],
+    ];
+
     public function handle(Request $request, Closure $next): Response
     {
+        $resource = $this->resourceFromRoute($request);
+
+        if (! $resource) {
+            abort(404, 'Resource not found.');
+        }
+
+        if (! Gate::allows('update', $resource)) {
+            abort(403, 'You do not have permission to update this resource.');
+        }
+
         return $next($request);
+    }
 
-        // Get resource from route parameters
+    private function resourceFromRoute(Request $request): ?object
-        // $resource = null;
+    {
-        // if ($request->route('application_uuid')) {
+        foreach (self::ROUTE_RESOURCE_MODELS as $routeParameter => $models) {
-        //     $resource = Application::where('uuid', $request->route('application_uuid'))->first();
+            $uuid = $request->route($routeParameter);
-        // } elseif ($request->route('service_uuid')) {
-        //     $resource = Service::where('uuid', $request->route('service_uuid'))->first();
-        // } elseif ($request->route('stack_service_uuid')) {
-        //     // Handle ServiceApplication or ServiceDatabase
-        //     $stack_service_uuid = $request->route('stack_service_uuid');
-        //     $resource = ServiceApplication::where('uuid', $stack_service_uuid)->first() ??
-        //                ServiceDatabase::where('uuid', $stack_service_uuid)->first();
-        // } elseif ($request->route('database_uuid')) {
-        //     // Try different database types
-        //     $database_uuid = $request->route('database_uuid');
-        //     $resource = StandalonePostgresql::where('uuid', $database_uuid)->first() ??
-        //                StandaloneMysql::where('uuid', $database_uuid)->first() ??
-        //                StandaloneMariadb::where('uuid', $database_uuid)->first() ??
-        //                StandaloneRedis::where('uuid', $database_uuid)->first() ??
-        //                StandaloneKeydb::where('uuid', $database_uuid)->first() ??
-        //                StandaloneDragonfly::where('uuid', $database_uuid)->first() ??
-        //                StandaloneClickhouse::where('uuid', $database_uuid)->first() ??
-        //                StandaloneMongodb::where('uuid', $database_uuid)->first();
-        // } elseif ($request->route('server_uuid')) {
-        //     // For server routes, check if user can manage servers
-        //     if (! auth()->user()->isAdmin()) {
-        //         abort(403, 'You do not have permission to access this resource.');
-        //     }
 
-        //     return $next($request);
+            if (! $uuid) {
-        // } elseif ($request->route('environment_uuid')) {
+                continue;
-        //     $resource = Environment::where('uuid', $request->route('environment_uuid'))->first();
+            }
-        // } elseif ($request->route('project_uuid')) {
-        //     $resource = Project::ownedByCurrentTeam()->where('uuid', $request->route('project_uuid'))->first();
-        // }
 
-        // if (! $resource) {
+            foreach ($models as $model) {
-        //     abort(404, 'Resource not found.');
+                $resource = $model::where('uuid', $uuid)->first();
-        // }
 
-        // if (! Gate::allows('update', $resource)) {
+                if ($resource) {
-        //     abort(403, 'You do not have permission to update this resource.');
+                    return $resource;
-        // }
+                }
+            }
+        }
 
-        // return $next($request);
+        return null;
     }
 }

app/Jobs/ApplicationDeploymentJob.php

@@ -1031,7 +1031,7 @@ private function write_deployment_configurations()
                 );
             }
             foreach ($this->application->fileStorages as $fileStorage) {
-                if (! $fileStorage->is_based_on_git && ! $fileStorage->is_directory) {
+                if (! $fileStorage->is_host_file && ! $fileStorage->is_based_on_git && ! $fileStorage->is_directory) {
                     $fileStorage->saveStorageOnServer();
                 }
             }
@@ -1833,8 +1833,8 @@ private function save_buildtime_environment_variables()
                     ]
                 );
             }
-        } elseif ($this->build_pack === 'dockercompose' || $this->build_pack === 'dockerfile') {
+        } elseif (in_array($this->build_pack, ['dockercompose', 'dockerfile', 'railpack'], true)) {
-            // For Docker Compose and Dockerfile, create an empty .env file even if there are no build-time variables
+            // For build packs that source the build-time .env file, create an empty file even if there are no build-time variables
             // This ensures the file exists when referenced in build commands
             $this->application_deployment_queue->addLogEntry('Creating empty build-time .env file in /artifacts (no build-time variables defined).', hidden: true);
 
@@ -2306,6 +2306,8 @@ private function check_git_if_build_needed()
                 ],
                 [
                     executeInDocker($this->deployment_uuid, "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null"),
+                    'hidden' => true,
+                    'skip_command_log' => true,
                 ],
                 [
                     executeInDocker($this->deployment_uuid, "chmod 600 {$customSshKeyLocation}"),
@@ -2365,12 +2367,7 @@ private function clone_repository()
         if ($this->pull_request_id !== 0) {
             $this->application_deployment_queue->addLogEntry("Checking out tag pull/{$this->pull_request_id}/head.");
         }
-        $this->execute_remote_command(
+        $this->execute_remote_command(...$this->gitCommandDefinitions($importCommands));
-            [
-                $importCommands,
-                'hidden' => true,
-            ]
-        );
         $this->create_workdir();
         $this->execute_remote_command(
             [
@@ -2400,6 +2397,39 @@ private function generate_git_import_commands()
         return $commands;
     }
 
+    private function gitCommandDefinitions(Collection|array|string $commands): array
+    {
+        if (is_string($commands)) {
+            return [
+                [
+                    $commands,
+                    'hidden' => true,
+                ],
+            ];
+        }
+
+        return collect($commands)
+            ->map(function ($command): array {
+                if (is_string($command)) {
+                    return [
+                        $command,
+                        'hidden' => true,
+                    ];
+                }
+
+                if (is_array($command)) {
+                    return $command + ['hidden' => true];
+                }
+
+                return [
+                    'command' => $command,
+                    'hidden' => true,
+                ];
+            })
+            ->values()
+            ->all();
+    }
+
     private function cleanup_git()
     {
         $this->execute_remote_command(
@@ -2667,12 +2697,22 @@ private function railpack_build_command(string $imageName, Collection $variables
             $cacheArgs .= ' --build-arg secrets-hash='.$this->generate_secrets_hash($variables);
         }
 
-        $environmentPrefix = $this->railpack_build_environment_prefix($variables);
+        // Build-time variables reach the build through the sourced build-time .env file
+        // (written by save_buildtime_environment_variables), which interpolates shell-style
+        // references such as BETTER_AUTH_URL=$COOLIFY_URL. Passing them inline via `env`
+        // would forward the literal `$COOLIFY_URL` because each value is single-quoted and
+        // `env` does not interpolate its own assignments. Only buildpack control variables
+        // (NIXPACKS_/RAILPACK_) — which are excluded from the build-time .env file and never
+        // need interpolation — are still passed inline.
+        $controlVariables = $variables->filter(
+            fn ($value, $key) => str($key)->startsWith(EnvironmentVariable::BUILDPACK_CONTROL_VARIABLE_PREFIXES)
+        );
+
+        $environmentPrefix = $this->railpack_build_environment_prefix($controlVariables);
         $secretFlags = $this->railpack_build_secret_flags($variables);
         $frontendImage = 'ghcr.io/railwayapp/railpack-frontend:v'.config('constants.coolify.railpack_version');
 
-        return 'docker buildx create --name coolify-railpack --driver docker-container 2>/dev/null || true'
+        $buildxBuildCommand = "{$environmentPrefix}docker buildx build --builder coolify-railpack"
-            ." && {$environmentPrefix}docker buildx build --builder coolify-railpack"
             ." {$this->addHosts} --network host"
             ." --build-arg BUILDKIT_SYNTAX=\"{$frontendImage}\""
             ." {$cacheArgs}"
@@ -2682,6 +2722,9 @@ private function railpack_build_command(string $imageName, Collection $variables
             .' --load'
             ." -t {$imageName}"
             ." {$this->workdir}";
+
+        return 'docker buildx create --name coolify-railpack --driver docker-container 2>/dev/null || true'
+            .' && '.$this->wrap_build_command_with_env_export($buildxBuildCommand);
     }
 
     private function decode_railpack_config(string $config, string $source): array

app/Jobs/DatabaseBackupJob.php

@@ -714,9 +714,11 @@ private function upload_to_s3(): void
             $escapedEndpoint = escapeshellarg($endpoint);
             $escapedKey = escapeshellarg($key);
             $escapedSecret = escapeshellarg($secret);
+            $escapedBackupLocation = escapeshellarg($this->backup_location);
+            $escapedS3Destination = escapeshellarg("temporary/{$bucket}{$this->backup_dir}/");
 
             $commands[] = "docker exec backup-of-{$this->backup_log_uuid} mc alias set temporary {$escapedEndpoint} {$escapedKey} {$escapedSecret}";
-            $commands[] = "docker exec backup-of-{$this->backup_log_uuid} mc cp $this->backup_location temporary/$bucket{$this->backup_dir}/";
+            $commands[] = "docker exec backup-of-{$this->backup_log_uuid} mc cp {$escapedBackupLocation} {$escapedS3Destination}";
             instant_remote_process($commands, $this->server, true, false, null, disableMultiplexing: true);
 
             $this->s3_uploaded = true;

app/Jobs/SendMessageToDiscordJob.php

@@ -3,6 +3,7 @@
 namespace App\Jobs;
 
 use App\Notifications\Dto\DiscordMessage;
+use App\Rules\SafeWebhookUrl;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
 use Illuminate\Contracts\Queue\ShouldQueue;
@@ -10,6 +11,8 @@
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
 use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Validator;
 
 class SendMessageToDiscordJob implements ShouldBeEncrypted, ShouldQueue
 {
@@ -41,6 +44,20 @@ public function __construct(
      */
     public function handle(): void
     {
-        Http::post($this->webhookUrl, $this->message->toPayload());
+        $validator = Validator::make(
+            ['webhook_url' => $this->webhookUrl],
+            ['webhook_url' => ['required', 'url', new SafeWebhookUrl]]
+        );
+
+        if ($validator->fails()) {
+            Log::warning('SendMessageToDiscordJob: blocked unsafe webhook URL', [
+                'url' => $this->webhookUrl,
+                'errors' => $validator->errors()->all(),
+            ]);
+
+            return;
+        }
+
+        Http::withOptions(['allow_redirects' => false])->post($this->webhookUrl, $this->message->toPayload());
     }
 }

app/Jobs/SendMessageToSlackJob.php

@@ -3,6 +3,7 @@
 namespace App\Jobs;
 
 use App\Notifications\Dto\SlackMessage;
+use App\Rules\SafeWebhookUrl;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
 use Illuminate\Contracts\Queue\ShouldQueue;
@@ -10,6 +11,8 @@
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
 use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Validator;
 
 class SendMessageToSlackJob implements ShouldBeEncrypted, ShouldQueue
 {
@@ -34,6 +37,20 @@ public function __construct(
 
     public function handle(): void
     {
+        $validator = Validator::make(
+            ['webhook_url' => $this->webhookUrl],
+            ['webhook_url' => ['required', 'url', new SafeWebhookUrl]]
+        );
+
+        if ($validator->fails()) {
+            Log::warning('SendMessageToSlackJob: blocked unsafe webhook URL', [
+                'url' => $this->webhookUrl,
+                'errors' => $validator->errors()->all(),
+            ]);
+
+            return;
+        }
+
         if ($this->isSlackWebhook()) {
             $this->sendToSlack();
 
@@ -64,7 +81,7 @@ private function isSlackWebhook(): bool
 
     private function sendToSlack(): void
     {
-        Http::post($this->webhookUrl, [
+        Http::withOptions(['allow_redirects' => false])->post($this->webhookUrl, [
             'text' => $this->message->title,
             'blocks' => [
                 [
@@ -106,7 +123,7 @@ private function sendToMattermost(): void
     {
         $username = config('app.name');
 
-        Http::post($this->webhookUrl, [
+        Http::withOptions(['allow_redirects' => false])->post($this->webhookUrl, [
             'username' => $username,
             'attachments' => [
                 [

app/Jobs/SendWebhookJob.php

@@ -64,7 +64,7 @@ public function handle(): void
             ]);
         }
 
-        $response = Http::post($this->webhookUrl, $this->payload);
+        $response = Http::withOptions(['allow_redirects' => false])->post($this->webhookUrl, $this->payload);
 
         if (isDev()) {
             ray('Webhook response', [

app/Jobs/StripeProcessJob.php

@@ -260,7 +260,10 @@ public function handle(): void
                     $comment = data_get($data, 'cancellation_details.comment');
                     $lookup_key = data_get($data, 'items.data.0.price.lookup_key');
                     if (str($lookup_key)->contains('dynamic')) {
-                        $quantity = min((int) data_get($data, 'items.data.0.quantity', 2), UpdateSubscriptionQuantity::MAX_SERVER_LIMIT);
+                        $quantity = max(
+                            UpdateSubscriptionQuantity::MIN_SERVER_LIMIT,
+                            min((int) data_get($data, 'items.data.0.quantity', 2), UpdateSubscriptionQuantity::MAX_SERVER_LIMIT)
+                        );
                         $team = data_get($subscription, 'team');
                         if ($team) {
                             $team->update([

app/Livewire/Destination/Show.php

@@ -3,6 +3,7 @@
 namespace App\Livewire\Destination;
 
 use App\Models\StandaloneDocker;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
@@ -35,7 +36,7 @@ public function mount(string $destination_uuid)
 
             $this->destination = $destination;
             $this->syncData();
-        } catch (\Illuminate\Auth\Access\AuthorizationException) {
+        } catch (AuthorizationException) {
             abort(403);
         } catch (\Throwable $e) {
             return handleError($e, $this);

app/Livewire/Notifications/Email.php

@@ -170,11 +170,15 @@ public function syncData(bool $toModel = false)
             $this->smtpPort = $this->settings->smtp_port;
             $this->smtpEncryption = $this->settings->smtp_encryption;
             $this->smtpUsername = $this->settings->smtp_username;
-            $this->smtpPassword = $this->settings->smtp_password;
+            $this->smtpPassword = auth()->user()->can('update', $this->settings)
+                ? $this->settings->smtp_password
+                : null;
             $this->smtpTimeout = $this->settings->smtp_timeout;
 
             $this->resendEnabled = $this->settings->resend_enabled;
-            $this->resendApiKey = $this->settings->resend_api_key;
+            $this->resendApiKey = auth()->user()->can('update', $this->settings)
+                ? $this->settings->resend_api_key
+                : null;
 
             $this->useInstanceEmailSettings = $this->settings->use_instance_email_settings;
 
@@ -242,6 +246,8 @@ public function instantSave(?string $type = null)
 
     public function submitSmtp()
     {
+        $this->authorize('update', $this->settings);
+
         try {
             $this->resetErrorBag();
             $this->validate([
@@ -289,6 +295,8 @@ public function submitSmtp()
 
     public function submitResend()
     {
+        $this->authorize('update', $this->settings);
+
         try {
             $this->resetErrorBag();
             $this->validate([

app/Livewire/Project/Database/BackupEdit.php

@@ -2,10 +2,13 @@
 
 namespace App\Livewire\Project\Database;
 
+use App\Jobs\DatabaseBackupJob;
+use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ServiceDatabase;
 use Exception;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Collection;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
@@ -17,7 +20,7 @@ class BackupEdit extends Component
     public ScheduledDatabaseBackup $backup;
 
     #[Locked]
-    public $s3s;
+    public $availableS3Storages;
 
     #[Locked]
     public $parameters;
@@ -68,7 +71,7 @@ class BackupEdit extends Component
     public bool $disableLocalBackup = false;
 
     #[Validate(['nullable', 'integer'])]
-    public ?int $s3StorageId = 1;
+    public ?int $s3StorageId = null;
 
     #[Validate(['nullable', 'string'])]
     public ?string $databasesToBackup = null;
@@ -128,7 +131,7 @@ public function syncData(bool $toModel = false)
             $this->databaseBackupRetentionMaxStorageS3 = $this->backup->database_backup_retention_max_storage_s3;
             $this->saveS3 = $this->backup->save_s3;
             $this->disableLocalBackup = $this->backup->disable_local_backup ?? false;
-            $this->s3StorageId = $this->backup->s3_storage_id;
+            $this->s3StorageId = $this->backup->s3_storage_id ?? $this->availableS3StorageIds()->first();
             $this->databasesToBackup = $this->backup->databases_to_backup;
             $this->dumpAll = $this->backup->dump_all;
             $this->timeout = $this->backup->timeout;
@@ -195,7 +198,7 @@ public function backupNow()
         try {
             $this->authorize('manageBackups', $this->backup->database);
 
-            \App\Jobs\DatabaseBackupJob::dispatch($this->backup);
+            DatabaseBackupJob::dispatch($this->backup);
             $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -214,6 +217,11 @@ public function instantSave()
         }
     }
 
+    public function updatedS3StorageId(): void
+    {
+        $this->instantSave();
+    }
+
     private function customValidate()
     {
         if (! is_numeric($this->backup->s3_storage_id)) {
@@ -221,10 +229,14 @@ private function customValidate()
         }
 
         // S3 backup cannot be enabled without a valid S3 storage owned by the team
-        $availableS3Ids = collect($this->s3s)->pluck('id');
+        $availableS3Ids = $this->availableS3StorageIds();
-        if ($this->backup->save_s3 && ! $availableS3Ids->contains($this->backup->s3_storage_id)) {
+        if ($availableS3Ids->isEmpty()) {
-            $this->backup->save_s3 = $this->saveS3 = false;
             $this->backup->s3_storage_id = $this->s3StorageId = null;
+            if ($this->backup->save_s3) {
+                $this->backup->save_s3 = $this->saveS3 = false;
+            }
+        } elseif (! $availableS3Ids->contains($this->backup->s3_storage_id)) {
+            $this->backup->s3_storage_id = $this->s3StorageId = $availableS3Ids->first();
         }
 
         // Validate that disable_local_backup can only be true when S3 backup is enabled
@@ -239,6 +251,28 @@ private function customValidate()
         $this->validate();
     }
 
+    private function availableS3StorageIds(): Collection
+    {
+        $storages = collect($this->availableS3Storages);
+        $storageIds = $storages->pluck('id')->filter()->all();
+
+        if (empty($storageIds)) {
+            return collect();
+        }
+
+        $teamIds = $storages->pluck('team_id')->reject(fn ($teamId) => $teamId === null)->unique()->values()->all();
+
+        if (empty($teamIds)) {
+            return collect();
+        }
+
+        return S3Storage::query()
+            ->whereKey($storageIds)
+            ->whereIn('team_id', $teamIds)
+            ->where('is_usable', true)
+            ->pluck('id');
+    }
+
     public function submit()
     {
         try {

app/Livewire/Project/Database/BackupExecutions.php

@@ -3,6 +3,7 @@
 namespace App\Livewire\Project\Database;
 
 use App\Models\ScheduledDatabaseBackup;
+use App\Models\ServiceDatabase;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Auth;
@@ -97,7 +98,7 @@ public function deleteBackup($executionId, $password, $selectedActions = [])
             return;
         }
 
-        $server = $execution->scheduledDatabaseBackup->database->getMorphClass() === \App\Models\ServiceDatabase::class
+        $server = $execution->scheduledDatabaseBackup->database->getMorphClass() === ServiceDatabase::class
             ? $execution->scheduledDatabaseBackup->database->service->destination->server
             : $execution->scheduledDatabaseBackup->database->destination->server;
 
@@ -204,7 +205,7 @@ public function server()
         if ($this->database) {
             $server = null;
 
-            if ($this->database instanceof \App\Models\ServiceDatabase) {
+            if ($this->database instanceof ServiceDatabase) {
                 $server = $this->database->service->destination->server;
             } elseif ($this->database->destination && $this->database->destination->server) {
                 $server = $this->database->destination->server;

app/Livewire/Project/Database/ImportForm.php

@@ -14,6 +14,7 @@
 use App\Models\StandaloneMysql;
 use App\Models\StandalonePostgresql;
 use App\Models\StandaloneRedis;
+use App\Support\DatabaseBackupFileValidator;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Storage;
@@ -27,11 +28,10 @@ class ImportForm extends Component
 
     /**
      * Validate that a string is safe for use as an S3 bucket name.
-     * Allows alphanumerics, dots, dashes, and underscores.
      */
     private function validateBucketName(string $bucket): bool
     {
-        return preg_match('/^[a-zA-Z0-9.\-_]+$/', $bucket) === 1;
+        return ValidationPatterns::isValidS3BucketName($bucket);
     }
 
     /**
@@ -451,10 +451,20 @@ public function runImport(string $password = ''): bool|string
             // Check if an uploaded file exists first (takes priority over custom location)
             if (Storage::exists($backupFileName)) {
                 $path = Storage::path($backupFileName);
+
+                // Reject malicious PostgreSQL payloads before transferring the file anywhere.
+                if ($this->isPostgresqlRestore() && DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($path)) {
+                    Storage::delete($backupFileName);
+                    $this->dispatch('error', 'The uploaded backup contains disallowed PostgreSQL restore directives (COPY ... PROGRAM or psql shell commands) and was rejected.');
+
+                    return true;
+                }
+
                 $tmpPath = '/tmp/'.basename($backupFileName).'_'.$this->resourceUuid;
                 instant_scp($path, $tmpPath, $this->server);
                 Storage::delete($backupFileName);
                 $this->importCommands[] = "docker cp {$tmpPath} {$this->container}:{$tmpPath}";
+                $this->addRestoreSafetyCheckCommand($this->importCommands, $tmpPath);
             } elseif (filled($this->customLocation)) {
                 // Validate the custom location to prevent command injection
                 if (! $this->validateServerPath($this->customLocation)) {
@@ -465,6 +475,7 @@ public function runImport(string $password = ''): bool|string
                 $tmpPath = '/tmp/restore_'.$this->resourceUuid;
                 $escapedCustomLocation = escapeshellarg($this->customLocation);
                 $this->importCommands[] = "docker cp {$escapedCustomLocation} {$this->container}:{$tmpPath}";
+                $this->addRestoreSafetyCheckCommand($this->importCommands, $tmpPath);
             } else {
                 $this->dispatch('error', 'The file does not exist or has been deleted.');
 
@@ -570,7 +581,7 @@ public function checkS3File()
 
             // Validate bucket name early
             if (! $this->validateBucketName($s3Storage->bucket)) {
-                $this->dispatch('error', 'Invalid S3 bucket name. Bucket name must contain only alphanumerics, dots, dashes, and underscores.');
+                $this->dispatch('error', 'Invalid S3 bucket name. Bucket name must contain only lowercase letters, numbers, dots, and dashes, and must follow S3 bucket naming rules.');
 
                 return;
             }
@@ -651,7 +662,7 @@ public function restoreFromS3(string $password = ''): bool|string
 
             // Validate bucket name to prevent command injection
             if (! $this->validateBucketName($bucket)) {
-                $this->dispatch('error', 'Invalid S3 bucket name. Bucket name must contain only alphanumerics, dots, dashes, and underscores.');
+                $this->dispatch('error', 'Invalid S3 bucket name. Bucket name must contain only lowercase letters, numbers, dots, and dashes, and must follow S3 bucket naming rules.');
 
                 return true;
             }
@@ -721,6 +732,7 @@ public function restoreFromS3(string $password = ''): bool|string
             // 6. Copy from helper to server, then immediately to database container
             $commands[] = "docker cp {$escapedHelperContainerPath} {$escapedServerTmpPath}";
             $commands[] = "docker cp {$escapedServerTmpPath} {$escapedDatabaseContainerTmpPath}";
+            $this->addRestoreSafetyCheckCommand($commands, $containerTmpPath);
 
             // 7. Cleanup helper container and server temp file immediately (no longer needed)
             $commands[] = "docker rm -f {$containerName} 2>/dev/null || true";
@@ -765,6 +777,69 @@ public function restoreFromS3(string $password = ''): bool|string
         return true;
     }
 
+    public function buildRestoreSafetyCheckCommand(string $tmpPath): ?string
+    {
+        $script = $this->buildPostgresRestoreScanScript($tmpPath);
+
+        if ($script === null) {
+            return null;
+        }
+
+        return "docker exec {$this->container} sh -c ".escapeshellarg($script);
+    }
+
+    /**
+     * Build the POSIX shell snippet that aborts (exit 1) when a PostgreSQL
+     * backup contains directives leading to OS command execution.
+     *
+     * Hardened against bypasses:
+     *  - decompresses gzip backups before scanning,
+     *  - strips `--` line comments and flattens newlines so multi-line and
+     *    comment-separated payloads (e.g. `FROM/**​/PROGRAM`) are caught,
+     *  - matches a literal `\!` shell escape and `\o|`/`\g|` pipe redirects.
+     */
+    public function buildPostgresRestoreScanScript(string $tmpPath): ?string
+    {
+        if (! $this->isPostgresqlRestore()) {
+            return null;
+        }
+
+        $escapedTmpPath = escapeshellarg($tmpPath);
+
+        // Token separator PostgreSQL treats as whitespace: real whitespace or a
+        // /* ... */ block comment (used to split keywords like FROM/**/PROGRAM).
+        $sep = '([[:space:]]|/\\*[^*]*\\*/)';
+
+        $pattern = implode('|', [
+            "copy{$sep}+[^;]*(from|to){$sep}+program",
+            '(^|[[:space:]])\\\\!',
+            "(^|[[:space:]])\\\\(o|g){$sep}*\\|",
+        ]);
+        $escapedPattern = escapeshellarg($pattern);
+
+        return "if (gunzip -cf {$escapedTmpPath} 2>/dev/null || cat {$escapedTmpPath}) | sed 's/--.*//' | tr '\n\r\t' '   ' | grep -Eiq {$escapedPattern}; then echo 'Blocked PostgreSQL restore: COPY ... PROGRAM and psql shell commands are not allowed.'; exit 1; fi";
+    }
+
+    private function addRestoreSafetyCheckCommand(array &$commands, string $tmpPath): void
+    {
+        $command = $this->buildRestoreSafetyCheckCommand($tmpPath);
+
+        if ($command !== null) {
+            $commands[] = $command;
+        }
+    }
+
+    private function isPostgresqlRestore(): bool
+    {
+        $morphClass = $this->resource->getMorphClass();
+
+        if ($morphClass === ServiceDatabase::class) {
+            return str_contains($this->resource->databaseType(), 'postgres');
+        }
+
+        return $morphClass === StandalonePostgresql::class || $morphClass === 'postgresql';
+    }
+
     public function buildRestoreCommand(string $tmpPath): string
     {
         $escapedTmpPath = escapeshellarg($tmpPath);

app/Livewire/Project/Database/ScheduledBackups.php

@@ -3,6 +3,7 @@
 namespace App\Livewire\Project\Database;
 
 use App\Models\ScheduledDatabaseBackup;
+use App\Models\ServiceDatabase;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
@@ -34,7 +35,7 @@ public function mount(): void
             $this->setSelectedBackup($this->selectedBackupId, true);
         }
         $this->parameters = get_route_parameters();
-        if ($this->database->getMorphClass() === \App\Models\ServiceDatabase::class) {
+        if ($this->database->getMorphClass() === ServiceDatabase::class) {
             $this->type = 'service-database';
         } else {
             $this->type = 'database';

app/Livewire/Project/New/DockerCompose.php

@@ -5,11 +5,14 @@
 use App\Models\EnvironmentVariable;
 use App\Models\Project;
 use App\Models\Service;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 use Symfony\Component\Yaml\Yaml;
 
 class DockerCompose extends Component
 {
+    use AuthorizesRequests;
+
     public string $dockerComposeRaw = '';
 
     public string $envFile = '';
@@ -30,6 +33,8 @@ public function mount()
     public function submit()
     {
         try {
+            $this->authorize('create', Service::class);
+
             $this->validate([
                 'dockerComposeRaw' => 'required',
             ]);

app/Livewire/Project/New/DockerImage.php

@@ -6,10 +6,13 @@
 use App\Models\Project;
 use App\Services\DockerImageParser;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class DockerImage extends Component
 {
+    use AuthorizesRequests;
+
     public string $imageName = '';
 
     public string $imageTag = '';
@@ -80,6 +83,8 @@ public function updatedImageName(): void
 
     public function submit()
     {
+        $this->authorize('create', Application::class);
+
         $this->validate([
             'imageName' => ValidationPatterns::dockerImageNameRules(required: true),
             'imageTag' => ValidationPatterns::dockerImageTagRules(),

app/Livewire/Project/New/EmptyProject.php

@@ -3,12 +3,17 @@
 namespace App\Livewire\Project\New;
 
 use App\Models\Project;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class EmptyProject extends Component
 {
+    use AuthorizesRequests;
+
     public function createEmptyProject()
     {
+        $this->authorize('create', Project::class);
+
         $project = Project::create([
             'name' => generate_random_name(),
             'team_id' => currentTeam()->id,

app/Livewire/Project/New/GithubPrivateRepository.php

@@ -7,6 +7,7 @@
 use App\Models\Project;
 use App\Rules\ValidGitBranch;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Route;
 use Livewire\Attributes\Locked;
@@ -14,6 +15,8 @@
 
 class GithubPrivateRepository extends Component
 {
+    use AuthorizesRequests;
+
     public $current_step = 'github_apps';
 
     public $github_apps;
@@ -169,6 +172,8 @@ protected function loadBranchByPage()
     public function submit()
     {
         try {
+            $this->authorize('create', Application::class);
+
             // Validate git repository parts and branch
             $validator = validator([
                 'selected_repository_owner' => $this->selected_repository_owner,

app/Livewire/Project/New/GithubPrivateRepositoryDeployKey.php

@@ -10,12 +10,15 @@
 use App\Rules\ValidGitBranch;
 use App\Rules\ValidGitRepositoryUrl;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Str;
 use Livewire\Component;
 use Spatie\Url\Url;
 
 class GithubPrivateRepositoryDeployKey extends Component
 {
+    use AuthorizesRequests;
+
     public $current_step = 'private_keys';
 
     public $parameters;
@@ -128,6 +131,8 @@ public function setPrivateKey($private_key_id)
 
     public function submit()
     {
+        $this->authorize('create', Application::class);
+
         $this->validate();
         try {
             $destination_uuid = $this->query['destination'] ?? null;

app/Livewire/Project/New/PublicGitRepository.php

@@ -6,16 +6,18 @@
 use App\Models\GithubApp;
 use App\Models\GitlabApp;
 use App\Models\Project;
-use App\Models\Service;
 use App\Rules\ValidGitBranch;
 use App\Rules\ValidGitRepositoryUrl;
 use App\Support\ValidationPatterns;
 use Carbon\Carbon;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 use Spatie\Url\Url;
 
 class PublicGitRepository extends Component
 {
+    use AuthorizesRequests;
+
     public string $repository_url;
 
     public int $port = 3000;
@@ -260,6 +262,8 @@ private function getBranch()
     public function submit()
     {
         try {
+            $this->authorize('create', Application::class);
+
             $this->validate();
 
             // Additional validation for git repository and branch
@@ -295,33 +299,6 @@ public function submit()
             $project = Project::ownedByCurrentTeam()->where('uuid', $project_uuid)->firstOrFail();
             $environment = $project->environments()->where('uuid', $environment_uuid)->firstOrFail();
 
-            if ($this->build_pack === 'dockercompose' && isDev() && $this->new_compose_services) {
-                $server = $destination->server;
-                $new_service = [
-                    'name' => 'service'.str()->random(10),
-                    'docker_compose_raw' => 'coolify',
-                    'environment_id' => $environment->id,
-                    'server_id' => $server->id,
-                ];
-                if ($this->git_source === 'other') {
-                    $new_service['git_repository'] = $this->git_repository;
-                    $new_service['git_branch'] = $this->git_branch;
-                } else {
-                    $new_service['git_repository'] = $this->git_repository;
-                    $new_service['git_branch'] = $this->git_branch;
-                    $new_service['source_id'] = $this->git_source->id;
-                    $new_service['source_type'] = $this->git_source->getMorphClass();
-                }
-                $service = Service::create($new_service);
-
-                return redirect()->route('project.service.configuration', [
-                    'service_uuid' => $service->uuid,
-                    'environment_uuid' => $environment->uuid,
-                    'project_uuid' => $project->uuid,
-                ]);
-
-                return;
-            }
             if ($this->git_source === 'other') {
                 $application_init = [
                     'name' => generate_random_name(),

app/Livewire/Project/New/SimpleDockerfile.php

@@ -5,10 +5,13 @@
 use App\Models\Application;
 use App\Models\GithubApp;
 use App\Models\Project;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class SimpleDockerfile extends Component
 {
+    use AuthorizesRequests;
+
     public string $dockerfile = '';
 
     public array $parameters;
@@ -29,6 +32,8 @@ public function mount()
 
     public function submit()
     {
+        $this->authorize('create', Application::class);
+
         $this->validate([
             'dockerfile' => 'required',
         ]);

app/Livewire/Project/Resource/Create.php

@@ -4,16 +4,20 @@
 
 use App\Models\EnvironmentVariable;
 use App\Models\Service;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Create extends Component
 {
+    use AuthorizesRequests;
+
     public $type;
 
     public $project;
 
     public function mount()
     {
+        $this->authorize('createAnyResource');
 
         $type = str(request()->query('type'));
         $destination_uuid = request()->query('destination');

app/Livewire/Project/Service/FileStorage.php

@@ -94,6 +94,10 @@ public function convertToDirectory()
         try {
             $this->authorize('update', $this->resource);
 
+            if ($this->fileStorage->is_host_file) {
+                throw new \Exception('Host file mounts are bind-only and cannot be converted.');
+            }
+
             $this->fileStorage->deleteStorageOnServer();
             $this->fileStorage->is_directory = true;
             $this->fileStorage->content = null;
@@ -112,6 +116,10 @@ public function loadStorageOnServer()
         try {
             $this->authorize('update', $this->resource);
 
+            if ($this->fileStorage->is_host_file) {
+                throw new \Exception('Host file mounts are bind-only and cannot be loaded from the server.');
+            }
+
             $this->fileStorage->loadStorageOnServer();
             $this->syncData();
             $this->dispatch('success', 'File storage loaded from server.');
@@ -127,6 +135,10 @@ public function convertToFile()
         try {
             $this->authorize('update', $this->resource);
 
+            if ($this->fileStorage->is_host_file) {
+                throw new \Exception('Host file mounts are bind-only and cannot be converted.');
+            }
+
             $this->fileStorage->deleteStorageOnServer();
             $this->fileStorage->is_directory = false;
             $this->fileStorage->content = null;
@@ -154,8 +166,10 @@ public function delete($password, $selectedActions = [])
             $message = 'File deleted.';
             if ($this->fileStorage->is_directory) {
                 $message = 'Directory deleted.';
+            } elseif ($this->fileStorage->is_host_file) {
+                $message = 'Host file mount removed.';
             }
-            if ($this->permanently_delete) {
+            if ($this->permanently_delete && ! $this->fileStorage->is_host_file) {
                 $message = 'Directory deleted from the server.';
                 $this->fileStorage->deleteStorageOnServer();
             }
@@ -174,6 +188,12 @@ public function submit()
     {
         $this->authorize('update', $this->resource);
 
+        if ($this->fileStorage->is_host_file) {
+            $this->dispatch('error', 'Host file mounts are bind-only and cannot be edited from the UI.');
+
+            return;
+        }
+
         if ($this->fileStorage->is_too_large) {
             $this->dispatch('error', 'File on server is too large to edit from the UI.');
 
@@ -205,6 +225,12 @@ public function submit()
     public function instantSave(): void
     {
         $this->authorize('update', $this->resource);
+        if ($this->fileStorage->is_host_file) {
+            $this->dispatch('error', 'Host file mounts are bind-only and cannot be edited from the UI.');
+
+            return;
+        }
+
         if ($this->fileStorage->is_too_large) {
             $this->dispatch('error', 'File on server is too large to edit from the UI.');
 
@@ -223,6 +249,9 @@ public function render()
             'fileDeletionCheckboxes' => [
                 ['id' => 'permanently_delete', 'label' => 'The selected file will be permanently deleted form the server.'],
             ],
+            'hostFileDeletionCheckboxes' => [
+                ['id' => 'permanently_delete', 'label' => 'Only the mount configuration will be removed. The host file will not be deleted.'],
+            ],
         ]);
     }
 }

app/Livewire/Project/Service/Storage.php

@@ -29,6 +29,10 @@ class Storage extends Component
 
     public ?string $file_storage_content = null;
 
+    public string $host_file_storage_source = '';
+
+    public string $host_file_storage_destination = '';
+
     public string $file_storage_directory_source = '';
 
     public string $file_storage_directory_destination = '';
@@ -146,19 +150,9 @@ public function submitFileStorage()
                 'file_storage_content' => 'nullable|string',
             ]);
 
-            $this->file_storage_path = trim($this->file_storage_path);
+            $this->file_storage_path = validateFileMountPath($this->file_storage_path, 'file storage path');
-            $this->file_storage_path = str($this->file_storage_path)->start('/')->value();
 
-            // Validate path to prevent command injection
+            $fs_path = confineFileMountPath($this->fileStorageHostPath(), $this->file_storage_path, 'file storage path');
-            validateShellSafePath($this->file_storage_path, 'file storage path');
-
-            if ($this->resource->getMorphClass() === Application::class) {
-                $fs_path = application_configuration_dir().'/'.$this->resource->uuid.$this->file_storage_path;
-            } elseif (str($this->resource->getMorphClass())->contains('Standalone')) {
-                $fs_path = database_configuration_dir().'/'.$this->resource->uuid.$this->file_storage_path;
-            } else {
-                throw new \Exception('No valid resource type for file mount storage type!');
-            }
 
             LocalFileVolume::create([
                 'fs_path' => $fs_path,
@@ -178,6 +172,38 @@ public function submitFileStorage()
         }
     }
 
+    public function submitHostFileStorage()
+    {
+        try {
+            $this->authorize('update', $this->resource);
+
+            $this->validate([
+                'host_file_storage_source' => 'required|string',
+                'host_file_storage_destination' => 'required|string',
+            ]);
+
+            $this->host_file_storage_source = validateHostFileMountPath($this->host_file_storage_source, 'host file source path');
+            $this->host_file_storage_destination = validateFileMountPath($this->host_file_storage_destination, 'host file destination path');
+
+            LocalFileVolume::create([
+                'fs_path' => $this->host_file_storage_source,
+                'mount_path' => $this->host_file_storage_destination,
+                'content' => null,
+                'is_directory' => false,
+                'is_host_file' => true,
+                'resource_id' => $this->resource->id,
+                'resource_type' => get_class($this->resource),
+            ]);
+
+            $this->dispatch('success', 'Host file mount added successfully');
+            $this->dispatch('closeStorageModal', 'host-file');
+            $this->clearForm();
+            $this->refreshStorages();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
     public function submitFileStorageDirectory()
     {
         try {
@@ -222,6 +248,8 @@ public function clearForm()
         $this->file_storage_path = '';
         $this->file_storage_content = null;
         $this->file_storage_directory_destination = '';
+        $this->host_file_storage_source = '';
+        $this->host_file_storage_destination = '';
 
         if (str($this->resource->getMorphClass())->contains('Standalone')) {
             $this->file_storage_directory_source = database_configuration_dir()."/{$this->resource->uuid}";
@@ -230,6 +258,34 @@ public function clearForm()
         }
     }
 
+    public function fileStorageHostPath(): string
+    {
+        if (method_exists($this->resource, 'workdir')) {
+            return $this->resource->workdir();
+        }
+
+        if ($this->resource->getMorphClass() === Application::class) {
+            return application_configuration_dir().'/'.$this->resource->uuid;
+        }
+
+        if (str($this->resource->getMorphClass())->contains('Standalone')) {
+            return database_configuration_dir().'/'.$this->resource->uuid;
+        }
+
+        throw new \Exception('No valid resource type for file mount storage type!');
+    }
+
+    public function fileStoragePreviewPath(): string
+    {
+        $path = str($this->file_storage_path)->trim();
+
+        if ($path->isEmpty()) {
+            return $this->fileStorageHostPath().'/';
+        }
+
+        return $this->fileStorageHostPath().$path->start('/')->value();
+    }
+
     public function render()
     {
         return view('livewire.project.service.storage');

app/Livewire/Storage/Create.php

@@ -4,6 +4,7 @@
 
 use App\Models\S3Storage;
 use App\Rules\SafeWebhookUrl;
+use App\Rules\ValidS3BucketName;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Uri;
@@ -37,7 +38,7 @@ protected function rules(): array
             'region' => 'required|max:255',
             'key' => 'required|max:255',
             'secret' => 'required|max:255',
-            'bucket' => 'required|max:255',
+            'bucket' => ['required', new ValidS3BucketName],
             'endpoint' => ['required', 'max:255', new SafeWebhookUrl],
         ];
     }
@@ -54,7 +55,6 @@ protected function messages(): array
                 'secret.required' => 'The Secret Key field is required.',
                 'secret.max' => 'The Secret Key may not be greater than 255 characters.',
                 'bucket.required' => 'The Bucket field is required.',
-                'bucket.max' => 'The Bucket may not be greater than 255 characters.',
                 'endpoint.required' => 'The Endpoint field is required.',
                 'endpoint.max' => 'The Endpoint may not be greater than 255 characters.',
             ]

app/Livewire/Storage/Form.php

@@ -4,6 +4,7 @@
 
 use App\Models\S3Storage;
 use App\Rules\SafeWebhookUrl;
+use App\Rules\ValidS3BucketName;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\DB;
@@ -44,7 +45,7 @@ protected function rules(): array
             'region' => 'required|max:255',
             'key' => 'required|max:255',
             'secret' => 'required|max:255',
-            'bucket' => 'required|max:255',
+            'bucket' => ['required', new ValidS3BucketName],
             'endpoint' => ['required', 'max:255', new SafeWebhookUrl],
         ];
     }
@@ -61,7 +62,6 @@ protected function messages(): array
                 'secret.required' => 'The Secret Key field is required.',
                 'secret.max' => 'The Secret Key may not be greater than 255 characters.',
                 'bucket.required' => 'The Bucket field is required.',
-                'bucket.max' => 'The Bucket may not be greater than 255 characters.',
                 'endpoint.required' => 'The Endpoint field is required.',
                 'endpoint.max' => 'The Endpoint may not be greater than 255 characters.',
             ]

app/Livewire/Storage/Show.php

@@ -4,6 +4,7 @@
 
 use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
@@ -25,7 +26,7 @@ public function mount()
         }
         try {
             $this->authorize('view', $this->storage);
-        } catch (\Illuminate\Auth\Access\AuthorizationException) {
+        } catch (AuthorizationException) {
             return $this->redirectRoute('storage.index', navigate: true);
         }
         $this->currentRoute = request()->route()->getName();

app/Models/Application.php

@@ -1338,7 +1338,7 @@ public function getGitRemoteStatus(string $deployment_uuid)
     {
         try {
             ['commands' => $lsRemoteCommand] = $this->generateGitLsRemoteCommands(deployment_uuid: $deployment_uuid, exec_in_docker: false);
-            instant_remote_process([$lsRemoteCommand], $this->destination->server, true);
+            instant_remote_process([$this->gitCommandsAsShellCommand($lsRemoteCommand)], $this->destination->server, true);
 
             return [
                 'is_accessible' => true,
@@ -1390,13 +1390,13 @@ public function generateGitLsRemoteCommands(string $deployment_uuid, bool $exec_
                 }
 
                 if ($exec_in_docker) {
-                    $commands->push(executeInDocker($deployment_uuid, $base_command));
+                    $commands->push($this->gitCommand(executeInDocker($deployment_uuid, $base_command)));
                 } else {
-                    $commands->push($base_command);
+                    $commands->push($this->gitCommand($base_command));
                 }
 
                 return [
-                    'commands' => $commands->implode(' && '),
+                    'commands' => $this->gitCommandsAsShellCommand($commands),
                     'branch' => $branch,
                     'fullRepoUrl' => $fullRepoUrl,
                 ];
@@ -1413,29 +1413,16 @@ public function generateGitLsRemoteCommands(string $deployment_uuid, bool $exec_
                     $escapedCustomRepository = str_replace("'", "'\\''", $customRepository);
                     $base_command = "GIT_SSH_COMMAND=\"ssh -o ConnectTimeout=30 -p {$gitlabPort} -o Port={$gitlabPort} -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i {$customSshKeyLocation} -o IdentitiesOnly=yes\" {$base_command} '{$escapedCustomRepository}'";
 
-                    if ($exec_in_docker) {
+                    $commands = $this->gitSshKeySetupCommands($deployment_uuid, $private_key, $exec_in_docker);
-                        $commands = collect([
-                            executeInDocker($deployment_uuid, 'mkdir -p /root/.ssh'),
-                            executeInDocker($deployment_uuid, "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null"),
-                            executeInDocker($deployment_uuid, "chmod 600 {$customSshKeyLocation}"),
-                        ]);
-                    } else {
-                        $commands = collect([
-                            "trap 'rm -f {$customSshKeyLocation}' EXIT",
-                            'mkdir -p /root/.ssh',
-                            "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null",
-                            "chmod 600 {$customSshKeyLocation}",
-                        ]);
-                    }
 
                     if ($exec_in_docker) {
-                        $commands->push(executeInDocker($deployment_uuid, $base_command));
+                        $commands->push($this->gitCommand(executeInDocker($deployment_uuid, $base_command)));
                     } else {
-                        $commands->push($base_command);
+                        $commands->push($this->gitCommand($base_command));
                     }
 
                     return [
-                        'commands' => $commands->implode(' && '),
+                        'commands' => $commands,
                         'branch' => $branch,
                         'fullRepoUrl' => $fullRepoUrl,
                     ];
@@ -1447,13 +1434,13 @@ public function generateGitLsRemoteCommands(string $deployment_uuid, bool $exec_
                 $base_command = "{$base_command} {$escapedCustomRepository}";
 
                 if ($exec_in_docker) {
-                    $commands->push(executeInDocker($deployment_uuid, $base_command));
+                    $commands->push($this->gitCommand(executeInDocker($deployment_uuid, $base_command)));
                 } else {
-                    $commands->push($base_command);
+                    $commands->push($this->gitCommand($base_command));
                 }
 
                 return [
-                    'commands' => $commands->implode(' && '),
+                    'commands' => $this->gitCommandsAsShellCommand($commands),
                     'branch' => $branch,
                     'fullRepoUrl' => $fullRepoUrl,
                 ];
@@ -1472,29 +1459,16 @@ public function generateGitLsRemoteCommands(string $deployment_uuid, bool $exec_
             $escapedCustomRepository = str_replace("'", "'\\''", $customRepository);
             $base_command = "GIT_SSH_COMMAND=\"ssh -o ConnectTimeout=30 -p {$customPort} -o Port={$customPort} -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i {$customSshKeyLocation} -o IdentitiesOnly=yes\" {$base_command} '{$escapedCustomRepository}'";
 
-            if ($exec_in_docker) {
+            $commands = $this->gitSshKeySetupCommands($deployment_uuid, $private_key, $exec_in_docker);
-                $commands = collect([
-                    executeInDocker($deployment_uuid, 'mkdir -p /root/.ssh'),
-                    executeInDocker($deployment_uuid, "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null"),
-                    executeInDocker($deployment_uuid, "chmod 600 {$customSshKeyLocation}"),
-                ]);
-            } else {
-                $commands = collect([
-                    "trap 'rm -f {$customSshKeyLocation}' EXIT",
-                    'mkdir -p /root/.ssh',
-                    "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null",
-                    "chmod 600 {$customSshKeyLocation}",
-                ]);
-            }
 
             if ($exec_in_docker) {
-                $commands->push(executeInDocker($deployment_uuid, $base_command));
+                $commands->push($this->gitCommand(executeInDocker($deployment_uuid, $base_command)));
             } else {
-                $commands->push($base_command);
+                $commands->push($this->gitCommand($base_command));
             }
 
             return [
-                'commands' => $commands->implode(' && '),
+                'commands' => $commands,
                 'branch' => $branch,
                 'fullRepoUrl' => $fullRepoUrl,
             ];
@@ -1506,19 +1480,60 @@ public function generateGitLsRemoteCommands(string $deployment_uuid, bool $exec_
             $base_command = "{$base_command} {$escapedCustomRepository}";
 
             if ($exec_in_docker) {
-                $commands->push(executeInDocker($deployment_uuid, $base_command));
+                $commands->push($this->gitCommand(executeInDocker($deployment_uuid, $base_command)));
             } else {
-                $commands->push($base_command);
+                $commands->push($this->gitCommand($base_command));
             }
 
             return [
-                'commands' => $commands->implode(' && '),
+                'commands' => $this->gitCommandsAsShellCommand($commands),
                 'branch' => $branch,
                 'fullRepoUrl' => $fullRepoUrl,
             ];
         }
     }
 
+    private function gitCommand(string $command): array
+    {
+        return [
+            'command' => $command,
+            'hidden' => true,
+        ];
+    }
+
+    private function gitCommandsAsShellCommand(Collection|array|string $commands): string
+    {
+        if (is_string($commands)) {
+            return $commands;
+        }
+
+        return collect($commands)
+            ->map(fn ($command) => data_get($command, 'command') ?? $command[0] ?? $command)
+            ->implode(' && ');
+    }
+
+    private function gitSshKeySetupCommands(string $deploymentUuid, string $privateKey, bool $execInDocker): Collection
+    {
+        $customSshKeyLocation = "/root/.ssh/id_rsa_coolify_{$deploymentUuid}";
+        $commands = collect([]);
+
+        if (! $execInDocker) {
+            $commands->push($this->gitCommand("trap 'rm -f {$customSshKeyLocation}' EXIT"));
+        }
+
+        $commands->push($this->gitCommand($execInDocker ? executeInDocker($deploymentUuid, 'mkdir -p /root/.ssh') : 'mkdir -p /root/.ssh'));
+        $commands->push([
+            'command' => $execInDocker
+                ? executeInDocker($deploymentUuid, "echo '{$privateKey}' | base64 -d | tee {$customSshKeyLocation} > /dev/null")
+                : "echo '{$privateKey}' | base64 -d | tee {$customSshKeyLocation} > /dev/null",
+            'hidden' => true,
+            'skip_command_log' => true,
+        ]);
+        $commands->push($this->gitCommand($execInDocker ? executeInDocker($deploymentUuid, "chmod 600 {$customSshKeyLocation}") : "chmod 600 {$customSshKeyLocation}"));
+
+        return $commands;
+    }
+
     private function withGitHttpTransportConfig(?string $gitConfigOptions = null): string
     {
         return trim(($gitConfigOptions ? "{$gitConfigOptions} " : '').'-c http.version=HTTP/1.1');
@@ -1590,9 +1605,9 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
                         $git_clone_command = $this->setGitImportSettings($deployment_uuid, $git_clone_command, public: true, commit: $commit, gitConfigOptions: $gitConfigOptions);
                     }
                     if ($exec_in_docker) {
-                        $commands->push(executeInDocker($deployment_uuid, $git_clone_command));
+                        $commands->push($this->gitCommand(executeInDocker($deployment_uuid, $git_clone_command)));
                     } else {
-                        $commands->push($git_clone_command);
+                        $commands->push($this->gitCommand($git_clone_command));
                     }
                 } else {
                     $github_access_token = generateGithubInstallationToken($this->source);
@@ -1619,9 +1634,9 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
                         $git_clone_command = $this->setGitImportSettings($deployment_uuid, $git_clone_command, public: false, commit: $commit, gitConfigOptions: $gitConfigOptions);
                     }
                     if ($exec_in_docker) {
-                        $commands->push(executeInDocker($deployment_uuid, $git_clone_command));
+                        $commands->push($this->gitCommand(executeInDocker($deployment_uuid, $git_clone_command)));
                     } else {
-                        $commands->push($git_clone_command);
+                        $commands->push($this->gitCommand($git_clone_command));
                     }
                 }
                 if ($pull_request_id !== 0) {
@@ -1631,14 +1646,14 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
                     $gitCommand = isset($gitConfigOptions) ? "git {$gitConfigOptions}" : 'git';
                     $escapedPrBranch = escapeshellarg($branch);
                     if ($exec_in_docker) {
-                        $commands->push(executeInDocker($deployment_uuid, "cd {$escapedBaseDir} && {$gitCommand} fetch origin {$escapedPrBranch} && $git_checkout_command"));
+                        $commands->push($this->gitCommand(executeInDocker($deployment_uuid, "cd {$escapedBaseDir} && {$gitCommand} fetch origin {$escapedPrBranch} && $git_checkout_command")));
                     } else {
-                        $commands->push("cd {$escapedBaseDir} && {$gitCommand} fetch origin {$escapedPrBranch} && $git_checkout_command");
+                        $commands->push($this->gitCommand("cd {$escapedBaseDir} && {$gitCommand} fetch origin {$escapedPrBranch} && $git_checkout_command"));
                     }
                 }
 
                 return [
-                    'commands' => $commands->implode(' && '),
+                    'commands' => $this->gitCommandsAsShellCommand($commands),
                     'branch' => $branch,
                     'fullRepoUrl' => $fullRepoUrl,
                 ];
@@ -1661,39 +1676,26 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
                     } else {
                         $git_clone_command = $this->setGitImportSettings($deployment_uuid, $git_clone_command_base, commit: $commit, gitSshCommand: $gitlabSshCommand);
                     }
-                    if ($exec_in_docker) {
+                    $commands = $this->gitSshKeySetupCommands($deployment_uuid, $private_key, $exec_in_docker);
-                        $commands = collect([
-                            executeInDocker($deployment_uuid, 'mkdir -p /root/.ssh'),
-                            executeInDocker($deployment_uuid, "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null"),
-                            executeInDocker($deployment_uuid, "chmod 600 {$customSshKeyLocation}"),
-                        ]);
-                    } else {
-                        $commands = collect([
-                            "trap 'rm -f {$customSshKeyLocation}' EXIT",
-                            'mkdir -p /root/.ssh',
-                            "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null",
-                            "chmod 600 {$customSshKeyLocation}",
-                        ]);
-                    }
 
                     if ($pull_request_id !== 0) {
                         $branch = "merge-requests/{$pull_request_id}/head:$pr_branch_name";
                         if ($exec_in_docker) {
-                            $commands->push(executeInDocker($deployment_uuid, "echo 'Checking out $branch'"));
+                            $commands->push($this->gitCommand(executeInDocker($deployment_uuid, "echo 'Checking out $branch'")));
                         } else {
-                            $commands->push("echo 'Checking out $branch'");
+                            $commands->push($this->gitCommand("echo 'Checking out $branch'"));
                         }
                         $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && {$gitlabGitSshCommand} git fetch origin $branch && ".$this->buildGitCheckoutCommand($pr_branch_name, $gitlabSshCommand);
                     }
 
                     if ($exec_in_docker) {
-                        $commands->push(executeInDocker($deployment_uuid, $git_clone_command));
+                        $commands->push($this->gitCommand(executeInDocker($deployment_uuid, $git_clone_command)));
                     } else {
-                        $commands->push($git_clone_command);
+                        $commands->push($this->gitCommand($git_clone_command));
                     }
 
                     return [
-                        'commands' => $commands->implode(' && '),
+                        'commands' => $commands,
                         'branch' => $branch,
                         'fullRepoUrl' => $fullRepoUrl,
                     ];
@@ -1710,13 +1712,13 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
                 $git_clone_command = $this->setGitImportSettings($deployment_uuid, $git_clone_command, public: true, commit: $commit, gitConfigOptions: $gitConfigOptions);
 
                 if ($exec_in_docker) {
-                    $commands->push(executeInDocker($deployment_uuid, $git_clone_command));
+                    $commands->push($this->gitCommand(executeInDocker($deployment_uuid, $git_clone_command)));
                 } else {
-                    $commands->push($git_clone_command);
+                    $commands->push($this->gitCommand($git_clone_command));
                 }
 
                 return [
-                    'commands' => $commands->implode(' && '),
+                    'commands' => $this->gitCommandsAsShellCommand($commands),
                     'branch' => $branch,
                     'fullRepoUrl' => $fullRepoUrl,
                 ];
@@ -1738,55 +1740,42 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
             } else {
                 $git_clone_command = $this->setGitImportSettings($deployment_uuid, $git_clone_command_base, commit: $commit, gitSshCommand: $deployKeySshCommand);
             }
-            if ($exec_in_docker) {
+            $commands = $this->gitSshKeySetupCommands($deployment_uuid, $private_key, $exec_in_docker);
-                $commands = collect([
-                    executeInDocker($deployment_uuid, 'mkdir -p /root/.ssh'),
-                    executeInDocker($deployment_uuid, "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null"),
-                    executeInDocker($deployment_uuid, "chmod 600 {$customSshKeyLocation}"),
-                ]);
-            } else {
-                $commands = collect([
-                    "trap 'rm -f {$customSshKeyLocation}' EXIT",
-                    'mkdir -p /root/.ssh',
-                    "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null",
-                    "chmod 600 {$customSshKeyLocation}",
-                ]);
-            }
             if ($pull_request_id !== 0) {
                 if ($git_type === 'gitlab') {
                     $branch = "merge-requests/{$pull_request_id}/head:$pr_branch_name";
                     if ($exec_in_docker) {
-                        $commands->push(executeInDocker($deployment_uuid, "echo 'Checking out $branch'"));
+                        $commands->push($this->gitCommand(executeInDocker($deployment_uuid, "echo 'Checking out $branch'")));
                     } else {
-                        $commands->push("echo 'Checking out $branch'");
+                        $commands->push($this->gitCommand("echo 'Checking out $branch'"));
                     }
                     $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && {$deployKeyGitSshCommand} git fetch origin $branch && ".$this->buildGitCheckoutCommand($pr_branch_name, $deployKeySshCommand);
                 } elseif ($git_type === 'github' || $git_type === 'gitea') {
                     $branch = "pull/{$pull_request_id}/head:$pr_branch_name";
                     if ($exec_in_docker) {
-                        $commands->push(executeInDocker($deployment_uuid, "echo 'Checking out $branch'"));
+                        $commands->push($this->gitCommand(executeInDocker($deployment_uuid, "echo 'Checking out $branch'")));
                     } else {
-                        $commands->push("echo 'Checking out $branch'");
+                        $commands->push($this->gitCommand("echo 'Checking out $branch'"));
                     }
                     $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && {$deployKeyGitSshCommand} git fetch origin $branch && ".$this->buildGitCheckoutCommand($pr_branch_name, $deployKeySshCommand);
                 } elseif ($git_type === 'bitbucket') {
                     if ($exec_in_docker) {
-                        $commands->push(executeInDocker($deployment_uuid, "echo 'Checking out $branch'"));
+                        $commands->push($this->gitCommand(executeInDocker($deployment_uuid, "echo 'Checking out $branch'")));
                     } else {
-                        $commands->push("echo 'Checking out $branch'");
+                        $commands->push($this->gitCommand("echo 'Checking out $branch'"));
                     }
                     $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && {$deployKeyGitSshCommand} ".$this->buildGitCheckoutCommand($commit, $deployKeySshCommand);
                 }
             }
 
             if ($exec_in_docker) {
-                $commands->push(executeInDocker($deployment_uuid, $git_clone_command));
+                $commands->push($this->gitCommand(executeInDocker($deployment_uuid, $git_clone_command)));
             } else {
-                $commands->push($git_clone_command);
+                $commands->push($this->gitCommand($git_clone_command));
             }
 
             return [
-                'commands' => $commands->implode(' && '),
+                'commands' => $commands,
                 'branch' => $branch,
                 'fullRepoUrl' => $fullRepoUrl,
             ];
@@ -1807,37 +1796,37 @@ public function generateGitImportCommands(string $deployment_uuid, int $pull_req
                 if ($git_type === 'gitlab') {
                     $branch = "merge-requests/{$pull_request_id}/head:$pr_branch_name";
                     if ($exec_in_docker) {
-                        $commands->push(executeInDocker($deployment_uuid, "echo 'Checking out $branch'"));
+                        $commands->push($this->gitCommand(executeInDocker($deployment_uuid, "echo 'Checking out $branch'")));
                     } else {
-                        $commands->push("echo 'Checking out $branch'");
+                        $commands->push($this->gitCommand("echo 'Checking out $branch'"));
                     }
                     $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && GIT_SSH_COMMAND=\"{$otherSshCommand}\" {$gitCommand} fetch origin $branch && ".$this->buildGitCheckoutCommand($pr_branch_name, $otherSshCommand, $gitConfigOptions);
                 } elseif ($git_type === 'github' || $git_type === 'gitea') {
                     $branch = "pull/{$pull_request_id}/head:$pr_branch_name";
                     if ($exec_in_docker) {
-                        $commands->push(executeInDocker($deployment_uuid, "echo 'Checking out $branch'"));
+                        $commands->push($this->gitCommand(executeInDocker($deployment_uuid, "echo 'Checking out $branch'")));
                     } else {
-                        $commands->push("echo 'Checking out $branch'");
+                        $commands->push($this->gitCommand("echo 'Checking out $branch'"));
                     }
                     $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && GIT_SSH_COMMAND=\"{$otherSshCommand}\" {$gitCommand} fetch origin $branch && ".$this->buildGitCheckoutCommand($pr_branch_name, $otherSshCommand, $gitConfigOptions);
                 } elseif ($git_type === 'bitbucket') {
                     if ($exec_in_docker) {
-                        $commands->push(executeInDocker($deployment_uuid, "echo 'Checking out $branch'"));
+                        $commands->push($this->gitCommand(executeInDocker($deployment_uuid, "echo 'Checking out $branch'")));
                     } else {
-                        $commands->push("echo 'Checking out $branch'");
+                        $commands->push($this->gitCommand("echo 'Checking out $branch'"));
                     }
                     $git_clone_command = "{$git_clone_command} && cd {$escapedBaseDir} && GIT_SSH_COMMAND=\"{$otherSshCommand}\" ".$this->buildGitCheckoutCommand($commit, $otherSshCommand, $gitConfigOptions);
                 }
             }
 
             if ($exec_in_docker) {
-                $commands->push(executeInDocker($deployment_uuid, $git_clone_command));
+                $commands->push($this->gitCommand(executeInDocker($deployment_uuid, $git_clone_command)));
             } else {
-                $commands->push($git_clone_command);
+                $commands->push($this->gitCommand($git_clone_command));
             }
 
             return [
-                'commands' => $commands->implode(' && '),
+                'commands' => $this->gitCommandsAsShellCommand($commands),
                 'branch' => $branch,
                 'fullRepoUrl' => $fullRepoUrl,
             ];
@@ -1926,6 +1915,7 @@ public function loadComposeFile($isInit = false, ?string $restoreBaseDirectory =
         }
         $uuid = new_public_id();
         ['commands' => $cloneCommand] = $this->generateGitImportCommands(deployment_uuid: $uuid, only_checkout: true, exec_in_docker: false, custom_base_dir: 'checkout');
+        $cloneCommand = $this->gitCommandsAsShellCommand($cloneCommand);
         $cloneCommand = str_replace(' clone ', ' clone --quiet ', $cloneCommand);
         $workdir = rtrim($this->base_directory, '/');
         $composeFile = $this->docker_compose_location;

app/Models/LocalFileVolume.php

@@ -21,6 +21,7 @@ class LocalFileVolume extends BaseModel
         // 'mount_path' => 'encrypted',
         'content' => 'encrypted',
         'is_directory' => 'boolean',
+        'is_host_file' => 'boolean',
         'is_preview_suffix_enabled' => 'boolean',
     ];
 
@@ -33,6 +34,7 @@ class LocalFileVolume extends BaseModel
         'resource_type',
         'resource_id',
         'is_directory',
+        'is_host_file',
         'chown',
         'chmod',
         'is_based_on_git',
@@ -44,6 +46,10 @@ class LocalFileVolume extends BaseModel
     protected static function booted()
     {
         static::created(function (LocalFileVolume $fileVolume) {
+            if ($fileVolume->is_host_file) {
+                return;
+            }
+
             $fileVolume->load(['service']);
             dispatch(new ServerStorageSaveJob($fileVolume));
         });
@@ -70,6 +76,10 @@ public function service()
 
     public function loadStorageOnServer()
     {
+        if ($this->is_host_file) {
+            return;
+        }
+
         $this->load(['service']);
         $isService = data_get($this->resource, 'service');
         if ($isService) {
@@ -124,6 +134,10 @@ protected function remoteFileExceedsLimit(string $escapedPath, $server): bool
 
     public function deleteStorageOnServer()
     {
+        if ($this->is_host_file) {
+            return;
+        }
+
         $this->load(['service']);
         $isService = data_get($this->resource, 'service');
         if ($isService) {
@@ -161,6 +175,10 @@ public function deleteStorageOnServer()
 
     public function saveStorageOnServer()
     {
+        if ($this->is_host_file) {
+            return;
+        }
+
         $this->load(['service']);
         $isService = data_get($this->resource, 'service');
         if ($isService) {
@@ -171,26 +189,26 @@ public function saveStorageOnServer()
             $server = $this->resource->destination->server;
         }
         $commands = collect([]);
-
-        // Validate fs_path early before any shell interpolation
-        validateShellSafePath($this->fs_path, 'storage path');
-        $escapedFsPath = escapeshellarg($this->fs_path);
         $escapedWorkdir = escapeshellarg($workdir);
 
         if ($this->is_directory) {
+            // Validate fs_path early before any shell interpolation
+            validateShellSafePath($this->fs_path, 'storage path');
+            $escapedFsPath = escapeshellarg($this->fs_path);
             $commands->push("mkdir -p {$escapedFsPath} > /dev/null 2>&1 || true");
             $commands->push("mkdir -p {$escapedWorkdir} > /dev/null 2>&1 || true");
             $commands->push("cd {$escapedWorkdir}");
         }
-        if (str($this->fs_path)->startsWith('.') || str($this->fs_path)->startsWith('/') || str($this->fs_path)->startsWith('~')) {
+        $path = data_get_str($this, 'fs_path');
-            $parent_dir = str($this->fs_path)->beforeLast('/');
+        $content = data_get($this, 'content');
+        $pathForParentDirectory = str($this->fs_path);
+        if ($pathForParentDirectory->startsWith('.') || $pathForParentDirectory->startsWith('/') || $pathForParentDirectory->startsWith('~')) {
+            $parent_dir = $pathForParentDirectory->beforeLast('/');
             if ($parent_dir != '') {
                 $escapedParentDir = escapeshellarg($parent_dir);
                 $commands->push("mkdir -p {$escapedParentDir} > /dev/null 2>&1 || true");
             }
         }
-        $path = data_get_str($this, 'fs_path');
-        $content = data_get($this, 'content');
         if ($path->startsWith('.')) {
             $path = $path->after('.');
             $path = $workdir.$path;

app/Models/S3Storage.php

@@ -3,6 +3,7 @@
 namespace App\Models;
 
 use App\Rules\SafeWebhookUrl;
+use App\Rules\ValidS3BucketName;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
@@ -147,12 +148,22 @@ public function testConnection(bool $shouldSave = false)
     {
         try {
             $validator = Validator::make(
-                ['endpoint' => $this['endpoint']],
+                [
-                ['endpoint' => ['required', new SafeWebhookUrl]],
+                    'endpoint' => $this['endpoint'],
+                    'bucket' => $this['bucket'],
+                ],
+                [
+                    'endpoint' => ['required', new SafeWebhookUrl],
+                    'bucket' => ['required', new ValidS3BucketName],
+                ],
             );
-            if ($validator->fails()) {
+            $validator->fails();
+            if ($validator->errors()->has('endpoint')) {
                 throw new \RuntimeException('S3 endpoint is not allowed: '.$validator->errors()->first('endpoint'));
             }
+            if ($validator->errors()->has('bucket')) {
+                throw new \RuntimeException('S3 bucket name is not allowed: '.$validator->errors()->first('bucket'));
+            }
 
             $disk = Storage::build([
                 'driver' => 's3',
@@ -165,6 +176,7 @@ public function testConnection(bool $shouldSave = false)
                 'http' => [
                     'connect_timeout' => self::CONNECTION_TIMEOUT_SECONDS,
                     'timeout' => self::REQUEST_TIMEOUT_SECONDS,
+                    'allow_redirects' => false,
                 ],
             ]);
             // Test the connection by listing files with ListObjectsV2 (S3)

app/Policies/ServiceDatabasePolicy.php

@@ -69,6 +69,6 @@ public function manageBackups(User $user, ServiceDatabase $serviceDatabase): boo
      */
     public function uploadBackup(User $user, ServiceDatabase $serviceDatabase): bool
     {
-        return Gate::allows('uploadBackup', $serviceDatabase->service);
+        return $user->can('uploadBackup', $serviceDatabase->service);
     }
 }

app/Policies/TeamPolicy.php

@@ -37,12 +37,11 @@ public function create(User $user): bool
      */
     public function update(User $user, Team $team): bool
     {
-        // Only admins and owners can update team settings
         if (! $user->teams->contains('id', $team->id)) {
             return false;
         }
 
-        return $user->isAdmin() || $user->isOwner();
+        return $user->isAdminOfTeam($team->id);
     }
 
     /**
@@ -50,12 +49,11 @@ public function update(User $user, Team $team): bool
      */
     public function delete(User $user, Team $team): bool
     {
-        // Only admins and owners can delete teams
         if (! $user->teams->contains('id', $team->id)) {
             return false;
         }
 
-        return $user->isAdmin() || $user->isOwner();
+        return $user->isAdminOfTeam($team->id);
     }
 
     /**
@@ -63,12 +61,11 @@ public function delete(User $user, Team $team): bool
      */
     public function manageMembers(User $user, Team $team): bool
     {
-        // Only admins and owners can manage team members
         if (! $user->teams->contains('id', $team->id)) {
             return false;
         }
 
-        return $user->isAdmin() || $user->isOwner();
+        return $user->isAdminOfTeam($team->id);
     }
 
     /**
@@ -76,12 +73,11 @@ public function manageMembers(User $user, Team $team): bool
      */
     public function viewAdmin(User $user, Team $team): bool
     {
-        // Only admins and owners can view admin panel
         if (! $user->teams->contains('id', $team->id)) {
             return false;
         }
 
-        return $user->isAdmin() || $user->isOwner();
+        return $user->isAdminOfTeam($team->id);
     }
 
     /**
@@ -89,11 +85,10 @@ public function viewAdmin(User $user, Team $team): bool
      */
     public function manageInvitations(User $user, Team $team): bool
     {
-        // Only admins and owners can manage invitations
         if (! $user->teams->contains('id', $team->id)) {
             return false;
         }
 
-        return $user->isAdmin() || $user->isOwner();
+        return $user->isAdminOfTeam($team->id);
     }
 }

app/Rules/SafeExternalUrl.php

@@ -8,6 +8,11 @@
 
 class SafeExternalUrl implements ValidationRule
 {
+    /**
+     * @param  (Closure(string): array<int, string>)|null  $resolver
+     */
+    public function __construct(private ?Closure $resolver = null) {}
+
     /**
      * Run the validation rule.
      *
@@ -38,44 +43,137 @@ public function validate(string $attribute, mixed $value, Closure $fail): void
         }
 
         $host = strtolower($host);
+        $hostForIpCheck = $this->normalizeHostForIpCheck($host);
+        $hostForDns = rtrim($hostForIpCheck, '.');
 
-        // Block well-known internal hostnames
         $internalHosts = ['localhost', '0.0.0.0', '::1'];
-        if (in_array($host, $internalHosts) || str_ends_with($host, '.local') || str_ends_with($host, '.internal')) {
+        if (in_array($hostForDns, $internalHosts, true) || str_ends_with($hostForDns, '.local') || str_ends_with($hostForDns, '.internal')) {
-            Log::warning('External URL points to internal host', [
+            $this->logBlockedHost($attribute, $value, $host);
-                'attribute' => $attribute,
-                'url' => $value,
-                'host' => $host,
-                'ip' => request()->ip(),
-                'user_id' => auth()->id(),
-            ]);
             $fail('The :attribute must not point to internal hosts.');
 
             return;
         }
 
-        // Resolve hostname to IP and block private/reserved ranges
+        if (filter_var($hostForIpCheck, FILTER_VALIDATE_IP)) {
-        $ip = gethostbyname($host);
+            if (! $this->isPublicIp($hostForIpCheck)) {
+                $this->logBlockedIp($attribute, $value, $host, $hostForIpCheck);
+                $fail('The :attribute must not point to a private or reserved IP address.');
 
-        // gethostbyname returns the original hostname on failure (e.g. unresolvable)
+                return;
-        if ($ip === $host && ! filter_var($host, FILTER_VALIDATE_IP)) {
+            }
+
+            return;
+        }
+
+        $resolvedIps = $this->resolveHost($hostForDns);
+        if ($resolvedIps === []) {
             $fail('The :attribute host could not be resolved.');
 
             return;
         }
 
-        if (! filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
+        foreach ($resolvedIps as $resolvedIp) {
-            Log::warning('External URL resolves to private or reserved IP', [
+            if (! $this->isPublicIp($resolvedIp)) {
-                'attribute' => $attribute,
+                $this->logBlockedIp($attribute, $value, $host, $resolvedIp);
-                'url' => $value,
+                $fail('The :attribute must not point to a private or reserved IP address.');
-                'host' => $host,
-                'resolved_ip' => $ip,
-                'ip' => request()->ip(),
-                'user_id' => auth()->id(),
-            ]);
-            $fail('The :attribute must not point to a private or reserved IP address.');
 
-            return;
+                return;
+            }
         }
     }
+
+    private function normalizeHostForIpCheck(string $host): string
+    {
+        return (str_starts_with($host, '[') && str_ends_with($host, ']'))
+            ? substr($host, 1, -1)
+            : $host;
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function resolveHost(string $host): array
+    {
+        if ($this->resolver instanceof Closure) {
+            return array_values(array_filter(($this->resolver)($host), fn (string $ip): bool => filter_var($ip, FILTER_VALIDATE_IP) !== false));
+        }
+
+        $records = @dns_get_record($host, DNS_A | DNS_AAAA);
+        if ($records === false) {
+            $records = [];
+        }
+
+        $ips = [];
+        foreach ($records as $record) {
+            foreach (['ip', 'ipv6'] as $key) {
+                if (isset($record[$key]) && filter_var($record[$key], FILTER_VALIDATE_IP)) {
+                    $ips[] = $record[$key];
+                }
+            }
+        }
+
+        $ipv4Addresses = @gethostbynamel($host);
+        if (is_array($ipv4Addresses)) {
+            foreach ($ipv4Addresses as $ip) {
+                if (filter_var($ip, FILTER_VALIDATE_IP)) {
+                    $ips[] = $ip;
+                }
+            }
+        }
+
+        return array_values(array_unique($ips));
+    }
+
+    private function isPublicIp(string $ip): bool
+    {
+        $embeddedIpv4 = $this->extractIpv4FromMappedIpv6($ip);
+        if ($embeddedIpv4 !== null) {
+            return filter_var($embeddedIpv4, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false;
+        }
+
+        return filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) !== false;
+    }
+
+    private function extractIpv4FromMappedIpv6(string $ip): ?string
+    {
+        $packed = @inet_pton($ip);
+        if ($packed === false || strlen($packed) !== 16) {
+            return null;
+        }
+
+        $prefix = substr($packed, 0, 12);
+        if ($prefix !== str_repeat("\0", 10)."\xff\xff") {
+            return null;
+        }
+
+        $parts = unpack('C4', substr($packed, 12, 4));
+        if ($parts === false) {
+            return null;
+        }
+
+        return implode('.', $parts);
+    }
+
+    private function logBlockedHost(string $attribute, string $url, string $host): void
+    {
+        Log::warning('External URL points to internal host', [
+            'attribute' => $attribute,
+            'url' => $url,
+            'host' => $host,
+            'ip' => request()->ip(),
+            'user_id' => auth()->id(),
+        ]);
+    }
+
+    private function logBlockedIp(string $attribute, string $url, string $host, string $resolvedIp): void
+    {
+        Log::warning('External URL resolves to private or reserved IP', [
+            'attribute' => $attribute,
+            'url' => $url,
+            'host' => $host,
+            'resolved_ip' => $resolvedIp,
+            'ip' => request()->ip(),
+            'user_id' => auth()->id(),
+        ]);
+    }
 }

app/Rules/SafeWebhookUrl.php

@@ -8,6 +8,11 @@
 
 class SafeWebhookUrl implements ValidationRule
 {
+    /**
+     * @param  (Closure(string): array<int, string>)|null  $resolver
+     */
+    public function __construct(private ?Closure $resolver = null) {}
+
     /**
      * Run the validation rule.
      *
@@ -39,63 +44,175 @@ public function validate(string $attribute, mixed $value, Closure $fail): void
         }
 
         $host = strtolower($host);
+        $hostForIpCheck = $this->normalizeHostForIpCheck($host);
+        $hostForDns = rtrim($hostForIpCheck, '.');
 
-        // Strip IPv6 brackets (e.g. "[::1]" -> "::1") before IP checks so bracketed
-        // literals can't sneak past filter_var FILTER_VALIDATE_IP.
-        $hostForIpCheck = (str_starts_with($host, '[') && str_ends_with($host, ']'))
-            ? substr($host, 1, -1)
-            : $host;
-
-        // Block well-known dangerous hostnames
         $blockedHosts = ['localhost', '0.0.0.0', '::1'];
-        if (in_array($hostForIpCheck, $blockedHosts) || str_ends_with($host, '.internal')) {
+        if (in_array($hostForDns, $blockedHosts, true) || str_ends_with($hostForDns, '.internal')) {
-            Log::warning('Webhook URL points to blocked host', [
+            $this->logBlockedHost($attribute, $host);
-                'attribute' => $attribute,
-                'host' => $host,
-                'ip' => request()->ip(),
-                'user_id' => auth()->id(),
-            ]);
             $fail('The :attribute must not point to localhost or internal hosts.');
 
             return;
         }
 
-        // Block loopback (127.0.0.0/8) and link-local/metadata (169.254.0.0/16) when IP is provided directly
+        if (filter_var($hostForIpCheck, FILTER_VALIDATE_IP)) {
-        if (filter_var($hostForIpCheck, FILTER_VALIDATE_IP) && ($this->isLoopback($hostForIpCheck) || $this->isLinkLocal($hostForIpCheck))) {
+            if ($this->isBlockedIp($hostForIpCheck)) {
-            Log::warning('Webhook URL points to blocked IP range', [
+                $this->logBlockedIp($attribute, $host, $hostForIpCheck);
-                'attribute' => $attribute,
+                $fail('The :attribute must not point to loopback or link-local addresses.');
-                'host' => $host,
+
-                'ip' => request()->ip(),
+                return;
-                'user_id' => auth()->id(),
+            }
-            ]);
-            $fail('The :attribute must not point to loopback or link-local addresses.');
 
             return;
         }
+
+        $resolvedIps = $this->resolveHost($hostForDns);
+        foreach ($resolvedIps as $resolvedIp) {
+            if ($this->isBlockedIp($resolvedIp)) {
+                $this->logBlockedIp($attribute, $host, $resolvedIp);
+                $fail('The :attribute must not point to loopback or link-local addresses.');
+
+                return;
+            }
+        }
     }
 
-    private function isLoopback(string $ip): bool
+    private function normalizeHostForIpCheck(string $host): string
+    {
+        return (str_starts_with($host, '[') && str_ends_with($host, ']'))
+            ? substr($host, 1, -1)
+            : $host;
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function resolveHost(string $host): array
+    {
+        if ($this->resolver instanceof Closure) {
+            return array_values(array_filter(($this->resolver)($host), fn (string $ip): bool => filter_var($ip, FILTER_VALIDATE_IP) !== false));
+        }
+
+        $records = @dns_get_record($host, DNS_A | DNS_AAAA);
+        if ($records === false) {
+            $records = [];
+        }
+
+        $ips = [];
+        foreach ($records as $record) {
+            foreach (['ip', 'ipv6'] as $key) {
+                if (isset($record[$key]) && filter_var($record[$key], FILTER_VALIDATE_IP)) {
+                    $ips[] = $record[$key];
+                }
+            }
+        }
+
+        $ipv4Addresses = @gethostbynamel($host);
+        if (is_array($ipv4Addresses)) {
+            foreach ($ipv4Addresses as $ip) {
+                if (filter_var($ip, FILTER_VALIDATE_IP)) {
+                    $ips[] = $ip;
+                }
+            }
+        }
+
+        return array_values(array_unique($ips));
+    }
+
+    private function isBlockedIp(string $ip): bool
+    {
+        $embeddedIpv4 = $this->extractIpv4FromMappedIpv6($ip);
+        if ($embeddedIpv4 !== null) {
+            return $this->isBlockedIpv4($embeddedIpv4);
+        }
+
+        if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+            return $this->isBlockedIpv4($ip);
+        }
+
+        return $this->isBlockedIpv6($ip);
+    }
+
+    private function isBlockedIpv4(string $ip): bool
     {
-        // 127.0.0.0/8, 0.0.0.0
         if ($ip === '0.0.0.0' || str_starts_with($ip, '127.')) {
             return true;
         }
 
-        // IPv6 loopback
+        $long = ip2long($ip);
-        $normalized = @inet_pton($ip);
+        if ($long === false) {
-
-        return $normalized !== false && $normalized === inet_pton('::1');
-    }
-
-    private function isLinkLocal(string $ip): bool
-    {
-        // 169.254.0.0/16 — covers cloud metadata at 169.254.169.254
-        if (! filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
             return false;
         }
 
-        $long = ip2long($ip);
+        $unsigned = sprintf('%u', $long);
+        $linkLocalStart = sprintf('%u', ip2long('169.254.0.0'));
+        $linkLocalEnd = sprintf('%u', ip2long('169.254.255.255'));
 
-        return $long !== false && ($long >> 16) === (ip2long('169.254.0.0') >> 16);
+        return $unsigned >= $linkLocalStart && $unsigned <= $linkLocalEnd;
+    }
+
+    private function isBlockedIpv6(string $ip): bool
+    {
+        $packed = @inet_pton($ip);
+        if ($packed === false) {
+            return false;
+        }
+
+        if ($packed === inet_pton('::1') || $packed === inet_pton('::')) {
+            return true;
+        }
+
+        $bytes = unpack('C16', $packed);
+        if ($bytes === false) {
+            return false;
+        }
+
+        $firstByte = $bytes[1];
+        $secondByte = $bytes[2];
+
+        // fe80::/10 link-local and fc00::/7 unique local addresses.
+        return ($firstByte === 0xFE && ($secondByte & 0xC0) === 0x80)
+            || (($firstByte & 0xFE) === 0xFC);
+    }
+
+    private function extractIpv4FromMappedIpv6(string $ip): ?string
+    {
+        $packed = @inet_pton($ip);
+        if ($packed === false || strlen($packed) !== 16) {
+            return null;
+        }
+
+        $prefix = substr($packed, 0, 12);
+        if ($prefix !== str_repeat("\0", 10)."\xff\xff") {
+            return null;
+        }
+
+        $parts = unpack('C4', substr($packed, 12, 4));
+        if ($parts === false) {
+            return null;
+        }
+
+        return implode('.', $parts);
+    }
+
+    private function logBlockedHost(string $attribute, string $host): void
+    {
+        Log::warning('Webhook URL points to blocked host', [
+            'attribute' => $attribute,
+            'host' => $host,
+            'ip' => request()->ip(),
+            'user_id' => auth()->id(),
+        ]);
+    }
+
+    private function logBlockedIp(string $attribute, string $host, string $blockedIp): void
+    {
+        Log::warning('Webhook URL points to blocked IP range', [
+            'attribute' => $attribute,
+            'host' => $host,
+            'resolved_ip' => $blockedIp,
+            'ip' => request()->ip(),
+            'user_id' => auth()->id(),
+        ]);
     }
 }

app/Rules/ValidS3BucketName.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Rules;
+
+use App\Support\ValidationPatterns;
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Translation\PotentiallyTranslatedString;
+
+class ValidS3BucketName implements ValidationRule
+{
+    /**
+     * Run the validation rule.
+     *
+     * @param  Closure(string, ?string=): PotentiallyTranslatedString  $fail
+     */
+    public function validate(string $attribute, mixed $value, Closure $fail): void
+    {
+        if (! is_string($value) || ! ValidationPatterns::isValidS3BucketName($value)) {
+            $fail('The :attribute must be a valid S3 bucket name: 3-63 lowercase letters, numbers, dots, or hyphens; start and end with a letter or number; no consecutive dots, dot-hyphen pairs, or IP address format.');
+        }
+    }
+}

app/Support/DatabaseBackupFileValidator.php

@@ -0,0 +1,209 @@
+<?php
+
+namespace App\Support;
+
+use Illuminate\Http\UploadedFile;
+
+class DatabaseBackupFileValidator
+{
+    public const ALLOWED_EXTENSIONS = [
+        'sql',
+        'sql.gz',
+        'gz',
+        'zip',
+        'tar',
+        'tar.gz',
+        'tgz',
+        'dump',
+        'bak',
+        'bson',
+        'bson.gz',
+        'archive',
+        'archive.gz',
+        'bz2',
+        'xz',
+        'dmp',
+    ];
+
+    private const DANGEROUS_EXTENSIONS = [
+        'asp',
+        'aspx',
+        'bat',
+        'bash',
+        'cgi',
+        'cmd',
+        'com',
+        'exe',
+        'htm',
+        'html',
+        'jar',
+        'js',
+        'jsp',
+        'php',
+        'php3',
+        'php4',
+        'php5',
+        'phtml',
+        'pl',
+        'ps1',
+        'py',
+        'rb',
+        'sh',
+    ];
+
+    public static function hasAllowedExtension(string $name): bool
+    {
+        return self::extensionFor($name) !== null;
+    }
+
+    public static function isUploadAllowed(UploadedFile $file, int $maxBytes): bool
+    {
+        $originalName = $file->getClientOriginalName();
+        $size = $file->getSize();
+
+        if ($size === false || $size > $maxBytes) {
+            return false;
+        }
+
+        $extension = self::extensionFor($originalName);
+        if ($extension === null) {
+            return false;
+        }
+
+        return self::contentMatchesExtension($file->getPathname(), $extension);
+    }
+
+    /**
+     * Scan a stored backup file (decompressing gzip on the fly) for PostgreSQL
+     * restore directives that lead to OS command execution.
+     */
+    public static function fileContainsPostgresqlProgramExecution(string $path): bool
+    {
+        $contents = self::readPossiblyGzippedText($path);
+
+        if ($contents === null) {
+            return false;
+        }
+
+        return self::containsPostgresqlProgramExecution($contents);
+    }
+
+    public static function containsPostgresqlProgramExecution(string $sql): bool
+    {
+        $withoutComments = self::stripSqlComments($sql);
+
+        if (preg_match('/^\s*\\\\(?:!|copy\b.*\bprogram\b)/mi', $withoutComments) === 1) {
+            return true;
+        }
+
+        return preg_match('/\bcopy\b[\s\S]{0,2000}\b(?:from|to)\s+program\b/i', $withoutComments) === 1;
+    }
+
+    private static function extensionFor(string $name): ?string
+    {
+        $lower = strtolower($name);
+        $suffixes = array_map(fn (string $ext) => '.'.$ext, self::ALLOWED_EXTENSIONS);
+        usort($suffixes, fn (string $a, string $b) => strlen($b) <=> strlen($a));
+
+        foreach ($suffixes as $suffix) {
+            if (! str_ends_with($lower, $suffix)) {
+                continue;
+            }
+
+            $stem = substr($lower, 0, -strlen($suffix));
+            if ($stem === '' || str_ends_with($stem, '.')) {
+                return null;
+            }
+
+            $parts = array_filter(explode('.', $stem));
+            if (array_intersect($parts, self::DANGEROUS_EXTENSIONS) !== []) {
+                return null;
+            }
+
+            return ltrim($suffix, '.');
+        }
+
+        return null;
+    }
+
+    private static function contentMatchesExtension(string $path, string $extension): bool
+    {
+        $sample = (string) file_get_contents($path, false, null, 0, 4096);
+
+        return match ($extension) {
+            'sql' => self::looksLikeText($sample) && ! self::containsPostgresqlProgramExecution($sample),
+            'sql.gz', 'gz', 'tar.gz', 'tgz', 'bson.gz', 'archive.gz' => str_starts_with($sample, "\x1f\x8b"),
+            'zip' => str_starts_with($sample, "PK\x03\x04") || str_starts_with($sample, "PK\x05\x06") || str_starts_with($sample, "PK\x07\x08"),
+            'tar' => substr($sample, 257, 5) === 'ustar',
+            'bz2' => str_starts_with($sample, 'BZh'),
+            'xz' => str_starts_with($sample, "\xfd7zXZ\x00"),
+            'dump', 'bak', 'archive', 'dmp' => str_starts_with($sample, 'PGDMP')
+                || (self::looksLikeText($sample) && ! self::containsPostgresqlProgramExecution($sample)),
+            'bson' => self::looksLikeBson($path, $sample),
+            default => false,
+        };
+    }
+
+    private static function readPossiblyGzippedText(string $path): ?string
+    {
+        // Cap the scan so a huge legitimate dump cannot exhaust memory; the
+        // remote pre-restore scanner inspects the full file as a second layer.
+        $maxBytes = 50 * 1024 * 1024;
+
+        $handle = @fopen($path, 'rb');
+        if ($handle === false) {
+            return null;
+        }
+        $magic = (string) fread($handle, 2);
+        fclose($handle);
+
+        if ($magic === "\x1f\x8b") {
+            $gz = @gzopen($path, 'rb');
+            if ($gz === false) {
+                return null;
+            }
+
+            $data = '';
+            while (! gzeof($gz) && strlen($data) < $maxBytes) {
+                $chunk = gzread($gz, 1024 * 1024);
+                if ($chunk === false || $chunk === '') {
+                    break;
+                }
+                $data .= $chunk;
+            }
+            gzclose($gz);
+
+            return $data;
+        }
+
+        return (string) file_get_contents($path, false, null, 0, $maxBytes);
+    }
+
+    private static function looksLikeText(string $sample): bool
+    {
+        if ($sample === '' || str_contains($sample, "\0")) {
+            return false;
+        }
+
+        return mb_check_encoding($sample, 'UTF-8') || mb_check_encoding($sample, 'ASCII');
+    }
+
+    private static function looksLikeBson(string $path, string $sample): bool
+    {
+        if (strlen($sample) < 5) {
+            return false;
+        }
+
+        $documentLength = unpack('V', substr($sample, 0, 4))[1] ?? 0;
+        $fileSize = filesize($path) ?: 0;
+
+        return $documentLength >= 5 && $documentLength <= $fileSize;
+    }
+
+    private static function stripSqlComments(string $sql): string
+    {
+        $sql = preg_replace('/\/\*[\s\S]*?\*\//', ' ', $sql) ?? $sql;
+
+        return preg_replace('/--[^\r\n]*/', ' ', $sql) ?? $sql;
+    }
+}

app/Support/ValidationPatterns.php

@@ -94,10 +94,19 @@ class ValidationPatterns
     public const DOCKER_NETWORK_PATTERN = '/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/';
 
     /**
-     * Pattern for Docker-compatible environment variable keys.
+     * Pattern for S3 bucket names.
-     * Docker environment entries are KEY=value strings, so keys must be non-empty and cannot contain '=' or NUL.
+     *
+     * Bucket names must be 3-63 lowercase characters, start and end with a
+     * letter or digit, and contain only lowercase letters, digits, dots, and
+     * hyphens. Additional semantic checks live in isValidS3BucketName().
      */
-    public const ENVIRONMENT_VARIABLE_KEY_PATTERN = '/\A[^=\x00]+\z/u';
+    public const S3_BUCKET_NAME_PATTERN = '/\A(?=.{3,63}\z)[a-z0-9][a-z0-9.-]*[a-z0-9]\z/';
+
+    /**
+     * Pattern for Docker-compatible environment variable keys.
+     * Environment variable keys are later interpolated into shell commands as Docker build args, so only shell-safe identifier characters are allowed.
+     */
+    public const ENVIRONMENT_VARIABLE_KEY_PATTERN = '/\A[A-Za-z_][A-Za-z0-9_.]*\z/u';
 
     /**
      * Pattern for SQL-safe unquoted database identifiers (usernames, database names).
@@ -164,7 +173,7 @@ public static function environmentVariableKeyRules(bool $required = true, int $m
     public static function environmentVariableKeyMessages(string $field = 'key', string $label = 'key'): array
     {
         return [
-            "{$field}.regex" => "The {$label} must be a non-empty Docker-compatible environment variable key and cannot contain '=' or NUL characters.",
+            "{$field}.regex" => "The {$label} must start with a letter or underscore and may only contain letters, numbers, underscores, and dots.",
             "{$field}.max" => "The {$label} may not be greater than :max characters.",
         ];
     }
@@ -177,6 +186,22 @@ public static function isValidEnvironmentVariableKey(string $value): bool
         return preg_match(self::ENVIRONMENT_VARIABLE_KEY_PATTERN, $value) === 1;
     }
 
+    /**
+     * Check if a string is a valid S3 bucket name.
+     */
+    public static function isValidS3BucketName(string $value): bool
+    {
+        if (preg_match(self::S3_BUCKET_NAME_PATTERN, $value) !== 1) {
+            return false;
+        }
+
+        if (str_contains($value, '..') || str_contains($value, '.-') || str_contains($value, '-.')) {
+            return false;
+        }
+
+        return filter_var($value, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) === false;
+    }
+
     /**
      * Normalize and validate an environment variable key.
      */

app/Traits/ExecuteRemoteCommand.php

@@ -79,6 +79,7 @@ public function execute_remote_command(...$commands)
             $ignore_errors = data_get($single_command, 'ignore_errors', false);
             $append = data_get($single_command, 'append', true);
             $command_hidden = data_get($single_command, 'command_hidden', false);
+            $skip_command_log = data_get($single_command, 'skip_command_log', false);
             $this->save = data_get($single_command, 'save');
             if ($this->server->isNonRoot()) {
                 if (str($command)->startsWith('docker exec')) {
@@ -91,7 +92,7 @@ public function execute_remote_command(...$commands)
             // Check for cancellation before executing commands
             if (isset($this->application_deployment_queue)) {
                 $this->application_deployment_queue->refresh();
-                if ($this->application_deployment_queue->status === \App\Enums\ApplicationDeploymentStatus::CANCELLED_BY_USER->value) {
+                if ($this->application_deployment_queue->status === ApplicationDeploymentStatus::CANCELLED_BY_USER->value) {
                     throw new \RuntimeException('Deployment cancelled by user', 69420);
                 }
             }
@@ -103,7 +104,7 @@ public function execute_remote_command(...$commands)
 
             while ($attempt < $maxRetries && ! $commandExecuted) {
                 try {
-                    $this->executeCommandWithProcess($command, $hidden, $customType, $append, $ignore_errors, $command_hidden);
+                    $this->executeCommandWithProcess($command, $hidden, $customType, $append, $ignore_errors, $command_hidden, $skip_command_log);
                     $commandExecuted = true;
                 } catch (\RuntimeException|DeploymentException $e) {
                     $lastError = $e;
@@ -119,7 +120,7 @@ public function execute_remote_command(...$commands)
 
                             // Check for cancellation during retry wait
                             $this->application_deployment_queue->refresh();
-                            if ($this->application_deployment_queue->status === \App\Enums\ApplicationDeploymentStatus::CANCELLED_BY_USER->value) {
+                            if ($this->application_deployment_queue->status === ApplicationDeploymentStatus::CANCELLED_BY_USER->value) {
                                 throw new \RuntimeException('Deployment cancelled by user during retry', 69420);
                             }
                         }
@@ -153,14 +154,14 @@ public function execute_remote_command(...$commands)
     /**
      * Execute the actual command with process handling
      */
-    private function executeCommandWithProcess($command, $hidden, $customType, $append, $ignore_errors, $command_hidden = false)
+    private function executeCommandWithProcess($command, $hidden, $customType, $append, $ignore_errors, $command_hidden = false, $skip_command_log = false)
     {
-        if ($command_hidden && isset($this->application_deployment_queue)) {
+        if ($command_hidden && ! $skip_command_log && isset($this->application_deployment_queue)) {
             $this->application_deployment_queue->addLogEntry('[CMD]: '.$this->redact_sensitive_info($command), hidden: true);
         }
 
         $remote_command = SshMultiplexingHelper::generateSshCommand($this->server, $command);
-        $process = Process::timeout(config('constants.ssh.command_timeout'))->idleTimeout(3600)->start($remote_command, function (string $type, string $output) use ($command, $hidden, $customType, $append, $command_hidden) {
+        $process = Process::timeout(config('constants.ssh.command_timeout'))->idleTimeout(3600)->start($remote_command, function (string $type, string $output) use ($command, $hidden, $customType, $append, $command_hidden, $skip_command_log) {
             $output = str($output)->trim();
             if ($output->startsWith('╔')) {
                 $output = "\n".$output;
@@ -170,7 +171,7 @@ private function executeCommandWithProcess($command, $hidden, $customType, $appe
             $sanitized_output = sanitize_utf8_text($output);
 
             $new_log_entry = [
-                'command' => $command_hidden ? null : $this->redact_sensitive_info($command),
+                'command' => $skip_command_log || $command_hidden ? null : $this->redact_sensitive_info($command),
                 'output' => $this->redact_sensitive_info($sanitized_output),
                 'type' => $customType ?? ($type === 'err' ? 'stderr' : 'stdout'),
                 'timestamp' => Carbon::now('UTC'),
@@ -227,7 +228,7 @@ private function executeCommandWithProcess($command, $hidden, $customType, $appe
                 // Check if deployment was cancelled while command was running
                 if (isset($this->application_deployment_queue)) {
                     $this->application_deployment_queue->refresh();
-                    if ($this->application_deployment_queue->status === \App\Enums\ApplicationDeploymentStatus::CANCELLED_BY_USER->value) {
+                    if ($this->application_deployment_queue->status === ApplicationDeploymentStatus::CANCELLED_BY_USER->value) {
                         throw new \RuntimeException('Deployment cancelled by user', 69420);
                     }
                 }

bootstrap/helpers/docker.php

@@ -1363,7 +1363,7 @@ function generateDockerBuildArgs($variables): Collection
         $key = is_array($var) ? data_get($var, 'key') : $var->key;
 
         // Only return the key - Docker will get the value from the environment
-        return "--build-arg {$key}";
+        return '--build-arg '.escapeshellarg((string) $key);
     });
 }
 

bootstrap/helpers/shared.php

@@ -166,7 +166,7 @@ function validateShellSafePath(string $input, string $context = 'path'): string
 /**
  * Validate that a filename is safe for use as a plain file name (no path components).
  *
- * Prevents path traversal attacks by rejecting directory separators, traversal
+ * Prevents unsafe parent directory paths by rejecting directory separators, parent directory
  * sequences, and null bytes, in addition to all shell metacharacters blocked by
  * validateShellSafePath(). Intended for user-supplied filenames such as PostgreSQL
  * init script names that are later written to a specific directory on the host.
@@ -175,7 +175,7 @@ function validateShellSafePath(string $input, string $context = 'path'): string
  * @param  string  $context  Descriptive name for error messages (e.g., 'init script filename')
  * @return string The validated input (unchanged if valid)
  *
- * @throws Exception If dangerous characters or path traversal sequences are detected
+ * @throws Exception If dangerous characters or parent directory sequences are detected
  */
 function validateFilenameSafe(string $input, string $context = 'filename'): string
 {
@@ -198,10 +198,10 @@ function validateFilenameSafe(string $input, string $context = 'filename'): stri
         );
     }
 
-    // Reject path traversal sequences (catches encoded or unusual forms)
+    // Reject parent directory sequences (catches encoded or unusual forms)
     if (str_contains($input, '..')) {
         throw new Exception(
-            "Invalid {$context}: path traversal sequence ('..') is not allowed."
+            "Invalid {$context}: parent directory sequence ('..') is not allowed."
         );
     }
 
@@ -230,6 +230,197 @@ function validateFilenameSafe(string $input, string $context = 'filename'): stri
     return $input;
 }
 
+/**
+ * Validate and normalize a user supplied file mount path.
+ *
+ * File mount paths are container paths supplied by tenants. They may look like
+ * absolute paths (for example /etc/nginx/nginx.conf), but are later joined to a
+ * Coolify-managed configuration directory on the host. Therefore shell safety is
+ * not enough: every path segment must also be unable to traverse out of that
+ * managed directory.
+ *
+ * @throws Exception
+ */
+function validateFileMountPath(string $input, string $context = 'file mount path'): string
+{
+    validateShellSafePath($input, $context);
+
+    if (str_contains($input, "\0")) {
+        throw new Exception(
+            "Invalid {$context}: contains null byte. ".
+            'Null bytes are not allowed in file mount paths for security reasons.'
+        );
+    }
+
+    if (str_contains($input, '\\')) {
+        throw new Exception(
+            "Invalid {$context}: backslash directory separators are not allowed."
+        );
+    }
+
+    $path = str($input)->trim()->start('/')->replaceMatches('#/+#', '/')->value();
+
+    foreach (explode('/', trim($path, '/')) as $segment) {
+        if ($segment === '' || ($segment !== '.' && $segment !== '..')) {
+            continue;
+        }
+
+        throw new Exception(
+            "Invalid {$context}: relative path segments ('.' or '..') are not allowed."
+        );
+    }
+
+    return $path;
+}
+
+/**
+ * Validate a host file path used as a bind-only source.
+ *
+ * Unlike managed file mounts, this path is not re-based under the Coolify
+ * configuration directory and must never be written by Coolify. It still needs
+ * to be shell-safe because other storage code may pass paths through remote
+ * shell commands.
+ *
+ * @throws Exception
+ */
+function validateHostFileMountPath(string $input, string $context = 'host file path'): string
+{
+    validateShellSafePath($input, $context);
+
+    if (str_contains($input, "\0")) {
+        throw new Exception("Invalid {$context}: contains null byte.");
+    }
+
+    if (str_contains($input, '\\')) {
+        throw new Exception("Invalid {$context}: backslash directory separators are not allowed.");
+    }
+
+    $path = str($input)->trim()->replaceMatches('#/+#', '/')->value();
+
+    if ($path === '' || ! str_starts_with($path, '/')) {
+        throw new Exception("Invalid {$context}: must be an absolute path.");
+    }
+
+    if ($path === '/' || str_ends_with($path, '/')) {
+        throw new Exception("Invalid {$context}: must point to a file, not a directory.");
+    }
+
+    foreach (explode('/', trim($path, '/')) as $segment) {
+        if ($segment === '' || ($segment !== '.' && $segment !== '..')) {
+            continue;
+        }
+
+        throw new Exception("Invalid {$context}: relative path segments ('.' or '..') are not allowed.");
+    }
+
+    return normalizeUnixPath($path);
+}
+
+/**
+ * Resolve a tenant file mount path under a Coolify-managed base directory.
+ *
+ * This performs lexical normalization only; the target file does not need to
+ * exist yet. The normalized result must remain inside the given base directory.
+ *
+ * @throws Exception
+ */
+function confineFileMountPath(string $baseDirectory, string $path, string $context = 'file mount path'): string
+{
+    $baseDirectory = normalizeUnixPath($baseDirectory);
+    $mountPath = validateFileMountPath($path, $context);
+    $resolvedPath = normalizeUnixPath($baseDirectory.'/'.$mountPath);
+
+    if ($resolvedPath !== $baseDirectory && ! str_starts_with($resolvedPath, $baseDirectory.'/')) {
+        throw new Exception(
+            "Invalid {$context}: resolved path must stay inside the resource configuration directory."
+        );
+    }
+
+    return $resolvedPath;
+}
+
+/**
+ * Normalize an existing host path and assert it remains inside a base directory.
+ *
+ * Dot-relative paths are resolved against the base directory for legacy
+ * LocalFileVolume rows. Absolute paths must already point inside the base.
+ *
+ * @throws Exception
+ */
+function confinePathToBase(string $baseDirectory, string $path, string $context = 'path'): string
+{
+    $baseDirectory = normalizeUnixPath($baseDirectory);
+    $path = trim($path);
+
+    if (str_starts_with($path, '.')) {
+        $path = $baseDirectory.'/'.str($path)->after('.')->value();
+    } elseif (! str_starts_with($path, '/')) {
+        $path = $baseDirectory.'/'.$path;
+    }
+
+    $resolvedPath = normalizeUnixPath($path);
+
+    if ($resolvedPath !== $baseDirectory && ! str_starts_with($resolvedPath, $baseDirectory.'/')) {
+        throw new Exception(
+            "Invalid {$context}: resolved path must stay inside the resource configuration directory."
+        );
+    }
+
+    return $resolvedPath;
+}
+
+/**
+ * Normalize a Unix path lexically without consulting the remote filesystem.
+ *
+ * @throws Exception
+ */
+function normalizeUnixPath(string $path): string
+{
+    validateShellSafePath($path, 'path');
+
+    if (str_contains($path, "\0")) {
+        throw new Exception('Invalid path: contains null byte.');
+    }
+
+    if (str_contains($path, '\\')) {
+        throw new Exception('Invalid path: backslash directory separators are not allowed.');
+    }
+
+    $isAbsolute = str_starts_with($path, '/');
+    $segments = [];
+
+    foreach (explode('/', $path) as $segment) {
+        if ($segment === '' || $segment === '.') {
+            continue;
+        }
+
+        if ($segment === '..') {
+            if ($segments === [] || end($segments) === '..') {
+                if ($isAbsolute) {
+                    throw new Exception('Invalid path: resolved path escapes the base directory.');
+                }
+                $segments[] = $segment;
+
+                continue;
+            }
+
+            array_pop($segments);
+
+            continue;
+        }
+
+        $segments[] = $segment;
+    }
+
+    $normalized = implode('/', $segments);
+
+    if ($isAbsolute) {
+        return $normalized === '' ? '/' : '/'.$normalized;
+    }
+
+    return $normalized === '' ? '.' : $normalized;
+}
+
 /**
  * Validate that a databases_to_backup input string is safe from command injection.
  *
@@ -3819,7 +4010,7 @@ function formatBytes(?int $bytes, int $precision = 2): string
 
 /**
  * Validates that a file path is safely within the /tmp/ directory.
- * Protects against path traversal attacks by resolving the real path
+ * Protects against unsafe parent directory paths by resolving the real path
  * and verifying it stays within /tmp/.
  *
  * Note: On macOS, /tmp is often a symlink to /private/tmp, which is handled.

composer.lock

@@ -1232,25 +1232,26 @@
         },
         {
             "name": "guzzlehttp/guzzle",
-            "version": "7.10.3",
+            "version": "7.12.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/guzzle/guzzle.git",
-                "reference": "47ba23c7a55247e2e1b7407aca90e9bbed0d9d86"
+                "reference": "d34627490fbc03bf5c5d7cfed81f2faa19519425"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/guzzle/zipball/47ba23c7a55247e2e1b7407aca90e9bbed0d9d86",
+                "url": "https://api.github.com/repos/guzzle/guzzle/zipball/d34627490fbc03bf5c5d7cfed81f2faa19519425",
-                "reference": "47ba23c7a55247e2e1b7407aca90e9bbed0d9d86",
+                "reference": "d34627490fbc03bf5c5d7cfed81f2faa19519425",
                 "shasum": ""
             },
             "require": {
                 "ext-json": "*",
-                "guzzlehttp/promises": "^2.3",
+                "guzzlehttp/promises": "^2.5",
-                "guzzlehttp/psr7": "^2.8",
+                "guzzlehttp/psr7": "^2.12.1",
                 "php": "^7.2.5 || ^8.0",
                 "psr/http-client": "^1.0",
-                "symfony/deprecation-contracts": "^2.2 || ^3.0"
+                "symfony/deprecation-contracts": "^2.5 || ^3.0",
+                "symfony/polyfill-php80": "^1.24"
             },
             "provide": {
                 "psr/http-client-implementation": "1.0"
@@ -1259,7 +1260,7 @@
                 "bamarni/composer-bin-plugin": "^1.8.2",
                 "ext-curl": "*",
                 "guzzle/client-integration-tests": "3.0.2",
-                "guzzlehttp/test-server": "^0.3.2",
+                "guzzlehttp/test-server": "^0.5.1",
                 "php-http/message-factory": "^1.1",
                 "phpunit/phpunit": "^8.5.52 || ^9.6.34",
                 "psr/log": "^1.1 || ^2.0 || ^3.0"
@@ -1339,7 +1340,7 @@
             ],
             "support": {
                 "issues": "https://github.com/guzzle/guzzle/issues",
-                "source": "https://github.com/guzzle/guzzle/tree/7.10.3"
+                "source": "https://github.com/guzzle/guzzle/tree/7.12.1"
             },
             "funding": [
                 {
@@ -1355,24 +1356,25 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-20T22:59:19+00:00"
+            "time": "2026-06-18T14:12:49+00:00"
         },
         {
             "name": "guzzlehttp/promises",
-            "version": "2.4.1",
+            "version": "2.5.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/guzzle/promises.git",
-                "reference": "09e8a212562fb1fb6a512c4156ed71525969d6c2"
+                "reference": "4360e982f87f5f258bf872d094647791db2f4c8e"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/promises/zipball/09e8a212562fb1fb6a512c4156ed71525969d6c2",
+                "url": "https://api.github.com/repos/guzzle/promises/zipball/4360e982f87f5f258bf872d094647791db2f4c8e",
-                "reference": "09e8a212562fb1fb6a512c4156ed71525969d6c2",
+                "reference": "4360e982f87f5f258bf872d094647791db2f4c8e",
                 "shasum": ""
             },
             "require": {
-                "php": "^7.2.5 || ^8.0"
+                "php": "^7.2.5 || ^8.0",
+                "symfony/deprecation-contracts": "^2.5 || ^3.0"
             },
             "require-dev": {
                 "bamarni/composer-bin-plugin": "^1.8.2",
@@ -1422,7 +1424,7 @@
             ],
             "support": {
                 "issues": "https://github.com/guzzle/promises/issues",
-                "source": "https://github.com/guzzle/promises/tree/2.4.1"
+                "source": "https://github.com/guzzle/promises/tree/2.5.0"
             },
             "funding": [
                 {
@@ -1438,27 +1440,29 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-20T22:57:30+00:00"
+            "time": "2026-06-02T12:23:43+00:00"
         },
         {
             "name": "guzzlehttp/psr7",
-            "version": "2.10.1",
+            "version": "2.12.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/guzzle/psr7.git",
-                "reference": "73ab136360b5dfd858006eae9795e8fe43c80361"
+                "reference": "172ef2f4e9824c1e058b7f30be8ae25a02c0f2b7"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/psr7/zipball/73ab136360b5dfd858006eae9795e8fe43c80361",
+                "url": "https://api.github.com/repos/guzzle/psr7/zipball/172ef2f4e9824c1e058b7f30be8ae25a02c0f2b7",
-                "reference": "73ab136360b5dfd858006eae9795e8fe43c80361",
+                "reference": "172ef2f4e9824c1e058b7f30be8ae25a02c0f2b7",
                 "shasum": ""
             },
             "require": {
                 "php": "^7.2.5 || ^8.0",
                 "psr/http-factory": "^1.0",
                 "psr/http-message": "^1.1 || ^2.0",
-                "ralouphie/getallheaders": "^3.0"
+                "ralouphie/getallheaders": "^3.0",
+                "symfony/deprecation-contracts": "^2.5 || ^3.0",
+                "symfony/polyfill-php80": "^1.24"
             },
             "provide": {
                 "psr/http-factory-implementation": "1.0",
@@ -1539,7 +1543,7 @@
             ],
             "support": {
                 "issues": "https://github.com/guzzle/psr7/issues",
-                "source": "https://github.com/guzzle/psr7/tree/2.10.1"
+                "source": "https://github.com/guzzle/psr7/tree/2.12.1"
             },
             "funding": [
                 {
@@ -1555,20 +1559,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-20T09:27:36+00:00"
+            "time": "2026-06-18T09:49:37+00:00"
         },
         {
             "name": "guzzlehttp/uri-template",
-            "version": "v1.0.5",
+            "version": "v1.0.7",
             "source": {
                 "type": "git",
                 "url": "https://github.com/guzzle/uri-template.git",
-                "reference": "4f4bbd4e7172148801e76e3decc1e559bdee34e1"
+                "reference": "7fe811c23a9e3cd712b4389eaeb50b5456d8c529"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/guzzle/uri-template/zipball/4f4bbd4e7172148801e76e3decc1e559bdee34e1",
+                "url": "https://api.github.com/repos/guzzle/uri-template/zipball/7fe811c23a9e3cd712b4389eaeb50b5456d8c529",
-                "reference": "4f4bbd4e7172148801e76e3decc1e559bdee34e1",
+                "reference": "7fe811c23a9e3cd712b4389eaeb50b5456d8c529",
                 "shasum": ""
             },
             "require": {
@@ -1577,7 +1581,7 @@
             },
             "require-dev": {
                 "bamarni/composer-bin-plugin": "^1.8.2",
-                "phpunit/phpunit": "^8.5.44 || ^9.6.25",
+                "phpunit/phpunit": "^8.5.52 || ^9.6.34",
                 "uri-template/tests": "1.0.0"
             },
             "type": "library",
@@ -1625,7 +1629,7 @@
             ],
             "support": {
                 "issues": "https://github.com/guzzle/uri-template/issues",
-                "source": "https://github.com/guzzle/uri-template/tree/v1.0.5"
+                "source": "https://github.com/guzzle/uri-template/tree/v1.0.7"
             },
             "funding": [
                 {
@@ -1641,7 +1645,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2025-08-22T14:27:06+00:00"
+            "time": "2026-06-12T21:33:43+00:00"
         },
         {
             "name": "jean85/pretty-package-versions",
@@ -1769,16 +1773,16 @@
         },
         {
             "name": "laravel/framework",
-            "version": "v12.60.2",
+            "version": "v12.61.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/laravel/framework.git",
-                "reference": "b8b55ce32175cc00f834a56eeb6316f18ed6ea39"
+                "reference": "e8472ca9774452fe50841d9bdced060679f4d58d"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/laravel/framework/zipball/b8b55ce32175cc00f834a56eeb6316f18ed6ea39",
+                "url": "https://api.github.com/repos/laravel/framework/zipball/e8472ca9774452fe50841d9bdced060679f4d58d",
-                "reference": "b8b55ce32175cc00f834a56eeb6316f18ed6ea39",
+                "reference": "e8472ca9774452fe50841d9bdced060679f4d58d",
                 "shasum": ""
             },
             "require": {
@@ -1987,7 +1991,7 @@
                 "issues": "https://github.com/laravel/framework/issues",
                 "source": "https://github.com/laravel/framework"
             },
-            "time": "2026-05-20T11:48:19+00:00"
+            "time": "2026-06-04T14:22:52+00:00"
         },
         {
             "name": "laravel/horizon",
@@ -4093,16 +4097,16 @@
         },
         {
             "name": "nesbot/carbon",
-            "version": "3.11.4",
+            "version": "3.13.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/CarbonPHP/carbon.git",
-                "reference": "e890471a3494740f7d9326d72ce6a8c559ffee60"
+                "reference": "40f6618f052df16b545f626fbf9a878e6497d16a"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/CarbonPHP/carbon/zipball/e890471a3494740f7d9326d72ce6a8c559ffee60",
+                "url": "https://api.github.com/repos/CarbonPHP/carbon/zipball/40f6618f052df16b545f626fbf9a878e6497d16a",
-                "reference": "e890471a3494740f7d9326d72ce6a8c559ffee60",
+                "reference": "40f6618f052df16b545f626fbf9a878e6497d16a",
                 "shasum": ""
             },
             "require": {
@@ -4194,7 +4198,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-04-07T09:57:54+00:00"
+            "time": "2026-06-18T13:49:15+00:00"
         },
         {
             "name": "nette/schema",
@@ -5130,16 +5134,16 @@
         },
         {
             "name": "phpseclib/phpseclib",
-            "version": "3.0.52",
+            "version": "3.0.54",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpseclib/phpseclib.git",
-                "reference": "2adaefc83df2ec548558307690f376dd7d4f4fce"
+                "reference": "5418963581a6d3e69f030d8c972238cb6add3166"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/2adaefc83df2ec548558307690f376dd7d4f4fce",
+                "url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/5418963581a6d3e69f030d8c972238cb6add3166",
-                "reference": "2adaefc83df2ec548558307690f376dd7d4f4fce",
+                "reference": "5418963581a6d3e69f030d8c972238cb6add3166",
                 "shasum": ""
             },
             "require": {
@@ -5220,7 +5224,7 @@
             ],
             "support": {
                 "issues": "https://github.com/phpseclib/phpseclib/issues",
-                "source": "https://github.com/phpseclib/phpseclib/tree/3.0.52"
+                "source": "https://github.com/phpseclib/phpseclib/tree/3.0.54"
             },
             "funding": [
                 {
@@ -5236,7 +5240,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-04-27T07:02:15+00:00"
+            "time": "2026-06-14T19:54:17+00:00"
         },
         {
             "name": "phpstan/phpdoc-parser",
@@ -6217,20 +6221,20 @@
         },
         {
             "name": "ramsey/uuid",
-            "version": "4.9.2",
+            "version": "4.9.3",
             "source": {
                 "type": "git",
                 "url": "https://github.com/ramsey/uuid.git",
-                "reference": "8429c78ca35a09f27565311b98101e2826affde0"
+                "reference": "1df15849d00943a67d677dc9cfd80795f038c9f8"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/ramsey/uuid/zipball/8429c78ca35a09f27565311b98101e2826affde0",
+                "url": "https://api.github.com/repos/ramsey/uuid/zipball/1df15849d00943a67d677dc9cfd80795f038c9f8",
-                "reference": "8429c78ca35a09f27565311b98101e2826affde0",
+                "reference": "1df15849d00943a67d677dc9cfd80795f038c9f8",
                 "shasum": ""
             },
             "require": {
-                "brick/math": "^0.8.16 || ^0.9 || ^0.10 || ^0.11 || ^0.12 || ^0.13 || ^0.14",
+                "brick/math": ">=0.8.16 <=0.18",
                 "php": "^8.0",
                 "ramsey/collection": "^1.2 || ^2.0"
             },
@@ -6289,9 +6293,9 @@
             ],
             "support": {
                 "issues": "https://github.com/ramsey/uuid/issues",
-                "source": "https://github.com/ramsey/uuid/tree/4.9.2"
+                "source": "https://github.com/ramsey/uuid/tree/4.9.3"
             },
-            "time": "2025-12-14T04:43:48+00:00"
+            "time": "2026-06-18T03:57:49+00:00"
         },
         {
             "name": "resend/resend-laravel",
@@ -8350,16 +8354,16 @@
         },
         {
             "name": "symfony/console",
-            "version": "v7.4.11",
+            "version": "v7.4.13",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/console.git",
-                "reference": "ed0107e43ab452aa77ae99e005b95e56b556e075"
+                "reference": "85095d2573eaefaf35e40b9513a9bf09f72cd217"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/console/zipball/ed0107e43ab452aa77ae99e005b95e56b556e075",
+                "url": "https://api.github.com/repos/symfony/console/zipball/85095d2573eaefaf35e40b9513a9bf09f72cd217",
-                "reference": "ed0107e43ab452aa77ae99e005b95e56b556e075",
+                "reference": "85095d2573eaefaf35e40b9513a9bf09f72cd217",
                 "shasum": ""
             },
             "require": {
@@ -8424,7 +8428,7 @@
                 "terminal"
             ],
             "support": {
-                "source": "https://github.com/symfony/console/tree/v7.4.11"
+                "source": "https://github.com/symfony/console/tree/v7.4.13"
             },
             "funding": [
                 {
@@ -8444,7 +8448,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-13T12:04:42+00:00"
+            "time": "2026-05-24T08:56:14+00:00"
         },
         {
             "name": "symfony/css-selector",
@@ -8973,16 +8977,16 @@
         },
         {
             "name": "symfony/http-foundation",
-            "version": "v7.4.8",
+            "version": "v7.4.13",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/http-foundation.git",
-                "reference": "9381209597ec66c25be154cbf2289076e64d1eab"
+                "reference": "bc354f47c62301e990b7874fa662326368508e2c"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/http-foundation/zipball/9381209597ec66c25be154cbf2289076e64d1eab",
+                "url": "https://api.github.com/repos/symfony/http-foundation/zipball/bc354f47c62301e990b7874fa662326368508e2c",
-                "reference": "9381209597ec66c25be154cbf2289076e64d1eab",
+                "reference": "bc354f47c62301e990b7874fa662326368508e2c",
                 "shasum": ""
             },
             "require": {
@@ -9031,7 +9035,7 @@
             "description": "Defines an object-oriented layer for the HTTP specification",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/http-foundation/tree/v7.4.8"
+                "source": "https://github.com/symfony/http-foundation/tree/v7.4.13"
             },
             "funding": [
                 {
@@ -9051,20 +9055,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-03-24T13:12:05+00:00"
+            "time": "2026-05-24T11:20:33+00:00"
         },
         {
             "name": "symfony/http-kernel",
-            "version": "v7.4.12",
+            "version": "v7.4.13",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/http-kernel.git",
-                "reference": "7922b53e70d2ba2027af8bb6a59d91eb3541ea4d"
+                "reference": "9df847980c436451f4f51d1284491bb4356dd989"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/http-kernel/zipball/7922b53e70d2ba2027af8bb6a59d91eb3541ea4d",
+                "url": "https://api.github.com/repos/symfony/http-kernel/zipball/9df847980c436451f4f51d1284491bb4356dd989",
-                "reference": "7922b53e70d2ba2027af8bb6a59d91eb3541ea4d",
+                "reference": "9df847980c436451f4f51d1284491bb4356dd989",
                 "shasum": ""
             },
             "require": {
@@ -9150,7 +9154,7 @@
             "description": "Provides a structured process for converting a Request into a Response",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/http-kernel/tree/v7.4.12"
+                "source": "https://github.com/symfony/http-kernel/tree/v7.4.13"
             },
             "funding": [
                 {
@@ -9170,7 +9174,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-20T09:27:11+00:00"
+            "time": "2026-05-27T08:31:43+00:00"
         },
         {
             "name": "symfony/mailer",
@@ -9258,16 +9262,16 @@
         },
         {
             "name": "symfony/mime",
-            "version": "v7.4.12",
+            "version": "v7.4.13",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/mime.git",
-                "reference": "b198dd66c211c97119bcaaff7c13431dbbb5e470"
+                "reference": "a845722765c4f6b2ce88beaf4f4479975b186770"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/mime/zipball/b198dd66c211c97119bcaaff7c13431dbbb5e470",
+                "url": "https://api.github.com/repos/symfony/mime/zipball/a845722765c4f6b2ce88beaf4f4479975b186770",
-                "reference": "b198dd66c211c97119bcaaff7c13431dbbb5e470",
+                "reference": "a845722765c4f6b2ce88beaf4f4479975b186770",
                 "shasum": ""
             },
             "require": {
@@ -9323,7 +9327,7 @@
                 "mime-type"
             ],
             "support": {
-                "source": "https://github.com/symfony/mime/tree/v7.4.12"
+                "source": "https://github.com/symfony/mime/tree/v7.4.13"
             },
             "funding": [
                 {
@@ -9343,7 +9347,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-20T07:20:23+00:00"
+            "time": "2026-05-23T16:22:37+00:00"
         },
         {
             "name": "symfony/options-resolver",
@@ -9585,16 +9589,16 @@
         },
         {
             "name": "symfony/polyfill-intl-grapheme",
-            "version": "v1.37.0",
+            "version": "v1.38.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-intl-grapheme.git",
-                "reference": "4864388bfbd3001ce88e234fab652acd91fdc57e"
+                "reference": "e9247d281d694a5120554d9afaf54e070e88a603"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-intl-grapheme/zipball/4864388bfbd3001ce88e234fab652acd91fdc57e",
+                "url": "https://api.github.com/repos/symfony/polyfill-intl-grapheme/zipball/e9247d281d694a5120554d9afaf54e070e88a603",
-                "reference": "4864388bfbd3001ce88e234fab652acd91fdc57e",
+                "reference": "e9247d281d694a5120554d9afaf54e070e88a603",
                 "shasum": ""
             },
             "require": {
@@ -9643,7 +9647,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-intl-grapheme/tree/v1.37.0"
+                "source": "https://github.com/symfony/polyfill-intl-grapheme/tree/v1.38.1"
             },
             "funding": [
                 {
@@ -9663,7 +9667,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-04-26T13:13:48+00:00"
+            "time": "2026-05-26T05:58:03+00:00"
         },
         {
             "name": "symfony/polyfill-intl-idn",
@@ -9839,16 +9843,16 @@
         },
         {
             "name": "symfony/polyfill-mbstring",
-            "version": "v1.38.1",
+            "version": "v1.38.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-mbstring.git",
-                "reference": "14c5439eec4ccff081ac14eca2dc57feb2a66d92"
+                "reference": "d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/14c5439eec4ccff081ac14eca2dc57feb2a66d92",
+                "url": "https://api.github.com/repos/symfony/polyfill-mbstring/zipball/d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6",
-                "reference": "14c5439eec4ccff081ac14eca2dc57feb2a66d92",
+                "reference": "d3d318bad5e7a1bfbd026009c8bfb8d8f99ae6b6",
                 "shasum": ""
             },
             "require": {
@@ -9900,7 +9904,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.38.1"
+                "source": "https://github.com/symfony/polyfill-mbstring/tree/v1.38.2"
             },
             "funding": [
                 {
@@ -9920,7 +9924,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-26T12:51:13+00:00"
+            "time": "2026-05-27T06:59:30+00:00"
         },
         {
             "name": "symfony/polyfill-php80",
@@ -10008,16 +10012,16 @@
         },
         {
             "name": "symfony/polyfill-php83",
-            "version": "v1.37.0",
+            "version": "v1.38.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-php83.git",
-                "reference": "3600c2cb22399e25bb226e4a135ce91eeb2a6149"
+                "reference": "796a26abb75ce49f3a84433cd81bf1009d73d5f8"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-php83/zipball/3600c2cb22399e25bb226e4a135ce91eeb2a6149",
+                "url": "https://api.github.com/repos/symfony/polyfill-php83/zipball/796a26abb75ce49f3a84433cd81bf1009d73d5f8",
-                "reference": "3600c2cb22399e25bb226e4a135ce91eeb2a6149",
+                "reference": "796a26abb75ce49f3a84433cd81bf1009d73d5f8",
                 "shasum": ""
             },
             "require": {
@@ -10064,7 +10068,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-php83/tree/v1.37.0"
+                "source": "https://github.com/symfony/polyfill-php83/tree/v1.38.2"
             },
             "funding": [
                 {
@@ -10084,20 +10088,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-04-10T17:25:58+00:00"
+            "time": "2026-05-27T06:51:48+00:00"
         },
         {
             "name": "symfony/polyfill-php84",
-            "version": "v1.37.0",
+            "version": "v1.38.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-php84.git",
-                "reference": "88486db2c389b290bf87ff1de7ebc1e13e42bb06"
+                "reference": "f4e1dfaee5b74aba5964fe1fd4dfc7ba5e3085fa"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-php84/zipball/88486db2c389b290bf87ff1de7ebc1e13e42bb06",
+                "url": "https://api.github.com/repos/symfony/polyfill-php84/zipball/f4e1dfaee5b74aba5964fe1fd4dfc7ba5e3085fa",
-                "reference": "88486db2c389b290bf87ff1de7ebc1e13e42bb06",
+                "reference": "f4e1dfaee5b74aba5964fe1fd4dfc7ba5e3085fa",
                 "shasum": ""
             },
             "require": {
@@ -10144,7 +10148,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-php84/tree/v1.37.0"
+                "source": "https://github.com/symfony/polyfill-php84/tree/v1.38.1"
             },
             "funding": [
                 {
@@ -10164,20 +10168,20 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-04-10T18:47:49+00:00"
+            "time": "2026-05-26T12:51:13+00:00"
         },
         {
             "name": "symfony/polyfill-php85",
-            "version": "v1.37.0",
+            "version": "v1.38.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/polyfill-php85.git",
-                "reference": "fcfa4973a9917cef23f2e38774da74a2b7d115ee"
+                "reference": "ba2ba04f3352cfa2dcbbcb90aee13ed967f505b1"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/polyfill-php85/zipball/fcfa4973a9917cef23f2e38774da74a2b7d115ee",
+                "url": "https://api.github.com/repos/symfony/polyfill-php85/zipball/ba2ba04f3352cfa2dcbbcb90aee13ed967f505b1",
-                "reference": "fcfa4973a9917cef23f2e38774da74a2b7d115ee",
+                "reference": "ba2ba04f3352cfa2dcbbcb90aee13ed967f505b1",
                 "shasum": ""
             },
             "require": {
@@ -10224,7 +10228,7 @@
                 "shim"
             ],
             "support": {
-                "source": "https://github.com/symfony/polyfill-php85/tree/v1.37.0"
+                "source": "https://github.com/symfony/polyfill-php85/tree/v1.38.1"
             },
             "funding": [
                 {
@@ -10244,7 +10248,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-04-26T13:10:57+00:00"
+            "time": "2026-05-26T02:25:22+00:00"
         },
         {
             "name": "symfony/polyfill-uuid",
@@ -10331,16 +10335,16 @@
         },
         {
             "name": "symfony/process",
-            "version": "v7.4.11",
+            "version": "v7.4.13",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/process.git",
-                "reference": "d9593c9efa40499eb078b81144de42cbc28a31f0"
+                "reference": "f5804be144caceb570f6747519999636b664f24c"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/process/zipball/d9593c9efa40499eb078b81144de42cbc28a31f0",
+                "url": "https://api.github.com/repos/symfony/process/zipball/f5804be144caceb570f6747519999636b664f24c",
-                "reference": "d9593c9efa40499eb078b81144de42cbc28a31f0",
+                "reference": "f5804be144caceb570f6747519999636b664f24c",
                 "shasum": ""
             },
             "require": {
@@ -10372,7 +10376,7 @@
             "description": "Executes commands in sub-processes",
             "homepage": "https://symfony.com",
             "support": {
-                "source": "https://github.com/symfony/process/tree/v7.4.11"
+                "source": "https://github.com/symfony/process/tree/v7.4.13"
             },
             "funding": [
                 {
@@ -10392,7 +10396,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-11T16:55:21+00:00"
+            "time": "2026-05-23T16:05:06+00:00"
         },
         {
             "name": "symfony/property-access",
@@ -10650,16 +10654,16 @@
         },
         {
             "name": "symfony/routing",
-            "version": "v7.4.12",
+            "version": "v7.4.13",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/routing.git",
-                "reference": "3b04a5ec4887a8135a12ebf0f4cbc5b8fc8ee204"
+                "reference": "3a162171bb008e5e0f15dce6581373a4c0e8390d"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/routing/zipball/3b04a5ec4887a8135a12ebf0f4cbc5b8fc8ee204",
+                "url": "https://api.github.com/repos/symfony/routing/zipball/3a162171bb008e5e0f15dce6581373a4c0e8390d",
-                "reference": "3b04a5ec4887a8135a12ebf0f4cbc5b8fc8ee204",
+                "reference": "3a162171bb008e5e0f15dce6581373a4c0e8390d",
                 "shasum": ""
             },
             "require": {
@@ -10711,7 +10715,7 @@
                 "url"
             ],
             "support": {
-                "source": "https://github.com/symfony/routing/tree/v7.4.12"
+                "source": "https://github.com/symfony/routing/tree/v7.4.13"
             },
             "funding": [
                 {
@@ -10731,7 +10735,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-20T07:20:23+00:00"
+            "time": "2026-05-24T11:20:33+00:00"
         },
         {
             "name": "symfony/serializer",
@@ -10986,16 +10990,16 @@
         },
         {
             "name": "symfony/string",
-            "version": "v8.0.11",
+            "version": "v8.0.13",
             "source": {
                 "type": "git",
                 "url": "https://github.com/symfony/string.git",
-                "reference": "39be2ad058a3c0bd558edca23e65f009865d75ff"
+                "reference": "f2e3e4d33579350d1b12001ef2872f86b27ed3dc"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/symfony/string/zipball/39be2ad058a3c0bd558edca23e65f009865d75ff",
+                "url": "https://api.github.com/repos/symfony/string/zipball/f2e3e4d33579350d1b12001ef2872f86b27ed3dc",
-                "reference": "39be2ad058a3c0bd558edca23e65f009865d75ff",
+                "reference": "f2e3e4d33579350d1b12001ef2872f86b27ed3dc",
                 "shasum": ""
             },
             "require": {
@@ -11052,7 +11056,7 @@
                 "utf8"
             ],
             "support": {
-                "source": "https://github.com/symfony/string/tree/v8.0.11"
+                "source": "https://github.com/symfony/string/tree/v8.0.13"
             },
             "funding": [
                 {
@@ -11072,7 +11076,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-05-13T12:07:53+00:00"
+            "time": "2026-05-23T18:05:53+00:00"
         },
         {
             "name": "symfony/translation",
@@ -12014,16 +12018,16 @@
         },
         {
             "name": "webmozart/assert",
-            "version": "2.4.0",
+            "version": "2.4.1",
             "source": {
                 "type": "git",
                 "url": "https://github.com/webmozarts/assert.git",
-                "reference": "9007ea6f45ecf352a9422b36644e4bfc039b9155"
+                "reference": "2ccb7c2e821038c03a3e6e1700c570c158c55f70"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/webmozarts/assert/zipball/9007ea6f45ecf352a9422b36644e4bfc039b9155",
+                "url": "https://api.github.com/repos/webmozarts/assert/zipball/2ccb7c2e821038c03a3e6e1700c570c158c55f70",
-                "reference": "9007ea6f45ecf352a9422b36644e4bfc039b9155",
+                "reference": "2ccb7c2e821038c03a3e6e1700c570c158c55f70",
                 "shasum": ""
             },
             "require": {
@@ -12074,9 +12078,9 @@
             ],
             "support": {
                 "issues": "https://github.com/webmozarts/assert/issues",
-                "source": "https://github.com/webmozarts/assert/tree/2.4.0"
+                "source": "https://github.com/webmozarts/assert/tree/2.4.1"
             },
-            "time": "2026-05-20T13:07:01+00:00"
+            "time": "2026-06-15T15:31:57+00:00"
         },
         {
             "name": "yosymfony/parser-utils",

database/migrations/2026_07_02_112425_add_is_host_file_to_local_file_volumes_table.php

@@ -0,0 +1,36 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        if (Schema::hasColumn('local_file_volumes', 'is_host_file')) {
+            return;
+        }
+
+        Schema::table('local_file_volumes', function (Blueprint $table) {
+            $table->boolean('is_host_file')->default(false)->after('is_directory');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        if (! Schema::hasColumn('local_file_volumes', 'is_host_file')) {
+            return;
+        }
+
+        Schema::table('local_file_volumes', function (Blueprint $table) {
+            $table->dropColumn('is_host_file');
+        });
+    }
+};

database/schema/testing-schema.sql

@@ -433,6 +433,7 @@ CREATE TABLE IF NOT EXISTS "local_file_volumes" (
     "created_at" TEXT,
     "updated_at" TEXT,
     "is_directory" INTEGER DEFAULT false NOT NULL,
+    "is_host_file" INTEGER DEFAULT false NOT NULL,
     "chown" TEXT,
     "chmod" TEXT,
     "is_based_on_git" INTEGER DEFAULT false NOT NULL

database/seeders/DevelopmentRailpackExamplesSeeder.php

@@ -7,6 +7,7 @@
 use App\Models\Application;
 use App\Models\Environment;
 use App\Models\GithubApp;
+use App\Models\GitlabApp;
 use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\Server;
@@ -360,6 +361,36 @@ public static function examples(): array
                 'ports_exposes' => '3000',
                 'git_branch' => 'v4.x',
             ],
+            [
+                'uuid' => 'railpack-github-deploy-key',
+                'name' => 'Railpack GitHub Deploy Key Example',
+                'git_repository' => 'git@github.com:coollabsio/coolify-examples-deploy-key.git',
+                'git_branch' => 'main',
+                'ports_exposes' => '80',
+                'private_key_id' => 1,
+            ],
+            [
+                'uuid' => 'railpack-gitlab-deploy-key',
+                'name' => 'Railpack GitLab Deploy Key Example',
+                'git_repository' => 'git@gitlab.com:coollabsio/php-example.git',
+                'git_branch' => 'main',
+                'ports_exposes' => '80',
+                'source_id' => 1,
+                'source_type' => GitlabApp::class,
+                'private_key_id' => 1,
+            ],
+            [
+                'uuid' => 'railpack-gitlab-public-example',
+                'name' => 'Railpack GitLab Public Example',
+                'git_repository' => 'https://gitlab.com/andrasbacsai/coolify-examples.git',
+                'git_branch' => 'main',
+                'base_directory' => '/astro/static',
+                'publish_directory' => '/dist',
+                'ports_exposes' => '80',
+                'source_id' => 1,
+                'source_type' => GitlabApp::class,
+                'is_static' => true,
+            ],
         ];
     }
 
@@ -420,6 +451,7 @@ private function ensureDevelopmentPrerequisitesExist(): void
         );
 
         $this->ensurePublicGithubSourceExists();
+        $this->ensurePublicGitlabSourceExists();
     }
 
     private function ensurePublicGithubSourceExists(): void
@@ -437,6 +469,21 @@ private function ensurePublicGithubSourceExists(): void
         );
     }
 
+    private function ensurePublicGitlabSourceExists(): void
+    {
+        GitlabApp::query()->firstOrCreate(
+            ['id' => 1],
+            [
+                'uuid' => 'gitlab-public',
+                'name' => 'Public GitLab',
+                'api_url' => 'https://gitlab.com/api/v4',
+                'html_url' => 'https://gitlab.com',
+                'is_public' => true,
+                'team_id' => 0,
+            ],
+        );
+    }
+
     private function isDevelopmentEnvironment(): bool
     {
         return in_array(config('app.env'), ['local', 'development', 'dev'], true);
@@ -479,12 +526,12 @@ private function upsertApplication(Environment $environment, StandaloneDocker $d
             'name' => $example['name'],
             'description' => $example['name'],
             'fqdn' => "http://{$example['uuid']}.127.0.0.1.sslip.io",
-            'repository_project_id' => self::REPOSITORY_PROJECT_ID,
+            'repository_project_id' => $example['repository_project_id'] ?? self::REPOSITORY_PROJECT_ID,
-            'git_repository' => self::GIT_REPOSITORY,
+            'git_repository' => $example['git_repository'] ?? self::GIT_REPOSITORY,
             'git_branch' => $example['git_branch'] ?? self::GIT_BRANCH,
             'build_pack' => 'railpack',
             'ports_exposes' => $example['ports_exposes'],
-            'base_directory' => $example['base_directory'],
+            'base_directory' => $example['base_directory'] ?? '/',
             'publish_directory' => $example['publish_directory'] ?? null,
             'static_image' => 'nginx:alpine',
             'install_command' => $example['install_command'] ?? null,
@@ -493,8 +540,9 @@ private function upsertApplication(Environment $environment, StandaloneDocker $d
             'environment_id' => $environment->id,
             'destination_id' => $destination->id,
             'destination_type' => StandaloneDocker::class,
-            'source_id' => 0,
+            'source_id' => $example['source_id'] ?? 0,
-            'source_type' => GithubApp::class,
+            'source_type' => $example['source_type'] ?? GithubApp::class,
+            'private_key_id' => $example['private_key_id'] ?? null,
         ]);
         $application->save();
 

package.json

@@ -8,11 +8,11 @@
     },
     "devDependencies": {
         "@tailwindcss/postcss": "4.1.18",
-        "laravel-vite-plugin": "2.0.1",
+        "laravel-vite-plugin": "3.1.0",
         "postcss": "8.5.15",
         "tailwind-scrollbar": "4.0.2",
         "tailwindcss": "4.1.18",
-        "vite": "7.3.2"
+        "vite": "8.0.16"
     },
     "dependencies": {
         "@tailwindcss/forms": "0.5.10",

resources/views/components/modal-confirmation.blade.php

@@ -129,9 +129,13 @@
     }
 }"
     @keydown.escape.window="if (modalOpen) { modalOpen = false; resetModal(); }" :class="{ 'z-40': modalOpen }"
-    class="relative w-auto h-auto">
+    @class([
+        'relative h-auto',
+        'w-full' => $buttonFullWidth,
+        'w-full sm:w-auto' => ! $buttonFullWidth,
+    ])>
     @if (isset($trigger))
-        <div @click="modalOpen=true">
+        <div class="w-full" @click="modalOpen=true">
             {{ $trigger }}
         </div>
     @elseif ($customButton)

resources/views/livewire/notifications/email.blade.php

@@ -81,7 +81,11 @@ class="p-4 border dark:border-coolgray-300 border-neutral-200 rounded-lg flex fl
                         </div>
                         <div class="flex flex-col w-full gap-2 xl:flex-row">
                             <x-forms.input canGate="update" :canResource="$settings" id="smtpUsername" label="SMTP Username" />
-                            <x-forms.input canGate="update" :canResource="$settings" id="smtpPassword" type="password" label="SMTP Password" />
+                            @can('update', $settings)
+                                <x-forms.input canGate="update" :canResource="$settings" id="smtpPassword" type="password" label="SMTP Password" />
+                            @else
+                                <x-forms.input disabled label="SMTP Password" value="Hidden (only admins can view)" />
+                            @endcan
                             <x-forms.input canGate="update" :canResource="$settings" id="smtpTimeout" type="number"  helper="Timeout value for sending emails."
                                 label="Timeout" />
                         </div>
@@ -103,8 +107,12 @@ class="p-4 border dark:border-coolgray-300 border-neutral-200 rounded-lg flex fl
                 <div class="flex flex-col">
                     <div class="flex flex-col gap-4">
                         <div class="flex flex-col w-full gap-2 xl:flex-row">
-                            <x-forms.input canGate="update" :canResource="$settings" required type="password" id="resendApiKey" placeholder="API key"
+                            @can('update', $settings)
-                                label="API Key" />
+                                <x-forms.input canGate="update" :canResource="$settings" required type="password" id="resendApiKey" placeholder="API key"
+                                    label="API Key" />
+                            @else
+                                <x-forms.input disabled label="API Key" value="Hidden (only admins can view)" />
+                            @endcan
                         </div>
                     </div>
                 </div>

resources/views/livewire/project/database/backup-edit.blade.php

@@ -1,32 +1,40 @@
 <form wire:submit="submit">
-    <div class="flex gap-2 pb-2">
+    <div class="flex flex-col gap-3 pb-4 sm:flex-row sm:items-center">
         <h2>Scheduled Backup</h2>
-        <x-forms.button type="submit">
+        <div class="flex flex-col gap-2 sm:flex-row sm:flex-wrap">
-            Save
+            <x-forms.button type="submit" class="w-full sm:w-auto">
-        </x-forms.button>
+                Save
-        @if (str($status)->startsWith('running'))
+            </x-forms.button>
-            <x-forms.button wire:click='backupNow'>Backup Now</x-forms.button>
+            @if (str($status)->startsWith('running'))
-        @endif
+                <x-forms.button wire:click='backupNow' class="w-full sm:w-auto">Backup Now</x-forms.button>
-        @if ($backup->database_id !== 0)
+            @endif
-            <x-modal-confirmation title="Confirm Backup Schedule Deletion?" buttonTitle="Delete Backups and Schedule"
+            @if ($backup->database_id !== 0)
-                isErrorButton submitAction="delete" :checkboxes="$checkboxes" :actions="[
+                <div class="w-full sm:w-auto">
-                    'The selected backup schedule will be deleted.',
+                    <x-modal-confirmation title="Confirm Backup Schedule Deletion?" isErrorButton submitAction="delete"
-                    'Scheduled backups for this database will be stopped (if this is the only backup schedule for this database).',
+                        :checkboxes="$checkboxes" :actions="[
-                ]"
+                            'The selected backup schedule will be deleted.',
-                confirmationText="{{ $backup->database->name }}"
+                            'Scheduled backups for this database will be stopped (if this is the only backup schedule for this database).',
-                confirmationLabel="Please confirm the execution of the actions by entering the Database Name of the scheduled backups below"
+                        ]"
-                shortConfirmationLabel="Database Name" />
+                        confirmationText="{{ $backup->database->name }}"
-        @endif
+                        confirmationLabel="Please confirm the execution of the actions by entering the Database Name of the scheduled backups below"
+                        shortConfirmationLabel="Database Name">
+                        <x-slot:trigger>
+                            <x-forms.button isError class="w-full sm:w-auto">Delete Backups and Schedule</x-forms.button>
+                        </x-slot:trigger>
+                    </x-modal-confirmation>
+                </div>
+            @endif
+        </div>
     </div>
-    <div class="w-64 pb-2">
+    <div class="w-full max-w-md pb-2">
         <x-forms.checkbox instantSave label="Backup Enabled" id="backupEnabled" />
-        @if ($s3s->count() > 0)
+        @if ($availableS3Storages->count() > 0)
             <x-forms.checkbox instantSave label="S3 Enabled" id="saveS3" />
         @else
             <x-forms.checkbox instantSave helper="No validated S3 storage available." label="S3 Enabled" id="saveS3"
                 disabled />
         @endif
-        @if ($backup->save_s3)
+        @if ($saveS3)
             <x-forms.checkbox instantSave label="Disable Local Backup" id="disableLocalBackup"
                 helper="When enabled, backup files will be deleted from local storage immediately after uploading to S3. This requires S3 backup to be enabled." />
         @else
@@ -34,16 +42,27 @@
                 helper="When enabled, backup files will be deleted from local storage immediately after uploading to S3. This requires S3 backup to be enabled." />
         @endif
     </div>
-    @if ($backup->save_s3)
+    <div class="w-full max-w-md pb-6">
-        <div class="pb-6">
+        <div class="flex gap-1 items-center mb-1 text-sm font-medium">
-            <x-forms.select id="s3StorageId" label="S3 Storage" required>
+            <span>S3 Storage</span>
-                <option value="default" disabled>Select a S3 storage</option>
+            @if (!$saveS3)
-                @foreach ($s3s as $s3)
+                <span class="text-xs font-normal text-warning">(currently disabled)</span>
+            @endif
+            @if ($saveS3)
+                <x-highlighted text="*" />
+            @endif
+        </div>
+        <x-forms.select id="s3StorageId" wire:model.live="s3StorageId" :required="$saveS3"
+            :disabled="$availableS3Storages->isEmpty()">
+            @if ($availableS3Storages->isEmpty())
+                <option value="">No S3 storage available</option>
+            @else
+                @foreach ($availableS3Storages as $s3)
                     <option value="{{ $s3->id }}">{{ $s3->name }}</option>
                 @endforeach
-            </x-forms.select>
+            @endif
-        </div>
+        </x-forms.select>
-    @endif
+    </div>
     <div class="flex flex-col gap-2">
         <h3>Settings</h3>
         <div class="flex gap-2 flex-col ">
@@ -80,7 +99,7 @@
                 @endif
             @endif
         </div>
-        <div class="flex gap-2">
+        <div class="grid grid-cols-1 gap-2 md:grid-cols-3">
             <x-forms.input label="Frequency" id="frequency" required />
             <x-forms.input label="Timezone" id="timezone" disabled
                 helper="The timezone of the server where the backup is scheduled to run (if not set, the instance timezone will be used)" required />
@@ -98,7 +117,7 @@
         <div class="flex gap-6 flex-col">
             <div>
                 <h4 class="mb-3 font-medium">Local Backup Retention</h4>
-                <div class="flex gap-2">
+                <div class="grid grid-cols-1 gap-2 md:grid-cols-3">
                     <x-forms.input label="Number of backups to keep" id="databaseBackupRetentionAmountLocally"
                         type="number" min="0"
                         helper="Keeps only the specified number of most recent backups on the server. Set to 0 for unlimited backups." required />
@@ -111,10 +130,10 @@
                 </div>
             </div>
 
-            @if ($backup->save_s3)
+            @if ($saveS3)
                 <div>
                     <h4 class="mb-3 font-medium">S3 Storage Retention</h4>
-                    <div class="flex gap-2">
+                    <div class="grid grid-cols-1 gap-2 md:grid-cols-3">
                         <x-forms.input label="Number of backups to keep" id="databaseBackupRetentionAmountS3"
                             type="number" min="0"
                             helper="Keeps only the specified number of most recent backups on S3 storage. Set to 0 for unlimited backups." required />

resources/views/livewire/project/database/backup-executions.blade.php

@@ -1,7 +1,7 @@
 <div wire:init='refreshBackupExecutions'>
     @isset($backup)
-        <div class="flex items-center gap-2">
+        <div class="flex flex-col gap-3 py-4 sm:flex-row sm:flex-wrap sm:items-center">
-            <h3 class="py-4">Executions <span class="text-xs">({{ $executions_count }})</span></h3>
+            <h3 class="py-0">Executions <span class="text-xs">({{ $executions_count }})</span></h3>
             @if ($executions_count > 0)
                 <div class="flex items-center gap-2">
                     <x-forms.button disabled="{{ !$showPrev }}" wire:click="previousPage('{{ $defaultTake }}')">
@@ -21,13 +21,19 @@
                     </x-forms.button>
                 </div>
             @endif
-            <x-forms.button wire:click='cleanupFailed'>Cleanup Failed Backups</x-forms.button>
+            <div class="flex flex-col gap-2 sm:flex-row sm:flex-wrap">
-            <x-modal-confirmation title="Cleanup Deleted Backup Entries?" buttonTitle="Cleanup Deleted" isErrorButton
+                <x-forms.button wire:click='cleanupFailed' class="w-full sm:w-auto">Cleanup Failed Backups</x-forms.button>
-                submitAction="cleanupDeleted()" 
+                <x-modal-confirmation title="Cleanup Deleted Backup Entries?" isErrorButton
-                :actions="['This will permanently delete all backup execution entries that are marked as deleted from local storage.', 'This only removes database entries, not actual backup files.']" 
+                    submitAction="cleanupDeleted()"
-                confirmationText="cleanup deleted backups"
+                    :actions="['This will permanently delete all backup execution entries that are marked as deleted from local storage.', 'This only removes database entries, not actual backup files.']"
-                confirmationLabel="Please confirm by typing 'cleanup deleted backups' below"
+                    confirmationText="cleanup deleted backups"
-                shortConfirmationLabel="Confirmation" />
+                    confirmationLabel="Please confirm by typing 'cleanup deleted backups' below"
+                    shortConfirmationLabel="Confirmation">
+                    <x-slot:trigger>
+                        <x-forms.button isError class="w-full sm:w-auto">Cleanup Deleted</x-forms.button>
+                    </x-slot:trigger>
+                </x-modal-confirmation>
+            </div>
         </div>
         <div @if (!$skip) wire:poll.5000ms="refreshBackupExecutions" @endif
             class="flex flex-col gap-4">
@@ -87,7 +93,7 @@ class="flex flex-col gap-4">
                     <div class="text-gray-600 dark:text-gray-400 text-sm">
                         Location: {{ data_get($execution, 'filename', 'N/A') }}
                     </div>
-                    <div class="flex items-center gap-3 mt-2">
+                    <div class="flex flex-col gap-2 mt-2 sm:flex-row sm:flex-wrap sm:items-center sm:gap-3">
                         <div class="text-gray-600 dark:text-gray-400 text-sm">
                             Backup Availability:
                         </div>
@@ -154,9 +160,9 @@ class="flex flex-col gap-4">
                             <pre class="whitespace-pre-wrap text-sm">{{ data_get($execution, 'message') }}</pre>
                         </div>
                     @endif
-                    <div class="flex gap-2 mt-4">
+                    <div class="grid grid-cols-2 gap-2 mt-4 sm:flex sm:flex-wrap">
                         @if (data_get($execution, 'status') === 'success')
-                            <x-forms.button class="dark:hover:bg-coolgray-400"
+                            <x-forms.button class="w-full dark:hover:bg-coolgray-400 sm:w-auto"
                                 x-on:click="download_file('{{ data_get($execution, 'id') }}')">Download</x-forms.button>
                         @endif
                         @php
@@ -175,11 +181,15 @@ class="flex flex-col gap-4">
                                 $deleteActions[] = 'This backup execution record will be deleted.';
                             }
                         @endphp
-                        <x-modal-confirmation title="Confirm Backup Deletion?" buttonTitle="Delete" isErrorButton
+                        <x-modal-confirmation title="Confirm Backup Deletion?" isErrorButton
                             submitAction="deleteBackup({{ data_get($execution, 'id') }})" :checkboxes="$executionCheckboxes"
                             :actions="$deleteActions" confirmationText="{{ data_get($execution, 'filename') }}"
                             confirmationLabel="Please confirm the execution of the actions by entering the Backup Filename below"
-                            shortConfirmationLabel="Backup Filename" 1 />
+                            shortConfirmationLabel="Backup Filename">
+                            <x-slot:trigger>
+                                <x-forms.button isError class="w-full sm:w-auto">Delete</x-forms.button>
+                            </x-slot:trigger>
+                        </x-modal-confirmation>
                     </div>
                 </div>
             @empty

resources/views/livewire/project/database/backup/execution.blade.php

@@ -6,7 +6,7 @@
     <livewire:project.shared.configuration-checker :resource="$database" />
     <livewire:project.database.heading :database="$database" />
     <div>
-        <livewire:project.database.backup-edit :backup="$backup" :s3s="$s3s" :status="data_get($database, 'status')" />
+        <livewire:project.database.backup-edit :backup="$backup" :available-s3-storages="$s3s" :status="data_get($database, 'status')" />
         <livewire:project.database.backup-executions :backup="$backup" />
     </div>
 </div>

resources/views/livewire/project/database/scheduled-backups.blade.php

@@ -216,7 +216,7 @@ class="px-3 py-1 rounded-md text-xs font-medium tracking-wide shadow-xs bg-gray-
     @if ($type === 'service-database' && $selectedBackup)
         <div class="pt-10">
             <livewire:project.database.backup-edit wire:key="{{ $selectedBackup->id }}" :backup="$selectedBackup"
-                :s3s="$s3s" :status="data_get($database, 'status')" />
+                :available-s3-storages="$s3s" :status="data_get($database, 'status')" />
             <livewire:project.database.backup-executions wire:key="{{ $selectedBackup->uuid }}" :backup="$selectedBackup"
                 :database="$database" />
         </div>

resources/views/livewire/project/service/file-storage.blade.php

@@ -4,6 +4,10 @@
             <div class="w-full p-2 text-sm rounded bg-warning/10 text-warning">
                 File on server exceeds 5 MB and cannot be edited from the UI. Edit it directly on the server.
             </div>
+        @elseif ($fileStorage->is_host_file)
+            <div class="w-full p-2 text-sm rounded bg-warning/10 text-warning">
+                This host file mount is bind-only. Coolify will not create, edit, load, chmod, or delete the source file.
+            </div>
         @elseif ($isReadOnly)
             <div class="w-full p-2 text-sm rounded bg-warning/10 text-warning">
                 @if ($fileStorage->is_directory)
@@ -32,7 +36,14 @@
             @if (!$isReadOnly)
                 @can('update', $resource)
                     <div class="flex gap-2">
-                        @if ($fileStorage->is_directory)
+                        @if ($fileStorage->is_host_file)
+                            <x-modal-confirmation :ignoreWire="false" title="Confirm Host File Mount Removal?"
+                                buttonTitle="Delete" isErrorButton submitAction="delete" :checkboxes="$hostFileDeletionCheckboxes"
+                                :actions="['Only the mount configuration will be removed. The host file will not be deleted.']"
+                                confirmationText="{{ $fs_path }}"
+                                confirmationLabel="Please confirm the execution of the actions by entering the Filepath below"
+                                shortConfirmationLabel="Filepath" />
+                        @elseif ($fileStorage->is_directory)
                             <x-modal-confirmation :ignoreWire="false" title="Confirm Directory Conversion to File?"
                                 buttonTitle="Convert to file" submitAction="convertToFile" :actions="[
                                     'All files in this directory will be permanently deleted and an empty file will be created in its place.',
@@ -68,7 +79,7 @@
                         @endif
                     </div>
                 @endcan
-                @if (!$fileStorage->is_directory)
+                @if (!$fileStorage->is_directory && !$fileStorage->is_host_file)
                     @can('update', $resource)
                         @if (data_get($resource, 'settings.is_preserve_repository_enabled'))
                             <div class="w-full sm:w-96">
@@ -99,7 +110,7 @@
                 @endif
             @else
                 {{-- Read-only view --}}
-                @if (!$fileStorage->is_directory)
+                @if (!$fileStorage->is_directory && !$fileStorage->is_host_file)
                     @can('update', $resource)
                         <div class="flex gap-2">
                             <x-forms.button type="button" wire:click="loadStorageOnServer">Load from

resources/views/livewire/project/service/storage.blade.php

@@ -22,11 +22,13 @@
                             dropdownOpen: false,
                             volumeModalOpen: false,
                             fileModalOpen: false,
+                            hostFileModalOpen: false,
                             directoryModalOpen: false
                         }"
                             @close-storage-modal.window="
                             if ($event.detail === 'volume') volumeModalOpen = false;
                             if ($event.detail === 'file') fileModalOpen = false;
+                            if ($event.detail === 'host-file') hostFileModalOpen = false;
                             if ($event.detail === 'directory') directoryModalOpen = false;
                         ">
                             <div class="relative" @click.outside="dropdownOpen = false">
@@ -62,6 +64,15 @@ class="p-1 mt-1 bg-white border rounded-sm shadow-sm dark:bg-coolgray-200 dark:b
                                                 </svg>
                                                 File Mount
                                             </a>
+                                            <a class="dropdown-item"
+                                                @click="hostFileModalOpen = true; dropdownOpen = false">
+                                                <svg class="size-4" fill="none" stroke="currentColor"
+                                                    viewBox="0 0 24 24">
+                                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2"
+                                                        d="M7 21h10a2 2 0 002-2V9.414a1 1 0 00-.293-.707l-5.414-5.414A1 1 0 0012.586 3H7a2 2 0 00-2 2v14a2 2 0 002 2z" />
+                                                </svg>
+                                                Host File Mount
+                                            </a>
                                             <a class="dropdown-item"
                                                 @click="directoryModalOpen = true; dropdownOpen = false">
                                                 <svg class="size-4" fill="none" stroke="currentColor"
@@ -188,14 +199,28 @@ class="absolute top-0 right-0 flex items-center justify-center w-8 h-8 mt-5 mr-5
                                                 }
                                             })">
                                             <form class="flex flex-col w-full gap-2 rounded-sm"
+                                                x-data="{
+                                                    hostPath: @js($this->fileStorageHostPath()),
+                                                    filePath: @entangle('file_storage_path'),
+                                                    previewPath() {
+                                                        const path = (this.filePath || '').trim();
+
+                                                        return this.hostPath + (path === '' ? '/' : (path.startsWith('/') ? path : `/${path}`));
+                                                    },
+                                                }"
                                                 wire:submit='submitFileStorage'>
                                                 <div class="flex flex-col">
-                                                    <div>Actual file mounted from the host system to the container.</div>
+                                                    <div>This file will be created on the host, then mounted into the container.</div>
                                                 </div>
                                                 <div class="flex flex-col gap-2">
+                                                    <div class="p-2 text-xs rounded-sm bg-neutral-100 dark:bg-coolgray-200">
+                                                        <div class="mb-1 font-medium">Host file path</div>
+                                                        <code class="break-all" x-text="previewPath()">{{ $this->fileStoragePreviewPath() }}</code>
+                                                    </div>
                                                     <x-forms.input canGate="update" :canResource="$resource"
                                                         placeholder="/etc/nginx/nginx.conf" id="file_storage_path"
                                                         label="Destination Path" required
+                                                        x-on:input="filePath = $event.target.value"
                                                         helper="File location inside the container" />
                                                     <x-forms.textarea canGate="update" :canResource="$resource" label="Content"
                                                         id="file_storage_content"></x-forms.textarea>
@@ -209,6 +234,67 @@ class="absolute top-0 right-0 flex items-center justify-center w-8 h-8 mt-5 mr-5
                                 </div>
                             </template>
 
+                            {{-- Host File Modal --}}
+                            <template x-teleport="body">
+                                <div x-show="hostFileModalOpen" @keydown.window.escape="hostFileModalOpen=false"
+                                    class="fixed top-0 left-0 lg:px-0 px-4 z-99 flex items-center justify-center w-screen h-screen">
+                                    <div x-show="hostFileModalOpen" x-transition:enter="ease-out duration-100"
+                                        x-transition:enter-start="opacity-0" x-transition:enter-end="opacity-100"
+                                        x-transition:leave="ease-in duration-100" x-transition:leave-start="opacity-100"
+                                        x-transition:leave-end="opacity-0" @click="hostFileModalOpen=false"
+                                        class="absolute inset-0 w-full h-full bg-black/20 backdrop-blur-xs"></div>
+                                    <div x-show="hostFileModalOpen" x-trap.inert.noscroll="hostFileModalOpen"
+                                        x-transition:enter="ease-out duration-100"
+                                        x-transition:enter-start="opacity-0 -translate-y-2 sm:scale-95"
+                                        x-transition:enter-end="opacity-100 translate-y-0 sm:scale-100"
+                                        x-transition:leave="ease-in duration-100"
+                                        x-transition:leave-start="opacity-100 translate-y-0 sm:scale-100"
+                                        x-transition:leave-end="opacity-0 -translate-y-2 sm:scale-95"
+                                        class="relative w-full py-6 border rounded-sm drop-shadow-sm min-w-full lg:min-w-[36rem] max-w-fit bg-white border-neutral-200 dark:bg-base px-6 dark:border-coolgray-300">
+                                        <div class="flex items-center justify-between pb-3">
+                                            <h3 class="text-2xl font-bold">Add Host File Mount</h3>
+                                            <button @click="hostFileModalOpen=false"
+                                                class="absolute top-0 right-0 flex items-center justify-center w-8 h-8 mt-5 mr-5 rounded-full dark:text-white hover:bg-neutral-100 dark:hover:bg-coolgray-300 outline-0 focus-visible:ring-2 focus-visible:ring-coollabs dark:focus-visible:ring-warning">
+                                                <svg class="w-5 h-5" xmlns="http://www.w3.org/2000/svg" fill="none"
+                                                    viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor">
+                                                    <path stroke-linecap="round" stroke-linejoin="round"
+                                                        d="M6 18L18 6M6 6l12 12" />
+                                                </svg>
+                                            </button>
+                                        </div>
+                                        <div class="relative flex items-center justify-center w-auto"
+                                            x-init="$watch('hostFileModalOpen', value => {
+                                                if (value) {
+                                                    $nextTick(() => {
+                                                        const input = $el.querySelector('input');
+                                                        input?.focus();
+                                                    })
+                                                }
+                                            })">
+                                            <form class="flex flex-col w-full gap-2 rounded-sm"
+                                                wire:submit='submitHostFileStorage'>
+                                                <div class="flex flex-col">
+                                                    <div>Bind an existing host file into the container. Coolify will not create, edit, load, chmod, or delete the source file.</div>
+                                                </div>
+                                                <div class="flex flex-col gap-2">
+                                                    <x-forms.input canGate="update" :canResource="$resource"
+                                                        placeholder="/etc/nginx/nginx.conf"
+                                                        id="host_file_storage_source" label="Host File Path" required
+                                                        helper="Existing file on the host system." />
+                                                    <x-forms.input canGate="update" :canResource="$resource"
+                                                        placeholder="/etc/nginx/nginx.conf"
+                                                        id="host_file_storage_destination" label="Destination Path"
+                                                        required helper="File location inside the container." />
+                                                    <x-forms.button canGate="update" :canResource="$resource" type="submit">
+                                                        Add
+                                                    </x-forms.button>
+                                                </div>
+                                            </form>
+                                        </div>
+                                    </div>
+                                </div>
+                            </template>
+
                             {{-- Directory Modal --}}
                             <template x-teleport="body">
                                 <div x-show="directoryModalOpen" @keydown.window.escape="directoryModalOpen=false"

resources/views/livewire/settings-backup.blade.php

@@ -27,7 +27,7 @@
                             <x-forms.input type="password" label="Password" readonly id="postgres_password" />
                         </div>
                     </div>
-                    <livewire:project.database.backup-edit :backup="$backup" :s3s="$s3s" :status="data_get($database, 'status')" />
+                    <livewire:project.database.backup-edit :backup="$backup" :available-s3-storages="$s3s" :status="data_get($database, 'status')" />
                     <div class="py-4">
                         <livewire:project.database.backup-executions :backup="$backup" />
                     </div>

resources/views/livewire/settings-dropdown.blade.php

@@ -114,7 +114,7 @@ class="relative text-left menu-item">
             <span class="text-left menu-item-label" :class="collapsed && 'lg:hidden'">What's New</span>
             @if ($unreadCount > 0)
                 <span
-                    class="absolute top-0 right-0 bg-error text-white text-[10px] rounded-full min-w-4 h-4 px-1 flex items-center justify-center"
+                    class="absolute right-2 top-1/2 -translate-y-1/2 bg-error text-white text-[10px] rounded-full min-w-4 h-4 px-1 flex items-center justify-center"
                     aria-label="{{ $unreadCount }} unread changelog {{ Str::plural('entry', $unreadCount) }}">
                     {{ $unreadCount > 9 ? '9+' : $unreadCount }}
                 </span>

templates/compose/convex.yaml

@@ -12,14 +12,15 @@ services:
       - data:/convex/data
     environment:
       - SERVICE_URL_BACKEND_3210
+      - SERVICE_URL_SITE_3211
       - INSTANCE_NAME=${INSTANCE_NAME:-self-hosted-convex}
       - INSTANCE_SECRET=${SERVICE_HEX_64_SECRET}
       - CONVEX_RELEASE_VERSION_DEV=${CONVEX_RELEASE_VERSION_DEV:-}
       - ACTIONS_USER_TIMEOUT_SECS=${ACTIONS_USER_TIMEOUT_SECS:-}
       # URL of the Convex API as accessed by the client/frontend.
-      - CONVEX_CLOUD_ORIGIN=${SERVICE_URL_DASHBOARD}
+      - CONVEX_CLOUD_ORIGIN=${SERVICE_URL_BACKEND}
       # URL of Convex HTTP actions as accessed by the client/frontend.
-      - CONVEX_SITE_ORIGIN=${SERVICE_URL_BACKEND}
+      - CONVEX_SITE_ORIGIN=${SERVICE_URL_SITE}
       - DATABASE_URL=${DATABASE_URL:-}
       - DISABLE_BEACON=${DISABLE_BEACON:?false}
       - REDACT_LOGS_TO_CLIENT=${REDACT_LOGS_TO_CLIENT:?false}

templates/compose/gitea-runner.yaml

@@ -6,7 +6,7 @@
 
 services:
   runner:
-    image: 'docker.io/gitea/runner:1.0.7'
+    image: 'docker.io/gitea/runner:1.0.8'
     environment:
       - 'GITEA_INSTANCE_URL=${GITEA_INSTANCE_URL}'
       - 'GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN}'

templates/compose/inngest.yaml

@@ -0,0 +1,64 @@
+# documentation: https://www.inngest.com/docs/self-hosting
+# slogan: Durable workflow engine for background jobs, queues and scheduled tasks.
+# category: automation
+# tags: queue, workflow, jobs, events, background, automation
+# logo: svgs/inngest.png
+# port: 8288
+
+services:
+  inngest:
+    image: 'inngest/inngest:v1.27.0'
+    command: 'inngest start --host 0.0.0.0'
+    environment:
+      - SERVICE_URL_INNGEST_8288
+      - 'INNGEST_EVENT_KEY=${SERVICE_HEX_32_EVENTKEY}'
+      - 'INNGEST_SIGNING_KEY=${SERVICE_HEX_32_SIGNINGKEY}'
+      - 'INNGEST_POSTGRES_URI=postgres://inngest:${SERVICE_PASSWORD_POSTGRES}@postgres:5432/inngest'
+      - 'INNGEST_REDIS_URI=redis://redis:6379'
+    depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
+    healthcheck:
+      test:
+        - CMD
+        - inngest
+        - alpha
+        - doctor
+        - healthcheck
+      interval: 30s
+      timeout: 10s
+      retries: 3
+      start_period: 40s
+    restart: unless-stopped
+  postgres:
+    image: 'postgres:17'
+    environment:
+      - POSTGRES_DB=inngest
+      - POSTGRES_USER=inngest
+      - 'POSTGRES_PASSWORD=${SERVICE_PASSWORD_POSTGRES}'
+    volumes:
+      - 'postgres-data:/var/lib/postgresql/data'
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - 'pg_isready -U inngest -d inngest'
+      interval: 5s
+      timeout: 5s
+      retries: 5
+    restart: unless-stopped
+  redis:
+    image: 'redis:7-alpine'
+    command: 'redis-server --appendonly yes'
+    volumes:
+      - 'redis-data:/data'
+    healthcheck:
+      test:
+        - CMD
+        - redis-cli
+        - ping
+      interval: 5s
+      timeout: 3s
+      retries: 5
+    restart: unless-stopped

templates/service-templates-latest.json

@@ -787,7 +787,7 @@
     "convex": {
         "documentation": "https://github.com/get-convex/convex-backend/blob/main/self-hosted/README.md?utm_source=coolify.io",
         "slogan": "Convex is the open-source reactive database for app developers.",
-        "compose": "c2VydmljZXM6CiAgYmFja2VuZDoKICAgIGltYWdlOiAnZ2hjci5pby9nZXQtY29udmV4L2NvbnZleC1iYWNrZW5kOmE5YTc2MGNhMTAzOTllZDQyZTFiNGJiODdjNzg1MzlhMjM1NDg4YzcnCiAgICB2b2x1bWVzOgogICAgICAtICdkYXRhOi9jb252ZXgvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0JBQ0tFTkRfMzIxMAogICAgICAtICdJTlNUQU5DRV9OQU1FPSR7SU5TVEFOQ0VfTkFNRTotc2VsZi1ob3N0ZWQtY29udmV4fScKICAgICAgLSAnSU5TVEFOQ0VfU0VDUkVUPSR7U0VSVklDRV9IRVhfNjRfU0VDUkVUfScKICAgICAgLSAnQ09OVkVYX1JFTEVBU0VfVkVSU0lPTl9ERVY9JHtDT05WRVhfUkVMRUFTRV9WRVJTSU9OX0RFVjotfScKICAgICAgLSAnQUNUSU9OU19VU0VSX1RJTUVPVVRfU0VDUz0ke0FDVElPTlNfVVNFUl9USU1FT1VUX1NFQ1M6LX0nCiAgICAgIC0gJ0NPTlZFWF9DTE9VRF9PUklHSU49JHtTRVJWSUNFX1VSTF9EQVNIQk9BUkR9JwogICAgICAtICdDT05WRVhfU0lURV9PUklHSU49JHtTRVJWSUNFX1VSTF9CQUNLRU5EfScKICAgICAgLSAnREFUQUJBU0VfVVJMPSR7REFUQUJBU0VfVVJMOi19JwogICAgICAtICdESVNBQkxFX0JFQUNPTj0ke0RJU0FCTEVfQkVBQ09OOj9mYWxzZX0nCiAgICAgIC0gJ1JFREFDVF9MT0dTX1RPX0NMSUVOVD0ke1JFREFDVF9MT0dTX1RPX0NMSUVOVDo/ZmFsc2V9JwogICAgICAtICdET19OT1RfUkVRVUlSRV9TU0w9JHtET19OT1RfUkVRVUlSRV9TU0w6P3RydWV9JwogICAgICAtICdQT1NUR1JFU19VUkw9JHtQT1NUR1JFU19VUkw6LX0nCiAgICAgIC0gJ01ZU1FMX1VSTD0ke01ZU1FMX1VSTDotfScKICAgICAgLSAnUlVTVF9MT0c9JHtSVVNUX0xPRzotaW5mb30nCiAgICAgIC0gJ1JVU1RfQkFDS1RSQUNFPSR7UlVTVF9CQUNLVFJBQ0U6LX0nCiAgICAgIC0gJ0FXU19SRUdJT049JHtBV1NfUkVHSU9OOi19JwogICAgICAtICdBV1NfQUNDRVNTX0tFWV9JRD0ke0FXU19BQ0NFU1NfS0VZX0lEOi19JwogICAgICAtICdBV1NfU0VDUkVUX0FDQ0VTU19LRVk9JHtBV1NfU0VDUkVUX0FDQ0VTU19LRVk6LX0nCiAgICAgIC0gJ0FXU19TRVNTSU9OX1RPS0VOPSR7QVdTX1NFU1NJT05fVE9LRU46LX0nCiAgICAgIC0gJ0FXU19TM19GT1JDRV9QQVRIX1NUWUxFPSR7QVdTX1MzX0ZPUkNFX1BBVEhfU1RZTEU6LX0nCiAgICAgIC0gJ0FXU19TM19ESVNBQkxFX1NTRT0ke0FXU19TM19ESVNBQkxFX1NTRTotfScKICAgICAgLSAnQVdTX1MzX0RJU0FCTEVfQ0hFQ0tTVU1TPSR7QVdTX1MzX0RJU0FCTEVfQ0hFQ0tTVU1TOi19JwogICAgICAtICdTM19TVE9SQUdFX0VYUE9SVFNfQlVDS0VUPSR7UzNfU1RPUkFHRV9FWFBPUlRTX0JVQ0tFVDotfScKICAgICAgLSAnUzNfU1RPUkFHRV9TTkFQU0hPVF9JTVBPUlRTX0JVQ0tFVD0ke1MzX1NUT1JBR0VfU05BUFNIT1RfSU1QT1JUU19CVUNLRVQ6LX0nCiAgICAgIC0gJ1MzX1NUT1JBR0VfTU9EVUxFU19CVUNLRVQ9JHtTM19TVE9SQUdFX01PRFVMRVNfQlVDS0VUOi19JwogICAgICAtICdTM19TVE9SQUdFX0ZJTEVTX0JVQ0tFVD0ke1MzX1NUT1JBR0VfRklMRVNfQlVDS0VUOi19JwogICAgICAtICdTM19TVE9SQUdFX1NFQVJDSF9CVUNLRVQ9JHtTM19TVE9SQUdFX1NFQVJDSF9CVUNLRVQ6LX0nCiAgICAgIC0gJ1MzX0VORFBPSU5UX1VSTD0ke1MzX0VORFBPSU5UX1VSTDotfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAnY3VybCAtZiBodHRwOi8vMTI3LjAuMC4xOjMyMTAvdmVyc2lvbicKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgZGFzaGJvYXJkOgogICAgaW1hZ2U6ICdnaGNyLmlvL2dldC1jb252ZXgvY29udmV4LWRhc2hib2FyZDphOWE3NjBjYTEwMzk5ZWQ0MmUxYjRiYjg3Yzc4NTM5YTIzNTQ4OGM3JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9VUkxfREFTSEJPQVJEXzY3OTEKICAgICAgLSAnTkVYVF9QVUJMSUNfREVQTE9ZTUVOVF9VUkw9JHtTRVJWSUNFX1VSTF9CQUNLRU5EfScKICAgIGRlcGVuZHNfb246CiAgICAgIGJhY2tlbmQ6CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAnY3VybCAtZiBodHRwOi8vMTI3LjAuMC4xOjY3OTEvJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgc3RhcnRfcGVyaW9kOiA1cwo=",
+        "compose": "c2VydmljZXM6CiAgYmFja2VuZDoKICAgIGltYWdlOiAnZ2hjci5pby9nZXQtY29udmV4L2NvbnZleC1iYWNrZW5kOmE5YTc2MGNhMTAzOTllZDQyZTFiNGJiODdjNzg1MzlhMjM1NDg4YzcnCiAgICB2b2x1bWVzOgogICAgICAtICdkYXRhOi9jb252ZXgvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0JBQ0tFTkRfMzIxMAogICAgICAtIFNFUlZJQ0VfVVJMX1NJVEVfMzIxMQogICAgICAtICdJTlNUQU5DRV9OQU1FPSR7SU5TVEFOQ0VfTkFNRTotc2VsZi1ob3N0ZWQtY29udmV4fScKICAgICAgLSAnSU5TVEFOQ0VfU0VDUkVUPSR7U0VSVklDRV9IRVhfNjRfU0VDUkVUfScKICAgICAgLSAnQ09OVkVYX1JFTEVBU0VfVkVSU0lPTl9ERVY9JHtDT05WRVhfUkVMRUFTRV9WRVJTSU9OX0RFVjotfScKICAgICAgLSAnQUNUSU9OU19VU0VSX1RJTUVPVVRfU0VDUz0ke0FDVElPTlNfVVNFUl9USU1FT1VUX1NFQ1M6LX0nCiAgICAgIC0gJ0NPTlZFWF9DTE9VRF9PUklHSU49JHtTRVJWSUNFX1VSTF9CQUNLRU5EfScKICAgICAgLSAnQ09OVkVYX1NJVEVfT1JJR0lOPSR7U0VSVklDRV9VUkxfU0lURX0nCiAgICAgIC0gJ0RBVEFCQVNFX1VSTD0ke0RBVEFCQVNFX1VSTDotfScKICAgICAgLSAnRElTQUJMRV9CRUFDT049JHtESVNBQkxFX0JFQUNPTjo/ZmFsc2V9JwogICAgICAtICdSRURBQ1RfTE9HU19UT19DTElFTlQ9JHtSRURBQ1RfTE9HU19UT19DTElFTlQ6P2ZhbHNlfScKICAgICAgLSAnRE9fTk9UX1JFUVVJUkVfU1NMPSR7RE9fTk9UX1JFUVVJUkVfU1NMOj90cnVlfScKICAgICAgLSAnUE9TVEdSRVNfVVJMPSR7UE9TVEdSRVNfVVJMOi19JwogICAgICAtICdNWVNRTF9VUkw9JHtNWVNRTF9VUkw6LX0nCiAgICAgIC0gJ1JVU1RfTE9HPSR7UlVTVF9MT0c6LWluZm99JwogICAgICAtICdSVVNUX0JBQ0tUUkFDRT0ke1JVU1RfQkFDS1RSQUNFOi19JwogICAgICAtICdBV1NfUkVHSU9OPSR7QVdTX1JFR0lPTjotfScKICAgICAgLSAnQVdTX0FDQ0VTU19LRVlfSUQ9JHtBV1NfQUNDRVNTX0tFWV9JRDotfScKICAgICAgLSAnQVdTX1NFQ1JFVF9BQ0NFU1NfS0VZPSR7QVdTX1NFQ1JFVF9BQ0NFU1NfS0VZOi19JwogICAgICAtICdBV1NfU0VTU0lPTl9UT0tFTj0ke0FXU19TRVNTSU9OX1RPS0VOOi19JwogICAgICAtICdBV1NfUzNfRk9SQ0VfUEFUSF9TVFlMRT0ke0FXU19TM19GT1JDRV9QQVRIX1NUWUxFOi19JwogICAgICAtICdBV1NfUzNfRElTQUJMRV9TU0U9JHtBV1NfUzNfRElTQUJMRV9TU0U6LX0nCiAgICAgIC0gJ0FXU19TM19ESVNBQkxFX0NIRUNLU1VNUz0ke0FXU19TM19ESVNBQkxFX0NIRUNLU1VNUzotfScKICAgICAgLSAnUzNfU1RPUkFHRV9FWFBPUlRTX0JVQ0tFVD0ke1MzX1NUT1JBR0VfRVhQT1JUU19CVUNLRVQ6LX0nCiAgICAgIC0gJ1MzX1NUT1JBR0VfU05BUFNIT1RfSU1QT1JUU19CVUNLRVQ9JHtTM19TVE9SQUdFX1NOQVBTSE9UX0lNUE9SVFNfQlVDS0VUOi19JwogICAgICAtICdTM19TVE9SQUdFX01PRFVMRVNfQlVDS0VUPSR7UzNfU1RPUkFHRV9NT0RVTEVTX0JVQ0tFVDotfScKICAgICAgLSAnUzNfU1RPUkFHRV9GSUxFU19CVUNLRVQ9JHtTM19TVE9SQUdFX0ZJTEVTX0JVQ0tFVDotfScKICAgICAgLSAnUzNfU1RPUkFHRV9TRUFSQ0hfQlVDS0VUPSR7UzNfU1RPUkFHRV9TRUFSQ0hfQlVDS0VUOi19JwogICAgICAtICdTM19FTkRQT0lOVF9VUkw9JHtTM19FTkRQT0lOVF9VUkw6LX0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDogJ2N1cmwgLWYgaHR0cDovLzEyNy4wLjAuMTozMjEwL3ZlcnNpb24nCiAgICAgIGludGVydmFsOiA1cwogICAgICBzdGFydF9wZXJpb2Q6IDEwcwogIGRhc2hib2FyZDoKICAgIGltYWdlOiAnZ2hjci5pby9nZXQtY29udmV4L2NvbnZleC1kYXNoYm9hcmQ6YTlhNzYwY2ExMDM5OWVkNDJlMWI0YmI4N2M3ODUzOWEyMzU0ODhjNycKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0RBU0hCT0FSRF82NzkxCiAgICAgIC0gJ05FWFRfUFVCTElDX0RFUExPWU1FTlRfVVJMPSR7U0VSVklDRV9VUkxfQkFDS0VORH0nCiAgICBkZXBlbmRzX29uOgogICAgICBiYWNrZW5kOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDogJ2N1cmwgLWYgaHR0cDovLzEyNy4wLjAuMTo2NzkxLycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHN0YXJ0X3BlcmlvZDogNXMK",
         "tags": [
             "database",
             "reactive",
@@ -803,7 +803,7 @@
         "category": "backend",
         "logo": "svgs/convex.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-05-09T19:26:30+05:30",
+        "template_last_updated_at": "2026-06-12T10:45:52+02:00",
         "port": "6791"
     },
     "cryptgeon": {
@@ -1769,7 +1769,7 @@
     "gitea-runner": {
         "documentation": "https://github.com/go-gitea/gitea?utm_source=coolify.io",
         "slogan": "Gitea Actions runner for docker",
-        "compose": "c2VydmljZXM6CiAgcnVubmVyOgogICAgaW1hZ2U6ICdkb2NrZXIuaW8vZ2l0ZWEvcnVubmVyOjEuMC43JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0dJVEVBX0lOU1RBTkNFX1VSTD0ke0dJVEVBX0lOU1RBTkNFX1VSTH0nCiAgICAgIC0gJ0dJVEVBX1JVTk5FUl9SRUdJU1RSQVRJT05fVE9LRU49JHtHSVRFQV9SVU5ORVJfUkVHSVNUUkFUSU9OX1RPS0VOfScKICAgICAgLSAnR0lURUFfUlVOTkVSX05BTUU9JHtHSVRFQV9SVU5ORVJfTkFNRTotZ2l0ZWEtcnVubmVyfScKICAgICAgLSAnR0lURUFfUlVOTkVSX0xBQkVMUz0ke0dJVEVBX1JVTk5FUl9MQUJFTFM6LXVidW50dS1sYXRlc3Q6ZG9ja2VyOi8vbm9kZToyMn0nCiAgICAgIC0gJ0dJVEVBX1RPS0VOPSR7R0lURUFfVE9LRU59JwogICAgd29ya2luZ19kaXI6IC9kYXRhCiAgICB2b2x1bWVzOgogICAgICAtICdydW5uZXItZGF0YTovZGF0YScKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2snCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gInBzIGF1eCB8IGdyZXAgJ1tSXXVubmVyJyA+IC9kZXYvbnVsbCB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
+        "compose": "c2VydmljZXM6CiAgcnVubmVyOgogICAgaW1hZ2U6ICdkb2NrZXIuaW8vZ2l0ZWEvcnVubmVyOjEuMC44JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0dJVEVBX0lOU1RBTkNFX1VSTD0ke0dJVEVBX0lOU1RBTkNFX1VSTH0nCiAgICAgIC0gJ0dJVEVBX1JVTk5FUl9SRUdJU1RSQVRJT05fVE9LRU49JHtHSVRFQV9SVU5ORVJfUkVHSVNUUkFUSU9OX1RPS0VOfScKICAgICAgLSAnR0lURUFfUlVOTkVSX05BTUU9JHtHSVRFQV9SVU5ORVJfTkFNRTotZ2l0ZWEtcnVubmVyfScKICAgICAgLSAnR0lURUFfUlVOTkVSX0xBQkVMUz0ke0dJVEVBX1JVTk5FUl9MQUJFTFM6LXVidW50dS1sYXRlc3Q6ZG9ja2VyOi8vbm9kZToyMn0nCiAgICAgIC0gJ0dJVEVBX1RPS0VOPSR7R0lURUFfVE9LRU59JwogICAgd29ya2luZ19kaXI6IC9kYXRhCiAgICB2b2x1bWVzOgogICAgICAtICdydW5uZXItZGF0YTovZGF0YScKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2snCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gInBzIGF1eCB8IGdyZXAgJ1tSXXVubmVyJyA+IC9kZXYvbnVsbCB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
         "tags": [
             "gitea",
             "actions",
@@ -1779,7 +1779,7 @@
         "category": "devtools",
         "logo": "svgs/gitea.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-06-01T07:54:27-05:00"
+        "template_last_updated_at": "2026-06-06T00:11:24+02:00"
     },
     "gitea-with-mariadb": {
         "documentation": "https://docs.gitea.com?utm_source=coolify.io",
@@ -2346,6 +2346,24 @@
         "template_last_updated_at": "2025-12-15T17:56:33+01:00",
         "port": "8080"
     },
+    "inngest": {
+        "documentation": "https://www.inngest.com/docs/self-hosting?utm_source=coolify.io",
+        "slogan": "Durable workflow engine for background jobs, queues and scheduled tasks.",
+        "compose": "c2VydmljZXM6CiAgaW5uZ2VzdDoKICAgIGltYWdlOiAnaW5uZ2VzdC9pbm5nZXN0OnYxLjI3LjAnCiAgICBjb21tYW5kOiAnaW5uZ2VzdCBzdGFydCAtLWhvc3QgMC4wLjAuMCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfVVJMX0lOTkdFU1RfODI4OAogICAgICAtICdJTk5HRVNUX0VWRU5UX0tFWT0ke1NFUlZJQ0VfSEVYXzMyX0VWRU5US0VZfScKICAgICAgLSAnSU5OR0VTVF9TSUdOSU5HX0tFWT0ke1NFUlZJQ0VfSEVYXzMyX1NJR05JTkdLRVl9JwogICAgICAtICdJTk5HRVNUX1BPU1RHUkVTX1VSST1wb3N0Z3JlczovL2lubmdlc3Q6JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfUBwb3N0Z3Jlczo1NDMyL2lubmdlc3QnCiAgICAgIC0gJ0lOTkdFU1RfUkVESVNfVVJJPXJlZGlzOi8vcmVkaXM6NjM3OScKICAgIGRlcGVuZHNfb246CiAgICAgIHBvc3RncmVzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaW5uZ2VzdAogICAgICAgIC0gYWxwaGEKICAgICAgICAtIGRvY3RvcgogICAgICAgIC0gaGVhbHRoY2hlY2sKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMwogICAgICBzdGFydF9wZXJpb2Q6IDQwcwogICAgcmVzdGFydDogdW5sZXNzLXN0b3BwZWQKICBwb3N0Z3JlczoKICAgIGltYWdlOiAncG9zdGdyZXM6MTcnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBQT1NUR1JFU19EQj1pbm5nZXN0CiAgICAgIC0gUE9TVEdSRVNfVVNFUj1pbm5nZXN0CiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICB2b2x1bWVzOgogICAgICAtICdwb3N0Z3Jlcy1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwvZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSBpbm5nZXN0IC1kIGlubmdlc3QnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiA1CiAgICByZXN0YXJ0OiB1bmxlc3Mtc3RvcHBlZAogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LWFscGluZScKICAgIGNvbW1hbmQ6ICdyZWRpcy1zZXJ2ZXIgLS1hcHBlbmRvbmx5IHllcycKICAgIHZvbHVtZXM6CiAgICAgIC0gJ3JlZGlzLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBwaW5nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAzcwogICAgICByZXRyaWVzOiA1CiAgICByZXN0YXJ0OiB1bmxlc3Mtc3RvcHBlZAo=",
+        "tags": [
+            "queue",
+            "workflow",
+            "jobs",
+            "events",
+            "background",
+            "automation"
+        ],
+        "category": "automation",
+        "logo": "svgs/inngest.png",
+        "minversion": "0.0.0",
+        "template_last_updated_at": "2026-07-02T13:25:47+02:00",
+        "port": "8288"
+    },
     "invoice-ninja": {
         "documentation": "https://invoiceninja.github.io/selfhost.html?utm_source=coolify.io",
         "slogan": "The leading open-source invoicing platform",

templates/service-templates.json

@@ -787,7 +787,7 @@
     "convex": {
         "documentation": "https://github.com/get-convex/convex-backend/blob/main/self-hosted/README.md?utm_source=coolify.io",
         "slogan": "Convex is the open-source reactive database for app developers.",
-        "compose": "c2VydmljZXM6CiAgYmFja2VuZDoKICAgIGltYWdlOiAnZ2hjci5pby9nZXQtY29udmV4L2NvbnZleC1iYWNrZW5kOmE5YTc2MGNhMTAzOTllZDQyZTFiNGJiODdjNzg1MzlhMjM1NDg4YzcnCiAgICB2b2x1bWVzOgogICAgICAtICdkYXRhOi9jb252ZXgvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9CQUNLRU5EXzMyMTAKICAgICAgLSAnSU5TVEFOQ0VfTkFNRT0ke0lOU1RBTkNFX05BTUU6LXNlbGYtaG9zdGVkLWNvbnZleH0nCiAgICAgIC0gJ0lOU1RBTkNFX1NFQ1JFVD0ke1NFUlZJQ0VfSEVYXzY0X1NFQ1JFVH0nCiAgICAgIC0gJ0NPTlZFWF9SRUxFQVNFX1ZFUlNJT05fREVWPSR7Q09OVkVYX1JFTEVBU0VfVkVSU0lPTl9ERVY6LX0nCiAgICAgIC0gJ0FDVElPTlNfVVNFUl9USU1FT1VUX1NFQ1M9JHtBQ1RJT05TX1VTRVJfVElNRU9VVF9TRUNTOi19JwogICAgICAtICdDT05WRVhfQ0xPVURfT1JJR0lOPSR7U0VSVklDRV9GUUROX0RBU0hCT0FSRH0nCiAgICAgIC0gJ0NPTlZFWF9TSVRFX09SSUdJTj0ke1NFUlZJQ0VfRlFETl9CQUNLRU5EfScKICAgICAgLSAnREFUQUJBU0VfVVJMPSR7REFUQUJBU0VfVVJMOi19JwogICAgICAtICdESVNBQkxFX0JFQUNPTj0ke0RJU0FCTEVfQkVBQ09OOj9mYWxzZX0nCiAgICAgIC0gJ1JFREFDVF9MT0dTX1RPX0NMSUVOVD0ke1JFREFDVF9MT0dTX1RPX0NMSUVOVDo/ZmFsc2V9JwogICAgICAtICdET19OT1RfUkVRVUlSRV9TU0w9JHtET19OT1RfUkVRVUlSRV9TU0w6P3RydWV9JwogICAgICAtICdQT1NUR1JFU19VUkw9JHtQT1NUR1JFU19VUkw6LX0nCiAgICAgIC0gJ01ZU1FMX1VSTD0ke01ZU1FMX1VSTDotfScKICAgICAgLSAnUlVTVF9MT0c9JHtSVVNUX0xPRzotaW5mb30nCiAgICAgIC0gJ1JVU1RfQkFDS1RSQUNFPSR7UlVTVF9CQUNLVFJBQ0U6LX0nCiAgICAgIC0gJ0FXU19SRUdJT049JHtBV1NfUkVHSU9OOi19JwogICAgICAtICdBV1NfQUNDRVNTX0tFWV9JRD0ke0FXU19BQ0NFU1NfS0VZX0lEOi19JwogICAgICAtICdBV1NfU0VDUkVUX0FDQ0VTU19LRVk9JHtBV1NfU0VDUkVUX0FDQ0VTU19LRVk6LX0nCiAgICAgIC0gJ0FXU19TRVNTSU9OX1RPS0VOPSR7QVdTX1NFU1NJT05fVE9LRU46LX0nCiAgICAgIC0gJ0FXU19TM19GT1JDRV9QQVRIX1NUWUxFPSR7QVdTX1MzX0ZPUkNFX1BBVEhfU1RZTEU6LX0nCiAgICAgIC0gJ0FXU19TM19ESVNBQkxFX1NTRT0ke0FXU19TM19ESVNBQkxFX1NTRTotfScKICAgICAgLSAnQVdTX1MzX0RJU0FCTEVfQ0hFQ0tTVU1TPSR7QVdTX1MzX0RJU0FCTEVfQ0hFQ0tTVU1TOi19JwogICAgICAtICdTM19TVE9SQUdFX0VYUE9SVFNfQlVDS0VUPSR7UzNfU1RPUkFHRV9FWFBPUlRTX0JVQ0tFVDotfScKICAgICAgLSAnUzNfU1RPUkFHRV9TTkFQU0hPVF9JTVBPUlRTX0JVQ0tFVD0ke1MzX1NUT1JBR0VfU05BUFNIT1RfSU1QT1JUU19CVUNLRVQ6LX0nCiAgICAgIC0gJ1MzX1NUT1JBR0VfTU9EVUxFU19CVUNLRVQ9JHtTM19TVE9SQUdFX01PRFVMRVNfQlVDS0VUOi19JwogICAgICAtICdTM19TVE9SQUdFX0ZJTEVTX0JVQ0tFVD0ke1MzX1NUT1JBR0VfRklMRVNfQlVDS0VUOi19JwogICAgICAtICdTM19TVE9SQUdFX1NFQVJDSF9CVUNLRVQ9JHtTM19TVE9SQUdFX1NFQVJDSF9CVUNLRVQ6LX0nCiAgICAgIC0gJ1MzX0VORFBPSU5UX1VSTD0ke1MzX0VORFBPSU5UX1VSTDotfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAnY3VybCAtZiBodHRwOi8vMTI3LjAuMC4xOjMyMTAvdmVyc2lvbicKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgZGFzaGJvYXJkOgogICAgaW1hZ2U6ICdnaGNyLmlvL2dldC1jb252ZXgvY29udmV4LWRhc2hib2FyZDphOWE3NjBjYTEwMzk5ZWQ0MmUxYjRiYjg3Yzc4NTM5YTIzNTQ4OGM3JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gU0VSVklDRV9GUUROX0RBU0hCT0FSRF82NzkxCiAgICAgIC0gJ05FWFRfUFVCTElDX0RFUExPWU1FTlRfVVJMPSR7U0VSVklDRV9GUUROX0JBQ0tFTkR9JwogICAgZGVwZW5kc19vbjoKICAgICAgYmFja2VuZDoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICdjdXJsIC1mIGh0dHA6Ly8xMjcuMC4wLjE6Njc5MS8nCiAgICAgIGludGVydmFsOiA1cwogICAgICBzdGFydF9wZXJpb2Q6IDVzCg==",
+        "compose": "c2VydmljZXM6CiAgYmFja2VuZDoKICAgIGltYWdlOiAnZ2hjci5pby9nZXQtY29udmV4L2NvbnZleC1iYWNrZW5kOmE5YTc2MGNhMTAzOTllZDQyZTFiNGJiODdjNzg1MzlhMjM1NDg4YzcnCiAgICB2b2x1bWVzOgogICAgICAtICdkYXRhOi9jb252ZXgvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9CQUNLRU5EXzMyMTAKICAgICAgLSBTRVJWSUNFX0ZRRE5fU0lURV8zMjExCiAgICAgIC0gJ0lOU1RBTkNFX05BTUU9JHtJTlNUQU5DRV9OQU1FOi1zZWxmLWhvc3RlZC1jb252ZXh9JwogICAgICAtICdJTlNUQU5DRV9TRUNSRVQ9JHtTRVJWSUNFX0hFWF82NF9TRUNSRVR9JwogICAgICAtICdDT05WRVhfUkVMRUFTRV9WRVJTSU9OX0RFVj0ke0NPTlZFWF9SRUxFQVNFX1ZFUlNJT05fREVWOi19JwogICAgICAtICdBQ1RJT05TX1VTRVJfVElNRU9VVF9TRUNTPSR7QUNUSU9OU19VU0VSX1RJTUVPVVRfU0VDUzotfScKICAgICAgLSAnQ09OVkVYX0NMT1VEX09SSUdJTj0ke1NFUlZJQ0VfRlFETl9CQUNLRU5EfScKICAgICAgLSAnQ09OVkVYX1NJVEVfT1JJR0lOPSR7U0VSVklDRV9GUUROX1NJVEV9JwogICAgICAtICdEQVRBQkFTRV9VUkw9JHtEQVRBQkFTRV9VUkw6LX0nCiAgICAgIC0gJ0RJU0FCTEVfQkVBQ09OPSR7RElTQUJMRV9CRUFDT046P2ZhbHNlfScKICAgICAgLSAnUkVEQUNUX0xPR1NfVE9fQ0xJRU5UPSR7UkVEQUNUX0xPR1NfVE9fQ0xJRU5UOj9mYWxzZX0nCiAgICAgIC0gJ0RPX05PVF9SRVFVSVJFX1NTTD0ke0RPX05PVF9SRVFVSVJFX1NTTDo/dHJ1ZX0nCiAgICAgIC0gJ1BPU1RHUkVTX1VSTD0ke1BPU1RHUkVTX1VSTDotfScKICAgICAgLSAnTVlTUUxfVVJMPSR7TVlTUUxfVVJMOi19JwogICAgICAtICdSVVNUX0xPRz0ke1JVU1RfTE9HOi1pbmZvfScKICAgICAgLSAnUlVTVF9CQUNLVFJBQ0U9JHtSVVNUX0JBQ0tUUkFDRTotfScKICAgICAgLSAnQVdTX1JFR0lPTj0ke0FXU19SRUdJT046LX0nCiAgICAgIC0gJ0FXU19BQ0NFU1NfS0VZX0lEPSR7QVdTX0FDQ0VTU19LRVlfSUQ6LX0nCiAgICAgIC0gJ0FXU19TRUNSRVRfQUNDRVNTX0tFWT0ke0FXU19TRUNSRVRfQUNDRVNTX0tFWTotfScKICAgICAgLSAnQVdTX1NFU1NJT05fVE9LRU49JHtBV1NfU0VTU0lPTl9UT0tFTjotfScKICAgICAgLSAnQVdTX1MzX0ZPUkNFX1BBVEhfU1RZTEU9JHtBV1NfUzNfRk9SQ0VfUEFUSF9TVFlMRTotfScKICAgICAgLSAnQVdTX1MzX0RJU0FCTEVfU1NFPSR7QVdTX1MzX0RJU0FCTEVfU1NFOi19JwogICAgICAtICdBV1NfUzNfRElTQUJMRV9DSEVDS1NVTVM9JHtBV1NfUzNfRElTQUJMRV9DSEVDS1NVTVM6LX0nCiAgICAgIC0gJ1MzX1NUT1JBR0VfRVhQT1JUU19CVUNLRVQ9JHtTM19TVE9SQUdFX0VYUE9SVFNfQlVDS0VUOi19JwogICAgICAtICdTM19TVE9SQUdFX1NOQVBTSE9UX0lNUE9SVFNfQlVDS0VUPSR7UzNfU1RPUkFHRV9TTkFQU0hPVF9JTVBPUlRTX0JVQ0tFVDotfScKICAgICAgLSAnUzNfU1RPUkFHRV9NT0RVTEVTX0JVQ0tFVD0ke1MzX1NUT1JBR0VfTU9EVUxFU19CVUNLRVQ6LX0nCiAgICAgIC0gJ1MzX1NUT1JBR0VfRklMRVNfQlVDS0VUPSR7UzNfU1RPUkFHRV9GSUxFU19CVUNLRVQ6LX0nCiAgICAgIC0gJ1MzX1NUT1JBR0VfU0VBUkNIX0JVQ0tFVD0ke1MzX1NUT1JBR0VfU0VBUkNIX0JVQ0tFVDotfScKICAgICAgLSAnUzNfRU5EUE9JTlRfVVJMPSR7UzNfRU5EUE9JTlRfVVJMOi19JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6ICdjdXJsIC1mIGh0dHA6Ly8xMjcuMC4wLjE6MzIxMC92ZXJzaW9uJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICBkYXNoYm9hcmQ6CiAgICBpbWFnZTogJ2doY3IuaW8vZ2V0LWNvbnZleC9jb252ZXgtZGFzaGJvYXJkOmE5YTc2MGNhMTAzOTllZDQyZTFiNGJiODdjNzg1MzlhMjM1NDg4YzcnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fREFTSEJPQVJEXzY3OTEKICAgICAgLSAnTkVYVF9QVUJMSUNfREVQTE9ZTUVOVF9VUkw9JHtTRVJWSUNFX0ZRRE5fQkFDS0VORH0nCiAgICBkZXBlbmRzX29uOgogICAgICBiYWNrZW5kOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDogJ2N1cmwgLWYgaHR0cDovLzEyNy4wLjAuMTo2NzkxLycKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHN0YXJ0X3BlcmlvZDogNXMK",
         "tags": [
             "database",
             "reactive",
@@ -803,7 +803,7 @@
         "category": "backend",
         "logo": "svgs/convex.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-05-09T19:26:30+05:30",
+        "template_last_updated_at": "2026-06-12T10:45:52+02:00",
         "port": "6791"
     },
     "cryptgeon": {
@@ -1769,7 +1769,7 @@
     "gitea-runner": {
         "documentation": "https://github.com/go-gitea/gitea?utm_source=coolify.io",
         "slogan": "Gitea Actions runner for docker",
-        "compose": "c2VydmljZXM6CiAgcnVubmVyOgogICAgaW1hZ2U6ICdkb2NrZXIuaW8vZ2l0ZWEvcnVubmVyOjEuMC43JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0dJVEVBX0lOU1RBTkNFX1VSTD0ke0dJVEVBX0lOU1RBTkNFX1VSTH0nCiAgICAgIC0gJ0dJVEVBX1JVTk5FUl9SRUdJU1RSQVRJT05fVE9LRU49JHtHSVRFQV9SVU5ORVJfUkVHSVNUUkFUSU9OX1RPS0VOfScKICAgICAgLSAnR0lURUFfUlVOTkVSX05BTUU9JHtHSVRFQV9SVU5ORVJfTkFNRTotZ2l0ZWEtcnVubmVyfScKICAgICAgLSAnR0lURUFfUlVOTkVSX0xBQkVMUz0ke0dJVEVBX1JVTk5FUl9MQUJFTFM6LXVidW50dS1sYXRlc3Q6ZG9ja2VyOi8vbm9kZToyMn0nCiAgICAgIC0gJ0dJVEVBX1RPS0VOPSR7R0lURUFfVE9LRU59JwogICAgd29ya2luZ19kaXI6IC9kYXRhCiAgICB2b2x1bWVzOgogICAgICAtICdydW5uZXItZGF0YTovZGF0YScKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2snCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gInBzIGF1eCB8IGdyZXAgJ1tSXXVubmVyJyA+IC9kZXYvbnVsbCB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
+        "compose": "c2VydmljZXM6CiAgcnVubmVyOgogICAgaW1hZ2U6ICdkb2NrZXIuaW8vZ2l0ZWEvcnVubmVyOjEuMC44JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ0dJVEVBX0lOU1RBTkNFX1VSTD0ke0dJVEVBX0lOU1RBTkNFX1VSTH0nCiAgICAgIC0gJ0dJVEVBX1JVTk5FUl9SRUdJU1RSQVRJT05fVE9LRU49JHtHSVRFQV9SVU5ORVJfUkVHSVNUUkFUSU9OX1RPS0VOfScKICAgICAgLSAnR0lURUFfUlVOTkVSX05BTUU9JHtHSVRFQV9SVU5ORVJfTkFNRTotZ2l0ZWEtcnVubmVyfScKICAgICAgLSAnR0lURUFfUlVOTkVSX0xBQkVMUz0ke0dJVEVBX1JVTk5FUl9MQUJFTFM6LXVidW50dS1sYXRlc3Q6ZG9ja2VyOi8vbm9kZToyMn0nCiAgICAgIC0gJ0dJVEVBX1RPS0VOPSR7R0lURUFfVE9LRU59JwogICAgd29ya2luZ19kaXI6IC9kYXRhCiAgICB2b2x1bWVzOgogICAgICAtICdydW5uZXItZGF0YTovZGF0YScKICAgICAgLSAnL3Zhci9ydW4vZG9ja2VyLnNvY2s6L3Zhci9ydW4vZG9ja2VyLnNvY2snCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gInBzIGF1eCB8IGdyZXAgJ1tSXXVubmVyJyA+IC9kZXYvbnVsbCB8fCBleGl0IDEiCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
         "tags": [
             "gitea",
             "actions",
@@ -1779,7 +1779,7 @@
         "category": "devtools",
         "logo": "svgs/gitea.svg",
         "minversion": "0.0.0",
-        "template_last_updated_at": "2026-06-01T07:54:27-05:00"
+        "template_last_updated_at": "2026-06-06T00:11:24+02:00"
     },
     "gitea-with-mariadb": {
         "documentation": "https://docs.gitea.com?utm_source=coolify.io",
@@ -2346,6 +2346,24 @@
         "template_last_updated_at": "2025-12-15T17:56:33+01:00",
         "port": "8080"
     },
+    "inngest": {
+        "documentation": "https://www.inngest.com/docs/self-hosting?utm_source=coolify.io",
+        "slogan": "Durable workflow engine for background jobs, queues and scheduled tasks.",
+        "compose": "c2VydmljZXM6CiAgaW5uZ2VzdDoKICAgIGltYWdlOiAnaW5uZ2VzdC9pbm5nZXN0OnYxLjI3LjAnCiAgICBjb21tYW5kOiAnaW5uZ2VzdCBzdGFydCAtLWhvc3QgMC4wLjAuMCcKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9JTk5HRVNUXzgyODgKICAgICAgLSAnSU5OR0VTVF9FVkVOVF9LRVk9JHtTRVJWSUNFX0hFWF8zMl9FVkVOVEtFWX0nCiAgICAgIC0gJ0lOTkdFU1RfU0lHTklOR19LRVk9JHtTRVJWSUNFX0hFWF8zMl9TSUdOSU5HS0VZfScKICAgICAgLSAnSU5OR0VTVF9QT1NUR1JFU19VUkk9cG9zdGdyZXM6Ly9pbm5nZXN0OiR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU31AcG9zdGdyZXM6NTQzMi9pbm5nZXN0JwogICAgICAtICdJTk5HRVNUX1JFRElTX1VSST1yZWRpczovL3JlZGlzOjYzNzknCiAgICBkZXBlbmRzX29uOgogICAgICBwb3N0Z3JlczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGlubmdlc3QKICAgICAgICAtIGFscGhhCiAgICAgICAgLSBkb2N0b3IKICAgICAgICAtIGhlYWx0aGNoZWNrCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMKICAgICAgc3RhcnRfcGVyaW9kOiA0MHMKICAgIHJlc3RhcnQ6IHVubGVzcy1zdG9wcGVkCiAgcG9zdGdyZXM6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE3JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gUE9TVEdSRVNfREI9aW5uZ2VzdAogICAgICAtIFBPU1RHUkVTX1VTRVI9aW5uZ2VzdAogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgdm9sdW1lczoKICAgICAgLSAncG9zdGdyZXMtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgaW5uZ2VzdCAtZCBpbm5nZXN0JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogNQogICAgcmVzdGFydDogdW5sZXNzLXN0b3BwZWQKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny1hbHBpbmUnCiAgICBjb21tYW5kOiAncmVkaXMtc2VydmVyIC0tYXBwZW5kb25seSB5ZXMnCiAgICB2b2x1bWVzOgogICAgICAtICdyZWRpcy1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gcGluZwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogM3MKICAgICAgcmV0cmllczogNQogICAgcmVzdGFydDogdW5sZXNzLXN0b3BwZWQK",
+        "tags": [
+            "queue",
+            "workflow",
+            "jobs",
+            "events",
+            "background",
+            "automation"
+        ],
+        "category": "automation",
+        "logo": "svgs/inngest.png",
+        "minversion": "0.0.0",
+        "template_last_updated_at": "2026-07-02T13:25:47+02:00",
+        "port": "8288"
+    },
     "invoice-ninja": {
         "documentation": "https://invoiceninja.github.io/selfhost.html?utm_source=coolify.io",
         "slogan": "The leading open-source invoicing platform",

tests/Feature/Api/EnvironmentVariableUpdateApiTest.php

@@ -15,7 +15,7 @@
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::updateOrCreate(['id' => 0]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0], ['is_api_enabled' => true]));
 
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
@@ -252,3 +252,94 @@
         $response->assertJsonFragment(['uuid' => ['This field is not allowed.']]);
     });
 });
+
+describe('environment variable key validation for app and service APIs', function () {
+    test('rejects invalid service environment variable keys on create update and bulk', function () {
+        $service = Service::factory()->create([
+            'server_id' => $this->server->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+            'environment_id' => $this->environment->id,
+        ]);
+
+        EnvironmentVariable::create([
+            'key' => 'SAFE_KEY',
+            'value' => 'old-value',
+            'resourceable_type' => Service::class,
+            'resourceable_id' => $service->id,
+            'is_preview' => false,
+        ]);
+
+        $headers = [
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ];
+
+        $this->withHeaders($headers)
+            ->postJson("/api/v1/services/{$service->uuid}/envs", [
+                'key' => 'BAD$(id)',
+                'value' => '1',
+            ])
+            ->assertStatus(422);
+
+        $this->withHeaders($headers)
+            ->patchJson("/api/v1/services/{$service->uuid}/envs", [
+                'key' => 'BAD$(id)',
+                'value' => '1',
+            ])
+            ->assertStatus(422);
+
+        $this->withHeaders($headers)
+            ->patchJson("/api/v1/services/{$service->uuid}/envs/bulk", [
+                'data' => [[
+                    'key' => 'BAD$(id)',
+                    'value' => '1',
+                ]],
+            ])
+            ->assertStatus(422);
+    });
+
+    test('rejects invalid application environment variable keys on create update and bulk', function () {
+        $application = Application::factory()->create([
+            'environment_id' => $this->environment->id,
+            'destination_id' => $this->destination->id,
+            'destination_type' => $this->destination->getMorphClass(),
+        ]);
+
+        EnvironmentVariable::create([
+            'key' => 'SAFE_KEY',
+            'value' => 'old-value',
+            'resourceable_type' => Application::class,
+            'resourceable_id' => $application->id,
+            'is_preview' => false,
+        ]);
+
+        $headers = [
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ];
+
+        $this->withHeaders($headers)
+            ->postJson("/api/v1/applications/{$application->uuid}/envs", [
+                'key' => 'BAD$(id)',
+                'value' => '1',
+            ])
+            ->assertStatus(422);
+
+        $this->withHeaders($headers)
+            ->patchJson("/api/v1/applications/{$application->uuid}/envs", [
+                'key' => 'BAD$(id)',
+                'value' => '1',
+            ])
+            ->assertStatus(422);
+
+        $this->withHeaders($headers)
+            ->patchJson("/api/v1/applications/{$application->uuid}/envs/bulk", [
+                'data' => [[
+                    'key' => 'BAD$(id)',
+                    'value' => '1',
+                ]],
+            ])
+            ->assertStatus(422);
+    });
+});

tests/Feature/Authorization/ApplicationConfigAuthorizationTest.php

@@ -18,7 +18,9 @@
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::updateOrCreate(['id' => 0]);
+    $this->withoutVite();
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
 
     $this->team = Team::factory()->create();
 

tests/Feature/Authorization/CanUpdateResourceMiddlewareTest.php

@@ -0,0 +1,89 @@
+<?php
+
+use App\Http\Middleware\CanUpdateResource;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpKernel\Exception\HttpException;
+use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+
+uses(RefreshDatabase::class);
+
+function requestWithCanUpdateResourceRouteParameter(string $parameter, ?string $value): Request
+{
+    $parameters = [
+        'application_uuid' => null,
+        'database_uuid' => null,
+        'stack_service_uuid' => null,
+        'service_uuid' => null,
+        'server_uuid' => null,
+        'environment_uuid' => null,
+        'project_uuid' => null,
+        $parameter => $value,
+    ];
+
+    $request = Mockery::mock(Request::class)->makePartial();
+    $request->shouldReceive('route')->andReturnUsing(fn (string $key): ?string => $parameters[$key] ?? null);
+
+    return $request;
+}
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+});
+
+it('blocks members from update-only project routes before the page renders', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    (new CanUpdateResource)->handle(
+        requestWithCanUpdateResourceRouteParameter('project_uuid', $this->project->uuid),
+        fn () => response('ok')
+    );
+})->throws(HttpException::class, 'You do not have permission to update this resource.');
+
+it('allows admins through update-only project routes', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $response = (new CanUpdateResource)->handle(
+        requestWithCanUpdateResourceRouteParameter('project_uuid', $this->project->uuid),
+        fn () => response('ok')
+    );
+
+    expect($response->getContent())->toBe('ok');
+});
+
+it('blocks members from update-only server routes before the page renders', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    (new CanUpdateResource)->handle(
+        requestWithCanUpdateResourceRouteParameter('server_uuid', $this->server->uuid),
+        fn () => response('ok')
+    );
+})->throws(HttpException::class, 'You do not have permission to update this resource.');
+
+it('returns not found when an update-only route references an unknown resource', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    (new CanUpdateResource)->handle(
+        requestWithCanUpdateResourceRouteParameter('project_uuid', 'not-a-project'),
+        fn () => response('ok')
+    );
+})->throws(NotFoundHttpException::class, 'Resource not found.');

tests/Feature/Authorization/NotificationAuthorizationTest.php

@@ -161,6 +161,33 @@
         ->assertForbidden();
 });
 
+test('member cannot update smtp email transport directly', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(EmailNotification::class)
+        ->set('smtpFromAddress', 'member@example.com')
+        ->set('smtpFromName', 'Member')
+        ->set('smtpHost', 'smtp.example.com')
+        ->set('smtpPort', '587')
+        ->set('smtpEncryption', 'starttls')
+        ->set('smtpPassword', 'member-smtp-password')
+        ->call('submitSmtp')
+        ->assertForbidden();
+});
+
+test('member cannot update resend email transport directly', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(EmailNotification::class)
+        ->set('smtpFromAddress', 'member@example.com')
+        ->set('smtpFromName', 'Member')
+        ->set('resendApiKey', 'member-resend-api-key')
+        ->call('submitResend')
+        ->assertForbidden();
+});
+
 test('member cannot copy instance email settings', function () {
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
@@ -312,6 +339,10 @@
     'generic webhook' => [WebhookNotification::class, 'webhookNotificationSettings', [
         'webhook_url' => 'https://example.com/secret-webhook',
     ]],
+    'email credentials' => [EmailNotification::class, 'emailNotificationSettings', [
+        'smtp_password' => 'smtp-secret-password',
+        'resend_api_key' => 'resend-secret-api-key',
+    ]],
 ]);
 
 test('admin can view notification secrets', function (string $component, string $settingsRelation, array $secrets) {
@@ -346,4 +377,8 @@
     'generic webhook' => [WebhookNotification::class, 'webhookNotificationSettings', [
         'webhook_url' => 'https://example.com/admin-webhook',
     ]],
+    'email credentials' => [EmailNotification::class, 'emailNotificationSettings', [
+        'smtp_password' => 'smtp-admin-password',
+        'resend_api_key' => 'resend-admin-api-key',
+    ]],
 ]);

tests/Feature/Authorization/ResourceCreationAuthorizationTest.php

@@ -0,0 +1,133 @@
+<?php
+
+use App\Http\Middleware\CanCreateResources;
+use App\Livewire\Project\New\DockerCompose;
+use App\Livewire\Project\New\PublicGitRepository;
+use App\Models\Application;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+use Symfony\Component\HttpKernel\Exception\HttpException;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config([
+        'app.maintenance.store' => 'array',
+        'cache.default' => 'array',
+    ]);
+
+    InstanceSettings::query()->forceCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $this->member = User::factory()->create();
+    $this->member->teams()->attach($this->team, ['role' => 'member']);
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first();
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+});
+
+test('member cannot pass create resources middleware', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    $middleware = new CanCreateResources;
+    $request = Request::create('/project/new', 'GET');
+
+    expect(fn () => $middleware->handle($request, fn () => response('ok')))
+        ->toThrow(HttpException::class, 'You do not have permission to create resources.');
+});
+
+test('admin can pass create resources middleware', function () {
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    $middleware = new CanCreateResources;
+    $request = Request::create('/project/new', 'GET');
+    $response = $middleware->handle($request, fn () => response('ok'));
+
+    expect($response->getStatusCode())->toBe(200);
+});
+
+test('member cannot create docker compose service through livewire action', function () {
+    $this->actingAs($this->member);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(DockerCompose::class)
+        ->set('parameters', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+        ])
+        ->set('query', ['destination' => $this->destination->uuid])
+        ->set('dockerComposeRaw', <<<'YAML'
+services:
+  app:
+    image: alpine
+YAML)
+        ->call('submit')
+        ->assertDispatched('error');
+
+    expect(Service::query()->count())->toBe(0);
+});
+
+test('public git docker compose creates an application in local mode', function () {
+    config(['app.env' => 'local']);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+
+    Livewire::test(PublicGitRepository::class)
+        ->set('parameters', [
+            'project_uuid' => $this->project->uuid,
+            'environment_uuid' => $this->environment->uuid,
+        ])
+        ->set('query', ['destination' => $this->destination->uuid])
+        ->set('repository_url', 'https://github.com/coollabsio/coolify')
+        ->set('git_repository', 'https://github.com/coollabsio/coolify')
+        ->set('git_branch', 'main')
+        ->set('build_pack', 'dockercompose')
+        ->set('new_compose_services', true)
+        ->call('submit');
+
+    expect(Application::query()->count())->toBe(1)
+        ->and(Service::query()->count())->toBe(0);
+});

tests/Feature/Authorization/TeamAuthorizationTest.php

@@ -323,5 +323,5 @@
     session(['currentTeam' => $this->team]);
 
     expect(fn () => $this->team->update(['name' => 'Hacked']))
-        ->toThrow(\Exception::class, 'You are not allowed to update this team.');
+        ->toThrow(Exception::class, 'You are not allowed to update this team.');
 });

tests/Feature/Authorization/UploadBackupAuthorizationTest.php

@@ -13,12 +13,19 @@
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\File;
+use Illuminate\Support\Once;
 use Illuminate\Support\Str;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::updateOrCreate(['id' => 0]);
+    $this->withoutVite();
+
+    Once::flush();
+
+    config(['app.maintenance.driver' => 'file']);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
 
     $this->team = Team::factory()->create();
 
@@ -159,7 +166,8 @@
     $this->actingAs($this->member);
     session(['currentTeam' => $this->team]);
 
-    $response = $this->post(route('upload.backup', ['databaseUuid' => $this->database->uuid]));
+    $response = $this->withHeader('Accept', 'application/json')
+        ->post(route('upload.backup', ['databaseUuid' => $this->database->uuid]));
 
     $response->assertForbidden();
 

tests/Feature/BackupEditValidationTest.php

@@ -4,6 +4,7 @@
 use App\Models\Environment;
 use App\Models\InstanceSettings;
 use App\Models\Project;
+use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
@@ -43,6 +44,20 @@ function createBackupForEditValidationTest(Team $team, array $overrides = []): S
     ], $overrides));
 }
 
+function createS3StorageForBackupEditValidationTest(Team|int $team, string $name = 'Backup Edit S3'): S3Storage
+{
+    return S3Storage::create([
+        'name' => $name,
+        'region' => 'us-east-1',
+        'key' => 'test-key',
+        'secret' => 'test-secret',
+        'bucket' => 'test-bucket',
+        'endpoint' => 'https://s3.example.com',
+        'is_usable' => true,
+        'team_id' => $team instanceof Team ? $team->id : $team,
+    ]);
+}
+
 beforeEach(function () {
     if (InstanceSettings::find(0) === null) {
         $settings = new InstanceSettings;
@@ -60,7 +75,7 @@ function createBackupForEditValidationTest(Team $team, array $overrides = []): S
 it('disables S3 backup when saved without a selected S3 storage', function () {
     $backup = createBackupForEditValidationTest($this->team);
 
-    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 's3s' => $this->team->s3s])
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
         ->call('submit')
         ->assertDispatched('success');
 
@@ -74,7 +89,7 @@ function createBackupForEditValidationTest(Team $team, array $overrides = []): S
         'disable_local_backup' => true,
     ]);
 
-    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 's3s' => $this->team->s3s])
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
         ->call('submit')
         ->assertDispatched('success');
 
@@ -83,3 +98,110 @@ function createBackupForEditValidationTest(Team $team, array $overrides = []): S
     expect($backup->s3_storage_id)->toBeNull();
     expect($backup->disable_local_backup)->toBeFalsy();
 });
+
+it('keeps S3 enabled by selecting the only available team storage when none is selected yet', function () {
+    createS3StorageForBackupEditValidationTest(Team::factory()->create());
+    $s3 = createS3StorageForBackupEditValidationTest($this->team);
+    $backup = createBackupForEditValidationTest($this->team, [
+        'save_s3' => false,
+        's3_storage_id' => null,
+    ]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->set('saveS3', true)
+        ->call('instantSave')
+        ->assertDispatched('success');
+
+    $backup->refresh();
+    expect($backup->save_s3)->toBeTruthy();
+    expect($backup->s3_storage_id)->toBe($s3->id);
+});
+
+it('defaults to the first available storage when multiple storages are available', function () {
+    $firstS3 = createS3StorageForBackupEditValidationTest($this->team, 'First S3');
+    createS3StorageForBackupEditValidationTest($this->team, 'Second S3');
+    $backup = createBackupForEditValidationTest($this->team, [
+        'save_s3' => false,
+        's3_storage_id' => null,
+    ]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->assertSet('s3StorageId', $firstS3->id)
+        ->set('saveS3', true)
+        ->call('instantSave')
+        ->assertDispatched('success');
+
+    $backup->refresh();
+    expect($backup->save_s3)->toBeTruthy();
+    expect($backup->s3_storage_id)->toBe($firstS3->id);
+});
+
+it('accepts the S3 storage scope passed to the component', function () {
+    $s3 = createS3StorageForBackupEditValidationTest(0);
+    $backup = createBackupForEditValidationTest($this->team, [
+        'save_s3' => false,
+        's3_storage_id' => null,
+    ]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => collect([$s3])])
+        ->set('saveS3', true)
+        ->set('s3StorageId', $s3->id)
+        ->call('instantSave')
+        ->assertDispatched('success');
+
+    $backup->refresh();
+    expect($backup->save_s3)->toBeTruthy();
+    expect($backup->s3_storage_id)->toBe($s3->id);
+});
+
+it('shows available S3 storages even when S3 backup is disabled', function () {
+    createS3StorageForBackupEditValidationTest($this->team, 'First S3');
+    createS3StorageForBackupEditValidationTest($this->team, 'Second S3');
+    $backup = createBackupForEditValidationTest($this->team, [
+        'save_s3' => false,
+        's3_storage_id' => null,
+    ]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->assertSee('First S3')
+        ->assertSee('Second S3');
+});
+
+it('shows disabled S3 storage dropdown when no storages are available', function () {
+    $backup = createBackupForEditValidationTest($this->team, [
+        'save_s3' => false,
+        's3_storage_id' => null,
+    ]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->assertSee('No S3 storage available');
+});
+
+it('shows when S3 backups are currently disabled', function () {
+    createS3StorageForBackupEditValidationTest($this->team);
+    $backup = createBackupForEditValidationTest($this->team, [
+        'save_s3' => false,
+        's3_storage_id' => null,
+    ]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->assertSee('S3 Storage')
+        ->assertSee('(currently disabled)');
+});
+
+it('saves selected S3 storage immediately when it changes', function () {
+    createS3StorageForBackupEditValidationTest($this->team, 'First S3');
+    $secondS3 = createS3StorageForBackupEditValidationTest($this->team, 'Second S3');
+    $backup = createBackupForEditValidationTest($this->team, [
+        'save_s3' => false,
+        's3_storage_id' => null,
+    ]);
+
+    Livewire::test(BackupEdit::class, ['backup' => $backup->fresh(), 'availableS3Storages' => $this->team->s3s])
+        ->set('s3StorageId', $secondS3->id)
+        ->assertDispatched('success');
+
+    $backup->refresh();
+    expect($backup->save_s3)->toBeFalsy();
+    expect($backup->s3_storage_id)->toBe($secondS3->id);
+});

tests/Feature/DatabaseBackupUploadValidationTest.php

@@ -1,6 +1,28 @@
 <?php
 
 use App\Http\Controllers\UploadController;
+use App\Livewire\Project\Database\ImportForm;
+use App\Models\StandalonePostgresql;
+use App\Support\DatabaseBackupFileValidator;
+use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Process;
+
+function writeScanPayload(string $content, bool $gzip = false): string
+{
+    $path = tempnam(sys_get_temp_dir(), 'coolify-scan-payload-');
+    file_put_contents($path, $gzip ? gzencode($content) : $content);
+
+    return $path;
+}
+
+/**
+ * Execute the real shell scanner snippet (as it runs inside the container)
+ * against a local payload file and return true when the restore is blocked.
+ */
+function scannerBlocks(string $script): bool
+{
+    return Process::run(['sh', '-c', $script])->exitCode() === 1;
+}
 
 function invokeHasAllowedExtension(string $name): bool
 {
@@ -10,6 +32,28 @@ function invokeHasAllowedExtension(string $name): bool
     return $method->invoke(null, $name);
 }
 
+function backupValidationImportFormWithResource(string $modelClass): ImportForm
+{
+    $component = new class extends ImportForm
+    {
+        public $resource;
+    };
+
+    $database = Mockery::mock($modelClass);
+    $database->shouldReceive('getMorphClass')->andReturn($modelClass);
+    $component->resource = $database;
+
+    return $component;
+}
+
+function makeTemporaryUpload(string $name, string $content): UploadedFile
+{
+    $path = tempnam(sys_get_temp_dir(), 'coolify-upload-test-');
+    file_put_contents($path, $content);
+
+    return new UploadedFile($path, $name, null, null, true);
+}
+
 test('hasAllowedExtension accepts supported extensions', function (string $name) {
     expect(invokeHasAllowedExtension($name))->toBeTrue();
 })->with([
@@ -46,6 +90,140 @@ function invokeHasAllowedExtension(string $name): bool
     'misleading double ext' => ['shell.php.sql-evil'],
 ]);
 
+test('hasAllowedExtension rejects dangerous double extensions', function (string $name) {
+    expect(invokeHasAllowedExtension($name))->toBeFalse();
+})->with([
+    'php sql' => ['evil.php.sql'],
+    'php gzip' => ['evil.php.gz'],
+    'shell tar' => ['evil.sh.tar'],
+    'php tar gzip' => ['shell.php.tar.gz'],
+    'exe zip' => ['cmd.exe.zip'],
+    'jsp sql' => ['evil.jsp.sql'],
+]);
+
+test('backup validator rejects content that does not match the backup extension', function () {
+    $file = makeTemporaryUpload('payload.sql.gz', 'not actually gzip');
+
+    expect(DatabaseBackupFileValidator::isUploadAllowed($file, 10 * 1024 * 1024))->toBeFalse();
+});
+
+test('backup validator accepts valid plain sql and gzip backup content', function () {
+    $plainSql = makeTemporaryUpload('backup.sql', "CREATE TABLE users (id integer);\n");
+    $gzipSql = makeTemporaryUpload('backup.sql.gz', gzencode("CREATE TABLE users (id integer);\n"));
+
+    expect(DatabaseBackupFileValidator::isUploadAllowed($plainSql, 10 * 1024 * 1024))->toBeTrue()
+        ->and(DatabaseBackupFileValidator::isUploadAllowed($gzipSql, 10 * 1024 * 1024))->toBeTrue();
+});
+
+test('postgresql backup safety scanner detects program execution payloads', function (string $payload) {
+    expect(DatabaseBackupFileValidator::containsPostgresqlProgramExecution($payload))->toBeTrue();
+})->with([
+    'copy from program' => ["COPY pwned FROM PROGRAM 'id';"],
+    'copy to program' => ["COPY pwned TO PROGRAM 'cat > /tmp/out';"],
+    'copy with block comment' => ["COPY pwned FROM/**/PROGRAM 'id';"],
+    'psql shell command' => ["\\! id\n"],
+    'psql copy program' => ["\\copy pwned from program 'id'\n"],
+]);
+
+test('postgresql backup safety scanner allows ordinary sql dumps', function () {
+    $dump = <<<'SQL'
+-- PostgreSQL database dump
+CREATE TABLE users (id integer, name text);
+COPY users (id, name) FROM stdin;
+1	Taylor
+\.
+SQL;
+
+    expect(DatabaseBackupFileValidator::containsPostgresqlProgramExecution($dump))->toBeFalse();
+});
+
+test('postgresql restore commands include a safety check before execution', function () {
+    $component = new class extends ImportForm
+    {
+        public function __get($property)
+        {
+            if ($property === 'resource') {
+                return new class
+                {
+                    public function getMorphClass(): string
+                    {
+                        return StandalonePostgresql::class;
+                    }
+                };
+            }
+
+            return parent::__get($property);
+        }
+    };
+    $component->container = 'postgres-test';
+
+    $command = $component->buildRestoreSafetyCheckCommand('/tmp/restore_test');
+
+    expect($command)
+        ->toContain('docker exec postgres-test')
+        ->toContain('COPY ... PROGRAM')
+        ->toContain('/tmp/restore_test')
+        ->toContain('grep -Eiq');
+});
+
+test('non postgresql restore commands do not include a safety check', function () {
+    $component = backupValidationImportFormWithResource('App\Models\StandaloneMysql');
+    $component->container = 'mysql-test';
+
+    expect($component->buildRestoreSafetyCheckCommand('/tmp/restore_test'))->toBeNull();
+});
+
+test('file scanner detects program execution payloads inside gzipped backups', function () {
+    $gzPayload = writeScanPayload("CREATE TABLE x();\nCOPY x FROM/**/PROGRAM 'id';\n", gzip: true);
+
+    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($gzPayload))->toBeTrue();
+});
+
+test('file scanner allows ordinary gzipped dumps', function () {
+    $gzClean = writeScanPayload("CREATE TABLE x();\nCOPY x FROM stdin;\n1\\.\n", gzip: true);
+
+    expect(DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($gzClean))->toBeFalse();
+});
+
+test('backup validator rejects plaintext .dump containing program execution', function () {
+    $file = makeTemporaryUpload('evil.dump', "COPY x FROM PROGRAM 'id';\n");
+
+    expect(DatabaseBackupFileValidator::isUploadAllowed($file, 10 * 1024 * 1024))->toBeFalse();
+});
+
+test('remote postgresql scanner blocks bypass payloads', function (string $content, bool $gzip) {
+    $component = backupValidationImportFormWithResource(StandalonePostgresql::class);
+    $component->container = 'postgres-test';
+
+    $payload = writeScanPayload($content, $gzip);
+    $script = $component->buildPostgresRestoreScanScript($payload);
+
+    expect(scannerBlocks($script))->toBeTrue();
+})->with([
+    'psql shell escape' => ["\\! id\n", false],
+    'copy from program' => ["COPY x FROM PROGRAM 'id';\n", false],
+    'copy with block comment' => ["COPY x FROM/**/PROGRAM 'id';\n", false],
+    'copy split across lines' => ["COPY x FROM\nPROGRAM 'id';\n", false],
+    'copy to program' => ["COPY x TO PROGRAM 'cat > /tmp/x';\n", false],
+    'psql pipe redirect' => ["\\o | id\n", false],
+    'gzipped comment bypass' => ["COPY x FROM/**/PROGRAM 'id';\n", true],
+]);
+
+test('remote postgresql scanner allows legitimate restores', function (string $content, bool $gzip) {
+    $component = backupValidationImportFormWithResource(StandalonePostgresql::class);
+    $component->container = 'postgres-test';
+
+    $payload = writeScanPayload($content, $gzip);
+    $script = $component->buildPostgresRestoreScanScript($payload);
+
+    expect(scannerBlocks($script))->toBeFalse();
+})->with([
+    'commented out payload' => ["-- COPY x FROM PROGRAM 'id'\nSELECT 1;\n", false],
+    'copy from stdin' => ["COPY users FROM stdin;\n1\tTaylor\n\\.\n", false],
+    'plain select' => ["SELECT * FROM users;\n", false],
+    'gzipped clean dump' => ["CREATE TABLE users (id int);\n", true],
+]);
+
 test('MAX_BYTES constant is 10 GiB', function () {
     $constant = (new ReflectionClass(UploadController::class))->getConstant('MAX_BYTES');
     expect($constant)->toBe(10 * 1024 * 1024 * 1024);

tests/Feature/DatabaseEnvironmentVariableApiTest.php

@@ -14,7 +14,7 @@
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::updateOrCreate(['id' => 0]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0], ['is_api_enabled' => true]));
 
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
@@ -344,3 +344,44 @@ function createDatabase($context): StandalonePostgresql
         $response->assertStatus(404);
     });
 });
+
+describe('environment variable key validation for database APIs', function () {
+    test('rejects invalid database environment variable keys on create update and bulk', function () {
+        $database = createDatabase($this);
+
+        EnvironmentVariable::create([
+            'key' => 'SAFE_KEY',
+            'value' => 'old-value',
+            'resourceable_type' => StandalonePostgresql::class,
+            'resourceable_id' => $database->id,
+        ]);
+
+        $headers = [
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ];
+
+        $this->withHeaders($headers)
+            ->postJson("/api/v1/databases/{$database->uuid}/envs", [
+                'key' => 'BAD$(id)',
+                'value' => '1',
+            ])
+            ->assertStatus(422);
+
+        $this->withHeaders($headers)
+            ->patchJson("/api/v1/databases/{$database->uuid}/envs", [
+                'key' => 'BAD$(id)',
+                'value' => '1',
+            ])
+            ->assertStatus(422);
+
+        $this->withHeaders($headers)
+            ->patchJson("/api/v1/databases/{$database->uuid}/envs/bulk", [
+                'data' => [[
+                    'key' => 'BAD$(id)',
+                    'value' => '1',
+                ]],
+            ])
+            ->assertStatus(422);
+    });
+});

tests/Feature/DevelopmentRailpackExamplesSeederTest.php

@@ -2,6 +2,7 @@
 
 use App\Models\Application;
 use App\Models\GithubApp;
+use App\Models\GitlabApp;
 use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\Server;
@@ -42,6 +43,7 @@ function seedRailpackExamplePrerequisites(): void
     expect(Server::query()->find(0))->not->toBeNull();
     expect(StandaloneDocker::query()->find(0))->not->toBeNull();
     expect(GithubApp::query()->find(0))->not->toBeNull();
+    expect(GitlabApp::query()->find(1))->not->toBeNull();
     expect(Project::query()->where('uuid', DevelopmentRailpackExamplesSeeder::PROJECT_UUID)->exists())->toBeTrue();
     expect(Application::query()->count())->toBe(count(DevelopmentRailpackExamplesSeeder::examples()));
 });
@@ -66,9 +68,10 @@ function seedRailpackExamplePrerequisites(): void
 
     expect($applications)->toHaveCount(count(DevelopmentRailpackExamplesSeeder::examples()));
     expect($applications->every(fn (Application $application) => $application->build_pack === 'railpack'))->toBeTrue();
-    expect($applications->every(fn (Application $application) => $application->git_repository === DevelopmentRailpackExamplesSeeder::GIT_REPOSITORY))->toBeTrue();
-
     $examples = collect(DevelopmentRailpackExamplesSeeder::examples())->keyBy('uuid');
+    expect($applications->every(
+        fn (Application $application) => $application->git_repository === ($examples->get($application->uuid)['git_repository'] ?? DevelopmentRailpackExamplesSeeder::GIT_REPOSITORY)
+    ))->toBeTrue();
     expect($applications->every(
         fn (Application $application) => $application->git_branch === ($examples->get($application->uuid)['git_branch'] ?? DevelopmentRailpackExamplesSeeder::GIT_BRANCH)
     ))->toBeTrue();
@@ -79,6 +82,9 @@ function seedRailpackExamplePrerequisites(): void
     $pythonFlask = $applications->firstWhere('uuid', 'railpack-python-flask');
     $goGin = $applications->firstWhere('uuid', 'railpack-go-gin');
     $rust = $applications->firstWhere('uuid', 'railpack-rust');
+    $githubDeployKey = $applications->firstWhere('uuid', 'railpack-github-deploy-key');
+    $gitlabDeployKey = $applications->firstWhere('uuid', 'railpack-gitlab-deploy-key');
+    $gitlabPublic = $applications->firstWhere('uuid', 'railpack-gitlab-public-example');
 
     expect($nestjs)
         ->not->toBeNull()
@@ -113,6 +119,33 @@ function seedRailpackExamplePrerequisites(): void
     expect($rust)
         ->not->toBeNull()
         ->and($rust->ports_exposes)->toBe('8000');
+
+    expect($githubDeployKey)
+        ->not->toBeNull()
+        ->and($githubDeployKey->git_repository)->toBe('git@github.com:coollabsio/coolify-examples-deploy-key.git')
+        ->and($githubDeployKey->git_branch)->toBe('main')
+        ->and($githubDeployKey->build_pack)->toBe('railpack')
+        ->and($githubDeployKey->private_key_id)->toBe(1)
+        ->and($githubDeployKey->source_type)->toBe(GithubApp::class)
+        ->and($githubDeployKey->source_id)->toBe(0);
+
+    expect($gitlabDeployKey)
+        ->not->toBeNull()
+        ->and($gitlabDeployKey->git_repository)->toBe('git@gitlab.com:coollabsio/php-example.git')
+        ->and($gitlabDeployKey->git_branch)->toBe('main')
+        ->and($gitlabDeployKey->build_pack)->toBe('railpack')
+        ->and($gitlabDeployKey->private_key_id)->toBe(1)
+        ->and($gitlabDeployKey->source_type)->toBe(GitlabApp::class)
+        ->and($gitlabDeployKey->source_id)->toBe(1);
+
+    expect($gitlabPublic)
+        ->not->toBeNull()
+        ->and($gitlabPublic->git_repository)->toBe('https://gitlab.com/andrasbacsai/coolify-examples.git')
+        ->and($gitlabPublic->base_directory)->toBe('/astro/static')
+        ->and($gitlabPublic->publish_directory)->toBe('/dist')
+        ->and($gitlabPublic->build_pack)->toBe('railpack')
+        ->and($gitlabPublic->source_type)->toBe(GitlabApp::class)
+        ->and($gitlabPublic->settings->is_static)->toBeTrue();
 });
 
 it('skips the railpack examples outside development mode', function () {

tests/Feature/EnvironmentVariable/MultilineEnvironmentVariableTest.php

@@ -9,8 +9,8 @@
     $buildArgs = generateDockerBuildArgs($variables);
 
     // Docker gets values from the environment, so only keys should be in build args
-    expect($buildArgs->first())->toBe('--build-arg SSH_PRIVATE_KEY');
+    expect($buildArgs->first())->toBe("--build-arg 'SSH_PRIVATE_KEY'");
-    expect($buildArgs->last())->toBe('--build-arg REGULAR_VAR');
+    expect($buildArgs->last())->toBe("--build-arg 'REGULAR_VAR'");
 });
 
 test('generateDockerBuildArgs works with collection of objects', function () {
@@ -22,8 +22,8 @@
     $buildArgs = generateDockerBuildArgs($variables);
     expect($buildArgs)->toHaveCount(2);
     expect($buildArgs->values()->toArray())->toBe([
-        '--build-arg VAR1',
+        "--build-arg 'VAR1'",
-        '--build-arg VAR2',
+        "--build-arg 'VAR2'",
     ]);
 });
 
@@ -38,7 +38,7 @@
     // The collection must be imploded to a string for command interpolation
     // This was the bug: Collection was interpolated as JSON instead of a space-separated string
     $argsString = $buildArgs->implode(' ');
-    expect($argsString)->toBe('--build-arg COOLIFY_URL --build-arg COOLIFY_BRANCH');
+    expect($argsString)->toBe("--build-arg 'COOLIFY_URL' --build-arg 'COOLIFY_BRANCH'");
 
     // Verify it does NOT produce JSON when cast to string
     expect($argsString)->not->toContain('{');
@@ -53,7 +53,7 @@
     $buildArgs = generateDockerBuildArgs($variables);
     $arg = $buildArgs->first();
 
-    expect($arg)->toBe('--build-arg NO_FLAG_VAR');
+    expect($arg)->toBe("--build-arg 'NO_FLAG_VAR'");
 });
 
 test('generateDockerEnvFlags produces correct format', function () {
@@ -81,3 +81,17 @@
     expect($envFlags)->toContain('-e VAR1=');
     expect($envFlags)->toContain('-e VAR2="');
 });
+
+test('generateDockerBuildArgs escapes legacy keys', function () {
+    $variables = [
+        ['key' => 'BAD$(id)', 'value' => '1'],
+        ['key' => "BAD'KEY", 'value' => '1'],
+    ];
+
+    $buildArgs = generateDockerBuildArgs($variables);
+
+    expect($buildArgs->values()->toArray())->toBe([
+        "--build-arg 'BAD$(id)'",
+        "--build-arg 'BAD'\''KEY'",
+    ]);
+});

tests/Feature/FileStorageMountPathTest.php

@@ -0,0 +1,123 @@
+<?php
+
+use App\Jobs\ServerStorageSaveJob;
+use App\Livewire\Project\Service\Storage;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\LocalFileVolume;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config(['app.maintenance.store' => 'array', 'cache.default' => 'array']);
+    Bus::fake();
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->admin = User::factory()->create();
+    $this->admin->teams()->attach($this->team, ['role' => 'admin']);
+
+    $keyId = DB::table('private_keys')->insertGetId([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Key',
+        'private_key' => 'test-key',
+        'team_id' => $this->team->id,
+        'created_at' => now(),
+        'updated_at' => now(),
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $keyId,
+    ]);
+
+    StandaloneDocker::withoutEvents(function () {
+        $this->destination = StandaloneDocker::firstOrCreate(
+            ['server_id' => $this->server->id, 'network' => 'coolify'],
+            ['uuid' => (string) Str::uuid(), 'name' => 'test-docker']
+        );
+    });
+
+    $this->project = Project::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test Project',
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = $this->project->environments()->first()
+        ?? Environment::factory()->create(['project_id' => $this->project->id]);
+
+    $this->application = Application::factory()->create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'Test App',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->actingAs($this->admin);
+    session(['currentTeam' => $this->team]);
+});
+
+test('livewire file storage rejects parent segments and does not create a local file volume', function () {
+    Livewire::test(Storage::class, ['resource' => $this->application])
+        ->set('file_storage_path', '/../../../../../../etc/example.conf')
+        ->set('file_storage_content', 'owned')
+        ->call('submitFileStorage')
+        ->assertDispatched('error');
+
+    expect(LocalFileVolume::query()->count())->toBe(0);
+});
+
+test('file mount modal shows the calculated host file path above the destination input', function () {
+    Livewire::test(Storage::class, ['resource' => $this->application])
+        ->assertSeeText('This file will be created on the host, then mounted into the container.')
+        ->assertSeeText('Host file path')
+        ->assertSeeText($this->application->workdir().'/')
+        ->set('file_storage_path', '/etc/nginx/nginx.conf')
+        ->assertSeeText($this->application->workdir().'/etc/nginx/nginx.conf')
+        ->assertDontSeeText('Actual file mounted from the host system to the container.');
+});
+
+test('livewire file storage stores safe file mounts under the application configuration root', function () {
+    Livewire::test(Storage::class, ['resource' => $this->application])
+        ->set('file_storage_path', '/etc/nginx/nginx.conf')
+        ->set('file_storage_content', 'server {}')
+        ->call('submitFileStorage')
+        ->assertDispatched('success');
+
+    $volume = LocalFileVolume::query()->sole();
+
+    expect($volume->mount_path)->toBe('/etc/nginx/nginx.conf')
+        ->and($volume->fs_path)->toBe(application_configuration_dir().'/'.$this->application->uuid.'/etc/nginx/nginx.conf')
+        ->and($volume->is_directory)->toBeFalse();
+});
+
+test('livewire host file storage stores an existing host file path without managed content', function () {
+    Livewire::test(Storage::class, ['resource' => $this->application])
+        ->set('host_file_storage_source', '/etc/nginx/nginx.conf')
+        ->set('host_file_storage_destination', '/etc/nginx/nginx.conf')
+        ->call('submitHostFileStorage')
+        ->assertDispatched('success');
+
+    $volume = LocalFileVolume::query()->sole();
+
+    expect($volume->fs_path)->toBe('/etc/nginx/nginx.conf')
+        ->and($volume->mount_path)->toBe('/etc/nginx/nginx.conf')
+        ->and($volume->content)->toBeNull()
+        ->and($volume->is_host_file)->toBeTrue()
+        ->and($volume->is_directory)->toBeFalse();
+
+    Bus::assertNotDispatched(ServerStorageSaveJob::class);
+});

tests/Feature/Jobs/CheckTraefikVersionJobTest.php

@@ -1,11 +1,15 @@
 <?php
 
+use App\Jobs\CheckTraefikVersionForServerJob;
 use App\Models\Server;
 use App\Models\Team;
 use App\Notifications\Server\TraefikVersionOutdated;
+use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Artisan;
 use Illuminate\Support\Facades\File;
 use Illuminate\Support\Facades\Notification;
+use Illuminate\Support\Facades\Schema;
 
 uses(RefreshDatabase::class);
 
@@ -14,7 +18,7 @@
 });
 
 it('detects servers table has detected_traefik_version column', function () {
-    expect(\Illuminate\Support\Facades\Schema::hasColumn('servers', 'detected_traefik_version'))->toBeTrue();
+    expect(Schema::hasColumn('servers', 'detected_traefik_version'))->toBeTrue();
 });
 
 it('server model casts detected_traefik_version as string', function () {
@@ -137,7 +141,7 @@
 });
 
 it('traefik version check command exists', function () {
-    $commands = \Illuminate\Support\Facades\Artisan::all();
+    $commands = Artisan::all();
 
     expect($commands)->toHaveKey('traefik:check-version');
 });
@@ -181,16 +185,16 @@
 });
 
 it('server check job exists and has correct structure', function () {
-    expect(class_exists(\App\Jobs\CheckTraefikVersionForServerJob::class))->toBeTrue();
+    expect(class_exists(CheckTraefikVersionForServerJob::class))->toBeTrue();
 
     // Verify CheckTraefikVersionForServerJob has required properties
-    $reflection = new \ReflectionClass(\App\Jobs\CheckTraefikVersionForServerJob::class);
+    $reflection = new ReflectionClass(CheckTraefikVersionForServerJob::class);
     expect($reflection->hasProperty('tries'))->toBeTrue();
     expect($reflection->hasProperty('timeout'))->toBeTrue();
 
     // Verify it implements ShouldQueue
-    $interfaces = class_implements(\App\Jobs\CheckTraefikVersionForServerJob::class);
+    $interfaces = class_implements(CheckTraefikVersionForServerJob::class);
-    expect($interfaces)->toContain(\Illuminate\Contracts\Queue\ShouldQueue::class);
+    expect($interfaces)->toContain(ShouldQueue::class);
 });
 
 it('sends immediate notifications when outdated traefik is detected', function () {

tests/Feature/Jobs/CoolifyTaskRetryTest.php

@@ -42,7 +42,7 @@
 });
 
 test('marks activity as error on permanent failure', function () {
-    $exception = new \RuntimeException('SSH connection failed');
+    $exception = new RuntimeException('SSH connection failed');
 
     $this->job->failed($exception);
 

tests/Feature/Jobs/DatabaseBackupJobTest.php

@@ -262,3 +262,11 @@
 
     expect($s3->scheduledBackups()->count())->toBe(1);
 });
+
+test('database backup job escapes the S3 copy destination argument', function () {
+    $source = file_get_contents(app_path('Jobs/DatabaseBackupJob.php'));
+
+    expect($source)->toContain('$escapedS3Destination = escapeshellarg("temporary/{$bucket}{$this->backup_dir}/");')
+        ->and($source)->toContain('mc cp {$escapedBackupLocation} {$escapedS3Destination}')
+        ->and($source)->not->toContain('mc cp $this->backup_location temporary/$bucket{$this->backup_dir}/');
+});

tests/Feature/Proxy/RestartProxyTest.php

@@ -1,5 +1,6 @@
 <?php
 
+use App\Enums\ProxyTypes;
 use App\Models\InstanceSettings;
 use App\Models\Server;
 use App\Models\Team;
@@ -35,7 +36,7 @@ function makeServerProxyRunning(Server $server): void
         'is_usable' => true,
     ]);
     $server->proxy->status = 'running';
-    $server->proxy->type = \App\Enums\ProxyTypes::TRAEFIK->value;
+    $server->proxy->type = ProxyTypes::TRAEFIK->value;
     $server->save();
     $server->refresh();
 }
@@ -75,7 +76,7 @@ function makeServerProxyRunning(Server $server): void
     [$user, $team, $server] = setupProxyUser('member');
 
     $server->proxy->status = 'exited';
-    $server->proxy->type = \App\Enums\ProxyTypes::TRAEFIK->value;
+    $server->proxy->type = ProxyTypes::TRAEFIK->value;
     $server->save();
     $server->refresh();
 

tests/Feature/Security/IpAllowlistTest.php

@@ -1,5 +1,7 @@
 <?php
 
+use App\Rules\ValidIpOrCidr;
+
 test('IP allowlist with single IPs', function () {
     $testCases = [
         ['ip' => '192.168.1.100', 'allowlist' => ['192.168.1.100'], 'expected' => true],
@@ -200,7 +202,7 @@
 });
 
 test('ValidIpOrCidr validation rule', function () {
-    $rule = new \App\Rules\ValidIpOrCidr;
+    $rule = new ValidIpOrCidr;
 
     // Helper function to test validation
     $validate = function ($value) use ($rule) {
@@ -248,7 +250,7 @@
 });
 
 test('ValidIpOrCidr validation rule error messages', function () {
-    $rule = new \App\Rules\ValidIpOrCidr;
+    $rule = new ValidIpOrCidr;
 
     // Helper function to get error message
     $getError = function ($value) use ($rule) {

tests/Feature/Security/TrustHostsMiddlewareTest.php

@@ -2,9 +2,10 @@
 
 use App\Http\Middleware\TrustHosts;
 use App\Models\InstanceSettings;
+use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Cache;
 
-uses(\Illuminate\Foundation\Testing\RefreshDatabase::class);
+uses(RefreshDatabase::class);
 
 beforeEach(function () {
     // Clear cache before each test to ensure isolation
@@ -84,7 +85,7 @@
 
 it('handles exception during InstanceSettings fetch', function () {
     // Drop the instance_settings table to simulate installation
-    \Schema::dropIfExists('instance_settings');
+    Schema::dropIfExists('instance_settings');
 
     $middleware = new TrustHosts($this->app);
 

tests/Feature/SidebarNavigationPreferencesTest.php

@@ -28,6 +28,7 @@
         ->toContain('wire:click="openWhatsNewModal"')
         ->toContain('class="relative text-left menu-item"')
         ->toContain('class="text-left menu-item-label"')
+        ->toContain('class="absolute right-2 top-1/2 -translate-y-1/2 bg-error')
         ->toContain("What's New</span>")
         ->toContain('M9.813 15.904 9 18.75')
         ->not->toContain('<span>Changelog</span>')

tests/Feature/StorageApiTest.php

@@ -1,5 +1,6 @@
 <?php
 
+use App\Jobs\ServerStorageSaveJob;
 use App\Models\Application;
 use App\Models\Environment;
 use App\Models\InstanceSettings;
@@ -7,6 +8,8 @@
 use App\Models\LocalPersistentVolume;
 use App\Models\Project;
 use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceApplication;
 use App\Models\StandaloneDocker;
 use App\Models\StandalonePostgresql;
 use App\Models\Team;
@@ -18,8 +21,9 @@
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    config(['app.maintenance.store' => 'array', 'cache.default' => 'array']);
     Bus::fake();
-    InstanceSettings::updateOrCreate(['id' => 0]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['id' => 0]));
 
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
@@ -61,6 +65,24 @@ function createTestDatabase($context): StandalonePostgresql
     ]);
 }
 
+function createTestServiceApplication($context): array
+{
+    $service = Service::factory()->create([
+        'environment_id' => $context->environment->id,
+        'destination_id' => $context->destination->id,
+        'destination_type' => $context->destination->getMorphClass(),
+    ]);
+
+    $serviceApplication = ServiceApplication::create([
+        'uuid' => (string) Str::uuid(),
+        'name' => 'test-service-app',
+        'service_id' => $service->id,
+        'image' => 'nginx:alpine',
+    ]);
+
+    return [$service, $serviceApplication];
+}
+
 // ──────────────────────────────────────────────────────────────
 // Application Storage Endpoints
 // ──────────────────────────────────────────────────────────────
@@ -140,6 +162,56 @@ function createTestDatabase($context): StandalonePostgresql
         expect($vol)->not->toBeNull();
         expect($vol->mount_path)->toBe('/app/config.json');
         expect($vol->is_directory)->toBeFalse();
+        expect($vol->fs_path)->toBe(application_configuration_dir().'/'.$app->uuid.'/app/config.json');
+    });
+
+    test('creates bind only host file storage for application', function () {
+        $app = createTestApplication($this);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/applications/{$app->uuid}/storages", [
+            'type' => 'file',
+            'is_host_file' => true,
+            'fs_path' => '/etc/nginx/nginx.conf',
+            'mount_path' => '/etc/nginx/nginx.conf',
+        ]);
+
+        $response->assertStatus(201);
+
+        $vol = LocalFileVolume::where('resource_id', $app->id)
+            ->where('resource_type', get_class($app))
+            ->first();
+
+        expect($vol)->not->toBeNull();
+        expect($vol->fs_path)->toBe('/etc/nginx/nginx.conf');
+        expect($vol->mount_path)->toBe('/etc/nginx/nginx.conf');
+        expect($vol->content)->toBeNull();
+        expect($vol->is_host_file)->toBeTrue();
+        expect($vol->is_directory)->toBeFalse();
+
+        Bus::assertNotDispatched(ServerStorageSaveJob::class);
+    });
+
+    test('rejects file storage paths with parent segments', function () {
+        $app = createTestApplication($this);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/applications/{$app->uuid}/storages", [
+            'type' => 'file',
+            'mount_path' => '/../../../../../../etc/example.conf',
+            'content' => 'owned',
+        ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonPath('message', 'Validation failed.');
+
+        expect(LocalFileVolume::where('resource_id', $app->id)
+            ->where('resource_type', get_class($app))
+            ->exists())->toBeFalse();
     });
 
     test('rejects persistent storage without name', function () {
@@ -331,6 +403,92 @@ function createTestDatabase($context): StandalonePostgresql
         expect($vol)->not->toBeNull();
         expect($vol->mount_path)->toBe('/extra');
     });
+
+    test('creates a file storage for a database under the database configuration root', function () {
+        $db = createTestDatabase($this);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/databases/{$db->uuid}/storages", [
+            'type' => 'file',
+            'mount_path' => '/postgres/postgresql.conf',
+            'content' => 'listen_addresses = "*"',
+        ]);
+
+        $response->assertStatus(201);
+
+        $vol = LocalFileVolume::where('resource_id', $db->id)
+            ->where('resource_type', get_class($db))
+            ->first();
+
+        expect($vol)->not->toBeNull();
+        expect($vol->fs_path)->toBe(database_configuration_dir().'/'.$db->uuid.'/postgres/postgresql.conf');
+    });
+
+    test('rejects file storage paths with parent segments for a database', function () {
+        $db = createTestDatabase($this);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/databases/{$db->uuid}/storages", [
+            'type' => 'file',
+            'mount_path' => '/postgres/../../../etc/shadow',
+            'content' => 'owned',
+        ]);
+
+        $response->assertStatus(422);
+
+        expect(LocalFileVolume::where('resource_id', $db->id)
+            ->where('resource_type', get_class($db))
+            ->exists())->toBeFalse();
+    });
+});
+
+describe('POST /api/v1/services/{uuid}/storages', function () {
+    test('creates a file storage for a service resource under the service configuration root', function () {
+        [$service, $serviceApplication] = createTestServiceApplication($this);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/services/{$service->uuid}/storages", [
+            'type' => 'file',
+            'resource_uuid' => $serviceApplication->uuid,
+            'mount_path' => '/etc/nginx/nginx.conf',
+            'content' => 'server {}',
+        ]);
+
+        $response->assertStatus(201);
+
+        $vol = LocalFileVolume::where('resource_id', $serviceApplication->id)
+            ->where('resource_type', get_class($serviceApplication))
+            ->first();
+
+        expect($vol)->not->toBeNull();
+        expect($vol->fs_path)->toBe(service_configuration_dir().'/'.$service->uuid.'/etc/nginx/nginx.conf');
+    });
+
+    test('rejects file storage paths with parent segments for a service resource', function () {
+        [$service, $serviceApplication] = createTestServiceApplication($this);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/services/{$service->uuid}/storages", [
+            'type' => 'file',
+            'resource_uuid' => $serviceApplication->uuid,
+            'mount_path' => '/../../../../../../root/.ssh/authorized_keys',
+            'content' => 'owned',
+        ]);
+
+        $response->assertStatus(422);
+
+        expect(LocalFileVolume::where('resource_id', $serviceApplication->id)
+            ->where('resource_type', get_class($serviceApplication))
+            ->exists())->toBeFalse();
+    });
 });
 
 describe('PATCH /api/v1/databases/{uuid}/storages', function () {

tests/Feature/Subscription/StripeProcessJobTest.php

@@ -143,7 +143,51 @@
     });
 });
 
-describe('customer.subscription.updated clamps quantity to MAX_SERVER_LIMIT', function () {
+describe('customer.subscription.updated clamps quantity to subscription bounds', function () {
+    test('quantity below MIN is clamped to 2', function () {
+        Queue::fake();
+
+        Subscription::create([
+            'team_id' => $this->team->id,
+            'stripe_subscription_id' => 'sub_existing',
+            'stripe_customer_id' => 'cus_min_clamp_test',
+            'stripe_invoice_paid' => true,
+        ]);
+
+        $event = [
+            'type' => 'customer.subscription.updated',
+            'data' => [
+                'object' => [
+                    'customer' => 'cus_min_clamp_test',
+                    'id' => 'sub_existing',
+                    'status' => 'active',
+                    'metadata' => [
+                        'team_id' => $this->team->id,
+                        'user_id' => $this->user->id,
+                    ],
+                    'items' => [
+                        'data' => [[
+                            'subscription' => 'sub_existing',
+                            'plan' => ['id' => 'price_dynamic_monthly'],
+                            'price' => ['lookup_key' => 'dynamic_monthly'],
+                            'quantity' => 1,
+                        ]],
+                    ],
+                    'cancel_at_period_end' => false,
+                    'cancellation_details' => ['feedback' => null, 'comment' => null],
+                ],
+            ],
+        ];
+
+        $job = new StripeProcessJob($event);
+        $job->handle();
+
+        $this->team->refresh();
+        expect($this->team->custom_server_limit)->toBe(2);
+
+        Queue::assertPushed(ServerLimitCheckJob::class);
+    });
+
     test('quantity exceeding MAX is clamped to 100', function () {
         Queue::fake();
 

tests/Feature/Webhook/WebhookHmacTest.php

@@ -2,6 +2,7 @@
 
 use App\Models\Application;
 use App\Models\Environment;
+use App\Models\GithubApp;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\Team;
@@ -100,6 +101,38 @@ function createApplicationWithWebhook(string $repo = 'test-org/test-repo', strin
     });
 });
 
+describe('GitHub App Webhook HMAC', function () {
+    test('rejects push when app webhook secret is empty', function () {
+        $team = Team::factory()->create();
+        GithubApp::create([
+            'uuid' => (string) str()->uuid(),
+            'name' => 'github-app-webhook-test',
+            'api_url' => 'https://api.github.com',
+            'html_url' => 'https://github.com',
+            'app_id' => 1234567890,
+            'webhook_secret' => null,
+            'team_id' => $team->id,
+        ]);
+
+        $payload = json_encode([
+            'ref' => 'refs/heads/main',
+            'repository' => ['id' => 987654321],
+            'after' => 'abc123',
+            'commits' => [],
+        ]);
+
+        $response = $this->call('POST', '/webhooks/source/github/events', [], [], [], [
+            'HTTP_X-GitHub-Event' => 'push',
+            'HTTP_X-GitHub-Hook-Installation-Target-Id' => '1234567890',
+            'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $payload, ''),
+            'CONTENT_TYPE' => 'application/json',
+        ], $payload);
+
+        $response->assertOk();
+        expect($response->getContent())->toContain('Invalid signature');
+    });
+});
+
 describe('GitLab Manual Webhook HMAC', function () {
     test('rejects push when secret is empty', function () {
         $app = createApplicationWithWebhook();

tests/Pest.php

@@ -2,6 +2,7 @@
 
 use App\Models\Server;
 use Illuminate\Support\Once;
+use Tests\TestCase;
 
 /*
 |--------------------------------------------------------------------------
@@ -13,7 +14,7 @@
 | need to change it using the "uses()" function to bind a different classes or traits.
 |
 */
-uses(Tests\TestCase::class)->in('Feature', 'v4/Feature', 'v4/Browser');
+uses(TestCase::class)->in('Feature', 'v4/Feature', 'v4/Browser');
 
 /*
 |--------------------------------------------------------------------------

tests/Unit/ApplicationDeploymentRailpackConfigTest.php

@@ -3,6 +3,8 @@
 use App\Exceptions\DeploymentException;
 use App\Jobs\ApplicationDeploymentJob;
 use App\Models\Application;
+use App\Models\ApplicationSetting;
+use App\Models\EnvironmentVariable;
 use Illuminate\Support\Collection;
 use Tests\TestCase;
 
@@ -236,10 +238,15 @@ function invokeRailpackMethod(object $job, ReflectionClass $reflection, string $
         ],
     );
 
+    // Build-time variables are interpolated by sourcing the build-time .env file before
+    // the build, so user/Coolify variables must NOT be forwarded inline as literals.
+    expect($command)->toContain('set -a && source /artifacts/build-time.env && set +a');
     expect($command)->toContain("env 'RAILPACK_NODE_VERSION=22'");
     expect($command)->toContain("'RAILPACK_INSTALL_CMD=npm ci && npm run postinstall'");
     expect($command)->toContain("'RAILPACK_DEPLOY_APT_PACKAGES=curl wget'");
-    expect($command)->toContain("'SECRET_JSON={\"token\":\"abc\"}'");
+    // SECRET_JSON is not a buildpack control variable, so it is provided via the sourced
+    // build-time .env file (which supports $VAR interpolation) rather than inline `env`.
+    expect($command)->not->toContain("'SECRET_JSON={\"token\":\"abc\"}'");
     expect($command)->toContain("--secret 'id=RAILPACK_NODE_VERSION,env=RAILPACK_NODE_VERSION'");
     expect($command)->toContain("--secret 'id=RAILPACK_INSTALL_CMD,env=RAILPACK_INSTALL_CMD'");
     expect($command)->toContain("--secret 'id=RAILPACK_DEPLOY_APT_PACKAGES,env=RAILPACK_DEPLOY_APT_PACKAGES'");
@@ -247,3 +254,69 @@ function invokeRailpackMethod(object $job, ReflectionClass $reflection, string $
     expect($command)->toContain(' --build-arg secrets-hash=');
     expect($command)->toContain('--build-arg BUILDKIT_SYNTAX="ghcr.io/railwayapp/railpack-frontend:v'.config('constants.coolify.railpack_version').'"');
 });
+
+it('interpolates build-time variable references for railpack by sourcing the build-time env file', function () {
+    [$job, $reflection] = makeRailpackDeploymentJob([
+        'uuid' => 'application-uuid',
+    ]);
+
+    // Mirrors the issue: BETTER_AUTH_URL=$COOLIFY_URL must be interpolated at build time.
+    $command = invokeRailpackMethod(
+        $job,
+        $reflection,
+        'railpack_build_command',
+        [
+            'coollabsio/coolify:test',
+            collect([
+                'BETTER_AUTH_URL' => '$COOLIFY_URL',
+                'COOLIFY_URL' => 'https://sapere-10.bobman.dev',
+            ]),
+        ],
+    );
+
+    // The literal `$COOLIFY_URL` must NOT be forwarded inline; it is resolved by the shell
+    // after sourcing the build-time .env file, then read through the build secret.
+    expect($command)->toContain('set -a && source /artifacts/build-time.env && set +a');
+    expect($command)->not->toContain("'BETTER_AUTH_URL=\$COOLIFY_URL'");
+    expect($command)->not->toContain("env 'BETTER_AUTH_URL");
+    expect($command)->toContain("--secret 'id=BETTER_AUTH_URL,env=BETTER_AUTH_URL'");
+    expect($command)->toContain("--secret 'id=COOLIFY_URL,env=COOLIFY_URL'");
+});
+
+it('creates an empty build-time env file for railpack when there are no generated build-time variables', function () {
+    [$job, $reflection] = makeRailpackDeploymentJob([
+        'build_pack' => 'railpack',
+        'compose_parsing_version' => '3',
+    ]);
+
+    $applicationProperty = $reflection->getProperty('application');
+    $applicationProperty->setAccessible(true);
+    $application = $applicationProperty->getValue($job);
+    $application->setRelation('settings', new ApplicationSetting([
+        'include_source_commit_in_build' => false,
+        'is_env_sorting_enabled' => false,
+    ]));
+    $application->setRelation('environment_variables', collect([
+        new EnvironmentVariable(['key' => 'COOLIFY_FQDN']),
+        new EnvironmentVariable(['key' => 'COOLIFY_URL']),
+        new EnvironmentVariable(['key' => 'COOLIFY_BRANCH']),
+        new EnvironmentVariable(['key' => 'COOLIFY_RESOURCE_UUID']),
+    ]));
+
+    foreach ([
+        'application_deployment_queue' => new class
+        {
+            public function addLogEntry(string $message, string $type = 'info', bool $hidden = false): void {}
+        },
+        'build_pack' => 'railpack',
+        'pull_request_id' => 0,
+    ] as $property => $value) {
+        $reflectionProperty = $reflection->getProperty($property);
+        $reflectionProperty->setAccessible(true);
+        $reflectionProperty->setValue($job, $value);
+    }
+
+    invokeRailpackMethod($job, $reflection, 'save_buildtime_environment_variables');
+
+    expect(collect($job->recordedCommands)->flatten()->implode(' '))->toContain('touch /artifacts/build-time.env');
+});

tests/Unit/DatabaseBackupSecurityTest.php

@@ -182,7 +182,7 @@
     $escaped = escapeshellarg($maliciousPassword);
 
     // Single quotes in the value get escaped as '\''
-    expect($escaped)->toBe("'pass'\\'''; whoami; echo '\\'''");
+    expect($escaped)->toBe("'pass'\\''; whoami; echo '\\'''");
     $command = "docker exec container mariadb-dump -u root -p$escaped db";
     // Verify the command doesn't contain an unescaped semicolon outside quotes
     expect($command)->toContain("-p'pass'");

tests/Unit/DeployKeyDedicatedPathTest.php

@@ -4,11 +4,50 @@
 use App\Models\ApplicationSetting;
 use App\Models\GitlabApp;
 use App\Models\PrivateKey;
+use Illuminate\Support\Collection;
 
 afterEach(function () {
     Mockery::close();
 });
 
+function commandStrings(array|Collection|string $commands): Collection
+{
+    if (is_string($commands)) {
+        return collect([$commands]);
+    }
+
+    return collect($commands)->map(fn ($command) => data_get($command, 'command') ?? $command[0] ?? $command);
+}
+
+function privateKeyMaterializationCommands(array|Collection|string $commands): Collection
+{
+    if (is_string($commands)) {
+        $commands = [$commands];
+    }
+
+    return collect($commands)->filter(fn ($command) => str(commandStrings([$command])->first())->contains('base64 -d | tee /root/.ssh/id_rsa_coolify_'));
+}
+
+function expectCommandListToContain(array|Collection|string $commands, string $expected): void
+{
+    expect(commandStrings($commands)->implode(' && '))->toContain($expected);
+}
+
+function expectCommandListNotToContain(array|Collection|string $commands, string $expected): void
+{
+    expect(commandStrings($commands)->implode(' && '))->not->toContain($expected);
+}
+
+function expectPrivateKeyMaterializationCommandsSkipLogging(array|Collection|string $commands): void
+{
+    $keyCommands = privateKeyMaterializationCommands($commands);
+
+    expect($keyCommands)->not->toBeEmpty();
+    $keyCommands->each(function ($command): void {
+        expect(data_get($command, 'skip_command_log'))->toBeTrue();
+    });
+}
+
 /**
  * Git operations authenticate with the SSH key assigned in the UI. Coolify writes that key to a
  * per-deployment path (/root/.ssh/id_rsa_coolify_<deployment_uuid>) instead of the shared
@@ -19,6 +58,24 @@
  */
 $keyPath = '/root/.ssh/id_rsa_coolify_test-deployment-uuid';
 
+it('skips logging the docker deploy key materialization command before ls-remote', function () {
+    $source = file_get_contents(__DIR__.'/../../app/Jobs/ApplicationDeploymentJob.php');
+    $commandPosition = strpos($source, 'base64 -d | tee {$customSshKeyLocation}');
+
+    expect($commandPosition)->not->toBeFalse()
+        ->and(substr($source, $commandPosition, 200))->toContain("'skip_command_log' => true");
+});
+
+it('supports skipping command log entries without adding a hidden command entry', function () {
+    $source = file_get_contents(__DIR__.'/../../app/Traits/ExecuteRemoteCommand.php');
+
+    expect($source)
+        ->toContain('$skip_command_log = data_get($single_command, \'skip_command_log\', false);')
+        ->toContain('if ($command_hidden && ! $skip_command_log && isset($this->application_deployment_queue))')
+        ->toContain('use ($command, $hidden, $customType, $append, $command_hidden, $skip_command_log)')
+        ->toContain('\'command\' => $skip_command_log || $command_hidden ? null : $this->redact_sensitive_info($command),');
+});
+
 it('writes a deploy key to a per-deployment path and cleans it up for ls-remote on the host', function () use ($keyPath) {
     $privateKey = Mockery::mock(PrivateKey::class)->makePartial();
     $privateKey->shouldReceive('getAttribute')->with('private_key')->andReturn('fake-private-key');
@@ -31,11 +88,11 @@
 
     $result = $application->generateGitLsRemoteCommands('test-deployment-uuid', false);
 
-    expect($result['commands'])
+    expectCommandListToContain($result['commands'], "tee {$keyPath}");
-        ->toContain("tee {$keyPath}")
+    expectCommandListToContain($result['commands'], "-i {$keyPath} -o IdentitiesOnly=yes");
-        ->toContain("-i {$keyPath} -o IdentitiesOnly=yes")
+    expectCommandListToContain($result['commands'], "trap 'rm -f {$keyPath}' EXIT"); // removed when the shell exits
-        ->toContain("trap 'rm -f {$keyPath}' EXIT") // removed when the shell exits
+    expectCommandListNotToContain($result['commands'], 'tee /root/.ssh/id_rsa >'); // never overwrites the host root's own key
-        ->not->toContain('tee /root/.ssh/id_rsa >'); // never overwrites the host root's own key
+    expectPrivateKeyMaterializationCommandsSkipLogging($result['commands']);
 });
 
 it('writes a deploy key to a per-deployment path for ls-remote inside docker without a trap', function () use ($keyPath) {
@@ -50,11 +107,11 @@
 
     $result = $application->generateGitLsRemoteCommands('test-deployment-uuid', true);
 
-    expect($result['commands'])
+    expectCommandListToContain($result['commands'], "tee {$keyPath}");
-        ->toContain("tee {$keyPath}")
+    expectCommandListToContain($result['commands'], "-i {$keyPath} -o IdentitiesOnly=yes");
-        ->toContain("-i {$keyPath} -o IdentitiesOnly=yes")
+    expectCommandListNotToContain($result['commands'], 'trap '); // ephemeral container, no cleanup needed
-        ->not->toContain('trap ') // ephemeral container, no cleanup needed
+    expectCommandListNotToContain($result['commands'], 'tee /root/.ssh/id_rsa >');
-        ->not->toContain('tee /root/.ssh/id_rsa >');
+    expectPrivateKeyMaterializationCommandsSkipLogging($result['commands']);
 });
 
 it('writes a GitLab source private key to a per-deployment path with cleanup on the host', function () use ($keyPath) {
@@ -77,11 +134,11 @@
 
     $result = $application->generateGitLsRemoteCommands('test-deployment-uuid', false);
 
-    expect($result['commands'])
+    expectCommandListToContain($result['commands'], "tee {$keyPath}");
-        ->toContain("tee {$keyPath}")
+    expectCommandListToContain($result['commands'], "-i {$keyPath} -o IdentitiesOnly=yes");
-        ->toContain("-i {$keyPath} -o IdentitiesOnly=yes")
+    expectCommandListToContain($result['commands'], "trap 'rm -f {$keyPath}' EXIT");
-        ->toContain("trap 'rm -f {$keyPath}' EXIT")
+    expectCommandListNotToContain($result['commands'], 'tee /root/.ssh/id_rsa >');
-        ->not->toContain('tee /root/.ssh/id_rsa >');
+    expectPrivateKeyMaterializationCommandsSkipLogging($result['commands']);
 });
 
 it('writes a deploy key to a per-deployment path and cleans it up when cloning on the host', function () use ($keyPath) {
@@ -104,11 +161,11 @@
     // exec_in_docker = false → the loadComposeFile / host clone path
     $result = $application->generateGitImportCommands('test-deployment-uuid', 0, null, false);
 
-    expect($result['commands'])
+    expectCommandListToContain($result['commands'], "tee {$keyPath}");
-        ->toContain("tee {$keyPath}")
+    expectCommandListToContain($result['commands'], "-i {$keyPath} -o IdentitiesOnly=yes");
-        ->toContain("-i {$keyPath} -o IdentitiesOnly=yes")
+    expectCommandListToContain($result['commands'], "trap 'rm -f {$keyPath}' EXIT");
-        ->toContain("trap 'rm -f {$keyPath}' EXIT")
+    expectCommandListNotToContain($result['commands'], 'tee /root/.ssh/id_rsa >');
-        ->not->toContain('tee /root/.ssh/id_rsa >');
+    expectPrivateKeyMaterializationCommandsSkipLogging($result['commands']);
 });
 
 it('writes a GitLab source private key to a per-deployment path and cleans it up when cloning on the host', function () use ($keyPath) {
@@ -137,11 +194,11 @@
 
     $result = $application->generateGitImportCommands('test-deployment-uuid', 0, null, false);
 
-    expect($result['commands'])
+    expectCommandListToContain($result['commands'], "tee {$keyPath}");
-        ->toContain("tee {$keyPath}")
+    expectCommandListToContain($result['commands'], "-i {$keyPath} -o IdentitiesOnly=yes");
-        ->toContain("-i {$keyPath} -o IdentitiesOnly=yes")
+    expectCommandListToContain($result['commands'], "trap 'rm -f {$keyPath}' EXIT");
-        ->toContain("trap 'rm -f {$keyPath}' EXIT")
+    expectCommandListNotToContain($result['commands'], 'tee /root/.ssh/id_rsa >');
-        ->not->toContain('tee /root/.ssh/id_rsa >');
+    expectPrivateKeyMaterializationCommandsSkipLogging($result['commands']);
 });
 
 it('uses the per-deployment deploy key for pull request fetches', function () use ($keyPath) {
@@ -163,9 +220,9 @@
 
     $result = $application->generateGitImportCommands('test-deployment-uuid', 123, 'github', false);
 
-    expect($result['commands'])
+    expectCommandListToContain($result['commands'], "GIT_SSH_COMMAND=\"ssh -o ConnectTimeout=30 -p 22 -o Port=22 -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i {$keyPath} -o IdentitiesOnly=yes\" git fetch origin pull/123/head:pr-123-coolify");
-        ->toContain("GIT_SSH_COMMAND=\"ssh -o ConnectTimeout=30 -p 22 -o Port=22 -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i {$keyPath} -o IdentitiesOnly=yes\" git fetch origin pull/123/head:pr-123-coolify")
+    expectCommandListNotToContain($result['commands'], 'GIT_SSH_COMMAND="ssh -o ConnectTimeout=30 -p 22 -o Port=22 -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /root/.ssh/id_rsa" git fetch origin pull/123/head:pr-123-coolify');
-        ->not->toContain('GIT_SSH_COMMAND="ssh -o ConnectTimeout=30 -p 22 -o Port=22 -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /root/.ssh/id_rsa" git fetch origin pull/123/head:pr-123-coolify');
+    expectPrivateKeyMaterializationCommandsSkipLogging($result['commands']);
 });
 
 it('does not force a missing per-deployment key for other repository pull request fetches', function () use ($keyPath) {
@@ -183,7 +240,6 @@
 
     $result = $application->generateGitImportCommands('test-deployment-uuid', 123, 'github', false);
 
-    expect($result['commands'])
+    expectCommandListToContain($result['commands'], 'GIT_SSH_COMMAND="ssh -o ConnectTimeout=30 -p 22 -o Port=22 -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /root/.ssh/id_rsa" git fetch origin pull/123/head:pr-123-coolify');
-        ->toContain('GIT_SSH_COMMAND="ssh -o ConnectTimeout=30 -p 22 -o Port=22 -o LogLevel=ERROR -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -i /root/.ssh/id_rsa" git fetch origin pull/123/head:pr-123-coolify')
+    expectCommandListNotToContain($result['commands'], $keyPath);
-        ->not->toContain($keyPath);
 });

tests/Unit/FileStorageSecurityTest.php

@@ -141,3 +141,77 @@
     expect(fn () => validateShellSafePath('./data', 'storage path'))
         ->not->toThrow(Exception::class);
 });
+
+test('file mount path validator rejects parent segments and unsafe separators', function (string $path) {
+    expect(fn () => validateFileMountPath($path, 'file storage path'))
+        ->toThrow(Exception::class);
+})->with([
+    'parent segment to etc' => ['/../../etc/passwd'],
+    'embedded parent segment' => ['/foo/../bar'],
+    'parent segment' => ['/..'],
+    'double slash before parent segment' => ['/foo//../bar'],
+    'current directory segment' => ['/foo/./bar'],
+    'backslash parent segment' => ['\\..\\etc\\passwd'],
+    'null byte' => ["/app/config\0/../../etc/passwd"],
+]);
+
+test('file mount path validator accepts safe absolute container file paths', function (string $path, string $expected) {
+    expect(validateFileMountPath($path, 'file storage path'))->toBe($expected);
+})->with([
+    'nginx config' => ['/etc/nginx/nginx.conf', '/etc/nginx/nginx.conf'],
+    'app env filename' => ['/app/.env', '/app/.env'],
+    'relative input becomes absolute' => ['config/app.yaml', '/config/app.yaml'],
+    'duplicate slashes collapse' => ['/opt//app///config.json', '/opt/app/config.json'],
+]);
+
+test('host file mount path validator accepts absolute host file paths', function () {
+    expect(validateHostFileMountPath('/etc/nginx/nginx.conf', 'host file path'))
+        ->toBe('/etc/nginx/nginx.conf');
+});
+
+test('host file mount path validator rejects ambiguous or directory paths', function (string $path) {
+    expect(fn () => validateHostFileMountPath($path, 'host file path'))
+        ->toThrow(Exception::class);
+})->with([
+    'relative path' => ['etc/nginx/nginx.conf'],
+    'root directory' => ['/'],
+    'trailing slash' => ['/etc/nginx/'],
+    'parent segment' => ['/etc/../shadow'],
+    'current segment' => ['/etc/./nginx.conf'],
+    'backslash' => ['\\etc\\nginx.conf'],
+]);
+
+test('confined path resolver keeps file mounts inside their resource configuration root', function () {
+    expect(confineFileMountPath('/data/coolify/applications/app-uuid', '/etc/nginx/nginx.conf', 'file storage path'))
+        ->toBe('/data/coolify/applications/app-uuid/etc/nginx/nginx.conf');
+
+    expect(confineFileMountPath('/data/coolify/databases/db-uuid/', 'postgres/postgresql.conf', 'file storage path'))
+        ->toBe('/data/coolify/databases/db-uuid/postgres/postgresql.conf');
+
+    expect(confineFileMountPath('/data/coolify/services/service-uuid', '/config.yaml', 'file storage path'))
+        ->toBe('/data/coolify/services/service-uuid/config.yaml');
+});
+
+test('confined path resolver rejects paths that escape the resource configuration root', function (string $base, string $path) {
+    expect(fn () => confineFileMountPath($base, $path, 'file storage path'))
+        ->toThrow(Exception::class);
+})->with([
+    'application parent segment' => ['/data/coolify/applications/app-uuid', '/../../etc/passwd'],
+    'database parent segment' => ['/data/coolify/databases/db-uuid', '/postgres/../../../etc/shadow'],
+    'service dot segment' => ['/data/coolify/services/service-uuid', '/./config.yaml'],
+]);
+
+test('local file volume write sink keeps saved managed file paths for compatibility', function () {
+    $source = file_get_contents(__DIR__.'/../../app/Models/LocalFileVolume.php');
+
+    expect($source)->not->toContain('confinePathToBase($workdir, $path->value(), \'storage path\')')
+        ->and($source)->toContain('tee {$escapedPath}');
+});
+
+test('host file mounts are bind-only and skipped by server storage writes', function () {
+    $source = file_get_contents(__DIR__.'/../../app/Models/LocalFileVolume.php');
+
+    expect($source)->toContain('if ($this->is_host_file) {')
+        ->and($source)->toContain('return;')
+        ->and($source)->toContain('tee {$escapedPath}');
+});