From 14ecadc0debb2a86975ea4d48dc6abc8ddc3ceb0 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 16 Jul 2026 14:24:12 +0200
Subject: [PATCH 01/42] fix(services): avoid reading bind-mount files when
 syncing volumes

Stop catting remote file contents into memory for non-git bind mounts in
getFilesystemVolumesFromServer; git-based volumes still load via
loadStorageOnServer().
---
 bootstrap/helpers/services.php                | 19 +++++++++----------
 tests/Unit/LocalFileVolumeContentSizeTest.php | 13 +++++++++++++
 2 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/bootstrap/helpers/services.php b/bootstrap/helpers/services.php
index 20b184a01..e46769a15 100644
--- a/bootstrap/helpers/services.php
+++ b/bootstrap/helpers/services.php
@@ -139,7 +139,7 @@ function replaceVariables(string $variable): Stringable
 function getFilesystemVolumesFromServer(ServiceApplication|ServiceDatabase|Application $oneService, bool $isInit = false)
 {
     try {
-        if ($oneService->getMorphClass() === \App\Models\Application::class) {
+        if ($oneService->getMorphClass() === Application::class) {
             $workdir = $oneService->workdir();
             $server = $oneService->destination->server;
         } else {
@@ -167,13 +167,12 @@ function getFilesystemVolumesFromServer(ServiceApplication|ServiceDatabase|Appli
             $isDir = instant_remote_process(["test -d $fileLocation && echo OK || echo NOK"], $server);
 
             if ($isFile === 'OK') {
-                // If its a file & exists
-                $filesystemContent = instant_remote_process(["cat $fileLocation"], $server);
                 if ($fileVolume->is_based_on_git) {
-                    $fileVolume->content = $filesystemContent;
+                    $fileVolume->loadStorageOnServer();
+                } else {
+                    $fileVolume->is_directory = false;
+                    $fileVolume->save();
                 }
-                $fileVolume->is_directory = false;
-                $fileVolume->save();
             } elseif ($isDir === 'OK') {
                 // If its a directory & exists
                 $fileVolume->content = null;
@@ -204,7 +203,7 @@ function getFilesystemVolumesFromServer(ServiceApplication|ServiceDatabase|Appli
                 instant_remote_process(["mkdir -p $fileLocation"], $server);
             }
         }
-    } catch (\Throwable $e) {
+    } catch (Throwable $e) {
         return handleError($e);
     }
 }
@@ -214,7 +213,7 @@ function updateCompose(ServiceApplication|ServiceDatabase $resource)
         $name = data_get($resource, 'name');
         $dockerComposeRaw = data_get($resource, 'service.docker_compose_raw');
         if (! $dockerComposeRaw) {
-            throw new \Exception('No compose file found or not a valid YAML file.');
+            throw new Exception('No compose file found or not a valid YAML file.');
         }
         $dockerCompose = Yaml::parse($dockerComposeRaw);
 
@@ -396,7 +395,7 @@ function updateCompose(ServiceApplication|ServiceDatabase $resource)
                 }
             }
         }
-    } catch (\Throwable $e) {
+    } catch (Throwable $e) {
         return handleError($e);
     }
 }
@@ -495,7 +494,7 @@ function applyServiceApplicationPrerequisites(Service $service): void
                 }
             }
         }
-    } catch (\Throwable $e) {
+    } catch (Throwable $e) {
         // Log error but don't throw - prerequisites are nice-to-have, not critical
         Log::error('Failed to apply service application prerequisites', [
             'service_id' => $service->id,
diff --git a/tests/Unit/LocalFileVolumeContentSizeTest.php b/tests/Unit/LocalFileVolumeContentSizeTest.php
index 1fd315884..0ad69e28a 100644
--- a/tests/Unit/LocalFileVolumeContentSizeTest.php
+++ b/tests/Unit/LocalFileVolumeContentSizeTest.php
@@ -64,3 +64,16 @@
     expect($array)->toHaveKey('is_too_large');
     expect($array['is_too_large'])->toBeTrue();
 });
+
+it('does not read regular bind-mounted file contents while loading service settings', function () {
+    $helpers = file_get_contents(base_path('bootstrap/helpers/services.php'));
+    $filesystemSync = str($helpers)
+        ->after('function getFilesystemVolumesFromServer')
+        ->before('function updateCompose');
+
+    expect($filesystemSync->value())
+        ->not->toContain('instant_remote_process(["cat $fileLocation"]');
+    expect($filesystemSync->value())
+        ->toContain('if ($fileVolume->is_based_on_git)')
+        ->toContain('$fileVolume->loadStorageOnServer();');
+});

From 2749f45ba6e464681929e9485730395452a246f3 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 16 Jul 2026 15:21:00 +0200
Subject: [PATCH 02/42] fix: cap remote logs, tasks, and config output sizes

Bound proxy config, docker compose, scheduled task, log viewer, and
dynamic proxy config reads so large remote output cannot overwhelm PHP.
---
 app/Actions/Proxy/GetProxyConfiguration.php   | 10 ++-
 app/Jobs/ScheduledTaskJob.php                 | 12 ++-
 app/Livewire/Project/Shared/GetLogs.php       | 39 ++++++--
 .../Server/Proxy/DynamicConfigurations.php    | 35 +++++++-
 app/Models/Application.php                    | 15 +++-
 tests/Unit/RemoteOutputSizeLimitsTest.php     | 90 +++++++++++++++++++
 6 files changed, 187 insertions(+), 14 deletions(-)
 create mode 100644 tests/Unit/RemoteOutputSizeLimitsTest.php

diff --git a/app/Actions/Proxy/GetProxyConfiguration.php b/app/Actions/Proxy/GetProxyConfiguration.php
index 159f12252..7df16c52b 100644
--- a/app/Actions/Proxy/GetProxyConfiguration.php
+++ b/app/Actions/Proxy/GetProxyConfiguration.php
@@ -13,6 +13,8 @@ class GetProxyConfiguration
 {
     use AsAction;
 
+    public const MAX_CONFIGURATION_SIZE_BYTES = 5 * 1024 * 1024;
+
     public function handle(Server $server, bool $forceRegenerate = false): string
     {
         $proxyType = $server->proxyType();
@@ -98,11 +100,17 @@ private function configMatchesProxyType(string $proxyType, string $configuration
     private function backfillFromDisk(Server $server): ?string
     {
         $proxy_path = $server->proxyPath();
+        $configurationPath = escapeshellarg("$proxy_path/docker-compose.yml");
+        $readLimit = self::MAX_CONFIGURATION_SIZE_BYTES + 1;
         $result = instant_remote_process([
             "mkdir -p $proxy_path",
-            "cat $proxy_path/docker-compose.yml 2>/dev/null",
+            "if [ ! -f {$configurationPath} ]; then exit 0; elif [ \"$(wc -c < {$configurationPath})\" -gt ".self::MAX_CONFIGURATION_SIZE_BYTES." ]; then echo '__COOLIFY_PROXY_CONFIG_TOO_LARGE__'; else head -c {$readLimit} {$configurationPath}; fi",
         ], $server, false);
 
+        if ($result === '__COOLIFY_PROXY_CONFIG_TOO_LARGE__') {
+            throw new \RuntimeException('Proxy configuration exceeds the 5 MiB size limit.');
+        }
+
         if (! empty(trim($result ?? ''))) {
             $server->proxy->last_saved_proxy_configuration = $result;
             $server->save();
diff --git a/app/Jobs/ScheduledTaskJob.php b/app/Jobs/ScheduledTaskJob.php
index dc11ec89e..02f3daa3b 100644
--- a/app/Jobs/ScheduledTaskJob.php
+++ b/app/Jobs/ScheduledTaskJob.php
@@ -25,6 +25,8 @@ class ScheduledTaskJob implements ShouldBeEncrypted, ShouldQueue
 {
     use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
 
+    public const MAX_OUTPUT_SIZE_BYTES = 5 * 1024 * 1024;
+
     /**
      * The number of times the job may be attempted.
      */
@@ -148,7 +150,8 @@ public function handle(): void
             foreach ($this->containers as $containerName) {
                 if (count($this->containers) == 1 || str_starts_with($containerName, $this->task->container.'-'.$this->resource->uuid)) {
                     $cmd = "sh -c '".str_replace("'", "'\''", $this->task->command)."'";
-                    $exec = "docker exec {$containerName} {$cmd}";
+                    $execCommand = "docker exec {$containerName} {$cmd}";
+                    $exec = $this->boundedTaskCommand($execCommand);
                     // Disable SSH multiplexing to prevent race conditions when multiple tasks run concurrently
                     // See: https://github.com/coollabsio/coolify/issues/6736
                     $this->task_output = instant_remote_process([$exec], $this->server, true, false, $this->timeout, disableMultiplexing: true);
@@ -204,6 +207,13 @@ public function handle(): void
         }
     }
 
+    private function boundedTaskCommand(string $command): string
+    {
+        $maxOutputBytes = self::MAX_OUTPUT_SIZE_BYTES;
+
+        return "output_file=\$(mktemp); trap 'rm -f \"\$output_file\"' EXIT; set +e; set -o pipefail; {$command} 2>&1 | { head -c {$maxOutputBytes} > \"\$output_file\"; if IFS= read -r -n 1 extra_byte; then printf '\n\n[... Output truncated at 5MB limit ...]' >> \"\$output_file\"; fi; cat > /dev/null; }; exit_code=\${PIPESTATUS[0]}; if [ \"\$exit_code\" -eq 0 ]; then cat \"\$output_file\"; else cat \"\$output_file\" >&2; fi; exit \$exit_code";
+    }
+
     /**
      * Calculate the number of seconds to wait before retrying the job.
      */
diff --git a/app/Livewire/Project/Shared/GetLogs.php b/app/Livewire/Project/Shared/GetLogs.php
index d0121bdc5..fa575073f 100644
--- a/app/Livewire/Project/Shared/GetLogs.php
+++ b/app/Livewire/Project/Shared/GetLogs.php
@@ -25,6 +25,8 @@ class GetLogs extends Component
 {
     public const MAX_LOG_LINES = 50000;
 
+    public const MAX_DISPLAY_SIZE_BYTES = 5 * 1024 * 1024;
+
     public const MAX_DOWNLOAD_SIZE_BYTES = 50 * 1024 * 1024; // 50MB
 
     public string $outputs = '';
@@ -154,14 +156,12 @@ public function getLogs($refresh = false)
                         $command = parseCommandsByLineForSudo(collect($command), $this->server);
                         $command = $command[0];
                     }
-                    $sshCommand = SshMultiplexingHelper::generateSshCommand($this->server, $command);
                 } else {
                     $command = "docker logs -n {$this->numberOfLines} -t {$this->container}";
                     if ($this->server->isNonRoot()) {
                         $command = parseCommandsByLineForSudo(collect($command), $this->server);
                         $command = $command[0];
                     }
-                    $sshCommand = SshMultiplexingHelper::generateSshCommand($this->server, $command);
                 }
             } else {
                 if ($this->server->isSwarm()) {
@@ -170,22 +170,39 @@ public function getLogs($refresh = false)
                         $command = parseCommandsByLineForSudo(collect($command), $this->server);
                         $command = $command[0];
                     }
-                    $sshCommand = SshMultiplexingHelper::generateSshCommand($this->server, $command);
                 } else {
                     $command = "docker logs -n {$this->numberOfLines} {$this->container}";
                     if ($this->server->isNonRoot()) {
                         $command = parseCommandsByLineForSudo(collect($command), $this->server);
                         $command = $command[0];
                     }
-                    $sshCommand = SshMultiplexingHelper::generateSshCommand($this->server, $command);
                 }
             }
+            $command = $this->boundedLogCommand($command, self::MAX_DISPLAY_SIZE_BYTES);
+            $sshCommand = SshMultiplexingHelper::generateSshCommand($this->server, $command);
+
             // Collect new logs into temporary variable first to prevent flickering
             // (avoids clearing output before new data is ready)
             // Use array accumulation + implode for O(n) instead of O(n²) string concatenation
             $logChunks = [];
-            Process::timeout(config('constants.ssh.command_timeout'))->run($sshCommand, function (string $type, string $output) use (&$logChunks) {
-                $logChunks[] = removeAnsiColors($output);
+            $accumulatedBytes = 0;
+            $truncated = false;
+            Process::timeout(config('constants.ssh.command_timeout'))->run($sshCommand, function (string $type, string $output) use (&$logChunks, &$accumulatedBytes, &$truncated) {
+                if ($truncated) {
+                    return;
+                }
+
+                $output = removeAnsiColors($output);
+                $remainingBytes = self::MAX_DISPLAY_SIZE_BYTES - $accumulatedBytes;
+                if (strlen($output) > $remainingBytes) {
+                    $logChunks[] = substr($output, 0, max(0, $remainingBytes));
+                    $truncated = true;
+
+                    return;
+                }
+
+                $logChunks[] = $output;
+                $accumulatedBytes += strlen($output);
             });
             $newOutputs = implode('', $logChunks);
 
@@ -198,6 +215,10 @@ public function getLogs($refresh = false)
                 })->join("\n");
             }
 
+            if ($truncated) {
+                $newOutputs .= "\n\n[... Output truncated at 5MB limit ...]";
+            }
+
             // Only update outputs after new data is ready (atomic update prevents flicker)
             $this->outputs = $newOutputs;
         }
@@ -239,6 +260,7 @@ public function downloadAllLogs(): string
             $command = $command[0];
         }
 
+        $command = $this->boundedLogCommand($command, self::MAX_DOWNLOAD_SIZE_BYTES);
         $sshCommand = SshMultiplexingHelper::generateSshCommand($this->server, $command);
 
         // Use array accumulation + implode for O(n) instead of O(n²) string concatenation
@@ -287,6 +309,11 @@ public function downloadAllLogs(): string
         return sanitizeLogsForExport($allLogs);
     }
 
+    private function boundedLogCommand(string $command, int $maxBytes): string
+    {
+        return "({$command}) 2>&1 | head -c ".($maxBytes + 1);
+    }
+
     public function render()
     {
         return view('livewire.project.shared.get-logs');
diff --git a/app/Livewire/Server/Proxy/DynamicConfigurations.php b/app/Livewire/Server/Proxy/DynamicConfigurations.php
index f824645aa..6351dace8 100644
--- a/app/Livewire/Server/Proxy/DynamicConfigurations.php
+++ b/app/Livewire/Server/Proxy/DynamicConfigurations.php
@@ -11,6 +11,12 @@ class DynamicConfigurations extends Component
 {
     use AuthorizesRequests;
 
+    public const MAX_CONFIGURATION_FILE_SIZE_BYTES = 1024 * 1024;
+
+    public const MAX_TOTAL_CONFIGURATION_SIZE_BYTES = 5 * 1024 * 1024;
+
+    public const MAX_CONFIGURATION_FILES = 100;
+
     public ?Server $server = null;
 
     public $parameters = [];
@@ -44,15 +50,36 @@ public function loadDynamicConfigurations()
             return handleError($e, $this);
         }
         $proxy_path = $this->server->proxyPath();
-        $files = instant_remote_process(["mkdir -p $proxy_path/dynamic && ls -1 {$proxy_path}/dynamic"], $this->server);
+        $fileLimit = self::MAX_CONFIGURATION_FILES + 1;
+        $files = instant_remote_process(["mkdir -p $proxy_path/dynamic && ls -1 {$proxy_path}/dynamic | head -n {$fileLimit}"], $this->server);
         $files = collect(explode("\n", $files))->filter(fn ($file) => ! empty($file));
         $files = $files->map(fn ($file) => trim($file));
         $files = $files->sort();
         $contents = collect([]);
-        foreach ($files as $file) {
+        $skippedFiles = collect([]);
+        $totalBytes = 0;
+        if ($files->count() > self::MAX_CONFIGURATION_FILES) {
+            $skippedFiles->push('additional files');
+        }
+        foreach ($files->take(self::MAX_CONFIGURATION_FILES) as $file) {
             $without_extension = str_replace('.', '|', $file);
-            $content = instant_remote_process(["cat {$proxy_path}/dynamic/{$file}"], $this->server);
-            $contents[$without_extension] = $content ?? '';
+            $filePath = escapeshellarg("{$proxy_path}/dynamic/{$file}");
+            $readLimit = self::MAX_CONFIGURATION_FILE_SIZE_BYTES + 1;
+            $content = instant_remote_process(["head -c {$readLimit} {$filePath}"], $this->server);
+            $content = $content ?? '';
+            $contentBytes = strlen($content);
+
+            if ($contentBytes > self::MAX_CONFIGURATION_FILE_SIZE_BYTES || $totalBytes + $contentBytes > self::MAX_TOTAL_CONFIGURATION_SIZE_BYTES) {
+                $skippedFiles->push($file);
+
+                continue;
+            }
+
+            $contents[$without_extension] = $content;
+            $totalBytes += $contentBytes;
+        }
+        if ($skippedFiles->isNotEmpty()) {
+            $this->dispatch('warning', 'Some dynamic configurations were not loaded because they exceed the safe display limits: '.$skippedFiles->implode(', '));
         }
         $this->contents = $contents;
         $this->dispatch('$refresh');
diff --git a/app/Models/Application.php b/app/Models/Application.php
index 732142b0d..6f1102717 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -119,6 +119,8 @@ class Application extends BaseModel
 {
     use ClearsGlobalSearchCache, HasConfiguration, HasFactory, HasMetrics, HasSafeStringAttribute, SoftDeletes;
 
+    public const MAX_DOCKER_COMPOSE_SIZE_BYTES = 5 * 1024 * 1024;
+
     private static $parserVersion = '5';
 
     protected $fillable = [
@@ -1936,6 +1938,9 @@ public function loadComposeFile($isInit = false, ?string $restoreBaseDirectory =
         $workdir = rtrim($this->base_directory, '/');
         $composeFile = $this->docker_compose_location;
         $fileList = collect([".$workdir$composeFile"]);
+        $composeFilePath = escapeshellarg(".$workdir$composeFile");
+        $composeReadLimit = self::MAX_DOCKER_COMPOSE_SIZE_BYTES + 1;
+        $readComposeFile = "if [ \"$(wc -c < {$composeFilePath})\" -gt ".self::MAX_DOCKER_COMPOSE_SIZE_BYTES." ]; then echo '__COOLIFY_COMPOSE_TOO_LARGE__'; else head -c {$composeReadLimit} {$composeFilePath}; fi";
         $gitRemoteStatus = $this->getGitRemoteStatus(deployment_uuid: $uuid);
         if (! $gitRemoteStatus['is_accessible']) {
             throw new RuntimeException('Failed to read Git source. Please verify repository access and try again.');
@@ -1966,7 +1971,7 @@ public function loadComposeFile($isInit = false, ?string $restoreBaseDirectory =
                 'git sparse-checkout init',
                 "git sparse-checkout set {$fileList->implode(' ')}",
                 'git read-tree -mu HEAD',
-                "cat .$workdir$composeFile",
+                $readComposeFile,
             ]);
         } else {
             $commands = collect([
@@ -1978,11 +1983,14 @@ public function loadComposeFile($isInit = false, ?string $restoreBaseDirectory =
                 'git sparse-checkout init --cone',
                 "git sparse-checkout set {$fileList->implode(' ')}",
                 'git read-tree -mu HEAD',
-                "cat .$workdir$composeFile",
+                $readComposeFile,
             ]);
         }
         try {
             $composeFileContent = instant_remote_process($commands, $this->destination->server);
+            if ($composeFileContent === '__COOLIFY_COMPOSE_TOO_LARGE__') {
+                throw new RuntimeException('Docker Compose file exceeds the 5 MiB size limit.');
+            }
         } catch (\Exception $e) {
             // Restore original values on failure only
             $this->docker_compose_location = $initialDockerComposeLocation;
@@ -1998,6 +2006,9 @@ public function loadComposeFile($isInit = false, ?string $restoreBaseDirectory =
                 }
                 throw new RuntimeException('Repository does not exist. Please check your repository URL and try again.');
             }
+            if (str($e->getMessage())->contains('exceeds the 5 MiB size limit')) {
+                throw $e;
+            }
             throw new RuntimeException('Failed to read the Docker Compose file from the repository.');
         } finally {
             // Cleanup only - restoration happens in catch block
diff --git a/tests/Unit/RemoteOutputSizeLimitsTest.php b/tests/Unit/RemoteOutputSizeLimitsTest.php
new file mode 100644
index 000000000..e010970bb
--- /dev/null
+++ b/tests/Unit/RemoteOutputSizeLimitsTest.php
@@ -0,0 +1,90 @@
+<?php
+
+use App\Actions\Proxy\GetProxyConfiguration;
+use App\Jobs\ScheduledTaskJob;
+use App\Livewire\Project\Shared\GetLogs;
+use App\Livewire\Server\Proxy\DynamicConfigurations;
+use App\Models\Application;
+
+function remoteOutputSource(string $path): string
+{
+    return file_get_contents(__DIR__.'/../../'.$path);
+}
+
+it('bounds dynamic proxy configuration files and their combined Livewire payload', function () {
+    $source = remoteOutputSource('app/Livewire/Server/Proxy/DynamicConfigurations.php');
+
+    expect($source)
+        ->toContain('MAX_CONFIGURATION_FILE_SIZE_BYTES')
+        ->toContain('MAX_TOTAL_CONFIGURATION_SIZE_BYTES')
+        ->toContain('MAX_CONFIGURATION_FILES')
+        ->toContain('head -c')
+        ->toContain('$totalBytes');
+
+    expect(DynamicConfigurations::MAX_CONFIGURATION_FILE_SIZE_BYTES)->toBe(1024 * 1024)
+        ->and(DynamicConfigurations::MAX_TOTAL_CONFIGURATION_SIZE_BYTES)->toBe(5 * 1024 * 1024)
+        ->and(DynamicConfigurations::MAX_CONFIGURATION_FILES)->toBe(100);
+});
+
+it('bounds regular log viewer output before it reaches PHP', function () {
+    $source = remoteOutputSource('app/Livewire/Project/Shared/GetLogs.php');
+
+    expect($source)
+        ->toContain('MAX_DISPLAY_SIZE_BYTES')
+        ->toContain('boundedLogCommand(')
+        ->toContain('[... Output truncated at');
+
+    $method = new ReflectionMethod(GetLogs::class, 'boundedLogCommand');
+    $command = $method->invoke(new GetLogs, 'docker logs example', 100);
+
+    expect(GetLogs::MAX_DISPLAY_SIZE_BYTES)->toBe(5 * 1024 * 1024)
+        ->and($command)->toBe('(docker logs example) 2>&1 | head -c 101');
+});
+
+it('bounds docker compose files loaded from git before parsing', function () {
+    $source = remoteOutputSource('app/Models/Application.php');
+
+    expect($source)
+        ->toContain('MAX_DOCKER_COMPOSE_SIZE_BYTES')
+        ->toContain('MAX_DOCKER_COMPOSE_SIZE_BYTES + 1')
+        ->toContain('head -c');
+
+    expect(Application::MAX_DOCKER_COMPOSE_SIZE_BYTES)->toBe(5 * 1024 * 1024);
+});
+
+it('bounds scheduled task output before storing or notifying', function () {
+    $source = remoteOutputSource('app/Jobs/ScheduledTaskJob.php');
+
+    expect($source)
+        ->toContain('MAX_OUTPUT_SIZE_BYTES')
+        ->toContain('head -c {$maxOutputBytes}')
+        ->toContain('[... Output truncated at');
+
+    $reflection = new ReflectionClass(ScheduledTaskJob::class);
+    $method = $reflection->getMethod('boundedTaskCommand');
+    $command = $method->invoke($reflection->newInstanceWithoutConstructor(), 'printf hello');
+    $failureCommand = $method->invoke($reflection->newInstanceWithoutConstructor(), "bash -c 'printf failure; exit 7'");
+    exec('bash -n -c '.escapeshellarg($command), $output, $exitCode);
+    exec('bash -c '.escapeshellarg($command), $commandOutput, $commandExitCode);
+    exec('bash -c '.escapeshellarg($failureCommand).' 2>&1', $failureOutput, $failureExitCode);
+
+    expect(ScheduledTaskJob::MAX_OUTPUT_SIZE_BYTES)->toBe(5 * 1024 * 1024)
+        ->and($command)->toContain('head -c 5242880')
+        ->and($exitCode)->toBe(0)
+        ->and($commandExitCode)->toBe(0)
+        ->and(implode("\n", $commandOutput))->toBe('hello')
+        ->and($failureExitCode)->toBe(7)
+        ->and(implode("\n", $failureOutput))->toBe('failure');
+});
+
+it('bounds proxy configuration backfill before storing it', function () {
+    $source = remoteOutputSource('app/Actions/Proxy/GetProxyConfiguration.php');
+
+    expect($source)
+        ->toContain('MAX_CONFIGURATION_SIZE_BYTES')
+        ->toContain('MAX_CONFIGURATION_SIZE_BYTES + 1')
+        ->toContain('head -c')
+        ->toContain('Proxy configuration exceeds');
+
+    expect(GetProxyConfiguration::MAX_CONFIGURATION_SIZE_BYTES)->toBe(5 * 1024 * 1024);
+});

From 60129c2c4701431a18c15fe4c7b40e4f8607c07c Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 16 Jul 2026 16:02:51 +0200
Subject: [PATCH 03/42] fix: measure log size before ANSI strip; harden tasks
 and volumes

Truncate GetLogs against raw byte length, then strip ANSI colors.
Run scheduled-task docker exec with explicit sudo docker and no_sudo
to avoid double sudo rewriting on non-root servers. Mark git-based
file volumes as files before refreshing content from the server.
---
 app/Jobs/ScheduledTaskJob.php                 |  5 ++-
 app/Livewire/Project/Shared/GetLogs.php       | 15 ++++---
 bootstrap/helpers/services.php                |  5 +--
 tests/Feature/GetLogsCommandInjectionTest.php | 41 ++++++++++++++++++-
 tests/Unit/LocalFileVolumeContentSizeTest.php | 11 +++++
 tests/Unit/RemoteOutputSizeLimitsTest.php     | 20 +++++++++
 6 files changed, 83 insertions(+), 14 deletions(-)

diff --git a/app/Jobs/ScheduledTaskJob.php b/app/Jobs/ScheduledTaskJob.php
index 02f3daa3b..d24f36350 100644
--- a/app/Jobs/ScheduledTaskJob.php
+++ b/app/Jobs/ScheduledTaskJob.php
@@ -150,11 +150,12 @@ public function handle(): void
             foreach ($this->containers as $containerName) {
                 if (count($this->containers) == 1 || str_starts_with($containerName, $this->task->container.'-'.$this->resource->uuid)) {
                     $cmd = "sh -c '".str_replace("'", "'\''", $this->task->command)."'";
-                    $execCommand = "docker exec {$containerName} {$cmd}";
+                    $dockerCommand = $this->server->isNonRoot() ? 'sudo docker' : 'docker';
+                    $execCommand = "{$dockerCommand} exec {$containerName} {$cmd}";
                     $exec = $this->boundedTaskCommand($execCommand);
                     // Disable SSH multiplexing to prevent race conditions when multiple tasks run concurrently
                     // See: https://github.com/coollabsio/coolify/issues/6736
-                    $this->task_output = instant_remote_process([$exec], $this->server, true, false, $this->timeout, disableMultiplexing: true);
+                    $this->task_output = instant_remote_process([$exec], $this->server, throwError: true, no_sudo: true, timeout: $this->timeout, disableMultiplexing: true);
                     $this->task_log->update([
                         'status' => 'success',
                         'message' => $this->task_output,
diff --git a/app/Livewire/Project/Shared/GetLogs.php b/app/Livewire/Project/Shared/GetLogs.php
index fa575073f..67a040ef7 100644
--- a/app/Livewire/Project/Shared/GetLogs.php
+++ b/app/Livewire/Project/Shared/GetLogs.php
@@ -192,17 +192,17 @@ public function getLogs($refresh = false)
                     return;
                 }
 
-                $output = removeAnsiColors($output);
                 $remainingBytes = self::MAX_DISPLAY_SIZE_BYTES - $accumulatedBytes;
-                if (strlen($output) > $remainingBytes) {
-                    $logChunks[] = substr($output, 0, max(0, $remainingBytes));
+                $outputBytes = strlen($output);
+                if ($outputBytes > $remainingBytes) {
+                    $logChunks[] = removeAnsiColors(substr($output, 0, max(0, $remainingBytes)));
                     $truncated = true;
 
                     return;
                 }
 
-                $logChunks[] = $output;
-                $accumulatedBytes += strlen($output);
+                $logChunks[] = removeAnsiColors($output);
+                $accumulatedBytes += $outputBytes;
             });
             $newOutputs = implode('', $logChunks);
 
@@ -274,20 +274,19 @@ public function downloadAllLogs(): string
                 return;
             }
 
-            $output = removeAnsiColors($output);
             $outputBytes = strlen($output);
 
             if ($accumulatedBytes + $outputBytes > self::MAX_DOWNLOAD_SIZE_BYTES) {
                 $remaining = self::MAX_DOWNLOAD_SIZE_BYTES - $accumulatedBytes;
                 if ($remaining > 0) {
-                    $logChunks[] = substr($output, 0, $remaining);
+                    $logChunks[] = removeAnsiColors(substr($output, 0, $remaining));
                 }
                 $truncated = true;
 
                 return;
             }
 
-            $logChunks[] = $output;
+            $logChunks[] = removeAnsiColors($output);
             $accumulatedBytes += $outputBytes;
         });
 
diff --git a/bootstrap/helpers/services.php b/bootstrap/helpers/services.php
index e46769a15..05430930b 100644
--- a/bootstrap/helpers/services.php
+++ b/bootstrap/helpers/services.php
@@ -167,11 +167,10 @@ function getFilesystemVolumesFromServer(ServiceApplication|ServiceDatabase|Appli
             $isDir = instant_remote_process(["test -d $fileLocation && echo OK || echo NOK"], $server);
 
             if ($isFile === 'OK') {
+                $fileVolume->is_directory = false;
+                $fileVolume->save();
                 if ($fileVolume->is_based_on_git) {
                     $fileVolume->loadStorageOnServer();
-                } else {
-                    $fileVolume->is_directory = false;
-                    $fileVolume->save();
                 }
             } elseif ($isDir === 'OK') {
                 // If its a directory & exists
diff --git a/tests/Feature/GetLogsCommandInjectionTest.php b/tests/Feature/GetLogsCommandInjectionTest.php
index db75f7b75..c920b94ed 100644
--- a/tests/Feature/GetLogsCommandInjectionTest.php
+++ b/tests/Feature/GetLogsCommandInjectionTest.php
@@ -3,6 +3,7 @@
 use App\Livewire\Project\Shared\GetLogs;
 use App\Models\Application;
 use App\Models\Environment;
+use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
@@ -10,6 +11,8 @@
 use App\Models\User;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Process\FakeProcessResult;
+use Illuminate\Support\Facades\Process;
 use Livewire\Attributes\Locked;
 use Livewire\Livewire;
 
@@ -20,7 +23,11 @@
     $this->team = Team::factory()->create();
     $this->user->teams()->attach($this->team, ['role' => 'owner']);
 
-    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $privateKey = PrivateKey::factory()->create(['team_id' => $this->team->id]);
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $privateKey->id,
+    ]);
     // Server::created auto-creates a StandaloneDocker, reuse it
     $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
     $this->project = Project::factory()->create(['team_id' => $this->team->id]);
@@ -67,6 +74,38 @@
 });
 
 describe('GetLogs Livewire action validation', function () {
+    test('getLogs marks ANSI-colored output truncated based on raw bytes', function () {
+        $this->server->settings->fill([
+            'is_reachable' => true,
+            'is_usable' => true,
+            'force_disabled' => false,
+        ])->save();
+        $server = Server::with('settings')->find($this->server->id);
+        $output = "\e[31m".str_repeat('a', GetLogs::MAX_DISPLAY_SIZE_BYTES - 4);
+
+        expect(strlen($output))->toBe(GetLogs::MAX_DISPLAY_SIZE_BYTES + 1);
+
+        Process::shouldReceive('timeout')->once()->andReturnSelf();
+        Process::shouldReceive('run')->andReturnUsing(function (string $command, ?callable $callback = null) use ($output): FakeProcessResult {
+            if ($callback) {
+                $callback('out', $output);
+            }
+
+            return new FakeProcessResult(command: $command);
+        });
+
+        $component = new GetLogs;
+        $component->server = $server;
+        $component->resource = $this->application;
+        $component->container = 'test-container';
+        $component->showTimeStamps = false;
+        $component->getLogs(true);
+
+        expect($component->outputs)
+            ->toContain('[... Output truncated at 5MB limit ...]')
+            ->not->toContain("\e[31m");
+    });
+
     test('getLogs rejects invalid container name', function () {
         // Make server functional by setting settings directly
         $this->server->settings->fill([
diff --git a/tests/Unit/LocalFileVolumeContentSizeTest.php b/tests/Unit/LocalFileVolumeContentSizeTest.php
index 0ad69e28a..195453978 100644
--- a/tests/Unit/LocalFileVolumeContentSizeTest.php
+++ b/tests/Unit/LocalFileVolumeContentSizeTest.php
@@ -77,3 +77,14 @@
         ->toContain('if ($fileVolume->is_based_on_git)')
         ->toContain('$fileVolume->loadStorageOnServer();');
 });
+
+it('marks git-based file volumes as files before refreshing their content', function () {
+    $helpers = file_get_contents(base_path('bootstrap/helpers/services.php'));
+    $fileBranch = str($helpers)
+        ->after("if (\$isFile === 'OK') {")
+        ->before("} elseif (\$isDir === 'OK') {");
+
+    expect($fileBranch->value())->toMatch(
+        '/\$fileVolume->is_directory = false;\s+\$fileVolume->save\(\);\s+if \(\$fileVolume->is_based_on_git\) \{/'
+    );
+});
diff --git a/tests/Unit/RemoteOutputSizeLimitsTest.php b/tests/Unit/RemoteOutputSizeLimitsTest.php
index e010970bb..b8341dd73 100644
--- a/tests/Unit/RemoteOutputSizeLimitsTest.php
+++ b/tests/Unit/RemoteOutputSizeLimitsTest.php
@@ -5,6 +5,7 @@
 use App\Livewire\Project\Shared\GetLogs;
 use App\Livewire\Server\Proxy\DynamicConfigurations;
 use App\Models\Application;
+use App\Models\Server;
 
 function remoteOutputSource(string $path): string
 {
@@ -77,6 +78,25 @@ function remoteOutputSource(string $path): string
         ->and(implode("\n", $failureOutput))->toBe('failure');
 });
 
+it('does not pass the scheduled task output wrapper through the sudo rewriter', function () {
+    $source = remoteOutputSource('app/Jobs/ScheduledTaskJob.php');
+    $reflection = new ReflectionClass(ScheduledTaskJob::class);
+    $method = $reflection->getMethod('boundedTaskCommand');
+    $command = $method->invoke($reflection->newInstanceWithoutConstructor(), 'sudo docker exec example true');
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->shouldReceive('getAttribute')->with('user')->andReturn('ubuntu');
+    $rewrittenCommand = parseCommandsByLineForSudo(collect([$command]), $server)[0];
+
+    exec('bash -n -c '.escapeshellarg($command), $output, $exitCode);
+    exec('bash -n -c '.escapeshellarg($rewrittenCommand).' 2>/dev/null', $rewrittenOutput, $rewrittenExitCode);
+
+    expect($source)
+        ->toContain("\$dockerCommand = \$this->server->isNonRoot() ? 'sudo docker' : 'docker'")
+        ->toContain('instant_remote_process([$exec], $this->server, throwError: true, no_sudo: true')
+        ->and($exitCode)->toBe(0)
+        ->and($rewrittenExitCode)->not->toBe(0);
+});
+
 it('bounds proxy configuration backfill before storing it', function () {
     $source = remoteOutputSource('app/Actions/Proxy/GetProxyConfiguration.php');
 

From 49c8f6cb5d1850fd9c49b59f1f06f359ea0172de Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 13 Aug 2026 11:31:26 +0200
Subject: [PATCH 04/42] fix: cap remote file and task reads after size-check
 races

Read local file volumes with a bounded head instead of cat so a file that grows after the size check cannot be fully slurped into PHP memory. Treat oversized bounded reads as too large and skip binary detection on that placeholder. For scheduled tasks, read one extra byte, then truncate and append the 5MB notice instead of relying on a one-byte peek.
---
 app/Jobs/ScheduledTaskJob.php                 |  3 +-
 app/Models/LocalFileVolume.php                | 27 ++++++++++++--
 tests/Unit/LocalFileVolumeContentSizeTest.php | 35 +++++++++++++++++++
 tests/Unit/RemoteOutputSizeLimitsTest.php     | 18 ++++++++--
 4 files changed, 77 insertions(+), 6 deletions(-)

diff --git a/app/Jobs/ScheduledTaskJob.php b/app/Jobs/ScheduledTaskJob.php
index d24f36350..f7bd5f933 100644
--- a/app/Jobs/ScheduledTaskJob.php
+++ b/app/Jobs/ScheduledTaskJob.php
@@ -211,8 +211,9 @@ public function handle(): void
     private function boundedTaskCommand(string $command): string
     {
         $maxOutputBytes = self::MAX_OUTPUT_SIZE_BYTES;
+        $readLimit = $maxOutputBytes + 1;
 
-        return "output_file=\$(mktemp); trap 'rm -f \"\$output_file\"' EXIT; set +e; set -o pipefail; {$command} 2>&1 | { head -c {$maxOutputBytes} > \"\$output_file\"; if IFS= read -r -n 1 extra_byte; then printf '\n\n[... Output truncated at 5MB limit ...]' >> \"\$output_file\"; fi; cat > /dev/null; }; exit_code=\${PIPESTATUS[0]}; if [ \"\$exit_code\" -eq 0 ]; then cat \"\$output_file\"; else cat \"\$output_file\" >&2; fi; exit \$exit_code";
+        return "output_file=\$(mktemp); trap 'rm -f \"\$output_file\"' EXIT; set +e; set -o pipefail; {$command} 2>&1 | { head -c {$readLimit} > \"\$output_file\"; cat > /dev/null; }; exit_code=\${PIPESTATUS[0]}; if [ \"\$(wc -c < \"\$output_file\")\" -gt {$maxOutputBytes} ]; then truncate -s {$maxOutputBytes} \"\$output_file\"; printf '\n\n[... Output truncated at 5MB limit ...]' >> \"\$output_file\"; fi; if [ \"\$exit_code\" -eq 0 ]; then cat \"\$output_file\"; else cat \"\$output_file\" >&2; fi; exit \$exit_code";
     }
 
     /**
diff --git a/app/Models/LocalFileVolume.php b/app/Models/LocalFileVolume.php
index 968e6c3d0..6b0124cb9 100644
--- a/app/Models/LocalFileVolume.php
+++ b/app/Models/LocalFileVolume.php
@@ -113,9 +113,9 @@ public function loadStorageOnServer()
 
                 return;
             }
-            $content = instant_remote_process(["cat {$escapedPath}"], $server, false);
+            $content = $this->readRemoteFileContent($escapedPath, $server);
             // Check if content contains binary data by looking for null bytes or non-printable characters
-            if (str_contains($content, "\0") || preg_match('/[\x00-\x08\x0B\x0C\x0E-\x1F]/', $content)) {
+            if ($content !== self::TOO_LARGE_PLACEHOLDER && (str_contains($content, "\0") || preg_match('/[\x00-\x08\x0B\x0C\x0E-\x1F]/', $content))) {
                 $content = self::BINARY_PLACEHOLDER;
             }
             $this->content = $content;
@@ -136,6 +136,27 @@ protected function remoteFileExceedsLimit(string $escapedPath, $server): bool
         return $size > self::MAX_CONTENT_SIZE;
     }
 
+    /**
+     * Cap the remote read itself so a file that grows after the size check
+     * cannot be fully slurped into PHP memory.
+     */
+    protected function readRemoteFileContent(string $escapedPath, $server): string
+    {
+        $readLimit = self::MAX_CONTENT_SIZE + 1;
+        $content = instant_remote_process(["head -c {$readLimit} {$escapedPath}"], $server, false);
+
+        return self::contentFromBoundedRead($content);
+    }
+
+    public static function contentFromBoundedRead(?string $content): string
+    {
+        if (strlen((string) $content) > self::MAX_CONTENT_SIZE) {
+            return self::TOO_LARGE_PLACEHOLDER;
+        }
+
+        return (string) $content;
+    }
+
     public function deleteStorageOnServer()
     {
         if ($this->is_host_file) {
@@ -228,7 +249,7 @@ public function saveStorageOnServer()
             if ($this->remoteFileExceedsLimit($escapedPath, $server)) {
                 $this->content = self::TOO_LARGE_PLACEHOLDER;
             } else {
-                $this->content = instant_remote_process(["cat {$escapedPath}"], $server, false);
+                $this->content = $this->readRemoteFileContent($escapedPath, $server);
             }
             $this->is_directory = false;
             $this->save();
diff --git a/tests/Unit/LocalFileVolumeContentSizeTest.php b/tests/Unit/LocalFileVolumeContentSizeTest.php
index 195453978..1894bf439 100644
--- a/tests/Unit/LocalFileVolumeContentSizeTest.php
+++ b/tests/Unit/LocalFileVolumeContentSizeTest.php
@@ -88,3 +88,38 @@
         '/\$fileVolume->is_directory = false;\s+\$fileVolume->save\(\);\s+if \(\$fileVolume->is_based_on_git\) \{/'
     );
 });
+
+it('bounds the remote file read itself to prevent a size-check race', function () {
+    $source = file_get_contents(app_path('Models/LocalFileVolume.php'));
+    $loadStorage = str($source)
+        ->after('public function loadStorageOnServer()')
+        ->before('public function deleteStorageOnServer()');
+
+    expect($loadStorage->value())
+        ->toContain('head -c')
+        ->not->toContain('instant_remote_process(["cat {$escapedPath}"]');
+});
+
+it('bounds directory-to-file conflict reads the same way', function () {
+    $source = file_get_contents(app_path('Models/LocalFileVolume.php'));
+    $saveStorage = str($source)
+        ->after('public function saveStorageOnServer()')
+        ->before('protected function plainMountPath');
+
+    expect($saveStorage->value())
+        ->not->toContain('instant_remote_process(["cat {$escapedPath}"]');
+});
+
+it('treats a bounded remote read that exceeds the limit as too large', function () {
+    $oversized = str_repeat('a', LocalFileVolume::MAX_CONTENT_SIZE + 1);
+
+    expect(LocalFileVolume::contentFromBoundedRead($oversized))
+        ->toBe(LocalFileVolume::TOO_LARGE_PLACEHOLDER);
+});
+
+it('keeps a bounded remote read that fits the limit', function () {
+    expect(LocalFileVolume::contentFromBoundedRead('hello'))
+        ->toBe('hello')
+        ->and(LocalFileVolume::contentFromBoundedRead(null))
+        ->toBe('');
+});
diff --git a/tests/Unit/RemoteOutputSizeLimitsTest.php b/tests/Unit/RemoteOutputSizeLimitsTest.php
index b8341dd73..3660e8828 100644
--- a/tests/Unit/RemoteOutputSizeLimitsTest.php
+++ b/tests/Unit/RemoteOutputSizeLimitsTest.php
@@ -58,7 +58,7 @@ function remoteOutputSource(string $path): string
 
     expect($source)
         ->toContain('MAX_OUTPUT_SIZE_BYTES')
-        ->toContain('head -c {$maxOutputBytes}')
+        ->toContain('head -c {$readLimit}')
         ->toContain('[... Output truncated at');
 
     $reflection = new ReflectionClass(ScheduledTaskJob::class);
@@ -70,7 +70,7 @@ function remoteOutputSource(string $path): string
     exec('bash -c '.escapeshellarg($failureCommand).' 2>&1', $failureOutput, $failureExitCode);
 
     expect(ScheduledTaskJob::MAX_OUTPUT_SIZE_BYTES)->toBe(5 * 1024 * 1024)
-        ->and($command)->toContain('head -c 5242880')
+        ->and($command)->toContain('head -c 5242881')
         ->and($exitCode)->toBe(0)
         ->and($commandExitCode)->toBe(0)
         ->and(implode("\n", $commandOutput))->toBe('hello')
@@ -78,6 +78,20 @@ function remoteOutputSource(string $path): string
         ->and(implode("\n", $failureOutput))->toBe('failure');
 });
 
+it('marks scheduled task output that exceeds the limit as truncated', function () {
+    $reflection = new ReflectionClass(ScheduledTaskJob::class);
+    $method = $reflection->getMethod('boundedTaskCommand');
+    $largeOutputCommand = 'head -c '.(ScheduledTaskJob::MAX_OUTPUT_SIZE_BYTES + 1).' /dev/zero | tr "\\0" "x"';
+    $command = $method->invoke($reflection->newInstanceWithoutConstructor(), $largeOutputCommand);
+
+    exec('bash -c '.escapeshellarg($command), $output, $exitCode);
+    $taskOutput = implode("\n", $output);
+
+    expect($exitCode)->toBe(0)
+        ->and(strlen($taskOutput))->toBeGreaterThan(ScheduledTaskJob::MAX_OUTPUT_SIZE_BYTES)
+        ->and($taskOutput)->toEndWith('[... Output truncated at 5MB limit ...]');
+});
+
 it('does not pass the scheduled task output wrapper through the sudo rewriter', function () {
     $source = remoteOutputSource('app/Jobs/ScheduledTaskJob.php');
     $reflection = new ReflectionClass(ScheduledTaskJob::class);

From 20a627ffe6f84f48643cacfb4d6a1b6ba03e0316 Mon Sep 17 00:00:00 2001
From: MarkosTech <markostechbusiness@gmail.com>
Date: Sun, 16 Aug 2026 13:14:28 +0200
Subject: [PATCH 05/42] fix(databases): redirect stdin for the SSL cert chown

Remote command lists are piped into `bash -se`, so the script sits on
stdin. `docker compose run` attaches stdin and eats the rest of it,
including the `docker compose up -d` that follows. The container is
removed and never recreated, and bash exits 0, so the deploy reports
success.

`-T` does not help, it does not detach stdin.

Affects MongoDB, MySQL, MariaDB and PostgreSQL when enable_ssl is set.
---
 app/Actions/Database/StartMariadb.php    | 2 +-
 app/Actions/Database/StartMongodb.php    | 2 +-
 app/Actions/Database/StartMysql.php      | 2 +-
 app/Actions/Database/StartPostgresql.php | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/Actions/Database/StartMariadb.php b/app/Actions/Database/StartMariadb.php
index f44008085..c4f98cfdf 100644
--- a/app/Actions/Database/StartMariadb.php
+++ b/app/Actions/Database/StartMariadb.php
@@ -211,7 +211,7 @@ public function handle(StandaloneMariadb $database)
         $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         if ($this->database->enable_ssl) {
-            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mysql:mysql /etc/mysql/certs/server.key /etc/mysql/certs/server.crt";
+            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mysql:mysql /etc/mysql/certs/server.key /etc/mysql/certs/server.crt < /dev/null";
         }
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
diff --git a/app/Actions/Database/StartMongodb.php b/app/Actions/Database/StartMongodb.php
index b31251ce2..0f9bba679 100644
--- a/app/Actions/Database/StartMongodb.php
+++ b/app/Actions/Database/StartMongodb.php
@@ -260,7 +260,7 @@ public function handle(StandaloneMongodb $database)
         $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         if ($this->database->enable_ssl) {
-            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mongodb:mongodb /etc/mongo/certs/server.pem";
+            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mongodb:mongodb /etc/mongo/certs/server.pem < /dev/null";
         }
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
diff --git a/app/Actions/Database/StartMysql.php b/app/Actions/Database/StartMysql.php
index 16b8e1585..3eab00464 100644
--- a/app/Actions/Database/StartMysql.php
+++ b/app/Actions/Database/StartMysql.php
@@ -212,7 +212,7 @@ public function handle(StandaloneMysql $database)
         $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         if ($this->database->enable_ssl) {
-            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mysql:mysql /etc/mysql/certs/server.key /etc/mysql/certs/server.crt";
+            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mysql:mysql /etc/mysql/certs/server.key /etc/mysql/certs/server.crt < /dev/null";
         }
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
 
diff --git a/app/Actions/Database/StartPostgresql.php b/app/Actions/Database/StartPostgresql.php
index 3b0f820df..21cb278fb 100644
--- a/app/Actions/Database/StartPostgresql.php
+++ b/app/Actions/Database/StartPostgresql.php
@@ -222,7 +222,7 @@ public function handle(StandalonePostgresql $database)
         $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         if ($this->database->enable_ssl) {
-            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name postgres:postgres /var/lib/postgresql/certs/server.key /var/lib/postgresql/certs/server.crt";
+            $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name postgres:postgres /var/lib/postgresql/certs/server.key /var/lib/postgresql/certs/server.crt < /dev/null";
         }
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";

From 70b9acc42467278373e00de77abb40684e25b395 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 16 Aug 2026 23:48:25 +0200
Subject: [PATCH 06/42] fix(ui): position table dropdowns outside overflowing
 containers

Update Coolify release metadata to version 4.3.7 and nightly 4.3.8.
---
 config/constants.php                          |  2 +-
 other/nightly/versions.json                   |  4 +--
 .../views/components/table/dropdown.blade.php | 31 ++++++++++++++++---
 tests/Feature/StandardTableComponentsTest.php |  4 +--
 tests/Feature/TablePaginationLoadingTest.php  | 14 +++++++++
 tests/Unit/ProductionImageWorkflowTest.php    |  6 ++--
 versions.json                                 |  4 +--
 7 files changed, 51 insertions(+), 14 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index 1e6395df8..76e34334c 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.6',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.7',
         'helper_version' => '1.0.15',
         'realtime_version' => '1.0.17',
         'railpack_version' => '0.23.0',
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index e32d035c5..2f449eed8 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,10 +1,10 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.6"
+            "version": "4.3.7"
         },
         "nightly": {
-            "version": "4.3.7"
+            "version": "4.3.8"
         },
         "helper": {
             "version": "1.0.15"
diff --git a/resources/views/components/table/dropdown.blade.php b/resources/views/components/table/dropdown.blade.php
index e236bff30..6a0472191 100644
--- a/resources/views/components/table/dropdown.blade.php
+++ b/resources/views/components/table/dropdown.blade.php
@@ -4,13 +4,36 @@
     'multiselectable' => false,
 ])
 
-<div class="relative" x-data="{ open: false }" @click.outside="open = false" @keydown.escape.window="open = false">
-    <div @click="open = !open">
+<div class="relative" x-data="{
+    open: false,
+    panelStyle: 'display: none;',
+    toggle() {
+        this.open = !this.open;
+
+        if (this.open) {
+            this.$nextTick(() => this.updatePosition());
+        }
+    },
+    updatePosition() {
+        const trigger = this.$refs.trigger.getBoundingClientRect();
+        const panel = this.$refs.panel.getBoundingClientRect();
+        const viewportPadding = 8;
+        const left = Math.max(viewportPadding, Math.min(trigger.right - panel.width, window.innerWidth - panel.width - viewportPadding));
+        const spaceBelow = window.innerHeight - trigger.bottom - viewportPadding;
+        const top = spaceBelow >= panel.height
+            ? trigger.bottom + 4
+            : Math.max(viewportPadding, trigger.top - panel.height - 4);
+
+        this.panelStyle = `position: fixed; left: ${left}px; top: ${top}px;`;
+    }
+}" @click.outside="open = false" @keydown.escape.window="open = false"
+    x-on:resize.window="if (open) updatePosition()" x-on:scroll.window="if (open) updatePosition()">
+    <div x-ref="trigger" @click="toggle()">
         {{ $trigger }}
     </div>
 
-    <div x-show="open" x-cloak
-        class="listbox-panel absolute top-full! right-0! left-auto! mt-1! {{ $panelClass }}" role="{{ $role }}"
+    <div x-ref="panel" x-show="open" x-cloak :style="panelStyle"
+        class="listbox-panel fixed! top-auto! right-auto! bottom-auto! z-[90]! mt-0! {{ $panelClass }}" role="{{ $role }}"
         @if ($multiselectable) aria-multiselectable="true" @endif>
         {{ $slot }}
     </div>
diff --git a/tests/Feature/StandardTableComponentsTest.php b/tests/Feature/StandardTableComponentsTest.php
index 684234518..28f07a9a2 100644
--- a/tests/Feature/StandardTableComponentsTest.php
+++ b/tests/Feature/StandardTableComponentsTest.php
@@ -24,8 +24,8 @@
         ->toContain('wire:model.live="search"')
         ->not->toContain('x-teleport="body"')
         ->not->toContain('floatingDropdown(')
-        ->not->toContain('position: fixed')
-        ->toContain('absolute top-full')
+        ->toContain('position: fixed')
+        ->toContain('getBoundingClientRect()')
         ->toContain('x-show="open"')
         ->toContain('aria-multiselectable="true"')
         ->toContain('Reset filters')
diff --git a/tests/Feature/TablePaginationLoadingTest.php b/tests/Feature/TablePaginationLoadingTest.php
index f6e5f5a81..d26a1a33d 100644
--- a/tests/Feature/TablePaginationLoadingTest.php
+++ b/tests/Feature/TablePaginationLoadingTest.php
@@ -30,6 +30,20 @@
         ->toContain('max="100"');
 });
 
+it('positions table dropdown panels outside overflowing containers', function () {
+    $html = Blade::render(<<<'BLADE'
+        <x-table.dropdown>
+            <x-slot:trigger><button type="button">Open</button></x-slot:trigger>
+            <button type="button">Option</button>
+        </x-table.dropdown>
+    BLADE);
+
+    expect($html)
+        ->toContain('position: fixed')
+        ->toContain('getBoundingClientRect()')
+        ->toContain('x-on:scroll.window');
+});
+
 it('renders compact client-side pagination', function () {
     $html = Blade::render('<x-client-pagination summary="1-10 of 20" page-size-model="pageSize" storage-key="tests.page-size" />');
 
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index c7d1229d2..754eca1c3 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,9 +23,9 @@
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.6'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.6')
-        ->and($versions['coolify']['nightly']['version'])->toBe('4.3.7')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.7'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.7')
+        ->and($versions['coolify']['nightly']['version'])->toBe('4.3.8')
         ->and($nightlyVersions)->toBe($versions);
 });
 
diff --git a/versions.json b/versions.json
index e32d035c5..2f449eed8 100644
--- a/versions.json
+++ b/versions.json
@@ -1,10 +1,10 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.6"
+            "version": "4.3.7"
         },
         "nightly": {
-            "version": "4.3.7"
+            "version": "4.3.8"
         },
         "helper": {
             "version": "1.0.15"

From 5872cc095cd2de92ab92466d646e51bd1bf76440 Mon Sep 17 00:00:00 2001
From: Dion VH <91065539+dionvanhecke@users.noreply.github.com>
Date: Mon, 17 Aug 2026 12:07:12 +0200
Subject: [PATCH 07/42] fix(docker): docker cleanup correctly checks the
 coolify.managed label (#8831)

---
 app/Actions/Server/CleanupDocker.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/Actions/Server/CleanupDocker.php b/app/Actions/Server/CleanupDocker.php
index e06516188..04fe00ad4 100644
--- a/app/Actions/Server/CleanupDocker.php
+++ b/app/Actions/Server/CleanupDocker.php
@@ -131,7 +131,7 @@ private function buildImagePruneCommand(
 
         $commands[] = "docker images --format '{{.Repository}}:{{.Tag}}' | ".
             $grepCommands.' | '.
-            "xargs -r -I {} sh -c 'docker inspect --format \"{{{{index .Config.Labels \\\"coolify.managed\\\"}}}}\" \"{}\" 2>/dev/null | grep -q true || docker rmi \"{}\" 2>/dev/null' || true";
+            "xargs -r -I {} sh -c 'docker inspect --format \"{{index .Config.Labels \\\"coolify.managed\\\"}}\" \"{}\" 2>/dev/null | grep -q true || docker rmi \"{}\" 2>/dev/null' || true";
 
         return implode(' && ', $commands);
     }

From 282227b238c1958a01721cb935da09761099db0a Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 16:05:21 +0200
Subject: [PATCH 08/42] fix(domains): preserve ports in split URL inputs
 (#11328)

---
 app/Livewire/Project/Application/Domains.php  | 34 ++++++++++
 app/Livewire/Project/Service/Domains.php      | 35 ++++++++++
 app/Livewire/Storage/Create.php               | 13 ++++
 app/Livewire/Storage/Form.php                 | 18 +++++
 .../components/forms/domain-input.blade.php   | 67 ++++---------------
 .../views/components/forms/listbox.blade.php  |  5 +-
 .../project/application/domains.blade.php     | 31 ++-------
 .../application/partials/domain-row.blade.php |  7 +-
 .../project/service/domains.blade.php         | 30 ++-------
 .../service/partials/domain-table.blade.php   |  8 +--
 .../views/livewire/storage/create.blade.php   |  2 +-
 .../views/livewire/storage/form.blade.php     |  2 +-
 tests/Feature/ApplicationDomainsTest.php      | 24 +++++--
 .../Feature/ListboxTriggerTruncationTest.php  |  9 +++
 tests/Feature/ServiceDomainsTest.php          |  4 +-
 tests/Feature/SplitUrlInputTest.php           | 50 +++++---------
 .../S3StorageEndpointNormalizationTest.php    |  4 +-
 17 files changed, 182 insertions(+), 161 deletions(-)

diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index 9ddd5e740..477abc08e 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -6,6 +6,7 @@
 use App\Livewire\Project\Shared\ConfigurationChecker;
 use App\Models\Application;
 use App\Models\Server;
+use App\Support\DomainUrlParts;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
@@ -35,12 +36,20 @@ class Domains extends Component
 
     public string $newDomain = '';
 
+    public array $newDomainParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public bool $newDomainPartsChanged = false;
+
     public ?string $newDomainService = null;
 
     public ?int $editingIndex = null;
 
     public string $editingDomain = '';
 
+    public array $editingDomainParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public bool $editingDomainPartsChanged = false;
+
     public ?string $editingService = null;
 
     /** @var array<int, array{url: string, service: ?string, dns_status: string, dns_message: string, expected_ip: ?string, checked_at?: ?string, is_suggested?: bool, suggested_for?: ?string, suggestion_label?: ?string, needs_force_add?: bool}> */
@@ -662,6 +671,12 @@ public function updatedNewDomain(): void
         $this->resetAddDomainDnsGate();
     }
 
+    public function updatedNewDomainParts(): void
+    {
+        $this->newDomainPartsChanged = true;
+        $this->resetAddDomainDnsGate();
+    }
+
     public function updatedNewDomainService(): void
     {
         $this->resetAddDomainDnsGate();
@@ -677,6 +692,8 @@ public function resetAddDomainDnsGate(): void
     public function resetAddDomainForm(): void
     {
         $this->newDomain = '';
+        $this->newDomainParts = DomainUrlParts::empty();
+        $this->newDomainPartsChanged = false;
         $this->resetAddDomainDnsGate();
         $this->resetErrorBag('newDomain');
     }
@@ -743,6 +760,9 @@ public function addDomain(): void
                 return;
             }
 
+            if ($this->newDomainPartsChanged) {
+                $this->newDomain = DomainUrlParts::compose(...$this->newDomainParts);
+            }
             $this->validateOnly('newDomain');
 
             $normalized = ValidationPatterns::normalizeApplicationDomains($this->newDomain);
@@ -893,6 +913,12 @@ public function updatedEditingDomain(): void
         $this->resetEditDomainDnsGate();
     }
 
+    public function updatedEditingDomainParts(): void
+    {
+        $this->editingDomainPartsChanged = true;
+        $this->resetEditDomainDnsGate();
+    }
+
     public function resetEditDomainDnsGate(): void
     {
         $this->editDomainDnsFailed = false;
@@ -908,10 +934,13 @@ public function startEdit(int $index): void
 
         $this->editingIndex = $index;
         $this->editingDomain = $this->domainRows[$index]['url'];
+        $this->editingDomainParts = DomainUrlParts::split($this->editingDomain);
+        $this->editingDomainPartsChanged = false;
         $this->editingService = $this->domainRows[$index]['service'];
         $this->resetEditDomainDnsGate();
         $this->resetErrorBag('editingDomain');
         $this->showEditDomainModal = true;
+        $this->dispatch('open-edit-domain');
     }
 
     public function addSuggestedDomain(int $index): void
@@ -990,6 +1019,8 @@ public function cancelEdit(): void
         $this->showEditDomainModal = false;
         $this->editingIndex = null;
         $this->editingDomain = '';
+        $this->editingDomainParts = DomainUrlParts::empty();
+        $this->editingDomainPartsChanged = false;
         $this->editingService = null;
         $this->resetEditDomainDnsGate();
         $this->resetErrorBag('editingDomain');
@@ -1021,6 +1052,9 @@ public function updateDomain(): void
                 return;
             }
 
+            if ($this->editingDomainPartsChanged) {
+                $this->editingDomain = DomainUrlParts::compose(...$this->editingDomainParts);
+            }
             $this->validateOnly('editingDomain');
 
             $normalized = ValidationPatterns::normalizeApplicationDomains($this->editingDomain);
diff --git a/app/Livewire/Project/Service/Domains.php b/app/Livewire/Project/Service/Domains.php
index a5479ca06..ad31560b5 100644
--- a/app/Livewire/Project/Service/Domains.php
+++ b/app/Livewire/Project/Service/Domains.php
@@ -43,10 +43,18 @@ class Domains extends Component
 
     public string $newDomain = '';
 
+    public array $newDomainParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public bool $newDomainPartsChanged = false;
+
     public ?int $editingIndex = null;
 
     public string $editingDomain = '';
 
+    public array $editingDomainParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public bool $editingDomainPartsChanged = false;
+
     public ?int $editingServiceApplicationId = null;
 
     public bool $showEditDomainModal = false;
@@ -515,6 +523,12 @@ public function updatedNewDomain(): void
         $this->forceSaveDns = false;
     }
 
+    public function updatedNewDomainParts(): void
+    {
+        $this->newDomainPartsChanged = true;
+        $this->resetAddDomainDnsGate();
+    }
+
     public function updatedEditingDomain(): void
     {
         $this->editDomainDnsFailed = false;
@@ -522,6 +536,12 @@ public function updatedEditingDomain(): void
         $this->forceSaveEditDns = false;
     }
 
+    public function updatedEditingDomainParts(): void
+    {
+        $this->editingDomainPartsChanged = true;
+        $this->updatedEditingDomain();
+    }
+
     public function confirmAddDomainDespiteDns(): void
     {
         $this->forceSaveDns = true;
@@ -842,6 +862,9 @@ public function addDomain(): void
     {
         try {
             $this->authorize('update', $this->service);
+            if ($this->newDomainPartsChanged) {
+                $this->newDomain = DomainUrlParts::compose(...$this->newDomainParts);
+            }
             $this->validateOnly('newDomain');
 
             $app = $this->findServiceApp($this->newServiceApplicationId);
@@ -893,6 +916,8 @@ public function addDomain(): void
             }
 
             $this->newDomain = '';
+            $this->newDomainParts = DomainUrlParts::empty();
+            $this->newDomainPartsChanged = false;
             $this->addDomainDnsFailed = false;
             $this->addDomainDnsMessage = '';
             $this->forceSaveDns = false;
@@ -916,12 +941,15 @@ public function startEdit(int $index): void
 
         $this->editingIndex = $index;
         $this->editingDomain = $this->domainRows[$index]['url'];
+        $this->editingDomainParts = DomainUrlParts::split($this->editingDomain);
+        $this->editingDomainPartsChanged = false;
         $this->editingServiceApplicationId = (int) $this->domainRows[$index]['service_application_id'];
         $this->editDomainDnsFailed = false;
         $this->editDomainDnsMessage = '';
         $this->forceSaveEditDns = false;
         $this->resetErrorBag('editingDomain');
         $this->showEditDomainModal = true;
+        $this->dispatch('open-edit-domain');
     }
 
     public function cancelEdit(): void
@@ -929,6 +957,8 @@ public function cancelEdit(): void
         $this->showEditDomainModal = false;
         $this->editingIndex = null;
         $this->editingDomain = '';
+        $this->editingDomainParts = DomainUrlParts::empty();
+        $this->editingDomainPartsChanged = false;
         $this->editingServiceApplicationId = null;
         $this->editDomainDnsFailed = false;
         $this->editDomainDnsMessage = '';
@@ -945,6 +975,9 @@ public function updateDomain(): void
                 return;
             }
 
+            if ($this->editingDomainPartsChanged) {
+                $this->editingDomain = DomainUrlParts::compose(...$this->editingDomainParts);
+            }
             $this->validateOnly('editingDomain');
 
             $app = $this->findServiceApp($this->editingServiceApplicationId);
@@ -1130,6 +1163,8 @@ public function generateDomain(): void
             }
 
             $this->newDomain = $domain;
+            $this->newDomainParts = DomainUrlParts::split($domain);
+            $this->newDomainPartsChanged = true;
             $this->updatedNewDomain();
         } catch (\Throwable $e) {
             handleError($e, $this);
diff --git a/app/Livewire/Storage/Create.php b/app/Livewire/Storage/Create.php
index d741e6918..9e22e5491 100644
--- a/app/Livewire/Storage/Create.php
+++ b/app/Livewire/Storage/Create.php
@@ -5,6 +5,7 @@
 use App\Models\S3Storage;
 use App\Rules\SafeWebhookUrl;
 use App\Rules\ValidS3BucketName;
+use App\Support\DomainUrlParts;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Uri;
@@ -28,6 +29,10 @@ class Create extends Component
 
     public string $endpoint = '';
 
+    public array $endpointParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public bool $endpointPartsChanged = false;
+
     public S3Storage $storage;
 
     protected function rules(): array
@@ -76,6 +81,9 @@ public function submit()
         try {
             $this->authorize('create', S3Storage::class);
 
+            if ($this->endpointPartsChanged) {
+                $this->endpoint = DomainUrlParts::compose(...$this->endpointParts);
+            }
             $this->endpoint = $this->normalizeEndpoint($this->endpoint);
             $this->validate();
             $this->storage = new S3Storage;
@@ -101,6 +109,11 @@ public function submit()
         }
     }
 
+    public function updatedEndpointParts(): void
+    {
+        $this->endpointPartsChanged = true;
+    }
+
     private function connectionErrorDescription(\Throwable $exception): string
     {
         $settingsUrl = route('settings.advanced').'#endpoint-section';
diff --git a/app/Livewire/Storage/Form.php b/app/Livewire/Storage/Form.php
index 94a0657ef..30084dcd3 100644
--- a/app/Livewire/Storage/Form.php
+++ b/app/Livewire/Storage/Form.php
@@ -5,6 +5,7 @@
 use App\Models\S3Storage;
 use App\Rules\SafeWebhookUrl;
 use App\Rules\ValidS3BucketName;
+use App\Support\DomainUrlParts;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\DB;
@@ -24,6 +25,10 @@ class Form extends Component
 
     public string $endpoint;
 
+    public array $endpointParts = ['scheme' => 'https', 'host' => '', 'port' => '', 'path' => ''];
+
+    public bool $endpointPartsChanged = false;
+
     public string $bucket;
 
     public string $region;
@@ -101,6 +106,8 @@ private function syncData(bool $toModel = false): void
             $this->name = $this->storage->name;
             $this->description = $this->storage->description;
             $this->endpoint = $this->storage->endpoint;
+            $this->endpointParts = DomainUrlParts::split($this->endpoint);
+            $this->endpointPartsChanged = false;
             $this->bucket = $this->storage->bucket;
             $this->region = $this->storage->region;
             $this->key = $this->storage->key;
@@ -126,6 +133,9 @@ public function testConnection()
 
         try {
             $this->authorize('validateConnection', $this->storage);
+            if ($this->endpointPartsChanged) {
+                $this->endpoint = DomainUrlParts::compose(...$this->endpointParts);
+            }
             $testedStorage = new S3Storage;
             $testedStorage->uuid = $this->storage->uuid;
             $testedStorage->team_id = $this->storage->team_id;
@@ -166,6 +176,9 @@ public function submit()
     {
         try {
             $this->authorize('update', $this->storage);
+            if ($this->endpointPartsChanged) {
+                $this->endpoint = DomainUrlParts::compose(...$this->endpointParts);
+            }
 
             DB::transaction(function () {
                 $this->validate();
@@ -195,4 +208,9 @@ public function submit()
             return handleError($e, $this);
         }
     }
+
+    public function updatedEndpointParts(): void
+    {
+        $this->endpointPartsChanged = true;
+    }
 }
diff --git a/resources/views/components/forms/domain-input.blade.php b/resources/views/components/forms/domain-input.blade.php
index d6e6bce85..5a4b5f950 100644
--- a/resources/views/components/forms/domain-input.blade.php
+++ b/resources/views/components/forms/domain-input.blade.php
@@ -1,68 +1,27 @@
 @props([
     'id',
-    'wire' => true,
-    'value' => '',
     'errorId' => null,
     'hostLabel' => 'Domain',
     'hostPlaceholder' => 'app.example.com',
 ])
 
-<div class="grid gap-4 sm:grid-cols-[8rem_minmax(0,1fr)_8rem]" x-data="{
-    value: @if ($wire) @entangle($id) @else @js($value) @endif,
-    scheme: 'https',
-    host: '',
-    port: '',
-    path: '',
-    syncing: false,
-    init() {
-        this.read(this.value);
-        this.$watch('value', value => {
-            if (!this.syncing) this.read(value);
-        });
-        ['scheme', 'host', 'port', 'path'].forEach(part => this.$watch(part, () => this.write()));
-    },
-    read(value) {
-        if (!value) return;
-        try {
-            const url = new URL(value);
-            const authority = value.match(/^[a-z][a-z0-9+.-]*:\/\/(?:\[[^\]]+\]|[^\/:?#]+)(?::(\d+))?/i);
-            this.syncing = true;
-            this.scheme = url.protocol.replace(':', '') === 'http' ? 'http' : 'https';
-            this.host = url.hostname;
-            this.port = authority?.[1] || url.port;
-            this.path = `${url.pathname === '/' ? '' : url.pathname}${url.search}${url.hash}`;
-            this.$nextTick(() => this.syncing = false);
-        } catch (_) {}
-    },
-    write() {
-        if (this.syncing) return;
-        const path = this.path.trim();
-        const normalizedPath = path && !['/', '?', '#'].includes(path[0]) ? `/${path}` : path;
-        const next = `${this.scheme}://${this.host.trim()}${this.port ? `:${this.port}` : ''}${normalizedPath}`;
-        if (this.value !== next) {
-            this.syncing = true;
-            this.value = next;
-            this.$nextTick(() => this.syncing = false);
-        }
-    },
-}" x-modelable="value" {{ $attributes->whereStartsWith('x-model') }}>
+<div class="grid gap-4 sm:grid-cols-[8rem_minmax(0,1fr)_8rem]">
     <div class="min-w-0">
-        <x-forms.listbox id="{{ $id }}-protocol" label="Protocol" :wire="false" value="https"
-            x-model="scheme" portal :options="[
-                ['value' => 'https', 'label' => 'https'],
-                ['value' => 'http', 'label' => 'http'],
-            ]" />
+        <x-forms.listbox id="{{ $id }}.scheme" htmlId="{{ $id }}-protocol" label="Protocol" portal :options="[
+            ['value' => 'https', 'label' => 'https'],
+            ['value' => 'http', 'label' => 'http'],
+        ]" />
     </div>
 
     <div class="min-w-0">
         <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
-            <label for="{{ $id }}" class="mb-0! flex items-center gap-1.5 leading-4">
+            <label for="{{ $id }}-host" class="mb-0! flex items-center gap-1.5 leading-4">
                 {{ $hostLabel }} <x-highlighted text="*" />
             </label>
         </div>
-        <input id="{{ $id }}" type="text" class="input" x-model="host" placeholder="{{ $hostPlaceholder }}"
-            autocomplete="off" required />
-        @error($errorId ?? $id)
+        <input id="{{ $id }}-host" type="text" class="input" wire:model="{{ $id }}.host"
+            placeholder="{{ $hostPlaceholder }}" autocomplete="off" required />
+        @error($errorId ?? "{$id}.host")
             @php
                 preg_match('/(https?:\/\/\S+)$/', $message, $validationLinkMatches);
                 $validationLink = $validationLinkMatches[1] ?? null;
@@ -82,16 +41,16 @@
         <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
             <label for="{{ $id }}-port" class="mb-0! flex items-center gap-1.5 leading-4">Port</label>
         </div>
-        <input id="{{ $id }}-port" type="number" class="input" x-model="port" placeholder="3000"
-            min="1" max="65535" inputmode="numeric" />
+        <input id="{{ $id }}-port" type="number" class="input" wire:model="{{ $id }}.port"
+            placeholder="3000" min="1" max="65535" inputmode="numeric" />
     </div>
 
     <div class="min-w-0 sm:col-span-3">
         <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
             <label for="{{ $id }}-path" class="mb-0! flex items-center gap-1.5 leading-4">Path</label>
         </div>
-        <input id="{{ $id }}-path" type="text" class="input" x-model="path" placeholder="/api/v3"
-            autocomplete="off" />
+        <input id="{{ $id }}-path" type="text" class="input" wire:model="{{ $id }}.path"
+            placeholder="/api/v3" autocomplete="off" />
         <p class="mt-1 text-[12px] text-neutral-500 dark:text-fg-dim">
             Optional path, query, or fragment appended after the domain and port.
         </p>
diff --git a/resources/views/components/forms/listbox.blade.php b/resources/views/components/forms/listbox.blade.php
index bfcb4437e..4677911d9 100644
--- a/resources/views/components/forms/listbox.blade.php
+++ b/resources/views/components/forms/listbox.blade.php
@@ -90,6 +90,9 @@
             const gap = 4;
             const edge = 12;
             const triggerRect = trigger.getBoundingClientRect();
+            panel.style.width = 'max-content';
+            panel.style.minWidth = `${triggerRect.width}px`;
+            panel.style.maxWidth = `${window.innerWidth - (edge * 2)}px`;
             const panelWidth = Math.min(
                 Math.max(triggerRect.width, panel.offsetWidth),
                 window.innerWidth - (edge * 2),
@@ -107,8 +110,6 @@
             panel.style.top = `${top}px`;
             panel.style.left = `${left}px`;
             panel.style.width = `${panelWidth}px`;
-            panel.style.maxWidth = `${window.innerWidth - (edge * 2)}px`;
-            panel.style.minWidth = `${triggerRect.width}px`;
             this.positioned = true;
         },
     }" x-modelable="value" :class="{ 'pointer-events-none opacity-70': saving }"
diff --git a/resources/views/livewire/project/application/domains.blade.php b/resources/views/livewire/project/application/domains.blade.php
index fb5bf9b1d..04dd249c7 100644
--- a/resources/views/livewire/project/application/domains.blade.php
+++ b/resources/views/livewire/project/application/domains.blade.php
@@ -15,30 +15,14 @@
         domainSearch: '',
         modalOpen: @js($showEditDomainModal || $editDomainDnsFailed),
         editingServiceLabel: @js($editingService ?? ''),
-        localEditingIndex: @js($editingIndex),
-        localEditingDomain: @js($editingDomain),
-        localEditingService: @js($editingService),
-        openEditDomain(index, url, service) {
-            this.localEditingIndex = index;
-            this.localEditingDomain = url;
-            this.localEditingService = service;
-            this.editingServiceLabel = service || '';
+        openEditDomain() {
+            this.editingServiceLabel = $wire.editingService || '';
             this.modalOpen = true;
             this.$nextTick(() => document.getElementById('editingDomainLocal')?.focus?.());
         },
         closeEditDomain() {
             this.modalOpen = false;
             this.editingServiceLabel = '';
-            this.localEditingIndex = null;
-            this.localEditingDomain = '';
-            this.localEditingService = null;
-        },
-        prepareEditSubmit() {
-            // Sync Alpine → Livewire only when the user actually saves (one request).
-            $wire.editingIndex = this.localEditingIndex;
-            $wire.editingDomain = this.localEditingDomain;
-            $wire.editingService = this.localEditingService;
-            $wire.showEditDomainModal = true;
         },
         matchesDomainSearch(value) {
             return !this.domainSearch.trim() || value.toLowerCase().includes(this.domainSearch.trim().toLowerCase());
@@ -47,7 +31,7 @@
             return values.some((value) => this.matchesDomainSearch(value));
         },
     }"
-    @open-edit-domain.window="openEditDomain($event.detail.index, $event.detail.url, $event.detail.service)"
+    @open-edit-domain.window="openEditDomain()"
     @edit-domain-saved.window="closeEditDomain()">
     <x-application.settings-section id="domains-section" title="Domains">
         @can('update', $application)
@@ -128,7 +112,7 @@ class="button button-highlighted">
                                         :disabled="! auth()->user()->can('update', $application)" />
                                 @endif
 
-                                <x-forms.domain-input id="newDomain" />
+                                <x-forms.domain-input id="newDomainParts" errorId="newDomain" />
 
                                 @if ($addDomainDnsFailed)
                                     <x-callout type="danger" title="DNS is not pointing to the right IP">
@@ -320,7 +304,7 @@ class="icon-button shrink-0" aria-label="Close">
                         </header>
                         <div class="application-settings-section-body relative min-h-0 flex-1 overflow-y-auto"
                             style="-webkit-overflow-scrolling: touch;">
-                            <form @submit.prevent="prepareEditSubmit(); $wire.updateDomain()" class="flex flex-col gap-4">
+                            <form wire:submit="updateDomain" class="flex flex-col gap-4">
                                 <div x-show="editingServiceLabel" x-cloak class="w-full">
                                     <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
                                         <label class="mb-0! flex items-center gap-1 text-sm font-medium leading-4">Service</label>
@@ -328,8 +312,7 @@ class="icon-button shrink-0" aria-label="Close">
                                     <input type="text" class="input" readonly x-bind:value="editingServiceLabel" />
                                 </div>
 
-                                <x-forms.domain-input id="editingDomainLocal" errorId="editingDomain" :wire="false"
-                                    x-model="localEditingDomain" />
+                                <x-forms.domain-input id="editingDomainParts" errorId="editingDomain" />
 
                                 @if ($editDomainDnsFailed)
                                     <x-callout type="danger" title="DNS is not pointing to the right IP">
@@ -345,7 +328,7 @@ class="icon-button shrink-0" aria-label="Close">
                                 <div class="flex flex-wrap items-center justify-end gap-2 pt-2">
                                     @if ($editDomainDnsFailed)
                                         <x-forms.button type="button" isError
-                                            @click="prepareEditSubmit(); $wire.forceSaveEditDns = true; $wire.confirmUpdateDomainDespiteDns()">
+                                            wire:click="confirmUpdateDomainDespiteDns">
                                             Continue
                                         </x-forms.button>
                                     @else
diff --git a/resources/views/livewire/project/application/partials/domain-row.blade.php b/resources/views/livewire/project/application/partials/domain-row.blade.php
index d5baaee56..10aa21200 100644
--- a/resources/views/livewire/project/application/partials/domain-row.blade.php
+++ b/resources/views/livewire/project/application/partials/domain-row.blade.php
@@ -178,12 +178,7 @@ class="icon-button shrink-0" title="Check DNS" aria-label="Check DNS">
                             </x-forms.button>
                         @endif
                     @else
-                        <button type="button"
-                            @click="$dispatch('open-edit-domain', {
-                                index: {{ $index }},
-                                url: @js($row['url']),
-                                service: @js($row['service'] ?? null),
-                            })"
+                        <button type="button" wire:click="startEdit({{ $index }})"
                             class="icon-button shrink-0"
                             title="Edit domain" aria-label="Edit domain">
                             <x-reicon name="settings" class="size-3.5" />
diff --git a/resources/views/livewire/project/service/domains.blade.php b/resources/views/livewire/project/service/domains.blade.php
index 730d4b855..59f573601 100644
--- a/resources/views/livewire/project/service/domains.blade.php
+++ b/resources/views/livewire/project/service/domains.blade.php
@@ -19,29 +19,14 @@
         domainSearch: '',
         modalOpen: @js($showEditDomainModal || $editDomainDnsFailed),
         editingServiceLabel: '',
-        localEditingIndex: @js($editingIndex),
-        localEditingDomain: @js($editingDomain),
-        localEditingServiceApplicationId: @js($editingServiceApplicationId),
-        openEditDomain(index, url, serviceApplicationId, serviceLabel) {
-            this.localEditingIndex = index;
-            this.localEditingDomain = url;
-            this.localEditingServiceApplicationId = serviceApplicationId;
-            this.editingServiceLabel = serviceLabel || '';
+        openEditDomain() {
+            this.editingServiceLabel = $wire.serviceApps.find(app => app.id === $wire.editingServiceApplicationId)?.name || '';
             this.modalOpen = true;
             this.$nextTick(() => document.getElementById('editingDomainLocal')?.focus?.());
         },
         closeEditDomain() {
             this.modalOpen = false;
             this.editingServiceLabel = '';
-            this.localEditingIndex = null;
-            this.localEditingDomain = '';
-            this.localEditingServiceApplicationId = null;
-        },
-        prepareEditSubmit() {
-            $wire.editingIndex = this.localEditingIndex;
-            $wire.editingDomain = this.localEditingDomain;
-            $wire.editingServiceApplicationId = this.localEditingServiceApplicationId;
-            $wire.showEditDomainModal = true;
         },
         matchesDomainSearch(value) {
             return !this.domainSearch.trim() || value.toLowerCase().includes(this.domainSearch.trim().toLowerCase());
@@ -50,7 +35,7 @@
             return values.some((value) => this.matchesDomainSearch(value));
         },
     }"
-    @open-edit-domain.window="openEditDomain($event.detail.index, $event.detail.url, $event.detail.serviceApplicationId, $event.detail.serviceLabel)"
+    @open-edit-domain.window="openEditDomain()"
     @edit-domain-saved.window="closeEditDomain()">
     <x-application.settings-section id="service-domains-section" title="Domains">
         @can('update', $service)
@@ -116,7 +101,7 @@ class="button button-highlighted">
                                 ])->values()->all()"
                                 :disabled="! auth()->user()->can('update', $service)" />
 
-                            <x-forms.domain-input id="newDomain" />
+                            <x-forms.domain-input id="newDomainParts" errorId="newDomain" />
 
                             @if ($addDomainDnsFailed)
                                 <x-callout type="danger" title="DNS is not pointing to the right IP">
@@ -232,7 +217,7 @@ class="application-settings-form application-settings-section relative flex max-
                         </header>
                         <div class="application-settings-section-body relative min-h-0 flex-1 overflow-y-auto"
                             style="-webkit-overflow-scrolling: touch;">
-                            <form @submit.prevent="prepareEditSubmit(); $wire.updateDomain()" class="flex flex-col gap-4">
+                            <form wire:submit="updateDomain" class="flex flex-col gap-4">
                                 <div x-show="editingServiceLabel" x-cloak class="w-full">
                                     <div class="mb-1.5 flex h-4 w-full items-center gap-1.5">
                                         <label class="mb-0! flex items-center gap-1 text-sm font-medium leading-4">Service application</label>
@@ -243,8 +228,7 @@ class="application-settings-form application-settings-section relative flex max-
                                     </p>
                                 </div>
 
-                                <x-forms.domain-input id="editingDomainLocal" errorId="editingDomain" :wire="false"
-                                    x-model="localEditingDomain" />
+                                <x-forms.domain-input id="editingDomainParts" errorId="editingDomain" />
 
                                 @if ($editDomainDnsFailed)
                                     <x-callout type="danger" title="DNS is not pointing to the right IP">
@@ -260,7 +244,7 @@ class="application-settings-form application-settings-section relative flex max-
                                 <div class="flex flex-wrap items-center justify-end gap-2 pt-2">
                                     @if ($editDomainDnsFailed)
                                         <x-forms.button type="button" isError
-                                            @click="prepareEditSubmit(); $wire.forceSaveEditDns = true; $wire.confirmUpdateDomainDespiteDns()">
+                                            wire:click="confirmUpdateDomainDespiteDns">
                                             Continue
                                         </x-forms.button>
                                     @else
diff --git a/resources/views/livewire/project/service/partials/domain-table.blade.php b/resources/views/livewire/project/service/partials/domain-table.blade.php
index f245c27e0..81daa100f 100644
--- a/resources/views/livewire/project/service/partials/domain-table.blade.php
+++ b/resources/views/livewire/project/service/partials/domain-table.blade.php
@@ -201,13 +201,7 @@ class="h-7! shrink-0 px-2.5! text-[12px]!">
                                 </x-forms.button>
                             @endif
                         @else
-                            <button type="button"
-                                @click="$dispatch('open-edit-domain', {
-                                    index: {{ $index }},
-                                    url: @js($row['url']),
-                                serviceApplicationId: {{ (int) ($row['service_application_id'] ?? 0) }},
-                                serviceLabel: @js($serviceLabel),
-                            })"
+                            <button type="button" wire:click="startEdit({{ $index }})"
                                 class="icon-button shrink-0" title="Edit domain" aria-label="Edit domain">
                                 <x-reicon name="settings" class="size-3.5" />
                             </button>
diff --git a/resources/views/livewire/storage/create.blade.php b/resources/views/livewire/storage/create.blade.php
index 1154a7e90..c0d6a6e27 100644
--- a/resources/views/livewire/storage/create.blade.php
+++ b/resources/views/livewire/storage/create.blade.php
@@ -7,7 +7,7 @@
                 <x-forms.input required label="Name" id="name" />
                 <x-forms.input label="Description" id="description" />
             </div>
-            <x-forms.domain-input id="endpoint" host-label="Host"
+            <x-forms.domain-input id="endpointParts" errorId="endpoint" host-label="Host"
                 host-placeholder="minio.internal or 192.168.1.50" />
             <div class="flex gap-2">
                 <x-forms.input required label="Bucket" id="bucket" />
diff --git a/resources/views/livewire/storage/form.blade.php b/resources/views/livewire/storage/form.blade.php
index 2a76e7cc6..d13d632fb 100644
--- a/resources/views/livewire/storage/form.blade.php
+++ b/resources/views/livewire/storage/form.blade.php
@@ -17,7 +17,7 @@
             <x-forms.input canGate="update" :canResource="$storage" label="Description" id="description" />
             <div class="lg:col-span-2">
                 @can('update', $storage)
-                    <x-forms.domain-input id="endpoint" host-label="Host"
+                    <x-forms.domain-input id="endpointParts" errorId="endpoint" host-label="Host"
                         host-placeholder="minio.internal or 192.168.1.50" />
                 @else
                     <x-forms.input label="Endpoint" :value="$endpoint" disabled />
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index 288952a7d..fbe72230d 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -236,6 +236,22 @@
         ->toBe(['https://app.example.com', 'https://www.app.example.com']);
 });
 
+it('composes the complete port on the server without duplicating an existing www domain', function () {
+    $this->application->update(['fqdn' => 'https://www.example.com:3000']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->set('newDomainParts.host', 'example.com')
+        ->set('newDomainParts.port', '3000')
+        ->call('addDomain')
+        ->assertHasNoErrors()
+        ->assertDispatched('success');
+
+    expect(explode(',', (string) $this->application->fresh()->fqdn))->toBe([
+        'https://www.example.com:3000',
+        'https://example.com:3000',
+    ]);
+});
+
 it('adds multiple domains without replacing existing ones', function () {
     $this->application->update([
         'fqdn' => 'https://app.example.com',
@@ -1222,16 +1238,16 @@
     $component = file_get_contents(resource_path('views/components/forms/domain-input.blade.php'));
 
     expect($view)
-        ->toContain('<x-forms.domain-input id="newDomain"')
-        ->toContain('<x-forms.domain-input id="editingDomainLocal"')
+        ->toContain('<x-forms.domain-input id="newDomainParts"')
+        ->toContain('<x-forms.domain-input id="editingDomainParts"')
         ->not->toContain('placeholder="https://app.example.com"')
         ->and($component)
         ->toContain('Protocol')
         ->toContain('Domain')
         ->toContain('Port')
         ->toContain('Path')
-        ->toContain("scheme: 'https'")
-        ->toContain('<x-forms.listbox id="{{ $id }}-protocol"')
+        ->toContain('wire:model="{{ $id }}.host"')
+        ->toContain('<x-forms.listbox id="{{ $id }}.scheme"')
         ->not->toContain('<select id="{{ $id }}-protocol"')
         ->toContain("['value' => 'https', 'label' => 'https']")
         ->toContain("['value' => 'http', 'label' => 'http']")
diff --git a/tests/Feature/ListboxTriggerTruncationTest.php b/tests/Feature/ListboxTriggerTruncationTest.php
index 835f60c0c..a64a97dd8 100644
--- a/tests/Feature/ListboxTriggerTruncationTest.php
+++ b/tests/Feature/ListboxTriggerTruncationTest.php
@@ -60,6 +60,15 @@
         ->not->toContain('transform: translate(-50%, -50%) !important;');
 });
 
+test('portaled listboxes measure content without inheriting the viewport width', function () {
+    $listbox = file_get_contents(resource_path('views/components/forms/listbox.blade.php'));
+
+    expect($listbox)
+        ->toContain("panel.style.width = 'max-content';")
+        ->toContain('panel.style.minWidth = `${triggerRect.width}px`;')
+        ->toContain('Math.max(triggerRect.width, panel.offsetWidth)');
+});
+
 test('searchable listbox component uses shared trigger label truncation', function () {
     $html = Blade::render(<<<'BLADE'
         <x-forms.searchable-listbox id="tz" label="Timezone"
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index a4d7d7db3..36f602856 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -141,8 +141,8 @@
     $view = file_get_contents(resource_path('views/livewire/project/service/domains.blade.php'));
 
     expect($view)
-        ->toContain('<x-forms.domain-input id="newDomain"')
-        ->toContain('<x-forms.domain-input id="editingDomainLocal"')
+        ->toContain('<x-forms.domain-input id="newDomainParts"')
+        ->toContain('<x-forms.domain-input id="editingDomainParts"')
         ->not->toContain('placeholder="https://app.example.com"');
 });
 
diff --git a/tests/Feature/SplitUrlInputTest.php b/tests/Feature/SplitUrlInputTest.php
index e05cc9eb2..2f317c797 100644
--- a/tests/Feature/SplitUrlInputTest.php
+++ b/tests/Feature/SplitUrlInputTest.php
@@ -1,51 +1,31 @@
 <?php
 
-use Illuminate\Support\Facades\Blade;
-use Illuminate\Support\Facades\View;
-use Illuminate\Support\MessageBag;
-use Illuminate\Support\ViewErrorBag;
-
 it('renders configurable host copy for S3 endpoints', function () {
-    View::share('errors', new ViewErrorBag);
-
-    $html = Blade::render(<<<'BLADE'
-        <x-forms.domain-input id="endpoint" :wire="false" value="http://192.168.1.50:9000/s3"
-            host-label="Host" host-placeholder="minio.internal or 192.168.1.50" />
-    BLADE);
+    $html = file_get_contents(resource_path('views/components/forms/domain-input.blade.php'));
 
     expect($html)
-        ->toContain('Host')
-        ->toContain('minio.internal or 192.168.1.50')
-        ->toContain("scheme: 'https'")
-        ->toContain("host: ''")
-        ->toContain("port: ''")
-        ->toContain("path: ''");
+        ->toContain('{{ $hostLabel }}')
+        ->toContain('{{ $hostPlaceholder }}')
+        ->toContain('wire:model="{{ $id }}.host"')
+        ->toContain('wire:model="{{ $id }}.port"')
+        ->toContain('wire:model="{{ $id }}.path"');
 });
 
-it('does not reparse partial numeric hosts while typing', function () {
+it('binds URL parts directly to Livewire without Alpine synchronization', function () {
     $view = file_get_contents(resource_path('views/components/forms/domain-input.blade.php'));
-    $writeMethod = str($view)->between('write() {', "\n    },\n}")->value();
 
-    expect($writeMethod)
-        ->toContain('this.syncing = true;')
-        ->toContain('this.value = next;')
-        ->toContain('this.$nextTick(() => this.syncing = false);')
-        ->and(strpos($writeMethod, 'this.syncing = true;'))
-        ->toBeLessThan(strpos($writeMethod, 'this.value = next;'));
+    expect($view)
+        ->toContain('wire:model="{{ $id }}.host"')
+        ->toContain('wire:model="{{ $id }}.port"')
+        ->not->toContain('x-data=')
+        ->not->toContain('$watch');
 });
 
 it('keeps validation errors attached to the composed endpoint', function () {
-    $settingsUrl = route('settings.advanced').'#endpoint-section';
-    $errors = new ViewErrorBag;
-    $errors->put('default', new MessageBag([
-        'endpoint' => "The endpoint is invalid. Configure allowed internal targets: {$settingsUrl}",
-    ]));
-    View::share('errors', $errors);
-
-    $html = Blade::render('<x-forms.domain-input id="endpoint" :wire="false" />');
+    $html = file_get_contents(resource_path('views/components/forms/domain-input.blade.php'));
 
     expect($html)
-        ->toContain('The endpoint is invalid.')
-        ->toContain('href="'.$settingsUrl.'"')
+        ->toContain('@error($errorId ?? "{$id}.host")')
+        ->toContain('href="{{ $validationLink }}"')
         ->toContain('Set them here.');
 });
diff --git a/tests/Unit/S3StorageEndpointNormalizationTest.php b/tests/Unit/S3StorageEndpointNormalizationTest.php
index ee2ecc04a..09c1a8a25 100644
--- a/tests/Unit/S3StorageEndpointNormalizationTest.php
+++ b/tests/Unit/S3StorageEndpointNormalizationTest.php
@@ -11,11 +11,11 @@
 
     expect($createView)
         ->not->toContain('wire:model.blur="endpoint"')
-        ->toContain('<x-forms.domain-input id="endpoint"')
+        ->toContain('<x-forms.domain-input id="endpointParts"')
         ->toContain('host-label="Host"')
         ->toContain('host-placeholder="minio.internal or 192.168.1.50"')
         ->and($editView)
-        ->toContain('<x-forms.domain-input id="endpoint"')
+        ->toContain('<x-forms.domain-input id="endpointParts"')
         ->toContain('@can(\'update\', $storage)');
 });
 

From a5dedc07cd72d58a3f0a843fcee7d120f9000d7c Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 16:19:41 +0200
Subject: [PATCH 09/42] feat(storage): persist local images and unify clipboard
 copying

Add a private images disk with persistent container mounts and installation/upgrade setup, while routing avatar and project icon storage through it. Reuse the copy button component for API tokens and support clipboard copying through the shared helper.
---
 app/Services/AvatarStorageService.php         |  2 +-
 config/filesystems.php                        |  7 +++++
 docker-compose.prod.yml                       |  1 +
 docker-compose.windows.yml                    |  1 +
 other/nightly/docker-compose.prod.yml         |  1 +
 .../components/forms/copy-button.blade.php    |  9 ++----
 .../livewire/security/api-tokens.blade.php    | 13 +-------
 scripts/install.sh                            |  1 +
 scripts/upgrade.sh                            |  4 +++
 tests/Feature/PersistentImageStorageTest.php  | 31 +++++++++++++++++++
 tests/Feature/ProfileAvatarTest.php           | 22 ++++++-------
 tests/Feature/ProjectIconTest.php             | 14 ++++-----
 .../Feature/ResourceDetailsVisibilityTest.php | 13 ++++++--
 13 files changed, 79 insertions(+), 40 deletions(-)
 create mode 100644 tests/Feature/PersistentImageStorageTest.php

diff --git a/app/Services/AvatarStorageService.php b/app/Services/AvatarStorageService.php
index d1446ea37..983b144b9 100644
--- a/app/Services/AvatarStorageService.php
+++ b/app/Services/AvatarStorageService.php
@@ -71,7 +71,7 @@ public function delete(User $user): void
     protected function disk(string $storageType, ?int $s3StorageId): FilesystemAdapter
     {
         if ($storageType !== 's3') {
-            return Storage::disk('local');
+            return Storage::disk('images');
         }
 
         $storage = S3Storage::query()->whereKey($s3StorageId)->where('is_usable', true)->first();
diff --git a/config/filesystems.php b/config/filesystems.php
index ba0921a79..966cd0d5a 100644
--- a/config/filesystems.php
+++ b/config/filesystems.php
@@ -35,6 +35,13 @@
             'throw' => false,
         ],
 
+        'images' => [
+            'driver' => 'local',
+            'root' => storage_path('app/images'),
+            'visibility' => 'private',
+            'throw' => false,
+        ],
+
         'public' => [
             'driver' => 'local',
             'root' => storage_path('app/public'),
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index 9edc00e70..0d7caceb9 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -11,6 +11,7 @@ services:
       - /data/coolify/databases:/var/www/html/storage/app/databases
       - /data/coolify/services:/var/www/html/storage/app/services
       - /data/coolify/backups:/var/www/html/storage/app/backups
+      - /data/coolify/images:/var/www/html/storage/app/images
     environment:
       - APP_ENV=${APP_ENV:-production}
       - PHP_MEMORY_LIMIT=${PHP_MEMORY_LIMIT:-256M}
diff --git a/docker-compose.windows.yml b/docker-compose.windows.yml
index 43f6f0d0e..33709873f 100644
--- a/docker-compose.windows.yml
+++ b/docker-compose.windows.yml
@@ -25,6 +25,7 @@ services:
       - ./databases:/var/www/html/storage/app/databases
       - ./services:/var/www/html/storage/app/services
       - ./backups:/var/www/html/storage/app/backups
+      - ./images:/var/www/html/storage/app/images
     env_file:
       - .env
     environment:
diff --git a/other/nightly/docker-compose.prod.yml b/other/nightly/docker-compose.prod.yml
index 9edc00e70..0d7caceb9 100644
--- a/other/nightly/docker-compose.prod.yml
+++ b/other/nightly/docker-compose.prod.yml
@@ -11,6 +11,7 @@ services:
       - /data/coolify/databases:/var/www/html/storage/app/databases
       - /data/coolify/services:/var/www/html/storage/app/services
       - /data/coolify/backups:/var/www/html/storage/app/backups
+      - /data/coolify/images:/var/www/html/storage/app/images
     environment:
       - APP_ENV=${APP_ENV:-production}
       - PHP_MEMORY_LIMIT=${PHP_MEMORY_LIMIT:-256M}
diff --git a/resources/views/components/forms/copy-button.blade.php b/resources/views/components/forms/copy-button.blade.php
index 7a12cdfe4..e299610eb 100644
--- a/resources/views/components/forms/copy-button.blade.php
+++ b/resources/views/components/forms/copy-button.blade.php
@@ -1,21 +1,18 @@
 @props(['text', 'label' => null])
 
-<div class="w-full"
-    x-data="{ copied: false, canCopy: window.isSecureContext && typeof navigator.clipboard?.writeText === 'function' }">
+<div class="w-full" x-data="{ copied: false }">
     @if ($label)
         <label class="flex gap-1 items-center mb-1 text-sm font-medium text-black dark:text-white">{{ $label }}</label>
     @endif
     <div class="relative">
         <input type="text" value="{{ $text }}"
-            class="input bg-white dark:bg-coolgray-100 dark:read-only:bg-coolgray-100 dark:read-only:text-white"
-            x-bind:class="{ 'input-with-copy-button': canCopy }"
+            class="input input-with-copy-button bg-white dark:bg-coolgray-100 dark:read-only:bg-coolgray-100 dark:read-only:text-white"
             readonly
             @keydown.prevent @paste.prevent @cut.prevent @drop.prevent
             @focus="$event.target.select()">
         <button
-            x-show="canCopy"
             type="button"
-            @click.prevent="copied = true; navigator.clipboard.writeText({{ Js::from($text) }}); setTimeout(() => copied = false, 1000)"
+            @click.prevent="await window.copyToClipboard({{ Js::from($text) }}); copied = true; setTimeout(() => copied = false, 1000)"
             class="copy-button flex absolute inset-y-0 right-0 z-10 items-center pr-2 cursor-pointer text-neutral-500 transition-colors hover:text-black focus-visible:ring-2 focus-visible:ring-coollabs focus-visible:ring-offset-2 dark:text-neutral-400 dark:hover:text-white dark:focus-visible:ring-warning dark:focus-visible:ring-offset-base"
             title="Copy to clipboard"
             aria-label="Copy to clipboard">
diff --git a/resources/views/livewire/security/api-tokens.blade.php b/resources/views/livewire/security/api-tokens.blade.php
index 4f87f9f2c..38db6aa3a 100644
--- a/resources/views/livewire/security/api-tokens.blade.php
+++ b/resources/views/livewire/security/api-tokens.blade.php
@@ -109,18 +109,7 @@ class="listbox-panel top-full! mt-1! w-full!" role="listbox">
             @if (session()->has('token'))
                 <x-application.settings-section title="Copy your token"
                     description="This value will not be shown again after you leave this page.">
-                    <div class="relative" x-data="{ copied: false }">
-                        <input type="text" value="{{ session('token') }}" readonly
-                            class="input w-full pr-12! font-mono text-[12px] text-black dark:text-fg">
-                        <button type="button"
-                            x-on:click="copied = true; navigator.clipboard.writeText(@js(session('token'))); setTimeout(() => copied = false, 1200)"
-                            class="absolute top-1/2 right-2 flex size-7 -translate-y-1/2 items-center justify-center rounded-md text-neutral-400 transition-colors hover:bg-neutral-100 hover:text-black dark:hover:bg-white/[0.06] dark:hover:text-fg"
-                            title="Copy token">
-                            <x-reicon name="file-content" class="size-3.5" />
-                        </button>
-                        <span x-cloak x-show="copied"
-                            class="absolute top-full right-0 mt-1 text-[10px] text-success">Copied</span>
-                    </div>
+                    <x-forms.copy-button :text="session('token')" />
                 </x-application.settings-section>
             @endif
 
diff --git a/scripts/install.sh b/scripts/install.sh
index 1773f37f1..226b1cc5e 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -229,6 +229,7 @@ if [ "$WARNING_SPACE" = true ]; then
 fi
 
 mkdir -p /data/coolify/{source,ssh,applications,databases,backups,services,proxy,sentinel}
+mkdir -p /data/coolify/images
 mkdir -p /data/coolify/ssh/{keys,mux}
 mkdir -p /data/coolify/proxy/dynamic
 
diff --git a/scripts/upgrade.sh b/scripts/upgrade.sh
index a909d2e49..516a9d7eb 100644
--- a/scripts/upgrade.sh
+++ b/scripts/upgrade.sh
@@ -170,6 +170,10 @@ else
     log "Network 'coolify' already exists"
 fi
 
+mkdir -p /data/coolify/images/{avatars,project-icons}
+chown -R 9999:root /data/coolify/images
+chmod -R 700 /data/coolify/images
+
 # Fix SSH directory ownership if not owned by container user UID 9999 (fixes #6621)
 # Only changes owner — preserves existing group to respect custom setups
 SSH_OWNER=$(stat -c '%u' /data/coolify/ssh 2>/dev/null || echo "unknown")
diff --git a/tests/Feature/PersistentImageStorageTest.php b/tests/Feature/PersistentImageStorageTest.php
new file mode 100644
index 000000000..59d88e3f0
--- /dev/null
+++ b/tests/Feature/PersistentImageStorageTest.php
@@ -0,0 +1,31 @@
+<?php
+
+it('configures a dedicated private disk for persisted images', function () {
+    expect(config('filesystems.disks.images'))
+        ->toMatchArray([
+            'driver' => 'local',
+            'root' => storage_path('app/images'),
+            'visibility' => 'private',
+        ]);
+});
+
+it('persists images in stable and nightly production compose files', function (string $composeFile) {
+    expect(file_get_contents(base_path($composeFile)))
+        ->toContain('/data/coolify/images:/var/www/html/storage/app/images');
+})->with([
+    'stable' => 'docker-compose.prod.yml',
+    'nightly' => 'other/nightly/docker-compose.prod.yml',
+]);
+
+it('persists images in the Windows compose file', function () {
+    expect(file_get_contents(base_path('docker-compose.windows.yml')))
+        ->toContain('./images:/var/www/html/storage/app/images');
+});
+
+it('creates the persistent image directory during installation and upgrades', function (string $script) {
+    expect(file_get_contents(base_path($script)))
+        ->toContain('/data/coolify/images');
+})->with([
+    'install' => 'scripts/install.sh',
+    'upgrade' => 'scripts/upgrade.sh',
+]);
diff --git a/tests/Feature/ProfileAvatarTest.php b/tests/Feature/ProfileAvatarTest.php
index e5abb2ef5..cf313882f 100644
--- a/tests/Feature/ProfileAvatarTest.php
+++ b/tests/Feature/ProfileAvatarTest.php
@@ -19,7 +19,7 @@
 });
 
 it('compresses and stores an uploaded profile picture on the configured local storage', function () {
-    Storage::fake('local');
+    Storage::fake('images');
     $user = User::factory()->create(['name' => 'Test User']);
     $this->actingAs($user);
 
@@ -35,18 +35,18 @@
         ->and($user->avatar_storage_type)->toBe('local')
         ->and($user->avatar_s3_storage_id)->toBeNull();
 
-    Storage::disk('local')->assertExists($user->avatar_path);
+    Storage::disk('images')->assertExists($user->avatar_path);
 
-    $image = getimagesizefromstring(Storage::disk('local')->get($user->avatar_path));
+    $image = getimagesizefromstring(Storage::disk('images')->get($user->avatar_path));
 
     expect($image[0])->toBeLessThanOrEqual(256)
         ->and($image[1])->toBeLessThanOrEqual(256)
         ->and($image['mime'])->toBe('image/jpeg')
-        ->and(Storage::disk('local')->size($user->avatar_path))->toBeLessThan(100_000);
+        ->and(Storage::disk('images')->size($user->avatar_path))->toBeLessThan(100_000);
 });
 
 it('stores an already compressed browser JPEG without server image extensions', function () {
-    Storage::fake('local');
+    Storage::fake('images');
     $user = User::factory()->create(['name' => 'Test User']);
     $contents = base64_decode('/9j/4AAQSkZJRgABAQEAYABgAAD//gA7Q1JFQVRPUjogZ2QtanBlZyB2MS4wICh1c2luZyBJSkcgSlBFRyB2NjIpLCBxdWFsaXR5ID0gODAK/9sAQwAGBAUGBQQGBgUGBwcGCAoQCgoJCQoUDg8MEBcUGBgXFBYWGh0lHxobIxwWFiAsICMmJykqKRkfLTAtKDAlKCko/9sAQwEHBwcKCAoTCgoTKBoWGigoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgoKCgo/8AAEQgAAgACAwEiAAIRAQMRAf/EAB8AAAEFAQEBAQEBAAAAAAAAAAABAgMEBQYHCAkKC//EALUQAAIBAwMCBAMFBQQEAAABfQECAwAEEQUSITFBBhNRYQcicRQygZGhCCNCscEVUtHwJDNicoIJChYXGBkaJSYnKCkqNDU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6g4SFhoeIiYqSk5SVlpeYmZqio6Slpqeoqaqys7S1tre4ubrCw8TFxsfIycrS09TV1tfY2drh4uPk5ebn6Onq8fLz9PX29/j5+v/EAB8BAAMBAQEBAQEBAQEAAAAAAAABAgMEBQYHCAkKC//EALURAAIBAgQEAwQHBQQEAAECdwABAgMRBAUhMQYSQVEHYXETIjKBCBRCkaGxwQkjM1LwFWJy0QoWJDThJfEXGBkaJicoKSo1Njc4OTpDREVGR0hJSlNUVVZXWFlaY2RlZmdoaWpzdHV2d3h5eoKDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uLj5OXm5+jp6vLz9PX29/j5+v/aAAwDAQACEQMRAD8A+qaKKKAP/9k=');
     $path = tempnam(sys_get_temp_dir(), 'avatar');
@@ -55,17 +55,17 @@
 
     app(AvatarStorageService::class)->store($user, $upload);
 
-    expect(Storage::disk('local')->get("avatars/{$user->id}/avatar.jpg"))->toBe($contents);
+    expect(Storage::disk('images')->get("avatars/{$user->id}/avatar.jpg"))->toBe($contents);
 });
 
 it('serves the authenticated users profile picture', function () {
-    Storage::fake('local');
+    Storage::fake('images');
     $user = User::factory()->create([
         'name' => 'Test User',
         'avatar_path' => 'avatars/1/avatar.jpg',
         'avatar_storage_type' => 'local',
     ]);
-    Storage::disk('local')->put($user->avatar_path, 'avatar-content');
+    Storage::disk('images')->put($user->avatar_path, 'avatar-content');
 
     $this->withoutMiddleware()->actingAs($user)
         ->get(route('profile.avatar'))
@@ -74,13 +74,13 @@
 });
 
 it('removes the current profile picture', function () {
-    Storage::fake('local');
+    Storage::fake('images');
     $user = User::factory()->create([
         'name' => 'Test User',
         'avatar_path' => 'avatars/1/avatar.jpg',
         'avatar_storage_type' => 'local',
     ]);
-    Storage::disk('local')->put($user->avatar_path, 'avatar-content');
+    Storage::disk('images')->put($user->avatar_path, 'avatar-content');
     $this->actingAs($user);
 
     Livewire::test(Index::class)
@@ -88,7 +88,7 @@
         ->assertHasNoErrors();
 
     expect($user->refresh()->avatar_path)->toBeNull();
-    Storage::disk('local')->assertMissing('avatars/1/avatar.jpg');
+    Storage::disk('images')->assertMissing('avatars/1/avatar.jpg');
 });
 
 it('falls back cleanly when the avatars S3 storage no longer exists', function () {
diff --git a/tests/Feature/ProjectIconTest.php b/tests/Feature/ProjectIconTest.php
index 3599c0b4b..b5b6ed088 100644
--- a/tests/Feature/ProjectIconTest.php
+++ b/tests/Feature/ProjectIconTest.php
@@ -31,7 +31,7 @@
 });
 
 it('stores a project icon using the instance image storage setting', function () {
-    Storage::fake('local');
+    Storage::fake('images');
 
     $upload = UploadedFile::fake()->createWithContent('project.jpg', file_get_contents(base_path('tests/Fixtures/project-icon.jpg')));
 
@@ -47,16 +47,16 @@
         ->and($this->project->icon_storage_type)->toBe('local')
         ->and($this->project->icon_s3_storage_id)->toBeNull();
 
-    Storage::disk('local')->assertExists($this->project->icon_path);
+    Storage::disk('images')->assertExists($this->project->icon_path);
 });
 
 it('serves a project icon only to a member of its team', function () {
-    Storage::fake('local');
+    Storage::fake('images');
     $this->project->forceFill([
         'icon_path' => "project-icons/{$this->project->uuid}/icon.jpg",
         'icon_storage_type' => 'local',
     ])->save();
-    Storage::disk('local')->put($this->project->icon_path, 'icon-content');
+    Storage::disk('images')->put($this->project->icon_path, 'icon-content');
 
     $this->withoutMiddleware()->get(route('project.icon', ['project_uuid' => $this->project->uuid]))
         ->assertSuccessful()
@@ -73,20 +73,20 @@
 });
 
 it('removes a project icon', function () {
-    Storage::fake('local');
+    Storage::fake('images');
     $path = "project-icons/{$this->project->uuid}/icon.jpg";
     $this->project->forceFill([
         'icon_path' => $path,
         'icon_storage_type' => 'local',
     ])->save();
-    Storage::disk('local')->put($path, 'icon-content');
+    Storage::disk('images')->put($path, 'icon-content');
 
     Livewire::test(Edit::class, ['project_uuid' => $this->project->uuid])
         ->call('removeIcon')
         ->assertHasNoErrors();
 
     expect($this->project->refresh()->icon_path)->toBeNull();
-    Storage::disk('local')->assertMissing($path);
+    Storage::disk('images')->assertMissing($path);
 });
 
 it('exposes the icon URL on the projects index', function () {
diff --git a/tests/Feature/ResourceDetailsVisibilityTest.php b/tests/Feature/ResourceDetailsVisibilityTest.php
index 6466a33ed..29f611cba 100644
--- a/tests/Feature/ResourceDetailsVisibilityTest.php
+++ b/tests/Feature/ResourceDetailsVisibilityTest.php
@@ -38,15 +38,22 @@
     expect($html)
         ->toContain('label class="flex gap-1 items-center mb-1 text-sm font-medium text-black dark:text-white"')
         ->toContain('readonly')
-        ->toContain("canCopy: window.isSecureContext && typeof navigator.clipboard?.writeText === 'function'")
-        ->toContain("x-bind:class=\"{ 'input-with-copy-button': canCopy }\"")
-        ->toContain('x-show="canCopy"')
+        ->toContain('window.copyToClipboard')
+        ->toContain('input-with-copy-button')
         ->toContain('copy-button')
         ->toContain('aria-label="Copy to clipboard"')
         ->toContain('title="Copy to clipboard"')
         ->toContain('class="size-[18px] text-green-500"');
 });
 
+it('uses the shared copy field for newly issued api tokens', function () {
+    $blade = file_get_contents(resource_path('views/livewire/security/api-tokens.blade.php'));
+
+    expect($blade)
+        ->toContain('<x-forms.copy-button :text="session(\'token\')" />')
+        ->not->toContain('navigator.clipboard.writeText(@js(session(\'token\')))');
+});
+
 it('keeps copy button padding above settings-workspace input overrides', function () {
     $css = file_get_contents(resource_path('css/app.css'));
 

From c314319a7eff0fcd39e3ed0b75e8cd2c19e68e77 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 16:23:30 +0200
Subject: [PATCH 10/42] fix(sudo): preserve substitutions in backup shell
 commands (#11329)

---
 AGENTS.md                                     |  1 +
 bootstrap/helpers/sudo.php                    |  1 +
 tests/Unit/ParseCommandsByLineForSudoTest.php | 18 ++++++++++++++++++
 3 files changed, 20 insertions(+)

diff --git a/AGENTS.md b/AGENTS.md
index 86fc0f00b..5563a18ec 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -179,6 +179,7 @@ ## Key Conventions
 - Run `vendor/bin/pint --dirty --format agent` before finalizing changes
 - Every change must have tests — write or update tests, then run them. For bug fixes, follow TDD: write a failing test first, then fix the bug (see Test Enforcement below)
 - Check sibling files for conventions before creating new files
+- When adding remote shell commands, account for servers using non-root SSH users: commands pass through `parseCommandsByLineForSudo()`, so test pipelines, redirects, substitutions, and `sh -c`/`bash -c` scripts with the non-root sudo parser.
 
 ## Git Workflow
 
diff --git a/bootstrap/helpers/sudo.php b/bootstrap/helpers/sudo.php
index b8ef84687..397efc387 100644
--- a/bootstrap/helpers/sudo.php
+++ b/bootstrap/helpers/sudo.php
@@ -95,6 +95,7 @@ function parseCommandsByLineForSudo(Collection $commands, Server $server): array
         $isComplexPipeCommand = (
             $line->contains(' | sh') ||
             $line->contains(' | bash') ||
+            $line->contains(' sh -c ') ||
             ($line->contains(' | ') && ($line->contains('||') || $line->contains('&&')))
         );
 
diff --git a/tests/Unit/ParseCommandsByLineForSudoTest.php b/tests/Unit/ParseCommandsByLineForSudoTest.php
index f294de35f..b741b875f 100644
--- a/tests/Unit/ParseCommandsByLineForSudoTest.php
+++ b/tests/Unit/ParseCommandsByLineForSudoTest.php
@@ -24,6 +24,24 @@
     expect($result[0])->toBe("sudo bash -c 'curl https://releases.rancher.com/install-docker/27.3.sh | sh || curl https://get.docker.com | sh'");
 });
 
+test('preserves command substitutions inside database and volume backup scripts', function () {
+    $script = 'compressor=$(if command -v pigz; then printf pigz; else printf gzip; fi); exec $compressor';
+    $command = 'docker exec database pg_dumpall | docker run --rm -i helper sh -c '.escapeshellarg($script);
+    $volumeCommand = 'docker run --rm helper sh -c '.escapeshellarg($script).' > /data/coolify/backups/volume.tar.gz';
+
+    $result = parseCommandsByLineForSudo(collect([$command, $volumeCommand]), $this->server);
+
+    expect($result[0])
+        ->toStartWith("sudo bash -c '")
+        ->toContain('compressor=$(if command -v pigz; then')
+        ->not->toContain('$(sudo if')
+        ->not->toContain('| sudo docker run')
+        ->and($result[1])
+        ->toStartWith("sudo bash -c '")
+        ->toContain('compressor=$(if command -v pigz; then')
+        ->not->toContain('$(sudo if');
+});
+
 test('wraps complex Docker install command with multiple fallbacks', function () {
     $commands = collect([
         'curl --max-time 300 https://releases.rancher.com/install-docker/27.3.sh | sh || curl https://get.docker.com | sh -s -- --version 27.3',

From 5152698757c5aa4fe5c731f58003fcfd24075aac Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 16:27:00 +0200
Subject: [PATCH 11/42] fix(deployments): advance queue after cancellations
 (#11330)

---
 .../Application/CleanupPreviewDeployment.php  |  10 +-
 app/Http/Controllers/Api/DeployController.php |  68 ++++++++----
 app/Jobs/DeleteResourceJob.php                |  11 ++
 app/Mcp/Tools/CancelDeployment.php            |   7 ++
 .../Api/DeploymentCancellationApiTest.php     | 102 +++++++++++++++++-
 ...ApplicationPreviewQueueAdvancementTest.php |  94 ++++++++++++++++
 tests/Feature/Mcp/McpReadToolsTest.php        |  23 ++++
 7 files changed, 288 insertions(+), 27 deletions(-)
 create mode 100644 tests/Feature/ApplicationPreviewQueueAdvancementTest.php

diff --git a/app/Actions/Application/CleanupPreviewDeployment.php b/app/Actions/Application/CleanupPreviewDeployment.php
index 74e2ff615..803eef398 100644
--- a/app/Actions/Application/CleanupPreviewDeployment.php
+++ b/app/Actions/Application/CleanupPreviewDeployment.php
@@ -54,6 +54,14 @@ public function handle(
             $server
         );
 
+        if ($result['cancelled_deployments'] > 0) {
+            try {
+                next_after_cancel($server);
+            } catch (\Throwable $e) {
+                \Log::warning("Failed to advance deployment queue after cleaning up preview for application {$application->id}: {$e->getMessage()}");
+            }
+        }
+
         // Step 2: Stop and remove all running PR containers
         $result['killed_containers'] = $this->stopRunningContainers(
             $application,
@@ -98,13 +106,13 @@ private function cancelActiveDeployments(
                 $deployment->update([
                     'status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
                 ]);
+                $cancelled++;
 
                 // Add cancellation log entry
                 $deployment->addLogEntry('Deployment cancelled: Pull request closed.', 'stderr');
 
                 // Try to kill helper container if it exists
                 $this->killHelperContainer($deployment->deployment_uuid, $server);
-                $cancelled++;
             } catch (\Throwable $e) {
                 \Log::warning("Failed to cancel deployment {$deployment->id}: {$e->getMessage()}");
             }
diff --git a/app/Http/Controllers/Api/DeployController.php b/app/Http/Controllers/Api/DeployController.php
index 396844cb0..a0f0cc1ae 100644
--- a/app/Http/Controllers/Api/DeployController.php
+++ b/app/Http/Controllers/Api/DeployController.php
@@ -238,57 +238,71 @@ public function cancel_deployment(Request $request)
             ApplicationDeploymentStatus::IN_PROGRESS->value,
         ];
 
-        if (! in_array($deployment->status, $cancellableStatuses)) {
+        if (! in_array($deployment->status, $cancellableStatuses, true)) {
             return response()->json([
                 'message' => "Deployment cannot be cancelled. Current status: {$deployment->status}",
             ], 400);
         }
 
         // Perform the cancellation
+        $cancelled = false;
+        $deploymentServer = Server::whereTeamId($teamId)->find($deployment->server_id);
+
         try {
             $deployment_uuid = $deployment->deployment_uuid;
             $kill_command = "docker rm -f {$deployment_uuid}";
             $build_server_id = $deployment->build_server_id ?? $deployment->server_id;
 
             // Mark deployment as cancelled
-            $deployment->update([
-                'status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
-            ]);
+            $updated = ApplicationDeploymentQueue::whereKey($deployment->getKey())
+                ->whereIn('status', $cancellableStatuses)
+                ->update(['status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value]);
+
+            if ($updated !== 1) {
+                $deployment->refresh();
+
+                return response()->json([
+                    'message' => "Deployment cannot be cancelled. Current status: {$deployment->status}",
+                ], 400);
+            }
+
+            $deployment->status = ApplicationDeploymentStatus::CANCELLED_BY_USER->value;
+            $cancelled = true;
 
             // Get the server
             $server = Server::whereTeamId($teamId)->find($build_server_id);
 
-            if ($server) {
-                // Add cancellation log entry
-                $deployment->addLogEntry('Deployment cancelled by user via API.', 'stderr');
+            try {
+                if ($server) {
+                    // Add cancellation log entry
+                    $deployment->addLogEntry('Deployment cancelled by user via API.', 'stderr');
 
-                // Check if container exists and kill it
-                $checkCommand = "docker ps -a --filter name={$deployment_uuid} --format '{{.Names}}'";
-                $containerExists = instant_remote_process([$checkCommand], $server);
+                    // Check if container exists and kill it
+                    $checkCommand = "docker ps -a --filter name={$deployment_uuid} --format '{{.Names}}'";
+                    $containerExists = instant_remote_process([$checkCommand], $server);
 
-                if ($containerExists && str($containerExists)->trim()->isNotEmpty()) {
-                    instant_remote_process([$kill_command], $server);
-                    $deployment->addLogEntry('Deployment container stopped.');
-                } else {
-                    $deployment->addLogEntry('Deployment container not yet started. Will be cancelled when job checks status.');
-                }
+                    if ($containerExists && str($containerExists)->trim()->isNotEmpty()) {
+                        instant_remote_process([$kill_command], $server);
+                        $deployment->addLogEntry('Deployment container stopped.');
+                    } else {
+                        $deployment->addLogEntry('Deployment container not yet started. Will be cancelled when job checks status.');
+                    }
 
-                // Kill running process if process ID exists
-                if ($deployment->current_process_id) {
-                    try {
+                    // Kill running process if process ID exists
+                    if ($deployment->current_process_id) {
                         $processKillCommand = "kill -9 {$deployment->current_process_id}";
                         instant_remote_process([$processKillCommand], $server);
-                    } catch (\Throwable $e) {
-                        // Process might already be gone
                     }
                 }
+            } catch (\Throwable $e) {
+                \Log::warning("Failed to clean up cancelled deployment {$deployment->id}: {$e->getMessage()}");
             }
 
             auditLog('api.deployment.cancelled', [
                 'team_id' => $teamId,
                 'deployment_uuid' => $deployment->deployment_uuid,
-                'application_id' => $application?->id,
-                'application_uuid' => $application?->uuid,
+                'application_id' => $deployment->application_id,
+                'application_uuid' => $deployment->application?->uuid,
                 'server_id' => $deployment->server_id,
             ]);
 
@@ -301,6 +315,14 @@ public function cancel_deployment(Request $request)
             return response()->json([
                 'message' => 'Failed to cancel deployment: '.$e->getMessage(),
             ], 500);
+        } finally {
+            if ($cancelled) {
+                try {
+                    next_after_cancel($deploymentServer);
+                } catch (\Throwable $e) {
+                    \Log::warning("Failed to advance deployment queue after cancelling deployment {$deployment->id}: {$e->getMessage()}");
+                }
+            }
         }
     }
 
diff --git a/app/Jobs/DeleteResourceJob.php b/app/Jobs/DeleteResourceJob.php
index 436bf788b..124cc16cc 100644
--- a/app/Jobs/DeleteResourceJob.php
+++ b/app/Jobs/DeleteResourceJob.php
@@ -158,12 +158,15 @@ private function deleteApplicationPreview()
             ])
             ->get();
 
+        $cancelledDeployments = 0;
+
         foreach ($activeDeployments as $activeDeployment) {
             try {
                 // Mark deployment as cancelled
                 $activeDeployment->update([
                     'status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
                 ]);
+                $cancelledDeployments++;
 
                 // Add cancellation log entry
                 $activeDeployment->addLogEntry('Deployment cancelled: Pull request closed.', 'stderr');
@@ -186,6 +189,14 @@ private function deleteApplicationPreview()
             }
         }
 
+        if ($cancelledDeployments > 0) {
+            try {
+                next_after_cancel($server);
+            } catch (\Throwable $e) {
+                \Log::warning("Failed to advance deployment queue after deleting preview {$this->resource->id}: {$e->getMessage()}");
+            }
+        }
+
         try {
             if ($server->isSwarm()) {
                 $escapedStackName = escapeshellarg("{$application->uuid}-{$pull_request_id}");
diff --git a/app/Mcp/Tools/CancelDeployment.php b/app/Mcp/Tools/CancelDeployment.php
index bbec09126..1133f3429 100644
--- a/app/Mcp/Tools/CancelDeployment.php
+++ b/app/Mcp/Tools/CancelDeployment.php
@@ -104,6 +104,13 @@ public function handle(Request $request): Response
             'server_id' => $deployment->server_id,
         ]);
 
+        try {
+            $deploymentServer = Server::whereTeamId($teamId)->find($deployment->server_id);
+            next_after_cancel($deploymentServer);
+        } catch (\Throwable $e) {
+            \Log::warning("Failed to advance deployment queue after cancelling deployment {$deployment->id}: {$e->getMessage()}");
+        }
+
         return $this->mcpSuccess($request, $this->respond([
             'ok' => true,
             'message' => 'Deployment cancelled successfully.',
diff --git a/tests/Feature/Api/DeploymentCancellationApiTest.php b/tests/Feature/Api/DeploymentCancellationApiTest.php
index 046af059a..81087a68d 100644
--- a/tests/Feature/Api/DeploymentCancellationApiTest.php
+++ b/tests/Feature/Api/DeploymentCancellationApiTest.php
@@ -1,17 +1,32 @@
 <?php
 
 use App\Enums\ApplicationDeploymentStatus;
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
 use App\Models\InstanceSettings;
+use App\Models\Project;
 use App\Models\Server;
+use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    InstanceSettings::updateOrCreate(['id' => 0]);
+    config([
+        'cache.default' => 'array',
+        'session.driver' => 'array',
+        'queue.default' => 'sync',
+        'app.maintenance.driver' => 'file',
+    ]);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::updateOrCreate(['id' => 0], ['is_api_enabled' => true]));
 
     // Create a team with owner
     $this->team = Team::factory()->create();
@@ -119,23 +134,104 @@
     });
 
     test('cancels queued deployment and updates status in database', function () {
+        $otherTeam = Team::factory()->create();
+        $buildServer = Server::factory()->create(['team_id' => $otherTeam->id]);
         $deployment = ApplicationDeploymentQueue::create([
             'deployment_uuid' => 'queued-deployment-uuid',
             'application_id' => 1,
             'server_id' => $this->server->id,
+            'build_server_id' => $buildServer->id,
             'status' => ApplicationDeploymentStatus::QUEUED->value,
         ]);
 
-        $this->withHeaders([
+        $response = $this->withHeaders([
             'Authorization' => 'Bearer '.$this->bearerToken,
             'Content-Type' => 'application/json',
         ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
 
-        // The controller updates status before SSH calls, so DB state is always correct
+        $response->assertSuccessful()->assertJson([
+            'message' => 'Deployment cancelled successfully.',
+            'deployment_uuid' => $deployment->deployment_uuid,
+            'status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
+        ]);
+
         $deployment->refresh();
         expect($deployment->status)->toBe(ApplicationDeploymentStatus::CANCELLED_BY_USER->value);
     });
 
+    test('starts the next queued deployment after cancellation', function () {
+        Queue::fake();
+
+        $otherTeam = Team::factory()->create();
+        $buildServer = Server::factory()->create(['team_id' => $otherTeam->id]);
+        $destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+        $project = Project::factory()->create(['team_id' => $this->team->id]);
+        $environment = Environment::factory()->create(['project_id' => $project->id]);
+        $application = Application::factory()->create([
+            'environment_id' => $environment->id,
+            'destination_id' => $destination->id,
+            'destination_type' => $destination->getMorphClass(),
+        ]);
+        $deployment = ApplicationDeploymentQueue::create([
+            'deployment_uuid' => 'cancelled-queue-head-uuid',
+            'application_id' => $application->id,
+            'server_id' => $this->server->id,
+            'build_server_id' => $buildServer->id,
+            'destination_id' => $destination->id,
+            'commit' => 'first-commit',
+            'pull_request_id' => 0,
+            'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,
+        ]);
+        $nextDeployment = ApplicationDeploymentQueue::create([
+            'deployment_uuid' => 'next-queued-deployment-uuid',
+            'application_id' => $application->id,
+            'server_id' => $this->server->id,
+            'destination_id' => $destination->id,
+            'commit' => 'second-commit',
+            'pull_request_id' => 0,
+            'status' => ApplicationDeploymentStatus::QUEUED->value,
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
+
+        $response->assertSuccessful();
+        expect($nextDeployment->fresh()->status)->toBe(ApplicationDeploymentStatus::IN_PROGRESS->value);
+        Queue::assertPushed(ApplicationDeploymentJob::class, fn (ApplicationDeploymentJob $job) => $job->application_deployment_queue_id === $nextDeployment->id);
+    });
+
+    test('updates only a still cancellable deployment and treats cleanup as best effort', function () {
+        Process::fake(fn () => throw new RuntimeException('SSH unavailable'));
+
+        $deployment = ApplicationDeploymentQueue::create([
+            'deployment_uuid' => 'atomic-cancellation-uuid',
+            'application_id' => 1,
+            'server_id' => $this->server->id,
+            'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,
+        ]);
+        $updates = [];
+        DB::listen(function ($query) use (&$updates) {
+            if (str_starts_with(strtolower(ltrim($query->sql)), 'update')) {
+                $updates[] = strtolower($query->sql);
+            }
+        });
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/deployments/{$deployment->deployment_uuid}/cancel");
+
+        $response->assertSuccessful();
+        expect($deployment->fresh()->status)->toBe(ApplicationDeploymentStatus::CANCELLED_BY_USER->value)
+            ->and(collect($updates)->contains(
+                fn (string $sql) => str_contains($sql, 'application_deployment_queues')
+                    && str_contains($sql, 'status')
+                    && str_contains($sql, ' in '),
+            ))->toBeTrue();
+    });
+
     test('cancels in-progress deployment and updates status in database', function () {
         $deployment = ApplicationDeploymentQueue::create([
             'deployment_uuid' => 'in-progress-deployment-uuid',
diff --git a/tests/Feature/ApplicationPreviewQueueAdvancementTest.php b/tests/Feature/ApplicationPreviewQueueAdvancementTest.php
new file mode 100644
index 000000000..304839808
--- /dev/null
+++ b/tests/Feature/ApplicationPreviewQueueAdvancementTest.php
@@ -0,0 +1,94 @@
+<?php
+
+use App\Actions\Application\CleanupPreviewDeployment;
+use App\Jobs\ApplicationDeploymentJob;
+use App\Jobs\DeleteResourceJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => false,
+    ]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->firstOrFail();
+    $project = Project::factory()->create(['team_id' => $this->team->id]);
+    $environment = $project->environments()->first()
+        ?? Environment::factory()->create(['project_id' => $project->id]);
+    $this->application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+    $this->preview = ApplicationPreview::create([
+        'application_id' => $this->application->id,
+        'pull_request_id' => 42,
+        'pull_request_html_url' => 'https://github.com/example/repository/pull/42',
+        'fqdn' => 'https://pr-42.example.com',
+    ]);
+
+    Process::fake(['*' => Process::result(output: '')]);
+    Queue::fake();
+});
+
+function createPreviewDeploymentsForQueueAdvancementTest(): array
+{
+    $activeDeployment = ApplicationDeploymentQueue::create([
+        'application_id' => test()->application->id,
+        'deployment_uuid' => 'preview-active-'.fake()->uuid(),
+        'status' => 'in_progress',
+        'server_id' => test()->server->id,
+        'destination_id' => test()->destination->id,
+        'commit' => 'preview-commit',
+        'pull_request_id' => 42,
+    ]);
+    $nextDeployment = ApplicationDeploymentQueue::create([
+        'application_id' => test()->application->id,
+        'deployment_uuid' => 'preview-next-'.fake()->uuid(),
+        'status' => 'queued',
+        'server_id' => test()->server->id,
+        'destination_id' => test()->destination->id,
+        'commit' => 'next-commit',
+        'pull_request_id' => 0,
+    ]);
+
+    return [$activeDeployment, $nextDeployment];
+}
+
+test('preview cleanup advances the deployment queue after cancelling active deployments', function () {
+    [$activeDeployment, $nextDeployment] = createPreviewDeploymentsForQueueAdvancementTest();
+
+    CleanupPreviewDeployment::run($this->application, 42, $this->preview);
+
+    expect($activeDeployment->fresh()->status)->toBe('cancelled-by-user')
+        ->and($nextDeployment->fresh()->status)->toBe('in_progress');
+    Queue::assertPushed(ApplicationDeploymentJob::class, fn (ApplicationDeploymentJob $job) => $job->application_deployment_queue_id === $nextDeployment->id);
+});
+
+test('deleting a preview advances the deployment queue after cancelling active deployments', function () {
+    [$activeDeployment, $nextDeployment] = createPreviewDeploymentsForQueueAdvancementTest();
+
+    (new DeleteResourceJob($this->preview))->handle();
+
+    expect($activeDeployment->fresh()->status)->toBe('cancelled-by-user')
+        ->and($nextDeployment->fresh()->status)->toBe('in_progress')
+        ->and(ApplicationPreview::withTrashed()->find($this->preview->id))->toBeNull();
+    Queue::assertPushed(ApplicationDeploymentJob::class, fn (ApplicationDeploymentJob $job) => $job->application_deployment_queue_id === $nextDeployment->id);
+});
diff --git a/tests/Feature/Mcp/McpReadToolsTest.php b/tests/Feature/Mcp/McpReadToolsTest.php
index b755e75b9..c3433bf45 100644
--- a/tests/Feature/Mcp/McpReadToolsTest.php
+++ b/tests/Feature/Mcp/McpReadToolsTest.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Jobs\ApplicationDeploymentJob;
 use App\Mcp\Concerns\BuildsResponse;
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
@@ -30,11 +31,19 @@
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Queue;
 use Illuminate\Support\Str;
 
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
+    config([
+        'cache.default' => 'array',
+        'session.driver' => 'array',
+        'queue.default' => 'sync',
+        'app.maintenance.driver' => 'file',
+    ]);
+
     InstanceSettings::query()->where('id', 0)->delete();
     InstanceSettings::query()->delete();
     $settings = new InstanceSettings(['is_mcp_server_enabled' => true]);
@@ -1744,6 +1753,7 @@ function mcpReadJson($response): array
     Process::fake([
         '*' => Process::result(output: ''),
     ]);
+    Queue::fake();
 
     $deployment = ApplicationDeploymentQueue::create([
         'application_id' => $this->application->id,
@@ -1755,6 +1765,17 @@ function mcpReadJson($response): array
         'commit' => 'abc',
         'current_process_id' => '12345',
     ]);
+    $nextDeployment = ApplicationDeploymentQueue::create([
+        'application_id' => $this->application->id,
+        'deployment_uuid' => 'dep-next-'.fake()->uuid(),
+        'status' => 'queued',
+        'server_id' => $this->server->id,
+        'destination_id' => $this->destination->id,
+        'application_name' => $this->application->name,
+        'server_name' => $this->server->name,
+        'commit' => 'def',
+        'pull_request_id' => 0,
+    ]);
 
     $token = $this->user->createToken('mcp-cancel', ['read', 'deploy'])->plainTextToken;
     $ok = test()->withHeaders([
@@ -1777,6 +1798,8 @@ function mcpReadJson($response): array
     expect($body['data']['ok'])->toBeTrue()
         ->and($body['data']['status'])->toBe('cancelled-by-user');
     expect($deployment->fresh()->status)->toBe('cancelled-by-user');
+    expect($nextDeployment->fresh()->status)->toBe('in_progress');
+    Queue::assertPushed(ApplicationDeploymentJob::class, fn (ApplicationDeploymentJob $job) => $job->application_deployment_queue_id === $nextDeployment->id);
 
     $otherTeam = Team::factory()->create();
     $otherServer = Server::factory()->create(['team_id' => $otherTeam->id]);

From db1316f878d3238d3cbdfe386600136783da1441 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 17:00:00 +0200
Subject: [PATCH 12/42] fix(backups): render form for directory-only targets
 (#11332)

---
 app/Livewire/Project/Application/Backup/Create.php |  2 +-
 tests/Feature/VolumeBackupTest.php                 | 12 ++++++++++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/app/Livewire/Project/Application/Backup/Create.php b/app/Livewire/Project/Application/Backup/Create.php
index 68115e775..f26d81b88 100644
--- a/app/Livewire/Project/Application/Backup/Create.php
+++ b/app/Livewire/Project/Application/Backup/Create.php
@@ -82,7 +82,7 @@ public function mount(): void
                 'type' => 'Directory',
                 'name' => $directory->fs_path,
             ]);
-        $this->targets = $volumes->concat($directories)->values();
+        $this->targets = collect($volumes->concat($directories)->all())->values();
         $this->targetKey = $this->selectedTargetKey ?? data_get($this->targets->first(), 'key');
         $this->loadSelectedBackup();
     }
diff --git a/tests/Feature/VolumeBackupTest.php b/tests/Feature/VolumeBackupTest.php
index 88e679a7c..496894591 100644
--- a/tests/Feature/VolumeBackupTest.php
+++ b/tests/Feature/VolumeBackupTest.php
@@ -222,6 +222,18 @@
     expect(ScheduledVolumeBackup::query()->sole()->backupable->is($directory))->toBeTrue();
 });
 
+it('renders the backup form for an application with only a directory target', function () {
+    $team = Team::factory()->create();
+    signInForVolumeBackups($this, $team);
+    [$application, $volume] = createVolumeBackupApplication($team);
+    $volume->delete();
+    $directory = createApplicationBackupDirectory($application);
+
+    Livewire::test(CreateScheduledVolumeBackup::class, ['application' => $application])
+        ->assertSet('targetKey', 'directory:'.$directory->id)
+        ->assertSuccessful();
+});
+
 it('rejects files and directory mounts owned by another application as backup targets', function () {
     $team = Team::factory()->create();
     signInForVolumeBackups($this, $team);

From 5c6defbc7618008529e807dfd8ab7f77152d1a5d Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 18:29:09 +0200
Subject: [PATCH 13/42] fix(backups): honor full dumps and selected storage
 deletion (#11331)

---
 app/Jobs/DatabaseBackupJob.php                | 55 ++++++++++---------
 .../Project/Database/BackupExecutions.php     | 26 ++++++---
 app/Models/ScheduledDatabaseBackup.php        |  1 +
 tests/Feature/Jobs/DatabaseBackupJobTest.php  | 46 ++++++++++++++++
 4 files changed, 92 insertions(+), 36 deletions(-)

diff --git a/app/Jobs/DatabaseBackupJob.php b/app/Jobs/DatabaseBackupJob.php
index 82e35b73c..1838feb9e 100644
--- a/app/Jobs/DatabaseBackupJob.php
+++ b/app/Jobs/DatabaseBackupJob.php
@@ -279,33 +279,10 @@ public function handle(): void
                 } else {
                     return;
                 }
-            } else {
-                if (str($databaseType)->contains('postgres')) {
-                    // Format: db1,db2,db3
-                    $databasesToBackup = explode(',', $databasesToBackup);
-                    $databasesToBackup = array_map('trim', $databasesToBackup);
-                } elseif (str($databaseType)->contains('mongo')) {
-                    // Format: db1:collection1,collection2|db2:collection3,collection4
-                    // Only explode if it's a string, not if it's already an array
-                    if (is_string($databasesToBackup)) {
-                        $databasesToBackup = explode('|', $databasesToBackup);
-                        $databasesToBackup = array_map('trim', $databasesToBackup);
-                    }
-                } elseif (str($databaseType)->contains('mysql')) {
-                    // Format: db1,db2,db3
-                    $databasesToBackup = explode(',', $databasesToBackup);
-                    $databasesToBackup = array_map('trim', $databasesToBackup);
-                } elseif (str($databaseType)->contains('mariadb')) {
-                    // Format: db1,db2,db3
-                    $databasesToBackup = explode(',', $databasesToBackup);
-                    $databasesToBackup = array_map('trim', $databasesToBackup);
-                } elseif ($this->database instanceof StandaloneClickhouse) {
-                    // Format: db1,db2,db3
-                    $databasesToBackup = explode(',', $databasesToBackup);
-                    $databasesToBackup = array_map('trim', $databasesToBackup);
-                } else {
-                    return;
-                }
+            }
+            $databasesToBackup = $this->databasesToBackup($databaseType, $databasesToBackup);
+            if ($databasesToBackup === []) {
+                return;
             }
             $this->backup_dir = backup_dir().'/databases/'.str($this->team->name)->slug().'-'.$this->team->id.'/'.$this->directory_name;
             if ($this->database->name === 'coolify-db') {
@@ -600,6 +577,30 @@ private function backup_standalone_mongodb(string $databaseWithCollections): voi
         }
     }
 
+    /** @return array<int, string> */
+    private function databasesToBackup(string $databaseType, string|array $databases): array
+    {
+        $type = str($databaseType);
+
+        if ($this->backup->dump_all && $type->contains(['postgres', 'mysql', 'mariadb'])) {
+            return ['all'];
+        }
+
+        if (is_array($databases)) {
+            return $databases;
+        }
+
+        if ($type->contains('mongo')) {
+            return array_map('trim', explode('|', $databases));
+        }
+
+        if ($type->contains(['postgres', 'mysql', 'mariadb', 'clickhouse'])) {
+            return array_map('trim', explode(',', $databases));
+        }
+
+        return [];
+    }
+
     private function backup_standalone_postgresql(string $database): void
     {
         try {
diff --git a/app/Livewire/Project/Database/BackupExecutions.php b/app/Livewire/Project/Database/BackupExecutions.php
index 41fb1681b..73877a945 100644
--- a/app/Livewire/Project/Database/BackupExecutions.php
+++ b/app/Livewire/Project/Database/BackupExecutions.php
@@ -98,26 +98,34 @@ public function deleteBackup($executionId, $password, $selectedActions = [])
             return;
         }
 
-        $server = $execution->scheduledDatabaseBackup->database->getMorphClass() === ServiceDatabase::class
-            ? $execution->scheduledDatabaseBackup->database->service->destination->server
-            : $execution->scheduledDatabaseBackup->database->destination->server;
-
         try {
-            if ($execution->filename) {
-                deleteBackupsLocally($execution->filename, $server);
+            $deleteFromS3 = in_array('delete_backup_s3', $selectedActions, true);
 
-                if ($this->delete_backup_s3 && $execution->scheduledDatabaseBackup->s3) {
-                    deleteBackupsS3($execution->filename, $execution->scheduledDatabaseBackup->s3);
+            if ($execution->filename && ! $execution->local_storage_deleted) {
+                $server = $this->backup->server();
+                if (! $server) {
+                    throw new \RuntimeException('The backup server is unavailable.');
                 }
+
+                deleteBackupsLocally($execution->filename, $server, throwError: true);
+            }
+
+            if ($deleteFromS3 && $execution->s3_uploaded && ! $execution->s3_storage_deleted) {
+                if (! $execution->scheduledDatabaseBackup->s3) {
+                    throw new \RuntimeException('The S3 storage is unavailable.');
+                }
+
+                deleteBackupsS3($execution->filename, $execution->scheduledDatabaseBackup->s3);
             }
 
             $execution->delete();
+            $this->delete_backup_s3 = false;
             $this->dispatch('success', 'Backup deleted.');
             $this->refreshBackupExecutions();
         } catch (\Exception $e) {
             $this->dispatch('error', 'Failed to delete backup: '.$e->getMessage());
 
-            return true;
+            return false;
         }
 
         return true;
diff --git a/app/Models/ScheduledDatabaseBackup.php b/app/Models/ScheduledDatabaseBackup.php
index 4038c6288..e41c793c8 100644
--- a/app/Models/ScheduledDatabaseBackup.php
+++ b/app/Models/ScheduledDatabaseBackup.php
@@ -11,6 +11,7 @@ class ScheduledDatabaseBackup extends BaseModel
     protected function casts(): array
     {
         return [
+            'dump_all' => 'boolean',
             'database_backup_retention_max_storage_locally' => 'float',
             'database_backup_retention_max_storage_s3' => 'float',
         ];
diff --git a/tests/Feature/Jobs/DatabaseBackupJobTest.php b/tests/Feature/Jobs/DatabaseBackupJobTest.php
index 7e47126ab..23e1bbd8d 100644
--- a/tests/Feature/Jobs/DatabaseBackupJobTest.php
+++ b/tests/Feature/Jobs/DatabaseBackupJobTest.php
@@ -44,6 +44,14 @@
     expect($casts['s3_storage_deleted'])->toBe('boolean');
 });
 
+test('scheduled database backup casts full dump selection to boolean', function () {
+    $model = new ScheduledDatabaseBackup;
+
+    expect($model->getCasts())->toMatchArray(['dump_all' => 'boolean'])
+        ->and((new ScheduledDatabaseBackup(['dump_all' => '0']))->dump_all)->toBeFalse()
+        ->and((new ScheduledDatabaseBackup(['dump_all' => '1']))->dump_all)->toBeTrue();
+});
+
 test('upload_to_s3 throws exception and disables s3 when storage is null', function () {
     $backup = ScheduledDatabaseBackup::create([
         'frequency' => '0 0 * * *',
@@ -362,3 +370,41 @@
         ->and(substr_count($source, '$this->buildCompressedDumpCommand($dumpCommand)'))->toBe(2)
         ->and($source)->not->toContain('| gzip >');
 });
+
+test('full database dumps create one logical all-databases archive regardless of saved database names', function (string $databaseType) {
+    $backup = new ScheduledDatabaseBackup([
+        'dump_all' => true,
+        'databases_to_backup' => 'default,analytics',
+    ]);
+    $job = new DatabaseBackupJob($backup);
+
+    $databases = (new ReflectionClass($job))
+        ->getMethod('databasesToBackup')
+        ->invoke($job, $databaseType, $backup->databases_to_backup);
+
+    expect($databases)->toBe(['all']);
+})->with(['postgresql', 'mysql', 'mariadb']);
+
+test('specific database dumps keep every selected database', function (string $databaseType) {
+    $backup = new ScheduledDatabaseBackup([
+        'dump_all' => false,
+        'databases_to_backup' => 'default, analytics',
+    ]);
+    $job = new DatabaseBackupJob($backup);
+
+    $databases = (new ReflectionClass($job))
+        ->getMethod('databasesToBackup')
+        ->invoke($job, $databaseType, $backup->databases_to_backup);
+
+    expect($databases)->toBe(['default', 'analytics']);
+})->with(['postgresql', 'mysql', 'mariadb']);
+
+test('individual database backup deletion surfaces local failures and honors selected S3 deletion', function () {
+    $source = file_get_contents(app_path('Livewire/Project/Database/BackupExecutions.php'));
+
+    expect($source)
+        ->toContain("in_array('delete_backup_s3', \$selectedActions, true)")
+        ->toContain('deleteBackupsLocally($execution->filename, $server, throwError: true)')
+        ->toContain("throw new \\RuntimeException('The backup server is unavailable.')")
+        ->not->toContain('deleteBackupsLocally($execution->filename, $server);');
+});

From 43cd1f4c0dfc883ab8c8cdea923b5be2aa4cd0c3 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 20:56:02 +0200
Subject: [PATCH 14/42] chore(release): bump Coolify versions to 4.3.8

---
 config/constants.php                       | 2 +-
 other/nightly/versions.json                | 4 ++--
 tests/Unit/ProductionImageWorkflowTest.php | 6 +++---
 versions.json                              | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index 76e34334c..bc2151467 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.7',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.8',
         'helper_version' => '1.0.15',
         'realtime_version' => '1.0.17',
         'railpack_version' => '0.23.0',
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index 2f449eed8..ebc1151c3 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,10 +1,10 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.7"
+            "version": "4.3.8"
         },
         "nightly": {
-            "version": "4.3.8"
+            "version": "4.3.9"
         },
         "helper": {
             "version": "1.0.15"
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index 754eca1c3..e57587f28 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,9 +23,9 @@
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.7'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.7')
-        ->and($versions['coolify']['nightly']['version'])->toBe('4.3.8')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.8'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.8')
+        ->and($versions['coolify']['nightly']['version'])->toBe('4.3.9')
         ->and($nightlyVersions)->toBe($versions);
 });
 
diff --git a/versions.json b/versions.json
index 2f449eed8..ebc1151c3 100644
--- a/versions.json
+++ b/versions.json
@@ -1,10 +1,10 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.7"
+            "version": "4.3.8"
         },
         "nightly": {
-            "version": "4.3.8"
+            "version": "4.3.9"
         },
         "helper": {
             "version": "1.0.15"

From 9d64b30612af2d80bf32ff46a09d9d9bdb5f3b64 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 21:26:57 +0200
Subject: [PATCH 15/42] fix(ui): improve listbox hover state and Traefik
 redirects

Add an opaque hover background for listbox triggers and preserve single-escaped
Traefik redirect capture groups when generating application labels.
---
 bootstrap/helpers/docker.php                   | 11 ++++++++---
 resources/css/app.css                          |  4 ++++
 tests/Feature/ListboxTriggerTruncationTest.php |  7 +++++++
 tests/Unit/TraefikServiceNameSegmentTest.php   | 12 ++++++++++++
 4 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index 3be2ae008..d4466d389 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -563,7 +563,7 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
     return $labels->sort();
 }
 
-function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null)
+function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_https_enabled = false, $onlyPort = null, ?Collection $serviceLabels = null, ?bool $is_gzip_enabled = true, ?bool $is_stripprefix_enabled = true, ?string $service_name = null, bool $generate_unique_uuid = false, ?string $image = null, string $redirect_direction = 'both', bool $is_http_basic_auth_enabled = false, ?string $http_basic_auth_username = null, ?string $http_basic_auth_password = null, ?Collection $noindex_domains = null, bool $escape_redirect_replacement_for_compose = true)
 {
     $labels = collect([]);
     $labels->push('traefik.enable=true');
@@ -646,14 +646,15 @@ function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_
 
             $to_www_name = "{$loop}-{$uuid}-to-www";
             $to_non_www_name = "{$loop}-{$uuid}-to-non-www";
+            $redirect_capture_prefix = $escape_redirect_replacement_for_compose ? '$$' : '$';
             $redirect_to_non_www = [
                 "traefik.http.middlewares.{$to_non_www_name}.redirectregex.regex=^(http|https)://www\.(.+)",
-                "traefik.http.middlewares.{$to_non_www_name}.redirectregex.replacement=\$\${1}://\$\${2}",
+                "traefik.http.middlewares.{$to_non_www_name}.redirectregex.replacement={$redirect_capture_prefix}{1}://{$redirect_capture_prefix}{2}",
                 "traefik.http.middlewares.{$to_non_www_name}.redirectregex.permanent=false",
             ];
             $redirect_to_www = [
                 "traefik.http.middlewares.{$to_www_name}.redirectregex.regex=^(http|https)://(?:www\.)?(.+)",
-                "traefik.http.middlewares.{$to_www_name}.redirectregex.replacement=\$\${1}://www.\$\${2}",
+                "traefik.http.middlewares.{$to_www_name}.redirectregex.replacement={$redirect_capture_prefix}{1}://www.{$redirect_capture_prefix}{2}",
                 "traefik.http.middlewares.{$to_www_name}.redirectregex.permanent=false",
             ];
             if ($schema === 'https') {
@@ -876,6 +877,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                             http_basic_auth_username: $application->http_basic_auth_username,
                             http_basic_auth_password: $application->http_basic_auth_password,
                             noindex_domains: $noindexDomains,
+                            escape_redirect_replacement_for_compose: false,
                         ));
                         break;
                 }
@@ -892,6 +894,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                     http_basic_auth_username: $application->http_basic_auth_username,
                     http_basic_auth_password: $application->http_basic_auth_password,
                     noindex_domains: $noindexDomains,
+                    escape_redirect_replacement_for_compose: false,
                 ));
                 $labels = $labels->merge(fqdnLabelsForCaddy(
                     network: $application->destination->network,
@@ -932,6 +935,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                         http_basic_auth_username: $application->http_basic_auth_username,
                         http_basic_auth_password: $application->http_basic_auth_password,
                         noindex_domains: $noindexDomains,
+                        escape_redirect_replacement_for_compose: false,
                     ));
                     break;
                 case ProxyTypes::CADDY->value:
@@ -962,6 +966,7 @@ function generateLabelsApplication(Application $application, ?ApplicationPreview
                 http_basic_auth_username: $application->http_basic_auth_username,
                 http_basic_auth_password: $application->http_basic_auth_password,
                 noindex_domains: $noindexDomains,
+                escape_redirect_replacement_for_compose: false,
             ));
             $labels = $labels->merge(fqdnLabelsForCaddy(
                 network: $application->destination->network,
diff --git a/resources/css/app.css b/resources/css/app.css
index 95e0207ce..566f29031 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -1903,6 +1903,10 @@ .dark .listbox-trigger {
     color: var(--color-fg);
 }
 
+.listbox-trigger:hover {
+    background: var(--coollabs-fill);
+}
+
 .listbox-trigger:disabled {
     cursor: not-allowed;
     opacity: 0.5;
diff --git a/tests/Feature/ListboxTriggerTruncationTest.php b/tests/Feature/ListboxTriggerTruncationTest.php
index a64a97dd8..a35ff8cbe 100644
--- a/tests/Feature/ListboxTriggerTruncationTest.php
+++ b/tests/Feature/ListboxTriggerTruncationTest.php
@@ -22,6 +22,13 @@
         ->toMatch('/\.application-settings-workspace \.listbox-trigger[^}]*height: 2rem;/s');
 });
 
+test('listbox trigger uses an opaque background on hover', function () {
+    $css = file_get_contents(resource_path('css/app.css'));
+
+    expect($css)
+        ->toMatch('/\.listbox-trigger:hover \{[^}]*background: var\(--coollabs-fill\);/s');
+});
+
 test('listbox component uses shared trigger label truncation', function () {
     $html = Blade::render(<<<'BLADE'
         <x-forms.listbox id="longOption" label="Example"
diff --git a/tests/Unit/TraefikServiceNameSegmentTest.php b/tests/Unit/TraefikServiceNameSegmentTest.php
index 60dd1f153..ef882961e 100644
--- a/tests/Unit/TraefikServiceNameSegmentTest.php
+++ b/tests/Unit/TraefikServiceNameSegmentTest.php
@@ -95,3 +95,15 @@
 
     expect($routerLine)->toContain("https-0-{$uuid}-another-service-{$hash}.rule=");
 });
+
+test('application labels keep redirect capture groups single escaped before compose generation', function () {
+    $labels = fqdnLabelsForTraefik(
+        uuid: 'application-uuid',
+        domains: collect(['https://example.com']),
+        redirect_direction: 'www',
+        escape_redirect_replacement_for_compose: false,
+    );
+
+    expect($labels)
+        ->toContain('traefik.http.middlewares.0-application-uuid-to-www.redirectregex.replacement=${1}://www.${2}');
+});

From 92d6fe9d4e3261e0447dc3a8e6024f8b4587b805 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 21:38:44 +0200
Subject: [PATCH 16/42] fix(ui): use solid surfaces for deployment indicator
 states

Remove deployment opacity fading and translucent dark-theme surfaces, and drop the global listbox hover background rule.
---
 app/Livewire/DeploymentsIndicator.php         |  6 ------
 resources/css/app.css                         |  4 ----
 .../livewire/deployments-indicator.blade.php  | 20 +++++++++----------
 .../DeploymentsIndicatorLayoutTest.php        | 15 +++++++++++++-
 .../Feature/ListboxTriggerTruncationTest.php  |  7 -------
 5 files changed, 23 insertions(+), 29 deletions(-)

diff --git a/app/Livewire/DeploymentsIndicator.php b/app/Livewire/DeploymentsIndicator.php
index 235071dbe..28c9a00c6 100644
--- a/app/Livewire/DeploymentsIndicator.php
+++ b/app/Livewire/DeploymentsIndicator.php
@@ -54,12 +54,6 @@ public function deploymentCount()
         return $this->deployments->count();
     }
 
-    #[Computed]
-    public function shouldReduceOpacity(): bool
-    {
-        return request()->routeIs('project.application.deployment.*');
-    }
-
     public function toggleExpanded()
     {
         $this->expanded = ! $this->expanded;
diff --git a/resources/css/app.css b/resources/css/app.css
index 566f29031..95e0207ce 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -1903,10 +1903,6 @@ .dark .listbox-trigger {
     color: var(--color-fg);
 }
 
-.listbox-trigger:hover {
-    background: var(--coollabs-fill);
-}
-
 .listbox-trigger:disabled {
     cursor: not-allowed;
     opacity: 0.5;
diff --git a/resources/views/livewire/deployments-indicator.blade.php b/resources/views/livewire/deployments-indicator.blade.php
index ece7e4b44..5b9e41f76 100644
--- a/resources/views/livewire/deployments-indicator.blade.php
+++ b/resources/views/livewire/deployments-indicator.blade.php
@@ -1,18 +1,16 @@
 <div wire:poll.3000ms x-on:livewire:navigated.window="
         $wire.updateShouldShowFromPath(window.location.pathname || '/')
     " x-data="{
-    expanded: @entangle('expanded'),
-    reduceOpacity: @js($this->shouldReduceOpacity)
+    expanded: @entangle('expanded')
 }" class="fixed bottom-0 left-0 z-60 mb-4 ml-4 transition-[left] duration-200"
     :class="collapsed ? 'lg:left-16' : 'lg:left-56'">
     @if ($this->shouldShow && $this->deploymentCount > 0)
-        <div class="relative transition-opacity duration-200"
-            :class="{ 'opacity-100': expanded || !reduceOpacity, 'opacity-60 hover:opacity-100': reduceOpacity && !expanded }">
+        <div class="relative">
             {{-- Expanded deployment list (above the pill) --}}
             <div x-show="expanded" x-transition:enter="transition ease-out duration-200"
-                x-transition:enter-start="opacity-0 translate-y-2" x-transition:enter-end="opacity-100 translate-y-0"
-                x-transition:leave="transition ease-in duration-150" x-transition:leave-start="opacity-100 translate-y-0"
-                x-transition:leave-end="opacity-0 translate-y-2" x-cloak
+                x-transition:enter-start="translate-y-2" x-transition:enter-end="translate-y-0"
+                x-transition:leave="transition ease-in duration-150" x-transition:leave-start="translate-y-0"
+                x-transition:leave-end="translate-y-2" x-cloak
                 class="absolute bottom-full mb-2 w-[min(22rem,calc(100vw-2rem))] overflow-hidden rounded-xl"
                 style="background: var(--coollabs-elevated); box-shadow: 0 0 0 1px var(--coollabs-line), var(--shadow-modal);">
                 <div class="max-h-96 space-y-1 overflow-y-auto p-2 scrollbar">
@@ -26,9 +24,9 @@ class="absolute bottom-full mb-2 w-[min(22rem,calc(100vw-2rem))] overflow-hidden
                         @endphp
                         <a wire:key="indicator-deployment-{{ $deployment->id }}"
                             href="{{ $deployment->deployment_url }}" {{ wireNavigate() }}
-                            class="flex items-start gap-3 rounded-lg border border-transparent p-3 transition-colors hover:border-neutral-200 hover:bg-neutral-50 hover:no-underline dark:hover:border-white/[0.08] dark:hover:bg-white/[0.04]">
+                            class="flex items-start gap-3 rounded-lg border border-transparent p-3 transition-colors hover:border-neutral-200 hover:bg-neutral-50 hover:no-underline dark:border-coolgray-300 dark:hover:border-coolgray-400 dark:hover:bg-raised">
                             <div
-                                class="mt-0.5 flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-coollabs dark:border-white/[0.08] dark:bg-white/[0.04] dark:text-warning">
+                                class="mt-0.5 flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-coollabs dark:border-coolgray-300 dark:bg-raised dark:text-warning">
                                 @if ($deployment->status === 'in_progress')
                                     <svg class="size-3.5 animate-spin" xmlns="http://www.w3.org/2000/svg" fill="none"
                                         viewBox="0 0 24 24" aria-hidden="true">
@@ -61,7 +59,7 @@ class="shrink-0" />
                                 <p class="mt-0.5 truncate text-[11px] text-neutral-500 dark:text-fg-faint">
                                     {{ $deployment->server_name ?: '-' }}
                                     @if ($deployment->pull_request_id)
-                                        <span class="px-1 text-neutral-300 dark:text-white/15">·</span>
+                                        <span class="px-1 text-neutral-300 dark:text-fg-faint">·</span>
                                         PR #{{ $deployment->pull_request_id }}
                                     @endif
                                 </p>
@@ -73,7 +71,7 @@ class="shrink-0" />
 
             {{-- Collapsed pill --}}
             <button type="button" @click="expanded = !expanded"
-                class="flex items-center gap-2 rounded-xl border border-neutral-200 bg-white px-3.5 py-2 text-sm font-medium text-neutral-800 transition-colors hover:bg-neutral-50 dark:border-white/[0.08] dark:bg-surface dark:text-fg dark:hover:bg-white/[0.04]"
+                class="flex items-center gap-2 rounded-xl border border-neutral-200 bg-white px-3.5 py-2 text-sm font-medium text-neutral-800 transition-colors hover:bg-neutral-50 dark:border-coolgray-300 dark:bg-surface dark:text-fg dark:hover:bg-raised"
                 style="box-shadow: 0 0 0 1px var(--coollabs-hairline), var(--shadow-modal);"
                 :aria-expanded="expanded.toString()" aria-label="Active deployments">
                 <svg class="loading-indicator size-3.5 shrink-0 animate-spin"
diff --git a/tests/Feature/DeploymentsIndicatorLayoutTest.php b/tests/Feature/DeploymentsIndicatorLayoutTest.php
index d70679d45..c1676dd81 100644
--- a/tests/Feature/DeploymentsIndicatorLayoutTest.php
+++ b/tests/Feature/DeploymentsIndicatorLayoutTest.php
@@ -30,7 +30,7 @@
         ->toContain("'In progress'")
         ->toContain("'Queued'")
         ->toContain('dark:text-fg')
-        ->toContain('dark:border-white/[0.08]')
+        ->toContain('dark:border-coolgray-300')
         ->toContain('$this->shouldShow')
         ->toContain('updateShouldShowFromPath')
         ->toContain('livewire:navigated')
@@ -39,3 +39,16 @@
         ->not->toContain('text-gray-800')
         ->not->toContain("str_replace('_', ' ', \$deployment->status)");
 });
+
+it('uses solid surfaces in every deployments indicator state', function () {
+    $indicatorView = file_get_contents(resource_path('views/livewire/deployments-indicator.blade.php'));
+
+    expect($indicatorView)
+        ->not->toContain('reduceOpacity')
+        ->not->toContain('transition-opacity')
+        ->not->toContain('x-transition:enter-start="opacity-0')
+        ->not->toContain('x-transition:leave-end="opacity-0')
+        ->not->toContain('dark:bg-white/[')
+        ->not->toContain('dark:hover:bg-white/[')
+        ->not->toContain('dark:border-white/[');
+});
diff --git a/tests/Feature/ListboxTriggerTruncationTest.php b/tests/Feature/ListboxTriggerTruncationTest.php
index a35ff8cbe..a64a97dd8 100644
--- a/tests/Feature/ListboxTriggerTruncationTest.php
+++ b/tests/Feature/ListboxTriggerTruncationTest.php
@@ -22,13 +22,6 @@
         ->toMatch('/\.application-settings-workspace \.listbox-trigger[^}]*height: 2rem;/s');
 });
 
-test('listbox trigger uses an opaque background on hover', function () {
-    $css = file_get_contents(resource_path('css/app.css'));
-
-    expect($css)
-        ->toMatch('/\.listbox-trigger:hover \{[^}]*background: var\(--coollabs-fill\);/s');
-});
-
 test('listbox component uses shared trigger label truncation', function () {
     $html = Blade::render(<<<'BLADE'
         <x-forms.listbox id="longOption" label="Example"

From 3d025a2a9b221b040090f1dff8a66067e22cb43f Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 22:38:44 +0200
Subject: [PATCH 17/42] docs: design external TLS redirect control

---
 ...08-17-external-tls-http-redirect-design.md | 90 +++++++++++++++++++
 1 file changed, 90 insertions(+)
 create mode 100644 docs/superpowers/specs/2026-08-17-external-tls-http-redirect-design.md

diff --git a/docs/superpowers/specs/2026-08-17-external-tls-http-redirect-design.md b/docs/superpowers/specs/2026-08-17-external-tls-http-redirect-design.md
new file mode 100644
index 000000000..7693ce13d
--- /dev/null
+++ b/docs/superpowers/specs/2026-08-17-external-tls-http-redirect-design.md
@@ -0,0 +1,90 @@
+# External TLS HTTP Redirect Design
+
+## Problem
+
+The Cloudflare Tunnel all-resource setup sends public HTTPS requests to Coolify's proxy through `http://localhost:80`. When a resource domain is stored as `https://` and Coolify redirects HTTP traffic to HTTPS, the tunneled request repeatedly returns to the HTTP entrypoint and causes `TOO_MANY_REDIRECTS`.
+
+The current documentation avoids the loop by telling users to store the public domain as `http://`. That misrepresents the public URL and can produce incorrect secure cookies, OAuth callback URLs, and canonical links. Applications can already disable forced HTTPS in advanced settings, but the control is not near domain configuration. Service applications always enable the redirect in generated proxy configuration.
+
+## Goals
+
+- Store the externally visible URL accurately as `https://`.
+- Let an upstream proxy such as Cloudflare handle the HTTP-to-HTTPS redirect.
+- Apply the behavior consistently to applications and service applications.
+- Keep existing resources secure and behaviorally unchanged by default.
+- Keep the feature generic rather than coupling it to Cloudflare or a server-wide tunnel mode.
+
+## Non-goals
+
+- Detect Cloudflare automatically.
+- Add a server-wide all-resource tunnel mode.
+- Configure trusted forwarded-header networks.
+- Replace the end-to-end origin TLS workflow.
+- Change the default redirect behavior of existing or new resources.
+
+## User Experience
+
+The Domains page shows a boolean control named **Redirect HTTP to HTTPS** when a resource has at least one `https://` domain.
+
+The control defaults to enabled. Its help text explains:
+
+> Disable this when HTTPS and redirects are handled by Cloudflare Tunnel or another reverse proxy that connects to Coolify over HTTP.
+
+A Cloudflare Tunnel user configures `https://app.example.com` and disables the control. A directly exposed resource leaves it enabled.
+
+For regular and Docker Compose applications, the control edits the existing `ApplicationSetting::is_force_https_enabled` value. The existing Advanced-page control must not become an independent source of truth; it should either be removed from that page or remain bound to the same setting with the clearer label.
+
+For service applications, the Domains page provides the same control for each application service. Database-only service entries do not expose it.
+
+## Data Model
+
+Add `is_force_https_enabled` to service applications as a non-null boolean with a default of `true`. Existing service applications therefore keep their current behavior after migration.
+
+Regular applications continue using the existing application setting. No Cloudflare-specific state is stored.
+
+## Proxy Configuration
+
+Domain scheme and redirect policy remain independent:
+
+- An `https://` domain continues generating the HTTPS router/listener.
+- Its HTTP router/listener is also generated.
+- When redirect is enabled, the HTTP router applies the HTTPS redirect middleware.
+- When redirect is disabled, the HTTP router forwards the request to the resource without that middleware.
+
+The stored service-application setting replaces the currently hardcoded `true` passed into Traefik and Caddy label generation. Existing path stripping, gzip, authentication, noindex, and www/non-www middleware behavior remains unchanged.
+
+Preview deployments inherit the parent application's existing redirect setting, matching current application behavior.
+
+## Validation and Authorization
+
+The new service-application value is validated as a boolean. Updating it uses the same authorization checks as other service domain settings. Changing the value marks proxy configuration as changed and follows the existing save/redeploy flow used by domain configuration.
+
+The control is relevant only when an HTTPS domain exists. Hiding it for HTTP-only resources does not reset the stored value.
+
+## Documentation
+
+Update the Cloudflare all-resource guide to instruct users to:
+
+1. Store the public resource domain using `https://`.
+2. Disable **Redirect HTTP to HTTPS** for that resource.
+3. Let Cloudflare perform the public redirect and TLS termination.
+
+The guide should retain the full TLS guide as the alternative for users who want TLS between cloudflared and Coolify's HTTPS entrypoint.
+
+## Testing
+
+Automated tests must cover:
+
+- Application HTTPS domains with redirects enabled and disabled.
+- Service-application HTTPS domains with redirects enabled and disabled.
+- The service-application default remains enabled.
+- Traefik and Caddy omit only the redirect behavior when disabled.
+- Other middleware remains present when the redirect is disabled.
+- HTTP-only resources do not show an irrelevant control.
+- The Domains UI persists changes with existing authorization rules.
+
+A manual smoke test should route a Cloudflare Tunnel hostname to `http://localhost:80`, save the Coolify resource as `https://`, disable the redirect, and verify the public HTTPS URL loads without a redirect loop.
+
+## Compatibility
+
+The database default of `true` preserves service behavior. Existing application values are unchanged. No automatic migration attempts to infer which resources are behind Cloudflare.

From 69dbfe00795f3a4b666189ce3634a8ccce152259 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 17 Aug 2026 23:34:56 +0200
Subject: [PATCH 18/42] fix(modal): use checkbox ids for Livewire bindings
 (#11335)

---
 .../components/modal-confirmation.blade.php      |  1 -
 .../ModalConfirmationStep1NoCancelTest.php       | 16 ++++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/resources/views/components/modal-confirmation.blade.php b/resources/views/components/modal-confirmation.blade.php
index 8cc233a0c..0e4350f50 100644
--- a/resources/views/components/modal-confirmation.blade.php
+++ b/resources/views/components/modal-confirmation.blade.php
@@ -236,7 +236,6 @@ class="flex size-7 shrink-0 items-center justify-center rounded-md text-neutral-
                             @foreach ($checkboxes as $index => $checkbox)
                                 <div class="flex justify-between items-center mb-2">
                                     <x-forms.checkbox fullWidth :label="$checkbox['label']" :id="$checkbox['id']"
-                                        :wire:model="$checkbox['id']"
                                         x-on:change="toggleAction('{{ $checkbox['id'] }}')" :checked="$this->{$checkbox['id']}"
                                         x-bind:checked="selectedActions.includes('{{ $checkbox['id'] }}')" />
                                 </div>
diff --git a/tests/Feature/ModalConfirmationStep1NoCancelTest.php b/tests/Feature/ModalConfirmationStep1NoCancelTest.php
index ec1425e7e..0311cd0ec 100644
--- a/tests/Feature/ModalConfirmationStep1NoCancelTest.php
+++ b/tests/Feature/ModalConfirmationStep1NoCancelTest.php
@@ -1,5 +1,7 @@
 <?php
 
+use Illuminate\Support\Facades\Blade;
+
 /**
  * Step 1 (checkbox options) should only show Continue — dismiss is the header X.
  */
@@ -13,3 +15,17 @@
         ->toContain('step1ButtonText')
         ->not->toContain('Cancel');
 });
+
+test('modal confirmation lets checkbox ids define their Livewire model binding', function () {
+    $checkbox = Blade::render(<<<'BLADE'
+        <x-forms.checkbox id="deleteVolumes"
+            x-on:change="toggleAction('deleteVolumes')"
+            x-bind:checked="selectedActions.includes('deleteVolumes')" />
+    BLADE);
+
+    expect($checkbox)
+        ->toContain('x-on:change="toggleAction(\'deleteVolumes\')"')
+        ->toContain('x-bind:checked="selectedActions.includes(\'deleteVolumes\')"')
+        ->toContain('wire:model=deleteVolumes')
+        ->toMatch('/id="deleteVolumes-[a-zA-Z0-9]{24}"/');
+});

From 17d9d1a3701da90c2a515d02bf6c2875839a6c08 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 09:08:18 +0200
Subject: [PATCH 19/42] feat(domains): add configurable HTTPS redirects for
 service apps

---
 .../UpdateServiceApplicationFromApi.php       |  4 ++
 .../Api/ServiceApplicationsController.php     |  3 +
 app/Livewire/Project/Application/Domains.php  | 16 +++++
 app/Livewire/Project/Service/Domains.php      | 36 +++++++++-
 app/Mcp/Concerns/BuildsResponse.php           | 13 ++++
 app/Models/ServiceApplication.php             | 11 +++
 app/View/Components/Services/Links.php        |  2 +-
 bootstrap/helpers/docker.php                  | 33 +++++----
 bootstrap/helpers/parsers.php                 | 14 ++--
 bootstrap/helpers/shared.php                  |  8 +--
 ..._enabled_to_service_applications_table.php | 28 ++++++++
 .../views/auth/two-factor-challenge.blade.php | 46 +++----------
 .../views/components/services/links.blade.php | 16 +++--
 .../project/application/domains.blade.php     | 15 ++++
 .../project/service/domains.blade.php         | 18 ++++-
 .../project/service/heading.blade.php         |  8 +--
 .../shared/resource-operations.blade.php      |  2 +-
 tests/Feature/ApplicationDomainsTest.php      | 21 ++++++
 ...licationParserDockerComposeDomainsTest.php |  4 +-
 .../Auth/TwoFactorChallengeAccessTest.php     | 12 ++++
 .../Feature/ListboxTriggerTruncationTest.php  |  3 +-
 tests/Feature/Mcp/McpEndpointTest.php         | 10 +++
 tests/Feature/Mcp/McpReadToolsTest.php        | 45 ++++++++++++
 tests/Feature/ModelFillableCreationTest.php   | 21 ++++++
 .../ResourceHeadingUnifiedNavbarTest.php      | 33 ++++++---
 tests/Feature/ServiceApplicationsApiTest.php  | 14 ++++
 tests/Feature/ServiceDomainsTest.php          | 30 ++++++++
 .../TraefikServiceDockerNetworkLabelTest.php  |  4 +-
 tests/Unit/FqdnLabelsNoindexTest.php          | 68 ++++++++++++++++++-
 .../ServerTransferExporterImporterTest.php    |  2 +
 30 files changed, 444 insertions(+), 96 deletions(-)
 create mode 100644 database/migrations/2026_08_17_000000_add_is_force_https_enabled_to_service_applications_table.php

diff --git a/app/Actions/Service/UpdateServiceApplicationFromApi.php b/app/Actions/Service/UpdateServiceApplicationFromApi.php
index 9d97c4738..123b752c0 100644
--- a/app/Actions/Service/UpdateServiceApplicationFromApi.php
+++ b/app/Actions/Service/UpdateServiceApplicationFromApi.php
@@ -88,6 +88,10 @@ public function execute(ServiceApplication $serviceApplication, Request $request
             $serviceApplication->is_stripprefix_enabled = filter_var($payload['is_stripprefix_enabled'], FILTER_VALIDATE_BOOLEAN);
         }
 
+        if (array_key_exists('is_force_https_enabled', $payload)) {
+            $serviceApplication->is_force_https_enabled = filter_var($payload['is_force_https_enabled'], FILTER_VALIDATE_BOOLEAN);
+        }
+
         if (array_key_exists('is_log_drain_enabled', $payload)) {
             $enabled = filter_var($payload['is_log_drain_enabled'], FILTER_VALIDATE_BOOLEAN);
             $server = $serviceApplication->service->destination->server;
diff --git a/app/Http/Controllers/Api/ServiceApplicationsController.php b/app/Http/Controllers/Api/ServiceApplicationsController.php
index 414aff035..e8446467d 100644
--- a/app/Http/Controllers/Api/ServiceApplicationsController.php
+++ b/app/Http/Controllers/Api/ServiceApplicationsController.php
@@ -256,6 +256,7 @@ public function show(Request $request): JsonResponse
                         'is_log_drain_enabled' => new OA\Property(property: 'is_log_drain_enabled', type: 'boolean', nullable: true),
                         'is_gzip_enabled' => new OA\Property(property: 'is_gzip_enabled', type: 'boolean', nullable: true),
                         'is_stripprefix_enabled' => new OA\Property(property: 'is_stripprefix_enabled', type: 'boolean', nullable: true),
+                        'is_force_https_enabled' => new OA\Property(property: 'is_force_https_enabled', type: 'boolean', nullable: true),
                     ]
                 )
             )
@@ -328,6 +329,7 @@ public function update(Request $request, UpdateServiceApplicationFromApi $update
             'is_log_drain_enabled',
             'is_gzip_enabled',
             'is_stripprefix_enabled',
+            'is_force_https_enabled',
         ];
 
         $validationRules = [
@@ -341,6 +343,7 @@ public function update(Request $request, UpdateServiceApplicationFromApi $update
             'is_log_drain_enabled' => 'sometimes|boolean',
             'is_gzip_enabled' => 'sometimes|boolean',
             'is_stripprefix_enabled' => 'sometimes|boolean',
+            'is_force_https_enabled' => 'sometimes|boolean',
         ];
 
         $validator = Validator::make($payload, $validationRules);
diff --git a/app/Livewire/Project/Application/Domains.php b/app/Livewire/Project/Application/Domains.php
index 477abc08e..45a76a4c3 100644
--- a/app/Livewire/Project/Application/Domains.php
+++ b/app/Livewire/Project/Application/Domains.php
@@ -23,6 +23,8 @@ class Domains extends Component
 
     public string $redirect = 'both';
 
+    public bool $isForceHttpsEnabled = true;
+
     /**
      * Per compose-service www/non-www redirect direction.
      * Keys are wire-safe (dots encoded) — use serviceRedirectWireKey().
@@ -109,6 +111,7 @@ protected function rules(): array
             'newDomain' => ValidationPatterns::applicationDomainRules(),
             'editingDomain' => ValidationPatterns::applicationDomainRules(),
             'redirect' => 'string|required|in:both,www,non-www',
+            'isForceHttpsEnabled' => 'boolean',
             'serviceRedirects' => 'array',
             'serviceRedirects.*' => 'string|in:both,www,non-www',
         ];
@@ -160,6 +163,18 @@ public function updateRedirect(string $redirect): void
         $this->setRedirect();
     }
 
+    public function updateForceHttps(): void
+    {
+        $this->authorize('update', $this->application);
+        $this->validateOnly('isForceHttpsEnabled');
+
+        $this->application->settings->is_force_https_enabled = $this->isForceHttpsEnabled;
+        $this->application->settings->save();
+        $this->resetDefaultLabels();
+        $this->dispatch('configurationChanged')->to(ConfigurationChecker::class);
+        $this->dispatch('success', 'HTTP to HTTPS redirect updated.');
+    }
+
     public function loadDomainState(): void
     {
         $this->application->refresh();
@@ -168,6 +183,7 @@ public function loadDomainState(): void
         $this->isCompose = $this->application->build_pack === 'dockercompose';
         $this->labelsAreWritable = $this->application->settings->is_container_label_readonly_enabled === false;
         $this->redirect = $this->application->redirect ?? 'both';
+        $this->isForceHttpsEnabled = $this->application->isForceHttpsEnabled();
 
         $settings = instanceSettings();
         $this->dnsValidationEnabled = (bool) data_get($settings, 'is_dns_validation_enabled', true);
diff --git a/app/Livewire/Project/Service/Domains.php b/app/Livewire/Project/Service/Domains.php
index ad31560b5..4690335d8 100644
--- a/app/Livewire/Project/Service/Domains.php
+++ b/app/Livewire/Project/Service/Domains.php
@@ -33,6 +33,9 @@ class Domains extends Component
      */
     public array $serviceRedirects = [];
 
+    /** @var array<int|string, bool> */
+    public array $forceHttpsRedirects = [];
+
     /** Service application id when a pending domain conflict belongs to setServiceRedirect. */
     public ?int $pendingRedirectServiceApplicationId = null;
 
@@ -110,6 +113,8 @@ protected function rules(): array
             'newServiceApplicationId' => 'nullable|integer',
             'serviceRedirects' => 'array',
             'serviceRedirects.*' => 'string|in:both,www,non-www',
+            'forceHttpsRedirects' => 'array',
+            'forceHttpsRedirects.*' => 'boolean',
         ];
     }
 
@@ -143,6 +148,22 @@ public function toggleNoindexDomain(int $serviceApplicationId, string $domain, s
         $this->dispatch('success', 'Search engine indexing updated.');
     }
 
+    public function updateForceHttps(int $serviceApplicationId, bool $enabled): void
+    {
+        $application = $this->service->applications()->findOrFail($serviceApplicationId);
+        $this->authorize('update', $application);
+
+        $this->forceHttpsRedirects[$serviceApplicationId] = $enabled;
+        $this->validateOnly("forceHttpsRedirects.{$serviceApplicationId}");
+
+        $application->is_force_https_enabled = $enabled;
+        $application->save();
+        $this->service->parse();
+        $this->refreshDomains();
+        $this->dispatch('configurationChanged')->to(ConfigurationChecker::class);
+        $this->dispatch('success', 'HTTP to HTTPS redirect updated.');
+    }
+
     public function loadDomainState(): void
     {
         $this->service->loadMissing(['applications', 'server']);
@@ -167,6 +188,10 @@ public function loadDomainState(): void
             $this->serverIpConfigured = null;
         }
 
+        $this->forceHttpsRedirects = $this->service->applications
+            ->mapWithKeys(fn (ServiceApplication $app) => [$app->id => $app->isForceHttpsEnabled()])
+            ->all();
+
         $this->serviceApps = $this->service->applications
             ->sortBy(fn (ServiceApplication $app) => strtolower($app->human_name ?: $app->name))
             ->values()
@@ -518,9 +543,7 @@ protected function pruneDomainDnsStatusesToCurrentDomains(): void
 
     public function updatedNewDomain(): void
     {
-        $this->addDomainDnsFailed = false;
-        $this->addDomainDnsMessage = '';
-        $this->forceSaveDns = false;
+        $this->resetAddDomainDnsGate();
     }
 
     public function updatedNewDomainParts(): void
@@ -529,6 +552,13 @@ public function updatedNewDomainParts(): void
         $this->resetAddDomainDnsGate();
     }
 
+    public function resetAddDomainDnsGate(): void
+    {
+        $this->addDomainDnsFailed = false;
+        $this->addDomainDnsMessage = '';
+        $this->forceSaveDns = false;
+    }
+
     public function updatedEditingDomain(): void
     {
         $this->editDomainDnsFailed = false;
diff --git a/app/Mcp/Concerns/BuildsResponse.php b/app/Mcp/Concerns/BuildsResponse.php
index d429edb5f..280e26b9e 100644
--- a/app/Mcp/Concerns/BuildsResponse.php
+++ b/app/Mcp/Concerns/BuildsResponse.php
@@ -47,6 +47,18 @@ trait BuildsResponse
         // app/env secrets
         'value', 'real_value', 'http_basic_auth_password',
 
+        // free-form commands / configurations can embed credentials
+        'git_full_url',
+        'install_command', 'build_command', 'start_command',
+        'health_check_command', 'health_check_response_text',
+        'custom_docker_run_options', 'pre_deployment_command', 'post_deployment_command',
+        'docker_compose_custom_start_command', 'docker_compose_custom_build_command',
+        'custom_nginx_configuration',
+
+        // raw database configuration blobs
+        'postgres_conf', 'mysql_conf', 'mariadb_conf', 'mongo_conf',
+        'redis_conf', 'keydb_conf',
+
         // database connection strings embed credentials
         'internal_db_url', 'external_db_url', 'init_scripts',
 
@@ -58,6 +70,7 @@ trait BuildsResponse
 
         // bulky / unsafe blobs
         'dockerfile', 'docker_compose', 'docker_compose_raw',
+        'last_saved_proxy_configuration',
         'custom_labels', 'environment_variables',
         'environment_variables_preview', 'validation_logs',
         'server_metadata', 'logs', 'configuration_snapshot',
diff --git a/app/Models/ServiceApplication.php b/app/Models/ServiceApplication.php
index 4afc6c29d..9763fa894 100644
--- a/app/Models/ServiceApplication.php
+++ b/app/Models/ServiceApplication.php
@@ -31,6 +31,7 @@ class ServiceApplication extends BaseModel
         'is_include_timestamps',
         'is_gzip_enabled',
         'is_stripprefix_enabled',
+        'is_force_https_enabled',
         'last_online_at',
         'is_migrated',
     ];
@@ -44,11 +45,16 @@ class ServiceApplication extends BaseModel
         'domain_dns_statuses',
     ];
 
+    protected $attributes = [
+        'is_force_https_enabled' => true,
+    ];
+
     protected function casts(): array
     {
         return [
             'domain_dns_statuses' => 'array',
             'noindex_domains' => 'array',
+            'is_force_https_enabled' => 'boolean',
         ];
     }
 
@@ -124,6 +130,11 @@ public function isGzipEnabled()
         return data_get($this, 'is_gzip_enabled', true);
     }
 
+    public function isForceHttpsEnabled(): bool
+    {
+        return $this->is_force_https_enabled;
+    }
+
     public function type()
     {
         return 'service';
diff --git a/app/View/Components/Services/Links.php b/app/View/Components/Services/Links.php
index 147b49d68..5b77dc90f 100644
--- a/app/View/Components/Services/Links.php
+++ b/app/View/Components/Services/Links.php
@@ -12,7 +12,7 @@ class Links extends Component
 {
     public Collection $links;
 
-    public function __construct(public Service $service, public bool $fullWidth = false)
+    public function __construct(public Service $service, public bool $fullWidth = false, public bool $compact = false)
     {
         $this->links = collect([]);
         $service->applications()->get()->map(function ($application) {
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index d4466d389..ae2963755 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -518,6 +518,10 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
         $path = $url->getPath();
         $host_without_www = str($host)->replace('www.', '');
         $schema = $url->getScheme();
+        $siteAddress = "{$schema}://{$host}";
+        if ($schema === 'https' && ! $is_force_https_enabled) {
+            $siteAddress = "http://{$host}, https://{$host}";
+        }
         $port = $url->getPort();
         $handle = 'handle_path';
         if (! $is_stripprefix_enabled) {
@@ -529,7 +533,7 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
         if (is_null($port) && $predefinedPort) {
             $port = $predefinedPort;
         }
-        $labels->push("caddy_{$loop}={$schema}://{$host}");
+        $labels->push("caddy_{$loop}={$siteAddress}");
         if (isNoindexDomain($domain, $noindex_domains)) {
             // Caddy's header directive takes either inline arguments or a block,
             // never both, so -Server has to move into the block alongside it.
@@ -549,11 +553,12 @@ function fqdnLabelsForCaddy(string $network, string $uuid, Collection $domains,
         if ($is_gzip_enabled) {
             $labels->push("caddy_{$loop}.encode=zstd gzip");
         }
+        $redirect_schema = $is_force_https_enabled ? $schema : '{scheme}';
         if ($redirect_direction === 'www' && ! str($host)->startsWith('www.')) {
-            $labels->push("caddy_{$loop}.redir={$schema}://www.{$host}{uri}");
+            $labels->push("caddy_{$loop}.redir={$redirect_schema}://www.{$host}{uri}");
         }
         if ($redirect_direction === 'non-www' && str($host)->startsWith('www.')) {
-            $labels->push("caddy_{$loop}.redir={$schema}://{$host_without_www}{uri}");
+            $labels->push("caddy_{$loop}.redir={$redirect_schema}://{$host_without_www}{uri}");
         }
         if ($is_http_basic_auth_enabled) {
             $labels->push("caddy_{$loop}.basicauth.{$http_basic_auth_username}=\"{$hashedPassword}\"");
@@ -696,8 +701,7 @@ function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_
                         $middlewares->push($middleware_name);
                     });
                     if ($middlewares->isNotEmpty()) {
-                        $middlewares = $middlewares->join(',');
-                        $labels->push("traefik.http.routers.{$https_label}.middlewares={$middlewares}");
+                        $labels->push("traefik.http.routers.{$https_label}.middlewares={$middlewares->join(',')}");
                     }
                 } else {
                     $middlewares = collect([]);
@@ -725,8 +729,7 @@ function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_
                         $middlewares->push($middleware_name);
                     });
                     if ($middlewares->isNotEmpty()) {
-                        $middlewares = $middlewares->join(',');
-                        $labels->push("traefik.http.routers.{$https_label}.middlewares={$middlewares}");
+                        $labels->push("traefik.http.routers.{$https_label}.middlewares={$middlewares->join(',')}");
                     }
                 }
                 $labels->push("traefik.http.routers.{$https_label}.tls=true");
@@ -739,15 +742,17 @@ function fqdnLabelsForTraefik(string $uuid, Collection $domains, bool $is_force_
                     $labels->push("traefik.http.services.{$http_label}.loadbalancer.server.port=$port");
                     $labels->push("traefik.http.routers.{$http_label}.service={$http_label}");
                 }
-                $middlewares = collect([]);
-                if ($is_noindex) {
-                    $middlewares->push($noindex_name);
-                }
                 if ($is_force_https_enabled) {
-                    $middlewares->push('redirect-to-https');
+                    $httpMiddlewares = collect([]);
+                    if ($is_noindex) {
+                        $httpMiddlewares->push($noindex_name);
+                    }
+                    $httpMiddlewares->push('redirect-to-https');
+                } else {
+                    $httpMiddlewares = $middlewares;
                 }
-                if ($middlewares->isNotEmpty()) {
-                    $labels->push("traefik.http.routers.{$http_label}.middlewares={$middlewares->join(',')}");
+                if ($httpMiddlewares->isNotEmpty()) {
+                    $labels->push("traefik.http.routers.{$http_label}.middlewares={$httpMiddlewares->join(',')}");
                 }
             } else {
                 // Set labels for http
diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index ddfd45531..7dd1c163c 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -1359,9 +1359,6 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
             $redirectDirection = in_array($composeRedirect, ['www', 'non-www', 'both'], true)
                 ? $composeRedirect
                 : 'both';
-            if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
-                $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
-            }
             if ($shouldGenerateLabelsExactly) {
                 switch ($server->proxyType()) {
                     case ProxyTypes::TRAEFIK->value:
@@ -2636,16 +2633,13 @@ function serviceParser(Service $resource): Collection
             $redirectDirection = in_array(data_get($originalResource, 'redirect'), ['www', 'non-www', 'both'], true)
                 ? data_get($originalResource, 'redirect')
                 : 'both';
-            if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
-                $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
-            }
             if ($shouldGenerateLabelsExactly) {
                 switch ($server->proxyType()) {
                     case ProxyTypes::TRAEFIK->value:
                         $serviceLabels = $serviceLabels->merge(fqdnLabelsForTraefik(
                             uuid: $uuid,
                             domains: $fqdns,
-                            is_force_https_enabled: true,
+                            is_force_https_enabled: $originalResource->isForceHttpsEnabled(),
                             serviceLabels: $serviceLabels,
                             is_gzip_enabled: $originalResource->isGzipEnabled(),
                             is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
@@ -2660,7 +2654,7 @@ function serviceParser(Service $resource): Collection
                             network: $network,
                             uuid: $uuid,
                             domains: $fqdns,
-                            is_force_https_enabled: true,
+                            is_force_https_enabled: $originalResource->isForceHttpsEnabled(),
                             serviceLabels: $serviceLabels,
                             is_gzip_enabled: $originalResource->isGzipEnabled(),
                             is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
@@ -2676,7 +2670,7 @@ function serviceParser(Service $resource): Collection
                 $serviceLabels = $serviceLabels->merge(fqdnLabelsForTraefik(
                     uuid: $uuid,
                     domains: $fqdns,
-                    is_force_https_enabled: true,
+                    is_force_https_enabled: $originalResource->isForceHttpsEnabled(),
                     serviceLabels: $serviceLabels,
                     is_gzip_enabled: $originalResource->isGzipEnabled(),
                     is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
@@ -2689,7 +2683,7 @@ function serviceParser(Service $resource): Collection
                     network: $network,
                     uuid: $uuid,
                     domains: $fqdns,
-                    is_force_https_enabled: true,
+                    is_force_https_enabled: $originalResource->isForceHttpsEnabled(),
                     serviceLabels: $serviceLabels,
                     is_gzip_enabled: $originalResource->isGzipEnabled(),
                     is_stripprefix_enabled: $originalResource->isStripprefixEnabled(),
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index cf63c4776..78a1f95e5 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -3050,7 +3050,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                     $serviceLabels = $serviceLabels->merge(fqdnLabelsForTraefik(
                                         uuid: $resource->uuid,
                                         domains: $fqdns,
-                                        is_force_https_enabled: true,
+                                        is_force_https_enabled: $savedService->isForceHttpsEnabled(),
                                         serviceLabels: $serviceLabels,
                                         is_gzip_enabled: $savedService->isGzipEnabled(),
                                         is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
@@ -3065,7 +3065,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                         network: $resource->destination->network,
                                         uuid: $resource->uuid,
                                         domains: $fqdns,
-                                        is_force_https_enabled: true,
+                                        is_force_https_enabled: $savedService->isForceHttpsEnabled(),
                                         serviceLabels: $serviceLabels,
                                         is_gzip_enabled: $savedService->isGzipEnabled(),
                                         is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
@@ -3080,7 +3080,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                             $serviceLabels = $serviceLabels->merge(fqdnLabelsForTraefik(
                                 uuid: $resource->uuid,
                                 domains: $fqdns,
-                                is_force_https_enabled: true,
+                                is_force_https_enabled: $savedService->isForceHttpsEnabled(),
                                 serviceLabels: $serviceLabels,
                                 is_gzip_enabled: $savedService->isGzipEnabled(),
                                 is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
@@ -3093,7 +3093,7 @@ function parseDockerComposeFile(Service|Application $resource, bool $isNew = fal
                                 network: $resource->destination->network,
                                 uuid: $resource->uuid,
                                 domains: $fqdns,
-                                is_force_https_enabled: true,
+                                is_force_https_enabled: $savedService->isForceHttpsEnabled(),
                                 serviceLabels: $serviceLabels,
                                 is_gzip_enabled: $savedService->isGzipEnabled(),
                                 is_stripprefix_enabled: $savedService->isStripprefixEnabled(),
diff --git a/database/migrations/2026_08_17_000000_add_is_force_https_enabled_to_service_applications_table.php b/database/migrations/2026_08_17_000000_add_is_force_https_enabled_to_service_applications_table.php
new file mode 100644
index 000000000..f389ef27d
--- /dev/null
+++ b/database/migrations/2026_08_17_000000_add_is_force_https_enabled_to_service_applications_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('service_applications', function (Blueprint $table) {
+            $table->boolean('is_force_https_enabled')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('service_applications', function (Blueprint $table) {
+            $table->dropColumn('is_force_https_enabled');
+        });
+    }
+};
diff --git a/resources/views/auth/two-factor-challenge.blade.php b/resources/views/auth/two-factor-challenge.blade.php
index 4170b188f..b15afc24d 100644
--- a/resources/views/auth/two-factor-challenge.blade.php
+++ b/resources/views/auth/two-factor-challenge.blade.php
@@ -2,35 +2,13 @@
     <x-auth.shell title="Coolify" description="Verify your identity to finish signing in.">
         <div class="flex flex-col gap-4" x-data="{
             showRecovery: false,
-            digits: ['', '', '', '', '', ''],
-            code: '',
-            focusNext(event) {
-                const nextInput = event.target.nextElementSibling;
-                if (nextInput?.tagName === 'INPUT') nextInput.focus();
-            },
-            focusPrevious(event) {
-                if (event.key !== 'Backspace' || event.target.value) return;
+            submitAuthenticatorCode(event) {
+                event.target.value = event.target.value.replace(/\D/g, '').slice(0, 6);
 
-                const previousInput = event.target.previousElementSibling;
-                if (previousInput?.tagName === 'INPUT') previousInput.focus();
-            },
-            updateCode() {
-                this.code = this.digits.join('');
-
-                if (this.code.length === 6) {
+                if (event.target.value.length === 6) {
                     this.$nextTick(() => this.$refs.challengeForm.requestSubmit());
                 }
             },
-            pasteCode(event) {
-                event.preventDefault();
-
-                const pastedDigits = event.clipboardData.getData('text').replace(/\D/g, '').slice(0, 6).split('');
-                const inputs = event.currentTarget.querySelectorAll('input[type=text]');
-
-                pastedDigits.forEach((digit, index) => this.digits[index] = digit);
-                this.updateCode();
-                inputs[Math.min(pastedDigits.length, 6) - 1]?.focus();
-            },
         }">
             @if (session('status'))
                 <x-auth.alert type="success">{{ session('status') }}</x-auth.alert>
@@ -56,17 +34,11 @@
                 @csrf
 
                 <div x-show="!showRecovery" class="flex flex-col gap-3">
-                    <input type="hidden" name="code" x-model="code" :disabled="showRecovery">
-                    <div class="flex justify-center gap-2" aria-label="Two-factor authentication code"
-                        @paste="pasteCode($event)">
-                        <template x-for="(digit, index) in digits" :key="index">
-                            <input type="text" inputmode="numeric" pattern="[0-9]*" maxlength="1"
-                                x-model="digits[index]" :aria-label="`Digit ${index + 1}`"
-                                @input="focusNext($event); updateCode()" @keydown="focusPrevious($event)"
-                                class="h-12 w-11 rounded-md border border-neutral-300 bg-white text-center text-lg font-semibold text-neutral-900 transition-colors focus:border-warning focus:outline-none focus:ring-1 focus:ring-warning dark:border-white/10 dark:bg-coolgray-100 dark:text-white sm:h-14 sm:w-12 sm:text-xl"
-                                autocomplete="one-time-code" />
-                        </template>
-                    </div>
+                    <input x-ref="authenticatorCode" type="text" name="code" inputmode="numeric"
+                        pattern="[0-9]*" maxlength="6" autocomplete="one-time-code" autofocus
+                        aria-label="Two-factor authentication code" :disabled="showRecovery"
+                        @input="submitAuthenticatorCode($event)"
+                        class="mx-auto h-14 w-64 rounded-md border border-neutral-300 bg-white px-4 text-center text-xl font-semibold tracking-[0.5em] text-neutral-900 transition-colors focus:border-warning focus:outline-none focus:ring-1 focus:ring-warning dark:border-white/10 dark:bg-coolgray-100 dark:text-white" />
                     <button type="button" class="auth-text-link self-center"
                         x-on:click="showRecovery = true; $nextTick(() => $refs.recoveryCode.focus())">
                         Use a recovery code
@@ -77,7 +49,7 @@ class="h-12 w-11 rounded-md border border-neutral-300 bg-white text-center text-
                     <x-forms.input x-ref="recoveryCode" name="recovery_code" autocomplete="one-time-code"
                         x-bind:disabled="!showRecovery" label="{{ __('input.recovery_code') }}" />
                     <button type="button" class="auth-text-link self-center"
-                        x-on:click="showRecovery = false; $nextTick(() => $el.closest('form').querySelector('input[type=text]').focus())">
+                        x-on:click="showRecovery = false; $nextTick(() => $refs.authenticatorCode.focus())">
                         Use an authenticator code
                     </button>
                 </div>
diff --git a/resources/views/components/services/links.blade.php b/resources/views/components/services/links.blade.php
index 5d7884628..32de3af61 100644
--- a/resources/views/components/services/links.blade.php
+++ b/resources/views/components/services/links.blade.php
@@ -2,15 +2,22 @@
     $linkItemClasses = 'listbox-option justify-start! gap-2.5!';
 @endphp
 
-<div @class(['relative', 'w-full' => $fullWidth]) x-data="{ open: false }"
+<div @class([
+    'relative' => !$compact,
+    'static' => $compact,
+    'w-full' => $fullWidth,
+]) x-data="{ open: false }"
     x-effect="$dispatch('resource-actions-toggled', { open })" @keydown.escape.window="open = false">
     <button type="button" @click="open = !open" @click.outside="open = false" title="Open service links"
         @class([
-            'app-tab shrink-0 gap-1' => !$fullWidth,
+            'app-tab shrink-0 gap-1' => !$fullWidth && !$compact,
             'button w-full justify-between' => $fullWidth,
+            'inline-flex h-6 shrink-0 items-center gap-1.5 rounded-full border border-neutral-200 bg-neutral-100 px-2 text-xs font-medium leading-none text-neutral-700 dark:border-white/[0.12] dark:bg-white/[0.07] dark:text-white' => $compact,
         ])>
         <span class="inline-flex items-center gap-2">
-            <x-reicon name="external-link" class="size-3.5 shrink-0 opacity-70" />
+            @unless ($compact)
+                <x-reicon name="external-link" class="size-3.5 shrink-0 opacity-70" />
+            @endunless
             Links
         </span>
         <span class="inline-flex transition-transform" :class="open && 'rotate-180'">
@@ -21,7 +28,8 @@
         @class([
             'listbox-panel top-full! mt-1! max-h-80! overflow-y-auto!',
             'left-0! right-0! w-full! min-w-0! max-w-none!' => $fullWidth,
-            'right-0! left-auto! min-w-60! max-w-96!' => !$fullWidth,
+            'left-1/2! right-auto! w-[calc(100vw-2rem)]! max-w-md! min-w-0! -translate-x-1/2' => $compact,
+            'right-0! left-auto! min-w-60! max-w-96!' => !$fullWidth && !$compact,
         ])>
         @forelse ($links as $link)
             <a class="{{ $linkItemClasses }}" target="_blank" href="{{ $link }}">
diff --git a/resources/views/livewire/project/application/domains.blade.php b/resources/views/livewire/project/application/domains.blade.php
index 04dd249c7..a11e6930f 100644
--- a/resources/views/livewire/project/application/domains.blade.php
+++ b/resources/views/livewire/project/application/domains.blade.php
@@ -8,6 +8,9 @@
     $helperText = $isCompose
         ? 'Manage domains for every service in this Docker Compose application.'
         : 'Manage domains for this application.';
+    $hasHttpsDomains = collect($domainRows)->contains(
+        fn ($row) => ! ($row['is_suggested'] ?? false) && str_starts_with(strtolower($row['url']), 'https://')
+    );
 @endphp
 
 <div class="flex flex-col gap-4"
@@ -66,6 +69,18 @@
             {{ $helperText }}
         </p>
 
+        @if ($hasHttpsDomains && ! $labelsAreWritable)
+            <div class="mt-4 max-w-md">
+                <x-forms.listbox id="isForceHttpsEnabled" label="Redirect HTTP to HTTPS"
+                    onChange="updateForceHttps"
+                    helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL."
+                    :options="[
+                        ['value' => true, 'label' => 'Enabled'],
+                        ['value' => false, 'label' => 'Disabled'],
+                    ]" :disabled="! auth()->user()->can('update', $application)" />
+            </div>
+        @endif
+
     </x-application.settings-section>
 
     {{-- Toolbar --}}
diff --git a/resources/views/livewire/project/service/domains.blade.php b/resources/views/livewire/project/service/domains.blade.php
index 59f573601..9399efe7f 100644
--- a/resources/views/livewire/project/service/domains.blade.php
+++ b/resources/views/livewire/project/service/domains.blade.php
@@ -159,12 +159,28 @@ class="application-settings-section-body is-flush mt-1 w-full scroll-mt-28 overf
                 @php
                     $app = collect($serviceApps)->firstWhere('id', (int) $appId);
                     $heading = \Illuminate\Support\Str::headline($app['name'] ?? $rows->first()['service_name'] ?? 'Service');
+                    $hasHttpsDomains = $rows->contains(
+                        fn ($row) => ! ($row['is_suggested'] ?? false) && str_starts_with(strtolower($row['url']), 'https://')
+                    );
                 @endphp
                 <section id="service-domain-group-{{ $appId }}" wire:key="service-domain-group-{{ $appId }}"
                     x-show="matchesDomainSearch(@js($heading.' '.$rows->pluck('url')->implode(' ')))"
                     class="border-b border-neutral-200 last:border-b-0 dark:border-white/10">
-                    <div class="flex w-full items-center gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-3 dark:border-white/10 dark:bg-white/[0.04]">
+                    <div class="flex w-full flex-wrap items-center gap-3 border-b border-neutral-200 bg-neutral-50 px-4 py-3 dark:border-white/10 dark:bg-white/[0.04]">
                         <span class="min-w-0 flex-1 truncate text-sm font-medium text-black dark:text-white">{{ $heading }}</span>
+                        @if ($hasHttpsDomains)
+                            <div class="w-full sm:w-72">
+                                <x-forms.listbox id="forceHttpsRedirects.{{ $appId }}"
+                                    htmlId="service-force-https-{{ $appId }}"
+                                    label="Redirect HTTP to HTTPS" onChange="updateForceHttps"
+                                    :onChangeArgs="[(int) $appId]"
+                                    helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL."
+                                    :options="[
+                                        ['value' => true, 'label' => 'Enabled'],
+                                        ['value' => false, 'label' => 'Disabled'],
+                                    ]" :disabled="! auth()->user()->can('update', $service)" />
+                            </div>
+                        @endif
                     </div>
 
                     <div wire:key="service-domain-rows-{{ $appId }}-{{ md5(serialize($rows->all())) }}">
diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index fd8f604cd..113a6c5a3 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -64,7 +64,10 @@
                 <h1 class="min-w-0 max-w-full truncate text-[24px]! leading-7! font-semibold! tracking-tight! text-black dark:text-fg">
                     {{ $service->name }}
                 </h1>
-                <x-status-summary :status="$service->status" title="Service status" container-name="Containers" />
+                <div class="relative flex w-full min-w-0 items-center gap-2">
+                    <x-status-summary :status="$service->status" title="Service status" container-name="Containers" />
+                    <x-services.links :service="$service" compact />
+                </div>
             </div>
         </div>
 
@@ -169,9 +172,6 @@ class="mb-3 inline-flex" aria-label="Open required environment variables">
                 </a>
             @endif
 
-            <div class="resource-heading-menus w-full">
-                <x-services.links :service="$service" full-width />
-            </div>
         </div>
 
         @teleport('#resource-action-hud-slot')
diff --git a/resources/views/livewire/project/shared/resource-operations.blade.php b/resources/views/livewire/project/shared/resource-operations.blade.php
index 70ba5acfa..255336d7d 100644
--- a/resources/views/livewire/project/shared/resource-operations.blade.php
+++ b/resources/views/livewire/project/shared/resource-operations.blade.php
@@ -246,7 +246,7 @@ class="mt-4 flex flex-col gap-3 border-t border-neutral-200 pt-4 sm:flex-row sm:
                     {{ data_get($resource, 'destination.network') }}.
                 </p>
                 <x-forms.button
-                    @click="$wire.cloneTo(@js($resource->destination->uuid), selectedCloneEnvironment)">
+                    @click="$wire.cloneTo(currentDestinationUuid, selectedCloneEnvironment)">
                     Clone resource
                 </x-forms.button>
             </div>
diff --git a/tests/Feature/ApplicationDomainsTest.php b/tests/Feature/ApplicationDomainsTest.php
index fbe72230d..50c71fe95 100644
--- a/tests/Feature/ApplicationDomainsTest.php
+++ b/tests/Feature/ApplicationDomainsTest.php
@@ -119,6 +119,27 @@
     expect(substr_count($html, 'this.$wire.updateRedirect('))->toBe(2);
 });
 
+it('shows the HTTP redirect control for HTTPS domains and persists changes', function () {
+    $this->application->update(['fqdn' => 'https://app.example.com']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertSet('isForceHttpsEnabled', true)
+        ->assertSee('Redirect HTTP to HTTPS')
+        ->assertSee('Keep enabled when Cloudflare uses Full or Full (Strict) SSL.')
+        ->set('isForceHttpsEnabled', false)
+        ->call('updateForceHttps')
+        ->assertHasNoErrors();
+
+    expect($this->application->settings->fresh()->is_force_https_enabled)->toBeFalse();
+});
+
+it('hides the HTTP redirect control for HTTP-only domains', function () {
+    $this->application->update(['fqdn' => 'http://app.example.com']);
+
+    Livewire::test(Domains::class, ['application' => $this->application->fresh()])
+        ->assertDontSee('Redirect HTTP to HTTPS');
+});
+
 it('shows one redirect direction control in each compose service header', function () {
     $this->application->update([
         'build_pack' => 'dockercompose',
diff --git a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
index 270927ca1..1b3e61be0 100644
--- a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
+++ b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
@@ -399,7 +399,7 @@
     expect(json_decode($plainApplication->docker_compose_domains, true))->toBeNull();
 });
 
-test('applicationParser selects the Coolify network for Traefik routed compose services', function () {
+test('applicationParser does not force the private resource network for Traefik routed compose services', function () {
     $application = Application::factory()->create([
         'environment_id' => $this->environment->id,
         'destination_id' => $this->destination->id,
@@ -422,7 +422,7 @@
     $parsedCompose = applicationParser($application);
     $labels = collect(data_get($parsedCompose, 'services.frontend.labels'));
 
-    expect($labels->values()->all())->toContain("traefik.docker.network={$application->uuid}");
+    expect($labels->values()->all())->not->toContain("traefik.docker.network={$application->uuid}");
 });
 
 test('applicationParser preserves a user-selected Traefik network', function () {
diff --git a/tests/Feature/Auth/TwoFactorChallengeAccessTest.php b/tests/Feature/Auth/TwoFactorChallengeAccessTest.php
index 4f1dee08c..f0dd97cc3 100644
--- a/tests/Feature/Auth/TwoFactorChallengeAccessTest.php
+++ b/tests/Feature/Auth/TwoFactorChallengeAccessTest.php
@@ -23,6 +23,18 @@
     expect($response->status())->toBeIn([200, 302]);
 });
 
+it('uses one mobile-friendly field for authenticator code paste and autofill', function () {
+    $challenge = file_get_contents(resource_path('views/auth/two-factor-challenge.blade.php'));
+
+    expect($challenge)
+        ->toContain('name="code"')
+        ->toContain('autocomplete="one-time-code"')
+        ->toContain('inputmode="numeric"')
+        ->toContain('maxlength="6"')
+        ->toContain('@input="submitAuthenticatorCode($event)"')
+        ->not->toContain('x-for="(digit, index) in digits"');
+});
+
 it('includes two-factor-challenge in allowed paths for unsubscribed accounts', function () {
     $paths = allowedPathsForUnsubscribedAccounts();
 
diff --git a/tests/Feature/ListboxTriggerTruncationTest.php b/tests/Feature/ListboxTriggerTruncationTest.php
index a64a97dd8..d5f259a85 100644
--- a/tests/Feature/ListboxTriggerTruncationTest.php
+++ b/tests/Feature/ListboxTriggerTruncationTest.php
@@ -114,7 +114,8 @@
         ->toContain('x-model="selectedCloneProject"')
         ->toContain('x-model="selectedCloneEnvironment"')
         ->toContain('$wire.cloneTo(selectedCloneDestination)')
-        ->toContain('$wire.cloneTo(@js($resource->destination->uuid), selectedCloneEnvironment)')
+        ->toContain('$wire.cloneTo(currentDestinationUuid, selectedCloneEnvironment)')
+        ->not->toContain('$wire.cloneTo(@js(')
         ->toContain('x-bind:disabled="!selectedMoveProject || availableEnvironments.length === 0"');
 });
 
diff --git a/tests/Feature/Mcp/McpEndpointTest.php b/tests/Feature/Mcp/McpEndpointTest.php
index 240f5b2e1..01ba0ecf1 100644
--- a/tests/Feature/Mcp/McpEndpointTest.php
+++ b/tests/Feature/Mcp/McpEndpointTest.php
@@ -216,6 +216,13 @@ function expectMcpAuditLog(array $expected): void
 
 test('get_server scrubs sensitive nested data and exposes connection_timeout', function () {
     $server = Server::factory()->create(['team_id' => $this->team->id]);
+    $server->proxy->set('last_saved_proxy_configuration', <<<'YAML'
+services:
+  traefik:
+    environment:
+      CF_DNS_API_TOKEN: plaintext-cloudflare-token
+YAML);
+    $server->saveQuietly();
     // creating hook auto-generates a sentinel_token; bump connection_timeout
     // via saveQuietly to avoid triggering restartSentinel.
     $server->settings->forceFill(['connection_timeout' => 42])->saveQuietly();
@@ -229,6 +236,9 @@ function expectMcpAuditLog(array $expected): void
     $raw = json_encode($body);
 
     expect($raw)->not->toContain('sentinel_token');
+    expect($raw)->not->toContain('last_saved_proxy_configuration');
+    expect($raw)->not->toContain('CF_DNS_API_TOKEN');
+    expect($raw)->not->toContain('plaintext-cloudflare-token');
     expect($raw)->not->toContain('"team_id"');
     expect($raw)->not->toContain('"private_key_id"');
     expect($body['data']['connection_timeout'])->toBe(42);
diff --git a/tests/Feature/Mcp/McpReadToolsTest.php b/tests/Feature/Mcp/McpReadToolsTest.php
index c3433bf45..6e146e719 100644
--- a/tests/Feature/Mcp/McpReadToolsTest.php
+++ b/tests/Feature/Mcp/McpReadToolsTest.php
@@ -590,6 +590,51 @@ function mcpReadJson($response): array
     expect($denied->json('result.isError'))->toBeTrue();
 });
 
+test('get_application omits free-form configuration that can contain secrets', function () {
+    $this->application->update([
+        'git_full_url' => 'https://oauth2:application-secret@example.com/repository.git',
+        'build_command' => 'API_TOKEN=application-secret npm run build',
+        'custom_docker_run_options' => '--env API_TOKEN=application-secret',
+        'custom_nginx_configuration' => base64_encode('proxy_set_header Authorization "Bearer application-secret";'),
+    ]);
+
+    $response = mcpReadCall('get_application', ['uuid' => $this->application->uuid]);
+    $response->assertOk();
+
+    $body = mcpReadJson($response);
+    $raw = json_encode($body);
+
+    expect($body['data']['uuid'])->toBe($this->application->uuid)
+        ->and($raw)->not->toContain('application-secret')
+        ->and($raw)->not->toContain('git_full_url')
+        ->and($raw)->not->toContain('build_command')
+        ->and($raw)->not->toContain('custom_docker_run_options')
+        ->and($raw)->not->toContain('custom_nginx_configuration');
+});
+
+test('get_database omits configuration blobs that can contain secrets', function () {
+    $database = StandalonePostgresql::create([
+        'name' => 'Secret-bearing config',
+        'postgres_password' => 'database-password',
+        'postgres_conf' => "primary_conninfo = 'password=database-config-secret'",
+        'custom_docker_run_options' => '--env API_TOKEN=database-config-secret',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $response = mcpReadCall('get_database', ['uuid' => $database->uuid]);
+    $response->assertOk();
+
+    $body = mcpReadJson($response);
+    $raw = json_encode($body);
+
+    expect($body['data']['uuid'])->toBe($database->uuid)
+        ->and($raw)->not->toContain('database-config-secret')
+        ->and($raw)->not->toContain('postgres_conf')
+        ->and($raw)->not->toContain('custom_docker_run_options');
+});
+
 test('list_destinations and get_destination are team scoped', function () {
     $response = mcpReadCall('list_destinations');
     $response->assertOk();
diff --git a/tests/Feature/ModelFillableCreationTest.php b/tests/Feature/ModelFillableCreationTest.php
index 50b6e02a9..46d9c36da 100644
--- a/tests/Feature/ModelFillableCreationTest.php
+++ b/tests/Feature/ModelFillableCreationTest.php
@@ -463,6 +463,7 @@
         'is_include_timestamps' => true,
         'is_gzip_enabled' => true,
         'is_stripprefix_enabled' => true,
+        'is_force_https_enabled' => false,
         'last_online_at' => now()->toISOString(),
         'is_migrated' => false,
     ]);
@@ -473,6 +474,26 @@
     expect($svcApp->human_name)->toBe('Web Server');
     expect($svcApp->image)->toBe('nginx:latest');
     expect($svcApp->is_log_drain_enabled)->toBeTrue();
+    expect($svcApp->is_force_https_enabled)->toBeFalse();
+    expect($svcApp->isForceHttpsEnabled())->toBeFalse();
+});
+
+it('enables HTTPS redirects for service applications by default', function () {
+    $service = Service::create([
+        'docker_compose_raw' => 'services: {}',
+        'environment_id' => $this->environment->id,
+        'server_id' => $this->server->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $serviceApplication = ServiceApplication::create([
+        'service_id' => $service->id,
+        'name' => 'web-default-redirect',
+    ]);
+
+    expect($serviceApplication->is_force_https_enabled)->toBeTrue();
+    expect($serviceApplication->isForceHttpsEnabled())->toBeTrue();
 });
 
 it('creates ServiceDatabase with all fillable attributes', function () {
diff --git a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
index 81e596ebf..bb9e88898 100644
--- a/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
+++ b/tests/Feature/ResourceHeadingUnifiedNavbarTest.php
@@ -635,20 +635,31 @@
         ->toContain('<x-reicon name="chevron-down"');
 });
 
-it('keeps service Links full width on mobile headings', function () {
+it('shows service Links as a compact badge beside the mobile status', function () {
     $service = file_get_contents(resource_path('views/livewire/project/service/heading.blade.php'));
-    $mobileServiceSection = str($service)->between('class="w-full md:hidden"', 'class="hidden w-full items-center md:flex')->toString();
-
-    expect($mobileServiceSection)
-        ->toContain('<x-services.links')
-        ->toContain('full-width')
-        ->toContain('resource-heading-menus')
-        ->not->toContain('<x-resource-heading-tabs');
-
     $serviceLinks = file_get_contents(resource_path('views/components/services/links.blade.php'));
+    $serviceLinksComponent = file_get_contents(app_path('View/Components/Services/Links.php'));
+    $mobileServiceTitle = str($service)->between('class="mb-3 w-full xl:hidden"', '<div class="w-full xl:hidden">')->toString();
+    $mobileServiceActions = str($service)->between('<div class="w-full xl:hidden">', '@teleport')->toString();
+
+    expect($mobileServiceTitle)
+        ->toContain('<x-status-summary')
+        ->toContain('<x-services.links')
+        ->toContain('relative flex w-full min-w-0 items-center gap-2')
+        ->toContain('compact')
+        ->not->toContain('full-width');
+
+    expect($mobileServiceActions)
+        ->not->toContain('<x-services.links');
+
+    expect($serviceLinksComponent)
+        ->toContain('public bool $compact = false');
+
     expect($serviceLinks)
-        ->toContain("'button w-full justify-between' => \$fullWidth")
-        ->toContain("'left-0! right-0! w-full! min-w-0! max-w-none!' => \$fullWidth")
+        ->toContain("'static' => \$compact")
+        ->toContain("'inline-flex h-6 shrink-0 items-center gap-1.5 rounded-full border border-neutral-200 bg-neutral-100 px-2 text-xs font-medium leading-none text-neutral-700 dark:border-white/[0.12] dark:bg-white/[0.07] dark:text-white' => \$compact")
+        ->toContain('@unless ($compact)')
+        ->toContain("'left-1/2! right-auto! w-[calc(100vw-2rem)]! max-w-md! min-w-0! -translate-x-1/2' => \$compact")
         ->toContain('<x-reicon name="chevron-down"')
         ->toContain('No links available');
 
diff --git a/tests/Feature/ServiceApplicationsApiTest.php b/tests/Feature/ServiceApplicationsApiTest.php
index d65967bd8..c8dd33a46 100644
--- a/tests/Feature/ServiceApplicationsApiTest.php
+++ b/tests/Feature/ServiceApplicationsApiTest.php
@@ -199,6 +199,20 @@ function createServiceWithoutApplicationsForApiTest(object $ctx): Service
         expect($ctx->serviceApplication->human_name)->toBe('Web UI');
     });
 
+    test('updates the HTTP to HTTPS redirect setting', function () {
+        config(['app.maintenance.driver' => 'file']);
+        $ctx = createServiceWithApplicationForApiTest($this);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->patchJson("/api/v1/services/{$ctx->service->uuid}/applications/{$ctx->serviceApplication->uuid}", [
+            'is_force_https_enabled' => false,
+        ]);
+
+        $response->assertSuccessful();
+        expect($ctx->serviceApplication->fresh()->is_force_https_enabled)->toBeFalse();
+    });
+
     test('returns 422 for invalid url scheme', function () {
         $ctx = createServiceWithApplicationForApiTest($this);
 
diff --git a/tests/Feature/ServiceDomainsTest.php b/tests/Feature/ServiceDomainsTest.php
index 36f602856..62ea41d96 100644
--- a/tests/Feature/ServiceDomainsTest.php
+++ b/tests/Feature/ServiceDomainsTest.php
@@ -125,6 +125,24 @@
         ->and(substr_count($html, "id=\"service-domain-group-{$this->apiApp->id}\""))->toBe(1);
 });
 
+it('shows and persists the HTTP redirect control for HTTPS service applications', function () {
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertSee('Redirect HTTP to HTTPS')
+        ->assertSee('Keep enabled when Cloudflare uses Full or Full (Strict) SSL.')
+        ->call('updateForceHttps', $this->apiApp->id, false)
+        ->assertHasNoErrors();
+
+    expect($this->apiApp->fresh()->is_force_https_enabled)->toBeFalse();
+    expect($this->service->fresh()->docker_compose)->not->toContain('middlewares=redirect-to-https');
+});
+
+it('hides the HTTP redirect control for HTTP-only service applications', function () {
+    $this->apiApp->update(['fqdn' => 'http://api.example.com']);
+
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->assertDontSee('Redirect HTTP to HTTPS');
+});
+
 it('shows one redirect control for each www and non-www pair', function () {
     $this->apiApp->update([
         'fqdn' => 'https://api.example.com,https://www.api.example.com,https://admin.example.com,https://www.admin.example.com',
@@ -146,6 +164,18 @@
         ->not->toContain('placeholder="https://app.example.com"');
 });
 
+it('resets the add domain dns gate when segmented domain fields change', function () {
+    Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
+        ->set('addDomainDnsFailed', true)
+        ->set('addDomainDnsMessage', 'DNS validation failed.')
+        ->set('forceSaveDns', true)
+        ->set('newDomainParts.host', 'web.example.com')
+        ->assertSet('newDomainPartsChanged', true)
+        ->assertSet('addDomainDnsFailed', false)
+        ->assertSet('addDomainDnsMessage', '')
+        ->assertSet('forceSaveDns', false);
+});
+
 it('shows dns entries control next to Add', function () {
     Livewire::test(Domains::class, ['service' => $this->service->fresh(['applications', 'server'])])
         ->assertSuccessful()
diff --git a/tests/Feature/TraefikServiceDockerNetworkLabelTest.php b/tests/Feature/TraefikServiceDockerNetworkLabelTest.php
index 4cf4ebc56..f1d7087a2 100644
--- a/tests/Feature/TraefikServiceDockerNetworkLabelTest.php
+++ b/tests/Feature/TraefikServiceDockerNetworkLabelTest.php
@@ -12,7 +12,7 @@
 
 uses(RefreshDatabase::class);
 
-it('selects the Coolify service network for Traefik routed compose services', function () {
+it('does not force the private service network for Traefik routed compose services', function () {
     Bus::fake();
 
     $team = Team::factory()->create();
@@ -45,5 +45,5 @@
     $parsedCompose = serviceParser($service);
     $labels = collect(data_get($parsedCompose, 'services.app.labels'));
 
-    expect($labels->values()->all())->toContain("traefik.docker.network={$service->uuid}");
+    expect($labels->values()->all())->not->toContain("traefik.docker.network={$service->uuid}");
 });
diff --git a/tests/Unit/FqdnLabelsNoindexTest.php b/tests/Unit/FqdnLabelsNoindexTest.php
index 48f2f4912..332d54898 100644
--- a/tests/Unit/FqdnLabelsNoindexTest.php
+++ b/tests/Unit/FqdnLabelsNoindexTest.php
@@ -17,13 +17,14 @@ function traefikLabels(array $domains, ?array $noindex = null, bool $forceHttps
     )->values()->all();
 }
 
-function caddyLabels(array $domains, ?array $noindex = null): array
+function caddyLabels(array $domains, ?array $noindex = null, bool $forceHttps = false): array
 {
     return fqdnLabelsForCaddy(
         network: 'testnetwork',
         uuid: 'testuuid',
         domains: collect($domains),
         onlyPort: 3000,
+        is_force_https_enabled: $forceHttps,
         noindex_domains: $noindex === null ? null : collect($noindex),
     )->values()->all();
 }
@@ -43,6 +44,33 @@ function middlewaresOf(array $labels, string $router): array
 }
 
 describe('Traefik noindex middleware', function () {
+    test('the HTTP router inherits the HTTPS middleware chain when redirects are disabled', function () {
+        $labels = fqdnLabelsForTraefik(
+            uuid: 'testuuid',
+            domains: collect(['https://example.com/api']),
+            is_force_https_enabled: false,
+            onlyPort: 3000,
+            serviceLabels: collect(['coolify.traefik.middlewares=rate-limit']),
+            redirect_direction: 'www',
+            is_http_basic_auth_enabled: true,
+            http_basic_auth_username: 'user',
+            http_basic_auth_password: 'secret',
+            noindex_domains: collect(['https://example.com/api']),
+        )->values()->all();
+
+        expect(middlewaresOf($labels, 'http-0-testuuid'))
+            ->toBe(middlewaresOf($labels, 'https-0-testuuid'))
+            ->toContain(
+                'https-0-testuuid-stripprefix',
+                'gzip',
+                '0-testuuid-to-www',
+                'http-basic-auth-testuuid',
+                '0-testuuid-noindex',
+                'rate-limit',
+            )
+            ->not->toContain('redirect-to-https');
+    });
+
     test('only the flagged domain gets the header', function () {
         $labels = traefikLabels(
             domains: ['https://prod.example.com', 'https://staging.example.com'],
@@ -138,6 +166,44 @@ function middlewaresOf(array $labels, string $router): array
 });
 
 describe('Caddy noindex header', function () {
+    test('serves an HTTPS public domain over HTTP and HTTPS when the HTTPS redirect is disabled', function () {
+        expect(caddyLabels(['https://example.com'], forceHttps: false))
+            ->toContain('caddy_0=http://example.com, https://example.com');
+    });
+
+    test('serves an HTTPS public domain over HTTPS when the HTTPS redirect is enabled', function () {
+        expect(caddyLabels(['https://example.com'], forceHttps: true))
+            ->toContain('caddy_0=https://example.com');
+    });
+
+    test('canonical redirects preserve the request scheme when the HTTPS redirect is disabled', function (string $domain, string $redirectDirection, string $expectedRedirect, string $httpsRedirect) {
+        $labels = fqdnLabelsForCaddy(
+            network: 'testnetwork',
+            uuid: 'testuuid',
+            domains: collect([$domain]),
+            is_force_https_enabled: false,
+            onlyPort: 3000,
+            redirect_direction: $redirectDirection,
+        );
+
+        expect($labels)
+            ->toContain($expectedRedirect)
+            ->not->toContain($httpsRedirect);
+    })->with([
+        'www redirect' => [
+            'https://example.com',
+            'www',
+            'caddy_0.redir={scheme}://www.example.com{uri}',
+            'caddy_0.redir=https://www.example.com{uri}',
+        ],
+        'non-www redirect' => [
+            'https://www.example.com',
+            'non-www',
+            'caddy_0.redir={scheme}://example.com{uri}',
+            'caddy_0.redir=https://example.com{uri}',
+        ],
+    ]);
+
     test('the flagged domain uses the header block, the other keeps the inline form', function () {
         $labels = caddyLabels(
             domains: ['https://prod.example.com', 'https://staging.example.com'],
diff --git a/tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php b/tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php
index 28675903b..5f940108c 100644
--- a/tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php
+++ b/tests/Unit/ServerTransfer/ServerTransferExporterImporterTest.php
@@ -509,6 +509,7 @@
         'is_log_drain_enabled' => true,
         'is_gzip_enabled' => false,
         'is_stripprefix_enabled' => false,
+        'is_force_https_enabled' => false,
         'status' => 'running:healthy',
     ]);
     $serviceApp->uuid = 'svc-app-whoami';
@@ -722,6 +723,7 @@
         ->and($importedSvcApp->exposes)->toBe('80')
         ->and((bool) $importedSvcApp->is_gzip_enabled)->toBeFalse()
         ->and((bool) $importedSvcApp->is_stripprefix_enabled)->toBeFalse()
+        ->and((bool) $importedSvcApp->is_force_https_enabled)->toBeFalse()
         ->and($importedSvcApp->environment_variables()->where('key', 'WHOAMI_NAME')->first()?->value)->toBe('nested-secret')
         ->and($importedSvcApp->persistentStorages)->toHaveCount(1)
         ->and($importedSvcApp->fileStorages)->toHaveCount(1)

From 0d23b29775b0325801e9d9c0e0b768bea91ccc33 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 09:16:29 +0200
Subject: [PATCH 20/42] fix: honor GitHub default branches and reconcile proxy
 networks

Use searchable repository and branch selectors, select each repository's default branch when available, and discover running container networks during proxy reconciliation.
---
 .../Project/New/GithubPrivateRepository.php   | 10 ++--
 bootstrap/helpers/proxy.php                   | 23 ++++----
 .../forms/searchable-listbox.blade.php        |  2 +-
 .../new/github-private-repository.blade.php   |  8 +--
 tests/Feature/GithubPrivateRepositoryTest.php | 48 +++++++++++++++--
 .../RuntimeNetworkReconciliationTest.php      | 53 +++++++++++++++++++
 .../SearchableListboxComponentTest.php        |  1 +
 7 files changed, 123 insertions(+), 22 deletions(-)
 create mode 100644 tests/Feature/Proxy/RuntimeNetworkReconciliationTest.php

diff --git a/app/Livewire/Project/New/GithubPrivateRepository.php b/app/Livewire/Project/New/GithubPrivateRepository.php
index 925f8d969..cef0cf6ac 100644
--- a/app/Livewire/Project/New/GithubPrivateRepository.php
+++ b/app/Livewire/Project/New/GithubPrivateRepository.php
@@ -134,8 +134,9 @@ public function loadRepositories(int $github_app_id): void
 
     public function loadBranches()
     {
-        $this->selected_repository_owner = $this->repositories->where('id', $this->selected_repository_id)->first()['owner']['login'];
-        $this->selected_repository_repo = $this->repositories->where('id', $this->selected_repository_id)->first()['name'];
+        $repository = $this->repositories->firstWhere('id', $this->selected_repository_id);
+        $this->selected_repository_owner = data_get($repository, 'owner.login');
+        $this->selected_repository_repo = data_get($repository, 'name');
         $this->branches = collect();
         $this->page = 1;
         $this->loadBranchByPage();
@@ -146,7 +147,10 @@ public function loadBranches()
             }
         }
         $this->branches = sortBranchesByPriority($this->branches);
-        $this->selected_branch_name = data_get($this->branches, '0.name', 'main');
+        $defaultBranch = data_get($repository, 'default_branch', 'main');
+        $this->selected_branch_name = $this->branches->contains('name', $defaultBranch)
+            ? $defaultBranch
+            : data_get($this->branches, '0.name', 'main');
     }
 
     protected function loadBranchByPage()
diff --git a/bootstrap/helpers/proxy.php b/bootstrap/helpers/proxy.php
index 699704393..31e55da33 100644
--- a/bootstrap/helpers/proxy.php
+++ b/bootstrap/helpers/proxy.php
@@ -107,8 +107,8 @@ function collectDockerNetworksByServer(Server $server)
 }
 function connectProxyToNetworks(Server $server)
 {
-    ['networks' => $networks] = collectDockerNetworksByServer($server);
     if ($server->isSwarm()) {
+        ['networks' => $networks] = collectDockerNetworksByServer($server);
         $commands = $networks->map(function ($network) {
             $safe = escapeshellarg($network);
 
@@ -118,19 +118,20 @@ function connectProxyToNetworks(Server $server)
                 "echo 'Successfully connected coolify-proxy to {$safe} network.'",
             ];
         });
-    } else {
-        $commands = $networks->map(function ($network) {
-            $safe = escapeshellarg($network);
 
-            return [
-                "docker network ls --format '{{.Name}}' | grep '^{$network}$' >/dev/null || docker network create --attachable {$safe} >/dev/null",
-                "docker network connect {$safe} coolify-proxy >/dev/null 2>&1 || true",
-                "echo 'Successfully connected coolify-proxy to {$safe} network.'",
-            ];
-        });
+        return $commands->flatten();
     }
 
-    return $commands->flatten();
+    return collect([
+        'for network in $(docker inspect $(docker ps --filter label=coolify.managed=true --format "{{.ID}}") --format=\'{{range $network, $_ := .NetworkSettings.Networks}}{{println $network}}{{end}}\' 2>/dev/null | sort -u); do',
+        '    if [ -z "$network" ] || [ "$network" = "bridge" ] || [ "$network" = "host" ] || [ "$network" = "none" ] || [ "$network" = "default" ]; then',
+        '        continue',
+        '    fi',
+        '    if docker network inspect "$network" >/dev/null 2>&1; then',
+        '        docker network connect "$network" coolify-proxy >/dev/null 2>&1 || true',
+        '    fi',
+        'done',
+    ]);
 }
 
 /**
diff --git a/resources/views/components/forms/searchable-listbox.blade.php b/resources/views/components/forms/searchable-listbox.blade.php
index c75a50c0b..9a7a88efd 100644
--- a/resources/views/components/forms/searchable-listbox.blade.php
+++ b/resources/views/components/forms/searchable-listbox.blade.php
@@ -111,7 +111,7 @@
             @click.stop>
             <div class="searchable-listbox-search">
                 <x-reicon name="search"
-                    class="pointer-events-none absolute top-1/2 left-2.5 size-3.5 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
+                    class="pointer-events-none absolute top-1/2 left-3 size-3 -translate-y-1/2 text-neutral-400 dark:text-fg-faint" />
                 <input x-ref="search" type="search" x-model="query" autocomplete="off"
                     placeholder="{{ $searchPlaceholder }}"
                     class="searchable-listbox-search-input"
diff --git a/resources/views/livewire/project/new/github-private-repository.blade.php b/resources/views/livewire/project/new/github-private-repository.blade.php
index be4c189a3..26aaf3530 100644
--- a/resources/views/livewire/project/new/github-private-repository.blade.php
+++ b/resources/views/livewire/project/new/github-private-repository.blade.php
@@ -72,10 +72,11 @@ class="flex size-9 shrink-0 items-center justify-center rounded-lg bg-neutral-10
             <div class="application-settings-section-body">
                 @if ($repositories->isNotEmpty())
                     <div class="flex items-end gap-2">
-                        <x-forms.listbox id="selected_repository_id" label="Repository" required live
+                        <x-forms.searchable-listbox id="selected_repository_id" label="Repository" required live
+                            searchPlaceholder="Search repositories…"
                             :options="$repositories->map(fn ($repository) => [
                                 'value' => data_get($repository, 'id'),
-                                'label' => data_get($repository, 'name'),
+                                'label' => data_get($repository, 'full_name', data_get($repository, 'name')),
                             ])->values()->all()" />
                         <x-forms.button :showLoadingIndicator="false" wire:click.prevent="loadBranches"
                             wire:loading.attr="disabled"
@@ -104,7 +105,8 @@ class="flex size-9 shrink-0 items-center justify-center rounded-lg bg-neutral-10
                     </div>
                     <div class="application-settings-section-body space-y-5">
                         <div class="grid gap-4 sm:grid-cols-2">
-                            <x-forms.listbox id="selected_branch_name" label="Branch" required
+                            <x-forms.searchable-listbox id="selected_branch_name" label="Branch" required
+                                searchPlaceholder="Search branches…"
                                 :options="$branches->map(fn ($branch) => [
                                     'value' => data_get($branch, 'name'),
                                     'label' => data_get($branch, 'name'),
diff --git a/tests/Feature/GithubPrivateRepositoryTest.php b/tests/Feature/GithubPrivateRepositoryTest.php
index 9884bca8c..6de13f0c7 100644
--- a/tests/Feature/GithubPrivateRepositoryTest.php
+++ b/tests/Feature/GithubPrivateRepositoryTest.php
@@ -105,19 +105,59 @@ function githubPrivateRepositoryTestPrivateKeyForTeam(Team $team): PrivateKey
             ->assertSet('selected_repository_id', 1);
     });
 
-    test('repository selection uses the shared listbox and disables loading action', function () {
+    test('repository selection uses the searchable listbox and disables loading action', function () {
         fakeGithubHttp([
             ['id' => 1, 'name' => 'alpha-repo', 'owner' => ['login' => 'testuser']],
         ]);
 
         Livewire::test(GithubPrivateRepository::class, ['type' => 'private-gh-app'])
             ->call('loadRepositories', $this->githubApp->id)
-            ->assertSee('id="selected_repository_id-trigger"', false)
+            ->assertSee('class="listbox-panel searchable-listbox-panel"', false)
+            ->assertSee('placeholder="Search repositories…"', false)
             ->assertSee('wire:loading.attr="disabled"', false)
             ->assertSee('wire:target="loadBranches,selected_repository_id"', false)
             ->assertDontSee('<datalist', false);
     });
 
+    test('loadBranches fetches available branches and selects the repository default branch', function () {
+        $repository = [
+            'id' => 1,
+            'name' => 'alpha-repo',
+            'default_branch' => 'production',
+            'owner' => ['login' => 'testuser'],
+        ];
+
+        fakeGithubHttp([$repository]);
+        Http::fake([
+            'https://api.github.com/zen' => Http::response('Keep it logically awesome.', 200, [
+                'Date' => now()->toRfc7231String(),
+            ]),
+            'https://api.github.com/app/installations/67890/access_tokens' => Http::response([
+                'token' => 'fake-installation-token',
+            ], 201),
+            'https://api.github.com/installation/repositories*' => Http::response([
+                'total_count' => 1,
+                'repositories' => [$repository],
+            ], 200),
+            'https://api.github.com/repos/testuser/alpha-repo/branches*' => Http::response([
+                ['name' => 'main'],
+                ['name' => 'feature/login'],
+                ['name' => 'production'],
+            ], 200),
+        ]);
+
+        Livewire::test(GithubPrivateRepository::class, ['type' => 'private-gh-app'])
+            ->call('loadRepositories', $this->githubApp->id)
+            ->call('loadBranches')
+            ->assertSet('selected_branch_name', 'production')
+            ->assertSet('branches', collect([
+                ['name' => 'main'],
+                ['name' => 'feature/login'],
+                ['name' => 'production'],
+            ]))
+            ->assertSee('placeholder="Search branches…"', false);
+    });
+
     test('continue button uses the shared submit loading indicator', function () {
         fakeGithubHttp([
             ['id' => 1, 'name' => 'alpha-repo', 'owner' => ['login' => 'testuser']],
@@ -301,11 +341,11 @@ function githubPrivateRepositoryTestPrivateKeyForTeam(Team $team): PrivateKey
 
         Livewire::test(GithubPrivateRepository::class, ['type' => 'private-gh-app'])
             ->call('loadRepositories', $this->githubApp->id)
-            ->assertSee('Refresh Repository List');
+            ->assertSee('Refresh');
     });
 
     test('refresh button is not visible before repositories are loaded', function () {
         Livewire::test(GithubPrivateRepository::class, ['type' => 'private-gh-app'])
-            ->assertDontSee('Refresh Repository List');
+            ->assertDontSee('Refresh');
     });
 });
diff --git a/tests/Feature/Proxy/RuntimeNetworkReconciliationTest.php b/tests/Feature/Proxy/RuntimeNetworkReconciliationTest.php
new file mode 100644
index 000000000..719455539
--- /dev/null
+++ b/tests/Feature/Proxy/RuntimeNetworkReconciliationTest.php
@@ -0,0 +1,53 @@
+<?php
+
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('discovers running container networks instead of relying on cached resource statuses', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+
+    $commands = connectProxyToNetworks($server)->implode("\n");
+
+    expect($commands)
+        ->toContain('docker ps --filter label=coolify.managed=true')
+        ->toContain('.NetworkSettings.Networks')
+        ->toContain('docker network inspect "$network"')
+        ->toContain('docker network connect "$network" coolify-proxy')
+        ->not->toContain('docker network create');
+});
+
+it('skips Docker system networks during runtime reconciliation', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+
+    $commands = connectProxyToNetworks($server)->implode("\n");
+
+    expect($commands)
+        ->toContain('"$network" = "bridge"')
+        ->toContain('"$network" = "host"')
+        ->toContain('"$network" = "none"')
+        ->toContain('"$network" = "default"');
+});
+
+it('preserves runtime reconciliation loops for non-root SSH users', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'user' => 'ubuntu',
+    ]);
+
+    $commands = collect(parseCommandsByLineForSudo(connectProxyToNetworks($server), $server))->implode("\n");
+
+    expect($commands)
+        ->toContain('$(sudo docker ps')
+        ->toMatch('/sudo\s+docker inspect/')
+        ->toMatch('/sudo\s+docker network inspect/')
+        ->toMatch('/sudo\s+docker network connect/')
+        ->not->toContain('sudo while')
+        ->not->toContain('sudo done')
+        ->not->toContain('sudo continue');
+});
diff --git a/tests/Feature/SearchableListboxComponentTest.php b/tests/Feature/SearchableListboxComponentTest.php
index a0f66d422..828e498f2 100644
--- a/tests/Feature/SearchableListboxComponentTest.php
+++ b/tests/Feature/SearchableListboxComponentTest.php
@@ -19,6 +19,7 @@
         ->toContain('No matching timezone')
         ->toContain('serverTimezone-trigger')
         ->toContain('x-ref="search"')
+        ->toContain('left-3 size-3')
         ->toContain('get filtered()')
         ->toContain('searchable-listbox-panel')
         ->toContain('Berlin')

From 8ecf77eadbbd1667c9565fac223cfdbffd0a9e17 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 09:42:22 +0200
Subject: [PATCH 21/42] fix(postgresql): persist selected public access state

---
 .../Project/Database/Postgresql/General.php         |  6 +++++-
 .../project/database/postgresql/general.blade.php   |  2 +-
 tests/Feature/DatabasePublicAccessLoadingTest.php   | 13 +++++++++++++
 3 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/app/Livewire/Project/Database/Postgresql/General.php b/app/Livewire/Project/Database/Postgresql/General.php
index 8993cc251..051fb515d 100644
--- a/app/Livewire/Project/Database/Postgresql/General.php
+++ b/app/Livewire/Project/Database/Postgresql/General.php
@@ -209,11 +209,15 @@ public function instantSaveAdvanced()
         }
     }
 
-    public function instantSave()
+    public function instantSave(?bool $isPublic = null)
     {
         try {
             $this->authorize('update', $this->database);
 
+            if ($isPublic !== null) {
+                $this->isPublic = $isPublic;
+            }
+
             if ($this->isPublic && ! $this->publicPort) {
                 $this->dispatch('error', 'Public port is required.');
                 $this->isPublic = false;
diff --git a/resources/views/livewire/project/database/postgresql/general.blade.php b/resources/views/livewire/project/database/postgresql/general.blade.php
index 3288a0ac6..705cad441 100644
--- a/resources/views/livewire/project/database/postgresql/general.blade.php
+++ b/resources/views/livewire/project/database/postgresql/general.blade.php
@@ -89,7 +89,7 @@
             <x-table.loading target="instantSave" text="Updating public access..." />
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
-                    <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
+                    <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave" :onChangeArgs="[]"
                         :disabled="! auth()->user()->can('update', $database)" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
diff --git a/tests/Feature/DatabasePublicAccessLoadingTest.php b/tests/Feature/DatabasePublicAccessLoadingTest.php
index 81529fb1d..4b81d5f28 100644
--- a/tests/Feature/DatabasePublicAccessLoadingTest.php
+++ b/tests/Feature/DatabasePublicAccessLoadingTest.php
@@ -26,3 +26,16 @@
             ->not->toContain('id="publicPort" live');
     }
 });
+
+it('passes the selected PostgreSQL public access state to the save action', function () {
+    $generalSettings = file_get_contents(resource_path('views/livewire/project/database/postgresql/general.blade.php'));
+
+    expect($generalSettings)
+        ->toContain('onChange="instantSave" :onChangeArgs="[]"');
+
+    $component = file_get_contents(app_path('Livewire/Project/Database/Postgresql/General.php'));
+
+    expect($component)
+        ->toContain('public function instantSave(?bool $isPublic = null)')
+        ->toContain('$this->isPublic = $isPublic;');
+});

From ab5025f0a77879a620213ac759ff1231a90f9aa0 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 09:42:36 +0200
Subject: [PATCH 22/42] fix: select Traefik networks and stabilize dropdown
 positioning

---
 bootstrap/helpers/parsers.php                       |  6 ++++++
 resources/views/components/table/dropdown.blade.php | 13 ++++++++-----
 .../ApplicationParserDockerComposeDomainsTest.php   |  4 ++--
 tests/Feature/StandardTableComponentsTest.php       |  3 +++
 .../TraefikServiceDockerNetworkLabelTest.php        |  4 ++--
 5 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/bootstrap/helpers/parsers.php b/bootstrap/helpers/parsers.php
index 7dd1c163c..b47e57047 100644
--- a/bootstrap/helpers/parsers.php
+++ b/bootstrap/helpers/parsers.php
@@ -1359,6 +1359,9 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
             $redirectDirection = in_array($composeRedirect, ['www', 'non-www', 'both'], true)
                 ? $composeRedirect
                 : 'both';
+            if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
+                $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
+            }
             if ($shouldGenerateLabelsExactly) {
                 switch ($server->proxyType()) {
                     case ProxyTypes::TRAEFIK->value:
@@ -2633,6 +2636,9 @@ function serviceParser(Service $resource): Collection
             $redirectDirection = in_array(data_get($originalResource, 'redirect'), ['www', 'non-www', 'both'], true)
                 ? data_get($originalResource, 'redirect')
                 : 'both';
+            if (! $use_network_mode && (! $shouldGenerateLabelsExactly || $server->proxyType() === ProxyTypes::TRAEFIK->value)) {
+                $serviceLabels = addTraefikDockerNetworkLabel($serviceLabels, $baseNetwork->first());
+            }
             if ($shouldGenerateLabelsExactly) {
                 switch ($server->proxyType()) {
                     case ProxyTypes::TRAEFIK->value:
diff --git a/resources/views/components/table/dropdown.blade.php b/resources/views/components/table/dropdown.blade.php
index 6a0472191..b290128f9 100644
--- a/resources/views/components/table/dropdown.blade.php
+++ b/resources/views/components/table/dropdown.blade.php
@@ -6,13 +6,16 @@
 
 <div class="relative" x-data="{
     open: false,
-    panelStyle: 'display: none;',
+    panelStyle: 'position: fixed; min-width: 0; visibility: hidden;',
     toggle() {
-        this.open = !this.open;
-
         if (this.open) {
-            this.$nextTick(() => this.updatePosition());
+            this.open = false;
+            return;
         }
+
+        this.panelStyle = 'position: fixed; min-width: 0; visibility: hidden;';
+        this.open = true;
+        this.$nextTick(() => this.updatePosition());
     },
     updatePosition() {
         const trigger = this.$refs.trigger.getBoundingClientRect();
@@ -24,7 +27,7 @@
             ? trigger.bottom + 4
             : Math.max(viewportPadding, trigger.top - panel.height - 4);
 
-        this.panelStyle = `position: fixed; left: ${left}px; top: ${top}px;`;
+        this.panelStyle = `position: fixed; left: ${left}px; top: ${top}px; min-width: 0;`;
     }
 }" @click.outside="open = false" @keydown.escape.window="open = false"
     x-on:resize.window="if (open) updatePosition()" x-on:scroll.window="if (open) updatePosition()">
diff --git a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
index 1b3e61be0..ebcb51fe1 100644
--- a/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
+++ b/tests/Feature/ApplicationParserDockerComposeDomainsTest.php
@@ -399,7 +399,7 @@
     expect(json_decode($plainApplication->docker_compose_domains, true))->toBeNull();
 });
 
-test('applicationParser does not force the private resource network for Traefik routed compose services', function () {
+test('applicationParser selects the resource network for Traefik routed compose services', function () {
     $application = Application::factory()->create([
         'environment_id' => $this->environment->id,
         'destination_id' => $this->destination->id,
@@ -422,7 +422,7 @@
     $parsedCompose = applicationParser($application);
     $labels = collect(data_get($parsedCompose, 'services.frontend.labels'));
 
-    expect($labels->values()->all())->not->toContain("traefik.docker.network={$application->uuid}");
+    expect($labels->values()->all())->toContain("traefik.docker.network={$application->uuid}");
 });
 
 test('applicationParser preserves a user-selected Traefik network', function () {
diff --git a/tests/Feature/StandardTableComponentsTest.php b/tests/Feature/StandardTableComponentsTest.php
index 28f07a9a2..9741268bc 100644
--- a/tests/Feature/StandardTableComponentsTest.php
+++ b/tests/Feature/StandardTableComponentsTest.php
@@ -24,7 +24,10 @@
         ->toContain('wire:model.live="search"')
         ->not->toContain('x-teleport="body"')
         ->not->toContain('floatingDropdown(')
+        ->toContain("panelStyle: 'position: fixed; min-width: 0; visibility: hidden;'")
+        ->toContain("this.panelStyle = 'position: fixed; min-width: 0; visibility: hidden;'")
         ->toContain('position: fixed')
+        ->toContain('min-width: 0')
         ->toContain('getBoundingClientRect()')
         ->toContain('x-show="open"')
         ->toContain('aria-multiselectable="true"')
diff --git a/tests/Feature/TraefikServiceDockerNetworkLabelTest.php b/tests/Feature/TraefikServiceDockerNetworkLabelTest.php
index f1d7087a2..c098a2e93 100644
--- a/tests/Feature/TraefikServiceDockerNetworkLabelTest.php
+++ b/tests/Feature/TraefikServiceDockerNetworkLabelTest.php
@@ -12,7 +12,7 @@
 
 uses(RefreshDatabase::class);
 
-it('does not force the private service network for Traefik routed compose services', function () {
+it('selects the private service network for Traefik routed compose services', function () {
     Bus::fake();
 
     $team = Team::factory()->create();
@@ -45,5 +45,5 @@
     $parsedCompose = serviceParser($service);
     $labels = collect(data_get($parsedCompose, 'services.app.labels'));
 
-    expect($labels->values()->all())->not->toContain("traefik.docker.network={$service->uuid}");
+    expect($labels->values()->all())->toContain("traefik.docker.network={$service->uuid}");
 });

From 48da7ee6e2764e28554cea7e691683edde364001 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 10:02:28 +0200
Subject: [PATCH 23/42] fix(table): preserve computed dropdown top position

---
 resources/views/components/table/dropdown.blade.php | 2 +-
 tests/Feature/TablePaginationLoadingTest.php        | 3 ++-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/resources/views/components/table/dropdown.blade.php b/resources/views/components/table/dropdown.blade.php
index b290128f9..c3ff1a2e5 100644
--- a/resources/views/components/table/dropdown.blade.php
+++ b/resources/views/components/table/dropdown.blade.php
@@ -36,7 +36,7 @@
     </div>
 
     <div x-ref="panel" x-show="open" x-cloak :style="panelStyle"
-        class="listbox-panel fixed! top-auto! right-auto! bottom-auto! z-[90]! mt-0! {{ $panelClass }}" role="{{ $role }}"
+        class="listbox-panel fixed! right-auto! bottom-auto! z-[90]! mt-0! {{ $panelClass }}" role="{{ $role }}"
         @if ($multiselectable) aria-multiselectable="true" @endif>
         {{ $slot }}
     </div>
diff --git a/tests/Feature/TablePaginationLoadingTest.php b/tests/Feature/TablePaginationLoadingTest.php
index d26a1a33d..49bb97400 100644
--- a/tests/Feature/TablePaginationLoadingTest.php
+++ b/tests/Feature/TablePaginationLoadingTest.php
@@ -41,7 +41,8 @@
     expect($html)
         ->toContain('position: fixed')
         ->toContain('getBoundingClientRect()')
-        ->toContain('x-on:scroll.window');
+        ->toContain('x-on:scroll.window')
+        ->not->toContain('top-auto!');
 });
 
 it('renders compact client-side pagination', function () {

From a3e78a36778e98634e6ad37ebdbef494aeb6b1bc Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 10:18:52 +0200
Subject: [PATCH 24/42] fix(authorization): gate mutable Livewire controls by
 policy

Disable unauthorized listbox inputs and hide application deploy actions, with updated disabled styling and coverage.
---
 resources/css/app.css                         |  8 +-
 .../components/database-status-info.blade.php |  4 +-
 .../views/components/forms/listbox.blade.php  |  7 ++
 .../livewire/notifications/discord.blade.php  |  2 +-
 .../livewire/notifications/email.blade.php    | 10 +--
 .../project/application/domains.blade.php     |  4 +-
 .../project/application/heading.blade.php     |  4 +
 .../project/application/swarm.blade.php       |  2 +-
 .../database/clickhouse/general.blade.php     |  4 +-
 .../database/dragonfly/general.blade.php      |  4 +-
 .../project/database/heading.blade.php        |  4 +
 .../project/database/keydb/general.blade.php  |  4 +-
 .../database/mariadb/general.blade.php        |  4 +-
 .../database/mongodb/general.blade.php        |  4 +-
 .../project/database/mysql/general.blade.php  |  4 +-
 .../database/postgresql/general.blade.php     |  4 +-
 .../project/database/redis/general.blade.php  |  4 +-
 .../project/service/domains.blade.php         |  4 +-
 .../project/service/heading.blade.php         |  4 +
 .../project/service/stack-form.blade.php      |  2 +-
 .../shared/scheduled-task/show.blade.php      | 10 +--
 .../storages/volume-backups/s3.blade.php      |  4 +-
 .../livewire/server/log-drains.blade.php      |  6 +-
 .../views/livewire/server/swarm.blade.php     |  4 +-
 .../livewire/source/github/change.blade.php   |  4 +-
 .../livewire/source/gitlab/change.blade.php   |  2 +-
 resources/views/livewire/team/index.blade.php |  2 +-
 .../Feature/ListboxTriggerTruncationTest.php  |  9 ++
 ...bleLivewireComponentsAuthorizationTest.php | 83 +++++++++++++++++++
 29 files changed, 164 insertions(+), 47 deletions(-)

diff --git a/resources/css/app.css b/resources/css/app.css
index 95e0207ce..636cf2ce8 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -1905,7 +1905,13 @@ .dark .listbox-trigger {
 
 .listbox-trigger:disabled {
     cursor: not-allowed;
-    opacity: 0.5;
+    background-color: var(--color-neutral-100);
+    color: var(--color-neutral-400);
+}
+
+.dark .listbox-trigger:disabled {
+    background-color: color-mix(in oklab, var(--color-white) 3%, transparent);
+    color: var(--color-fg-faint);
 }
 
 .listbox-trigger:focus-visible {
diff --git a/resources/views/components/database-status-info.blade.php b/resources/views/components/database-status-info.blade.php
index 5e352c206..b9298e268 100644
--- a/resources/views/components/database-status-info.blade.php
+++ b/resources/views/components/database-status-info.blade.php
@@ -65,7 +65,7 @@
                 </div>
             @endif
             <div class="grid gap-4 sm:grid-cols-2">
-                <x-forms.listbox id="enableSsl" label="SSL"
+                <x-forms.listbox canGate="update" :canResource="$database" id="enableSsl" label="SSL"
                     onChange="instantSaveSSL"
                     :disabled="! $isExited || ! auth()->user()?->can('update', $database)"
                     :options="[
@@ -73,7 +73,7 @@
                         ['value' => false, 'label' => 'Disabled'],
                     ]" />
                 @if ($sslModeOptions)
-                    <x-forms.listbox id="sslMode" label="SSL mode" :helper="$sslModeHelper"
+                    <x-forms.listbox canGate="update" :canResource="$database" id="sslMode" label="SSL mode" :helper="$sslModeHelper"
                         onChange="instantSaveSSL"
                         :disabled="! $enableSsl || ! $isExited || ! auth()->user()?->can('update', $database)"
                         :options="collect($sslModeOptions)->map(fn ($option, $value) => [
diff --git a/resources/views/components/forms/listbox.blade.php b/resources/views/components/forms/listbox.blade.php
index 4677911d9..d04a5f57e 100644
--- a/resources/views/components/forms/listbox.blade.php
+++ b/resources/views/components/forms/listbox.blade.php
@@ -16,9 +16,16 @@
     'tooltip' => true,
     'portal' => false,
     'preserveValue' => false,
+    'canGate' => null,
+    'canResource' => null,
+    'autoDisable' => true,
 ])
 
 @php
+    if ($canGate && $canResource && $autoDisable && ! Illuminate\Support\Facades\Gate::allows($canGate, $canResource)) {
+        $disabled = true;
+    }
+
     $triggerId = ($htmlId ?? $id).'-trigger';
     $panelId = ($htmlId ?? $id).'-panel';
 @endphp
diff --git a/resources/views/livewire/notifications/discord.blade.php b/resources/views/livewire/notifications/discord.blade.php
index 5fdeb10da..9e568c845 100644
--- a/resources/views/livewire/notifications/discord.blade.php
+++ b/resources/views/livewire/notifications/discord.blade.php
@@ -15,7 +15,7 @@
                 </x-slot:actions>
 
                 <div class="grid gap-4 lg:grid-cols-2">
-                    <x-forms.listbox id="discordPingEnabled" label="Critical event mention"
+                    <x-forms.listbox canGate="update" :canResource="$settings" id="discordPingEnabled" label="Critical event mention"
                         helper="Mention @here when a critical event occurs."
                         onChange="instantSaveDiscordPingEnabled"
                         :disabled="!auth()->user()->can('update', $settings)" :options="[
diff --git a/resources/views/livewire/notifications/email.blade.php b/resources/views/livewire/notifications/email.blade.php
index e571d5083..5ca19e8da 100644
--- a/resources/views/livewire/notifications/email.blade.php
+++ b/resources/views/livewire/notifications/email.blade.php
@@ -41,7 +41,7 @@ class="button button-highlighted">
                     <div class="lg:col-span-2">
                         @if (isCloud())
                             <div class="w-full sm:w-72">
-                                <x-forms.listbox id="useInstanceEmailSettings" label="Email service"
+                                <x-forms.listbox canGate="update" :canResource="$settings" id="useInstanceEmailSettings" label="Email service"
                                     onChange="instantSave"
                                     :disabled="!auth()->user()->can('update', $settings)" :options="[
                                         ['value' => true, 'label' => 'Use hosted email service'],
@@ -50,7 +50,7 @@ class="button button-highlighted">
                             </div>
                         @else
                             <div class="w-full sm:w-72">
-                                <x-forms.listbox id="useInstanceEmailSettings" label="Email service"
+                                <x-forms.listbox canGate="update" :canResource="$settings" id="useInstanceEmailSettings" label="Email service"
                                     onChange="instantSave"
                                     :disabled="!auth()->user()->can('update', $settings)" :options="[
                                         ['value' => true, 'label' => 'Use system-wide settings'],
@@ -85,7 +85,7 @@ class="button button-highlighted">
                     <div class="grid gap-4 lg:grid-cols-3">
                         <div class="lg:col-span-3">
                             <div class="w-full sm:w-72">
-                                <x-forms.listbox id="smtpEnabled" label="SMTP delivery"
+                                <x-forms.listbox canGate="update" :canResource="$settings" id="smtpEnabled" label="SMTP delivery"
                                     onChange="submitSmtp"
                                     :disabled="!auth()->user()->can('update', $settings)" :options="[
                                         ['value' => true, 'label' => 'Enabled'],
@@ -97,7 +97,7 @@ class="button button-highlighted">
                             placeholder="smtp.mailgun.org" label="Host" />
                         <x-forms.input canGate="update" :canResource="$settings" required id="smtpPort"
                             type="number" placeholder="587" label="Port" />
-                        <x-forms.listbox id="smtpEncryption" label="Encryption" required
+                        <x-forms.listbox canGate="update" :canResource="$settings" id="smtpEncryption" label="Encryption" required
                             :disabled="!auth()->user()->can('update', $settings)" :options="[
                             ['value' => 'starttls', 'label' => 'StartTLS'],
                             ['value' => 'tls', 'label' => 'TLS / SSL'],
@@ -120,7 +120,7 @@ class="button button-highlighted">
             <div class="application-settings-form">
                 <x-application.settings-section title="Resend">
                     <div class="grid gap-4 lg:grid-cols-2">
-                        <x-forms.listbox id="resendEnabled" label="Resend delivery"
+                        <x-forms.listbox canGate="update" :canResource="$settings" id="resendEnabled" label="Resend delivery"
                             onChange="submitResend"
                             :disabled="!auth()->user()->can('update', $settings)" :options="[
                                 ['value' => true, 'label' => 'Enabled'],
diff --git a/resources/views/livewire/project/application/domains.blade.php b/resources/views/livewire/project/application/domains.blade.php
index a11e6930f..4adbcf8ff 100644
--- a/resources/views/livewire/project/application/domains.blade.php
+++ b/resources/views/livewire/project/application/domains.blade.php
@@ -71,7 +71,7 @@
 
         @if ($hasHttpsDomains && ! $labelsAreWritable)
             <div class="mt-4 max-w-md">
-                <x-forms.listbox id="isForceHttpsEnabled" label="Redirect HTTP to HTTPS"
+                <x-forms.listbox canGate="update" :canResource="$application" id="isForceHttpsEnabled" label="Redirect HTTP to HTTPS"
                     onChange="updateForceHttps"
                     helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL."
                     :options="[
@@ -119,7 +119,7 @@ class="button button-highlighted">
                             </x-slot:content>
                             <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
                                 @if ($isCompose && count($composeServices) > 0)
-                                    <x-forms.listbox label="Service" id="newDomainService" required
+                                    <x-forms.listbox canGate="update" :canResource="$application" label="Service" id="newDomainService" required
                                         :options="collect($composeServices)->map(fn ($serviceName) => [
                                             'value' => $serviceName,
                                             'label' => $serviceName,
diff --git a/resources/views/livewire/project/application/heading.blade.php b/resources/views/livewire/project/application/heading.blade.php
index d7efc8f2f..3892a623c 100644
--- a/resources/views/livewire/project/application/heading.blade.php
+++ b/resources/views/livewire/project/application/heading.blade.php
@@ -39,6 +39,7 @@
 
         <div class="w-full xl:hidden">
             @if (!($application->build_pack === 'dockercompose' && is_null($application->docker_compose_raw)))
+                @can('deploy', $application)
                 <div id="application-mobile-actions" class="relative mb-3"
                     x-data="{ open: false }" @click.outside="open = false"
                     @keydown.escape.window="open = false">
@@ -149,6 +150,7 @@ class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="me
                         @endif
                     </div>
                 </div>
+                @endcan
             @endif
             <div class="hidden" aria-hidden="true">
                 <x-modal-confirmation title="Confirm Application Stopping?" buttonTitle="Stop"
@@ -185,6 +187,7 @@ class="resource-heading-navbar application-heading-actions flex w-full min-w-0 i
                         <div class="resource-heading-menus shrink-0">
                             <x-applications.links :application="$application" />
                         </div>
+                        @can('deploy', $application)
                         <div id="application-desktop-actions" class="relative" x-data="{ open: false }"
                             x-effect="$dispatch('resource-actions-toggled', { open })"
                             @click.outside="open = false" @keydown.escape.window="open = false">
@@ -279,6 +282,7 @@ class="listbox-panel top-full! right-0! left-auto! mt-1! w-60! min-w-0!" role="m
                                 @endif
                             </div>
                         </div>
+                        @endcan
                     @endif
                 </div>
             </div>
diff --git a/resources/views/livewire/project/application/swarm.blade.php b/resources/views/livewire/project/application/swarm.blade.php
index fc8112afb..6bd593b93 100644
--- a/resources/views/livewire/project/application/swarm.blade.php
+++ b/resources/views/livewire/project/application/swarm.blade.php
@@ -14,7 +14,7 @@
         <div class="mt-4 grid gap-4 lg:grid-cols-2">
             <x-forms.input id="swarmReplicas" label="Replicas" required canGate="update"
                 :canResource="$application" />
-            <x-forms.listbox id="isSwarmOnlyWorkerNodes" label="Node placement" live onChange="instantSave"
+            <x-forms.listbox canGate="update" :canResource="$application" id="isSwarmOnlyWorkerNodes" label="Node placement" live onChange="instantSave"
                 :disabled="! auth()->user()->can('update', $application)" :options="[
                     ['value' => true, 'label' => 'Worker nodes only'],
                     ['value' => false, 'label' => 'Manager and worker nodes'],
diff --git a/resources/views/livewire/project/database/clickhouse/general.blade.php b/resources/views/livewire/project/database/clickhouse/general.blade.php
index 33486f8e0..1a83934c8 100644
--- a/resources/views/livewire/project/database/clickhouse/general.blade.php
+++ b/resources/views/livewire/project/database/clickhouse/general.blade.php
@@ -79,7 +79,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -94,7 +94,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/dragonfly/general.blade.php b/resources/views/livewire/project/database/dragonfly/general.blade.php
index 8dabe8c9a..592396c0a 100644
--- a/resources/views/livewire/project/database/dragonfly/general.blade.php
+++ b/resources/views/livewire/project/database/dragonfly/general.blade.php
@@ -80,7 +80,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -95,7 +95,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/heading.blade.php b/resources/views/livewire/project/database/heading.blade.php
index c36020ee9..bcdf1cf85 100644
--- a/resources/views/livewire/project/database/heading.blade.php
+++ b/resources/views/livewire/project/database/heading.blade.php
@@ -69,6 +69,7 @@
 
         <div class="w-full xl:hidden">
             @if ($database->destination->server->isFunctional())
+                @can('manage', $database)
                 <div id="database-mobile-actions" class="relative mb-3"
                     x-data="{ open: false }" @click.outside="open = false"
                     @keydown.escape.window="open = false">
@@ -127,6 +128,7 @@ class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="me
                         @endif
                     </div>
                 </div>
+                @endcan
             @endif
 
         </div>
@@ -137,6 +139,7 @@ class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="me
                 class="resource-heading-navbar application-heading-actions flex w-auto min-w-0 items-center justify-end gap-1 overflow-visible">
                 <div class="resource-heading-actions flex shrink-0 items-center gap-0.5">
                     @if ($database->destination->server->isFunctional())
+                        @can('manage', $database)
                         <div id="database-desktop-actions" class="flex items-center gap-0.5">
                             @if (! $databaseStatus->startsWith('exited'))
                                 <button type="button" class="button button-highlighted"
@@ -156,6 +159,7 @@ class="resource-heading-navbar application-heading-actions flex w-auto min-w-0 i
                                 </x-forms.button>
                             @endif
                         </div>
+                        @endcan
                     @else
                         <x-status-badge status="Server unavailable" type="error" />
                     @endif
diff --git a/resources/views/livewire/project/database/keydb/general.blade.php b/resources/views/livewire/project/database/keydb/general.blade.php
index e6b7ff985..6d894df04 100644
--- a/resources/views/livewire/project/database/keydb/general.blade.php
+++ b/resources/views/livewire/project/database/keydb/general.blade.php
@@ -81,7 +81,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -104,7 +104,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/mariadb/general.blade.php b/resources/views/livewire/project/database/mariadb/general.blade.php
index a604bb700..f2df51f66 100644
--- a/resources/views/livewire/project/database/mariadb/general.blade.php
+++ b/resources/views/livewire/project/database/mariadb/general.blade.php
@@ -86,7 +86,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -107,7 +107,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/mongodb/general.blade.php b/resources/views/livewire/project/database/mongodb/general.blade.php
index 62d57910a..ac47d8d69 100644
--- a/resources/views/livewire/project/database/mongodb/general.blade.php
+++ b/resources/views/livewire/project/database/mongodb/general.blade.php
@@ -83,7 +83,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -104,7 +104,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/mysql/general.blade.php b/resources/views/livewire/project/database/mysql/general.blade.php
index e2cd3802e..7f7b40085 100644
--- a/resources/views/livewire/project/database/mysql/general.blade.php
+++ b/resources/views/livewire/project/database/mysql/general.blade.php
@@ -86,7 +86,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -107,7 +107,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/postgresql/general.blade.php b/resources/views/livewire/project/database/postgresql/general.blade.php
index 705cad441..738c46fea 100644
--- a/resources/views/livewire/project/database/postgresql/general.blade.php
+++ b/resources/views/livewire/project/database/postgresql/general.blade.php
@@ -90,7 +90,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave" :onChangeArgs="[]"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -111,7 +111,7 @@
 
         <x-application.settings-section id="log-delivery-section" title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/database/redis/general.blade.php b/resources/views/livewire/project/database/redis/general.blade.php
index 39fa2c852..3fdf25619 100644
--- a/resources/views/livewire/project/database/redis/general.blade.php
+++ b/resources/views/livewire/project/database/redis/general.blade.php
@@ -85,7 +85,7 @@
             <div class="grid gap-4 lg:grid-cols-2">
                 <div wire:key="public-access-{{ $publicPort ?: 'unset' }}">
                     <x-forms.listbox id="isPublic" label="Access" live onChange="instantSave"
-                        :disabled="! auth()->user()->can('update', $database)" :options="[
+                        :disabled="! auth()->user()->can('update', $database)" canGate="update" :canResource="$database" :options="[
                             ['value' => false, 'label' => 'Private'],
                             ['value' => true, 'label' => blank($publicPort) ? 'Public through TCP proxy (set public port first)' : 'Public through TCP proxy', 'disabled' => blank($publicPort)],
                         ]" />
@@ -110,7 +110,7 @@
 
         <x-application.settings-section title="Log delivery"
             description="Forward container logs to the drain configured on the server.">
-            <x-forms.listbox id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
+            <x-forms.listbox canGate="update" :canResource="$database" id="isLogDrainEnabled" label="Log drain" live onChange="instantSaveAdvanced"
                 :disabled="! auth()->user()->can('update', $database)" :options="[
                     ['value' => false, 'label' => 'Do not forward logs'],
                     ['value' => true, 'label' => 'Forward logs to the server drain'],
diff --git a/resources/views/livewire/project/service/domains.blade.php b/resources/views/livewire/project/service/domains.blade.php
index 9399efe7f..05e5792fe 100644
--- a/resources/views/livewire/project/service/domains.blade.php
+++ b/resources/views/livewire/project/service/domains.blade.php
@@ -93,7 +93,7 @@ class="button button-highlighted">
                         </x-slot:content>
                         <form wire:submit="addDomain" class="application-settings-form flex flex-col gap-4">
                             {{-- Always show which service receives the domain --}}
-                            <x-forms.listbox label="Service application" id="newServiceApplicationId" required
+                            <x-forms.listbox canGate="update" :canResource="$service" label="Service application" id="newServiceApplicationId" required
                                 helper="Domain will be assigned to this compose service application."
                                 :options="collect($serviceApps)->map(fn ($app) => [
                                     'value' => $app['id'],
@@ -170,7 +170,7 @@ class="border-b border-neutral-200 last:border-b-0 dark:border-white/10">
                         <span class="min-w-0 flex-1 truncate text-sm font-medium text-black dark:text-white">{{ $heading }}</span>
                         @if ($hasHttpsDomains)
                             <div class="w-full sm:w-72">
-                                <x-forms.listbox id="forceHttpsRedirects.{{ $appId }}"
+                                <x-forms.listbox canGate="update" :canResource="$service" id="forceHttpsRedirects.{{ $appId }}"
                                     htmlId="service-force-https-{{ $appId }}"
                                     label="Redirect HTTP to HTTPS" onChange="updateForceHttps"
                                     :onChangeArgs="[(int) $appId]"
diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index 113a6c5a3..b022eef10 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -73,6 +73,7 @@
 
         <div class="w-full xl:hidden">
             @if ($service->isDeployable)
+                @can('deploy', $service)
                 <div id="service-mobile-actions" class="relative mb-3"
                     x-data="{ open: false }" @click.outside="open = false"
                     @keydown.escape.window="open = false">
@@ -165,6 +166,7 @@ class="listbox-panel top-full! left-0! right-0! mt-1! w-full! min-w-0!" role="me
                         @endif
                     </div>
                 </div>
+                @endcan
             @else
                 <a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
                     class="mb-3 inline-flex" aria-label="Open required environment variables">
@@ -183,6 +185,7 @@ class="resource-heading-navbar application-heading-actions flex w-auto min-w-0 i
                         <div class="resource-heading-menus shrink-0">
                             <x-services.links :service="$service" />
                         </div>
+                        @can('deploy', $service)
                         <div id="service-desktop-actions" class="relative" x-data="{ open: false }"
                                 x-effect="$dispatch('resource-actions-toggled', { open })"
                                 @click.outside="open = false" @keydown.escape.window="open = false">
@@ -247,6 +250,7 @@ class="listbox-panel top-full! right-0! left-auto! mt-1! w-64! min-w-0!" role="m
                                     @endif
                                 </div>
                         </div>
+                        @endcan
                     @else
                         <a href="{{ $environmentVariablesUrl }}" {{ wireNavigate() }}
                             aria-label="Open required environment variables">
diff --git a/resources/views/livewire/project/service/stack-form.blade.php b/resources/views/livewire/project/service/stack-form.blade.php
index d6c55ecfe..423ea0aaf 100644
--- a/resources/views/livewire/project/service/stack-form.blade.php
+++ b/resources/views/livewire/project/service/stack-form.blade.php
@@ -52,7 +52,7 @@
 
     <x-application.settings-section title="Network"
         description="Control whether this Compose stack joins Coolify's predefined network.">
-        <x-forms.listbox id="connectToDockerNetwork" label="Network attachment" live onChange="instantSave"
+        <x-forms.listbox canGate="update" :canResource="$service" id="connectToDockerNetwork" label="Network attachment" live onChange="instantSave"
             :disabled="! auth()->user()->can('update', $service)" :options="[
                 ['value' => false, 'label' => 'Use the stack network only'],
                 ['value' => true, 'label' => 'Connect to the predefined Coolify network'],
diff --git a/resources/views/livewire/project/shared/scheduled-task/show.blade.php b/resources/views/livewire/project/shared/scheduled-task/show.blade.php
index dcf90fd2e..c5be9974b 100644
--- a/resources/views/livewire/project/shared/scheduled-task/show.blade.php
+++ b/resources/views/livewire/project/shared/scheduled-task/show.blade.php
@@ -27,21 +27,21 @@
             </x-slot:actions>
 
             <div class="grid gap-4 md:grid-cols-2">
-                <x-forms.input :disabled="!auth()->user()->can('update', $resource)" placeholder="Name" id="name"
+                <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)" placeholder="Name" id="name"
                     label="Name" required />
-                <x-forms.input :disabled="!auth()->user()->can('update', $resource)"
+                <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)"
                     placeholder="0 0 * * * or daily" id="frequency" label="Schedule"
                     helper="Use every_minute, hourly, daily, weekly, monthly, yearly, or a cron expression."
                     required />
-                <x-forms.input :disabled="!auth()->user()->can('update', $resource)" type="number"
+                <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)" type="number"
                     placeholder="300" id="timeout" helper="Maximum execution time from 60 to 36,000 seconds."
                     label="Timeout (seconds)" required />
-                <x-forms.input :disabled="!auth()->user()->can('update', $resource)" placeholder="php"
+                <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)" placeholder="php"
                     helper="Leave empty when the resource only has one container." id="container"
                     label="{{ $type === 'service' ? 'Service' : 'Container' }}" />
             </div>
             <div class="mt-4">
-                <x-forms.input :disabled="!auth()->user()->can('update', $resource)"
+                <x-forms.input canGate="update" :canResource="$resource" :disabled="!auth()->user()->can('update', $resource)"
                     placeholder="php artisan schedule:run" id="command" label="Command" required />
             </div>
         </x-application.settings-section>
diff --git a/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php b/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
index 2dc32b3e3..eeaca7847 100644
--- a/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
+++ b/resources/views/livewire/project/shared/storages/volume-backups/s3.blade.php
@@ -39,13 +39,13 @@
                 @endif
             </div>
             <div class="application-settings-section-body grid gap-4 sm:grid-cols-2">
-                <x-forms.listbox id="s3StorageId" label="S3 storage" :required="$saveToS3"
+                <x-forms.listbox canGate="update" :canResource="$resource" id="s3StorageId" label="S3 storage" :required="$saveToS3"
                     :disabled="! auth()->user()?->can('update', $resource)"
                     :options="$availableS3Storages->map(fn ($s3Storage) => [
                         'value' => $s3Storage->id,
                         'label' => $s3Storage->name,
                     ])->values()->all()" />
-                <x-forms.listbox id="disableLocalBackup" label="Local copy"
+                <x-forms.listbox canGate="update" :canResource="$resource" id="disableLocalBackup" label="Local copy"
                     :disabled="! $saveToS3 || ! auth()->user()?->can('update', $resource)" :options="[
                         ['value' => false, 'label' => 'Keep local backup'],
                         ['value' => true, 'label' => 'Delete after S3 upload'],
diff --git a/resources/views/livewire/server/log-drains.blade.php b/resources/views/livewire/server/log-drains.blade.php
index 66f798503..ac908a7c9 100644
--- a/resources/views/livewire/server/log-drains.blade.php
+++ b/resources/views/livewire/server/log-drains.blade.php
@@ -29,7 +29,7 @@ class="server-settings-workspace application-settings-workspace mt-4 grid w-full
                     <x-application.settings-section id="server-new-relic-drain-section" title="New Relic"
                         helper="Send logs through the New Relic Log API.">
                         <div class="grid gap-4 lg:grid-cols-3">
-                            <x-forms.listbox id="isLogDrainNewRelicEnabled" label="Status"
+                            <x-forms.listbox canGate="update" :canResource="$server" id="isLogDrainNewRelicEnabled" label="Status"
                                 onChange="instantSave" :options="[
                                     ['value' => false, 'label' => 'Disabled'],
                                     ['value' => true, 'label' => 'Enabled'],
@@ -48,7 +48,7 @@ class="server-settings-workspace application-settings-workspace mt-4 grid w-full
                     <x-application.settings-section id="server-axiom-drain-section" title="Axiom"
                         helper="Send logs to an Axiom dataset using its ingest API.">
                         <div class="grid gap-4 lg:grid-cols-3">
-                            <x-forms.listbox id="isLogDrainAxiomEnabled" label="Status"
+                            <x-forms.listbox canGate="update" :canResource="$server" id="isLogDrainAxiomEnabled" label="Status"
                                 onChange="instantSave" :options="[
                                     ['value' => false, 'label' => 'Disabled'],
                                     ['value' => true, 'label' => 'Enabled'],
@@ -65,7 +65,7 @@ class="server-settings-workspace application-settings-workspace mt-4 grid w-full
                     <x-application.settings-section id="server-custom-drain-section" title="Custom Fluent Bit"
                         helper="Provide a custom Fluent Bit output and optional parser configuration.">
                         <div class="mb-4 max-w-sm">
-                            <x-forms.listbox id="isLogDrainCustomEnabled" label="Status"
+                            <x-forms.listbox canGate="update" :canResource="$server" id="isLogDrainCustomEnabled" label="Status"
                                 onChange="instantSave" :options="[
                                     ['value' => false, 'label' => 'Disabled'],
                                     ['value' => true, 'label' => 'Enabled'],
diff --git a/resources/views/livewire/server/swarm.blade.php b/resources/views/livewire/server/swarm.blade.php
index 8d807fcc5..a3e8dfce4 100644
--- a/resources/views/livewire/server/swarm.blade.php
+++ b/resources/views/livewire/server/swarm.blade.php
@@ -23,14 +23,14 @@ class="server-settings-workspace application-settings-workspace mt-4 grid w-full
                 </x-callout>
 
                 <div class="mt-4 grid gap-4 lg:grid-cols-2">
-                    <x-forms.listbox id="isSwarmManager" label="Manager role"
+                    <x-forms.listbox canGate="update" :canResource="$server" id="isSwarmManager" label="Manager role"
                         helper="Managers control scheduling and cluster state." onChange="instantSave"
                         :options="[
                             ['value' => false, 'label' => 'Not a Swarm manager'],
                             ['value' => true, 'label' => 'Swarm manager'],
                         ]"
                         :disabled="$server->settings->is_swarm_worker || !auth()->user()->can('update', $server)" />
-                    <x-forms.listbox id="isSwarmWorker" label="Worker role"
+                    <x-forms.listbox canGate="update" :canResource="$server" id="isSwarmWorker" label="Worker role"
                         helper="Workers run tasks assigned by a Swarm manager." onChange="instantSave"
                         :options="[
                             ['value' => false, 'label' => 'Not a Swarm worker'],
diff --git a/resources/views/livewire/source/github/change.blade.php b/resources/views/livewire/source/github/change.blade.php
index 5cafb3edb..2730c19a9 100644
--- a/resources/views/livewire/source/github/change.blade.php
+++ b/resources/views/livewire/source/github/change.blade.php
@@ -127,7 +127,7 @@ class="flex size-9 shrink-0 items-center justify-center rounded-lg bg-warning/10
 
                                         @if (!isCloud())
                                             <div class="lg:col-span-2">
-                                                <x-forms.listbox id="isSystemWide" label="Availability" :options="[
+                                                <x-forms.listbox canGate="update" :canResource="$github_app" id="isSystemWide" label="Availability" :options="[
                                                     ['value' => false, 'label' => 'Only this team'],
                                                     ['value' => true, 'label' => 'Every team on this instance'],
                                                 ]"
@@ -161,7 +161,7 @@ class="flex size-9 shrink-0 items-center justify-center rounded-lg bg-warning/10
                                             label="Client secret" type="password" required />
                                         <x-forms.input canGate="update" :canResource="$github_app" id="webhookSecret"
                                             label="Webhook secret" type="password" required />
-                                        <x-forms.listbox id="privateKeyId" label="Private key" required
+                                        <x-forms.listbox canGate="update" :canResource="$github_app" id="privateKeyId" label="Private key" required
                                             :options="$privateKeyOptions" :disabled="!auth()->user()->can('update', $github_app)" />
                                     </div>
                                 </x-application.settings-section>
diff --git a/resources/views/livewire/source/gitlab/change.blade.php b/resources/views/livewire/source/gitlab/change.blade.php
index a8a499e6b..5629e1e36 100644
--- a/resources/views/livewire/source/gitlab/change.blade.php
+++ b/resources/views/livewire/source/gitlab/change.blade.php
@@ -82,7 +82,7 @@
                     <x-forms.input canGate="update" :canResource="$gitlab_app" type="number" id="customPort"
                         label="SSH port" />
                     <div class="lg:col-span-2">
-                        <x-forms.listbox id="privateKeyId" label="SSH private key (optional)"
+                        <x-forms.listbox canGate="update" :canResource="$gitlab_app" id="privateKeyId" label="SSH private key (optional)"
                             :options="collect($privateKeys)->map(fn ($key) => [
                                 'value' => $key->id,
                                 'label' => $key->name,
diff --git a/resources/views/livewire/team/index.blade.php b/resources/views/livewire/team/index.blade.php
index 64fe0994a..d30df3411 100644
--- a/resources/views/livewire/team/index.blade.php
+++ b/resources/views/livewire/team/index.blade.php
@@ -18,7 +18,7 @@
                     <x-forms.input id="name" label="Name" required canGate="update" :canResource="$team" />
                     <x-forms.input id="description" label="Description" canGate="update" :canResource="$team" />
                     <div class="lg:col-span-2">
-                        <x-forms.listbox id="is_mcp_server_enabled" label="MCP server"
+                        <x-forms.listbox canGate="update" :canResource="$team" id="is_mcp_server_enabled" label="MCP server"
                             helper="Controls whether this team's API tokens can use the instance MCP endpoint."
                             :disabled="! auth()->user()->can('update', $team)" :options="[
                                 ['value' => false, 'label' => 'Disabled for this team'],
diff --git a/tests/Feature/ListboxTriggerTruncationTest.php b/tests/Feature/ListboxTriggerTruncationTest.php
index d5f259a85..82e526bb3 100644
--- a/tests/Feature/ListboxTriggerTruncationTest.php
+++ b/tests/Feature/ListboxTriggerTruncationTest.php
@@ -22,6 +22,15 @@
         ->toMatch('/\.application-settings-workspace \.listbox-trigger[^}]*height: 2rem;/s');
 });
 
+test('disabled listboxes use the same colors as disabled inputs', function () {
+    $css = file_get_contents(resource_path('css/app.css'));
+
+    expect($css)
+        ->toMatch('/\.listbox-trigger:disabled \{[^}]*background-color: var\(--color-neutral-100\);[^}]*color: var\(--color-neutral-400\);/s')
+        ->toMatch('/\.dark \.listbox-trigger:disabled \{[^}]*background-color: color-mix\(in oklab, var\(--color-white\) 3%, transparent\);[^}]*color: var\(--color-fg-faint\);/s')
+        ->not->toMatch('/\.listbox-trigger:disabled \{[^}]*opacity:/s');
+});
+
 test('listbox component uses shared trigger label truncation', function () {
     $html = Blade::render(<<<'BLADE'
         <x-forms.listbox id="longOption" label="Example"
diff --git a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
index ffaefa863..f6991025c 100644
--- a/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
+++ b/tests/Feature/MutableLivewireComponentsAuthorizationTest.php
@@ -1,9 +1,58 @@
 <?php
 
 use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Blade;
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Gate;
 
 uses(RefreshDatabase::class);
 
+it('auto-disables listboxes when the gate denies access', function () {
+    Gate::define('update-listbox-test', fn (): bool => false);
+
+    $html = Blade::render(<<<'BLADE'
+        <x-forms.listbox id="status" :wire="false" value="enabled"
+            canGate="update-listbox-test" :canResource="new stdClass"
+            :options="[['value' => 'enabled', 'label' => 'Enabled']]" />
+    BLADE);
+
+    expect($html)->toMatch('/<button[^>]*id="status-trigger"[^>]*\sdisabled(?:[=\s>])/');
+});
+
+it('declares gate attributes on form controls with update permission checks', function () {
+    $controlPattern = '/<x-forms\.(?:listbox|input|select|checkbox|textarea|button|toggle)\b.*?(?:\/>|<\/x-forms\.[^>]+>)/s';
+
+    foreach (File::allFiles(resource_path('views')) as $file) {
+        $path = $file->getPathname();
+        $source = file_get_contents($path);
+        preg_match_all($controlPattern, $source, $controls);
+
+        foreach ($controls[0] as $control) {
+            if (! preg_match('/can\(\s*[\'\"]update[\'\"]/', $control)) {
+                continue;
+            }
+
+            expect($control, $path)->toContain('canGate="update"')
+                ->toContain(':canResource=');
+        }
+    }
+});
+
+it('hides resource action menus when the user cannot manage the resource', function (string $path, string $ability, string $resource, string $prefix) {
+    $source = file_get_contents(resource_path($path));
+
+    foreach (['mobile', 'desktop'] as $viewport) {
+        expect($source)->toMatch(
+            "/@can\\('{$ability}', \\$".$resource."\\)[\\s\\S]*?<div id=\"{$prefix}-{$viewport}-actions\"/"
+        );
+    }
+})->with([
+    'application actions' => ['views/livewire/project/application/heading.blade.php', 'deploy', 'application', 'application'],
+    'service actions' => ['views/livewire/project/service/heading.blade.php', 'deploy', 'service', 'service'],
+    'database actions' => ['views/livewire/project/database/heading.blade.php', 'manage', 'database', 'database'],
+    'server actions' => ['views/livewire/server/navbar.blade.php', 'manageProxy', 'server', 'server'],
+]);
+
 it('keeps mutable Livewire components behind authorization checks', function (string $path, array $requiredNeedles) {
     $source = file_get_contents(base_path($path));
 
@@ -69,4 +118,38 @@
             '/wire:click="checkAllDns"/s',
         ],
     ],
+    'postgres public access control' => [
+        'resources/views/livewire/project/database/postgresql/general.blade.php',
+        [
+            '/<x-forms\.listbox id="isPublic"[\s\S]*?:disabled="! auth\(\)->user\(\)->can\(\'update\', \$database\)" canGate="update" :canResource="\$database" :options=/',
+        ],
+    ],
+    'redis public access control' => [
+        'resources/views/livewire/project/database/redis/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'mongodb public access control' => [
+        'resources/views/livewire/project/database/mongodb/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'clickhouse public access control' => [
+        'resources/views/livewire/project/database/clickhouse/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'mariadb public access control' => [
+        'resources/views/livewire/project/database/mariadb/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'dragonfly public access control' => [
+        'resources/views/livewire/project/database/dragonfly/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'mysql public access control' => [
+        'resources/views/livewire/project/database/mysql/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
+    'keydb public access control' => [
+        'resources/views/livewire/project/database/keydb/general.blade.php',
+        ['/<x-forms\.listbox id="isPublic"[\s\S]*?canGate="update" :canResource="\$database" :options=/'],
+    ],
 ]);

From c9d5c4c41fc46220448cd1b3b7d144c3477d000d Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 10:41:45 +0200
Subject: [PATCH 25/42] fix(upgrade): handle missing status after restart
 (#11350)

---
 resources/views/livewire/upgrade.blade.php | 10 ++++++++++
 tests/Unit/CoolifyUpgradeStatusTest.php    | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/resources/views/livewire/upgrade.blade.php b/resources/views/livewire/upgrade.blade.php
index f93c7bcea..97c08c035 100644
--- a/resources/views/livewire/upgrade.blade.php
+++ b/resources/views/livewire/upgrade.blade.php
@@ -295,6 +295,16 @@ class="flex flex-wrap items-center justify-end gap-2 border-t border-neutral-200
                         }
                         throw error;
                     }
+                    if (!data) {
+                        if (this.instanceWentDown) {
+                            // The upgraded instance can no longer return data for the old Livewire component.
+                            // A healthy response after observed downtime confirms that the restart completed.
+                            this.showSuccess();
+                        } else {
+                            this.currentStatus = this.getReviveStatusMessage(elapsedMinutes, this.healthCheckAttempts);
+                        }
+                        return;
+                    }
                     if (data.status === 'complete') {
                         this.showSuccess();
                     } else if (data.status === 'error') {
diff --git a/tests/Unit/CoolifyUpgradeStatusTest.php b/tests/Unit/CoolifyUpgradeStatusTest.php
index a00283615..2248e382b 100644
--- a/tests/Unit/CoolifyUpgradeStatusTest.php
+++ b/tests/Unit/CoolifyUpgradeStatusTest.php
@@ -149,6 +149,16 @@
         ->toContain('return;');
 });
 
+it('finishes when the post-restart Livewire status response is undefined', function () {
+    $upgradeView = file_get_contents(__DIR__.'/../../resources/views/livewire/upgrade.blade.php');
+
+    expect($upgradeView)
+        ->toContain('if (!data) {')
+        ->toContain('if (this.instanceWentDown) {')
+        ->toContain('this.showSuccess();')
+        ->toContain('return;');
+});
+
 it('tells users to reload manually if the automatic reload does not happen', function () {
     $upgradeView = file_get_contents(__DIR__.'/../../resources/views/livewire/upgrade.blade.php');
 

From 88eccbf78fb6e9044f00ff4f088ec675d5d1ad44 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 11:29:01 +0200
Subject: [PATCH 26/42] chore(release): bump Coolify versions to 4.3.9

---
 config/constants.php                       | 2 +-
 other/nightly/versions.json                | 4 ++--
 tests/Unit/ProductionImageWorkflowTest.php | 6 +++---
 versions.json                              | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index bc2151467..e0aefe8e2 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => env('COOLIFY_VERSION') ?: '4.3.8',
+        'version' => env('COOLIFY_VERSION') ?: '4.3.9',
         'helper_version' => '1.0.15',
         'realtime_version' => '1.0.17',
         'railpack_version' => '0.23.0',
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index ebc1151c3..92a88ea02 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,10 +1,10 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.8"
+            "version": "4.3.9"
         },
         "nightly": {
-            "version": "4.3.9"
+            "version": "4.3.10"
         },
         "helper": {
             "version": "1.0.15"
diff --git a/tests/Unit/ProductionImageWorkflowTest.php b/tests/Unit/ProductionImageWorkflowTest.php
index e57587f28..c3b5e665f 100644
--- a/tests/Unit/ProductionImageWorkflowTest.php
+++ b/tests/Unit/ProductionImageWorkflowTest.php
@@ -23,9 +23,9 @@
         ->toContain('ARG COOLIFY_VERSION')
         ->toContain('ENV COOLIFY_VERSION=${COOLIFY_VERSION}')
         ->and($constants)
-        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.8'")
-        ->and($versions['coolify']['v4']['version'])->toBe('4.3.8')
-        ->and($versions['coolify']['nightly']['version'])->toBe('4.3.9')
+        ->toContain("'version' => env('COOLIFY_VERSION') ?: '4.3.9'")
+        ->and($versions['coolify']['v4']['version'])->toBe('4.3.9')
+        ->and($versions['coolify']['nightly']['version'])->toBe('4.3.10')
         ->and($nightlyVersions)->toBe($versions);
 });
 
diff --git a/versions.json b/versions.json
index ebc1151c3..92a88ea02 100644
--- a/versions.json
+++ b/versions.json
@@ -1,10 +1,10 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.3.8"
+            "version": "4.3.9"
         },
         "nightly": {
-            "version": "4.3.9"
+            "version": "4.3.10"
         },
         "helper": {
             "version": "1.0.15"

From 05ebba9f1a9875b3e0f5faf42c71fbafc031d37e Mon Sep 17 00:00:00 2001
From: Prai'ns <sleskov2013@yandex.ru>
Date: Tue, 18 Aug 2026 12:30:09 +0300
Subject: [PATCH 27/42] fix: compress dashboard over HTTPS (#10828)

Co-authored-by: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
---
 app/Models/Server.php | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/app/Models/Server.php b/app/Models/Server.php
index 1acc4e45f..0f5a35364 100644
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -736,6 +736,9 @@ public function setupDynamicProxyConfiguration()
                     ];
 
                     $traefik_dynamic_conf['http']['routers']['coolify-https'] = [
+                        'middlewares' => [
+                            0 => 'gzip',
+                        ],
                         'entryPoints' => [
                             0 => 'https',
                         ],
@@ -791,6 +794,7 @@ public function setupDynamicProxyConfiguration()
                 $schema = $url->getScheme();
                 $caddy_file = "
 $schema://$host {
+    encode zstd gzip
     handle /app/* {
         reverse_proxy coolify-realtime:6001
     }

From 30da9e96eb05b89020d1da8b155207c7d9e5d4c3 Mon Sep 17 00:00:00 2001
From: NrwPlay <nrwplay@nrwplay.de>
Date: Tue, 18 Aug 2026 11:38:01 +0200
Subject: [PATCH 28/42] fix(notification): update storage email link in S3
 error (#8633)

---
 app/Models/S3Storage.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/Models/S3Storage.php b/app/Models/S3Storage.php
index e8e1788e3..e4b1e2fd6 100644
--- a/app/Models/S3Storage.php
+++ b/app/Models/S3Storage.php
@@ -198,7 +198,7 @@ public function testConnection(bool $shouldSave = false)
                 try {
                     $mail = new MailMessage;
                     $mail->subject('Coolify: S3 Storage Connection Error');
-                    $mail->view('emails.s3-connection-error', ['name' => $this->name, 'reason' => $exception->getMessage(), 'url' => route('storage.show', ['storage_uuid' => $this->uuid])]);
+                    $mail->view('emails.s3-connection-error', ['name' => $this->name, 'reason' => $e->getMessage(), 'url' => base_url().'/storages/'.$this->uuid]);
 
                     // Load the team with its members and their roles explicitly
                     $team = $this->team()->with(['members' => function ($query) {

From d360da327067174ebe10340aac5172d3877016c0 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 11:55:55 +0200
Subject: [PATCH 29/42] fix(databases): chown SSL certs before container
 replacement (#11352)

---
 app/Actions/Database/StartMariadb.php          |  4 ++--
 app/Actions/Database/StartMongodb.php          |  4 ++--
 app/Actions/Database/StartMysql.php            |  4 ++--
 app/Actions/Database/StartPostgresql.php       |  4 ++--
 .../Unit/DatabaseSslCredentialEscapingTest.php | 18 +++++++++++++-----
 5 files changed, 21 insertions(+), 13 deletions(-)

diff --git a/app/Actions/Database/StartMariadb.php b/app/Actions/Database/StartMariadb.php
index c4f98cfdf..2f030ae29 100644
--- a/app/Actions/Database/StartMariadb.php
+++ b/app/Actions/Database/StartMariadb.php
@@ -208,11 +208,11 @@ public function handle(StandaloneMariadb $database)
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
-        $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         if ($this->database->enable_ssl) {
             $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mysql:mysql /etc/mysql/certs/server.key /etc/mysql/certs/server.crt < /dev/null";
         }
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
+        $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
diff --git a/app/Actions/Database/StartMongodb.php b/app/Actions/Database/StartMongodb.php
index 0f9bba679..097e19f7b 100644
--- a/app/Actions/Database/StartMongodb.php
+++ b/app/Actions/Database/StartMongodb.php
@@ -257,11 +257,11 @@ public function handle(StandaloneMongodb $database)
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
-        $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         if ($this->database->enable_ssl) {
             $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mongodb:mongodb /etc/mongo/certs/server.pem < /dev/null";
         }
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
+        $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
diff --git a/app/Actions/Database/StartMysql.php b/app/Actions/Database/StartMysql.php
index 3eab00464..d21ee02fb 100644
--- a/app/Actions/Database/StartMysql.php
+++ b/app/Actions/Database/StartMysql.php
@@ -209,11 +209,11 @@ public function handle(StandaloneMysql $database)
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
-        $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         if ($this->database->enable_ssl) {
             $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name mysql:mysql /etc/mysql/certs/server.key /etc/mysql/certs/server.crt < /dev/null";
         }
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
+        $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
 
         $this->commands[] = "echo 'Database started.'";
diff --git a/app/Actions/Database/StartPostgresql.php b/app/Actions/Database/StartPostgresql.php
index 21cb278fb..f70e8f3cf 100644
--- a/app/Actions/Database/StartPostgresql.php
+++ b/app/Actions/Database/StartPostgresql.php
@@ -219,11 +219,11 @@ public function handle(StandalonePostgresql $database)
         $this->commands[] = "echo '{$readme}' > $this->configuration_dir/README.md";
         $this->commands[] = "echo 'Pulling {$database->image} image.'";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml pull";
-        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
-        $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         if ($this->database->enable_ssl) {
             $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml run --rm --no-deps --user root --entrypoint chown $container_name postgres:postgres /var/lib/postgresql/certs/server.key /var/lib/postgresql/certs/server.crt < /dev/null";
         }
+        $this->commands[] = dockerStopCommand(10, $container_name, $this->database->destination->server).' 2>/dev/null || true';
+        $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         $this->commands[] = "echo 'Database started.'";
 
diff --git a/tests/Unit/DatabaseSslCredentialEscapingTest.php b/tests/Unit/DatabaseSslCredentialEscapingTest.php
index 8ddc10a04..7b2ecf927 100644
--- a/tests/Unit/DatabaseSslCredentialEscapingTest.php
+++ b/tests/Unit/DatabaseSslCredentialEscapingTest.php
@@ -21,33 +21,41 @@
         ->toContain('chown');
 });
 
-it('sets postgres SSL file ownership before starting the database container', function () {
+it('sets postgres SSL file ownership before replacing the database container', function () {
     $source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartPostgresql.php');
 
     $permissionCommandPosition = strpos($source, '--entrypoint chown');
+    $stopCommandPosition = strpos($source, 'dockerStopCommand');
     $startCommandPosition = strpos($source, 'docker-compose.yml up -d');
 
     expect($permissionCommandPosition)->not->toBeFalse()
+        ->and($stopCommandPosition)->not->toBeFalse()
         ->and($startCommandPosition)->not->toBeFalse()
+        ->and($permissionCommandPosition)->toBeLessThan($stopCommandPosition)
         ->and($permissionCommandPosition)->toBeLessThan($startCommandPosition)
+        ->and($source)->toContain('/var/lib/postgresql/certs/server.crt < /dev/null')
         ->and($source)->toContain('postgres:postgres /var/lib/postgresql/certs/server.key')
         ->not->toContain('chown {$postgresUser}:{$postgresUser}');
 });
 
-it('sets database SSL file ownership before startup', function (string $action, string $owner, string $keyPath) {
+it('sets database SSL file ownership before replacing the container', function (string $action, string $owner, string $keyPath, string $lastCertificatePath) {
     $source = file_get_contents(__DIR__."/../../app/Actions/Database/{$action}.php");
 
     $permissionCommandPosition = strpos($source, '--entrypoint chown');
+    $stopCommandPosition = strpos($source, 'dockerStopCommand');
     $startCommandPosition = strpos($source, 'docker-compose.yml up -d');
 
     expect($permissionCommandPosition)->not->toBeFalse()
+        ->and($stopCommandPosition)->not->toBeFalse()
         ->and($startCommandPosition)->not->toBeFalse()
+        ->and($permissionCommandPosition)->toBeLessThan($stopCommandPosition)
         ->and($permissionCommandPosition)->toBeLessThan($startCommandPosition)
+        ->and($source)->toContain("{$lastCertificatePath} < /dev/null")
         ->and($source)->toContain("{$owner} {$keyPath}");
 })->with([
-    'mysql' => ['StartMysql', 'mysql:mysql', '/etc/mysql/certs/server.key'],
-    'mariadb' => ['StartMariadb', 'mysql:mysql', '/etc/mysql/certs/server.key'],
-    'mongodb' => ['StartMongodb', 'mongodb:mongodb', '/etc/mongo/certs/server.pem'],
+    'mysql' => ['StartMysql', 'mysql:mysql', '/etc/mysql/certs/server.key', '/etc/mysql/certs/server.crt'],
+    'mariadb' => ['StartMariadb', 'mysql:mysql', '/etc/mysql/certs/server.key', '/etc/mysql/certs/server.crt'],
+    'mongodb' => ['StartMongodb', 'mongodb:mongodb', '/etc/mongo/certs/server.pem', '/etc/mongo/certs/server.pem'],
 ]);
 
 it('advisory PoC postgres_user payload is contained by escapeshellarg in chown command', function () {

From c2b7978e3ee01baeef58632f9c32c94e7c5a7d2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Far=C3=A8s=20SIONI?=
 <82713835+fsioni@users.noreply.github.com>
Date: Tue, 18 Aug 2026 12:21:49 +0200
Subject: [PATCH 30/42] fix(ui): improve highlighted button and spinner
 contrast (#11279)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: 🏔️ Peak <122374094+peaklabs-dev@users.noreply.github.com>
---
 resources/css/app.css                            | 10 ++++++----
 resources/css/utilities.css                      |  2 +-
 resources/views/components/unsaved-bar.blade.php |  2 +-
 tests/Feature/HighlightedButtonStylingTest.php   | 15 ++++++++++++++-
 tests/Feature/SentinelUnsavedBarFlashTest.php    |  6 +++---
 5 files changed, 25 insertions(+), 10 deletions(-)

diff --git a/resources/css/app.css b/resources/css/app.css
index 636cf2ce8..9dc39b7cc 100644
--- a/resources/css/app.css
+++ b/resources/css/app.css
@@ -398,9 +398,12 @@ html[data-theme="custom"] .animate-spin {
     color: var(--theme-bright-color) !important;
 }
 
-/* Opt out of the brand spinner when the surrounding surface is a selected/neutral control. */
+/* Opt out of the brand spinner when the surrounding surface is a selected/neutral control
+   or a highlighted button, whose accent surface would camouflage a brand-colored spinner. */
 .dark .animate-spin.spinner-current,
-html[data-theme="custom"] .animate-spin.spinner-current {
+html[data-theme="custom"] .animate-spin.spinner-current,
+html[data-theme="custom"] .button-highlighted .animate-spin,
+html[data-theme="custom"] button[isHighlighted] .animate-spin {
     color: inherit !important;
 }
 
@@ -993,8 +996,7 @@ html[data-theme="custom"] {
 }
 
 html[data-theme="custom"] .control-selected,
-html[data-theme="custom"] .logs-viewer-btn-active,
-html[data-theme="custom"] .button-highlighted:hover {
+html[data-theme="custom"] .logs-viewer-btn-active {
     color: var(--color-accent-foreground);
 }
 
diff --git a/resources/css/utilities.css b/resources/css/utilities.css
index 44218b0f3..7c690cba7 100644
--- a/resources/css/utilities.css
+++ b/resources/css/utilities.css
@@ -131,7 +131,7 @@ @utility button {
 }
 
 @utility button-highlighted {
-    @apply border-coollabs-200 bg-linear-to-b from-coollabs-100 to-coollabs-200 text-white! hover:from-coollabs-100 hover:to-coollabs hover:text-white!;
+    @apply border-coollabs-200 bg-linear-to-b from-coollabs-100 to-coollabs-200 text-accent-foreground! hover:from-coollabs-100 hover:to-coollabs hover:text-accent-foreground!;
 }
 
 @utility control-selected {
diff --git a/resources/views/components/unsaved-bar.blade.php b/resources/views/components/unsaved-bar.blade.php
index 1a5f85d3a..8d029c2fb 100644
--- a/resources/views/components/unsaved-bar.blade.php
+++ b/resources/views/components/unsaved-bar.blade.php
@@ -67,7 +67,7 @@ class="h-8 rounded-lg bg-neutral-100 px-3.5 text-[13px] font-medium text-neutral
             class="button-highlighted flex h-8 items-center gap-2 rounded-lg px-4 text-[13px] font-semibold transition-[transform,background-color] active:scale-[0.98]">
             <span>Save changes</span>
             <kbd
-                class="rounded border border-coollabs/20 bg-coollabs/10 px-1.5 py-0.5 text-[10px] leading-none font-medium text-coollabs-200 dark:border-white/20 dark:bg-white/10 dark:text-white/75">Enter</kbd>
+                class="rounded border border-current/20 bg-current/10 px-1.5 py-0.5 text-[10px] leading-none font-medium text-current">Enter</kbd>
         </button>
     </div>
 </div>
diff --git a/tests/Feature/HighlightedButtonStylingTest.php b/tests/Feature/HighlightedButtonStylingTest.php
index eae11deaf..834d792ce 100644
--- a/tests/Feature/HighlightedButtonStylingTest.php
+++ b/tests/Feature/HighlightedButtonStylingTest.php
@@ -10,10 +10,23 @@
 
     expect($utilities)
         ->toContain('@utility button-highlighted')
-        ->toContain('@apply border-coollabs-200 bg-linear-to-b from-coollabs-100 to-coollabs-200 text-white! hover:from-coollabs-100 hover:to-coollabs hover:text-white!;')
+        ->toContain('@apply border-coollabs-200 bg-linear-to-b from-coollabs-100 to-coollabs-200 text-accent-foreground! hover:from-coollabs-100 hover:to-coollabs hover:text-accent-foreground!;')
         ->and($appStyles)
         ->toContain('button[isHighlighted]:not(:disabled)')
         ->toContain('@apply button-highlighted;')
         ->and($views)
         ->not->toContain('dark:bg-warning/15! dark:text-warning! dark:ring-warning/25');
 });
+
+test('custom theme highlighted buttons use the computed contrasting foreground', function () {
+    $utilities = file_get_contents(resource_path('css/utilities.css'));
+    $appStyles = file_get_contents(resource_path('css/app.css'));
+
+    expect($utilities)
+        ->toContain('text-accent-foreground!')
+        ->toContain('hover:text-accent-foreground!')
+        ->not->toContain('text-white! hover:')
+        ->and($appStyles)
+        ->toContain('html[data-theme="custom"] .button-highlighted .animate-spin')
+        ->toContain('html[data-theme="custom"] button[isHighlighted] .animate-spin');
+});
diff --git a/tests/Feature/SentinelUnsavedBarFlashTest.php b/tests/Feature/SentinelUnsavedBarFlashTest.php
index ac8f72ddf..0c5d196c0 100644
--- a/tests/Feature/SentinelUnsavedBarFlashTest.php
+++ b/tests/Feature/SentinelUnsavedBarFlashTest.php
@@ -76,9 +76,9 @@
     $contents = file_get_contents(resource_path('views/components/unsaved-bar.blade.php'));
 
     expect($contents)
-        ->toContain('border-coollabs/20 bg-coollabs/10')
-        ->toContain('text-coollabs-200')
-        ->toContain('dark:border-white/20 dark:bg-white/10 dark:text-white/75');
+        ->toContain('border-current/20 bg-current/10')
+        ->toContain('text-current')
+        ->not->toContain('text-coollabs-200');
 });
 
 test('unsaved bar uses a light surface in light mode', function () {

From 264cb8e2b01dc8087f0bc1e21dbe9a0f97fbba36 Mon Sep 17 00:00:00 2001
From: Andrew Matia <73502748+drewmt@users.noreply.github.com>
Date: Tue, 18 Aug 2026 13:24:06 +0300
Subject: [PATCH 31/42] fix(webhook): restore GitLab source deployments
 (#11284)

---
 app/Http/Controllers/Webhook/Gitlab.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/Http/Controllers/Webhook/Gitlab.php b/app/Http/Controllers/Webhook/Gitlab.php
index e521093d7..c9a554e2a 100644
--- a/app/Http/Controllers/Webhook/Gitlab.php
+++ b/app/Http/Controllers/Webhook/Gitlab.php
@@ -15,6 +15,7 @@
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Str;
+use Visus\Cuid2\Cuid2;
 
 class Gitlab extends Controller
 {

From d2d6c8ac967a9c7e8b68cf470a445333b52a49cf Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 12:51:54 +0200
Subject: [PATCH 32/42] fix(deployments): defer container cleanup and configure
 dashboard HTTPS

---
 app/Jobs/ApplicationDeploymentJob.php         | 40 +++++++-
 app/Jobs/RemoveContainerJob.php               | 49 ++++++++++
 app/Livewire/Settings/Index.php               |  5 +
 app/Models/InstanceSettings.php               |  6 ++
 app/Models/Server.php                         | 25 ++++-
 bootstrap/helpers/docker.php                  |  9 ++
 ...tps_enabled_to_instance_settings_table.php | 28 ++++++
 .../views/livewire/settings/index.blade.php   | 17 +++-
 tests/Feature/DashboardHttpsRedirectTest.php  | 94 +++++++++++++++++++
 tests/Unit/DockerRemoveWithTimeoutTest.php    | 78 +++++++++++++++
 10 files changed, 341 insertions(+), 10 deletions(-)
 create mode 100644 app/Jobs/RemoveContainerJob.php
 create mode 100644 database/migrations/2026_08_18_104130_add_is_dashboard_force_https_enabled_to_instance_settings_table.php
 create mode 100644 tests/Feature/DashboardHttpsRedirectTest.php
 create mode 100644 tests/Unit/DockerRemoveWithTimeoutTest.php

diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index 3047bcc01..1e8450c1b 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -52,6 +52,8 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     private const RAILPACK_GENERATED_CONFIG_PATH = '.coolify/railpack.generated.json';
 
+    private const CONTAINER_REMOVE_TIMEOUT_MARKER = '__COOLIFY_CONTAINER_REMOVE_TIMEOUT__';
+
     private const DOCKER_CLIENT_ENV_KEYS = [
         'BUILDKIT_HOST',
         'BUILDX_BUILDER',
@@ -3977,15 +3979,45 @@ private function graceful_shutdown_container(string $containerName, bool $skipRe
                 );
             } else {
                 $this->execute_remote_command(
-                    [dockerStopCommand($timeout, $containerName, $this->server), 'hidden' => true, 'ignore_errors' => true],
-                    ["docker rm -f $containerName", 'hidden' => true, 'ignore_errors' => true]
+                    [dockerStopCommand($timeout, $containerName, $this->server), 'hidden' => true, 'ignore_errors' => true]
                 );
+                $this->removeContainerWithTimeout($containerName);
             }
         } catch (Exception $error) {
             $this->application_deployment_queue->addLogEntry("Error stopping container $containerName: ".$error->getMessage(), 'stderr');
         }
     }
 
+    private function removeContainerWithTimeout(string $containerName): void
+    {
+        $outputKey = 'container_remove_'.md5($containerName);
+
+        $this->execute_remote_command([
+            dockerRemoveCommandWithTimeout($containerName),
+            'hidden' => true,
+            'ignore_errors' => true,
+            'save' => $outputKey,
+            'append' => false,
+        ]);
+
+        if (! isset($this->saved_outputs)) {
+            return;
+        }
+
+        $output = (string) $this->saved_outputs->get($outputKey, '');
+        if (! str_contains($output, self::CONTAINER_REMOVE_TIMEOUT_MARKER)) {
+            return;
+        }
+
+        $this->application_deployment_queue->addLogEntry(
+            "Warning: Removing container {$containerName} timed out after 60 seconds. The deployment will continue and cleanup will be retried in 5 minutes.",
+            'stderr'
+        );
+
+        RemoveContainerJob::dispatch($this->server->id, $containerName)
+            ->delay(now()->addMinutes(5));
+    }
+
     private function stop_running_container(bool $force = false)
     {
         try {
@@ -5016,9 +5048,7 @@ public function failed(Throwable $exception): void
                     // do not remove already running container for PR deployments
                 } else {
                     $this->application_deployment_queue->addLogEntry('Deployment failed. Removing the new version of your application.', 'stderr');
-                    $this->execute_remote_command(
-                        ["docker rm -f $this->container_name >/dev/null 2>&1", 'hidden' => true, 'ignore_errors' => true]
-                    );
+                    $this->removeContainerWithTimeout($this->container_name);
                 }
             }
         }
diff --git a/app/Jobs/RemoveContainerJob.php b/app/Jobs/RemoveContainerJob.php
new file mode 100644
index 000000000..de2160324
--- /dev/null
+++ b/app/Jobs/RemoveContainerJob.php
@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\Server;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeEncrypted;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\Log;
+
+class RemoveContainerJob implements ShouldBeEncrypted, ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public int $tries = 3;
+
+    public int $timeout = 90;
+
+    public function __construct(public int $serverId, public string $containerName) {}
+
+    public function handle(): void
+    {
+        $server = Server::findOrFail($this->serverId);
+
+        instant_remote_process(
+            [dockerRemoveCommandWithTimeout($this->containerName)],
+            $server,
+            timeout: 75,
+            disableMultiplexing: true,
+        );
+    }
+
+    public function backoff(): array
+    {
+        return [300, 900];
+    }
+
+    public function failed(?\Throwable $exception): void
+    {
+        Log::warning('Deferred container removal failed', [
+            'server_id' => $this->serverId,
+            'container' => $this->containerName,
+            'error' => $exception?->getMessage(),
+        ]);
+    }
+}
diff --git a/app/Livewire/Settings/Index.php b/app/Livewire/Settings/Index.php
index 91bc03d21..40705617f 100644
--- a/app/Livewire/Settings/Index.php
+++ b/app/Livewire/Settings/Index.php
@@ -20,6 +20,9 @@ class Index extends Component
     #[Validate('nullable|string|max:255|url')]
     public ?string $fqdn = null;
 
+    #[Validate('boolean')]
+    public bool $is_dashboard_force_https_enabled = true;
+
     #[Validate('required|integer|min:1025|max:65535')]
     public int $public_port_min;
 
@@ -68,6 +71,7 @@ public function mount()
             $this->server = Server::findOrFail(0);
         }
         $this->fqdn = $this->settings->fqdn;
+        $this->is_dashboard_force_https_enabled = $this->settings->is_dashboard_force_https_enabled;
         $this->public_port_min = $this->settings->public_port_min;
         $this->public_port_max = $this->settings->public_port_max;
         $this->instance_name = $this->settings->instance_name;
@@ -91,6 +95,7 @@ public function instantSave($isSave = true)
         $this->authorize('update', $this->settings);
         $this->validate();
         $this->settings->fqdn = $this->fqdn ? trim($this->fqdn) : $this->fqdn;
+        $this->settings->is_dashboard_force_https_enabled = $this->is_dashboard_force_https_enabled;
         $this->settings->public_port_min = $this->public_port_min;
         $this->settings->public_port_max = $this->public_port_max;
         $this->settings->instance_name = $this->instance_name;
diff --git a/app/Models/InstanceSettings.php b/app/Models/InstanceSettings.php
index 877fc5b12..adf5a4abd 100644
--- a/app/Models/InstanceSettings.php
+++ b/app/Models/InstanceSettings.php
@@ -9,6 +9,10 @@
 
 class InstanceSettings extends Model
 {
+    protected $attributes = [
+        'is_dashboard_force_https_enabled' => true,
+    ];
+
     protected $fillable = [
         'public_ipv4',
         'public_ipv6',
@@ -51,6 +55,7 @@ class InstanceSettings extends Model
         'webhook_allow_localhost',
         'avatar_storage_type',
         'avatar_s3_storage_id',
+        'is_dashboard_force_https_enabled',
     ];
 
     protected $hidden = [
@@ -89,6 +94,7 @@ class InstanceSettings extends Model
         'is_mcp_server_enabled' => 'boolean',
         'webhook_allowed_internal_hosts' => 'array',
         'webhook_allow_localhost' => 'boolean',
+        'is_dashboard_force_https_enabled' => 'boolean',
     ];
 
     protected static function booted(): void
diff --git a/app/Models/Server.php b/app/Models/Server.php
index 0f5a35364..b5b11d26a 100644
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -731,9 +731,7 @@ public function setupDynamicProxyConfiguration()
                 ];
 
                 if ($schema === 'https') {
-                    $traefik_dynamic_conf['http']['routers']['coolify-http']['middlewares'] = [
-                        0 => 'redirect-to-https',
-                    ];
+                    $traefik_dynamic_conf['http']['routers']['coolify-http']['middlewares'] = $this->dashboardHttpMiddlewares($settings);
 
                     $traefik_dynamic_conf['http']['routers']['coolify-https'] = [
                         'middlewares' => [
@@ -792,8 +790,9 @@ public function setupDynamicProxyConfiguration()
                 $url = Url::fromString($settings->fqdn);
                 $host = $url->getHost();
                 $schema = $url->getScheme();
+                $siteAddress = $this->dashboardCaddySiteAddress($settings, $schema, $host);
                 $caddy_file = "
-$schema://$host {
+$siteAddress {
     encode zstd gzip
     handle /app/* {
         reverse_proxy coolify-realtime:6001
@@ -819,6 +818,24 @@ public function reloadCaddy()
         ], $this);
     }
 
+    public function dashboardHttpMiddlewares(InstanceSettings $settings): array
+    {
+        if ($settings->is_dashboard_force_https_enabled) {
+            return ['redirect-to-https'];
+        }
+
+        return ['gzip'];
+    }
+
+    public function dashboardCaddySiteAddress(InstanceSettings $settings, string $schema, string $host): string
+    {
+        if ($schema === 'https' && ! $settings->is_dashboard_force_https_enabled) {
+            return "http://{$host}, https://{$host}";
+        }
+
+        return "{$schema}://{$host}";
+    }
+
     public function proxyPath()
     {
         $base_path = config('constants.coolify.base_config_path');
diff --git a/bootstrap/helpers/docker.php b/bootstrap/helpers/docker.php
index ae2963755..a60ba675b 100644
--- a/bootstrap/helpers/docker.php
+++ b/bootstrap/helpers/docker.php
@@ -263,6 +263,15 @@ function dockerStopCommand(int $timeout, string $containers, Server|string|null
 
     return $command;
 }
+
+function dockerRemoveCommandWithTimeout(string $container, int $timeout = 60, int $killAfter = 10): string
+{
+    $container = escapeShellValue($container);
+    $script = "if command -v timeout >/dev/null 2>&1; then timeout -k {$killAfter}s {$timeout}s docker rm -f {$container}; exit_code=\$?; else exit_code=124; fi; if [ \"\$exit_code\" -eq 124 ]; then echo '__COOLIFY_CONTAINER_REMOVE_TIMEOUT__'; fi; exit \$exit_code";
+
+    return 'bash -c '.escapeShellValue($script);
+}
+
 function escapeShellValue(string $value): string
 {
     return "'".str_replace("'", "'\\''", $value)."'";
diff --git a/database/migrations/2026_08_18_104130_add_is_dashboard_force_https_enabled_to_instance_settings_table.php b/database/migrations/2026_08_18_104130_add_is_dashboard_force_https_enabled_to_instance_settings_table.php
new file mode 100644
index 000000000..d88f9be3f
--- /dev/null
+++ b/database/migrations/2026_08_18_104130_add_is_dashboard_force_https_enabled_to_instance_settings_table.php
@@ -0,0 +1,28 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    /**
+     * Run the migrations.
+     */
+    public function up(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->boolean('is_dashboard_force_https_enabled')->default(true);
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     */
+    public function down(): void
+    {
+        Schema::table('instance_settings', function (Blueprint $table) {
+            $table->dropColumn('is_dashboard_force_https_enabled');
+        });
+    }
+};
diff --git a/resources/views/livewire/settings/index.blade.php b/resources/views/livewire/settings/index.blade.php
index 7992b4ca9..518f1a45d 100644
--- a/resources/views/livewire/settings/index.blade.php
+++ b/resources/views/livewire/settings/index.blade.php
@@ -11,12 +11,27 @@
                 targets="fqdn,instance_name,public_ipv4,public_ipv6,dev_helper_version" />
             <x-application.settings-section title="General">
                 <div class="grid gap-4 lg:grid-cols-2">
-                    <div class="lg:col-span-2">
+                    <div @class([
+                        'lg:col-span-2' => !str_starts_with(strtolower($fqdn ?? ''), 'https://'),
+                    ])>
                         <x-forms.input canGate="update" :canResource="$settings" id="fqdn" label="URL"
                             helper="Enter the full URL of the instance (for example, https://dashboard.example.com).<br><br><span class='text-coollabs dark:text-warning'>Important:</span> Include <b>https://</b> to secure the dashboard with HTTPS."
                             placeholder="https://coolify.yourdomain.com" />
                     </div>
 
+                    @if (str_starts_with(strtolower($fqdn ?? ''), 'https://'))
+                        <div>
+                            <x-forms.listbox canGate="update" :canResource="$settings"
+                                id="is_dashboard_force_https_enabled" label="Redirect HTTP to HTTPS"
+                                onChange="submit"
+                                helper="Disable only when Cloudflare Tunnel or another proxy connects to Coolify over HTTP. Keep enabled when Cloudflare uses Full or Full (Strict) SSL."
+                                :options="[
+                                    ['value' => true, 'label' => 'Enabled'],
+                                    ['value' => false, 'label' => 'Disabled'],
+                                ]" />
+                        </div>
+                    @endif
+
                     <x-forms.input canGate="update" :canResource="$settings" id="instance_name" label="Name"
                         placeholder="Coolify" helper="Custom name for this Coolify instance." />
 
diff --git a/tests/Feature/DashboardHttpsRedirectTest.php b/tests/Feature/DashboardHttpsRedirectTest.php
new file mode 100644
index 000000000..d709b8428
--- /dev/null
+++ b/tests/Feature/DashboardHttpsRedirectTest.php
@@ -0,0 +1,94 @@
+<?php
+
+use App\Livewire\Settings\Index;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+test('dashboard proxy keeps existing HTTPS redirect behavior by default', function () {
+    $settings = new InstanceSettings;
+    $server = new Server;
+
+    expect($settings->is_dashboard_force_https_enabled)->toBeTrue()
+        ->and($server->dashboardHttpMiddlewares($settings))->toBe(['redirect-to-https'])
+        ->and($server->dashboardCaddySiteAddress($settings, 'https', 'dashboard.example.com'))
+        ->toBe('https://dashboard.example.com');
+});
+
+test('dashboard proxy accepts HTTP and HTTPS when its redirect is disabled', function () {
+    $settings = new InstanceSettings(['is_dashboard_force_https_enabled' => false]);
+    $server = new Server;
+
+    expect($server->dashboardHttpMiddlewares($settings))->toBe(['gzip'])
+        ->and($server->dashboardCaddySiteAddress($settings, 'https', 'dashboard.example.com'))
+        ->toBe('http://dashboard.example.com, https://dashboard.example.com')
+        ->and($server->dashboardCaddySiteAddress($settings, 'http', 'dashboard.example.com'))
+        ->toBe('http://dashboard.example.com');
+});
+
+test('instance administrators can configure the dashboard HTTPS redirect', function () {
+    $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
+    Server::factory()->create(['id' => 0, 'team_id' => $rootTeam->id]);
+    $settings = InstanceSettings::forceCreate([
+        'id' => 0,
+        'fqdn' => 'https://dashboard.example.com',
+    ]);
+    Once::flush();
+
+    $user = User::factory()->create();
+    $rootTeam->members()->attach($user->id, ['role' => 'admin']);
+
+    $this->actingAs($user);
+    session(['currentTeam' => ['id' => $rootTeam->id]]);
+
+    Livewire::test(Index::class)
+        ->assertSet('is_dashboard_force_https_enabled', true)
+        ->assertSee('Redirect HTTP to HTTPS')
+        ->assertSee('Keep enabled when Cloudflare uses Full or Full (Strict) SSL.')
+        ->set('is_dashboard_force_https_enabled', false)
+        ->call('instantSave')
+        ->assertHasNoErrors();
+
+    expect($settings->fresh()->is_dashboard_force_https_enabled)->toBeFalse();
+});
+
+test('dashboard HTTPS redirect saves immediately when changed', function () {
+    $contents = file_get_contents(resource_path('views/livewire/settings/index.blade.php'));
+
+    expect($contents)
+        ->toMatch('/id="is_dashboard_force_https_enabled"[\s\S]*?onChange="submit"/')
+        ->and($contents)->not->toContain('targets="fqdn,is_dashboard_force_https_enabled');
+});
+
+test('dashboard HTTPS redirect is next to the URL on desktop', function () {
+    $contents = file_get_contents(resource_path('views/livewire/settings/index.blade.php'));
+
+    expect($contents)
+        ->toContain("'lg:col-span-2' => !str_starts_with")
+        ->not->toContain('<div class="lg:col-span-2 max-w-md">');
+});
+
+test('dashboard HTTPS redirect control is hidden for an HTTP URL', function () {
+    $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
+    Server::factory()->create(['id' => 0, 'team_id' => $rootTeam->id]);
+    InstanceSettings::forceCreate([
+        'id' => 0,
+        'fqdn' => 'http://dashboard.example.com',
+    ]);
+    Once::flush();
+
+    $user = User::factory()->create();
+    $rootTeam->members()->attach($user->id, ['role' => 'admin']);
+
+    $this->actingAs($user);
+    session(['currentTeam' => ['id' => $rootTeam->id]]);
+
+    Livewire::test(Index::class)
+        ->assertDontSee('Redirect HTTP to HTTPS');
+});
diff --git a/tests/Unit/DockerRemoveWithTimeoutTest.php b/tests/Unit/DockerRemoveWithTimeoutTest.php
new file mode 100644
index 000000000..a3b9f15dc
--- /dev/null
+++ b/tests/Unit/DockerRemoveWithTimeoutTest.php
@@ -0,0 +1,78 @@
+<?php
+
+use App\Jobs\RemoveContainerJob;
+use App\Models\Server;
+use Symfony\Component\Process\Process;
+
+it('bounds forced container removal and reports a timeout marker', function () {
+    expect(dockerRemoveCommandWithTimeout('container name'))
+        ->toStartWith("bash -c '")
+        ->toContain('timeout -k 10s 60s docker rm -f')
+        ->toContain('__COOLIFY_CONTAINER_REMOVE_TIMEOUT__');
+});
+
+it('uses timeout syntax supported by coreutils and busybox', function () {
+    expect(dockerRemoveCommandWithTimeout('container-name'))
+        ->toContain('command -v timeout')
+        ->toContain('timeout -k 10s 60s')
+        ->not->toContain('--kill-after');
+});
+
+it('preserves bounded cleanup when commands are adapted for non-root servers', function () {
+    $server = Mockery::mock(Server::class)->makePartial();
+    $server->shouldReceive('getAttribute')->with('user')->andReturn('ubuntu');
+    $server->shouldReceive('setAttribute')->andReturnSelf();
+    $server->user = 'ubuntu';
+
+    $commands = parseCommandsByLineForSudo(
+        collect([dockerRemoveCommandWithTimeout('container-name')]),
+        $server
+    );
+    $command = $commands[0];
+
+    expect($command)
+        ->toStartWith("sudo bash -c '")
+        ->toContain('timeout -k 10s 60s docker rm -f')
+        ->toContain('__COOLIFY_CONTAINER_REMOVE_TIMEOUT__');
+});
+
+it('escapes container names in bounded removal commands', function () {
+    $containerName = "container'; reboot; '";
+    $directory = sys_get_temp_dir().'/coolify-docker-remove-'.bin2hex(random_bytes(4));
+    $captureFile = $directory.'/arguments';
+    mkdir($directory);
+    file_put_contents($directory.'/docker', "#!/bin/sh\nprintf '%s\\n' \"\$@\" > \"\$CAPTURE_FILE\"\n");
+    chmod($directory.'/docker', 0755);
+
+    $process = new Process(['/bin/sh', '-c', dockerRemoveCommandWithTimeout($containerName)], env: [
+        'PATH' => $directory.':'.getenv('PATH'),
+        'CAPTURE_FILE' => $captureFile,
+    ]);
+    $process->run();
+
+    expect($process->isSuccessful())->toBeTrue()
+        ->and(file_get_contents($captureFile))->toBe("rm\n-f\n{$containerName}\n");
+
+    unlink($captureFile);
+    unlink($directory.'/docker');
+    rmdir($directory);
+});
+
+it('configures deferred removal attempts to outlive the shell timeout', function () {
+    $job = new RemoveContainerJob(123, 'container-name');
+
+    expect($job->serverId)->toBe(123)
+        ->and($job->containerName)->toBe('container-name')
+        ->and($job->timeout)->toBeGreaterThan(60)
+        ->and($job->tries)->toBeGreaterThan(1);
+});
+
+it('continues deployments and schedules deferred cleanup after a removal timeout', function () {
+    $source = file_get_contents(dirname(__DIR__, 2).'/app/Jobs/ApplicationDeploymentJob.php');
+
+    expect($source)
+        ->toContain('dockerRemoveCommandWithTimeout($containerName)')
+        ->toContain('timed out after 60 seconds. The deployment will continue')
+        ->toContain('RemoveContainerJob::dispatch($this->server->id, $containerName)')
+        ->toContain('->delay(now()->addMinutes(5))');
+});

From 3cca2a0bfe184344b17fc650f2f1fa54ab7e5e8e Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 12:53:41 +0200
Subject: [PATCH 33/42] fix(ui): add spacing between database backup sections

Add a flex column gap to the backup edit layout and cover the spacing with a feature test.
---
 .../views/livewire/project/database/backup-edit.blade.php  | 2 +-
 tests/Feature/DatabaseBackupsLayoutTest.php                | 7 +++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/resources/views/livewire/project/database/backup-edit.blade.php b/resources/views/livewire/project/database/backup-edit.blade.php
index 31637d7f9..d85d506a0 100644
--- a/resources/views/livewire/project/database/backup-edit.blade.php
+++ b/resources/views/livewire/project/database/backup-edit.blade.php
@@ -1,4 +1,4 @@
-<div>
+<div class="flex flex-col gap-6">
     @if ($backup->database_id === 0)
         @include('livewire.project.database.backup-edit.general')
         @include('livewire.project.database.backup-edit.s3')
diff --git a/tests/Feature/DatabaseBackupsLayoutTest.php b/tests/Feature/DatabaseBackupsLayoutTest.php
index b2ab349d9..2b4941c09 100644
--- a/tests/Feature/DatabaseBackupsLayoutTest.php
+++ b/tests/Feature/DatabaseBackupsLayoutTest.php
@@ -50,3 +50,10 @@
     expect($executions)
         ->not->toContain('sticky right-0');
 });
+
+it('spaces instance backup settings sections', function () {
+    $edit = file_get_contents(resource_path('views/livewire/project/database/backup-edit.blade.php'));
+
+    expect($edit)
+        ->toStartWith('<div class="flex flex-col gap-6">');
+});

From 861a9049920cf227ef3dd8bbf3e308850225833c Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 13:53:40 +0200
Subject: [PATCH 34/42] fix(server): surface pending proxy and outdated Traefik
 states

---
 app/Jobs/CheckTraefikVersionForServerJob.php  |  8 +-
 app/Livewire/ActivityMonitor.php              | 15 +++-
 app/Livewire/Server/Navbar.php                | 19 +++-
 app/Livewire/Server/Proxy.php                 |  6 +-
 app/Models/Server.php                         | 27 ++++++
 resources/css/utilities.css                   |  3 +-
 .../proxy-configuration-warning.blade.php     | 37 ++++++++
 .../views/components/server/sidebar.blade.php | 20 ++++-
 .../views/livewire/server/index.blade.php     | 39 +++++---
 .../views/livewire/server/navbar.blade.php    | 16 +++-
 .../views/livewire/server/proxy.blade.php     | 15 +++-
 .../Feature/ActivityMonitorCrossTeamTest.php  | 20 +++++
 tests/Feature/ButtonHeightConsistencyTest.php |  4 +-
 .../DashboardServerMetricsChartTest.php       | 19 ++++
 tests/Feature/Proxy/RestartProxyTest.php      | 59 ++++++++++++
 .../ProxyConfigurationLoadingStateTest.php    | 12 +++
 tests/Feature/ServerSidebarIconsTest.php      | 14 +++
 tests/Feature/TraefikVersionStateTest.php     | 89 +++++++++++++++++++
 18 files changed, 398 insertions(+), 24 deletions(-)
 create mode 100644 resources/views/components/proxy-configuration-warning.blade.php
 create mode 100644 tests/Feature/ProxyConfigurationLoadingStateTest.php
 create mode 100644 tests/Feature/TraefikVersionStateTest.php

diff --git a/app/Jobs/CheckTraefikVersionForServerJob.php b/app/Jobs/CheckTraefikVersionForServerJob.php
index 91869eb12..054a739bc 100644
--- a/app/Jobs/CheckTraefikVersionForServerJob.php
+++ b/app/Jobs/CheckTraefikVersionForServerJob.php
@@ -33,10 +33,11 @@ public function __construct(
      */
     public function handle(): void
     {
+        $this->clearOutdatedInfo();
+
         // Detect current version (makes SSH call)
         $currentVersion = getTraefikVersionFromDockerCompose($this->server);
 
-        // Update detected version in database
         $this->server->update(['detected_traefik_version' => $currentVersion]);
 
         if (! $currentVersion) {
@@ -113,6 +114,11 @@ public function handle(): void
         ProxyStatusChangedUI::dispatch($this->server->team_id);
     }
 
+    private function clearOutdatedInfo(): void
+    {
+        $this->server->update(['traefik_outdated_info' => null]);
+    }
+
     /**
      * Get information about newer branches if available.
      */
diff --git a/app/Livewire/ActivityMonitor.php b/app/Livewire/ActivityMonitor.php
index 665d14ba0..25935d88e 100644
--- a/app/Livewire/ActivityMonitor.php
+++ b/app/Livewire/ActivityMonitor.php
@@ -29,7 +29,10 @@ class ActivityMonitor extends Component
 
     public static $eventDispatched = false;
 
-    protected $listeners = ['activityMonitor' => 'newMonitorActivity'];
+    protected $listeners = [
+        'activityMonitor' => 'newMonitorActivity',
+        'processDialogClosed' => 'clearActivity',
+    ];
 
     public function newMonitorActivity($activityId, $eventToDispatch = 'activityFinished', $eventData = null, $header = null)
     {
@@ -50,6 +53,16 @@ public function newMonitorActivity($activityId, $eventToDispatch = 'activityFini
         $this->isPollingActive = true;
     }
 
+    public function clearActivity(): void
+    {
+        $this->activityId = null;
+        $this->activity = null;
+        $this->isPollingActive = false;
+        $this->eventToDispatch = 'activityFinished';
+        $this->eventData = null;
+        self::$eventDispatched = false;
+    }
+
     public function hydrateActivity()
     {
         if ($this->activityId === null) {
diff --git a/app/Livewire/Server/Navbar.php b/app/Livewire/Server/Navbar.php
index 31a857865..d9f70ea25 100644
--- a/app/Livewire/Server/Navbar.php
+++ b/app/Livewire/Server/Navbar.php
@@ -163,6 +163,7 @@ public function showNotification($event = null)
         $previousStatus = $this->proxyStatus;
         $this->server->refresh();
         $this->proxyStatus = $this->server->proxy->status ?? 'unknown';
+        $this->dispatchProxyConfigurationState();
 
         // If event contains activityId, open activity monitor
         if ($event && isset($event['activityId'])) {
@@ -227,6 +228,16 @@ public function refreshServer()
     {
         $this->server->refresh();
         $this->server->load('settings');
+        $this->dispatchProxyConfigurationState();
+    }
+
+    private function dispatchProxyConfigurationState(): void
+    {
+        $this->dispatch(
+            'proxy-configuration-state-changed',
+            pending: $this->server->hasPendingProxyConfiguration(),
+            traefikOutdated: $this->server->hasCurrentTraefikOutdatedInfo(),
+        );
     }
 
     public function refreshSentinelStatus($event = null): void
@@ -248,10 +259,12 @@ public function getHasTraefikOutdatedProperty(): bool
             return false;
         }
 
-        // Check if server has outdated info stored
-        $outdatedInfo = $this->server->traefik_outdated_info;
+        return $this->server->hasCurrentTraefikOutdatedInfo();
+    }
 
-        return ! empty($outdatedInfo) && isset($outdatedInfo['type']);
+    public function getHasPendingProxyConfigurationProperty(): bool
+    {
+        return $this->server->hasPendingProxyConfiguration();
     }
 
     public function render()
diff --git a/app/Livewire/Server/Proxy.php b/app/Livewire/Server/Proxy.php
index 8cd4e9640..811a01eb1 100644
--- a/app/Livewire/Server/Proxy.php
+++ b/app/Livewire/Server/Proxy.php
@@ -161,6 +161,7 @@ public function submit()
             $this->server->proxy->redirect_url = $this->redirectUrl;
             $this->server->save();
             $this->server->setupDefaultRedirect();
+            $this->dispatch('refreshServerShow');
             $this->dispatch('success', 'Proxy configuration saved.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -175,6 +176,7 @@ public function resetProxyConfiguration()
             $this->proxySettings = GetProxyConfiguration::run($this->server, forceRegenerate: true);
             SaveProxyConfiguration::run($this->server, $this->proxySettings);
             $this->server->save();
+            $this->dispatch('refreshServerShow');
             $this->dispatch('success', 'Proxy configuration reset to default.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -276,7 +278,9 @@ public function getNewerTraefikBranchAvailableProperty(): ?string
 
             // Check if we have outdated info stored for this server (faster than computing)
             $outdatedInfo = $this->server->traefik_outdated_info;
-            if ($outdatedInfo && isset($outdatedInfo['type']) && $outdatedInfo['type'] === 'minor_upgrade') {
+            $storedCurrentVersion = ltrim((string) data_get($outdatedInfo, 'current'), 'v');
+            $detectedCurrentVersion = ltrim($currentVersion, 'v');
+            if ($storedCurrentVersion === $detectedCurrentVersion && data_get($outdatedInfo, 'type') === 'minor_upgrade') {
                 // Use the upgrade_target field if available (e.g., "v3.6")
                 if (isset($outdatedInfo['upgrade_target'])) {
                     return str_starts_with($outdatedInfo['upgrade_target'], 'v')
diff --git a/app/Models/Server.php b/app/Models/Server.php
index b5b11d26a..f7a4bf20c 100644
--- a/app/Models/Server.php
+++ b/app/Models/Server.php
@@ -858,6 +858,33 @@ public function proxyType()
         return data_get($this->proxy, 'type');
     }
 
+    public function hasPendingProxyConfiguration(): bool
+    {
+        if ($this->proxy->get('status') !== 'running') {
+            return false;
+        }
+
+        $savedSettings = $this->proxy->get('last_saved_settings');
+        $appliedSettings = $this->proxy->get('last_applied_settings');
+
+        return filled($savedSettings) && filled($appliedSettings) && $savedSettings !== $appliedSettings;
+    }
+
+    public function hasCurrentTraefikOutdatedInfo(): bool
+    {
+        if ($this->proxyType() !== ProxyTypes::TRAEFIK->value) {
+            return false;
+        }
+
+        $detectedVersion = ltrim((string) $this->detected_traefik_version, 'v');
+        $storedVersion = ltrim((string) data_get($this->traefik_outdated_info, 'current'), 'v');
+        $type = data_get($this->traefik_outdated_info, 'type');
+
+        return filled($detectedVersion)
+            && $storedVersion === $detectedVersion
+            && in_array($type, ['patch_update', 'minor_upgrade'], true);
+    }
+
     public function scopeWithProxy(): Builder
     {
         return $this->proxy->modelScope();
diff --git a/resources/css/utilities.css b/resources/css/utilities.css
index 7c690cba7..6fdd260b5 100644
--- a/resources/css/utilities.css
+++ b/resources/css/utilities.css
@@ -126,8 +126,7 @@ @utility select {
 }
 
 @utility button {
-    /* h-9 matches input-select; nowrap + shrink-0 keep side-by-side action rows equal height */
-    @apply inline-flex shrink-0 gap-1.5 justify-center items-center whitespace-nowrap px-2.5 h-9 min-h-9 text-[13px] text-black normal-case rounded-md border outline-0 cursor-pointer font-medium transition-colors bg-white border-neutral-200 hover:bg-neutral-100 dark:bg-white/[0.06] dark:text-fg dark:hover:text-fg dark:hover:bg-white/[0.1] dark:border-white/[0.08] hover:text-black disabled:cursor-not-allowed min-w-fit dark:disabled:text-fg-faint disabled:border-neutral-200 dark:disabled:border-white/[0.06] disabled:hover:bg-transparent disabled:bg-transparent disabled:text-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent;
+    @apply inline-flex shrink-0 gap-1.5 justify-center items-center whitespace-nowrap px-2.5 h-8 min-h-8 text-[13px] text-black normal-case rounded-md border outline-0 cursor-pointer font-medium transition-colors bg-white border-neutral-200 hover:bg-neutral-100 dark:bg-white/[0.06] dark:text-fg dark:hover:text-fg dark:hover:bg-white/[0.1] dark:border-white/[0.08] hover:text-black disabled:cursor-not-allowed min-w-fit dark:disabled:text-fg-faint disabled:border-neutral-200 dark:disabled:border-white/[0.06] disabled:hover:bg-transparent disabled:bg-transparent disabled:text-neutral-300 focus-visible:outline-none focus-visible:ring-1 focus-visible:ring-accent;
 }
 
 @utility button-highlighted {
diff --git a/resources/views/components/proxy-configuration-warning.blade.php b/resources/views/components/proxy-configuration-warning.blade.php
new file mode 100644
index 000000000..7337779d0
--- /dev/null
+++ b/resources/views/components/proxy-configuration-warning.blade.php
@@ -0,0 +1,37 @@
+@props(['canRestart' => false])
+
+<div class="relative" x-data="{ open: false }" @click.outside="open = false" @keydown.escape.window="open = false">
+    <button type="button" aria-label="Proxy configuration changes not applied" aria-haspopup="dialog"
+        :aria-expanded="open" @click="open = !open"
+        class="flex h-8 items-center justify-center gap-1.5 rounded-lg px-2 text-amber-700 transition-colors hover:bg-amber-100 dark:text-warning dark:hover:bg-warning/10">
+        <x-reicon name="alert-triangle" class="size-4" />
+        <span class="hidden text-xs font-medium lg:inline">Changes pending</span>
+    </button>
+
+    <div x-show="open" x-cloak x-transition.opacity role="dialog"
+        class="fixed top-14 left-1/2 z-[1100] w-[calc(100vw-2rem)] max-w-sm -translate-x-1/2 rounded-lg p-3 lg:absolute lg:top-full lg:right-0 lg:left-auto lg:mt-2 lg:translate-x-0"
+        style="background: var(--coollabs-elevated); box-shadow: 0 0 0 1px var(--coollabs-line), var(--shadow-modal);">
+        <div class="flex items-start gap-2.5">
+            <span
+                class="flex size-7 shrink-0 items-center justify-center rounded-md bg-amber-100 text-amber-700 dark:bg-warning/10 dark:text-warning">
+                <x-reicon name="alert-triangle" class="size-4" />
+            </span>
+            <div class="min-w-0 flex-1">
+                <p class="text-[13px] leading-4 font-semibold text-neutral-950 dark:text-fg">
+                    The saved proxy configuration has not been applied
+                </p>
+                <p class="mt-0.5 text-[11px] leading-4 text-neutral-600 dark:text-fg-dim">
+                    Restart the proxy to apply these changes.
+                    @if ($canRestart)
+                        <button type="button"
+                            class="ml-0.5 inline-flex items-center gap-0.5 font-semibold text-coollabs transition-colors hover:text-coollabs-100 dark:text-warning dark:hover:text-warning/80"
+                            @click="open = false; document.getElementById('server-mobile-restart-proxy-trigger')?.click()">
+                            Restart proxy
+                            <x-reicon name="arrow-right" class="size-2.5" />
+                        </button>
+                    @endif
+                </p>
+            </div>
+        </div>
+    </div>
+</div>
diff --git a/resources/views/components/server/sidebar.blade.php b/resources/views/components/server/sidebar.blade.php
index 006efb2ca..41cbd7ce9 100644
--- a/resources/views/components/server/sidebar.blade.php
+++ b/resources/views/components/server/sidebar.blade.php
@@ -55,6 +55,8 @@
             'icon' => 'network',
             'group' => 'Platform',
             'visible' => ! $server->isSwarmWorker() && ! $server->settings->is_build_server,
+            'warning' => $server->hasCurrentTraefikOutdatedInfo(),
+            'tracks_proxy_configuration' => true,
             'children' => [
                 ['label' => 'Configuration', 'route' => 'server.proxy', 'active' => $activeSubMenu === 'configuration', 'icon' => 'settings'],
                 ['label' => 'Dynamic Configurations', 'route' => 'server.proxy.dynamic-confs', 'active' => $activeSubMenu === 'dynamic-confs', 'icon' => 'sliders', 'visible' => $server->proxySet()],
@@ -167,7 +169,15 @@
     $groupedServerMenuItems = $serverMenuItems->groupBy('group');
 @endphp
 
-<aside class="application-settings-navigation min-w-0 xl:self-start">
+<aside class="application-settings-navigation min-w-0 xl:self-start"
+    x-data="{
+        proxyConfigurationPending: @js($server->hasPendingProxyConfiguration()),
+        traefikOutdated: @js($server->hasCurrentTraefikOutdatedInfo())
+    }"
+    @proxy-configuration-state-changed.window="
+        proxyConfigurationPending = $event.detail.pending;
+        traefikOutdated = $event.detail.traefikOutdated;
+    ">
     <nav aria-label="Server configuration sections"
         class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3 lg:grid-cols-4 xl:grid-cols-1 xl:border-y-0 xl:py-0 dark:border-white/[0.06]">
         @foreach ($groupedServerMenuItems as $groupLabel => $groupItems)
@@ -186,6 +196,14 @@ class="grid grid-cols-2 gap-0.5 border-y border-neutral-200 py-3 sm:grid-cols-3
                     href="{{ route($menuItem['route'], $serverRouteParameters) }}">
                     <x-reicon :name="$menuItem['icon']" class="menu-item-icon" />
                     <span class="menu-item-label">{{ $menuItem['label'] }}</span>
+                    @if ($menuItem['tracks_proxy_configuration'] ?? false)
+                        <x-reicon name="alert-triangle" x-cloak
+                            x-show="proxyConfigurationPending || traefikOutdated"
+                            class="ml-auto size-3.5 shrink-0 text-orange-500 dark:text-warning" />
+                    @elseif ($menuItem['warning'] ?? false)
+                        <x-reicon name="alert-triangle"
+                            class="ml-auto size-3.5 shrink-0 text-orange-500 dark:text-warning" />
+                    @endif
                 </a>
                 @if ($menuItem['active'] && isset($menuItem['children']))
                     <div class="col-span-full grid grid-cols-2 gap-0.5 border-l border-neutral-200 pl-2 sm:grid-cols-3 xl:grid-cols-1 dark:border-white/[0.08]">
diff --git a/resources/views/livewire/server/index.blade.php b/resources/views/livewire/server/index.blade.php
index 2bb9e10c7..2aa93aa7f 100644
--- a/resources/views/livewire/server/index.blade.php
+++ b/resources/views/livewire/server/index.blade.php
@@ -126,24 +126,41 @@ class="flex size-7.5 items-center justify-center rounded-md transition-colors"
 
             <div x-cloak x-show="viewMode === 'grid'"
                 class="grid grid-cols-1 gap-3 sm:grid-cols-2 lg:grid-cols-4">
-                <template x-for="server in filteredServers" :key="server.uuid">
-                    <a :href="server.href" {{ wireNavigate() }}
+                @foreach ($servers as $server)
+                    @php
+                        $serverRow = $serverRows->firstWhere('uuid', $server->uuid);
+                    @endphp
+                    <a x-cloak
+                        x-show="filteredServers.some(server => server.uuid === @js($server->uuid))"
+                        href="{{ $serverRow['href'] }}" {{ wireNavigate() }}
                         class="group relative flex min-h-28 flex-col rounded-xl border border-neutral-200 bg-white p-3 shadow-sm transition-all hover:-translate-y-px hover:border-neutral-300 hover:no-underline hover:shadow-md dark:border-white/[0.08] dark:bg-white/[0.025] dark:hover:border-white/[0.14]">
-                        <div class="flex items-start gap-3">
-                            <div :title="server.status" :aria-label="`Server status: ${server.status}`"
-                                class="flex size-8 shrink-0 items-center justify-center rounded-lg border bg-neutral-50 text-neutral-500 dark:bg-white/[0.04] dark:text-fg-dim"
-                                :class="server.statusType === 'success' ? 'border-emerald-500/70' : server.statusType === 'warning' ? 'border-amber-500/70' : 'border-red-500/70'">
+                        @if ($server->isMetricsEnabled())
+                            <livewire:dashboard.server-metrics-chart :server="$server"
+                                :key="'server-index-metrics-'.$server->uuid" />
+                        @endif
+
+                        <div class="pointer-events-none relative z-10 flex items-start gap-3">
+                            <div title="{{ $serverRow['status'] }}"
+                                aria-label="Server status: {{ $serverRow['status'] }}"
+                                @class([
+                                    'flex size-8 shrink-0 items-center justify-center rounded-lg border bg-neutral-50 text-neutral-500 dark:bg-white/[0.04] dark:text-fg-dim',
+                                    'border-emerald-500/70' => $serverRow['statusType'] === 'success',
+                                    'border-amber-500/70' => $serverRow['statusType'] === 'warning',
+                                    'border-red-500/70' => $serverRow['statusType'] === 'error',
+                                ])>
                                 <x-reicon name="servers" class="size-4" />
                             </div>
                             <div class="min-w-0 flex-1">
-                                <h2 class="truncate text-[13px]! leading-4! font-semibold! text-black dark:text-fg"
-                                    x-text="server.name"></h2>
-                                <p class="mt-0.5 truncate text-[11px] text-neutral-500 dark:text-fg-faint"
-                                    x-text="server.description"></p>
+                                <h2 class="truncate text-[13px]! leading-4! font-semibold! text-black dark:text-fg">
+                                    {{ $serverRow['name'] }}
+                                </h2>
+                                <p class="mt-0.5 truncate text-[11px] text-neutral-500 dark:text-fg-faint">
+                                    {{ $serverRow['description'] }}
+                                </p>
                             </div>
                         </div>
                     </a>
-                </template>
+                @endforeach
             </div>
 
             <div x-show="viewMode === 'table'"
diff --git a/resources/views/livewire/server/navbar.blade.php b/resources/views/livewire/server/navbar.blade.php
index 7879f5727..e75f77b5b 100644
--- a/resources/views/livewire/server/navbar.blade.php
+++ b/resources/views/livewire/server/navbar.blade.php
@@ -43,7 +43,7 @@
                 'route' => 'server.proxy',
                 'active' => request()->routeIs('server.proxy', 'server.proxy.*'),
                 'visible' => ! $server->isSwarmWorker() && ! $server->settings->is_build_server,
-                'warning' => $this->hasTraefikOutdated,
+                'warning' => $this->hasTraefikOutdated || $this->hasPendingProxyConfiguration,
             ],
             [
                 'label' => 'Sentinel',
@@ -89,6 +89,20 @@
         $proxyCanBeStopped = in_array($proxyStatus, ['running', 'starting', 'restarting'], true);
     @endphp
 
+    @if ($this->hasPendingProxyConfiguration)
+        @teleport('#configuration-warning-hud-slot')
+            <div>
+                <x-proxy-configuration-warning :can-restart="auth()->user()?->can('manageProxy', $server) ?? false" />
+            </div>
+        @endteleport
+
+        @teleport('#configuration-warning-hud-slot-mobile')
+            <div>
+                <x-proxy-configuration-warning :can-restart="auth()->user()?->can('manageProxy', $server) ?? false" />
+            </div>
+        @endteleport
+    @endif
+
     @teleport('#server-topbar-context')
         <div data-testid="server-topbar-context"
             class="flex min-w-0 items-center gap-1 text-[13px]">
diff --git a/resources/views/livewire/server/proxy.blade.php b/resources/views/livewire/server/proxy.blade.php
index 0e15bd1e2..aeb661bcd 100644
--- a/resources/views/livewire/server/proxy.blade.php
+++ b/resources/views/livewire/server/proxy.blade.php
@@ -6,6 +6,9 @@
             <form wire:submit="submit" class="contents">
                 <x-unsaved-bar action="submit" />
 
+                <fieldset class="contents" wire:loading.attr="disabled"
+                    wire:target="submit,resetProxyConfiguration">
+
                 <x-application.settings-section id="server-proxy-overview-section" title="Proxy configuration"
                     helper="Configure the reverse proxy and request handling for this server.">
                     <x-slot:actions>
@@ -126,7 +129,16 @@ class="flex size-9 shrink-0 items-center justify-center rounded-lg bg-neutral-10
                         @endif
 
                         @if ($proxySettings)
-                            <div class="mt-4">
+                            <div class="relative mt-4" wire:loading.class="pointer-events-none opacity-50"
+                                wire:target="submit,resetProxyConfiguration" aria-live="polite">
+                                <div wire:loading.flex wire:target="submit,resetProxyConfiguration"
+                                    class="absolute inset-0 z-20 hidden items-center justify-center rounded-lg bg-white/75 backdrop-blur-[1px] dark:bg-black/55">
+                                    <div
+                                        class="flex items-center gap-2 rounded-lg bg-white px-3 py-2 text-xs font-medium text-neutral-700 shadow-sm ring-1 ring-neutral-200 dark:bg-coolgray-100 dark:text-fg dark:ring-white/10">
+                                        <x-loading />
+                                        Updating proxy configuration…
+                                    </div>
+                                </div>
                                 <x-forms.textarea canGate="update" :canResource="$server" useMonacoEditor
                                     monacoEditorLanguage="yaml"
                                     label="Configuration file · {{ $this->configurationFilePath }}"
@@ -135,6 +147,7 @@ class="flex size-9 shrink-0 items-center justify-center rounded-lg bg-neutral-10
                         @endif
                     </x-application.settings-section>
                 @endif
+                </fieldset>
             </form>
         @elseif($selectedProxy === 'NONE')
             <x-application.settings-section title="Custom proxy"
diff --git a/tests/Feature/ActivityMonitorCrossTeamTest.php b/tests/Feature/ActivityMonitorCrossTeamTest.php
index 9966ac2dd..dc15140c6 100644
--- a/tests/Feature/ActivityMonitorCrossTeamTest.php
+++ b/tests/Feature/ActivityMonitorCrossTeamTest.php
@@ -130,3 +130,23 @@
         ->set('activityId', $otherActivity->id)
         ->assertStatus(500);
 })->throws(CannotUpdateLockedPropertyException::class);
+
+test('closing a process dialog clears the previous activity logs', function () {
+    $activity = Activity::create([
+        'log_name' => 'default',
+        'description' => 'proxy restart activity',
+        'properties' => ['team_id' => $this->team->id],
+    ]);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => ['id' => $this->team->id]]);
+
+    Livewire::test(ActivityMonitor::class)
+        ->call('newMonitorActivity', $activity->id)
+        ->assertSet('activityId', $activity->id)
+        ->assertSet('isPollingActive', true)
+        ->dispatch('processDialogClosed')
+        ->assertSet('activityId', null)
+        ->assertSet('activity', null)
+        ->assertSet('isPollingActive', false);
+});
diff --git a/tests/Feature/ButtonHeightConsistencyTest.php b/tests/Feature/ButtonHeightConsistencyTest.php
index 06b45d782..ac72cb2ba 100644
--- a/tests/Feature/ButtonHeightConsistencyTest.php
+++ b/tests/Feature/ButtonHeightConsistencyTest.php
@@ -1,10 +1,10 @@
 <?php
 
-it('uses the standard button height inside application forms and workspaces', function () {
+it('uses the compact height for all standard buttons', function () {
     $utilities = file_get_contents(resource_path('css/utilities.css'));
     $applicationStyles = file_get_contents(resource_path('css/app.css'));
 
-    expect($utilities)->toContain('px-2.5 h-9 min-h-9')
+    expect($utilities)->toContain('px-2.5 h-8 min-h-8')
         ->and($applicationStyles)
         ->not->toContain('.application-settings-workspace .button')
         ->not->toContain('.application-settings-form .button');
diff --git a/tests/Feature/DashboardServerMetricsChartTest.php b/tests/Feature/DashboardServerMetricsChartTest.php
index 196526fcf..4d7c64d0f 100644
--- a/tests/Feature/DashboardServerMetricsChartTest.php
+++ b/tests/Feature/DashboardServerMetricsChartTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Livewire\Dashboard;
+use App\Livewire\Server\Index as ServerIndex;
 use App\Models\InstanceSettings;
 use App\Models\PrivateKey;
 use App\Models\Server;
@@ -45,6 +46,24 @@
         ->assertDontSeeHtml("dashboard-server-metrics-{$disabledServer->uuid}");
 });
 
+it('renders dashboard metrics charts on the server index grid', function () {
+    $enabledServer = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+    ]);
+    $enabledServer->settings->update(['is_metrics_enabled' => true]);
+
+    $disabledServer = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+    ]);
+    $disabledServer->settings->update(['is_metrics_enabled' => false]);
+
+    Livewire::test(ServerIndex::class)
+        ->assertSeeHtml("dashboard-server-metrics-{$enabledServer->uuid}")
+        ->assertDontSeeHtml("dashboard-server-metrics-{$disabledServer->uuid}");
+});
+
 it('configures the dashboard chart as a ten minute cpu and memory sparkline with hover details', function () {
     $chart = file_get_contents(resource_path('views/livewire/dashboard/server-metrics-chart.blade.php'));
     $component = file_get_contents(app_path('Livewire/Dashboard/ServerMetricsChart.php'));
diff --git a/tests/Feature/Proxy/RestartProxyTest.php b/tests/Feature/Proxy/RestartProxyTest.php
index 60c057135..16cddd36e 100644
--- a/tests/Feature/Proxy/RestartProxyTest.php
+++ b/tests/Feature/Proxy/RestartProxyTest.php
@@ -72,6 +72,65 @@ function makeServerProxyRunning(Server $server): void
         ->assertSee('Stop Proxy');
 });
 
+test('running proxy shows pending configuration warning when saved settings differ from applied settings', function () {
+    [$user, $team, $server] = setupProxyUser('admin');
+    makeServerProxyRunning($server);
+    $server->proxy->last_saved_settings = 'saved-hash';
+    $server->proxy->last_applied_settings = 'applied-hash';
+    $server->detected_traefik_version = '3.6.23';
+    $server->traefik_outdated_info = [
+        'current' => '3.6.23',
+        'latest' => '3.7.8',
+        'type' => 'minor_upgrade',
+        'upgrade_target' => 'v3.7',
+    ];
+    $server->save();
+
+    expect($server->fresh()->hasPendingProxyConfiguration())->toBeTrue();
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    $component = Livewire::test('server.navbar', ['server' => $server->fresh()])
+        ->assertSee('Changes pending')
+        ->assertSee('The saved proxy configuration has not been applied')
+        ->assertSee('Restart proxy');
+
+    $server->refresh();
+    $server->proxy->last_applied_settings = 'saved-hash';
+    $server->traefik_outdated_info = null;
+    $server->save();
+
+    $component->call('showNotification')
+        ->assertDispatched('proxy-configuration-state-changed', pending: false, traefikOutdated: false)
+        ->assertDontSee('The saved proxy configuration has not been applied');
+});
+
+test('running proxy hides pending configuration warning when saved settings match applied settings', function () {
+    [$user, $team, $server] = setupProxyUser('admin');
+    makeServerProxyRunning($server);
+    $server->proxy->last_saved_settings = 'matching-hash';
+    $server->proxy->last_applied_settings = 'matching-hash';
+    $server->save();
+
+    expect($server->fresh()->hasPendingProxyConfiguration())->toBeFalse();
+
+    $this->actingAs($user);
+    session(['currentTeam' => $team]);
+
+    $component = Livewire::test('server.navbar', ['server' => $server->fresh()])
+        ->assertDontSee('The saved proxy configuration has not been applied');
+
+    $server->refresh();
+    $server->proxy->last_saved_settings = 'new-saved-hash';
+    $server->save();
+
+    $component->dispatch('refreshServerShow')
+        ->assertDispatched('proxy-configuration-state-changed', pending: true, traefikOutdated: false)
+        ->assertSee('Changes pending')
+        ->assertSee('The saved proxy configuration has not been applied');
+});
+
 test('admin can stop a proxy while it is starting', function () {
     [$user, $team, $server] = setupProxyUser('admin');
 
diff --git a/tests/Feature/ProxyConfigurationLoadingStateTest.php b/tests/Feature/ProxyConfigurationLoadingStateTest.php
new file mode 100644
index 000000000..112f68d8c
--- /dev/null
+++ b/tests/Feature/ProxyConfigurationLoadingStateTest.php
@@ -0,0 +1,12 @@
+<?php
+
+it('disables proxy configuration controls and covers the editor while saving', function () {
+    $view = file_get_contents(resource_path('views/livewire/server/proxy.blade.php'));
+
+    expect($view)
+        ->toContain('wire:loading.attr="disabled"')
+        ->toContain('wire:target="submit,resetProxyConfiguration"')
+        ->toContain('wire:loading.class="pointer-events-none opacity-50"')
+        ->toContain('Updating proxy configuration')
+        ->toContain('aria-live="polite"');
+});
diff --git a/tests/Feature/ServerSidebarIconsTest.php b/tests/Feature/ServerSidebarIconsTest.php
index 414a86381..205429d67 100644
--- a/tests/Feature/ServerSidebarIconsTest.php
+++ b/tests/Feature/ServerSidebarIconsTest.php
@@ -46,3 +46,17 @@
         ->toMatch("/'label' => 'Proxy'[\s\S]*?'icon' => 'network'/")
         ->not->toMatch("/'label' => 'Proxy'[\s\S]*?'icon' => 'settings',\s*'group' => 'Platform'/");
 });
+
+it('shows a warning icon when a server menu item requires attention', function () {
+    $contents = file_get_contents(resource_path('views/components/server/sidebar.blade.php'));
+
+    expect($contents)
+        ->toContain('proxyConfigurationPending: @js($server->hasPendingProxyConfiguration())')
+        ->toContain('proxyConfigurationPending: @js($server->hasPendingProxyConfiguration()),')
+        ->toContain('traefikOutdated: @js($server->hasCurrentTraefikOutdatedInfo())')
+        ->toContain('@proxy-configuration-state-changed.window')
+        ->toContain("\$menuItem['warning'] ?? false")
+        ->toContain('name="alert-triangle"');
+
+    expect(substr_count($contents, 'traefikOutdated: @js($server->hasCurrentTraefikOutdatedInfo())'))->toBe(1);
+});
diff --git a/tests/Feature/TraefikVersionStateTest.php b/tests/Feature/TraefikVersionStateTest.php
new file mode 100644
index 000000000..9068683f6
--- /dev/null
+++ b/tests/Feature/TraefikVersionStateTest.php
@@ -0,0 +1,89 @@
+<?php
+
+use App\Enums\ProxyTypes;
+use App\Jobs\CheckTraefikVersionForServerJob;
+use App\Livewire\Server\Proxy;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+
+uses(RefreshDatabase::class);
+
+it('ignores stale minor upgrade information for the detected Traefik version', function () {
+    Cache::put('coolify:versions:all', [
+        'traefik' => [
+            'v3.7' => '3.7.8',
+            'v3.6' => '3.6.23',
+        ],
+    ]);
+
+    $server = Server::factory()->make([
+        'proxy' => ['type' => ProxyTypes::TRAEFIK->value],
+        'detected_traefik_version' => '3.7.8',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+            'upgrade_target' => 'v3.7',
+        ],
+    ]);
+
+    $component = new Proxy;
+    $component->server = $server;
+
+    expect($component->getNewerTraefikBranchAvailableProperty())->toBeNull();
+});
+
+it('does not mark stale Traefik outdated information as a current warning', function () {
+    $server = Server::factory()->make([
+        'proxy' => ['type' => ProxyTypes::TRAEFIK->value],
+        'detected_traefik_version' => '3.7.8',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+            'upgrade_target' => 'v3.7',
+        ],
+    ]);
+
+    expect($server->hasCurrentTraefikOutdatedInfo())->toBeFalse();
+});
+
+it('marks matching Traefik outdated information as a current warning', function () {
+    $server = Server::factory()->make([
+        'proxy' => ['type' => ProxyTypes::TRAEFIK->value],
+        'detected_traefik_version' => 'v3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+            'upgrade_target' => 'v3.7',
+        ],
+    ]);
+
+    expect($server->hasCurrentTraefikOutdatedInfo())->toBeTrue();
+});
+
+it('clears stale outdated information before detecting the current version', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'detected_traefik_version' => '3.6.23',
+        'traefik_outdated_info' => [
+            'current' => '3.6.23',
+            'latest' => '3.7.8',
+            'type' => 'minor_upgrade',
+            'upgrade_target' => 'v3.7',
+        ],
+    ]);
+
+    $job = new CheckTraefikVersionForServerJob($server, ['v3.7' => '3.7.8']);
+    $method = new ReflectionMethod($job, 'clearOutdatedInfo');
+    $method->invoke($job);
+
+    $server->refresh();
+
+    expect($server->detected_traefik_version)->toBe('3.6.23')
+        ->and($server->traefik_outdated_info)->toBeNull();
+});

From b2af1c11a5c65d10d0fd4f9efec1902ee6221ac1 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 14:02:48 +0200
Subject: [PATCH 35/42] fix(logs): clean up deployment log scrolling on
 teardown

---
 .../project/shared/get-logs.blade.php         | 41 +++++++++++++------
 .../Feature/DeploymentLogToolbarStyleTest.php | 11 +++++
 2 files changed, 39 insertions(+), 13 deletions(-)

diff --git a/resources/views/livewire/project/shared/get-logs.blade.php b/resources/views/livewire/project/shared/get-logs.blade.php
index f96667b57..57391233d 100644
--- a/resources/views/livewire/project/shared/get-logs.blade.php
+++ b/resources/views/livewire/project/shared/get-logs.blade.php
@@ -7,7 +7,9 @@
         alwaysScroll: false,
         followManuallyDisabled: false,
         rafId: null,
+        scrollTimeout: null,
         scrollDebounce: null,
+        destroyed: false,
         colorLogs: localStorage.getItem('coolify-color-logs') === 'true',
         logFilters: JSON.parse(localStorage.getItem('coolify-log-filters')) || {error: true, warning: true, debug: true, info: true},
         searchQuery: '',
@@ -17,10 +19,7 @@
             this.fullscreen = !this.fullscreen;
             if (this.fullscreen === false) {
                 this.alwaysScroll = false;
-                if (this.rafId) {
-                    cancelAnimationFrame(this.rafId);
-                    this.rafId = null;
-                }
+                this.cancelScrollLoop();
             }
         },
         handleKeyDown(event) {
@@ -33,10 +32,21 @@
         disableFollow() {
             if (!this.alwaysScroll) return;
             this.alwaysScroll = false;
+            this.cancelScrollLoop();
+        },
+        cancelScrollLoop() {
             if (this.rafId) {
                 cancelAnimationFrame(this.rafId);
                 this.rafId = null;
             }
+            if (this.scrollTimeout) {
+                clearTimeout(this.scrollTimeout);
+                this.scrollTimeout = null;
+            }
+            if (this.scrollDebounce) {
+                clearTimeout(this.scrollDebounce);
+                this.scrollDebounce = null;
+            }
         },
         handleWheel(event) {
             if (this.alwaysScroll && event.deltaY < 0) {
@@ -62,7 +72,8 @@
             }
         },
         scrollToBottom() {
-            const logsContainer = document.getElementById('logsContainer');
+            if (this.destroyed) return;
+            const logsContainer = this.$root.querySelector('#logsContainer');
             if (logsContainer) {
                 this.isScrolling = true;
                 logsContainer.scrollTop = logsContainer.scrollHeight;
@@ -70,11 +81,12 @@
             }
         },
         scheduleScroll() {
-            if (!this.alwaysScroll) return;
+            if (!this.alwaysScroll || this.destroyed) return;
             this.rafId = requestAnimationFrame(() => {
+                if (!this.alwaysScroll || this.destroyed) return;
                 this.scrollToBottom();
-                if (this.alwaysScroll) {
-                    setTimeout(() => this.scheduleScroll(), 250);
+                if (this.alwaysScroll && !this.destroyed) {
+                    this.scrollTimeout = setTimeout(() => this.scheduleScroll(), 250);
                 }
             });
         },
@@ -85,16 +97,14 @@
                 this.scheduleScroll();
             } else {
                 this.followManuallyDisabled = true;
-                if (this.rafId) {
-                    cancelAnimationFrame(this.rafId);
-                    this.rafId = null;
-                }
+                this.cancelScrollLoop();
             }
         },
         handleScroll(event) {
-            if (this.isScrolling) return;
+            if (this.isScrolling || this.destroyed) return;
             clearTimeout(this.scrollDebounce);
             this.scrollDebounce = setTimeout(() => {
+                if (this.destroyed) return;
                 const el = event.target;
                 const distanceFromBottom = el.scrollHeight - el.scrollTop - el.clientHeight;
                 if (!this.alwaysScroll && !this.followManuallyDisabled && distanceFromBottom <= 10) {
@@ -253,6 +263,11 @@
                     applyAfterUpdate();
                 }
             });
+        },
+        destroy() {
+            this.destroyed = true;
+            this.alwaysScroll = false;
+            this.cancelScrollLoop();
         }
     }" @keydown.window="handleKeyDown($event)">
         @if ($collapsible)
diff --git a/tests/Feature/DeploymentLogToolbarStyleTest.php b/tests/Feature/DeploymentLogToolbarStyleTest.php
index a33fb5315..24cf01376 100644
--- a/tests/Feature/DeploymentLogToolbarStyleTest.php
+++ b/tests/Feature/DeploymentLogToolbarStyleTest.php
@@ -45,3 +45,14 @@
             ->toContain('this.followManuallyDisabled = false');
     }
 });
+
+test('runtime log follow loop is cleaned up when navigating away', function () {
+    $view = file_get_contents(resource_path('views/livewire/project/shared/get-logs.blade.php'));
+
+    expect($view)
+        ->toContain('scrollTimeout: null')
+        ->toContain("this.\$root.querySelector('#logsContainer')")
+        ->toContain('destroy() {')
+        ->toContain('this.destroyed = true')
+        ->toContain('this.cancelScrollLoop()');
+});

From 288dc98ca7bd803fd927e6c677550f10e136842b Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 14:03:33 +0200
Subject: [PATCH 36/42] fix: enforce remote output size limits

---
 app/Actions/Proxy/GetProxyConfiguration.php   |   2 +-
 app/Models/Application.php                    |   2 +-
 tests/Feature/GetLogsCommandInjectionTest.php |   6 +-
 tests/Pest.php                                |  17 +++
 tests/Unit/LocalFileVolumeContentSizeTest.php |  73 +++++++----
 tests/Unit/RemoteOutputSizeLimitsTest.php     | 119 +++++++++++++-----
 6 files changed, 163 insertions(+), 56 deletions(-)

diff --git a/app/Actions/Proxy/GetProxyConfiguration.php b/app/Actions/Proxy/GetProxyConfiguration.php
index 7df16c52b..d09aae802 100644
--- a/app/Actions/Proxy/GetProxyConfiguration.php
+++ b/app/Actions/Proxy/GetProxyConfiguration.php
@@ -107,7 +107,7 @@ private function backfillFromDisk(Server $server): ?string
             "if [ ! -f {$configurationPath} ]; then exit 0; elif [ \"$(wc -c < {$configurationPath})\" -gt ".self::MAX_CONFIGURATION_SIZE_BYTES." ]; then echo '__COOLIFY_PROXY_CONFIG_TOO_LARGE__'; else head -c {$readLimit} {$configurationPath}; fi",
         ], $server, false);
 
-        if ($result === '__COOLIFY_PROXY_CONFIG_TOO_LARGE__') {
+        if ($result === '__COOLIFY_PROXY_CONFIG_TOO_LARGE__' || strlen($result ?? '') > self::MAX_CONFIGURATION_SIZE_BYTES) {
             throw new \RuntimeException('Proxy configuration exceeds the 5 MiB size limit.');
         }
 
diff --git a/app/Models/Application.php b/app/Models/Application.php
index a74941f02..fef76cd39 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -2161,7 +2161,7 @@ public function loadComposeFile($isInit = false, ?string $restoreBaseDirectory =
         }
         try {
             $composeFileContent = instant_remote_process($commands, $this->destination->server);
-            if ($composeFileContent === '__COOLIFY_COMPOSE_TOO_LARGE__') {
+            if ($composeFileContent === '__COOLIFY_COMPOSE_TOO_LARGE__' || strlen($composeFileContent) > self::MAX_DOCKER_COMPOSE_SIZE_BYTES) {
                 throw new RuntimeException('Docker Compose file exceeds the 5 MiB size limit.');
             }
         } catch (\Exception $e) {
diff --git a/tests/Feature/GetLogsCommandInjectionTest.php b/tests/Feature/GetLogsCommandInjectionTest.php
index c920b94ed..2c86d7328 100644
--- a/tests/Feature/GetLogsCommandInjectionTest.php
+++ b/tests/Feature/GetLogsCommandInjectionTest.php
@@ -80,7 +80,7 @@
             'is_usable' => true,
             'force_disabled' => false,
         ])->save();
-        $server = Server::with('settings')->find($this->server->id);
+        $server = Server::with('settings')->findOrFail($this->server->id);
         $output = "\e[31m".str_repeat('a', GetLogs::MAX_DISPLAY_SIZE_BYTES - 4);
 
         expect(strlen($output))->toBe(GetLogs::MAX_DISPLAY_SIZE_BYTES + 1);
@@ -114,7 +114,7 @@
             'force_disabled' => false,
         ])->save();
         // Reload server with fresh settings to ensure casted values
-        $server = Server::with('settings')->find($this->server->id);
+        $server = Server::with('settings')->findOrFail($this->server->id);
 
         Livewire::test(GetLogs::class, [
             'server' => $server,
@@ -144,7 +144,7 @@
             'is_usable' => true,
             'force_disabled' => false,
         ])->save();
-        $server = Server::with('settings')->find($this->server->id);
+        $server = Server::with('settings')->findOrFail($this->server->id);
 
         Livewire::test(GetLogs::class, [
             'server' => $server,
diff --git a/tests/Pest.php b/tests/Pest.php
index 7100bfaa7..25d944010 100644
--- a/tests/Pest.php
+++ b/tests/Pest.php
@@ -27,6 +27,23 @@
 
 require_once __DIR__.'/Support/BrowserTestHelpers.php';
 
+function remoteOutputSource(string $path): string
+{
+    $fixturePath = dirname(__DIR__).'/'.$path;
+
+    if (! is_readable($fixturePath)) {
+        throw new RuntimeException("Unable to read source fixture: {$fixturePath}");
+    }
+
+    $source = file_get_contents($fixturePath);
+
+    if ($source === false) {
+        throw new RuntimeException("Unable to read source fixture: {$fixturePath}");
+    }
+
+    return $source;
+}
+
 /*
 |--------------------------------------------------------------------------
 | Test Hooks
diff --git a/tests/Unit/LocalFileVolumeContentSizeTest.php b/tests/Unit/LocalFileVolumeContentSizeTest.php
index 1894bf439..2a2223401 100644
--- a/tests/Unit/LocalFileVolumeContentSizeTest.php
+++ b/tests/Unit/LocalFileVolumeContentSizeTest.php
@@ -9,10 +9,18 @@
  * payload, crashing the browser.
  */
 
+use App\Models\Application;
 use App\Models\LocalFileVolume;
+use App\Models\PrivateKey;
+use App\Models\Server;
+use App\Models\User;
+use Illuminate\Database\Eloquent\Relations\MorphMany;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
 use Tests\TestCase;
 
-uses(TestCase::class);
+uses(TestCase::class, RefreshDatabase::class);
 
 it('exposes a 5 MiB content size limit', function () {
     expect(LocalFileVolume::MAX_CONTENT_SIZE)->toBe(5_242_880);
@@ -66,31 +74,50 @@
 });
 
 it('does not read regular bind-mounted file contents while loading service settings', function () {
-    $helpers = file_get_contents(base_path('bootstrap/helpers/services.php'));
-    $filesystemSync = str($helpers)
-        ->after('function getFilesystemVolumesFromServer')
-        ->before('function updateCompose');
+    $user = User::factory()->create();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $user->teams()->first()->id]);
+    Storage::fake('ssh-keys');
+    $server = Server::factory()->create([
+        'team_id' => $user->teams()->first()->id,
+        'private_key_id' => $privateKey->id,
+    ]);
 
-    expect($filesystemSync->value())
-        ->not->toContain('instant_remote_process(["cat $fileLocation"]');
-    expect($filesystemSync->value())
-        ->toContain('if ($fileVolume->is_based_on_git)')
-        ->toContain('$fileVolume->loadStorageOnServer();');
-});
+    $volume = Mockery::mock(LocalFileVolume::class)->makePartial();
+    $volume->fs_path = '/data/large.bin';
+    $volume->is_based_on_git = false;
+    $volume->shouldReceive('save')->once();
+    $volume->shouldNotReceive('loadStorageOnServer');
 
-it('marks git-based file volumes as files before refreshing their content', function () {
-    $helpers = file_get_contents(base_path('bootstrap/helpers/services.php'));
-    $fileBranch = str($helpers)
-        ->after("if (\$isFile === 'OK') {")
-        ->before("} elseif (\$isDir === 'OK') {");
+    $fileStorages = Mockery::mock(MorphMany::class);
+    $fileStorages->shouldReceive('get')->once()->andReturn(collect([$volume]));
 
-    expect($fileBranch->value())->toMatch(
-        '/\$fileVolume->is_directory = false;\s+\$fileVolume->save\(\);\s+if \(\$fileVolume->is_based_on_git\) \{/'
-    );
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('getMorphClass')->andReturn(Application::class);
+    $application->shouldReceive('workdir')->once()->andReturn('/data/application');
+    $application->shouldReceive('fileStorages')->once()->andReturn($fileStorages);
+    $application->setRelation('destination', (object) ['server' => $server]);
+
+    Process::fake(function ($process) {
+        if (str_contains($process->command, 'test -f /data/large.bin')) {
+            return Process::result(output: 'OK');
+        }
+
+        if (str_contains($process->command, 'test -d /data/large.bin')) {
+            return Process::result(output: 'NOK');
+        }
+
+        return Process::result();
+    });
+
+    getFilesystemVolumesFromServer($application);
+
+    expect($volume->is_directory)->toBeFalse();
+    Process::assertRan(fn ($process) => str_contains($process->command, 'test -f /data/large.bin'));
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'cat /data/large.bin') || str_contains($process->command, 'head -c'));
 });
 
 it('bounds the remote file read itself to prevent a size-check race', function () {
-    $source = file_get_contents(app_path('Models/LocalFileVolume.php'));
+    $source = remoteOutputSource('app/Models/LocalFileVolume.php');
     $loadStorage = str($source)
         ->after('public function loadStorageOnServer()')
         ->before('public function deleteStorageOnServer()');
@@ -101,7 +128,7 @@
 });
 
 it('bounds directory-to-file conflict reads the same way', function () {
-    $source = file_get_contents(app_path('Models/LocalFileVolume.php'));
+    $source = remoteOutputSource('app/Models/LocalFileVolume.php');
     $saveStorage = str($source)
         ->after('public function saveStorageOnServer()')
         ->before('protected function plainMountPath');
@@ -118,8 +145,12 @@
 });
 
 it('keeps a bounded remote read that fits the limit', function () {
+    $maximumSizedContent = str_repeat('a', LocalFileVolume::MAX_CONTENT_SIZE);
+
     expect(LocalFileVolume::contentFromBoundedRead('hello'))
         ->toBe('hello')
+        ->and(LocalFileVolume::contentFromBoundedRead($maximumSizedContent))
+        ->toBe($maximumSizedContent)
         ->and(LocalFileVolume::contentFromBoundedRead(null))
         ->toBe('');
 });
diff --git a/tests/Unit/RemoteOutputSizeLimitsTest.php b/tests/Unit/RemoteOutputSizeLimitsTest.php
index 3660e8828..dda82a0fb 100644
--- a/tests/Unit/RemoteOutputSizeLimitsTest.php
+++ b/tests/Unit/RemoteOutputSizeLimitsTest.php
@@ -5,27 +5,65 @@
 use App\Livewire\Project\Shared\GetLogs;
 use App\Livewire\Server\Proxy\DynamicConfigurations;
 use App\Models\Application;
+use App\Models\PrivateKey;
 use App\Models\Server;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Process;
+use Illuminate\Support\Facades\Storage;
+use Spatie\SchemalessAttributes\SchemalessAttributes;
+use Tests\TestCase;
 
-function remoteOutputSource(string $path): string
+uses(TestCase::class, RefreshDatabase::class);
+
+function remoteOutputTestServer(): Server
 {
-    return file_get_contents(__DIR__.'/../../'.$path);
+    $user = User::factory()->create();
+    $team = $user->teams()->first();
+    $privateKey = PrivateKey::factory()->create(['team_id' => $team->id]);
+    Storage::fake('ssh-keys');
+
+    return Server::factory()->create([
+        'team_id' => $team->id,
+        'private_key_id' => $privateKey->id,
+    ]);
 }
 
 it('bounds dynamic proxy configuration files and their combined Livewire payload', function () {
-    $source = remoteOutputSource('app/Livewire/Server/Proxy/DynamicConfigurations.php');
+    $server = Mockery::mock(remoteOutputTestServer())->makePartial();
+    $server->shouldReceive('proxyPath')->andReturn('/data/proxy');
+    $files = collect(range(1, 101))->map(fn (int $number) => sprintf('file%03d.yml', $number))->implode("\n");
 
-    expect($source)
-        ->toContain('MAX_CONFIGURATION_FILE_SIZE_BYTES')
-        ->toContain('MAX_TOTAL_CONFIGURATION_SIZE_BYTES')
-        ->toContain('MAX_CONFIGURATION_FILES')
-        ->toContain('head -c')
-        ->toContain('$totalBytes');
+    Process::fake(function ($process) use ($files) {
+        if (str_contains($process->command, 'ls -1')) {
+            return Process::result(output: $files);
+        }
 
-    expect(DynamicConfigurations::MAX_CONFIGURATION_FILE_SIZE_BYTES)->toBe(1024 * 1024)
-        ->and(DynamicConfigurations::MAX_TOTAL_CONFIGURATION_SIZE_BYTES)->toBe(5 * 1024 * 1024)
-        ->and(DynamicConfigurations::MAX_CONFIGURATION_FILES)->toBe(100);
+        if (str_contains($process->command, 'file001.yml')) {
+            return Process::result(output: str_repeat('x', DynamicConfigurations::MAX_CONFIGURATION_FILE_SIZE_BYTES + 1));
+        }
+
+        if (preg_match('/file00[2-6]\.yml/', $process->command)) {
+            return Process::result(output: str_repeat('x', DynamicConfigurations::MAX_CONFIGURATION_FILE_SIZE_BYTES));
+        }
+
+        return Process::result(output: 'x');
+    });
+
+    $component = Mockery::mock(DynamicConfigurations::class)->makePartial();
+    $component->server = $server;
+    $component->shouldReceive('authorize')->once();
+    $component->shouldReceive('dispatch')->andReturnSelf();
+    $component->loadDynamicConfigurations();
+
+    expect($component->contents)->toHaveCount(5)
+        ->toHaveKeys(['file002|yml', 'file003|yml', 'file004|yml', 'file005|yml', 'file006|yml'])
+        ->not->toHaveKeys(['file001|yml', 'file007|yml', 'file101|yml']);
+    Process::assertNotRan(fn ($process) => str_contains($process->command, 'file101.yml'));
 });
+it('fails explicitly when a source fixture cannot be read', function () {
+    remoteOutputSource('missing-source-fixture.php');
+})->throws(RuntimeException::class, 'Unable to read source fixture:');
 
 it('bounds regular log viewer output before it reaches PHP', function () {
     $source = remoteOutputSource('app/Livewire/Project/Shared/GetLogs.php');
@@ -42,17 +80,34 @@ function remoteOutputSource(string $path): string
         ->and($command)->toBe('(docker logs example) 2>&1 | head -c 101');
 });
 
-it('bounds docker compose files loaded from git before parsing', function () {
-    $source = remoteOutputSource('app/Models/Application.php');
+it('rejects oversized docker compose files loaded from git before parsing', function () {
+    $server = remoteOutputTestServer();
 
-    expect($source)
-        ->toContain('MAX_DOCKER_COMPOSE_SIZE_BYTES')
-        ->toContain('MAX_DOCKER_COMPOSE_SIZE_BYTES + 1')
-        ->toContain('head -c');
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->base_directory = '/';
+    $application->docker_compose_location = '/docker-compose.yml';
+    $application->setRelation('destination', (object) ['server' => $server]);
+    $application->shouldReceive('generateGitImportCommands')->andReturn(['commands' => collect(['git clone example checkout'])]);
+    $application->shouldReceive('getGitRemoteStatus')->andReturn(['is_accessible' => true]);
+    $application->shouldReceive('save')->once();
 
-    expect(Application::MAX_DOCKER_COMPOSE_SIZE_BYTES)->toBe(5 * 1024 * 1024);
+    Process::fake(function ($process) {
+        if (str_contains($process->command, 'git --version')) {
+            return Process::result(output: 'git version 2.40.0');
+        }
+
+        if (str_contains($process->command, 'wc -c')) {
+            return Process::result(output: '__COOLIFY_COMPOSE_TOO_LARGE__');
+        }
+
+        return Process::result();
+    });
+
+    expect(fn () => $application->loadComposeFile())
+        ->toThrow(RuntimeException::class, 'Docker Compose file exceeds the 5 MiB size limit.');
+    expect($application->docker_compose_raw)->toBeNull();
+    Process::assertRan(fn ($process) => str_contains($process->command, 'head -c '.(Application::MAX_DOCKER_COMPOSE_SIZE_BYTES + 1)));
 });
-
 it('bounds scheduled task output before storing or notifying', function () {
     $source = remoteOutputSource('app/Jobs/ScheduledTaskJob.php');
 
@@ -97,8 +152,7 @@ function remoteOutputSource(string $path): string
     $reflection = new ReflectionClass(ScheduledTaskJob::class);
     $method = $reflection->getMethod('boundedTaskCommand');
     $command = $method->invoke($reflection->newInstanceWithoutConstructor(), 'sudo docker exec example true');
-    $server = Mockery::mock(Server::class)->makePartial();
-    $server->shouldReceive('getAttribute')->with('user')->andReturn('ubuntu');
+    $server = new Server(['user' => 'ubuntu']);
     $rewrittenCommand = parseCommandsByLineForSudo(collect([$command]), $server)[0];
 
     exec('bash -n -c '.escapeshellarg($command), $output, $exitCode);
@@ -111,14 +165,19 @@ function remoteOutputSource(string $path): string
         ->and($rewrittenExitCode)->not->toBe(0);
 });
 
-it('bounds proxy configuration backfill before storing it', function () {
-    $source = remoteOutputSource('app/Actions/Proxy/GetProxyConfiguration.php');
+it('rejects oversized proxy configuration backfill before persistence', function () {
+    $proxy = Mockery::mock(SchemalessAttributes::class);
+    $proxy->shouldNotReceive('set');
+    $server = Mockery::mock(remoteOutputTestServer())->makePartial();
+    $server->shouldReceive('proxyPath')->andReturn('/data/proxy');
+    $server->shouldReceive('getAttribute')->with('proxy')->andReturn($proxy);
+    $server->shouldNotReceive('save');
 
-    expect($source)
-        ->toContain('MAX_CONFIGURATION_SIZE_BYTES')
-        ->toContain('MAX_CONFIGURATION_SIZE_BYTES + 1')
-        ->toContain('head -c')
-        ->toContain('Proxy configuration exceeds');
+    Process::fake(['*' => Process::result(output: '__COOLIFY_PROXY_CONFIG_TOO_LARGE__')]);
 
-    expect(GetProxyConfiguration::MAX_CONFIGURATION_SIZE_BYTES)->toBe(5 * 1024 * 1024);
+    $method = new ReflectionMethod(GetProxyConfiguration::class, 'backfillFromDisk');
+
+    expect(fn () => $method->invoke(new GetProxyConfiguration, $server))
+        ->toThrow(RuntimeException::class, 'Proxy configuration exceeds the 5 MiB size limit.');
+    Process::assertRan(fn ($process) => str_contains($process->command, 'head -c '.(GetProxyConfiguration::MAX_CONFIGURATION_SIZE_BYTES + 1)));
 });

From dd597d152722cb8f141dfa76b4de694fd4283618 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 14:10:23 +0200
Subject: [PATCH 37/42] fix(backups): support long-running volume backups

---
 .../Api/VolumeBackupsController.php           |  4 +-
 app/Jobs/VolumeBackupJob.php                  |  4 +-
 .../Project/Shared/Storages/VolumeBackups.php |  2 +-
 app/Models/ScheduledVolumeBackup.php          |  2 +
 config/horizon.php                            |  6 ++-
 ...increase_default_volume_backup_timeout.php | 27 ++++++++++++++
 tests/Feature/VolumeBackupTest.php            | 37 +++++++++++++++++++
 7 files changed, 76 insertions(+), 6 deletions(-)
 create mode 100644 database/migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php

diff --git a/app/Http/Controllers/Api/VolumeBackupsController.php b/app/Http/Controllers/Api/VolumeBackupsController.php
index e51bf31f8..a5225f5dd 100644
--- a/app/Http/Controllers/Api/VolumeBackupsController.php
+++ b/app/Http/Controllers/Api/VolumeBackupsController.php
@@ -34,7 +34,7 @@
         new OA\Property(property: 'retention_amount_s3', type: 'integer', default: 7, minimum: 0, maximum: 10000),
         new OA\Property(property: 'retention_days_s3', type: 'integer', default: 0, maximum: 2147483647, minimum: 0),
         new OA\Property(property: 'retention_max_storage_s3', type: 'number', format: 'float', default: 0, maximum: 9999999999, minimum: 0),
-        new OA\Property(property: 'timeout', type: 'integer', default: 3600, minimum: 60, maximum: 36000),
+        new OA\Property(property: 'timeout', type: 'integer', default: ScheduledVolumeBackup::DEFAULT_TIMEOUT, minimum: 60, maximum: 36000),
     ],
     type: 'object',
     additionalProperties: false,
@@ -275,7 +275,7 @@ private function persistSchedule(
             'retention_amount_s3' => $request->integer('retention_amount_s3', 7),
             'retention_days_s3' => $request->integer('retention_days_s3'),
             'retention_max_storage_s3' => $request->float('retention_max_storage_s3'),
-            'timeout' => $request->integer('timeout', 3600),
+            'timeout' => $request->integer('timeout', ScheduledVolumeBackup::DEFAULT_TIMEOUT),
         ]);
         $created = $backup->wasRecentlyCreated;
 
diff --git a/app/Jobs/VolumeBackupJob.php b/app/Jobs/VolumeBackupJob.php
index 39998a1f6..b567a71b7 100644
--- a/app/Jobs/VolumeBackupJob.php
+++ b/app/Jobs/VolumeBackupJob.php
@@ -28,14 +28,14 @@ class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
 
     public int $maxExceptions = 1;
 
-    public int $timeout = 3600;
+    public int $timeout = ScheduledVolumeBackup::DEFAULT_TIMEOUT;
 
     private ?ScheduledVolumeBackupExecution $execution = null;
 
     public function __construct(public ScheduledVolumeBackup $backup)
     {
         $this->onQueue(crons_queue());
-        $this->timeout = $backup->timeout ?? 3600;
+        $this->timeout = $backup->timeout ?? ScheduledVolumeBackup::DEFAULT_TIMEOUT;
     }
 
     public function middleware(): array
diff --git a/app/Livewire/Project/Shared/Storages/VolumeBackups.php b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
index a03820b4b..a10eb5ad0 100644
--- a/app/Livewire/Project/Shared/Storages/VolumeBackups.php
+++ b/app/Livewire/Project/Shared/Storages/VolumeBackups.php
@@ -56,7 +56,7 @@ class VolumeBackups extends Component
 
     public string $timezone = '';
 
-    public int $timeout = 3600;
+    public int $timeout = ScheduledVolumeBackup::DEFAULT_TIMEOUT;
 
     public int $perPage = 10;
 
diff --git a/app/Models/ScheduledVolumeBackup.php b/app/Models/ScheduledVolumeBackup.php
index a33368142..7f33fd92b 100644
--- a/app/Models/ScheduledVolumeBackup.php
+++ b/app/Models/ScheduledVolumeBackup.php
@@ -11,6 +11,8 @@
 
 class ScheduledVolumeBackup extends BaseModel
 {
+    public const int DEFAULT_TIMEOUT = 36000;
+
     protected $fillable = [
         'uuid',
         'backupable_type',
diff --git a/config/horizon.php b/config/horizon.php
index d86c52aff..fe35734c2 100644
--- a/config/horizon.php
+++ b/config/horizon.php
@@ -1,5 +1,6 @@
 <?php
 
+use App\Models\ScheduledVolumeBackup;
 use Illuminate\Support\Str;
 
 return [
@@ -202,7 +203,10 @@
             'tries' => 1,
             'nice' => 0,
             'sleep' => 3,
-            'timeout' => env('HORIZON_TIMEOUT', 36000),
+            'timeout' => min(
+                max((int) env('HORIZON_TIMEOUT', 39600), ScheduledVolumeBackup::DEFAULT_TIMEOUT + 600),
+                85800,
+            ),
         ],
 
     ],
diff --git a/database/migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php b/database/migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php
new file mode 100644
index 000000000..f895c7837
--- /dev/null
+++ b/database/migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php
@@ -0,0 +1,27 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        DB::table('scheduled_volume_backups')
+            ->where('timeout', 3600)
+            ->update(['timeout' => 36000]);
+
+        Schema::table('scheduled_volume_backups', function (Blueprint $table) {
+            $table->unsignedInteger('timeout')->default(36000)->change();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('scheduled_volume_backups', function (Blueprint $table) {
+            $table->unsignedInteger('timeout')->default(3600)->change();
+        });
+    }
+};
diff --git a/tests/Feature/VolumeBackupTest.php b/tests/Feature/VolumeBackupTest.php
index 496894591..e18f1475f 100644
--- a/tests/Feature/VolumeBackupTest.php
+++ b/tests/Feature/VolumeBackupTest.php
@@ -51,6 +51,43 @@
         ->and(method_exists(LocalFileVolume::class, 'scheduledBackups'))->toBeTrue();
 });
 
+it('allows large volume backups to run for ten hours by default', function () {
+    $backup = new ScheduledVolumeBackup;
+    $job = new VolumeBackupJob($backup);
+
+    expect($job->timeout)->toBe(36000)
+        ->and((new VolumeBackups)->timeout)->toBe(36000)
+        ->and(config('horizon.defaults.s6.timeout'))->toBeGreaterThan($job->timeout)
+        ->and(config('queue.connections.redis.retry_after'))->toBeGreaterThan(config('horizon.defaults.s6.timeout'));
+});
+
+it('upgrades existing default volume backup timeouts without changing custom timeouts', function () {
+    $team = Team::factory()->create();
+    [$application, $defaultVolume] = createVolumeBackupApplication($team);
+    $customVolume = LocalPersistentVolume::create([
+        'name' => 'custom-timeout-data',
+        'mount_path' => '/custom-data',
+        'resource_id' => $application->id,
+        'resource_type' => $application->getMorphClass(),
+    ]);
+    $defaultBackup = $defaultVolume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'timeout' => 3600,
+    ]);
+    $customBackup = $customVolume->scheduledBackups()->create([
+        'team_id' => $team->id,
+        'frequency' => 'daily',
+        'timeout' => 7200,
+    ]);
+
+    $migration = require database_path('migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php');
+    $migration->up();
+
+    expect($defaultBackup->fresh()->timeout)->toBe(36000)
+        ->and($customBackup->fresh()->timeout)->toBe(7200);
+});
+
 it('includes parallel gzip support in the Coolify helper image', function () {
     $dockerfile = file_get_contents(base_path('docker/coolify-helper/Dockerfile'));
 

From ee843b723029c39fd2a19b45e592a407741fa891 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 14:51:40 +0200
Subject: [PATCH 38/42] fix(ui): show server warnings with alert icons

---
 resources/views/livewire/dashboard.blade.php  | 22 +++++++-----
 .../views/livewire/server/index.blade.php     | 34 ++++++++++++-------
 .../ServerStatusIndicatorDesignTest.php       | 18 +++++-----
 3 files changed, 44 insertions(+), 30 deletions(-)

diff --git a/resources/views/livewire/dashboard.blade.php b/resources/views/livewire/dashboard.blade.php
index e9f8b3273..175fdb39a 100644
--- a/resources/views/livewire/dashboard.blade.php
+++ b/resources/views/livewire/dashboard.blade.php
@@ -196,14 +196,9 @@ class="group relative flex min-h-28 min-w-0 flex-col rounded-xl border border-ne
                                     :key="'dashboard-server-metrics-'.$server->uuid" />
                             @endif
 
-                            <div class="pointer-events-none relative z-10 flex min-w-0 items-start gap-3">
-                                <div title="{{ $serverStatus }}" aria-label="Server status: {{ $serverStatus }}"
-                                    @class([
-                                        'flex size-8 shrink-0 items-center justify-center rounded-lg border bg-neutral-50 text-neutral-500 dark:bg-white/[0.04] dark:text-fg-dim',
-                                        'border-emerald-500/70' => $serverStatusType === 'success',
-                                        'border-amber-500/70' => $serverStatusType === 'warning',
-                                        'border-red-500/70' => $serverStatusType === 'error',
-                                    ])>
+                            <div class="relative z-10 flex min-w-0 items-start gap-3">
+                                <div
+                                    class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.1] dark:bg-white/[0.04] dark:text-fg-dim">
                                     <x-reicon name="servers" class="size-4" />
                                 </div>
                                 <div class="min-w-0 flex-1">
@@ -215,6 +210,17 @@ class="truncate text-[13px]! leading-4! font-semibold! text-black dark:text-fg">
                                         {{ $server->description ?: 'No description' }}
                                     </p>
                                 </div>
+                                @if ($serverStatusType !== 'success')
+                                    <span data-tooltip="{{ $serverStatus }}"
+                                        aria-label="Server status: {{ $serverStatus }}"
+                                        @class([
+                                            'flex size-6 shrink-0 items-center justify-center rounded-md',
+                                            'text-orange-500 dark:text-warning' => $serverStatusType === 'warning',
+                                            'text-red-500 dark:text-red-400' => $serverStatusType === 'error',
+                                        ])>
+                                        <x-reicon name="alert-triangle" class="size-4" />
+                                    </span>
+                                @endif
                             </div>
                         </a>
                     @endforeach
diff --git a/resources/views/livewire/server/index.blade.php b/resources/views/livewire/server/index.blade.php
index 2aa93aa7f..d89e8b891 100644
--- a/resources/views/livewire/server/index.blade.php
+++ b/resources/views/livewire/server/index.blade.php
@@ -139,15 +139,9 @@ class="group relative flex min-h-28 flex-col rounded-xl border border-neutral-20
                                 :key="'server-index-metrics-'.$server->uuid" />
                         @endif
 
-                        <div class="pointer-events-none relative z-10 flex items-start gap-3">
-                            <div title="{{ $serverRow['status'] }}"
-                                aria-label="Server status: {{ $serverRow['status'] }}"
-                                @class([
-                                    'flex size-8 shrink-0 items-center justify-center rounded-lg border bg-neutral-50 text-neutral-500 dark:bg-white/[0.04] dark:text-fg-dim',
-                                    'border-emerald-500/70' => $serverRow['statusType'] === 'success',
-                                    'border-amber-500/70' => $serverRow['statusType'] === 'warning',
-                                    'border-red-500/70' => $serverRow['statusType'] === 'error',
-                                ])>
+                        <div class="relative z-10 flex items-start gap-3">
+                            <div
+                                class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.1] dark:bg-white/[0.04] dark:text-fg-dim">
                                 <x-reicon name="servers" class="size-4" />
                             </div>
                             <div class="min-w-0 flex-1">
@@ -158,6 +152,17 @@ class="group relative flex min-h-28 flex-col rounded-xl border border-neutral-20
                                     {{ $serverRow['description'] }}
                                 </p>
                             </div>
+                            @if ($serverRow['statusType'] !== 'success')
+                                <span data-tooltip="{{ $serverRow['status'] }}"
+                                    aria-label="Server status: {{ $serverRow['status'] }}"
+                                    @class([
+                                        'ml-auto flex size-6 shrink-0 items-center justify-center rounded-md',
+                                        'text-orange-500 dark:text-warning' => $serverRow['statusType'] === 'warning',
+                                        'text-red-500 dark:text-red-400' => $serverRow['statusType'] === 'error',
+                                    ])>
+                                    <x-reicon name="alert-triangle" class="size-4" />
+                                </span>
+                            @endif
                         </div>
                     </a>
                 @endforeach
@@ -174,9 +179,8 @@ class="grid min-w-[480px] grid-cols-[minmax(0,1fr)_9.5rem] border-b border-neutr
                     <a :href="server.href" {{ wireNavigate() }}
                         class="grid min-h-14 min-w-[480px] grid-cols-[minmax(0,1fr)_9.5rem] items-center border-b border-neutral-200 px-4 py-2.5 text-[12px] transition-colors last:border-b-0 hover:bg-neutral-50 hover:no-underline dark:border-white/[0.07] dark:hover:bg-white/[0.025]">
                         <div class="flex min-w-0 items-center gap-3">
-                            <div :title="server.status" :aria-label="`Server status: ${server.status}`"
-                                class="flex size-8 shrink-0 items-center justify-center rounded-lg border bg-neutral-50 text-neutral-500 dark:bg-white/[0.035] dark:text-fg-dim"
-                                :class="server.statusType === 'success' ? 'border-emerald-500/70' : server.statusType === 'warning' ? 'border-amber-500/70' : 'border-red-500/70'">
+                            <div
+                                class="flex size-8 shrink-0 items-center justify-center rounded-lg border border-neutral-200 bg-neutral-50 text-neutral-500 dark:border-white/[0.1] dark:bg-white/[0.035] dark:text-fg-dim">
                                 <x-reicon name="servers" class="size-4" />
                             </div>
                             <div class="min-w-0">
@@ -185,6 +189,12 @@ class="flex size-8 shrink-0 items-center justify-center rounded-lg border bg-neu
                                 <p class="truncate text-[11px] text-neutral-500 dark:text-fg-faint"
                                     x-text="server.description"></p>
                             </div>
+                            <span x-show="server.statusType !== 'success'" :data-tooltip="server.status"
+                                :aria-label="`Server status: ${server.status}`"
+                                class="ml-auto flex size-6 shrink-0 items-center justify-center rounded-md"
+                                :class="server.statusType === 'warning' ? 'text-orange-500 dark:text-warning' : 'text-red-500 dark:text-red-400'">
+                                <x-reicon name="alert-triangle" class="size-4" />
+                            </span>
                         </div>
                         <div class="text-[11px] font-medium text-neutral-600 dark:text-fg-dim">
                             <span x-text="server.status"></span>
diff --git a/tests/Feature/ServerStatusIndicatorDesignTest.php b/tests/Feature/ServerStatusIndicatorDesignTest.php
index 34e0f4cbd..090d6d816 100644
--- a/tests/Feature/ServerStatusIndicatorDesignTest.php
+++ b/tests/Feature/ServerStatusIndicatorDesignTest.php
@@ -1,16 +1,15 @@
 <?php
 
-test('server cards use icon borders instead of ready badges', function () {
+test('server cards use warning icons instead of colored icon borders', function () {
     $dashboard = file_get_contents(resource_path('views/livewire/dashboard.blade.php'));
     $serverIndex = file_get_contents(resource_path('views/livewire/server/index.blade.php'));
 
     expect($dashboard)
         ->not->toContain('<x-status-badge :status="$serverStatus"')
-        ->toContain("'border-emerald-500/70' => \$serverStatusType === 'success'")
-        ->toContain("'border-amber-500/70' => \$serverStatusType === 'warning'")
-        ->toContain("'border-red-500/70' => \$serverStatusType === 'error'")
-        ->toContain('title="{{ $serverStatus }}"')
-        ->toContain('aria-label="Server status: {{ $serverStatus }}"');
+        ->not->toContain("'border-amber-500/70' => \$serverStatusType === 'warning'")
+        ->toContain('@if ($serverStatusType !== \'success\')')
+        ->toContain('data-tooltip="{{ $serverStatus }}"')
+        ->toContain('<x-reicon name="alert-triangle"');
 
     expect(substr_count($serverIndex, '<x-status-badge'))->toBe(1)
         ->and($serverIndex)
@@ -20,10 +19,9 @@
         ->toContain("\$isReady => 'success'")
         ->toContain("\$isTransferredAway || \$server->settings->force_disabled => 'error'")
         ->toContain("default => 'error'")
-        ->toContain("server.statusType === 'success' ? 'border-emerald-500/70'")
-        ->toContain("server.statusType === 'warning' ? 'border-amber-500/70'")
-        ->toContain("'border-red-500/70'")
-        ->toContain(':title="server.status"')
+        ->not->toContain("server.statusType === 'warning' ? 'border-amber-500/70'")
+        ->toContain('x-show="server.statusType !== \'success\'"')
+        ->toContain(':data-tooltip="server.status"')
         ->toContain(':aria-label="`Server status: ${server.status}`"');
 });
 

From 1073bbca83a6cda81f237b26ca43ef2b02c59c1d Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 15:06:05 +0200
Subject: [PATCH 39/42] fix(sentinel): clarify restart after settings update

Add a regression test for the updated success notification.
---
 app/Livewire/Server/Sentinel.php                 | 2 +-
 tests/Feature/Livewire/SentinelComponentTest.php | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/app/Livewire/Server/Sentinel.php b/app/Livewire/Server/Sentinel.php
index cd05002aa..a69eb3f80 100644
--- a/app/Livewire/Server/Sentinel.php
+++ b/app/Livewire/Server/Sentinel.php
@@ -146,7 +146,7 @@ public function submit()
     {
         try {
             $this->syncData(true);
-            $this->dispatch('success', 'Sentinel settings updated.');
+            $this->dispatch('success', 'Sentinel settings updated. Restarting Sentinel.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
diff --git a/tests/Feature/Livewire/SentinelComponentTest.php b/tests/Feature/Livewire/SentinelComponentTest.php
index 41b3f2b49..01250910a 100644
--- a/tests/Feature/Livewire/SentinelComponentTest.php
+++ b/tests/Feature/Livewire/SentinelComponentTest.php
@@ -36,3 +36,12 @@
 
     expect($view)->not->toContain("? 'Disabled'");
 });
+
+it('tells the user that saving sentinel settings initiates a restart', function () {
+    $componentSource = file_get_contents(app_path('Livewire/Server/Sentinel.php'));
+
+    preg_match('/public function submit\([^)]*\).*?\{(?<body>.*?)\n    \}/s', $componentSource, $matches);
+
+    expect($matches['body'] ?? '')
+        ->toContain("\$this->dispatch('success', 'Sentinel settings updated. Restarting Sentinel.');");
+});

From b075693274341f78f894783e5ca18c6712eab6d1 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 15:30:59 +0200
Subject: [PATCH 40/42] fix(backups): preserve existing volume backup timeouts

Change only the default timeout for new volume backups without modifying existing schedules.
---
 ...6_08_15_000000_increase_default_volume_backup_timeout.php | 5 -----
 tests/Feature/VolumeBackupTest.php                           | 4 ++--
 2 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/database/migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php b/database/migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php
index f895c7837..32eccce96 100644
--- a/database/migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php
+++ b/database/migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php
@@ -2,17 +2,12 @@
 
 use Illuminate\Database\Migrations\Migration;
 use Illuminate\Database\Schema\Blueprint;
-use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Schema;
 
 return new class extends Migration
 {
     public function up(): void
     {
-        DB::table('scheduled_volume_backups')
-            ->where('timeout', 3600)
-            ->update(['timeout' => 36000]);
-
         Schema::table('scheduled_volume_backups', function (Blueprint $table) {
             $table->unsignedInteger('timeout')->default(36000)->change();
         });
diff --git a/tests/Feature/VolumeBackupTest.php b/tests/Feature/VolumeBackupTest.php
index e18f1475f..b4f78d9e0 100644
--- a/tests/Feature/VolumeBackupTest.php
+++ b/tests/Feature/VolumeBackupTest.php
@@ -61,7 +61,7 @@
         ->and(config('queue.connections.redis.retry_after'))->toBeGreaterThan(config('horizon.defaults.s6.timeout'));
 });
 
-it('upgrades existing default volume backup timeouts without changing custom timeouts', function () {
+it('changes the default volume backup timeout without changing existing timeouts', function () {
     $team = Team::factory()->create();
     [$application, $defaultVolume] = createVolumeBackupApplication($team);
     $customVolume = LocalPersistentVolume::create([
@@ -84,7 +84,7 @@
     $migration = require database_path('migrations/2026_08_15_000000_increase_default_volume_backup_timeout.php');
     $migration->up();
 
-    expect($defaultBackup->fresh()->timeout)->toBe(36000)
+    expect($defaultBackup->fresh()->timeout)->toBe(3600)
         ->and($customBackup->fresh()->timeout)->toBe(7200);
 });
 

From a3e968d03e38807a676fc573770f366b0e581be9 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 18 Aug 2026 15:41:31 +0200
Subject: [PATCH 41/42] fix(backups): preserve existing volume backup timeouts

Only update timeout when the API request explicitly provides one, with coverage for custom timeout values.
---
 app/Http/Controllers/Api/VolumeBackupsController.php | 10 +++++++---
 tests/Feature/Api/VolumeBackupScheduleApiTest.php    |  4 +++-
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/app/Http/Controllers/Api/VolumeBackupsController.php b/app/Http/Controllers/Api/VolumeBackupsController.php
index a5225f5dd..26ff938a1 100644
--- a/app/Http/Controllers/Api/VolumeBackupsController.php
+++ b/app/Http/Controllers/Api/VolumeBackupsController.php
@@ -261,7 +261,7 @@ private function persistSchedule(
         string $resourceType,
         Model $resource,
     ): JsonResponse {
-        $backup = $storage->scheduledBackups()->updateOrCreate([], [
+        $attributes = [
             'team_id' => $teamId,
             'frequency' => $request->string('frequency')->toString(),
             'enabled' => $request->boolean('enabled', true),
@@ -275,8 +275,12 @@ private function persistSchedule(
             'retention_amount_s3' => $request->integer('retention_amount_s3', 7),
             'retention_days_s3' => $request->integer('retention_days_s3'),
             'retention_max_storage_s3' => $request->float('retention_max_storage_s3'),
-            'timeout' => $request->integer('timeout', ScheduledVolumeBackup::DEFAULT_TIMEOUT),
-        ]);
+        ];
+        if ($request->has('timeout')) {
+            $attributes['timeout'] = $request->integer('timeout');
+        }
+
+        $backup = $storage->scheduledBackups()->updateOrCreate([], $attributes);
         $created = $backup->wasRecentlyCreated;
 
         auditLog('api.volume_backup.schedule_set', [
diff --git a/tests/Feature/Api/VolumeBackupScheduleApiTest.php b/tests/Feature/Api/VolumeBackupScheduleApiTest.php
index 4f4bc395b..e60f2919d 100644
--- a/tests/Feature/Api/VolumeBackupScheduleApiTest.php
+++ b/tests/Feature/Api/VolumeBackupScheduleApiTest.php
@@ -130,6 +130,7 @@ function createVolumeBackupApiToken($context, User $user, array $abilities): str
         'save_s3' => true,
         'disable_local_backup' => true,
         's3_storage_id' => $this->s3Storage->id,
+        'timeout' => 7200,
     ]);
 
     $response = $this->withHeaders($this->headers)
@@ -146,7 +147,8 @@ function createVolumeBackupApiToken($context, User $user, array $abilities): str
         ->and($backup->enabled)->toBeFalse()
         ->and($backup->save_s3)->toBeFalse()
         ->and($backup->disable_local_backup)->toBeFalse()
-        ->and($backup->s3_storage_id)->toBeNull();
+        ->and($backup->s3_storage_id)->toBeNull()
+        ->and($backup->timeout)->toBe(7200);
 });
 
 it('sets a directory backup schedule through the API', function () {

From 8170798115427b59c068167b5caa50b30a7cf779 Mon Sep 17 00:00:00 2001
From: Helge Sverre <helge.sverre@gmail.com>
Date: Tue, 18 Aug 2026 16:01:17 +0200
Subject: [PATCH 42/42] fix(security): enforce team-scoped authorization for
 scheduled tasks (#11239)

Co-authored-by: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
---
 .../Shared/ScheduledTask/Executions.php       |   4 +-
 .../Project/Shared/ScheduledTask/Show.php     |   7 +
 app/Policies/ScheduledTaskPolicy.php          |  70 ++++++++++
 app/Providers/AuthServiceProvider.php         |   5 +
 .../ScheduledTaskCrossTeamIdorTest.php        | 125 ++++++++++++++++++
 5 files changed, 210 insertions(+), 1 deletion(-)
 create mode 100644 app/Policies/ScheduledTaskPolicy.php
 create mode 100644 tests/Feature/ScheduledTaskCrossTeamIdorTest.php

diff --git a/app/Livewire/Project/Shared/ScheduledTask/Executions.php b/app/Livewire/Project/Shared/ScheduledTask/Executions.php
index ca2bbd9b4..e95fd2f5a 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Executions.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Executions.php
@@ -10,6 +10,7 @@
 
 class Executions extends Component
 {
+    #[Locked]
     public ScheduledTask $task;
 
     #[Locked]
@@ -28,6 +29,7 @@ class Executions extends Component
 
     public $logsPerPage = 100;
 
+    #[Locked]
     public $selectedExecution = null;
 
     public $isPollingActive = false;
@@ -45,7 +47,7 @@ public function mount($taskId)
     {
         try {
             $this->taskId = $taskId;
-            $this->task = ScheduledTask::findOrFail($taskId);
+            $this->task = ScheduledTask::where('team_id', Auth::user()->currentTeam()->id)->findOrFail($taskId);
             $this->executions = $this->task->executions()->take(20)->get();
             $this->serverTimezone = data_get($this->task, 'application.destination.server.settings.server_timezone');
             if (! $this->serverTimezone) {
diff --git a/app/Livewire/Project/Shared/ScheduledTask/Show.php b/app/Livewire/Project/Shared/ScheduledTask/Show.php
index 882737f09..11df00153 100644
--- a/app/Livewire/Project/Shared/ScheduledTask/Show.php
+++ b/app/Livewire/Project/Shared/ScheduledTask/Show.php
@@ -15,8 +15,10 @@ class Show extends Component
 {
     use AuthorizesRequests;
 
+    #[Locked]
     public Application|Service $resource;
 
+    #[Locked]
     public ScheduledTask $task;
 
     #[Locked]
@@ -115,6 +117,7 @@ public function toggleEnabled()
     {
         try {
             $this->authorize('update', $this->resource);
+            $this->authorize('update', $this->task);
             $this->isEnabled = ! $this->isEnabled;
             $this->task->enabled = $this->isEnabled;
             $this->task->save();
@@ -128,6 +131,7 @@ public function instantSave()
     {
         try {
             $this->authorize('update', $this->resource);
+            $this->authorize('update', $this->task);
             $this->syncData(true);
             $this->dispatch('success', 'Scheduled task updated.');
             $this->refreshTasks();
@@ -140,6 +144,7 @@ public function submit()
     {
         try {
             $this->authorize('update', $this->resource);
+            $this->authorize('update', $this->task);
             $this->syncData(true);
             $this->dispatch('success', 'Scheduled task updated.');
         } catch (\Exception $e) {
@@ -160,6 +165,7 @@ public function delete()
     {
         try {
             $this->authorize('update', $this->resource);
+            $this->authorize('delete', $this->task);
             $this->task->delete();
 
             if ($this->type === 'application') {
@@ -176,6 +182,7 @@ public function executeNow()
     {
         try {
             $this->authorize('update', $this->resource);
+            $this->authorize('update', $this->task);
             ScheduledTaskJob::dispatch($this->task);
             $this->dispatch('success', 'Scheduled task executed.');
         } catch (\Exception $e) {
diff --git a/app/Policies/ScheduledTaskPolicy.php b/app/Policies/ScheduledTaskPolicy.php
new file mode 100644
index 000000000..fac7e7b22
--- /dev/null
+++ b/app/Policies/ScheduledTaskPolicy.php
@@ -0,0 +1,70 @@
+<?php
+
+namespace App\Policies;
+
+use App\Models\ScheduledTask;
+use App\Models\User;
+use Illuminate\Auth\Access\Response;
+
+class ScheduledTaskPolicy
+{
+    /**
+     * Determine whether the user can view any models.
+     */
+    public function viewAny(User $user): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determine whether the user can view the model.
+     */
+    public function view(User $user, ScheduledTask $scheduledTask): bool
+    {
+        return $user->teams->contains('id', $scheduledTask->team_id);
+    }
+
+    /**
+     * Determine whether the user can create models.
+     */
+    public function create(User $user): bool
+    {
+        return $user->isAdmin();
+    }
+
+    /**
+     * Determine whether the user can update the model.
+     */
+    public function update(User $user, ScheduledTask $scheduledTask): Response
+    {
+        if (! $user->isAdminOfTeam($scheduledTask->team_id)) {
+            return Response::deny('You need at least admin or owner permissions to update this scheduled task.');
+        }
+
+        return Response::allow();
+    }
+
+    /**
+     * Determine whether the user can delete the model.
+     */
+    public function delete(User $user, ScheduledTask $scheduledTask): bool
+    {
+        return $user->isAdminOfTeam($scheduledTask->team_id);
+    }
+
+    /**
+     * Determine whether the user can restore the model.
+     */
+    public function restore(User $user, ScheduledTask $scheduledTask): bool
+    {
+        return false;
+    }
+
+    /**
+     * Determine whether the user can permanently delete the model.
+     */
+    public function forceDelete(User $user, ScheduledTask $scheduledTask): bool
+    {
+        return false;
+    }
+}
diff --git a/app/Providers/AuthServiceProvider.php b/app/Providers/AuthServiceProvider.php
index 0adf9e232..09b2a3e08 100644
--- a/app/Providers/AuthServiceProvider.php
+++ b/app/Providers/AuthServiceProvider.php
@@ -19,6 +19,7 @@
 use App\Models\Project;
 use App\Models\PushoverNotificationSettings;
 use App\Models\S3Storage;
+use App\Models\ScheduledTask;
 use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
@@ -56,6 +57,7 @@
 use App\Policies\ProjectPolicy;
 use App\Policies\ResourceCreatePolicy;
 use App\Policies\S3StoragePolicy;
+use App\Policies\ScheduledTaskPolicy;
 use App\Policies\ServerPolicy;
 use App\Policies\ServiceApplicationPolicy;
 use App\Policies\ServiceDatabasePolicy;
@@ -118,6 +120,9 @@ class AuthServiceProvider extends ServiceProvider
         // S3 storage policy
         S3Storage::class => S3StoragePolicy::class,
 
+        // Scheduled task policy
+        ScheduledTask::class => ScheduledTaskPolicy::class,
+
         // Team policy
         Team::class => TeamPolicy::class,
 
diff --git a/tests/Feature/ScheduledTaskCrossTeamIdorTest.php b/tests/Feature/ScheduledTaskCrossTeamIdorTest.php
new file mode 100644
index 000000000..b250db119
--- /dev/null
+++ b/tests/Feature/ScheduledTaskCrossTeamIdorTest.php
@@ -0,0 +1,125 @@
+<?php
+
+use App\Livewire\Project\Shared\ScheduledTask\Executions;
+use App\Livewire\Project\Shared\ScheduledTask\Show;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\ScheduledTask;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Gate;
+use Livewire\Attributes\Locked;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutVite();
+    InstanceSettings::forceCreate(['id' => 0]);
+
+    $this->attacker = User::factory()->create();
+    $this->attackerTeam = Team::factory()->create();
+    $this->attacker->teams()->attach($this->attackerTeam, ['role' => 'owner']);
+
+    $this->victim = User::factory()->create();
+    $this->victimTeam = Team::factory()->create();
+    $this->victim->teams()->attach($this->victimTeam, ['role' => 'owner']);
+
+    // Attacker team gets a real server/project/env/app so Show can mount + authorize
+    $this->server = Server::factory()->create(['team_id' => $this->attackerTeam->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+    $this->project = Project::factory()->create(['team_id' => $this->attackerTeam->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->actingAs($this->attacker);
+    session(['currentTeam' => $this->attackerTeam]);
+});
+
+describe('ScheduledTask locked properties', function () {
+    test('Show component task property has Locked attribute', function () {
+        $property = new ReflectionProperty(Show::class, 'task');
+        $attributes = $property->getAttributes(Locked::class);
+
+        expect($attributes)->not->toBeEmpty();
+    });
+
+    test('Show component resource property has Locked attribute', function () {
+        $property = new ReflectionProperty(Show::class, 'resource');
+        $attributes = $property->getAttributes(Locked::class);
+
+        expect($attributes)->not->toBeEmpty();
+    });
+
+    test('Executions component task property has Locked attribute', function () {
+        $property = new ReflectionProperty(Executions::class, 'task');
+        $attributes = $property->getAttributes(Locked::class);
+
+        expect($attributes)->not->toBeEmpty();
+    });
+
+    test('Executions component selected execution property has Locked attribute', function () {
+        $property = new ReflectionProperty(Executions::class, 'selectedExecution');
+        $attributes = $property->getAttributes(Locked::class);
+
+        expect($attributes)->not->toBeEmpty();
+    });
+});
+
+describe('ScheduledTask cross-team access', function () {
+    test('Executions rejects mounting another team task id', function () {
+        $victimTask = ScheduledTask::factory()->create([
+            'team_id' => $this->victimTeam->id,
+            'command' => 'echo top-secret-victim-command',
+        ]);
+
+        Livewire::test(Executions::class, ['taskId' => $victimTask->id])
+            ->assertStatus(404);
+    });
+
+    test('Show policy denies updating another team task', function () {
+        $victimTask = ScheduledTask::factory()->create([
+            'team_id' => $this->victimTeam->id,
+            'name' => 'victim-task',
+            'command' => 'echo original-victim-command',
+        ]);
+
+        expect(
+            Gate::forUser($this->attacker)->allows('update', $victimTask)
+        )->toBeFalse();
+    });
+
+    test('Show policy denies deleting another team task', function () {
+        $victimTask = ScheduledTask::factory()->create([
+            'team_id' => $this->victimTeam->id,
+            'name' => 'victim-task',
+            'command' => 'echo original-victim-command',
+        ]);
+
+        expect(
+            Gate::forUser($this->attacker)->allows('delete', $victimTask)
+        )->toBeFalse();
+    });
+
+    test('Show policy allows updating own team task', function () {
+        $ownTask = ScheduledTask::factory()->create([
+            'team_id' => $this->attackerTeam->id,
+            'application_id' => $this->application->id,
+            'name' => 'own-task',
+            'command' => 'echo original-command',
+        ]);
+
+        expect(
+            Gate::forUser($this->attacker)->allows('update', $ownTask)
+        )->toBeTrue();
+    });
+});