Merge remote-tracking branch 'origin/next' into fix-ghe-app-install-url

.env.production

@@ -15,4 +15,4 @@ ROOT_USERNAME=
 ROOT_USER_EMAIL=
 ROOT_USER_PASSWORD=
 
-REGISTRY_URL=ghcr.io
+REGISTRY_URL=docker.io

.github/ISSUE_TEMPLATE/01_BUG_REPORT.yml

@@ -1,7 +1,7 @@
 name: 🐞 Bug Report
 description: "File a new bug report."
 title: "[Bug]: "
-labels: ["🐛 Bug", "🔍 Triage"]
+labels: ["🔍 Triage"]
 body:
   - type: markdown
     attributes:
@@ -11,10 +11,22 @@ body:
 
   - type: textarea
     attributes:
-      label: Error Message and Logs
+      label: Description and Error Message
       description: Provide a detailed description of the error or exception you encountered, along with any relevant log output.
     validations:
       required: true
+      
+  - type: textarea
+    attributes:
+      label: Expected Behavior
+      description: Please describe what you expected to happen instead of the issue. Be as detailed as possible.
+      value: |
+        1.
+        2.
+        3.
+        4.
+    validations:
+      required: true
 
   - type: textarea
     attributes:
@@ -37,7 +49,7 @@ body:
     attributes:
       label: Coolify Version
       description: Please provide the Coolify version you are using. This can be found in the top left corner of your Coolify dashboard.
-      placeholder: "v4.0.0-beta.335"
+      placeholder: "v4.1.2"
     validations:
       required: true
 
@@ -55,6 +67,12 @@ body:
       label: Operating System and Version (self-hosted)
       description: Run `cat /etc/os-release` or `lsb_release -a` in your terminal and provide the operating system and version.
       placeholder: "Ubuntu 22.04"
+      
+  - type: textarea
+    attributes:
+      label: Screenshots / Visuals
+      description: If possible, provide screenshots, screen recordings, or diagrams to help illustrate the issue.
+      placeholder: "Attach images or provide links to recordings demonstrating the problem."
 
   - type: textarea
     attributes:

.github/workflows/chore-pr-comments.yml

@@ -40,7 +40,10 @@ jobs:
           #    This will help ensure that our documentation remains accurate and up-to-date for all users.
     steps:
       - name: Add comment
-        if: github.event.label.name == matrix.label
+        if: >-
+          (github.event.label.name == matrix.label || github.event.label.name == '📑 Waiting for Docs PR')
+          && contains(github.event.pull_request.labels.*.name, matrix.label)
+          && contains(github.event.pull_request.labels.*.name, '📑 Waiting for Docs PR')
         run: gh pr comment "$NUMBER" --body "$BODY"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

AGENTS.md

@@ -1,7 +1,147 @@
+# AGENTS.md
+
+This file provides guidance to agentic coding tools when working with code in this repository.
+
+## Project Overview
+
+Coolify is an open-source, self-hostable PaaS (alternative to Heroku/Netlify/Vercel). It manages servers, applications, databases, and services via SSH. Built with Laravel 12 (using Laravel 10 file structure), Livewire 3, and Tailwind CSS v4.
+
 ## Design Reference
 
 For UI/UX design specifications, principles, and visual standards, consult `DESIGN.md` in the [coollabsio/architecture](https://github.com/coollabsio/architecture) repo.
 
+## Development Environment
+
+Docker Compose-based dev setup with services: coolify (app), postgres, redis, soketi (WebSockets), vite, testing-host, mailpit, minio.
+
+```bash
+# Start dev environment (uses docker-compose.dev.yml)
+spin up                          # or: docker compose -f docker-compose.dev.yml up -d
+spin down                        # stop services
+```
+
+The app runs at `localhost:8000` by default. Vite dev server on port 5173.
+
+## Common Commands
+
+```bash
+# Tests (Pest 4)
+php artisan test --compact                          # all tests
+php artisan test --compact --filter=testName         # single test
+php artisan test --compact tests/Feature/SomeTest.php  # specific file
+
+# Code formatting (Pint, Laravel preset)
+vendor/bin/pint --dirty --format agent              # format changed files
+
+# Frontend
+npm run dev                     # vite dev server
+npm run build                   # production build
+```
+
+## Browser Tests (Pest Browser Plugin)
+
+Uses `pestphp/pest-plugin-browser` with Laravel Dusk 8. New browser tests go in `tests/v4/Browser/`.
+
+```bash
+# Run all browser tests
+php artisan test --compact tests/v4/Browser/
+
+# Run a specific browser test file
+php artisan test --compact tests/v4/Browser/LoginTest.php
+
+# Run a specific test by name
+php artisan test --compact --filter='can login with valid credentials'
+```
+
+### Writing Browser Tests
+
+- Place new tests in `tests/v4/Browser/` — legacy Dusk tests in `tests/Browser/` should not be used as reference.
+- Use `RefreshDatabase` and seed required data (at minimum `InstanceSettings::create(['id' => 0])`) in `beforeEach`.
+- Key API: `visit()`, `fill(field, value)`, `click(text)`, `assertSee()`, `assertDontSee()`, `assertPathIs()`, `screenshot()`.
+- Always call `screenshot()` at the end of each test for debugging.
+- For authenticated tests, create a helper function that logs in via the UI:
+
+```php
+function loginAsRoot(): mixed
+{
+    return visit('/login')
+        ->fill('email', 'test@example.com')
+        ->fill('password', 'password')
+        ->click('Login');
+}
+```
+
+- See `tests/v4/Browser/LoginTest.php`, `tests/v4/Browser/DashboardTest.php`, and `tests/v4/Browser/RegistrationTest.php` for conventions.
+- Chrome driver runs on `localhost:4444`, app on `localhost:8000` (configured in `tests/DuskTestCase.php`).
+- Legacy Dusk macros in `app/Providers/DuskServiceProvider.php` use the old `type()`/`press()` API — do not mix with Pest Browser Plugin's `fill()`/`click()` API.
+
+## Architecture
+
+### Backend Structure (app/)
+- **Actions/** — Domain actions organized by area (Application, Database, Docker, Proxy, Server, Service, Shared, Stripe, User, CoolifyTask, Fortify). Uses `lorisleiva/laravel-actions` with `AsAction` trait — actions can be called as objects, dispatched as jobs, or used as controllers.
+- **Livewire/** — All UI components (Livewire 3). Pages organized by domain: Server, Project, Settings, Security, Notifications, Terminal, Subscription, SharedVariables. This is the primary UI layer — no traditional Blade controllers. Components listen to private team channels for real-time status updates via Soketi.
+- **Jobs/** — Queue jobs for deployments (`ApplicationDeploymentJob`), backups, Docker cleanup, server management, proxy configuration. Uses Redis queue with Horizon for monitoring.
+- **Models/** — Eloquent models extending `BaseModel` which provides auto-CUID2 UUID generation. Key models: `Server`, `Application`, `Service`, `Project`, `Environment`, `Team`, plus standalone database models (`StandalonePostgresql`, `StandaloneMysql`, etc.). Common traits: `HasConfiguration`, `HasMetrics`, `HasSafeStringAttribute`, `ClearsGlobalSearchCache`.
+- **Services/** — Business logic services (ConfigurationGenerator, DockerImageParser, ContainerStatusAggregator, HetznerService, etc.). Use Services for complex orchestration; use Actions for single-purpose domain operations.
+- **Helpers/** — Global helpers loaded via `bootstrap/includeHelpers.php` from `bootstrap/helpers/` — organized into `shared.php`, `constants.php`, `versions.php`, `subscriptions.php`, `domains.php`, `docker.php`, `services.php`, `github.php`, `proxy.php`, `notifications.php`.
+- **Data/** — Spatie Laravel Data DTOs (e.g., `ServerMetadata`).
+- **Enums/** — PHP enums (TitleCase keys). Key enums: `ProcessStatus`, `Role` (MEMBER/ADMIN/OWNER with rank comparison), `BuildPackTypes`, `ProxyTypes`, `ContainerStatusTypes`.
+- **Rules/** — Custom validation rules (`ValidGitRepositoryUrl`, `ValidServerIp`, `ValidHostname`, `DockerImageFormat`, etc.).
+
+### API Layer
+- REST API at `/api/v1/` with OpenAPI 3.0 attributes (`use OpenApi\Attributes as OA`) for auto-generated docs
+- Authentication via Laravel Sanctum with custom `ApiAbility` middleware for token abilities (read, write, deploy)
+- `ApiSensitiveData` middleware masks sensitive fields (IDs, credentials) in responses
+- API controllers in `app/Http/Controllers/Api/` use inline `Validator` (not Form Request classes)
+- Response serialization via `serializeApiResponse()` helper
+
+### Authorization
+- Policy-based authorization with ~15 model-to-policy mappings in `AuthServiceProvider`
+- Custom gates: `createAnyResource`, `canAccessTerminal`
+- Role hierarchy: `Role::MEMBER` (1) < `Role::ADMIN` (2) < `Role::OWNER` (3) with `lt()`/`gt()` comparison methods
+- Multi-tenancy via Teams — team auto-initializes notification settings on creation
+
+### Event Broadcasting
+- Soketi WebSocket server for real-time updates (ports 6001-6002 in dev)
+- Status change events: `ApplicationStatusChanged`, `ServiceStatusChanged`, `DatabaseStatusChanged`, `ProxyStatusChanged`
+- Livewire components subscribe to private team channels via `getListeners()`
+
+### Key Domain Concepts
+- **Server** — A managed host connected via SSH. Has settings, proxy config, and destinations.
+- **Application** — A deployed app (from Git or Docker image) with environment variables, previews, deployment queue.
+- **Service** — A pre-configured service stack from templates (`templates/service-templates-latest.json`).
+- **Standalone Databases** — Individual database instances (Postgres, MySQL, MariaDB, MongoDB, Redis, Clickhouse, KeyDB, Dragonfly).
+- **Project/Environment** — Organizational hierarchy: Team → Project → Environment → Resources.
+- **Proxy** — Traefik reverse proxy managed per server.
+
+### Frontend
+- Livewire 3 components with Alpine.js for client-side interactivity
+- Blade templates in `resources/views/livewire/`
+- Tailwind CSS v4 with `@tailwindcss/forms` and `@tailwindcss/typography`
+- Vite for asset bundling
+
+### Laravel 10 Structure (NOT Laravel 11+ slim structure)
+- Middleware in `app/Http/Middleware/` — custom middleware includes `CheckForcePasswordReset`, `DecideWhatToDoWithUser`, `ApiAbility`, `ApiSensitiveData`
+- Kernels: `app/Http/Kernel.php`, `app/Console/Kernel.php`
+- Exception handler: `app/Exceptions/Handler.php`
+- Service providers in `app/Providers/`
+
+## Key Conventions
+
+- Use `php artisan make:*` commands with `--no-interaction` to create files
+- Use Eloquent relationships, avoid `DB::` facade — prefer `Model::query()`
+- PHP 8.5: constructor property promotion, explicit return types, type hints
+- Validation uses inline `Validator` facade in controllers/Livewire components and custom rules in `app/Rules/` — not Form Request classes
+- Run `vendor/bin/pint --dirty --format agent` before finalizing changes
+- Every change must have tests — write or update tests, then run them. For bug fixes, follow TDD: write a failing test first, then fix the bug (see Test Enforcement below)
+- Check sibling files for conventions before creating new files
+
+## Git Workflow
+
+- Main branch: `v4.x`
+- Development branch: `next`
+- PRs should target `v4.x`
+
 <laravel-boost-guidelines>
 === foundation rules ===
 

CLAUDE.md

@@ -1,312 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-Coolify is an open-source, self-hostable PaaS (alternative to Heroku/Netlify/Vercel). It manages servers, applications, databases, and services via SSH. Built with Laravel 12 (using Laravel 10 file structure), Livewire 3, and Tailwind CSS v4.
-
-## Design Reference
-
-For UI/UX design specifications, principles, and visual standards, consult `DESIGN.md` in the [coollabsio/architecture](https://github.com/coollabsio/architecture) repo.
-
-## Development Environment
-
-Docker Compose-based dev setup with services: coolify (app), postgres, redis, soketi (WebSockets), vite, testing-host, mailpit, minio.
-
-```bash
-# Start dev environment (uses docker-compose.dev.yml)
-spin up                          # or: docker compose -f docker-compose.dev.yml up -d
-spin down                        # stop services
-```
-
-The app runs at `localhost:8000` by default. Vite dev server on port 5173.
-
-## Common Commands
-
-```bash
-# Tests (Pest 4)
-php artisan test --compact                          # all tests
-php artisan test --compact --filter=testName         # single test
-php artisan test --compact tests/Feature/SomeTest.php  # specific file
-
-# Code formatting (Pint, Laravel preset)
-vendor/bin/pint --dirty --format agent              # format changed files
-
-# Frontend
-npm run dev                     # vite dev server
-npm run build                   # production build
-```
-
-## Architecture
-
-### Backend Structure (app/)
-- **Actions/** — Domain actions organized by area (Application, Database, Docker, Proxy, Server, Service, Shared, Stripe, User, CoolifyTask, Fortify). Uses `lorisleiva/laravel-actions` with `AsAction` trait — actions can be called as objects, dispatched as jobs, or used as controllers.
-- **Livewire/** — All UI components (Livewire 3). Pages organized by domain: Server, Project, Settings, Security, Notifications, Terminal, Subscription, SharedVariables. This is the primary UI layer — no traditional Blade controllers. Components listen to private team channels for real-time status updates via Soketi.
-- **Jobs/** — Queue jobs for deployments (`ApplicationDeploymentJob`), backups, Docker cleanup, server management, proxy configuration. Uses Redis queue with Horizon for monitoring.
-- **Models/** — Eloquent models extending `BaseModel` which provides auto-CUID2 UUID generation. Key models: `Server`, `Application`, `Service`, `Project`, `Environment`, `Team`, plus standalone database models (`StandalonePostgresql`, `StandaloneMysql`, etc.). Common traits: `HasConfiguration`, `HasMetrics`, `HasSafeStringAttribute`, `ClearsGlobalSearchCache`.
-- **Services/** — Business logic services (ConfigurationGenerator, DockerImageParser, ContainerStatusAggregator, HetznerService, etc.). Use Services for complex orchestration; use Actions for single-purpose domain operations.
-- **Helpers/** — Global helpers loaded via `bootstrap/includeHelpers.php` from `bootstrap/helpers/` — organized into `shared.php`, `constants.php`, `versions.php`, `subscriptions.php`, `domains.php`, `docker.php`, `services.php`, `github.php`, `proxy.php`, `notifications.php`.
-- **Data/** — Spatie Laravel Data DTOs (e.g., `ServerMetadata`).
-- **Enums/** — PHP enums (TitleCase keys). Key enums: `ProcessStatus`, `Role` (MEMBER/ADMIN/OWNER with rank comparison), `BuildPackTypes`, `ProxyTypes`, `ContainerStatusTypes`.
-- **Rules/** — Custom validation rules (`ValidGitRepositoryUrl`, `ValidServerIp`, `ValidHostname`, `DockerImageFormat`, etc.).
-
-### API Layer
-- REST API at `/api/v1/` with OpenAPI 3.0 attributes (`use OpenApi\Attributes as OA`) for auto-generated docs
-- Authentication via Laravel Sanctum with custom `ApiAbility` middleware for token abilities (read, write, deploy)
-- `ApiSensitiveData` middleware masks sensitive fields (IDs, credentials) in responses
-- API controllers in `app/Http/Controllers/Api/` use inline `Validator` (not Form Request classes)
-- Response serialization via `serializeApiResponse()` helper
-
-### Authorization
-- Policy-based authorization with ~15 model-to-policy mappings in `AuthServiceProvider`
-- Custom gates: `createAnyResource`, `canAccessTerminal`
-- Role hierarchy: `Role::MEMBER` (1) < `Role::ADMIN` (2) < `Role::OWNER` (3) with `lt()`/`gt()` comparison methods
-- Multi-tenancy via Teams — team auto-initializes notification settings on creation
-
-### Event Broadcasting
-- Soketi WebSocket server for real-time updates (ports 6001-6002 in dev)
-- Status change events: `ApplicationStatusChanged`, `ServiceStatusChanged`, `DatabaseStatusChanged`, `ProxyStatusChanged`
-- Livewire components subscribe to private team channels via `getListeners()`
-
-### Key Domain Concepts
-- **Server** — A managed host connected via SSH. Has settings, proxy config, and destinations.
-- **Application** — A deployed app (from Git or Docker image) with environment variables, previews, deployment queue.
-- **Service** — A pre-configured service stack from templates (`templates/service-templates-latest.json`).
-- **Standalone Databases** — Individual database instances (Postgres, MySQL, MariaDB, MongoDB, Redis, Clickhouse, KeyDB, Dragonfly).
-- **Project/Environment** — Organizational hierarchy: Team → Project → Environment → Resources.
-- **Proxy** — Traefik reverse proxy managed per server.
-
-### Frontend
-- Livewire 3 components with Alpine.js for client-side interactivity
-- Blade templates in `resources/views/livewire/`
-- Tailwind CSS v4 with `@tailwindcss/forms` and `@tailwindcss/typography`
-- Vite for asset bundling
-
-### Laravel 10 Structure (NOT Laravel 11+ slim structure)
-- Middleware in `app/Http/Middleware/` — custom middleware includes `CheckForcePasswordReset`, `DecideWhatToDoWithUser`, `ApiAbility`, `ApiSensitiveData`
-- Kernels: `app/Http/Kernel.php`, `app/Console/Kernel.php`
-- Exception handler: `app/Exceptions/Handler.php`
-- Service providers in `app/Providers/`
-
-## Key Conventions
-
-- Use `php artisan make:*` commands with `--no-interaction` to create files
-- Use Eloquent relationships, avoid `DB::` facade — prefer `Model::query()`
-- PHP 8.4: constructor property promotion, explicit return types, type hints
-- Validation uses inline `Validator` facade in controllers/Livewire components and custom rules in `app/Rules/` — not Form Request classes
-- Run `vendor/bin/pint --dirty --format agent` before finalizing changes
-- Every change must have tests — write or update tests, then run them. For bug fixes, follow TDD: write a failing test first, then fix the bug (see Test Enforcement below)
-- Check sibling files for conventions before creating new files
-
-## Git Workflow
-
-- Main branch: `v4.x`
-- Development branch: `next`
-- PRs should target `v4.x`
-
-<laravel-boost-guidelines>
-=== foundation rules ===
-
-# Laravel Boost Guidelines
-
-The Laravel Boost guidelines are specifically curated by Laravel maintainers for this application. These guidelines should be followed closely to ensure the best experience when building Laravel applications.
-
-## Foundational Context
-
-This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.
-
-- php - 8.5
-- laravel/fortify (FORTIFY) - v1
-- laravel/framework (LARAVEL) - v12
-- laravel/horizon (HORIZON) - v5
-- laravel/mcp (MCP) - v0
-- laravel/nightwatch (NIGHTWATCH) - v1
-- laravel/pail (PAIL) - v1
-- laravel/prompts (PROMPTS) - v0
-- laravel/sanctum (SANCTUM) - v4
-- laravel/socialite (SOCIALITE) - v5
-- livewire/livewire (LIVEWIRE) - v3
-- laravel/boost (BOOST) - v2
-- laravel/dusk (DUSK) - v8
-- laravel/pint (PINT) - v1
-- laravel/telescope (TELESCOPE) - v5
-- pestphp/pest (PEST) - v4
-- phpunit/phpunit (PHPUNIT) - v12
-- rector/rector (RECTOR) - v2
-- tailwindcss (TAILWINDCSS) - v4
-
-## Skills Activation
-
-This project has domain-specific skills available in `**/skills/**`. You MUST activate the relevant skill whenever you work in that domain—don't wait until you're stuck.
-
-## Conventions
-
-- You must follow all existing code conventions used in this application. When creating or editing a file, check sibling files for the correct structure, approach, and naming.
-- Use descriptive names for variables and methods. For example, `isRegisteredForDiscounts`, not `discount()`.
-- Check for existing components to reuse before writing a new one.
-
-## Verification Scripts
-
-- Do not create verification scripts or tinker when tests cover that functionality and prove they work. Unit and feature tests are more important.
-
-## Application Structure & Architecture
-
-- Stick to existing directory structure; don't create new base folders without approval.
-- Do not change the application's dependencies without approval.
-
-## Frontend Bundling
-
-- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `npm run build`, `npm run dev`, or `composer run dev`. Ask them.
-
-## Documentation Files
-
-- You must only create documentation files if explicitly requested by the user.
-
-## Replies
-
-- Be concise in your explanations - focus on what's important rather than explaining obvious details.
-
-=== boost rules ===
-
-# Laravel Boost
-
-## Tools
-
-- Laravel Boost is an MCP server with tools designed specifically for this application. Prefer Boost tools over manual alternatives like shell commands or file reads.
-- Use `database-query` to run read-only queries against the database instead of writing raw SQL in tinker.
-- Use `database-schema` to inspect table structure before writing migrations or models.
-- Use `get-absolute-url` to resolve the correct scheme, domain, and port for project URLs. Always use this before sharing a URL with the user.
-- Use `browser-logs` to read browser logs, errors, and exceptions. Only recent logs are useful, ignore old entries.
-
-## Searching Documentation (IMPORTANT)
-
-- Always use `search-docs` before making code changes. Do not skip this step. It returns version-specific docs based on installed packages automatically.
-- Pass a `packages` array to scope results when you know which packages are relevant.
-- Use multiple broad, topic-based queries: `['rate limiting', 'routing rate limiting', 'routing']`. Expect the most relevant results first.
-- Do not add package names to queries because package info is already shared. Use `test resource table`, not `filament 4 test resource table`.
-
-### Search Syntax
-
-1. Use words for auto-stemmed AND logic: `rate limit` matches both "rate" AND "limit".
-2. Use `"quoted phrases"` for exact position matching: `"infinite scroll"` requires adjacent words in order.
-3. Combine words and phrases for mixed queries: `middleware "rate limit"`.
-4. Use multiple queries for OR logic: `queries=["authentication", "middleware"]`.
-
-## Artisan
-
-- Run Artisan commands directly via the command line (e.g., `php artisan route:list`). Use `php artisan list` to discover available commands and `php artisan [command] --help` to check parameters.
-- Inspect routes with `php artisan route:list`. Filter with: `--method=GET`, `--name=users`, `--path=api`, `--except-vendor`, `--only-vendor`.
-- Read configuration values using dot notation: `php artisan config:show app.name`, `php artisan config:show database.default`. Or read config files directly from the `config/` directory.
-
-## Tinker
-
-- Execute PHP in app context for debugging and testing code. Do not create models without user approval, prefer tests with factories instead. Prefer existing Artisan commands over custom tinker code.
-- Always use single quotes to prevent shell expansion: `php artisan tinker --execute 'Your::code();'`
-  - Double quotes for PHP strings inside: `php artisan tinker --execute 'User::where("active", true)->count();'`
-
-=== php rules ===
-
-# PHP
-
-- Always use curly braces for control structures, even for single-line bodies.
-- Use PHP 8 constructor property promotion: `public function __construct(public GitHub $github) { }`. Do not leave empty zero-parameter `__construct()` methods unless the constructor is private.
-- Use explicit return type declarations and type hints for all method parameters: `function isAccessible(User $user, ?string $path = null): bool`
-- Follow existing application Enum naming conventions.
-- Prefer PHPDoc blocks over inline comments. Only add inline comments for exceptionally complex logic.
-- Use array shape type definitions in PHPDoc blocks.
-
-=== deployments rules ===
-
-# Deployment
-
-- Laravel can be deployed using [Laravel Cloud](https://cloud.laravel.com/), which is the fastest way to deploy and scale production Laravel applications.
-
-=== tests rules ===
-
-# Test Enforcement
-
-- Every change must be programmatically tested. Write a new test or update an existing test, then run the affected tests to make sure they pass.
-- Run the minimum number of tests needed to ensure code quality and speed. Use `php artisan test --compact` with a specific filename or filter.
-
-=== laravel/core rules ===
-
-# Do Things the Laravel Way
-
-- Use `php artisan make:` commands to create new files (i.e. migrations, controllers, models, etc.). You can list available Artisan commands using `php artisan list` and check their parameters with `php artisan [command] --help`.
-- If you're creating a generic PHP class, use `php artisan make:class`.
-- Pass `--no-interaction` to all Artisan commands to ensure they work without user input. You should also pass the correct `--options` to ensure correct behavior.
-
-### Model Creation
-
-- When creating new models, create useful factories and seeders for them too. Ask the user if they need any other things, using `php artisan make:model --help` to check the available options.
-
-## APIs & Eloquent Resources
-
-- For APIs, default to using Eloquent API Resources and API versioning unless existing API routes do not, then you should follow existing application convention.
-
-## URL Generation
-
-- When generating links to other pages, prefer named routes and the `route()` function.
-
-## Testing
-
-- When creating models for tests, use the factories for the models. Check if the factory has custom states that can be used before manually setting up the model.
-- Faker: Use methods such as `$this->faker->word()` or `fake()->randomDigit()`. Follow existing conventions whether to use `$this->faker` or `fake()`.
-- When creating tests, make use of `php artisan make:test [options] {name}` to create a feature test, and pass `--unit` to create a unit test. Most tests should be feature tests.
-
-## Vite Error
-
-- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`.
-
-=== laravel/v12 rules ===
-
-# Laravel 12
-
-- CRITICAL: ALWAYS use `search-docs` tool for version-specific Laravel documentation and updated code examples.
-- This project upgraded from Laravel 10 without migrating to the new streamlined Laravel file structure.
-- This is perfectly fine and recommended by Laravel. Follow the existing structure from Laravel 10. We do not need to migrate to the new Laravel structure unless the user explicitly requests it.
-
-## Laravel 10 Structure
-
-- Middleware typically lives in `app/Http/Middleware/` and service providers in `app/Providers/`.
-- There is no `bootstrap/app.php` application configuration in a Laravel 10 structure:
-    - Middleware registration happens in `app/Http/Kernel.php`
-    - Exception handling is in `app/Exceptions/Handler.php`
-    - Console commands and schedule register in `app/Console/Kernel.php`
-    - Rate limits likely exist in `RouteServiceProvider` or `app/Http/Kernel.php`
-
-## Database
-
-- When modifying a column, the migration must include all of the attributes that were previously defined on the column. Otherwise, they will be dropped and lost.
-- Laravel 12 allows limiting eagerly loaded records natively, without external packages: `$query->latest()->limit(10);`.
-
-### Models
-
-- Casts can and likely should be set in a `casts()` method on a model rather than the `$casts` property. Follow existing conventions from other models.
-
-=== livewire/core rules ===
-
-# Livewire
-
-- Livewire allow to build dynamic, reactive interfaces in PHP without writing JavaScript.
-- You can use Alpine.js for client-side interactions instead of JavaScript frameworks.
-- Keep state server-side so the UI reflects it. Validate and authorize in actions as you would in HTTP requests.
-
-=== pint/core rules ===
-
-# Laravel Pint Code Formatter
-
-- If you have modified any PHP files, you must run `vendor/bin/pint --dirty --format agent` before finalizing changes to ensure your code matches the project's expected style.
-- Do not run `vendor/bin/pint --test --format agent`, simply run `vendor/bin/pint --format agent` to fix any formatting issues.
-
-=== pest/core rules ===
-
-## Pest
-
-- This project uses Pest for testing. Create tests: `php artisan make:test --pest {name}`.
-- The `{name}` argument should not include the test suite directory. Use `php artisan make:test --pest SomeFeatureTest` instead of `php artisan make:test --pest Feature/SomeFeatureTest`.
-- Run tests: `php artisan test --compact` or filter: `php artisan test --compact --filter=testName`.
-- Do NOT delete tests without approval.
-
-</laravel-boost-guidelines>

CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

CONTRIBUTING.md

@@ -1,289 +1,231 @@
 # Contributing to Coolify
+We’re happy that you’re interested in contributing to Coolify!
 
-> "First, thanks for considering contributing to my project. It really means a lot!" - [@andrasbacsai](https://github.com/andrasbacsai)
+There are many ways to help:
+- Answer questions in GitHub Discussions or Discord
+- Report reproducible bugs
+- Submit pull requests to fix issues
+- Add new one-click services
+- Improve documentation
 
-You can ask for guidance anytime on our [Discord server](https://coollabs.io/discord) in the `#contribute` channel.
+Coolify is a PaaS used by 400,000+ people worldwide and maintained by two active maintainers. Contributions are welcome — but **alignment matters more than quantity**.
 
-To understand the tech stack, please refer to the [Tech Stack](TECH_STACK.md) document.
+This guide explains **what kind of contributions are likely to be accepted** and how to submit them properly. Following it saves time for both you and the maintainers.
-
-## Table of Contents
-
-1. [Setup Development Environment](#1-setup-development-environment)
-2. [Verify Installation](#2-verify-installation-optional)
-3. [Fork and Setup Local Repository](#3-fork-and-setup-local-repository)
-4. [Set up Environment Variables](#4-set-up-environment-variables)
-5. [Start Coolify](#5-start-coolify)
-6. [Start Development](#6-start-development)
-7. [Create a Pull Request](#7-create-a-pull-request)
-8. [Development Notes](#development-notes)
-9. [Resetting Development Environment](#resetting-development-environment)
-10. [Additional Contribution Guidelines](#additional-contribution-guidelines)
-
-## 1. Setup Development Environment
-
-Follow the steps below for your operating system:
-
-<details>
-<summary><strong>Windows</strong></summary>
-
-1. Install `docker-ce`, Docker Desktop (or similar):
-   - Docker CE (recommended):
-     - Install Windows Subsystem for Linux v2 (WSL2) by following this guide: [Install WSL](https://learn.microsoft.com/en-us/windows/wsl/install?ref=coolify)
-     - After installing WSL2, install Docker CE for your Linux distribution by following this guide: [Install Docker Engine](https://docs.docker.com/engine/install/?ref=coolify)
-     - Make sure to choose the appropriate Linux distribution (e.g., Ubuntu) when following the Docker installation guide
-   - Install Docker Desktop (easier):
-     - Download and install [Docker Desktop for Windows](https://docs.docker.com/desktop/install/windows-install/?ref=coolify)
-     - Ensure WSL2 backend is enabled in Docker Desktop settings
-
-2. Install Spin:
-   - Follow the instructions to install Spin on Windows from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-windows#download-and-install-spin-into-wsl2?ref=coolify)
-
-</details>
-
-<details>
-<summary><strong>MacOS</strong></summary>
-
-1. Install Orbstack, Docker Desktop (or similar):
-   - Orbstack (recommended, as it is a faster and lighter alternative to Docker Desktop):
-     - Download and install [Orbstack](https://docs.orbstack.dev/quick-start#installation?ref=coolify)
-   - Docker Desktop:
-     - Download and install [Docker Desktop for Mac](https://docs.docker.com/desktop/install/mac-install/?ref=coolify)
-
-2. Install Spin:
-   - Follow the instructions to install Spin on MacOS from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-macos/#download-and-install-spin?ref=coolify)
-
-</details>
-
-<details>
-<summary><strong>Linux</strong></summary>
-
-1. Install Docker Engine, Docker Desktop (or similar):
-   - Docker Engine (recommended, as there is no VM overhead):
-     - Follow the official [Docker Engine installation guide](https://docs.docker.com/engine/install/?ref=coolify) for your Linux distribution
-   - Docker Desktop:
-     - If you want a GUI, you can use [Docker Desktop for Linux](https://docs.docker.com/desktop/install/linux-install/?ref=coolify)
-
-2. Install Spin:
-   - Follow the instructions to install Spin on Linux from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-linux#configure-docker-permissions?ref=coolify)
-
-</details>
-
-## 2. Verify Installation (Optional)
-
-After installing Docker (or Orbstack) and Spin, verify the installation:
-
-1. Open a terminal or command prompt
-2. Run the following commands:
-   ```bash
-   docker --version
-   spin --version
-   ```
-   You should see version information for both Docker and Spin.
-
-## 3. Fork and Setup Local Repository
-
-1. Fork the [Coolify](https://github.com/coollabsio/coolify) repository to your GitHub account.
-
-2. Install a code editor on your machine (choose one):
-
-   | Editor | Platform | Download Link |
-   |--------|----------|---------------|
-   | Visual Studio Code (recommended free) | Windows/macOS/Linux | [Download](https://code.visualstudio.com/download?ref=coolify) |
-   | Cursor (recommended but paid) | Windows/macOS/Linux | [Download](https://www.cursor.com/?ref=coolify) |
-   | Zed (very fast) | macOS/Linux | [Download](https://zed.dev/download?ref=coolify) |
-
-3. Clone the Coolify Repository from your fork to your local machine
-   - Use `git clone` in the command line, or
-   - Use GitHub Desktop (recommended):
-     - Download and install from [https://desktop.github.com/](https://desktop.github.com/?ref=coolify)
-     - Open GitHub Desktop and login with your GitHub account
-     - Click on `File` -> `Clone Repository` select `github.com` as the repository location, then select your forked Coolify repository, choose the local path and then click `Clone`
-
-4. Open the cloned Coolify Repository in your chosen code editor.
-
-## 4. Set up Environment Variables
-
-1. In the Code Editor, locate the `.env.development.example` file in the root directory of your local Coolify repository.
-2. Duplicate the `.env.development.example` file and rename the copy to `.env`.
-3. Open the new `.env` file and review its contents. Adjust any environment variables as needed for your development setup.
-4. If you encounter errors during database migrations, update the database connection settings in your `.env` file. Use the IP address or hostname of your PostgreSQL database container. You can find this information by running `docker ps` after executing `spin up`.
-5. Save the changes to your `.env` file.
-
-## 5. Start Coolify
-
-1. Open a terminal in the local Coolify directory.
-2. Run the following command in the terminal (leave that terminal open):
-   ```bash
-   spin up
-   ```
-
-> [!NOTE]
-> You may see some errors, but don't worry; this is expected.
-
-3. If you encounter permission errors, especially on macOS, use:
-   ```bash
-   sudo spin up
-   ```
-
-> [!NOTE]
-> If you change environment variables afterwards or anything seems broken, press Ctrl + C to stop the process and run `spin up` again.
-
-## 6. Start Development
-
-1. Access your Coolify instance:
-   - URL: `http://localhost:8000`
-   - Login: `test@example.com`
-   - Password: `password`
-
-2. Additional development tools:
-
-   | Tool | URL | Note |
-   |------|-----|------|
-   | Laravel Horizon (scheduler) | `http://localhost:8000/horizon` | Only accessible when logged in as root user |
-   | Mailpit (email catcher) | `http://localhost:8025` | |
-   | Telescope (debugging tool) | `http://localhost:8000/telescope` | Disabled by default |
-
-> [!NOTE]
-> To enable Telescope, add the following to your `.env` file:
-> ```env
-> TELESCOPE_ENABLED=true
-> ```
-
-## 7. Create a Pull Request
 
 > [!IMPORTANT]
-> Please read the [Pull Request Guidelines](#pull-request-guidelines) carefully before creating your PR.
+> These guidelines may feel stricter than in many open-source projects. That is intentional.
+> Clear structure and boundaries prevent maintainer burnout and keep the project sustainable long-term.
 
-1. After making changes or adding a new service:
-    - Commit your changes to your forked repository.
-    - Push the changes to your GitHub account.
 
-2. Creating the Pull Request (PR):
+## High-Level Expectations
-    - Navigate to the main Coolify repository on GitHub.
+- Coolify has a clear product direction.
-    - Click the "Pull requests" tab.
+- Ownership and decisions are centralized.
-    - Click the green "New pull request" button.
+- Review capacity is limited.
-    - Choose your fork and `next` branch as the compare branch.
+- Not every contribution will be accepted — even if technically correct.
-    - Click "Create pull request".
 
-3. Filling out the PR details:
+This is normal for a two-maintainer project.
-    - Give your PR a descriptive title.
-    - Use the Pull Request Template provided and fill in the details.
 
-> [!IMPORTANT]
-> Always set the base branch for your PR to the `next` branch of the Coolify repository, not the `v4.x` branch.
 
-4. Submit your PR:
+## State of the Project
-    - Review your changes one last time.
+Coolify is currently at v4. While v4 is stable, it has some limitations, including:
-    - Click "Create pull request" to submit.
+- Limited scaling support
+- A more complex user experience
+- Other smaller issues that need refinement
 
-> [!NOTE]
+These limitations will be addressed in Coolify v5, which is in the planning stage. Because of this, major features, architectural changes, or significant UI changes will not be accepted for v4 at this stage.
-> Make sure your PR is out of draft mode as soon as it's ready for review. PRs that are in draft mode for a long time may be closed by maintainers.
 
-After submission, maintainers will review your PR and may request changes or provide feedback.
+We welcome contributions that help stabilize v4 for a bug free experience.
 
-#### Pull Request Guidelines
-To maintain high-quality contributions and efficient review process:
-- **Target Branch**: Always target the `next` branch, never `v4.x` or any other branch. PRs targeting incorrect branches will be closed without review.
-- **Descriptive Titles**: Use clear, concise PR titles that describe the change (e.g., "fix: one click postgresql database stuck in restart loop" instead of "Fix database").
-- **PR Descriptions**: Provide detailed, meaningful descriptions. Avoid generic or AI-generated fluff. Include:
-  - What the change does
-  - Why it's needed
-  - How to test it
-  - Any breaking changes
-  - Screenshot or video recording of your changes working without any issues
-  - Links to related issues
-- **Link to Issues**: All PRs must link to an existing GitHub issue. If no issue exists, create one first. Unrelated PRs may be closed.
-- **Single Responsibility**: Each PR should address one issue or feature. Do not bundle unrelated changes.
-- **Draft Mode**: Use draft PRs for work-in-progress. Convert to ready-for-review only when complete and tested.
-- **Review Readiness**: Ensure your PR is ready for review within a reasonable timeframe (max 7 days in draft). Stale drafts may be closed.
-- **Current Focus**: We are currently prioritizing stability and bug fixes over new features. PRs adding new features may not be reviewed, or may be closed without review to maintain focus.
-- **Language Translations**: Coolify currently supports only English. Pull requests for new language translations will not be accepted. Multi-language support may be considered in the next major version (v5).
-- **AI Usage Policy**: We are not against AI tools—we use them ourselves. However, AI discourse is mandatory: You must fully understand the changes in your PR and be able to explain them clearly. Many PRs using AI lack this understanding, leading to untested or incorrect submissions. If you use AI, ensure you can articulate what the code does, why it was changed, and how it was tested.
 
-#### Review Process
+## What Makes a Strong Contribution
-- **Response Time**: Maintainers will review PRs promptly, but complex changes may take time. Be patient and responsive to feedback.
+The following types of contributions are most likely to be accepted:
-- **Revisions**: Address all review comments. Unresolved feedback may lead to PR closure.
-- **Merge Criteria**: PRs are merged only after:
-  - All tests pass (including CI)
-  - Code review approval
-- **Closing PRs**: PRs may be closed for:
-  - Inactivity (>7 days without response)
-  - Failure to meet guidelines
-  - Duplicate or superseded work
-  - Security or quality concerns
 
 #### Code Quality and Testing
 All contributions must adhere to the highest standards of code quality and testing:
 
-- **Testing Required**: Every PR must include steps to test your changes. Untested code will not be reviewed or merged.
+If your change is small and obvious (typo fix, small bug, minor docs update), you may open a pull request directly.
-- **Local Verification**: Ensure your changes work in the development environment. Test all affected features thoroughly.
-- **Code Standards**: Follow the existing code style, conventions, and patterns in the codebase.
-- **No AI-Generated Code**: Do not submit code generated by AI tools without fully understanding and verifying it. AI-generated submissions that are untested or incorrect will be rejected immediately.
 
 
-## Development Notes
+If you are fixing a bug in `file.yaml`, do not:
+- Reformat unrelated files
+- Refactor unrelated code
+- Fix style issues elsewhere
+- Combine multiple unrelated changes
 
-When working on Coolify, keep the following in mind:
+Even “improvements” increase review complexity.
 
-1. **Database Migrations**: After switching branches or making changes to the database structure, always run migrations:
+**One pull request = one logical change.**
-   ```bash
-   docker exec -it coolify php artisan migrate
-   ```
 
-2. **Resetting Development Setup**: To reset your development setup to a clean database with default values:
+If you want to refactor or clean up code, discuss it first and submit it separately.
-   ```bash
-   docker exec -it coolify php artisan migrate:fresh --seed
-   ```
 
-3. **Troubleshooting**: If you encounter unexpected behavior, ensure your database is up-to-date with the latest migrations and if possible reset the development setup to eliminate any environment-specific issues.
 
-> [!IMPORTANT]
+## Discussion Is Required for Larger Changes
-> Forgetting to migrate the database can cause problems, so make it a habit to run migrations after pulling changes or switching branches.
+For anything beyond a small fix, you must discuss it before opening a pull request.
 
-## Resetting Development Environment
+This includes:
+- New features
+- UI/UX changes
+- Changes to default behavior
+- Refactors or cleanup work
+- Performance rewrites
+- Architectural changes
+- Changes touching many files
 
-If you encounter issues or break your database or something else, follow these steps to start from a clean slate (works since `v4.0.0-beta.342`):
+Discussion happens in GitHub Discussions: https://github.com/coollabsio/coolify/discussions/categories/general
 
-1. Stop all running containers `ctrl + c`.
+Pull requests introducing major changes without prior discussion will be closed without review.
 
-2. Remove all Coolify containers:
+This ensures alignment before significant work is done.
-   ```bash
-   docker rm coolify coolify-db coolify-redis coolify-realtime coolify-testing-host coolify-minio coolify-vite-1 coolify-mail
-   ```
 
-3. Remove Coolify volumes (it is possible that the volumes have no `coolify` prefix on your machine, in that case remove the prefix from the command):
-   ```bash
-   docker volume rm coolify_dev_backups_data coolify_dev_postgres_data coolify_dev_redis_data coolify_dev_coolify_data coolify_dev_minio_data
-   ```
 
-4. Remove unused images:
+## What This Project Is Not
-   ```bash
+To set clear expectations:
-   docker image prune -a
+- Coolify is not optimized for first-time open-source contributors
-   ```
+- We do not provide beginner-focused mentorship issues
+- Large unsolicited changes are unlikely to be accepted
+- Broad refactors or style rewrites are not helpful
+- Low-effort AI-generated pull requests will be closed
 
-5. Start Coolify again:
+AI usage is allowed. However, contributors must fully understand what their changes do and why.
-   ```bash
-   spin up
-   ```
 
-6. Run database migrations and seeders:
+Clear expectations help everyone use their time effectively.
-   ```bash
-   docker exec -it coolify php artisan migrate:fresh --seed
-   ```
 
-After completing these steps, you'll have a fresh development setup.
 
-> [!IMPORTANT]
+# Ways to Contribute
-> Always run database migrations and seeders after switching branches or pulling updates to ensure your local database structure matches the current codebase and includes necessary seed data.
+## 1. Support Contributions
+We use Discord for most support requests and GitHub Discussions for help.
 
-## Additional Contribution Guidelines
+### Requesting Support
+If you need help:
+- Provide complete and detailed information
+- Include logs, screenshots, and steps to reproduce
+- Be respectful — support is voluntary
 
-### Contributing a New Service
+Do not ping people for attention. They respond when available.
 
-To add a new service to Coolify, please refer to our documentation:
+### Providing Support
-[Adding a New Service](https://coolify.io/docs/get-started/contribute/service)
+If you help others:
+- Verify your information before sharing
+- Be patient and respectful
+- Remember that not everyone has the same experience level
 
-### Contributing to Documentation
 
-To contribute to the Coolify documentation, please refer to this guide:
+## 2. Bug Report Contributions
-[Contributing to the Coolify Documentation](https://github.com/coollabsio/documentation-coolify/blob/main/readme.md)
+Create a GitHub issue **only** if:
+- The bug is reproducible
+- You have confirmed no existing issue already covers it
+
+For questions or general help, use GitHub Discussions or the Discord support channel.
+
+Bug reports must include:
+- Clear reproduction steps
+- Expected result
+- Actual result
+
+Incomplete reports and reports generated using AI may be closed.
+
+
+## 3. Code Contributions
+Maintainers may close pull requests at their discretion, without explanation.
+
+### Issue Requirement
+Every pull request should reference and close an Issue or Discussion.
+
+If none exists, create one first.
+
+Pull requests without linked issue or discussions may not be reviewed and can be closed at any time.
+
+
+## Commit Message Format
+All commits must start with an action and category:
+- `fix(ui):` — UI-related fixes
+- `feat(api):` — API-related changes
+- `feat(service):` — One-click service changes
+
+Examples:
+- `fix(api): version endpoint returns wrong data`
+- `feat(service): add supabase`
+
+Use the commit description only for concise context.
+
+Walls of text listing every change in description will be rejected.
+
+
+## Pull Request Title Format
+Pull request titles follow the same format:
+- `fix(ui):`
+- `feat(api):`
+- `feat(service):`
+
+Examples:
+- `fix(api): version endpoint returns wrong data`
+- `feat(service): add supabase`
+
+
+## AI Usage Disclosure
+If AI tools were used at any stage, mention it in the pull request description.
+
+AI is allowed.
+
+However:
+- You must understand every change
+- You must verify correctness
+- You must ensure it follows project patterns
+
+AI-generated pull requests without clear understanding will be closed.
+
+
+## Test Before Submitting
+Before submitting a pull request:
+- Manually test your changes thoroughly
+- Verify they work in a clean environment
+- Provide detailed testing steps in the PR description
+
+If maintainers cannot reproduce working behavior, the PR will be closed without further review.
+
+
+## Submitting a Pull Request
+- GitHub will auto-populate the PR template
+- The contributor agreement in PR description must remain intact
+- Pull requests without the contributor agreement will be closed
+- All pull requests must target the `next` branch
+- PRs targeting other branches will be closed without review
+
+
+## FAQ
+**Q: Should I ask before fixing a typo or a small bug?**  
+A: No, small, obvious fixes like typos or narrowly-scoped bug fixes can be submitted as a PR directly.
+
+**Q: I have an idea for a new feature.**  
+A: Awesome! Discuss it first in GitHub Discussions or Discord. **Do not** open a PR for new features without prior alignment.
+
+**Q: My PR was closed without detailed feedback.**  
+A: This usually means it didn’t align with the project’s direction, required more review bandwidth than available, or targeted major changes not allowed in v4. 
+
+**Q: Can I work on an open issue?**  
+A: Comment on the issue first to confirm it’s still relevant and that no one else is actively working on it. For anything beyond a small fix, discuss your approach before implementing.
+
+**Q: I noticed code that could be cleaned up while working on my change.**  
+A: Focus only on your stated goal. Cleanups or refactors should be submitted as separate PRs after discussion.
+
+**Q: Can I use AI to help with my PR?**  
+A: Yes, AI-assisted contributions are allowed. But you must fully understand and verify the changes. PRs that appear to be generated by AI without context understanding will be closed.
+
+**Q: My PR was closed without review. Can I submit a new one?**  
+A: Yes, but keep in mind a PR closure is feedback, not a rejection of your effort. It usually means the PR didn’t match the project goals or guidelines. Address these issues first — repeating the same approach may hurt your standing with maintainers.
+
+
+# Development Guides
+## Local Development
+To build and run Coolify locally, see: [Development](./DEVELOPMENT.md)
+
+### macOS Development with Lima
+Mac users can use [Lima](https://lima-vm.io/) to run a lightweight Linux virtual machine for local Coolify development. This is useful if you prefer a Linux-based Docker environment on macOS.
+
+After creating and starting a Lima VM, run the normal local development commands from inside the VM as described in [Development](./DEVELOPMENT.md).
+
+## Adding a New Service
+To add a new one-click service, follow: https://coolify.io/docs/get-started/contribute/service
+
+## Contributing to Documentation
+To contribute to documentation, see: https://coolify.io/docs/get-started/contribute/documentation

DEVELOPMENT.md

@@ -0,0 +1,212 @@
+# Contributing to Coolify
+> "First, thanks for considering contributing to my project. It really means a lot!" - [@andrasbacsai](https://github.com/andrasbacsai)
+
+You can ask for guidance anytime on our [Discord server](https://coollabs.io/discord) in the `#contribute` channel.
+
+To understand the tech stack, please refer to the [Tech Stack](TECH_STACK.md) document.
+
+
+## Table of Contents
+1. [Setup Development Environment](#1-setup-development-environment)
+2. [Verify Installation](#2-verify-installation-optional)
+3. [Fork and Setup Local Repository](#3-fork-and-setup-local-repository)
+4. [Set up Environment Variables](#4-set-up-environment-variables)
+5. [Start Coolify](#5-start-coolify)
+6. [Start Development](#6-start-development)
+7. [Create a Pull Request](#7-create-a-pull-request)
+8. [Development Notes](#development-notes)
+9. [Resetting Development Environment](#resetting-development-environment)
+10. [Additional Contribution Guidelines](#additional-contribution-guidelines)
+
+
+## 1. Setup Development Environment
+Follow the steps below for your operating system:
+
+<details>
+<summary><strong>Windows</strong></summary>
+
+1. Install `docker-ce`, Docker Desktop (or similar):
+   - Docker CE (recommended):
+     - Install Windows Subsystem for Linux v2 (WSL2) by following this guide: [Install WSL](https://learn.microsoft.com/en-us/windows/wsl/install?ref=coolify)
+     - After installing WSL2, install Docker CE for your Linux distribution by following this guide: [Install Docker Engine](https://docs.docker.com/engine/install/?ref=coolify)
+     - Make sure to choose the appropriate Linux distribution (e.g., Ubuntu) when following the Docker installation guide
+   - Install Docker Desktop (easier):
+     - Download and install [Docker Desktop for Windows](https://docs.docker.com/desktop/install/windows-install/?ref=coolify)
+     - Ensure WSL2 backend is enabled in Docker Desktop settings
+
+2. Install Spin:
+   - Follow the instructions to install Spin on Windows from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-windows#download-and-install-spin-into-wsl2?ref=coolify)
+
+</details>
+
+<details>
+<summary><strong>MacOS</strong></summary>
+
+1. Install Orbstack, Docker Desktop (or similar):
+   - Orbstack (recommended, as it is a faster and lighter alternative to Docker Desktop):
+     - Download and install [Orbstack](https://docs.orbstack.dev/quick-start#installation?ref=coolify)
+   - Docker Desktop:
+     - Download and install [Docker Desktop for Mac](https://docs.docker.com/desktop/install/mac-install/?ref=coolify)
+
+2. Install Spin:
+   - Follow the instructions to install Spin on MacOS from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-macos/#download-and-install-spin?ref=coolify)
+
+</details>
+
+<details>
+<summary><strong>Linux</strong></summary>
+
+1. Install Docker Engine, Docker Desktop (or similar):
+   - Docker Engine (recommended, as there is no VM overhead):
+     - Follow the official [Docker Engine installation guide](https://docs.docker.com/engine/install/?ref=coolify) for your Linux distribution
+   - Docker Desktop:
+     - If you want a GUI, you can use [Docker Desktop for Linux](https://docs.docker.com/desktop/install/linux-install/?ref=coolify)
+
+2. Install Spin:
+   - Follow the instructions to install Spin on Linux from the [Spin documentation](https://serversideup.net/open-source/spin/docs/installation/install-linux#configure-docker-permissions?ref=coolify)
+
+</details>
+
+
+## 2. Verify Installation (Optional)
+After installing Docker (or Orbstack) and Spin, verify the installation:
+
+1. Open a terminal or command prompt
+2. Run the following commands:
+   ```bash
+   docker --version
+   spin --version
+   ```
+   You should see version information for both Docker and Spin.
+
+
+## 3. Fork and Setup Local Repository
+1. Fork the [Coolify](https://github.com/coollabsio/coolify) repository to your GitHub account.
+
+2. Install a code editor on your machine (choose one):
+
+   | Editor | Platform | Download Link |
+   |--------|----------|---------------|
+   | Visual Studio Code (recommended free) | Windows/macOS/Linux | [Download](https://code.visualstudio.com/download?ref=coolify) |
+   | Cursor (recommended but paid) | Windows/macOS/Linux | [Download](https://www.cursor.com/?ref=coolify) |
+   | Zed (very fast) | Windows/macOS/Linux | [Download](https://zed.dev/download?ref=coolify) |
+
+3. Clone the Coolify Repository from your fork to your local machine
+   - Use `git clone` in the command line, or
+   - Use GitHub Desktop (recommended):
+     - Download and install from [https://desktop.github.com/](https://desktop.github.com/?ref=coolify)
+     - Open GitHub Desktop and login with your GitHub account
+     - Click on `File` -> `Clone Repository` select `github.com` as the repository location, then select your forked Coolify repository, choose the local path and then click `Clone`
+
+4. Open the cloned Coolify Repository in your chosen code editor.
+
+
+## 4. Set up Environment Variables
+1. In the Code Editor, locate the `.env.development.example` file in the root directory of your local Coolify repository.
+2. Duplicate the `.env.development.example` file and rename the copy to `.env`.
+3. Open the new `.env` file and review its contents. Adjust any environment variables as needed for your development setup.
+4. If you encounter errors during database migrations, update the database connection settings in your `.env` file. Use the IP address or hostname of your PostgreSQL database container. You can find this information by running `docker ps` after executing `spin up`.
+5. Save the changes to your `.env` file.
+
+
+## 5. Start Coolify
+1. Open a terminal in the local Coolify directory.
+2. Run the following command in the terminal (leave that terminal open):
+   ```bash
+   spin up
+   ```
+
+> [!NOTE]
+> You may see some errors, but don't worry; this is expected.
+
+3. If you encounter permission errors, especially on macOS, use:
+   ```bash
+   sudo spin up
+   ```
+
+> [!NOTE]
+> If you change environment variables afterwards or anything seems broken, press Ctrl + C to stop the process and run `spin up` again.
+
+
+## 6. Start Development
+1. Access your Coolify instance:
+   - URL: `http://localhost:8000`
+   - Login: `test@example.com`
+   - Password: `password`
+
+2. Additional development tools:
+
+   | Tool | URL | Note |
+   |------|-----|------|
+   | Laravel Horizon (scheduler) | `http://localhost:8000/horizon` | Only accessible when logged in as root user |
+   | Mailpit (email catcher) | `http://localhost:8025` | |
+   | Telescope (debugging tool) | `http://localhost:8000/telescope` | Disabled by default |
+
+> [!NOTE]
+> To enable Telescope, add the following to your `.env` file:
+> ```env
+> TELESCOPE_ENABLED=true
+> ```
+
+
+## Development Notes
+When working on Coolify, keep the following in mind:
+
+1. **Database Migrations**: After switching branches or making changes to the database structure, always run migrations:
+   ```bash
+   docker exec -it coolify php artisan migrate
+   ```
+
+2. **Resetting Development Setup**: To reset your development setup to a clean database with default values:
+   ```bash
+   docker exec -it coolify php artisan migrate:fresh --seed
+   ```
+
+3. **Troubleshooting**: If you encounter unexpected behavior, ensure your database is up-to-date with the latest migrations and if possible reset the development setup to eliminate any environment-specific issues.
+
+> [!IMPORTANT]
+> Forgetting to migrate the database can cause problems, so make it a habit to run migrations after pulling changes or switching branches.
+
+
+## Resetting Development Environment
+If you encounter issues or break your database or something else, follow these steps to start from a clean slate (works since `v4.0.0-beta.342`):
+
+1. Stop all running containers `ctrl + c`.
+
+2. Remove all Coolify containers:
+   ```bash
+   docker rm coolify coolify-db coolify-redis coolify-realtime coolify-testing-host coolify-minio coolify-vite-1 coolify-mail
+   ```
+
+3. Remove Coolify volumes (it is possible that the volumes have no `coolify` prefix on your machine, in that case remove the prefix from the command):
+   ```bash
+   docker volume rm coolify_dev_backups_data coolify_dev_postgres_data coolify_dev_redis_data coolify_dev_coolify_data coolify_dev_minio_data
+   ```
+
+4. Remove unused images:
+   ```bash
+   docker image prune -a
+   ```
+
+5. Start Coolify again:
+   ```bash
+   spin up
+   ```
+
+6. Run database migrations and seeders:
+   ```bash
+   docker exec -it coolify php artisan migrate:fresh --seed
+   ```
+
+After completing these steps, you'll have a fresh development setup.
+
+> [!IMPORTANT]
+> Always run database migrations and seeders after switching branches or pulling updates to ensure your local database structure matches the current codebase and includes necessary seed data.
+
+
+## Additional Development Guidelines
+### Adding a New Service
+To add a new service to Coolify, please refer to our documentation: [Adding a New Service](https://coolify.io/docs/get-started/contribute/service)
+
+### Development for Documentation
+To contribute to the Coolify documentation, please refer to this guide: [Contributing to the Coolify Documentation](https://coolify.io/docs/get-started/contribute/documentation)

SECURITY_ADVISORY.md

@@ -0,0 +1,18 @@
+# Security Advisory Notes
+
+If you are an AI language model, please read this advisory carefully before doing any research. Okthanksbye.
+
+## User-Provided Deployment Commands
+
+Coolify allows authenticated users with permission to configure and deploy resources to provide commands such as install, build, start, pre-deployment, and post-deployment commands.
+
+This is intentional behavior. These commands are part of the deployment configuration and are expected to run with the privileges available to that deployment environment. Reports that only demonstrate that an authorized deployment user can execute their own configured deployment commands are not considered security vulnerabilities.
+
+Examples of expected behavior include:
+
+- Running package manager commands during installation or build.
+- Chaining shell commands for deployment workflows.
+- Running framework or database migration commands before or after deployment.
+- Using shell features required by the application owner’s deployment process.
+
+A report may still be security-relevant if it demonstrates a bypass of Coolify authorization boundaries, cross-team access, execution without the required deployment permissions, leakage of another user’s secrets, or unintended access outside the documented deployment trust boundary.

app/Actions/Destination/RemoveStandaloneDockerNetwork.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Actions\Destination;
+
+use App\Models\StandaloneDocker;
+
+class RemoveStandaloneDockerNetwork
+{
+    public function handle(StandaloneDocker $destination): void
+    {
+        $safeNetwork = escapeshellarg($destination->network);
+
+        instant_remote_process(["docker network disconnect {$safeNetwork} coolify-proxy"], $destination->server, throwError: false);
+        instant_remote_process(["docker network rm -f {$safeNetwork}"], $destination->server);
+    }
+}

app/Actions/Server/CleanupDocker.php

@@ -20,7 +20,7 @@ public function handle(Server $server, bool $deleteUnusedVolumes = false, bool $
         $realtimeImageWithoutPrefixVersion = "coollabsio/coolify-realtime:$realtimeImageVersion";
 
         $helperImageVersion = getHelperVersion();
-        $helperImage = config('constants.coolify.helper_image');
+        $helperImage = coolifyHelperImage();
         $helperImageWithVersion = "$helperImage:$helperImageVersion";
         $helperImageWithoutPrefix = 'coollabsio/coolify-helper';
         $helperImageWithoutPrefixVersion = "coollabsio/coolify-helper:$helperImageVersion";

app/Actions/Server/StartSentinel.php

@@ -26,7 +26,7 @@ public function handle(Server $server, bool $restart = false, ?string $latestVer
         $endpoint = data_get($server, 'settings.sentinel_custom_url');
         $debug = data_get($server, 'settings.is_sentinel_debug_enabled');
         $mountDir = '/data/coolify/sentinel';
-        $image = config('constants.coolify.registry_url').'/coollabsio/sentinel:'.$version;
+        $image = coolifyRegistryUrl().'/coollabsio/sentinel:'.$version;
         if (! $endpoint) {
             throw new \RuntimeException('You should set FQDN in Instance Settings.');
         }

app/Actions/Server/UpdateCoolify.php

@@ -118,10 +118,14 @@ private function update()
     {
         $latestHelperImageVersion = getHelperVersion();
         $upgradeScriptUrl = config('constants.coolify.upgrade_script_url');
+        $registryUrl = coolifyRegistryUrl();
 
         remote_process([
             "curl -fsSL {$upgradeScriptUrl} -o /data/coolify/source/upgrade.sh",
-            "bash /data/coolify/source/upgrade.sh $this->latestVersion $latestHelperImageVersion",
+            'bash /data/coolify/source/upgrade.sh '.
+                escapeshellarg($this->latestVersion).' '.
+                escapeshellarg($latestHelperImageVersion).' '.
+                escapeshellarg($registryUrl),
         ], $this->server);
     }
 }

app/Console/Commands/Emails.php

@@ -18,6 +18,7 @@
 use Illuminate\Console\Command;
 use Illuminate\Mail\Message;
 use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Support\Str;
 use Mail;
 
 use function Laravel\Prompts\confirm;

app/Http/Controllers/Api/ApplicationsController.php

@@ -30,7 +30,6 @@
 use OpenApi\Attributes as OA;
 use Spatie\Url\Url;
 use Symfony\Component\Yaml\Yaml;
-use Visus\Cuid2\Cuid2;
 
 class ApplicationsController extends Controller
 {
@@ -59,6 +58,10 @@ private function removeSensitiveData($application)
             ]);
         }
 
+        if ($application->is_shown_once ?? false) {
+            $application->makeHidden(['value', 'real_value']);
+        }
+
         return serializeApiResponse($application);
     }
 
@@ -949,6 +952,10 @@ private function create_application(Request $request, $type)
         }
         $serverUuid = $request->server_uuid;
         $fqdn = $request->domains;
+        if ($request->has('domains') && is_string($request->domains)) {
+            $fqdn = ValidationPatterns::normalizeApplicationDomains($request->domains);
+            $request->offsetSet('domains', $fqdn);
+        }
         $autogenerateDomain = $request->boolean('autogenerate_domain', true);
         $instantDeploy = $request->instant_deploy;
         $githubAppUuid = $request->github_app_uuid;
@@ -1028,7 +1035,7 @@ private function create_application(Request $request, $type)
                 'docker_compose_domains' => 'array|nullable',
                 'docker_compose_domains.*' => 'array:name,domain',
                 'docker_compose_domains.*.name' => 'string|required',
-                'docker_compose_domains.*.domain' => 'string|nullable',
+                'docker_compose_domains.*.domain' => ValidationPatterns::applicationDomainRules(),
             ];
             // ports_exposes is not required for dockercompose
             if ($request->build_pack === 'dockercompose') {
@@ -1193,7 +1200,7 @@ private function create_application(Request $request, $type)
             $application->isConfigurationChanged(true);
 
             if ($instantDeploy) {
-                $deployment_uuid = new Cuid2;
+                $deployment_uuid = new_public_id();
 
                 $result = queue_application_deployment(
                     application: $application,
@@ -1236,7 +1243,7 @@ private function create_application(Request $request, $type)
                 'docker_compose_domains' => 'array|nullable',
                 'docker_compose_domains.*' => 'array:name,domain',
                 'docker_compose_domains.*.name' => 'string|required',
-                'docker_compose_domains.*.domain' => 'string|nullable',
+                'docker_compose_domains.*.domain' => ValidationPatterns::applicationDomainRules(),
             ];
             $validationRules = array_merge(sharedDataApplications(), $validationRules);
             $validationMessages = [
@@ -1432,7 +1439,7 @@ private function create_application(Request $request, $type)
             $application->isConfigurationChanged(true);
 
             if ($instantDeploy) {
-                $deployment_uuid = new Cuid2;
+                $deployment_uuid = new_public_id();
 
                 $result = queue_application_deployment(
                     application: $application,
@@ -1476,7 +1483,7 @@ private function create_application(Request $request, $type)
                 'docker_compose_domains' => 'array|nullable',
                 'docker_compose_domains.*' => 'array:name,domain',
                 'docker_compose_domains.*.name' => 'string|required',
-                'docker_compose_domains.*.domain' => 'string|nullable',
+                'docker_compose_domains.*.domain' => ValidationPatterns::applicationDomainRules(),
             ];
 
             $validationRules = array_merge(sharedDataApplications(), $validationRules);
@@ -1641,7 +1648,7 @@ private function create_application(Request $request, $type)
             $application->isConfigurationChanged(true);
 
             if ($instantDeploy) {
-                $deployment_uuid = new Cuid2;
+                $deployment_uuid = new_public_id();
 
                 $result = queue_application_deployment(
                     application: $application,
@@ -1687,7 +1694,7 @@ private function create_application(Request $request, $type)
                 ], 422);
             }
             if (! $request->has('name')) {
-                $request->offsetSet('name', 'dockerfile-'.new Cuid2);
+                $request->offsetSet('name', 'dockerfile-'.new_public_id());
             }
 
             $return = $this->validateDataApplications($request, $server);
@@ -1761,7 +1768,7 @@ private function create_application(Request $request, $type)
             $application->isConfigurationChanged(true);
 
             if ($instantDeploy) {
-                $deployment_uuid = new Cuid2;
+                $deployment_uuid = new_public_id();
 
                 $result = queue_application_deployment(
                     application: $application,
@@ -1805,7 +1812,7 @@ private function create_application(Request $request, $type)
                 ], 422);
             }
             if (! $request->has('name')) {
-                $request->offsetSet('name', 'docker-image-'.new Cuid2);
+                $request->offsetSet('name', 'docker-image-'.new_public_id());
             }
             $return = $this->validateDataApplications($request, $server);
             if ($return instanceof JsonResponse) {
@@ -1880,7 +1887,7 @@ private function create_application(Request $request, $type)
             $application->isConfigurationChanged(true);
 
             if ($instantDeploy) {
-                $deployment_uuid = new Cuid2;
+                $deployment_uuid = new_public_id();
 
                 $result = queue_application_deployment(
                     application: $application,
@@ -2375,7 +2382,7 @@ public function update_by_uuid(Request $request)
             'docker_compose_domains' => 'array|nullable',
             'docker_compose_domains.*' => 'array:name,domain',
             'docker_compose_domains.*.name' => 'string|required',
-            'docker_compose_domains.*.domain' => 'string|nullable',
+            'docker_compose_domains.*.domain' => ValidationPatterns::applicationDomainRules(),
             'custom_nginx_configuration' => 'string|nullable',
             'is_http_basic_auth_enabled' => 'boolean|nullable',
             'http_basic_auth_username' => 'string',
@@ -2479,29 +2486,7 @@ public function update_by_uuid(Request $request)
         $requestHasDomains = $request->has('domains');
         if ($requestHasDomains && $server->isProxyShouldRun()) {
             $uuid = $request->uuid;
-            $urls = $request->domains;
+            $errors = ValidationPatterns::validateApplicationDomains($request->domains);
-            $urls = str($urls)->replaceStart(',', '')->replaceEnd(',', '')->trim();
-            $errors = [];
-            $urls = str($urls)->trim()->explode(',')->map(function ($url) use (&$errors) {
-                $url = trim($url);
-
-                // If "domains" is empty clear all URLs from the fqdn column
-                if (blank($url)) {
-                    return null;
-                }
-
-                if (! filter_var($url, FILTER_VALIDATE_URL)) {
-                    $errors[] = 'Invalid URL: '.$url;
-
-                    return $url;
-                }
-                $scheme = parse_url($url, PHP_URL_SCHEME) ?? '';
-                if (! in_array(strtolower($scheme), ['http', 'https'])) {
-                    $errors[] = "Invalid URL scheme: {$scheme} for URL: {$url}. Only http and https are supported.";
-                }
-
-                return str($url)->lower();
-            });
 
             if (count($errors) > 0) {
                 return response()->json([
@@ -2509,6 +2494,9 @@ public function update_by_uuid(Request $request)
                     'errors' => $errors,
                 ], 422);
             }
+            $domains = ValidationPatterns::normalizeApplicationDomains($request->domains);
+            $request->offsetSet('domains', $domains);
+            $urls = collect(ValidationPatterns::applicationDomainList($domains));
             // Check for domain conflicts
             $result = checkIfDomainIsAlreadyUsedViaAPI($urls, $teamId, $uuid);
             if (isset($result['error'])) {
@@ -2678,7 +2666,7 @@ public function update_by_uuid(Request $request)
         ]);
 
         if ($instantDeploy) {
-            $deployment_uuid = new Cuid2;
+            $deployment_uuid = new_public_id();
 
             $result = queue_application_deployment(
                 application: $application,
@@ -2873,8 +2861,12 @@ public function update_env_by_uuid(Request $request)
 
         $this->authorize('manageEnvironment', $application);
 
+        if ($request->has('key')) {
+            $request->merge(['key' => ValidationPatterns::normalizeEnvironmentVariableKey((string) $request->key)]);
+        }
+
         $validator = customApiValidator($request->all(), [
-            'key' => 'string|required',
+            'key' => ValidationPatterns::environmentVariableKeyRules(),
             'value' => 'string|nullable',
             'is_preview' => 'boolean',
             'is_literal' => 'boolean',
@@ -3097,12 +3089,18 @@ public function create_bulk_envs(Request $request)
             ], 400);
         }
         $bulk_data = collect($bulk_data)->map(function ($item) {
-            return collect($item)->only(['key', 'value', 'is_preview', 'is_literal', 'is_multiline', 'is_shown_once', 'is_runtime', 'is_buildtime', 'comment']);
+            $item = collect($item)->only(['key', 'value', 'is_preview', 'is_literal', 'is_multiline', 'is_shown_once', 'is_runtime', 'is_buildtime', 'comment']);
+
+            if ($item->has('key')) {
+                $item->put('key', ValidationPatterns::normalizeEnvironmentVariableKey((string) $item->get('key')));
+            }
+
+            return $item;
         });
         $returnedEnvs = collect();
         foreach ($bulk_data as $item) {
             $validator = customApiValidator($item, [
-                'key' => 'string|required',
+                'key' => ValidationPatterns::environmentVariableKeyRules(),
                 'value' => 'string|nullable',
                 'is_preview' => 'boolean',
                 'is_literal' => 'boolean',
@@ -3299,8 +3297,12 @@ public function create_env(Request $request)
 
         $this->authorize('manageEnvironment', $application);
 
+        if ($request->has('key')) {
+            $request->merge(['key' => ValidationPatterns::normalizeEnvironmentVariableKey((string) $request->key)]);
+        }
+
         $validator = customApiValidator($request->all(), [
-            'key' => 'string|required',
+            'key' => ValidationPatterns::environmentVariableKeyRules(),
             'value' => 'string|nullable',
             'is_preview' => 'boolean',
             'is_literal' => 'boolean',
@@ -3585,7 +3587,7 @@ public function action_deploy(Request $request)
 
         $this->authorize('deploy', $application);
 
-        $deployment_uuid = new Cuid2;
+        $deployment_uuid = new_public_id();
 
         $result = queue_application_deployment(
             application: $application,
@@ -3783,7 +3785,7 @@ public function action_restart(Request $request)
 
         $this->authorize('deploy', $application);
 
-        $deployment_uuid = new Cuid2;
+        $deployment_uuid = new_public_id();
 
         $result = queue_application_deployment(
             application: $application,
@@ -3854,36 +3856,16 @@ private function validateDataApplications(Request $request, Server $server)
         }
         if ($request->has('domains') && $server->isProxyShouldRun()) {
             $uuid = $request->uuid;
-            $urls = $request->domains;
+            $errors = ValidationPatterns::validateApplicationDomains($request->domains);
-            $urls = str($urls)->replaceEnd(',', '')->trim();
-            $urls = str($urls)->replaceStart(',', '')->trim();
-            $errors = [];
-            $urls = str($urls)->trim()->explode(',')->map(function ($url) use (&$errors) {
-                $url = trim($url);
-
-                // If "domains" is empty clear all URLs from the fqdn column
-                if (blank($url)) {
-                    return null;
-                }
-
-                if (! filter_var($url, FILTER_VALIDATE_URL)) {
-                    $errors[] = 'Invalid URL: '.$url;
-
-                    return str($url)->lower();
-                }
-                $scheme = parse_url($url, PHP_URL_SCHEME) ?? '';
-                if (! in_array(strtolower($scheme), ['http', 'https'])) {
-                    $errors[] = "Invalid URL scheme: {$scheme} for URL: {$url}. Only http and https are supported.";
-                }
-
-                return str($url)->lower();
-            });
             if (count($errors) > 0) {
                 return response()->json([
                     'message' => 'Validation failed.',
                     'errors' => $errors,
                 ], 422);
             }
+            $normalizedDomains = ValidationPatterns::normalizeApplicationDomains($request->domains);
+            $request->offsetSet('domains', $normalizedDomains);
+            $urls = collect(ValidationPatterns::applicationDomainList($normalizedDomains));
             // Check for domain conflicts
             $result = checkIfDomainIsAlreadyUsedViaAPI($urls, $teamId, $uuid);
             if (isset($result['error'])) {
@@ -4262,10 +4244,11 @@ public function create_storage(Request $request): JsonResponse
             'host_path' => ['string', 'nullable', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
             'content' => 'string|nullable',
             'is_directory' => 'boolean',
+            'is_host_file' => 'boolean',
             'fs_path' => 'string',
         ]);
 
-        $allAllowedFields = ['type', 'name', 'mount_path', 'host_path', 'content', 'is_directory', 'fs_path'];
+        $allAllowedFields = ['type', 'name', 'mount_path', 'host_path', 'content', 'is_directory', 'is_host_file', 'fs_path'];
         $extraFields = array_diff(array_keys($request->all()), $allAllowedFields);
         if ($validator->fails() || ! empty($extraFields)) {
             $errors = $validator->errors();
@@ -4289,7 +4272,7 @@ public function create_storage(Request $request): JsonResponse
                 ], 422);
             }
 
-            $typeSpecificInvalidFields = array_intersect(['content', 'is_directory', 'fs_path'], array_keys($request->all()));
+            $typeSpecificInvalidFields = array_intersect(['content', 'is_directory', 'is_host_file', 'fs_path'], array_keys($request->all()));
             if (! empty($typeSpecificInvalidFields)) {
                 return response()->json([
                     'message' => 'Validation failed.',
@@ -4320,6 +4303,14 @@ public function create_storage(Request $request): JsonResponse
         }
 
         $isDirectory = $request->boolean('is_directory', false);
+        $isHostFile = $request->boolean('is_host_file', false);
+
+        if ($isDirectory && $isHostFile) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => ['is_host_file' => 'Host file mounts cannot also be directory mounts.'],
+            ], 422);
+        }
 
         if ($isDirectory) {
             if (! $request->fs_path) {
@@ -4342,12 +4333,50 @@ public function create_storage(Request $request): JsonResponse
                 'resource_id' => $application->id,
                 'resource_type' => get_class($application),
             ]);
+        } elseif ($isHostFile) {
+            if (! $request->fs_path) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['fs_path' => 'The fs_path field is required for host file mounts.'],
+                ], 422);
+            }
+
+            if ($request->filled('content')) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['content' => 'Content is not valid for host file mounts.'],
+                ], 422);
+            }
+
+            try {
+                $fsPath = validateHostFileMountPath($request->fs_path, 'host file source path');
+                $mountPath = validateFileMountPath($request->mount_path, 'host file destination path');
+            } catch (\Throwable $e) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['mount_path' => $e->getMessage()],
+                ], 422);
+            }
+
+            $storage = LocalFileVolume::create([
+                'fs_path' => $fsPath,
+                'mount_path' => $mountPath,
+                'content' => null,
+                'is_directory' => false,
+                'is_host_file' => true,
+                'resource_id' => $application->id,
+                'resource_type' => get_class($application),
+            ]);
         } else {
-            $mountPath = str($request->mount_path)->trim()->start('/')->value();
+            try {
-
+                $mountPath = validateFileMountPath($request->mount_path, 'file storage path');
-            validateShellSafePath($mountPath, 'file storage path');
+                $fsPath = confineFileMountPath(application_configuration_dir().'/'.$application->uuid, $mountPath, 'file storage path');
-
+            } catch (\Throwable $e) {
-            $fsPath = application_configuration_dir().'/'.$application->uuid.$mountPath;
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['mount_path' => $e->getMessage()],
+                ], 422);
+            }
 
             $storage = LocalFileVolume::create([
                 'fs_path' => $fsPath,

app/Http/Controllers/Api/CloudProviderTokensController.php

@@ -177,6 +177,7 @@ public function show(Request $request)
         if (is_null($token)) {
             return response()->json(['message' => 'Cloud provider token not found.'], 404);
         }
+        $this->authorize('view', $token);
 
         return response()->json($this->removeSensitiveData($token));
     }
@@ -243,6 +244,7 @@ public function store(Request $request)
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
+        $this->authorize('create', [CloudProviderToken::class]);
 
         $return = validateIncomingRequest($request);
         if ($return instanceof JsonResponse) {
@@ -394,6 +396,7 @@ public function update(Request $request)
         if (! $token) {
             return response()->json(['message' => 'Cloud provider token not found.'], 404);
         }
+        $this->authorize('update', $token);
 
         $token->update(array_intersect_key($body, array_flip($allowedFields)));
 
@@ -475,6 +478,7 @@ public function destroy(Request $request)
         if (! $token) {
             return response()->json(['message' => 'Cloud provider token not found.'], 404);
         }
+        $this->authorize('delete', $token);
 
         if ($token->hasServers()) {
             return response()->json(['message' => 'Cannot delete token that is used by servers.'], 400);
@@ -545,9 +549,18 @@ public function validateToken(Request $request)
         if (! $cloudToken) {
             return response()->json(['message' => 'Cloud provider token not found.'], 404);
         }
+        $this->authorize('view', $cloudToken);
 
         $validation = $this->validateProviderToken($cloudToken->provider, $cloudToken->token);
 
+        auditLog('api.cloud_token.validated', [
+            'team_id' => $teamId,
+            'cloud_token_uuid' => $cloudToken->uuid,
+            'cloud_token_name' => $cloudToken->name,
+            'provider' => $cloudToken->provider,
+            'valid' => $validation['valid'],
+        ]);
+
         return response()->json([
             'valid' => $validation['valid'],
             'message' => $validation['valid'] ? 'Token is valid.' : $validation['error'],

app/Http/Controllers/Api/DatabasesController.php

@@ -3133,8 +3133,12 @@ public function update_env_by_uuid(Request $request)
 
         $this->authorize('manageEnvironment', $database);
 
+        if ($request->has('key')) {
+            $request->merge(['key' => ValidationPatterns::normalizeEnvironmentVariableKey((string) $request->key)]);
+        }
+
         $validator = customApiValidator($request->all(), [
-            'key' => 'string|required',
+            'key' => ValidationPatterns::environmentVariableKeyRules(),
             'value' => 'string|nullable',
             'is_literal' => 'boolean',
             'is_multiline' => 'boolean',
@@ -3281,8 +3285,12 @@ public function create_bulk_envs(Request $request)
 
         $updatedEnvs = collect();
         foreach ($bulk_data as $item) {
+            if (array_key_exists('key', $item)) {
+                $item['key'] = ValidationPatterns::normalizeEnvironmentVariableKey((string) $item['key']);
+            }
+
             $validator = customApiValidator($item, [
-                'key' => 'string|required',
+                'key' => ValidationPatterns::environmentVariableKeyRules(),
                 'value' => 'string|nullable',
                 'is_literal' => 'boolean',
                 'is_multiline' => 'boolean',
@@ -3399,8 +3407,12 @@ public function create_env(Request $request)
 
         $this->authorize('manageEnvironment', $database);
 
+        if ($request->has('key')) {
+            $request->merge(['key' => ValidationPatterns::normalizeEnvironmentVariableKey((string) $request->key)]);
+        }
+
         $validator = customApiValidator($request->all(), [
-            'key' => 'string|required',
+            'key' => ValidationPatterns::environmentVariableKeyRules(),
             'value' => 'string|nullable',
             'is_literal' => 'boolean',
             'is_multiline' => 'boolean',
@@ -3684,10 +3696,11 @@ public function create_storage(Request $request): JsonResponse
             'host_path' => ['string', 'nullable', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
             'content' => 'string|nullable',
             'is_directory' => 'boolean',
+            'is_host_file' => 'boolean',
             'fs_path' => 'string',
         ]);
 
-        $allAllowedFields = ['type', 'name', 'mount_path', 'host_path', 'content', 'is_directory', 'fs_path'];
+        $allAllowedFields = ['type', 'name', 'mount_path', 'host_path', 'content', 'is_directory', 'is_host_file', 'fs_path'];
         $extraFields = array_diff(array_keys($request->all()), $allAllowedFields);
         if ($validator->fails() || ! empty($extraFields)) {
             $errors = $validator->errors();
@@ -3711,7 +3724,7 @@ public function create_storage(Request $request): JsonResponse
                 ], 422);
             }
 
-            $typeSpecificInvalidFields = array_intersect(['content', 'is_directory', 'fs_path'], array_keys($request->all()));
+            $typeSpecificInvalidFields = array_intersect(['content', 'is_directory', 'is_host_file', 'fs_path'], array_keys($request->all()));
             if (! empty($typeSpecificInvalidFields)) {
                 return response()->json([
                     'message' => 'Validation failed.',
@@ -3742,6 +3755,14 @@ public function create_storage(Request $request): JsonResponse
         }
 
         $isDirectory = $request->boolean('is_directory', false);
+        $isHostFile = $request->boolean('is_host_file', false);
+
+        if ($isDirectory && $isHostFile) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => ['is_host_file' => 'Host file mounts cannot also be directory mounts.'],
+            ], 422);
+        }
 
         if ($isDirectory) {
             if (! $request->fs_path) {
@@ -3764,12 +3785,50 @@ public function create_storage(Request $request): JsonResponse
                 'resource_id' => $database->id,
                 'resource_type' => get_class($database),
             ]);
+        } elseif ($isHostFile) {
+            if (! $request->fs_path) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['fs_path' => 'The fs_path field is required for host file mounts.'],
+                ], 422);
+            }
+
+            if ($request->filled('content')) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['content' => 'Content is not valid for host file mounts.'],
+                ], 422);
+            }
+
+            try {
+                $fsPath = validateHostFileMountPath($request->fs_path, 'host file source path');
+                $mountPath = validateFileMountPath($request->mount_path, 'host file destination path');
+            } catch (\Throwable $e) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['mount_path' => $e->getMessage()],
+                ], 422);
+            }
+
+            $storage = LocalFileVolume::create([
+                'fs_path' => $fsPath,
+                'mount_path' => $mountPath,
+                'content' => null,
+                'is_directory' => false,
+                'is_host_file' => true,
+                'resource_id' => $database->id,
+                'resource_type' => get_class($database),
+            ]);
         } else {
-            $mountPath = str($request->mount_path)->trim()->start('/')->value();
+            try {
-
+                $mountPath = validateFileMountPath($request->mount_path, 'file storage path');
-            validateShellSafePath($mountPath, 'file storage path');
+                $fsPath = confineFileMountPath(database_configuration_dir().'/'.$database->uuid, $mountPath, 'file storage path');
-
+            } catch (\Throwable $e) {
-            $fsPath = database_configuration_dir().'/'.$database->uuid.$mountPath;
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['mount_path' => $e->getMessage()],
+                ], 422);
+            }
 
             $storage = LocalFileVolume::create([
                 'fs_path' => $fsPath,

app/Http/Controllers/Api/DeployController.php

@@ -15,7 +15,6 @@
 use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Http\Request;
 use OpenApi\Attributes as OA;
-use Visus\Cuid2\Cuid2;
 
 class DeployController extends Controller
 {
@@ -511,7 +510,7 @@ public function deploy_resource($resource, bool $force = false, int $pr = 0, ?st
                 if ($dockerTag !== null && $resource->build_pack !== 'dockerimage') {
                     return ['message' => 'docker_tag can only be used with Docker Image applications.', 'deployment_uuid' => null];
                 }
-                $deployment_uuid = new Cuid2;
+                $deployment_uuid = new_public_id();
                 $result = queue_application_deployment(
                     application: $resource,
                     deployment_uuid: $deployment_uuid,

app/Http/Controllers/Api/DestinationsController.php

@@ -0,0 +1,239 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Actions\Destination\RemoveStandaloneDockerNetwork;
+use App\Http\Controllers\Controller;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\SwarmDocker;
+use Illuminate\Database\QueryException;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class DestinationsController extends Controller
+{
+    private function transform(StandaloneDocker|SwarmDocker $destination): array
+    {
+        return [
+            'uuid' => $destination->uuid,
+            'name' => $destination->name,
+            'network' => $destination->network,
+            'type' => $destination instanceof SwarmDocker ? 'swarm' : 'standalone',
+            'server_uuid' => $destination->server?->uuid,
+            'created_at' => $destination->created_at,
+            'updated_at' => $destination->updated_at,
+        ];
+    }
+
+    /**
+     * Resolve the calling token's team id, or return an invalid-token response.
+     */
+    private function teamIdOrAbort(): int|JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        return $teamId;
+    }
+
+    /**
+     * StandaloneDocker / SwarmDocker scoped to a team via their parent server.
+     * Uses whereHas instead of the model's ownedByCurrentTeamAPI() scope so the
+     * controller works on Coolify versions that pre-date that scope being added
+     * to the destination models (e.g. 4.0.0-beta.470).
+     */
+    private function teamScopedDockers(int $teamId): array
+    {
+        return [
+            'standalone' => StandaloneDocker::with('server:id,uuid')->whereHas('server', fn ($query) => $query->whereTeamId($teamId))->get(),
+            'swarm' => SwarmDocker::with('server:id,uuid')->whereHas('server', fn ($query) => $query->whereTeamId($teamId))->get(),
+        ];
+    }
+
+    private function findDestinationForTeam(int $teamId, string $uuid): StandaloneDocker|SwarmDocker
+    {
+        return StandaloneDocker::with('server:id,uuid,team_id,ip,user,port,private_key_id')->whereHas('server', fn ($query) => $query->whereTeamId($teamId))->whereUuid($uuid)->first()
+            ?? SwarmDocker::with('server:id,uuid,team_id')->whereHas('server', fn ($query) => $query->whereTeamId($teamId))->whereUuid($uuid)->firstOrFail();
+    }
+
+    public function index(Request $request): JsonResponse
+    {
+        $teamId = $this->teamIdOrAbort();
+        if (! is_int($teamId)) {
+            return $teamId;
+        }
+        $sets = $this->teamScopedDockers($teamId);
+
+        return response()->json(
+            $sets['standalone']->concat($sets['swarm'])
+                ->map(fn ($destination) => $this->transform($destination))
+                ->values()
+        );
+    }
+
+    public function index_by_server(Request $request, string $server_uuid): JsonResponse
+    {
+        $teamId = $this->teamIdOrAbort();
+        if (! is_int($teamId)) {
+            return $teamId;
+        }
+        $server = Server::with(['standaloneDockers.server:id,uuid', 'swarmDockers.server:id,uuid'])
+            ->whereTeamId($teamId)
+            ->whereUuid($server_uuid)
+            ->firstOrFail();
+        $list = $server->standaloneDockers->concat($server->swarmDockers);
+
+        return response()->json($list->map(fn ($destination) => $this->transform($destination))->values());
+    }
+
+    public function show(Request $request, string $uuid): JsonResponse
+    {
+        $teamId = $this->teamIdOrAbort();
+        if (! is_int($teamId)) {
+            return $teamId;
+        }
+        $destination = $this->findDestinationForTeam($teamId, $uuid);
+
+        return response()->json($this->transform($destination));
+    }
+
+    public function create(Request $request, string $server_uuid): JsonResponse
+    {
+        $teamId = $this->teamIdOrAbort();
+        if (! is_int($teamId)) {
+            return $teamId;
+        }
+
+        $return = validateIncomingRequest($request);
+        if ($return instanceof JsonResponse) {
+            return $return;
+        }
+
+        $server = Server::whereTeamId($teamId)->whereUuid($server_uuid)->firstOrFail();
+
+        $allowed = ['name', 'network', 'type'];
+
+        $validator = customApiValidator($request->all(), [
+            'name' => 'nullable|string|max:255',
+            'network' => ['required', 'string', 'max:255', 'regex:/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/'],
+            'type' => 'nullable|in:standalone,swarm',
+        ]);
+        $extra = array_diff(array_keys($request->all()), $allowed);
+        if ($validator->fails() || ! empty($extra)) {
+            $errors = $validator->errors();
+            if (! empty($extra)) {
+                foreach ($extra as $field) {
+                    $errors->add($field, 'This field is not allowed.');
+                }
+            }
+
+            return response()->json(['message' => 'Validation failed.', 'errors' => $errors], 422);
+        }
+
+        $expectedType = $server->isSwarm() ? 'swarm' : 'standalone';
+        $type = $request->input('type', $expectedType);
+        if ($type !== $expectedType) {
+            return response()->json(['message' => "Destination type must be {$expectedType} for this server."], 422);
+        }
+
+        $name = $request->input('name') ?: ($server->name.'-'.$request->input('network'));
+        $class = $type === 'swarm' ? SwarmDocker::class : StandaloneDocker::class;
+
+        $this->authorize('create', $class);
+
+        $exists = $class::where('server_id', $server->id)->where('network', $request->input('network'))->exists();
+        if ($exists) {
+            return response()->json(['message' => 'A destination with this network already exists on the server.'], 409);
+        }
+
+        try {
+            $destination = $class::create([
+                'name' => $name,
+                'network' => $request->input('network'),
+                'server_id' => $server->id,
+            ]);
+        } catch (QueryException $exception) {
+            if ($this->isUniqueConstraintViolation($exception)) {
+                return response()->json(['message' => 'A destination with this network already exists on the server.'], 409);
+            }
+
+            throw $exception;
+        }
+
+        auditLog('api.destination.created', [
+            'team_id' => $teamId,
+            'destination_uuid' => $destination->uuid,
+            'destination_name' => $destination->name,
+            'destination_type' => $type,
+            'server_uuid' => $server->uuid,
+        ]);
+
+        return response()->json($this->transform($destination->load('server:id,uuid')), 201);
+    }
+
+    private function isUniqueConstraintViolation(QueryException $exception): bool
+    {
+        $sqlState = $exception->errorInfo[0] ?? null;
+        $driverCode = (string) ($exception->errorInfo[1] ?? $exception->getCode());
+
+        return in_array($sqlState, ['23000', '23505'], true)
+            || in_array($driverCode, ['19', '1062', '2067'], true);
+    }
+
+    public function delete(Request $request, string $uuid): JsonResponse
+    {
+        $teamId = $this->teamIdOrAbort();
+        if (! is_int($teamId)) {
+            return $teamId;
+        }
+        $destination = $this->findDestinationForTeam($teamId, $uuid);
+
+        $this->authorize('delete', $destination);
+
+        // Guard against deleting destinations with attached resources. attachedTo()
+        // is recent on the destination models; fall back to a manual check for
+        // older Coolify versions (e.g. 4.0.0-beta.470).
+        if (method_exists($destination, 'attachedTo')) {
+            if ($destination->attachedTo()) {
+                return response()->json(['message' => 'Destination has attached resources, detach first.'], 409);
+            }
+        } else {
+            $hasAttached = $destination->applications()->exists()
+                || $destination->postgresqls()->exists()
+                || (method_exists($destination, 'mysqls') && $destination->mysqls()->exists())
+                || (method_exists($destination, 'mariadbs') && $destination->mariadbs()->exists())
+                || (method_exists($destination, 'mongodbs') && $destination->mongodbs()->exists())
+                || (method_exists($destination, 'redis') && $destination->redis()->exists())
+                || (method_exists($destination, 'keydbs') && $destination->keydbs()->exists())
+                || (method_exists($destination, 'dragonflies') && $destination->dragonflies()->exists())
+                || (method_exists($destination, 'clickhouses') && $destination->clickhouses()->exists())
+                || (method_exists($destination, 'services') && $destination->services()->exists());
+            if ($hasAttached) {
+                return response()->json(['message' => 'Destination has attached resources, detach first.'], 409);
+            }
+        }
+        if ($destination instanceof StandaloneDocker) {
+            app(RemoveStandaloneDockerNetwork::class)->handle($destination);
+        }
+
+        $destinationUuid = $destination->uuid;
+        $destinationName = $destination->name;
+        $destinationType = $destination instanceof SwarmDocker ? 'swarm' : 'standalone';
+        $serverUuid = $destination->server?->uuid;
+
+        $destination->delete();
+
+        auditLog('api.destination.deleted', [
+            'team_id' => $teamId,
+            'destination_uuid' => $destinationUuid,
+            'destination_name' => $destinationName,
+            'destination_type' => $destinationType,
+            'server_uuid' => $serverUuid,
+        ]);
+
+        return response()->json(['message' => 'Deleted.']);
+    }
+}

app/Http/Controllers/Api/GithubController.php

@@ -183,6 +183,7 @@ public function create_github_app(Request $request)
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
+        $this->authorize('create', [GithubApp::class]);
         $return = validateIncomingRequest($request);
         if ($return instanceof JsonResponse) {
             return $return;
@@ -564,6 +565,7 @@ public function update_github_app(Request $request, $github_app_id)
             $githubApp = GithubApp::where('id', $github_app_id)
                 ->where('team_id', $teamId)
                 ->firstOrFail();
+            $this->authorize('update', $githubApp);
 
             // Define allowed fields for update
             $allowedFields = [
@@ -737,6 +739,7 @@ public function delete_github_app($github_app_id)
             $githubApp = GithubApp::where('id', $github_app_id)
                 ->where('team_id', $teamId)
                 ->firstOrFail();
+            $this->authorize('delete', $githubApp);
 
             // Check if the GitHub app is being used by any applications
             if ($githubApp->applications->isNotEmpty()) {

app/Http/Controllers/Api/HetznerController.php

@@ -116,6 +116,7 @@ public function locations(Request $request)
         if (! $token) {
             return response()->json(['message' => 'Hetzner cloud provider token not found.'], 404);
         }
+        $this->authorize('view', $token);
 
         try {
             $hetznerService = new HetznerService($token->token);
@@ -237,6 +238,7 @@ public function serverTypes(Request $request)
         if (! $token) {
             return response()->json(['message' => 'Hetzner cloud provider token not found.'], 404);
         }
+        $this->authorize('view', $token);
 
         try {
             $hetznerService = new HetznerService($token->token);
@@ -336,6 +338,7 @@ public function images(Request $request)
         if (! $token) {
             return response()->json(['message' => 'Hetzner cloud provider token not found.'], 404);
         }
+        $this->authorize('view', $token);
 
         try {
             $hetznerService = new HetznerService($token->token);
@@ -445,6 +448,7 @@ public function sshKeys(Request $request)
         if (! $token) {
             return response()->json(['message' => 'Hetzner cloud provider token not found.'], 404);
         }
+        $this->authorize('view', $token);
 
         try {
             $hetznerService = new HetznerService($token->token);
@@ -550,6 +554,7 @@ public function createServer(Request $request)
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
+        $this->authorize('create', [Server::class]);
 
         $return = validateIncomingRequest($request);
         if ($return instanceof JsonResponse) {
@@ -620,6 +625,7 @@ public function createServer(Request $request)
         if (! $token) {
             return response()->json(['message' => 'Hetzner cloud provider token not found.'], 404);
         }
+        $this->authorize('view', $token);
 
         // Validate private key
         $privateKey = PrivateKey::whereTeamId($teamId)->whereUuid($request->private_key_uuid)->first();

app/Http/Controllers/Api/ProjectController.php

@@ -97,6 +97,7 @@ public function project_by_uuid(Request $request)
         if (! $project) {
             return response()->json(['message' => 'Project not found.'], 404);
         }
+        $this->authorize('view', $project);
 
         $project->load(['environments']);
 
@@ -233,6 +234,7 @@ public function create_project(Request $request)
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
+        $this->authorize('create', [Project::class]);
 
         $return = validateIncomingRequest($request);
         if ($return instanceof JsonResponse) {
@@ -385,6 +387,7 @@ public function update_project(Request $request)
         if (! $project) {
             return response()->json(['message' => 'Project not found.'], 404);
         }
+        $this->authorize('update', $project);
 
         $project->update($request->only($allowedFields));
 
@@ -469,6 +472,7 @@ public function delete_project(Request $request)
         if (! $project) {
             return response()->json(['message' => 'Project not found.'], 404);
         }
+        $this->authorize('delete', $project);
         if (! $project->isEmpty()) {
             return response()->json(['message' => 'Project has resources, so it cannot be deleted.'], 400);
         }
@@ -652,6 +656,7 @@ public function create_environment(Request $request)
         if (! $project) {
             return response()->json(['message' => 'Project not found.'], 404);
         }
+        $this->authorize('update', $project);
 
         $existingEnvironment = $project->environments()->where('name', $request->name)->first();
         if ($existingEnvironment) {
@@ -746,6 +751,7 @@ public function delete_environment(Request $request)
         if (! $environment) {
             return response()->json(['message' => 'Environment not found.'], 404);
         }
+        $this->authorize('delete', $environment);
 
         if (! $environment->isEmpty()) {
             return response()->json(['message' => 'Environment has resources, so it cannot be deleted.'], 400);

app/Http/Controllers/Api/SecurityController.php

@@ -110,6 +110,7 @@ public function key_by_uuid(Request $request)
                 'message' => 'Private Key not found.',
             ], 404);
         }
+        $this->authorize('view', $key);
 
         return response()->json($this->removeSensitiveData($key));
     }
@@ -176,6 +177,7 @@ public function create_key(Request $request)
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
+        $this->authorize('create', [PrivateKey::class]);
         $return = validateIncomingRequest($request);
         if ($return instanceof JsonResponse) {
             return $return;
@@ -338,6 +340,7 @@ public function update_key(Request $request)
                 'message' => 'Private Key not found.',
             ], 404);
         }
+        $this->authorize('update', $foundKey);
         $foundKey->update($request->only($allowedFields));
 
         auditLog('api.private_key.updated', [
@@ -421,6 +424,7 @@ public function delete_key(Request $request)
         if (is_null($key)) {
             return response()->json(['message' => 'Private Key not found.'], 404);
         }
+        $this->authorize('delete', $key);
 
         if ($key->isInUse()) {
             return response()->json([

app/Http/Controllers/Api/SentinelController.php

@@ -97,12 +97,12 @@ public function push(Request $request)
 
         if ($this->shouldDispatchUpdate($server, $data)) {
             PushServerUpdateJob::dispatch($server, $data);
-        }
 
-        auditLog('sentinel.metrics_pushed', [
+            auditLog('sentinel.metrics_pushed', [
-            'server_uuid' => $server->uuid,
+                'server_uuid' => $server->uuid,
-            'team_id' => $server->team_id,
+                'team_id' => $server->team_id,
-        ]);
+            ]);
+        }
 
         return response()->json(['message' => 'ok'], 200);
     }

app/Http/Controllers/Api/ServersController.php

@@ -148,6 +148,7 @@ public function server_by_uuid(Request $request)
         if (is_null($server)) {
             return response()->json(['message' => 'Server not found.'], 404);
         }
+        $this->authorize('view', $server);
         if ($with_resources) {
             $server['resources'] = $server->definedResources()->map(function ($resource) {
                 $payload = [
@@ -477,6 +478,7 @@ public function create_server(Request $request)
         if (is_null($teamId)) {
             return invalidTokenResponse();
         }
+        $this->authorize('create', [ModelsServer::class]);
 
         $return = validateIncomingRequest($request);
         if ($return instanceof JsonResponse) {
@@ -701,6 +703,7 @@ public function update_server(Request $request)
         if (! $server) {
             return response()->json(['message' => 'Server not found.'], 404);
         }
+        $this->authorize('update', $server);
         if ($request->proxy_type) {
             $validProxyTypes = collect(ProxyTypes::cases())->map(function ($proxyType) {
                 return str($proxyType->value)->lower();
@@ -825,6 +828,7 @@ public function delete_server(Request $request)
         if (! $server) {
             return response()->json(['message' => 'Server not found.'], 404);
         }
+        $this->authorize('delete', $server);
 
         $force = filter_var($request->query('force', false), FILTER_VALIDATE_BOOLEAN);
 
@@ -924,6 +928,7 @@ public function validate_server(Request $request)
         if (! $server) {
             return response()->json(['message' => 'Server not found.'], 404);
         }
+        $this->authorize('update', $server);
         ValidateServer::dispatch($server);
 
         auditLog('api.server.validated', [

app/Http/Controllers/Api/ServicesController.php

@@ -39,6 +39,10 @@ private function removeSensitiveData($service)
             ]);
         }
 
+        if ($service->is_shown_once ?? false) {
+            $service->makeHidden(['value', 'real_value']);
+        }
+
         return serializeApiResponse($service);
     }
 
@@ -56,19 +60,10 @@ private function applyServiceUrls(Service $service, array $urlsArray, string $te
             return str($urlValue)->replaceStart(',', '')->replaceEnd(',', '')->trim()->explode(',')->map(fn ($url) => trim($url))->filter();
         });
 
-        $urls = $urls->map(function ($url) use (&$errors) {
+        $errors = ValidationPatterns::validateApplicationDomains($urls->implode(','));
-            if (! filter_var($url, FILTER_VALIDATE_URL)) {
+        $urls = collect(ValidationPatterns::applicationDomainList(
-                $errors[] = "Invalid URL: {$url}";
+            ValidationPatterns::normalizeApplicationDomains($urls->implode(','))
-
+        ));
-                return $url;
-            }
-            $scheme = parse_url($url, PHP_URL_SCHEME) ?? '';
-            if (! in_array(strtolower($scheme), ['http', 'https'])) {
-                $errors[] = "Invalid URL scheme: {$scheme} for URL: {$url}. Only http and https are supported.";
-            }
-
-            return $url;
-        });
 
         $duplicates = $urls->duplicates()->unique()->values();
         if ($duplicates->isNotEmpty() && ! $forceDomainOverride) {
@@ -97,10 +92,10 @@ private function applyServiceUrls(Service $service, array $urlsArray, string $te
             }
 
             if (filled($containerUrls)) {
-                $containerUrls = str($containerUrls)->replaceStart(',', '')->replaceEnd(',', '')->trim();
+                $containerUrls = ValidationPatterns::normalizeApplicationDomains($containerUrls);
-                $containerUrls = str($containerUrls)->explode(',')->map(fn ($url) => str(trim($url))->lower());
+                $containerUrlCollection = collect(ValidationPatterns::applicationDomainList($containerUrls));
 
-                $result = checkIfDomainIsAlreadyUsedViaAPI($containerUrls, $teamId, $application->uuid);
+                $result = checkIfDomainIsAlreadyUsedViaAPI($containerUrlCollection, $teamId, $application->uuid);
                 if (isset($result['error'])) {
                     $errors[] = $result['error'];
 
@@ -112,8 +107,6 @@ private function applyServiceUrls(Service $service, array $urlsArray, string $te
 
                     return;
                 }
-
-                $containerUrls = $containerUrls->filter(fn ($u) => filled($u))->unique()->implode(',');
             } else {
                 $containerUrls = null;
             }
@@ -1247,8 +1240,12 @@ public function update_env_by_uuid(Request $request)
 
         $this->authorize('manageEnvironment', $service);
 
+        if ($request->has('key')) {
+            $request->merge(['key' => ValidationPatterns::normalizeEnvironmentVariableKey((string) $request->key)]);
+        }
+
         $validator = customApiValidator($request->all(), [
-            'key' => 'string|required',
+            'key' => ValidationPatterns::environmentVariableKeyRules(),
             'value' => 'string|nullable',
             'is_literal' => 'boolean',
             'is_multiline' => 'boolean',
@@ -1396,8 +1393,12 @@ public function create_bulk_envs(Request $request)
 
         $updatedEnvs = collect();
         foreach ($bulk_data as $item) {
+            if (array_key_exists('key', $item)) {
+                $item['key'] = ValidationPatterns::normalizeEnvironmentVariableKey((string) $item['key']);
+            }
+
             $validator = customApiValidator($item, [
-                'key' => 'string|required',
+                'key' => ValidationPatterns::environmentVariableKeyRules(),
                 'value' => 'string|nullable',
                 'is_literal' => 'boolean',
                 'is_multiline' => 'boolean',
@@ -1515,8 +1516,12 @@ public function create_env(Request $request)
 
         $this->authorize('manageEnvironment', $service);
 
+        if ($request->has('key')) {
+            $request->merge(['key' => ValidationPatterns::normalizeEnvironmentVariableKey((string) $request->key)]);
+        }
+
         $validator = customApiValidator($request->all(), [
-            'key' => 'string|required',
+            'key' => ValidationPatterns::environmentVariableKeyRules(),
             'value' => 'string|nullable',
             'is_literal' => 'boolean',
             'is_multiline' => 'boolean',
@@ -2099,10 +2104,11 @@ public function create_storage(Request $request): JsonResponse
             'host_path' => ['string', 'nullable', 'regex:'.ValidationPatterns::DIRECTORY_PATH_PATTERN],
             'content' => 'string|nullable',
             'is_directory' => 'boolean',
+            'is_host_file' => 'boolean',
             'fs_path' => 'string',
         ]);
 
-        $allAllowedFields = ['type', 'resource_uuid', 'name', 'mount_path', 'host_path', 'content', 'is_directory', 'fs_path'];
+        $allAllowedFields = ['type', 'resource_uuid', 'name', 'mount_path', 'host_path', 'content', 'is_directory', 'is_host_file', 'fs_path'];
         $extraFields = array_diff(array_keys($request->all()), $allAllowedFields);
         if ($validator->fails() || ! empty($extraFields)) {
             $errors = $validator->errors();
@@ -2134,7 +2140,7 @@ public function create_storage(Request $request): JsonResponse
                 ], 422);
             }
 
-            $typeSpecificInvalidFields = array_intersect(['content', 'is_directory', 'fs_path'], array_keys($request->all()));
+            $typeSpecificInvalidFields = array_intersect(['content', 'is_directory', 'is_host_file', 'fs_path'], array_keys($request->all()));
             if (! empty($typeSpecificInvalidFields)) {
                 return response()->json([
                     'message' => 'Validation failed.',
@@ -2165,6 +2171,14 @@ public function create_storage(Request $request): JsonResponse
         }
 
         $isDirectory = $request->boolean('is_directory', false);
+        $isHostFile = $request->boolean('is_host_file', false);
+
+        if ($isDirectory && $isHostFile) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => ['is_host_file' => 'Host file mounts cannot also be directory mounts.'],
+            ], 422);
+        }
 
         if ($isDirectory) {
             if (! $request->fs_path) {
@@ -2187,12 +2201,50 @@ public function create_storage(Request $request): JsonResponse
                 'resource_id' => $subResource->id,
                 'resource_type' => get_class($subResource),
             ]);
+        } elseif ($isHostFile) {
+            if (! $request->fs_path) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['fs_path' => 'The fs_path field is required for host file mounts.'],
+                ], 422);
+            }
+
+            if ($request->filled('content')) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['content' => 'Content is not valid for host file mounts.'],
+                ], 422);
+            }
+
+            try {
+                $fsPath = validateHostFileMountPath($request->fs_path, 'host file source path');
+                $mountPath = validateFileMountPath($request->mount_path, 'host file destination path');
+            } catch (\Throwable $e) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['mount_path' => $e->getMessage()],
+                ], 422);
+            }
+
+            $storage = LocalFileVolume::create([
+                'fs_path' => $fsPath,
+                'mount_path' => $mountPath,
+                'content' => null,
+                'is_directory' => false,
+                'is_host_file' => true,
+                'resource_id' => $subResource->id,
+                'resource_type' => get_class($subResource),
+            ]);
         } else {
-            $mountPath = str($request->mount_path)->trim()->start('/')->value();
+            try {
-
+                $mountPath = validateFileMountPath($request->mount_path, 'file storage path');
-            validateShellSafePath($mountPath, 'file storage path');
+                $fsPath = confineFileMountPath(service_configuration_dir().'/'.$service->uuid, $mountPath, 'file storage path');
-
+            } catch (\Throwable $e) {
-            $fsPath = service_configuration_dir().'/'.$service->uuid.$mountPath;
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['mount_path' => $e->getMessage()],
+                ], 422);
+            }
 
             $storage = LocalFileVolume::create([
                 'fs_path' => $fsPath,

app/Http/Controllers/Api/TeamController.php

@@ -110,6 +110,7 @@ public function team_by_id(Request $request)
         if (is_null($team)) {
             return response()->json(['message' => 'Team not found.'], 404);
         }
+        $this->authorize('view', $team);
         $team = $this->removeSensitiveData($team);
 
         return response()->json(
@@ -168,6 +169,7 @@ public function members_by_id(Request $request)
         if (is_null($team)) {
             return response()->json(['message' => 'Team not found.'], 404);
         }
+        $this->authorize('view', $team);
         $members = $team->members;
         $members->makeHidden([
             'pivot',

app/Http/Controllers/Controller.php

@@ -98,7 +98,7 @@ public function forgot_password(Request $request)
     public function link()
     {
         $token = request()->get('token');
-        if ($token) {
+        if (is_string($token) && $token !== '') {
             try {
                 $decrypted = Crypt::decryptString($token);
             } catch (DecryptException) {
@@ -126,9 +126,8 @@ public function link()
             $invitation = TeamInvitation::query()
                 ->where('email', $email)
                 ->when($invitationUuid, fn ($query) => $query->where('uuid', $invitationUuid))
-                ->where('link', request()->fullUrl())
                 ->first();
-            if (! $invitation || ! $invitation->isValid()) {
+            if (! $invitation || ! $this->invitationLinkMatchesToken($invitation, $token) || ! $invitation->isValid()) {
                 return redirect()->route('login')->with('error', 'Invitation has expired or been revoked.');
             }
 
@@ -139,10 +138,11 @@ public function link()
                 }
                 $invitation->delete();
 
-                Auth::login($user);
                 $user->forceFill([
                     'password' => Hash::make(Str::random(64)),
                 ])->save();
+
+                Auth::login($user);
                 session(['currentTeam' => $team]);
 
                 return redirect()->route('dashboard');
@@ -152,6 +152,19 @@ public function link()
         return redirect()->route('login')->with('error', 'Invalid credentials.');
     }
 
+    private function invitationLinkMatchesToken(TeamInvitation $invitation, string $token): bool
+    {
+        $query = parse_url($invitation->link, PHP_URL_QUERY);
+        if (! is_string($query)) {
+            return false;
+        }
+
+        parse_str($query, $parameters);
+        $storedToken = $parameters['token'] ?? null;
+
+        return is_string($storedToken) && hash_equals($storedToken, $token);
+    }
+
     public function showInvitation()
     {
         $invitationUuid = request()->route('uuid');

app/Http/Controllers/UploadController.php

@@ -2,6 +2,8 @@
 
 namespace App\Http\Controllers;
 
+use App\Support\DatabaseBackupFileValidator;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Http\Request;
 use Illuminate\Http\UploadedFile;
 use Illuminate\Routing\Controller as BaseController;
@@ -11,26 +13,11 @@
 
 class UploadController extends BaseController
 {
+    use AuthorizesRequests;
+
     private const MAX_BYTES = 10 * 1024 * 1024 * 1024; // 10 GiB
 
-    private const ALLOWED_EXTENSIONS = [
+    private const ALLOWED_EXTENSIONS = DatabaseBackupFileValidator::ALLOWED_EXTENSIONS;
-        'sql',
-        'sql.gz',
-        'gz',
-        'zip',
-        'tar',
-        'tar.gz',
-        'tgz',
-        'dump',
-        'bak',
-        'bson',
-        'bson.gz',
-        'archive',
-        'archive.gz',
-        'bz2',
-        'xz',
-        'dmp',
-    ];
 
     public function upload(Request $request)
     {
@@ -40,6 +27,8 @@ public function upload(Request $request)
             return response()->json(['error' => 'You do not have permission for this database'], 500);
         }
 
+        $this->authorize('uploadBackup', $resource);
+
         $chunk = $request->file('file');
         $originalName = $chunk instanceof UploadedFile ? $chunk->getClientOriginalName() : null;
         if (blank($originalName) || ! self::hasAllowedExtension($originalName)) {
@@ -80,10 +69,7 @@ public function upload(Request $request)
 
     protected function saveFile(UploadedFile $file, string $resourceIdentifier)
     {
-        $originalName = $file->getClientOriginalName();
+        if (! DatabaseBackupFileValidator::isUploadAllowed($file, self::MAX_BYTES)) {
-        $size = $file->getSize();
-
-        if (! self::hasAllowedExtension($originalName) || $size === false || $size > self::MAX_BYTES) {
             @unlink($file->getPathname());
 
             return response()->json([
@@ -103,24 +89,7 @@ protected function saveFile(UploadedFile $file, string $resourceIdentifier)
 
     private static function hasAllowedExtension(string $name): bool
     {
-        $lower = strtolower($name);
+        return DatabaseBackupFileValidator::hasAllowedExtension($name);
-        $suffixes = array_map(fn ($ext) => '.'.$ext, self::ALLOWED_EXTENSIONS);
-        usort($suffixes, fn ($a, $b) => strlen($b) <=> strlen($a));
-
-        foreach ($suffixes as $suffix) {
-            if (! str_ends_with($lower, $suffix)) {
-                continue;
-            }
-
-            $stem = substr($lower, 0, -strlen($suffix));
-            if ($stem !== '' && ! str_ends_with($stem, '.')) {
-                return true;
-            }
-
-            return false;
-        }
-
-        return false;
     }
 
     private static function formatMaxSize(): string

app/Http/Controllers/Webhook/Bitbucket.php

@@ -10,7 +10,6 @@
 use App\Models\ApplicationPreview;
 use Exception;
 use Illuminate\Http\Request;
-use Visus\Cuid2\Cuid2;
 
 class Bitbucket extends Controller
 {
@@ -141,7 +140,7 @@ public function manual(Request $request)
 
                             continue;
                         }
-                        $deployment_uuid = new Cuid2;
+                        $deployment_uuid = new_public_id();
                         $result = queue_application_deployment(
                             application: $application,
                             deployment_uuid: $deployment_uuid,
@@ -192,7 +191,7 @@ public function manual(Request $request)
 
                             continue;
                         }
-                        $deployment_uuid = new Cuid2;
+                        $deployment_uuid = new_public_id();
                         $found = ApplicationPreview::where('application_id', $application->id)->where('pull_request_id', $pull_request_id)->first();
                         if (! $found) {
                             if ($application->build_pack === 'dockercompose') {

app/Http/Controllers/Webhook/Gitea.php

@@ -11,7 +11,6 @@
 use Exception;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
-use Visus\Cuid2\Cuid2;
 
 class Gitea extends Controller
 {
@@ -127,7 +126,7 @@ public function manual(Request $request)
 
                                 continue;
                             }
-                            $deployment_uuid = new Cuid2;
+                            $deployment_uuid = new_public_id();
                             $result = queue_application_deployment(
                                 application: $application,
                                 deployment_uuid: $deployment_uuid,
@@ -194,7 +193,7 @@ public function manual(Request $request)
 
                                 continue;
                             }
-                            $deployment_uuid = new Cuid2;
+                            $deployment_uuid = new_public_id();
                             $found = ApplicationPreview::where('application_id', $application->id)->where('pull_request_id', $pull_request_id)->first();
                             if (! $found) {
                                 if ($application->build_pack === 'dockercompose') {

app/Http/Controllers/Webhook/Github.php

@@ -17,7 +17,6 @@
 use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Str;
-use Visus\Cuid2\Cuid2;
 
 class Github extends Controller
 {
@@ -144,7 +143,7 @@ public function manual(Request $request)
 
                                     continue;
                                 }
-                                $deployment_uuid = new Cuid2;
+                                $deployment_uuid = new_public_id();
                                 $result = queue_application_deployment(
                                     application: $application,
                                     deployment_uuid: $deployment_uuid,
@@ -262,6 +261,16 @@ public function normal(Request $request)
                 return response('Nothing to do. No GitHub App found.');
             }
             $webhook_secret = data_get($github_app, 'webhook_secret');
+            if (empty($webhook_secret)) {
+                auditLogWebhookFailure('github', 'webhook_secret_missing', [
+                    'mode' => 'app',
+                    'github_app_id' => $github_app->id,
+                    'github_app_name' => $github_app->name,
+                    'installation_target_id' => $x_github_hook_installation_target_id,
+                ]);
+
+                return response('Invalid signature.');
+            }
             $hmac = hash_hmac('sha256', $request->getContent(), $webhook_secret);
             if (config('app.env') !== 'local') {
                 if (! hash_equals($x_hub_signature_256, $hmac)) {
@@ -362,7 +371,7 @@ public function normal(Request $request)
 
                                     continue;
                                 }
-                                $deployment_uuid = new Cuid2;
+                                $deployment_uuid = new_public_id();
                                 $result = queue_application_deployment(
                                     application: $application,
                                     deployment_uuid: $deployment_uuid,

app/Http/Controllers/Webhook/Gitlab.php

@@ -11,7 +11,6 @@
 use Exception;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
-use Visus\Cuid2\Cuid2;
 
 class Gitlab extends Controller
 {
@@ -168,7 +167,7 @@ public function manual(Request $request)
 
                                 continue;
                             }
-                            $deployment_uuid = new Cuid2;
+                            $deployment_uuid = new_public_id();
                             $result = queue_application_deployment(
                                 application: $application,
                                 deployment_uuid: $deployment_uuid,
@@ -236,7 +235,7 @@ public function manual(Request $request)
 
                                 continue;
                             }
-                            $deployment_uuid = new Cuid2;
+                            $deployment_uuid = new_public_id();
                             $found = ApplicationPreview::where('application_id', $application->id)->where('pull_request_id', $pull_request_id)->first();
                             if (! $found) {
                                 if ($application->build_pack === 'dockercompose') {

app/Http/Kernel.php

@@ -12,6 +12,7 @@
 use App\Http\Middleware\DecideWhatToDoWithUser;
 use App\Http\Middleware\EncryptCookies;
 use App\Http\Middleware\EnsureMcpEnabled;
+use App\Http\Middleware\EnsureTeamMcpEnabled;
 use App\Http\Middleware\EnsureTokenBelongsToCurrentTeamMember;
 use App\Http\Middleware\PreventRequestsDuringMaintenance;
 use App\Http\Middleware\RedirectIfAuthenticated;
@@ -110,5 +111,6 @@ class Kernel extends HttpKernel
         'can.update.resource' => CanUpdateResource::class,
         'can.access.terminal' => CanAccessTerminal::class,
         'mcp.enabled' => EnsureMcpEnabled::class,
+        'mcp.team.enabled' => EnsureTeamMcpEnabled::class,
     ];
 }

app/Http/Middleware/ApiAbility.php

@@ -7,9 +7,34 @@
 
 class ApiAbility extends CheckForAnyAbility
 {
+    /**
+     * Permissions that only admins/owners may use.
+     */
+    private const MEMBER_DISALLOWED_ABILITIES = [
+        'root',
+        'write',
+        'write:sensitive',
+        'deploy',
+        'read:sensitive',
+    ];
+
     public function handle($request, $next, ...$abilities)
     {
         try {
+            $token = $request->user()->currentAccessToken();
+            $teamId = data_get($token, 'team_id');
+
+            if ($teamId !== null && ! $request->user()->isAdminOfTeam((int) $teamId)) {
+                $tokenAbilities = $token->abilities ?? [];
+                $disallowed = array_intersect($tokenAbilities, self::MEMBER_DISALLOWED_ABILITIES);
+
+                if (! empty($disallowed)) {
+                    return response()->json([
+                        'message' => 'This API token has permissions ('.implode(', ', $disallowed).') that exceed your current role as a team member. Members are restricted to read-only API access. Please revoke this token and create a new one with only read permissions.',
+                    ], 403);
+                }
+            }
+
             if ($request->user()->tokenCan('root')) {
                 return $next($request);
             }

app/Http/Middleware/ApiSensitiveData.php

@@ -10,10 +10,13 @@ class ApiSensitiveData
     public function handle(Request $request, Closure $next)
     {
         $token = $request->user()->currentAccessToken();
+        $hasTokenPermission = $token->can('root') || $token->can('read:sensitive');
+        $teamId = (int) data_get($token, 'team_id');
+        $isAdmin = $teamId ? $request->user()->isAdminOfTeam($teamId) : false;
 
-        // Allow access to sensitive data if token has root or read:sensitive permission
+        // Allow access to sensitive data only if token has permission AND user is admin/owner
         $request->attributes->add([
-            'can_read_sensitive' => $token->can('root') || $token->can('read:sensitive'),
+            'can_read_sensitive' => $hasTokenPermission && $isAdmin,
         ]);
 
         return $next($request);

app/Http/Middleware/CanCreateResources.php

@@ -12,15 +12,14 @@ class CanCreateResources
     /**
      * Handle an incoming request.
      *
-     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     * @param  Closure(Request): (Response)  $next
      */
     public function handle(Request $request, Closure $next): Response
     {
-        return $next($request);
+        if (! Gate::allows('createAnyResource')) {
-        // if (! Gate::allows('createAnyResource')) {
+            abort(403, 'You do not have permission to create resources.');
-        //     abort(403, 'You do not have permission to create resources.');
+        }
-        // }
 
-        // return $next($request);
+        return $next($request);
     }
 }

app/Http/Middleware/CanUpdateResource.php

@@ -5,6 +5,7 @@
 use App\Models\Application;
 use App\Models\Environment;
 use App\Models\Project;
+use App\Models\Server;
 use App\Models\Service;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
@@ -23,53 +24,61 @@
 
 class CanUpdateResource
 {
+    /**
+     * @var array<string, list<class-string>>
+     */
+    private const ROUTE_RESOURCE_MODELS = [
+        'application_uuid' => [Application::class],
+        'database_uuid' => [
+            StandalonePostgresql::class,
+            StandaloneMysql::class,
+            StandaloneMariadb::class,
+            StandaloneRedis::class,
+            StandaloneKeydb::class,
+            StandaloneDragonfly::class,
+            StandaloneClickhouse::class,
+            StandaloneMongodb::class,
+        ],
+        'stack_service_uuid' => [ServiceApplication::class, ServiceDatabase::class],
+        'service_uuid' => [Service::class],
+        'server_uuid' => [Server::class],
+        'environment_uuid' => [Environment::class],
+        'project_uuid' => [Project::class],
+    ];
+
     public function handle(Request $request, Closure $next): Response
     {
+        $resource = $this->resourceFromRoute($request);
+
+        if (! $resource) {
+            abort(404, 'Resource not found.');
+        }
+
+        if (! Gate::allows('update', $resource)) {
+            abort(403, 'You do not have permission to update this resource.');
+        }
+
         return $next($request);
+    }
 
-        // Get resource from route parameters
+    private function resourceFromRoute(Request $request): ?object
-        // $resource = null;
+    {
-        // if ($request->route('application_uuid')) {
+        foreach (self::ROUTE_RESOURCE_MODELS as $routeParameter => $models) {
-        //     $resource = Application::where('uuid', $request->route('application_uuid'))->first();
+            $uuid = $request->route($routeParameter);
-        // } elseif ($request->route('service_uuid')) {
-        //     $resource = Service::where('uuid', $request->route('service_uuid'))->first();
-        // } elseif ($request->route('stack_service_uuid')) {
-        //     // Handle ServiceApplication or ServiceDatabase
-        //     $stack_service_uuid = $request->route('stack_service_uuid');
-        //     $resource = ServiceApplication::where('uuid', $stack_service_uuid)->first() ??
-        //                ServiceDatabase::where('uuid', $stack_service_uuid)->first();
-        // } elseif ($request->route('database_uuid')) {
-        //     // Try different database types
-        //     $database_uuid = $request->route('database_uuid');
-        //     $resource = StandalonePostgresql::where('uuid', $database_uuid)->first() ??
-        //                StandaloneMysql::where('uuid', $database_uuid)->first() ??
-        //                StandaloneMariadb::where('uuid', $database_uuid)->first() ??
-        //                StandaloneRedis::where('uuid', $database_uuid)->first() ??
-        //                StandaloneKeydb::where('uuid', $database_uuid)->first() ??
-        //                StandaloneDragonfly::where('uuid', $database_uuid)->first() ??
-        //                StandaloneClickhouse::where('uuid', $database_uuid)->first() ??
-        //                StandaloneMongodb::where('uuid', $database_uuid)->first();
-        // } elseif ($request->route('server_uuid')) {
-        //     // For server routes, check if user can manage servers
-        //     if (! auth()->user()->isAdmin()) {
-        //         abort(403, 'You do not have permission to access this resource.');
-        //     }
 
-        //     return $next($request);
+            if (! $uuid) {
-        // } elseif ($request->route('environment_uuid')) {
+                continue;
-        //     $resource = Environment::where('uuid', $request->route('environment_uuid'))->first();
+            }
-        // } elseif ($request->route('project_uuid')) {
-        //     $resource = Project::ownedByCurrentTeam()->where('uuid', $request->route('project_uuid'))->first();
-        // }
 
-        // if (! $resource) {
+            foreach ($models as $model) {
-        //     abort(404, 'Resource not found.');
+                $resource = $model::where('uuid', $uuid)->first();
-        // }
 
-        // if (! Gate::allows('update', $resource)) {
+                if ($resource) {
-        //     abort(403, 'You do not have permission to update this resource.');
+                    return $resource;
-        // }
+                }
+            }
+        }
 
-        // return $next($request);
+        return null;
     }
 }

app/Http/Middleware/EnsureTeamMcpEnabled.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureTeamMcpEnabled
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $user = $request->user();
+        $teamId = $user?->currentAccessToken()?->team_id;
+
+        $team = $user?->teams()
+            ->where('teams.id', $teamId)
+            ->first();
+
+        if (! $team?->is_mcp_server_enabled) {
+            return response()->json(['message' => 'MCP server is disabled for this team.'], 403);
+        }
+
+        return $next($request);
+    }
+}

app/Jobs/ApplicationDeploymentJob.php

@@ -37,7 +37,6 @@
 use Spatie\Url\Url;
 use Symfony\Component\Yaml\Yaml;
 use Throwable;
-use Visus\Cuid2\Cuid2;
 
 class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 {
@@ -53,6 +52,21 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
 
     private const RAILPACK_GENERATED_CONFIG_PATH = '.coolify/railpack.generated.json';
 
+    private const DOCKER_CLIENT_ENV_KEYS = [
+        'BUILDKIT_HOST',
+        'BUILDX_BUILDER',
+        'BUILDX_CONFIG',
+        'DOCKER_API_VERSION',
+        'DOCKER_BUILDKIT',
+        'DOCKER_CERT_PATH',
+        'DOCKER_CLI_EXPERIMENTAL',
+        'DOCKER_CONFIG',
+        'DOCKER_CONTEXT',
+        'DOCKER_HOST',
+        'DOCKER_TLS',
+        'DOCKER_TLS_VERIFY',
+    ];
+
     public $tries = 1;
 
     public $timeout = 3600;
@@ -1032,7 +1046,7 @@ private function write_deployment_configurations()
                 );
             }
             foreach ($this->application->fileStorages as $fileStorage) {
-                if (! $fileStorage->is_based_on_git && ! $fileStorage->is_directory) {
+                if (! $fileStorage->is_host_file && ! $fileStorage->is_based_on_git && ! $fileStorage->is_directory) {
                     $fileStorage->saveStorageOnServer();
                 }
             }
@@ -1702,6 +1716,10 @@ private function generate_buildtime_environment_variables()
             }
 
             foreach ($sorted_environment_variables as $env) {
+                if ($this->build_pack === 'railpack' && $this->is_reserved_docker_client_env_key($env->key)) {
+                    continue;
+                }
+
                 $resolvedValue = $env->getResolvedValueWithServer($this->mainServer);
                 // For literal/multiline vars, real_value includes quotes that we need to remove
                 if ($env->is_literal || $env->is_multiline) {
@@ -1753,6 +1771,10 @@ private function generate_buildtime_environment_variables()
             }
 
             foreach ($sorted_environment_variables as $env) {
+                if ($this->build_pack === 'railpack' && $this->is_reserved_docker_client_env_key($env->key)) {
+                    continue;
+                }
+
                 $resolvedValue = $env->getResolvedValueWithServer($this->mainServer);
                 // For literal/multiline vars, real_value includes quotes that we need to remove
                 if ($env->is_literal || $env->is_multiline) {
@@ -1834,8 +1856,8 @@ private function save_buildtime_environment_variables()
                     ]
                 );
             }
-        } elseif ($this->build_pack === 'dockercompose' || $this->build_pack === 'dockerfile') {
+        } elseif (in_array($this->build_pack, ['dockercompose', 'dockerfile', 'railpack'], true)) {
-            // For Docker Compose and Dockerfile, create an empty .env file even if there are no build-time variables
+            // For build packs that source the build-time .env file, create an empty file even if there are no build-time variables
             // This ensures the file exists when referenced in build commands
             $this->application_deployment_queue->addLogEntry('Creating empty build-time .env file in /artifacts (no build-time variables defined).', hidden: true);
 
@@ -2125,7 +2147,7 @@ private function create_workdir()
     private function prepare_builder_image(bool $firstTry = true)
     {
         $this->checkForCancellation();
-        $helperImage = config('constants.coolify.helper_image');
+        $helperImage = coolifyHelperImage();
         $helperImage = "{$helperImage}:".getHelperVersion();
         // Get user home directory
         $this->serverUserHomeDir = instant_remote_process(['echo $HOME'], $this->server);
@@ -2207,7 +2229,7 @@ private function deploy_to_additional_destinations()
 
                 continue;
             }
-            $deployment_uuid = new Cuid2;
+            $deployment_uuid = new_public_id();
             queue_application_deployment(
                 deployment_uuid: $deployment_uuid,
                 application: $this->application,
@@ -2230,7 +2252,7 @@ private function set_coolify_variables()
 
         // Only include SOURCE_COMMIT in build context if enabled in settings
         if ($this->application->settings->include_source_commit_in_build) {
-            $this->coolify_variables .= "SOURCE_COMMIT={$this->commit} ";
+            $this->coolify_variables .= 'SOURCE_COMMIT='.escapeShellValue($this->commit).' ';
         }
         if ($this->pull_request_id === 0) {
             $fqdn = $this->application->fqdn;
@@ -2242,17 +2264,33 @@ private function set_coolify_variables()
             $fqdn = $url->getHost();
             $url = $url->withHost($fqdn)->withPort(null)->__toString();
             if ((int) $this->application->compose_parsing_version >= 3) {
-                $this->coolify_variables .= "COOLIFY_URL={$url} ";
+                $this->coolify_variables .= 'COOLIFY_URL='.escapeShellValue($url).' ';
-                $this->coolify_variables .= "COOLIFY_FQDN={$fqdn} ";
+                $this->coolify_variables .= 'COOLIFY_FQDN='.escapeShellValue($fqdn).' ';
             } else {
-                $this->coolify_variables .= "COOLIFY_URL={$fqdn} ";
+                $this->coolify_variables .= 'COOLIFY_URL='.escapeShellValue($fqdn).' ';
-                $this->coolify_variables .= "COOLIFY_FQDN={$url} ";
+                $this->coolify_variables .= 'COOLIFY_FQDN='.escapeShellValue($url).' ';
             }
         }
         if (isset($this->application->git_branch)) {
             $this->coolify_variables .= 'COOLIFY_BRANCH='.escapeShellValue($this->application->git_branch).' ';
         }
-        $this->coolify_variables .= "COOLIFY_RESOURCE_UUID={$this->application->uuid} ";
+        $this->coolify_variables .= 'COOLIFY_RESOURCE_UUID='.escapeShellValue($this->application->uuid).' ';
+    }
+
+    private function shellAssignmentForDockerfileArg(string $assignment): string
+    {
+        [$key, $value] = array_pad(explode('=', $assignment, 2), 2, null);
+
+        if ($value === null) {
+            return $assignment;
+        }
+
+        if (str_starts_with($value, "'") && str_ends_with($value, "'")) {
+            $value = substr($value, 1, -1);
+            $value = str_replace("'\\''", "'", $value);
+        }
+
+        return "{$key}={$value}";
     }
 
     private function gitLsRemoteCommand(string $lsRemoteRef, ?string $identityFile = null): string
@@ -2307,6 +2345,8 @@ private function check_git_if_build_needed()
                 ],
                 [
                     executeInDocker($this->deployment_uuid, "echo '{$private_key}' | base64 -d | tee {$customSshKeyLocation} > /dev/null"),
+                    'hidden' => true,
+                    'skip_command_log' => true,
                 ],
                 [
                     executeInDocker($this->deployment_uuid, "chmod 600 {$customSshKeyLocation}"),
@@ -2326,7 +2366,7 @@ private function check_git_if_build_needed()
                 ],
             );
         }
-        if ($this->saved_outputs->get('git_commit_sha') && ! $this->rollback) {
+        if ($this->saved_outputs->get('git_commit_sha') && ! $this->rollback && $this->shouldResolveBranchHeadCommit()) {
             // Extract commit SHA from git ls-remote output, handling multi-line output (e.g., redirect warnings)
             // Expected format: "commit_sha\trefs/heads/branch" possibly preceded by warning lines
             // Note: Git warnings can be on the same line as the result (no newline)
@@ -2358,6 +2398,13 @@ private function check_git_if_build_needed()
         }
     }
 
+    private function shouldResolveBranchHeadCommit(): bool
+    {
+        $commit = trim($this->commit);
+
+        return $commit === '' || $commit === 'HEAD';
+    }
+
     private function clone_repository()
     {
         $importCommands = $this->generate_git_import_commands();
@@ -2366,12 +2413,7 @@ private function clone_repository()
         if ($this->pull_request_id !== 0) {
             $this->application_deployment_queue->addLogEntry("Checking out tag pull/{$this->pull_request_id}/head.");
         }
-        $this->execute_remote_command(
+        $this->execute_remote_command(...$this->gitCommandDefinitions($importCommands));
-            [
-                $importCommands,
-                'hidden' => true,
-            ]
-        );
         $this->create_workdir();
         $this->execute_remote_command(
             [
@@ -2401,6 +2443,39 @@ private function generate_git_import_commands()
         return $commands;
     }
 
+    private function gitCommandDefinitions(Collection|array|string $commands): array
+    {
+        if (is_string($commands)) {
+            return [
+                [
+                    $commands,
+                    'hidden' => true,
+                ],
+            ];
+        }
+
+        return collect($commands)
+            ->map(function ($command): array {
+                if (is_string($command)) {
+                    return [
+                        $command,
+                        'hidden' => true,
+                    ];
+                }
+
+                if (is_array($command)) {
+                    return $command + ['hidden' => true];
+                }
+
+                return [
+                    'command' => $command,
+                    'hidden' => true,
+                ];
+            })
+            ->values()
+            ->all();
+    }
+
     private function cleanup_git()
     {
         $this->execute_remote_command(
@@ -2537,6 +2612,20 @@ private function generate_nixpacks_env_variables()
         $this->env_nixpacks_args = $this->env_nixpacks_args->implode(' ');
     }
 
+    private function is_reserved_docker_client_env_key(?string $key): bool
+    {
+        if (blank($key)) {
+            return false;
+        }
+
+        return in_array(strtoupper($key), self::DOCKER_CLIENT_ENV_KEYS, true);
+    }
+
+    private function without_reserved_docker_client_variables(Collection $variables): Collection
+    {
+        return $variables->reject(fn ($value, $key) => $this->is_reserved_docker_client_env_key((string) $key));
+    }
+
     private function generate_railpack_env_variables(): Collection
     {
         $variables = $this->railpack_build_variables();
@@ -2657,6 +2746,8 @@ private function railpack_build_secret_flags(Collection $variables): string
 
     private function railpack_build_command(string $imageName, Collection $variables): string
     {
+        $variables = $this->without_reserved_docker_client_variables($variables);
+
         $cacheArgs = '';
         if ($this->force_rebuild) {
             $cacheArgs = '--no-cache';
@@ -2668,12 +2759,22 @@ private function railpack_build_command(string $imageName, Collection $variables
             $cacheArgs .= ' --build-arg secrets-hash='.$this->generate_secrets_hash($variables);
         }
 
-        $environmentPrefix = $this->railpack_build_environment_prefix($variables);
+        // Build-time variables reach the build through the sourced build-time .env file
+        // (written by save_buildtime_environment_variables), which interpolates shell-style
+        // references such as BETTER_AUTH_URL=$COOLIFY_URL. Passing them inline via `env`
+        // would forward the literal `$COOLIFY_URL` because each value is single-quoted and
+        // `env` does not interpolate its own assignments. Only buildpack control variables
+        // (NIXPACKS_/RAILPACK_) — which are excluded from the build-time .env file and never
+        // need interpolation — are still passed inline.
+        $controlVariables = $variables->filter(
+            fn ($value, $key) => str($key)->startsWith(EnvironmentVariable::BUILDPACK_CONTROL_VARIABLE_PREFIXES)
+        );
+
+        $environmentPrefix = $this->railpack_build_environment_prefix($controlVariables);
         $secretFlags = $this->railpack_build_secret_flags($variables);
         $frontendImage = 'ghcr.io/railwayapp/railpack-frontend:v'.config('constants.coolify.railpack_version');
 
-        return 'docker buildx create --name coolify-railpack --driver docker-container 2>/dev/null || true'
+        $buildxBuildCommand = "{$environmentPrefix}DOCKER_CONFIG=/root/.docker docker buildx build --builder coolify-railpack"
-            ." && {$environmentPrefix}docker buildx build --builder coolify-railpack"
             ." {$this->addHosts} --network host"
             ." --build-arg BUILDKIT_SYNTAX=\"{$frontendImage}\""
             ." {$cacheArgs}"
@@ -2683,6 +2784,9 @@ private function railpack_build_command(string $imageName, Collection $variables
             .' --load'
             ." -t {$imageName}"
             ." {$this->workdir}";
+
+        return 'DOCKER_CONFIG=/root/.docker docker buildx create --name coolify-railpack --driver docker-container 2>/dev/null || true'
+            .' && '.$this->wrap_build_command_with_env_export($buildxBuildCommand);
     }
 
     private function decode_railpack_config(string $config, string $source): array
@@ -2836,9 +2940,25 @@ private function ensure_docker_buildx_available_for_railpack(): void
         throw new DeploymentException('Railpack deployments require the Docker buildx CLI plugin on the build server. Install or enable docker buildx and retry the deployment.');
     }
 
+    private function ensure_helper_docker_buildx_available_for_railpack(): void
+    {
+        $this->execute_remote_command([
+            executeInDocker($this->deployment_uuid, 'DOCKER_CONFIG=/root/.docker docker buildx version >/dev/null 2>&1 && echo available || echo not-available'),
+            'hidden' => true,
+            'save' => 'railpack_helper_buildx_available',
+        ]);
+
+        if (trim((string) $this->saved_outputs->get('railpack_helper_buildx_available')) === 'available') {
+            return;
+        }
+
+        throw new DeploymentException('Railpack deployments require the Docker buildx CLI plugin inside the Coolify helper container. The helper could not find buildx at /root/.docker/cli-plugins/docker-buildx. Pull the latest helper image and retry the deployment.');
+    }
+
     private function build_railpack_image(): void
     {
         $this->ensure_docker_buildx_available_for_railpack();
+        $this->ensure_helper_docker_buildx_available_for_railpack();
 
         $railpackVariables = $this->generate_railpack_env_variables();
         $railpackConfigPath = $this->generate_railpack_config_file();
@@ -4038,6 +4158,10 @@ private function generate_docker_env_flags_for_secrets()
 
         $variables = $this->env_args;
 
+        if ($this->build_pack === 'railpack') {
+            $variables = $this->without_reserved_docker_client_variables($variables);
+        }
+
         if ($variables->isEmpty()) {
             return '';
         }
@@ -4178,7 +4302,7 @@ private function add_build_env_variables_to_dockerfile()
                 $coolify_vars = collect(explode(' ', trim($this->coolify_variables)))
                     ->filter()
                     ->map(function ($var) {
-                        return "ARG {$var}";
+                        return 'ARG '.$this->shellAssignmentForDockerfileArg($var);
                     });
                 $argsToInsert = $argsToInsert->merge($coolify_vars);
             }
@@ -4200,7 +4324,7 @@ private function add_build_env_variables_to_dockerfile()
                 $coolify_vars = collect(explode(' ', trim($this->coolify_variables)))
                     ->filter()
                     ->map(function ($var) {
-                        return "ARG {$var}";
+                        return 'ARG '.$this->shellAssignmentForDockerfileArg($var);
                     });
                 $argsToInsert = $argsToInsert->merge($coolify_vars);
             }

app/Jobs/CleanupHelperContainersJob.php

@@ -36,7 +36,7 @@ public function handle(): void
                 'active_deployment_uuids' => $activeDeployments,
             ]);
 
-            $containers = instant_remote_process_with_timeout(['docker container ps --format \'{{json .}}\' | jq -s \'map(select(.Image | contains("'.config('constants.coolify.registry_url').'/coollabsio/coolify-helper")))\''], $this->server, false);
+            $containers = instant_remote_process_with_timeout(['docker container ps --format \'{{json .}}\' | jq -s \'map(select(.Image | contains("'.coolifyRegistryUrl().'/coollabsio/coolify-helper")))\''], $this->server, false);
             $helperContainers = collect(json_decode($containers));
 
             if ($helperContainers->count() > 0) {

app/Jobs/DatabaseBackupJob.php

@@ -16,6 +16,7 @@
 use App\Notifications\Database\BackupFailed;
 use App\Notifications\Database\BackupSuccess;
 use App\Notifications\Database\BackupSuccessWithS3Warning;
+use App\Rules\SafeWebhookUrl;
 use Carbon\Carbon;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
@@ -27,7 +28,6 @@
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Str;
 use Throwable;
-use Visus\Cuid2\Cuid2;
 
 class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
 {
@@ -309,7 +309,7 @@ public function handle(): void
                 // Generate unique UUID for each database backup execution
                 $attempts = 0;
                 do {
-                    $this->backup_log_uuid = (string) new Cuid2;
+                    $this->backup_log_uuid = new_public_id();
                     $exists = ScheduledDatabaseBackupExecution::where('uuid', $this->backup_log_uuid)->exists();
                     $attempts++;
                     if ($attempts >= 3 && $exists) {
@@ -715,9 +715,15 @@ private function upload_to_s3(): void
             $escapedEndpoint = escapeshellarg($endpoint);
             $escapedKey = escapeshellarg($key);
             $escapedSecret = escapeshellarg($secret);
+            $escapedBackupLocation = escapeshellarg($this->backup_location);
+            $escapedS3Destination = escapeshellarg("temporary/{$bucket}{$this->backup_dir}/");
+            $resolveOptions = collect(SafeWebhookUrl::minioClientResolveOptions($endpoint))
+                ->map(fn (string $resolveOption): string => '--resolve '.escapeshellarg($resolveOption))
+                ->implode(' ');
+            $resolveOptions = $resolveOptions === '' ? '' : ' '.$resolveOptions;
 
-            $commands[] = "docker exec backup-of-{$this->backup_log_uuid} mc alias set temporary {$escapedEndpoint} {$escapedKey} {$escapedSecret}";
+            $commands[] = "docker exec backup-of-{$this->backup_log_uuid} mc alias set{$resolveOptions} temporary {$escapedEndpoint} {$escapedKey} {$escapedSecret}";
-            $commands[] = "docker exec backup-of-{$this->backup_log_uuid} mc cp $this->backup_location temporary/$bucket{$this->backup_dir}/";
+            $commands[] = "docker exec backup-of-{$this->backup_log_uuid} mc cp {$escapedBackupLocation} {$escapedS3Destination}";
             instant_remote_process($commands, $this->server, true, false, null, disableMultiplexing: true);
 
             $this->s3_uploaded = true;
@@ -733,7 +739,7 @@ private function upload_to_s3(): void
 
     private function getFullImageName(): string
     {
-        $helperImage = config('constants.coolify.helper_image');
+        $helperImage = coolifyHelperImage();
         $latestVersion = getHelperVersion();
 
         return "{$helperImage}:{$latestVersion}";

app/Jobs/ProcessGithubPullRequestWebhook.php

@@ -15,7 +15,6 @@
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
 use Throwable;
-use Visus\Cuid2\Cuid2;
 
 class ProcessGithubPullRequestWebhook implements ShouldBeEncrypted, ShouldQueue
 {
@@ -166,7 +165,7 @@ private function handleOpenAction(Application $application, ?GithubApp $githubAp
         }
 
         // Queue the deployment
-        $deployment_uuid = new Cuid2;
+        $deployment_uuid = new_public_id();
         queue_application_deployment(
             application: $application,
             pull_request_id: $this->pullRequestId,

app/Jobs/SendMessageToDiscordJob.php

@@ -3,6 +3,7 @@
 namespace App\Jobs;
 
 use App\Notifications\Dto\DiscordMessage;
+use App\Rules\SafeWebhookUrl;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
 use Illuminate\Contracts\Queue\ShouldQueue;
@@ -10,6 +11,8 @@
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
 use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Validator;
 
 class SendMessageToDiscordJob implements ShouldBeEncrypted, ShouldQueue
 {
@@ -41,6 +44,31 @@ public function __construct(
      */
     public function handle(): void
     {
-        Http::post($this->webhookUrl, $this->message->toPayload());
+        $validator = Validator::make(
+            ['webhook_url' => $this->webhookUrl],
+            ['webhook_url' => ['required', 'url', new SafeWebhookUrl]]
+        );
+
+        if ($validator->fails()) {
+            Log::warning('SendMessageToDiscordJob: blocked unsafe webhook URL', [
+                'url' => SafeWebhookUrl::redactedUrlForLog($this->webhookUrl),
+                'errors' => $validator->errors()->all(),
+            ]);
+
+            return;
+        }
+
+        try {
+            $httpOptions = SafeWebhookUrl::httpClientOptions($this->webhookUrl);
+        } catch (\RuntimeException $e) {
+            Log::warning('SendMessageToDiscordJob: blocked unsafe webhook URL at send time', [
+                'url' => SafeWebhookUrl::redactedUrlForLog($this->webhookUrl),
+                'error' => $e->getMessage(),
+            ]);
+
+            return;
+        }
+
+        Http::withOptions($httpOptions)->post($this->webhookUrl, $this->message->toPayload());
     }
 }

app/Jobs/SendMessageToSlackJob.php

@@ -3,6 +3,7 @@
 namespace App\Jobs;
 
 use App\Notifications\Dto\SlackMessage;
+use App\Rules\SafeWebhookUrl;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
 use Illuminate\Contracts\Queue\ShouldQueue;
@@ -10,6 +11,8 @@
 use Illuminate\Queue\InteractsWithQueue;
 use Illuminate\Queue\SerializesModels;
 use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Validator;
 
 class SendMessageToSlackJob implements ShouldBeEncrypted, ShouldQueue
 {
@@ -34,8 +37,33 @@ public function __construct(
 
     public function handle(): void
     {
+        $validator = Validator::make(
+            ['webhook_url' => $this->webhookUrl],
+            ['webhook_url' => ['required', 'url', new SafeWebhookUrl]]
+        );
+
+        if ($validator->fails()) {
+            Log::warning('SendMessageToSlackJob: blocked unsafe webhook URL', [
+                'url' => SafeWebhookUrl::redactedUrlForLog($this->webhookUrl),
+                'errors' => $validator->errors()->all(),
+            ]);
+
+            return;
+        }
+
+        try {
+            $httpOptions = SafeWebhookUrl::httpClientOptions($this->webhookUrl);
+        } catch (\RuntimeException $e) {
+            Log::warning('SendMessageToSlackJob: blocked unsafe webhook URL at send time', [
+                'url' => SafeWebhookUrl::redactedUrlForLog($this->webhookUrl),
+                'error' => $e->getMessage(),
+            ]);
+
+            return;
+        }
+
         if ($this->isSlackWebhook()) {
-            $this->sendToSlack();
+            $this->sendToSlack($httpOptions);
 
             return;
         }
@@ -45,7 +73,7 @@ public function handle(): void
          *
          * @see https://github.com/coollabsio/coolify/pull/6139#issuecomment-3756777708
          */
-        $this->sendToMattermost();
+        $this->sendToMattermost($httpOptions);
     }
 
     private function isSlackWebhook(): bool
@@ -62,9 +90,12 @@ private function isSlackWebhook(): bool
         return $scheme === 'https' && $host === 'hooks.slack.com';
     }
 
-    private function sendToSlack(): void
+    /**
+     * @param  array<string, mixed>  $httpOptions
+     */
+    private function sendToSlack(array $httpOptions): void
     {
-        Http::post($this->webhookUrl, [
+        Http::withOptions($httpOptions)->post($this->webhookUrl, [
             'text' => $this->message->title,
             'blocks' => [
                 [
@@ -102,11 +133,14 @@ private function sendToSlack(): void
     /**
      * @todo v5 refactor: Extract this into a separate SendMessageToMattermostJob.php triggered via the "mattermost" notification channel type.
      */
-    private function sendToMattermost(): void
+    /**
+     * @param  array<string, mixed>  $httpOptions
+     */
+    private function sendToMattermost(array $httpOptions): void
     {
         $username = config('app.name');
 
-        Http::post($this->webhookUrl, [
+        Http::withOptions($httpOptions)->post($this->webhookUrl, [
             'username' => $username,
             'attachments' => [
                 [

app/Jobs/SendWebhookJob.php

@@ -50,7 +50,7 @@ public function handle(): void
 
         if ($validator->fails()) {
             Log::warning('SendWebhookJob: blocked unsafe webhook URL', [
-                'url' => $this->webhookUrl,
+                'url' => SafeWebhookUrl::redactedUrlForLog($this->webhookUrl),
                 'errors' => $validator->errors()->all(),
             ]);
 
@@ -64,7 +64,18 @@ public function handle(): void
             ]);
         }
 
-        $response = Http::post($this->webhookUrl, $this->payload);
+        try {
+            $httpOptions = SafeWebhookUrl::httpClientOptions($this->webhookUrl);
+        } catch (\RuntimeException $e) {
+            Log::warning('SendWebhookJob: blocked unsafe webhook URL at send time', [
+                'url' => SafeWebhookUrl::redactedUrlForLog($this->webhookUrl),
+                'error' => $e->getMessage(),
+            ]);
+
+            return;
+        }
+
+        $response = Http::withOptions($httpOptions)->post($this->webhookUrl, $this->payload);
 
         if (isDev()) {
             ray('Webhook response', [

app/Jobs/StripeProcessJob.php

@@ -260,7 +260,10 @@ public function handle(): void
                     $comment = data_get($data, 'cancellation_details.comment');
                     $lookup_key = data_get($data, 'items.data.0.price.lookup_key');
                     if (str($lookup_key)->contains('dynamic')) {
-                        $quantity = min((int) data_get($data, 'items.data.0.quantity', 2), UpdateSubscriptionQuantity::MAX_SERVER_LIMIT);
+                        $quantity = max(
+                            UpdateSubscriptionQuantity::MIN_SERVER_LIMIT,
+                            min((int) data_get($data, 'items.data.0.quantity', 2), UpdateSubscriptionQuantity::MAX_SERVER_LIMIT)
+                        );
                         $team = data_get($subscription, 'team');
                         if ($team) {
                             $team->update([

app/Livewire/Admin/Index.php

@@ -54,6 +54,9 @@ public function submitSearch()
 
     public function getSubscribers()
     {
+        if (Auth::id() !== 0 && ! session('impersonating')) {
+            return redirect()->route('dashboard');
+        }
         $this->inactiveSubscribers = Team::whereRelation('subscription', 'stripe_invoice_paid', false)->count();
         $this->activeSubscribers = Team::whereRelation('subscription', 'stripe_invoice_paid', true)->count();
     }

app/Livewire/Boarding/Index.php

@@ -9,13 +9,15 @@
 use App\Models\Team;
 use App\Services\ConfigurationRepository;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Attributes\Url;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class Index extends Component
 {
+    use AuthorizesRequests;
+
     protected $listeners = [
         'refreshBoardingIndex' => 'validateServer',
         'prerequisitesInstalled' => 'handlePrerequisitesInstalled',
@@ -174,6 +176,9 @@ public function restartBoarding()
 
     public function skipBoarding()
     {
+        if (auth()->user()?->isMember()) {
+            return redirect()->route('dashboard');
+        }
         Team::find(currentTeam()->id)->update([
             'show_boarding' => false,
         ]);
@@ -276,6 +281,7 @@ public function savePrivateKey()
         ]);
 
         try {
+            $this->authorize('create', PrivateKey::class);
             $privateKey = PrivateKey::createAndStore([
                 'name' => $this->privateKeyName,
                 'description' => $this->privateKeyDescription,
@@ -294,6 +300,12 @@ public function saveServer()
     {
         $this->validate();
 
+        try {
+            $this->authorize('create', Server::class);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+
         $this->privateKey = formatPrivateKey($this->privateKey);
         $foundServer = Server::whereIp($this->remoteServerHost)->first();
         if ($foundServer) {
@@ -457,7 +469,7 @@ public function createNewProject()
         $this->createdProject = Project::create([
             'name' => 'My first project',
             'team_id' => currentTeam()->id,
-            'uuid' => (string) new Cuid2,
+            'uuid' => new_public_id(),
         ]);
         $this->currentState = 'create-resource';
     }

app/Livewire/Destination/New/Docker.php

@@ -9,7 +9,6 @@
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class Docker extends Component
 {
@@ -35,7 +34,7 @@ class Docker extends Component
 
     public function mount(?string $server_id = null): void
     {
-        $this->network = (string) new Cuid2;
+        $this->network = new_public_id();
         $this->servers = Server::isUsable()->get();
 
         if (filled($server_id)) {
@@ -68,7 +67,7 @@ public function updatedServerId(): void
 
     public function generateName(): void
     {
-        $name = data_get($this->selectedServer, 'name', new Cuid2);
+        $name = data_get($this->selectedServer, 'name', new_public_id());
         $this->name = str("{$name}-{$this->network}")->kebab();
     }
 

app/Livewire/Destination/Show.php

@@ -3,6 +3,7 @@
 namespace App\Livewire\Destination;
 
 use App\Models\StandaloneDocker;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
@@ -31,8 +32,12 @@ public function mount(string $destination_uuid)
             if (! $destination) {
                 return redirect()->route('destination.index');
             }
+            $this->authorize('view', $destination);
+
             $this->destination = $destination;
             $this->syncData();
+        } catch (AuthorizationException) {
+            abort(403);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }

app/Livewire/MonacoEditor.php

@@ -4,7 +4,6 @@
 
 // use Livewire\Component;
 use Illuminate\View\Component;
-use Visus\Cuid2\Cuid2;
 
 class MonacoEditor extends Component
 {
@@ -40,7 +39,7 @@ public function __construct(
     public function render()
     {
         if (is_null($this->id)) {
-            $this->id = new Cuid2;
+            $this->id = new_public_id();
         }
 
         if (is_null($this->name)) {

app/Livewire/NavbarDeleteTeam.php

@@ -2,12 +2,16 @@
 
 namespace App\Livewire;
 
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\DB;
 use Livewire\Component;
 
 class NavbarDeleteTeam extends Component
 {
+    use AuthorizesRequests;
+
     public $team;
 
     public function mount()
@@ -17,27 +21,35 @@ public function mount()
 
     public function delete($password, $selectedActions = [])
     {
-        if (! verifyPasswordConfirmation($password, $this)) {
+        try {
-            return 'The provided password is incorrect.';
+            if (! verifyPasswordConfirmation($password, $this)) {
+                return 'The provided password is incorrect.';
+            }
+
+            $currentTeam = currentTeam();
+            $this->authorize('delete', $currentTeam);
+
+            $currentTeam->members->each(function ($user) use ($currentTeam) {
+                if ($user->id === Auth::id()) {
+                    return;
+                }
+                $user->teams()->detach($currentTeam);
+                $session = DB::table('sessions')->where('user_id', $user->id)->first();
+                if ($session) {
+                    DB::table('sessions')->where('id', $session->id)->delete();
+                }
+            });
+
+            Cache::forget('user:'.Auth::id().':team:'.$currentTeam->id);
+            $currentTeam->delete();
+
+            $newTeam = Auth::user()->teams()->first();
+            refreshSession($newTeam);
+
+            return redirect()->route('team.index');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-
-        $currentTeam = currentTeam();
-        $currentTeam->delete();
-
-        $currentTeam->members->each(function ($user) use ($currentTeam) {
-            if ($user->id === Auth::id()) {
-                return;
-            }
-            $user->teams()->detach($currentTeam);
-            $session = DB::table('sessions')->where('user_id', $user->id)->first();
-            if ($session) {
-                DB::table('sessions')->where('id', $session->id)->delete();
-            }
-        });
-
-        refreshSession();
-
-        return redirectRoute($this, 'team.index');
     }
 
     public function render()

app/Livewire/Notifications/Discord.php

@@ -110,7 +110,9 @@ public function syncData(bool $toModel = false)
             refreshSession();
         } else {
             $this->discordEnabled = $this->settings->discord_enabled;
-            $this->discordWebhookUrl = $this->settings->discord_webhook_url;
+            $this->discordWebhookUrl = auth()->user()->can('update', $this->settings)
+                ? $this->settings->discord_webhook_url
+                : null;
 
             $this->deploymentSuccessDiscordNotifications = $this->settings->deployment_success_discord_notifications;
             $this->deploymentFailureDiscordNotifications = $this->settings->deployment_failure_discord_notifications;

app/Livewire/Notifications/Email.php

@@ -170,11 +170,15 @@ public function syncData(bool $toModel = false)
             $this->smtpPort = $this->settings->smtp_port;
             $this->smtpEncryption = $this->settings->smtp_encryption;
             $this->smtpUsername = $this->settings->smtp_username;
-            $this->smtpPassword = $this->settings->smtp_password;
+            $this->smtpPassword = auth()->user()->can('update', $this->settings)
+                ? $this->settings->smtp_password
+                : null;
             $this->smtpTimeout = $this->settings->smtp_timeout;
 
             $this->resendEnabled = $this->settings->resend_enabled;
-            $this->resendApiKey = $this->settings->resend_api_key;
+            $this->resendApiKey = auth()->user()->can('update', $this->settings)
+                ? $this->settings->resend_api_key
+                : null;
 
             $this->useInstanceEmailSettings = $this->settings->use_instance_email_settings;
 
@@ -242,6 +246,8 @@ public function instantSave(?string $type = null)
 
     public function submitSmtp()
     {
+        $this->authorize('update', $this->settings);
+
         try {
             $this->resetErrorBag();
             $this->validate([
@@ -289,6 +295,8 @@ public function submitSmtp()
 
     public function submitResend()
     {
+        $this->authorize('update', $this->settings);
+
         try {
             $this->resetErrorBag();
             $this->validate([

app/Livewire/Notifications/Pushover.php

@@ -113,8 +113,13 @@ public function syncData(bool $toModel = false)
             refreshSession();
         } else {
             $this->pushoverEnabled = $this->settings->pushover_enabled;
-            $this->pushoverUserKey = $this->settings->pushover_user_key;
+            if (auth()->user()->can('update', $this->settings)) {
-            $this->pushoverApiToken = $this->settings->pushover_api_token;
+                $this->pushoverUserKey = $this->settings->pushover_user_key;
+                $this->pushoverApiToken = $this->settings->pushover_api_token;
+            } else {
+                $this->pushoverUserKey = null;
+                $this->pushoverApiToken = null;
+            }
 
             $this->deploymentSuccessPushoverNotifications = $this->settings->deployment_success_pushover_notifications;
             $this->deploymentFailurePushoverNotifications = $this->settings->deployment_failure_pushover_notifications;

app/Livewire/Notifications/Slack.php

@@ -110,7 +110,9 @@ public function syncData(bool $toModel = false)
             refreshSession();
         } else {
             $this->slackEnabled = $this->settings->slack_enabled;
-            $this->slackWebhookUrl = $this->settings->slack_webhook_url;
+            $this->slackWebhookUrl = auth()->user()->can('update', $this->settings)
+                ? $this->settings->slack_webhook_url
+                : null;
 
             $this->deploymentSuccessSlackNotifications = $this->settings->deployment_success_slack_notifications;
             $this->deploymentFailureSlackNotifications = $this->settings->deployment_failure_slack_notifications;

app/Livewire/Notifications/Telegram.php

@@ -169,8 +169,13 @@ public function syncData(bool $toModel = false)
             $this->settings->save();
         } else {
             $this->telegramEnabled = $this->settings->telegram_enabled;
-            $this->telegramToken = $this->settings->telegram_token;
+            if (auth()->user()->can('update', $this->settings)) {
-            $this->telegramChatId = $this->settings->telegram_chat_id;
+                $this->telegramToken = $this->settings->telegram_token;
+                $this->telegramChatId = $this->settings->telegram_chat_id;
+            } else {
+                $this->telegramToken = null;
+                $this->telegramChatId = null;
+            }
 
             $this->deploymentSuccessTelegramNotifications = $this->settings->deployment_success_telegram_notifications;
             $this->deploymentFailureTelegramNotifications = $this->settings->deployment_failure_telegram_notifications;

app/Livewire/Notifications/Webhook.php

@@ -105,7 +105,9 @@ public function syncData(bool $toModel = false)
             refreshSession();
         } else {
             $this->webhookEnabled = $this->settings->webhook_enabled;
-            $this->webhookUrl = $this->settings->webhook_url;
+            $this->webhookUrl = auth()->user()->can('update', $this->settings)
+                ? $this->settings->webhook_url
+                : null;
 
             $this->deploymentSuccessWebhookNotifications = $this->settings->deployment_success_webhook_notifications;
             $this->deploymentFailureWebhookNotifications = $this->settings->deployment_failure_webhook_notifications;

app/Livewire/Project/AddEmpty.php

@@ -4,11 +4,13 @@
 
 use App\Models\Project;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class AddEmpty extends Component
 {
+    use AuthorizesRequests;
+
     public string $name;
 
     public string $description = '';
@@ -29,12 +31,13 @@ protected function messages(): array
     public function submit()
     {
         try {
+            $this->authorize('create', Project::class);
             $this->validate();
             $project = Project::create([
                 'name' => $this->name,
                 'description' => $this->description,
                 'team_id' => currentTeam()->id,
-                'uuid' => (string) new Cuid2,
+                'uuid' => new_public_id(),
             ]);
 
             $productionEnvironment = $project->environments()->where('name', 'production')->first();

app/Livewire/Project/Application/Deployment/Show.php

@@ -59,7 +59,9 @@ public function mount()
         $this->application_deployment_queue = $application_deployment_queue;
         $this->horizon_job_status = $this->application_deployment_queue->getHorizonJobStatus();
         $this->deployment_uuid = $deploymentUuid;
-        $this->is_debug_enabled = $this->application->settings->is_debug_enabled;
+        $this->is_debug_enabled = auth()->user()->isMember()
+            ? false
+            : $this->application->settings->is_debug_enabled;
         $this->isKeepAliveOn();
     }
 
@@ -110,6 +112,8 @@ public function getLogLinesProperty()
 
     public function downloadAllLogs(): string
     {
+        $this->authorize('update', $this->application);
+
         $logs = decode_remote_command_output($this->application_deployment_queue, includeAll: true)
             ->map(function ($line) {
                 $prefix = '';

app/Livewire/Project/Application/DeploymentNavbar.php

@@ -6,11 +6,14 @@
 use App\Models\Application;
 use App\Models\ApplicationDeploymentQueue;
 use App\Models\Server;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Carbon;
 use Livewire\Component;
 
 class DeploymentNavbar extends Component
 {
+    use AuthorizesRequests;
+
     public ApplicationDeploymentQueue $application_deployment_queue;
 
     public Application $application;
@@ -25,7 +28,9 @@ public function mount()
     {
         $this->application = Application::ownedByCurrentTeam()->find($this->application_deployment_queue->application_id);
         $this->server = $this->application->destination->server;
-        $this->is_debug_enabled = $this->application->settings->is_debug_enabled;
+        $this->is_debug_enabled = auth()->user()->isMember()
+            ? false
+            : $this->application->settings->is_debug_enabled;
     }
 
     public function deploymentFinished()
@@ -35,15 +40,21 @@ public function deploymentFinished()
 
     public function show_debug()
     {
-        $this->application->settings->is_debug_enabled = ! $this->application->settings->is_debug_enabled;
+        try {
-        $this->application->settings->save();
+            $this->authorize('update', $this->application);
-        $this->is_debug_enabled = $this->application->settings->is_debug_enabled;
+            $this->application->settings->is_debug_enabled = ! $this->application->settings->is_debug_enabled;
-        $this->dispatch('refreshQueue');
+            $this->application->settings->save();
+            $this->is_debug_enabled = $this->application->settings->is_debug_enabled;
+            $this->dispatch('refreshQueue');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function force_start()
     {
         try {
+            $this->authorize('deploy', $this->application);
             force_start_deployment($this->application_deployment_queue);
         } catch (\Throwable $e) {
             return handleError($e, $this);
@@ -58,10 +69,15 @@ public function copyLogsToClipboard(): string
             return '';
         }
 
+        $isMember = auth()->user()->isMember();
+
         $markdown = "# Deployment Logs\n\n";
         $markdown .= "```\n";
 
         foreach ($logs as $log) {
+            if ($isMember && ! empty($log['hidden'])) {
+                continue;
+            }
             if (isset($log['output'])) {
                 $markdown .= $log['output']."\n";
             }
@@ -74,6 +90,11 @@ public function copyLogsToClipboard(): string
 
     public function cancel()
     {
+        try {
+            $this->authorize('deploy', $this->application);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
         $deployment_uuid = $this->application_deployment_queue->deployment_uuid;
         $kill_command = "docker rm -f {$deployment_uuid}";
         $build_server_id = $this->application_deployment_queue->build_server_id ?? $this->application->destination->server_id;

app/Livewire/Project/Application/General.php

@@ -12,8 +12,6 @@
 use Illuminate\Support\Collection;
 use Livewire\Component;
 use Livewire\Features\SupportEvents\Event;
-use Spatie\Url\Url;
-use Visus\Cuid2\Cuid2;
 
 class General extends Component
 {
@@ -143,7 +141,8 @@ protected function rules(): array
         return [
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
-            'fqdn' => 'nullable',
+            'fqdn' => ValidationPatterns::applicationDomainRules(),
+            'parsedServiceDomains.*.domain' => ValidationPatterns::applicationDomainRules(),
             'gitRepository' => 'required',
             'gitBranch' => ['required', 'string', new ValidGitBranch],
             'gitCommitSha' => ['nullable', 'string', 'regex:/^[a-zA-Z0-9][a-zA-Z0-9._\-\/]*$/'],
@@ -549,7 +548,7 @@ public function generateDomain(string $serviceName)
         try {
             $this->authorize('update', $this->application);
 
-            $uuid = new Cuid2;
+            $uuid = new_public_id();
             $domain = generateUrl(server: $this->application->destination->server, random: $uuid);
             $sanitizedKey = str($serviceName)->replace('-', '_')->replace('.', '_')->toString();
             $this->parsedServiceDomains[$sanitizedKey]['domain'] = $domain;
@@ -772,16 +771,7 @@ public function submit($showToaster = true)
             $oldBaseDirectory = $this->application->base_directory;
 
             // Process FQDN with intermediate variable to avoid Collection/string confusion
-            $this->fqdn = str($this->fqdn)->replaceEnd(',', '')->trim()->toString();
+            $this->fqdn = ValidationPatterns::normalizeApplicationDomains($this->fqdn);
-            $this->fqdn = str($this->fqdn)->replaceStart(',', '')->trim()->toString();
-            $domains = str($this->fqdn)->trim()->explode(',')->map(function ($domain) {
-                $domain = trim($domain);
-                Url::fromString($domain, ['http', 'https']);
-
-                return str($domain)->lower();
-            });
-
-            $this->fqdn = $domains->unique()->implode(',');
             $warning = sslipDomainWarning($this->fqdn);
             if ($warning) {
                 $this->dispatch('warning', __('warning.sslipdomain'));
@@ -864,6 +854,9 @@ public function submit($showToaster = true)
                 }
             }
             if ($this->buildPack === 'dockercompose') {
+                foreach ($this->parsedServiceDomains as $serviceName => $service) {
+                    $this->parsedServiceDomains[$serviceName]['domain'] = ValidationPatterns::normalizeApplicationDomains(data_get($service, 'domain'));
+                }
                 $this->application->docker_compose_domains = json_encode($this->parsedServiceDomains);
                 if ($this->application->isDirty('docker_compose_domains')) {
                     foreach ($this->parsedServiceDomains as $service) {

app/Livewire/Project/Application/Heading.php

@@ -7,7 +7,6 @@
 use App\Models\Application;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class Heading extends Component
 {
@@ -65,107 +64,123 @@ public function manualCheckStatus()
 
     public function force_deploy_without_cache()
     {
-        $this->authorize('deploy', $this->application);
+        try {
+            $this->authorize('deploy', $this->application);
 
-        $this->deploy(force_rebuild: true);
+            $this->deploy(force_rebuild: true);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function deploy(bool $force_rebuild = false)
     {
-        $this->authorize('deploy', $this->application);
+        try {
+            $this->authorize('deploy', $this->application);
 
-        if ($this->application->build_pack === 'dockercompose' && is_null($this->application->docker_compose_raw)) {
+            if ($this->application->build_pack === 'dockercompose' && is_null($this->application->docker_compose_raw)) {
-            $this->dispatch('error', 'Failed to deploy', 'Please load a Compose file first.');
+                $this->dispatch('error', 'Failed to deploy', 'Please load a Compose file first.');
 
-            return;
+                return;
+            }
+            if ($this->application->destination->server->isSwarm() && str($this->application->docker_registry_image_name)->isEmpty()) {
+                $this->dispatch('error', 'Failed to deploy.', 'To deploy to a Swarm cluster you must set a Docker image name first.');
+
+                return;
+            }
+            if (data_get($this->application, 'settings.is_build_server_enabled') && str($this->application->docker_registry_image_name)->isEmpty()) {
+                $this->dispatch('error', 'Failed to deploy.', 'To use a build server, you must first set a Docker image.<br>More information here: <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/build-server">documentation</a>');
+
+                return;
+            }
+            if ($this->application->additional_servers->count() > 0 && str($this->application->docker_registry_image_name)->isEmpty()) {
+                $this->dispatch('error', 'Failed to deploy.', 'Before deploying to multiple servers, you must first set a Docker image in the General tab.<br>More information here: <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/multiple-servers">documentation</a>');
+
+                return;
+            }
+            $this->setDeploymentUuid();
+            $result = queue_application_deployment(
+                application: $this->application,
+                deployment_uuid: $this->deploymentUuid,
+                force_rebuild: $force_rebuild,
+            );
+            if ($result['status'] === 'queue_full') {
+                $this->dispatch('error', 'Deployment queue full', $result['message']);
+
+                return;
+            }
+            if ($result['status'] === 'skipped') {
+                $this->dispatch('error', 'Deployment skipped', $result['message']);
+
+                return;
+            }
+
+            return $this->redirectRoute('project.application.deployment.show', [
+                'project_uuid' => $this->parameters['project_uuid'],
+                'application_uuid' => $this->parameters['application_uuid'],
+                'deployment_uuid' => $this->deploymentUuid,
+                'environment_uuid' => $this->parameters['environment_uuid'],
+            ], navigate: false);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-        if ($this->application->destination->server->isSwarm() && str($this->application->docker_registry_image_name)->isEmpty()) {
-            $this->dispatch('error', 'Failed to deploy.', 'To deploy to a Swarm cluster you must set a Docker image name first.');
-
-            return;
-        }
-        if (data_get($this->application, 'settings.is_build_server_enabled') && str($this->application->docker_registry_image_name)->isEmpty()) {
-            $this->dispatch('error', 'Failed to deploy.', 'To use a build server, you must first set a Docker image.<br>More information here: <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/build-server">documentation</a>');
-
-            return;
-        }
-        if ($this->application->additional_servers->count() > 0 && str($this->application->docker_registry_image_name)->isEmpty()) {
-            $this->dispatch('error', 'Failed to deploy.', 'Before deploying to multiple servers, you must first set a Docker image in the General tab.<br>More information here: <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/multiple-servers">documentation</a>');
-
-            return;
-        }
-        $this->setDeploymentUuid();
-        $result = queue_application_deployment(
-            application: $this->application,
-            deployment_uuid: $this->deploymentUuid,
-            force_rebuild: $force_rebuild,
-        );
-        if ($result['status'] === 'queue_full') {
-            $this->dispatch('error', 'Deployment queue full', $result['message']);
-
-            return;
-        }
-        if ($result['status'] === 'skipped') {
-            $this->dispatch('error', 'Deployment skipped', $result['message']);
-
-            return;
-        }
-
-        return $this->redirectRoute('project.application.deployment.show', [
-            'project_uuid' => $this->parameters['project_uuid'],
-            'application_uuid' => $this->parameters['application_uuid'],
-            'deployment_uuid' => $this->deploymentUuid,
-            'environment_uuid' => $this->parameters['environment_uuid'],
-        ], navigate: false);
     }
 
     protected function setDeploymentUuid()
     {
-        $this->deploymentUuid = new Cuid2;
+        $this->deploymentUuid = new_public_id();
         $this->parameters['deployment_uuid'] = $this->deploymentUuid;
     }
 
     public function stop()
     {
-        $this->authorize('deploy', $this->application);
+        try {
+            $this->authorize('deploy', $this->application);
 
-        $this->dispatch('info', 'Gracefully stopping application.<br/>It could take a while depending on the application.');
+            $this->dispatch('info', 'Gracefully stopping application.<br/>It could take a while depending on the application.');
-        StopApplication::dispatch($this->application, false, $this->docker_cleanup);
+            StopApplication::dispatch($this->application, false, $this->docker_cleanup);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function restart()
     {
-        $this->authorize('deploy', $this->application);
+        try {
+            $this->authorize('deploy', $this->application);
 
-        if ($this->application->additional_servers->count() > 0 && str($this->application->docker_registry_image_name)->isEmpty()) {
+            if ($this->application->additional_servers->count() > 0 && str($this->application->docker_registry_image_name)->isEmpty()) {
-            $this->dispatch('error', 'Failed to deploy', 'Before deploying to multiple servers, you must first set a Docker image in the General tab.<br>More information here: <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/multiple-servers">documentation</a>');
+                $this->dispatch('error', 'Failed to deploy', 'Before deploying to multiple servers, you must first set a Docker image in the General tab.<br>More information here: <a target="_blank" class="underline" href="https://coolify.io/docs/knowledge-base/server/multiple-servers">documentation</a>');
 
-            return;
+                return;
+            }
+
+            $this->setDeploymentUuid();
+            $result = queue_application_deployment(
+                application: $this->application,
+                deployment_uuid: $this->deploymentUuid,
+                restart_only: true,
+            );
+            if ($result['status'] === 'queue_full') {
+                $this->dispatch('error', 'Deployment queue full', $result['message']);
+
+                return;
+            }
+            if ($result['status'] === 'skipped') {
+                $this->dispatch('success', 'Deployment skipped', $result['message']);
+
+                return;
+            }
+
+            return $this->redirectRoute('project.application.deployment.show', [
+                'project_uuid' => $this->parameters['project_uuid'],
+                'application_uuid' => $this->parameters['application_uuid'],
+                'deployment_uuid' => $this->deploymentUuid,
+                'environment_uuid' => $this->parameters['environment_uuid'],
+            ], navigate: false);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-
-        $this->setDeploymentUuid();
-        $result = queue_application_deployment(
-            application: $this->application,
-            deployment_uuid: $this->deploymentUuid,
-            restart_only: true,
-        );
-        if ($result['status'] === 'queue_full') {
-            $this->dispatch('error', 'Deployment queue full', $result['message']);
-
-            return;
-        }
-        if ($result['status'] === 'skipped') {
-            $this->dispatch('success', 'Deployment skipped', $result['message']);
-
-            return;
-        }
-
-        return $this->redirectRoute('project.application.deployment.show', [
-            'project_uuid' => $this->parameters['project_uuid'],
-            'application_uuid' => $this->parameters['application_uuid'],
-            'deployment_uuid' => $this->deploymentUuid,
-            'environment_uuid' => $this->parameters['environment_uuid'],
-        ], navigate: false);
     }
 
     public function render()

app/Livewire/Project/Application/Previews.php

@@ -6,10 +6,10 @@
 use App\Jobs\DeleteResourceJob;
 use App\Models\Application;
 use App\Models\ApplicationPreview;
+use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class Previews extends Component
 {
@@ -118,12 +118,14 @@ public function save_preview($preview_id)
             });
 
             if ($previewKey !== false && isset($this->previewFqdns[$previewKey])) {
+                $this->validate([
+                    "previewFqdns.{$previewKey}" => ValidationPatterns::applicationDomainRules(),
+                ]);
+
                 $fqdn = $this->previewFqdns[$previewKey];
 
                 if (! empty($fqdn)) {
-                    $fqdn = str($fqdn)->replaceEnd(',', '')->trim();
+                    $fqdn = ValidationPatterns::normalizeApplicationDomains($fqdn);
-                    $fqdn = str($fqdn)->replaceStart(',', '')->trim();
-                    $fqdn = str($fqdn)->trim()->lower();
                     $this->previewFqdns[$previewKey] = $fqdn;
 
                     if (! validateDNSEntry($fqdn, $this->application->destination->server)) {
@@ -234,31 +236,38 @@ public function add(int $pull_request_id, ?string $pull_request_html_url = null,
 
     public function force_deploy_without_cache(int $pull_request_id, ?string $pull_request_html_url = null)
     {
-        $this->authorize('deploy', $this->application);
+        try {
+            $this->authorize('deploy', $this->application);
 
-        $dockerRegistryImageTag = null;
+            $dockerRegistryImageTag = null;
-        if ($this->application->build_pack === 'dockerimage') {
+            if ($this->application->build_pack === 'dockerimage') {
-            $dockerRegistryImageTag = $this->application->previews()
+                $dockerRegistryImageTag = $this->application->previews()
-                ->where('pull_request_id', $pull_request_id)
+                    ->where('pull_request_id', $pull_request_id)
-                ->value('docker_registry_image_tag');
+                    ->value('docker_registry_image_tag');
+            }
+
+            $this->deploy($pull_request_id, $pull_request_html_url, force_rebuild: true, docker_registry_image_tag: $dockerRegistryImageTag);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-
-        $this->deploy($pull_request_id, $pull_request_html_url, force_rebuild: true, docker_registry_image_tag: $dockerRegistryImageTag);
     }
 
     public function add_and_deploy(int $pull_request_id, ?string $pull_request_html_url = null, ?string $docker_registry_image_tag = null)
     {
-        $this->authorize('deploy', $this->application);
+        try {
+            $this->authorize('deploy', $this->application);
 
-        $this->add($pull_request_id, $pull_request_html_url, $docker_registry_image_tag);
+            $this->add($pull_request_id, $pull_request_html_url, $docker_registry_image_tag);
-        $this->deploy($pull_request_id, $pull_request_html_url, force_rebuild: false, docker_registry_image_tag: $docker_registry_image_tag);
+            $this->deploy($pull_request_id, $pull_request_html_url, force_rebuild: false, docker_registry_image_tag: $docker_registry_image_tag);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function deploy(int $pull_request_id, ?string $pull_request_html_url = null, bool $force_rebuild = false, ?string $docker_registry_image_tag = null)
     {
-        $this->authorize('deploy', $this->application);
-
         try {
+            $this->authorize('deploy', $this->application);
             $this->setDeploymentUuid();
             $found = ApplicationPreview::where('application_id', $this->application->id)->where('pull_request_id', $pull_request_id)->first();
             if (! $found && (! is_null($pull_request_html_url) || ($this->application->build_pack === 'dockerimage' && str($docker_registry_image_tag)->isNotEmpty()))) {
@@ -305,7 +314,7 @@ public function deploy(int $pull_request_id, ?string $pull_request_html_url = nu
 
     protected function setDeploymentUuid()
     {
-        $this->deployment_uuid = new Cuid2;
+        $this->deployment_uuid = new_public_id();
         $this->parameters['deployment_uuid'] = $this->deployment_uuid;
     }
 
@@ -350,9 +359,8 @@ private function stopContainers(array $containers, $server)
 
     public function stop(int $pull_request_id)
     {
-        $this->authorize('deploy', $this->application);
-
         try {
+            $this->authorize('deploy', $this->application);
             $server = $this->application->destination->server;
 
             if ($this->application->destination->server->isSwarm()) {

app/Livewire/Project/Application/PreviewsCompose.php

@@ -3,10 +3,10 @@
 namespace App\Livewire\Project\Application;
 
 use App\Models\ApplicationPreview;
+use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 use Spatie\Url\Url;
-use Visus\Cuid2\Cuid2;
 
 class PreviewsCompose extends Component
 {
@@ -34,6 +34,11 @@ public function save()
     {
         try {
             $this->authorize('update', $this->preview->application);
+            $this->validate([
+                'domain' => ValidationPatterns::applicationDomainRules(),
+            ]);
+
+            $this->domain = ValidationPatterns::normalizeApplicationDomains($this->domain);
 
             $docker_compose_domains = data_get($this->preview, 'docker_compose_domains');
             $docker_compose_domains = json_decode($docker_compose_domains, true) ?: [];
@@ -64,7 +69,7 @@ public function generate()
             if (empty($domain_string)) {
                 $server = $this->preview->application->destination->server;
                 $template = $this->preview->application->preview_url_template;
-                $random = new Cuid2;
+                $random = new_public_id();
 
                 // Generate a unique domain like main app services do
                 $generated_fqdn = generateUrl(server: $server, random: $random);
@@ -74,12 +79,16 @@ public function generate()
                 $preview_fqdn = str_replace('{{pr_id}}', $this->preview->pull_request_id, $preview_fqdn);
                 $preview_fqdn = str($generated_fqdn)->before('://').'://'.$preview_fqdn;
             } else {
+                foreach (ValidationPatterns::validateApplicationDomains($domain_string) as $error) {
+                    throw new \InvalidArgumentException($error);
+                }
+
                 // Use the existing domain from the main application
                 // Handle multiple domains separated by commas
-                $domain_list = explode(',', $domain_string);
+                $domain_list = ValidationPatterns::applicationDomainList($domain_string);
                 $preview_fqdns = [];
                 $template = $this->preview->application->preview_url_template;
-                $random = new Cuid2;
+                $random = new_public_id();
 
                 foreach ($domain_list as $single_domain) {
                     $single_domain = trim($single_domain);

app/Livewire/Project/Application/Rollback.php

@@ -6,7 +6,6 @@
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class Rollback extends Component
 {
@@ -52,7 +51,7 @@ public function rollbackImage($commit)
 
         $commit = validateGitRef($commit, 'rollback commit');
 
-        $deployment_uuid = new Cuid2;
+        $deployment_uuid = new_public_id();
 
         $result = queue_application_deployment(
             application: $this->application,

app/Livewire/Project/Application/Swarm.php

@@ -3,11 +3,14 @@
 namespace App\Livewire\Project\Application;
 
 use App\Models\Application;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
 class Swarm extends Component
 {
+    use AuthorizesRequests;
+
     public Application $application;
 
     #[Validate('required')]
@@ -51,6 +54,7 @@ public function syncData(bool $toModel = false)
     public function instantSave()
     {
         try {
+            $this->authorize('update', $this->application);
             $this->syncData(true);
             $this->dispatch('success', 'Swarm settings updated.');
         } catch (\Throwable $e) {
@@ -61,6 +65,7 @@ public function instantSave()
     public function submit()
     {
         try {
+            $this->authorize('update', $this->application);
             $this->syncData(true);
             $this->dispatch('success', 'Swarm settings updated.');
         } catch (\Throwable $e) {

app/Livewire/Project/CloneMe.php

@@ -11,11 +11,13 @@
 use App\Models\Project;
 use App\Models\Server;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class CloneMe extends Component
 {
+    use AuthorizesRequests;
+
     public string $project_uuid;
 
     public string $environment_uuid;
@@ -61,7 +63,7 @@ public function mount($project_uuid)
             ->servers()
             ->get()
             ->reject(fn ($server) => $server->isBuildServer());
-        $this->newName = str($this->project->name.'-clone-'.(string) new Cuid2)->slug();
+        $this->newName = str($this->project->name.'-clone-'.new_public_id())->slug();
     }
 
     public function toggleVolumeCloning(bool $value)
@@ -91,6 +93,7 @@ public function selectServer($server_id, $destination_id)
     public function clone(string $type)
     {
         try {
+            $this->authorize('create', Project::class);
             $this->validate([
                 'selectedDestination' => 'required',
                 'newName' => ValidationPatterns::nameRules(),
@@ -108,7 +111,7 @@ public function clone(string $type)
                 if ($this->environment->name !== 'production') {
                     $project->environments()->create([
                         'name' => $this->environment->name,
-                        'uuid' => (string) new Cuid2,
+                        'uuid' => new_public_id(),
                     ]);
                 }
                 $environment = $project->environments->where('name', $this->environment->name)->first();
@@ -120,7 +123,7 @@ public function clone(string $type)
                 $project = $this->project;
                 $environment = $this->project->environments()->create([
                     'name' => $this->newName,
-                    'uuid' => (string) new Cuid2,
+                    'uuid' => new_public_id(),
                 ]);
             }
             $applications = $this->environment->applications;
@@ -134,7 +137,7 @@ public function clone(string $type)
             }
 
             foreach ($databases as $database) {
-                $uuid = (string) new Cuid2;
+                $uuid = new_public_id();
                 $newDatabase = $database->replicate([
                     'id',
                     'created_at',
@@ -225,7 +228,7 @@ public function clone(string $type)
 
                 $scheduledBackups = $database->scheduledBackups()->get();
                 foreach ($scheduledBackups as $backup) {
-                    $uuid = (string) new Cuid2;
+                    $uuid = new_public_id();
                     $newBackup = $backup->replicate([
                         'id',
                         'created_at',
@@ -254,7 +257,7 @@ public function clone(string $type)
             }
 
             foreach ($services as $service) {
-                $uuid = (string) new Cuid2;
+                $uuid = new_public_id();
                 $newService = $service->replicate([
                     'id',
                     'created_at',
@@ -278,7 +281,7 @@ public function clone(string $type)
                         'created_at',
                         'updated_at',
                     ])->fill([
-                        'uuid' => (string) new Cuid2,
+                        'uuid' => new_public_id(),
                         'service_id' => $newService->id,
                         'team_id' => currentTeam()->id,
                     ]);
@@ -409,7 +412,7 @@ public function clone(string $type)
 
                     $scheduledBackups = $database->scheduledBackups()->get();
                     foreach ($scheduledBackups as $backup) {
-                        $uuid = (string) new Cuid2;
+                        $uuid = new_public_id();
                         $newBackup = $backup->replicate([
                             'id',
                             'created_at',

app/Livewire/Project/Database/BackupEdit.php

@@ -2,10 +2,13 @@
 
 namespace App\Livewire\Project\Database;
 
+use App\Jobs\DatabaseBackupJob;
+use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ServiceDatabase;
 use Exception;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Collection;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
@@ -17,7 +20,7 @@ class BackupEdit extends Component
     public ScheduledDatabaseBackup $backup;
 
     #[Locked]
-    public $s3s;
+    public $availableS3Storages;
 
     #[Locked]
     public $parameters;
@@ -68,7 +71,7 @@ class BackupEdit extends Component
     public bool $disableLocalBackup = false;
 
     #[Validate(['nullable', 'integer'])]
-    public ?int $s3StorageId = 1;
+    public ?int $s3StorageId = null;
 
     #[Validate(['nullable', 'string'])]
     public ?string $databasesToBackup = null;
@@ -128,7 +131,7 @@ public function syncData(bool $toModel = false)
             $this->databaseBackupRetentionMaxStorageS3 = $this->backup->database_backup_retention_max_storage_s3;
             $this->saveS3 = $this->backup->save_s3;
             $this->disableLocalBackup = $this->backup->disable_local_backup ?? false;
-            $this->s3StorageId = $this->backup->s3_storage_id;
+            $this->s3StorageId = $this->backup->s3_storage_id ?? $this->availableS3StorageIds()->first();
             $this->databasesToBackup = $this->backup->databases_to_backup;
             $this->dumpAll = $this->backup->dump_all;
             $this->timeout = $this->backup->timeout;
@@ -190,6 +193,18 @@ public function delete($password, $selectedActions = [])
         }
     }
 
+    public function backupNow()
+    {
+        try {
+            $this->authorize('manageBackups', $this->backup->database);
+
+            DatabaseBackupJob::dispatch($this->backup);
+            $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
     public function instantSave()
     {
         try {
@@ -202,6 +217,11 @@ public function instantSave()
         }
     }
 
+    public function updatedS3StorageId(): void
+    {
+        $this->instantSave();
+    }
+
     private function customValidate()
     {
         if (! is_numeric($this->backup->s3_storage_id)) {
@@ -209,10 +229,14 @@ private function customValidate()
         }
 
         // S3 backup cannot be enabled without a valid S3 storage owned by the team
-        $availableS3Ids = collect($this->s3s)->pluck('id');
+        $availableS3Ids = $this->availableS3StorageIds();
-        if ($this->backup->save_s3 && ! $availableS3Ids->contains($this->backup->s3_storage_id)) {
+        if ($availableS3Ids->isEmpty()) {
-            $this->backup->save_s3 = $this->saveS3 = false;
             $this->backup->s3_storage_id = $this->s3StorageId = null;
+            if ($this->backup->save_s3) {
+                $this->backup->save_s3 = $this->saveS3 = false;
+            }
+        } elseif (! $availableS3Ids->contains($this->backup->s3_storage_id)) {
+            $this->backup->s3_storage_id = $this->s3StorageId = $availableS3Ids->first();
         }
 
         // Validate that disable_local_backup can only be true when S3 backup is enabled
@@ -227,6 +251,28 @@ private function customValidate()
         $this->validate();
     }
 
+    private function availableS3StorageIds(): Collection
+    {
+        $storages = collect($this->availableS3Storages);
+        $storageIds = $storages->pluck('id')->filter()->all();
+
+        if (empty($storageIds)) {
+            return collect();
+        }
+
+        $teamIds = $storages->pluck('team_id')->reject(fn ($teamId) => $teamId === null)->unique()->values()->all();
+
+        if (empty($teamIds)) {
+            return collect();
+        }
+
+        return S3Storage::query()
+            ->whereKey($storageIds)
+            ->whereIn('team_id', $teamIds)
+            ->where('is_usable', true)
+            ->pluck('id');
+    }
+
     public function submit()
     {
         try {

app/Livewire/Project/Database/BackupExecutions.php

@@ -3,12 +3,16 @@
 namespace App\Livewire\Project\Database;
 
 use App\Models\ScheduledDatabaseBackup;
+use App\Models\ServiceDatabase;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
 
 class BackupExecutions extends Component
 {
+    use AuthorizesRequests;
+
     public ?ScheduledDatabaseBackup $backup = null;
 
     public $database;
@@ -44,29 +48,45 @@ public function getListeners()
 
     public function cleanupFailed()
     {
-        if ($this->backup) {
+        try {
-            $this->backup->executions()->where('status', 'failed')->delete();
+            $this->authorize('manageBackups', $this->database);
-            $this->refreshBackupExecutions();
+            if ($this->backup) {
-            $this->dispatch('success', 'Failed backups cleaned up.');
+                $this->backup->executions()->where('status', 'failed')->delete();
+                $this->refreshBackupExecutions();
+                $this->dispatch('success', 'Failed backups cleaned up.');
+            }
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
     }
 
     public function cleanupDeleted()
     {
-        if ($this->backup) {
+        try {
-            $deletedCount = $this->backup->executions()->where('local_storage_deleted', true)->count();
+            $this->authorize('manageBackups', $this->database);
-            if ($deletedCount > 0) {
+            if ($this->backup) {
-                $this->backup->executions()->where('local_storage_deleted', true)->delete();
+                $deletedCount = $this->backup->executions()->where('local_storage_deleted', true)->count();
-                $this->refreshBackupExecutions();
+                if ($deletedCount > 0) {
-                $this->dispatch('success', "Cleaned up {$deletedCount} backup entries deleted from local storage.");
+                    $this->backup->executions()->where('local_storage_deleted', true)->delete();
-            } else {
+                    $this->refreshBackupExecutions();
-                $this->dispatch('info', 'No backup entries found that are deleted from local storage.');
+                    $this->dispatch('success', "Cleaned up {$deletedCount} backup entries deleted from local storage.");
+                } else {
+                    $this->dispatch('info', 'No backup entries found that are deleted from local storage.');
+                }
             }
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
     }
 
     public function deleteBackup($executionId, $password, $selectedActions = [])
     {
+        try {
+            $this->authorize('manageBackups', $this->database);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+
         if (! verifyPasswordConfirmation($password, $this)) {
             return 'The provided password is incorrect.';
         }
@@ -78,7 +98,7 @@ public function deleteBackup($executionId, $password, $selectedActions = [])
             return;
         }
 
-        $server = $execution->scheduledDatabaseBackup->database->getMorphClass() === \App\Models\ServiceDatabase::class
+        $server = $execution->scheduledDatabaseBackup->database->getMorphClass() === ServiceDatabase::class
             ? $execution->scheduledDatabaseBackup->database->service->destination->server
             : $execution->scheduledDatabaseBackup->database->destination->server;
 
@@ -185,7 +205,7 @@ public function server()
         if ($this->database) {
             $server = null;
 
-            if ($this->database instanceof \App\Models\ServiceDatabase) {
+            if ($this->database instanceof ServiceDatabase) {
                 $server = $this->database->service->destination->server;
             } elseif ($this->database->destination && $this->database->destination->server) {
                 $server = $this->database->destination->server;

app/Livewire/Project/Database/BackupNow.php

@@ -14,9 +14,13 @@ class BackupNow extends Component
 
     public function backupNow()
     {
-        $this->authorize('manageBackups', $this->backup->database);
+        try {
+            $this->authorize('manageBackups', $this->backup->database);
 
-        DatabaseBackupJob::dispatch($this->backup);
+            DatabaseBackupJob::dispatch($this->backup);
-        $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
+            $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 }

app/Livewire/Project/Database/Clickhouse/General.php

@@ -42,6 +42,8 @@ class General extends Component
 
     public bool $isLogDrainEnabled = false;
 
+    public bool $isPasswordHiddenForMember = false;
+
     public function getListeners(): array
     {
         $user = Auth::user();
@@ -72,6 +74,11 @@ public function mount()
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->clickhouseAdminPassword = '';
+        }
     }
 
     protected function rules(): array

app/Livewire/Project/Database/Dragonfly/General.php

@@ -40,6 +40,8 @@ class General extends Component
 
     public bool $isLogDrainEnabled = false;
 
+    public bool $isPasswordHiddenForMember = false;
+
     public function getListeners(): array
     {
         $user = Auth::user();
@@ -70,6 +72,11 @@ public function mount()
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->dragonflyPassword = '';
+        }
     }
 
     protected function rules(): array

app/Livewire/Project/Database/Heading.php

@@ -90,18 +90,28 @@ public function stop()
 
     public function restart()
     {
-        $this->authorize('manage', $this->database);
+        try {
+            $this->authorize('manage', $this->database);
 
-        $activity = RestartDatabase::run($this->database);
+            $activity = RestartDatabase::run($this->database);
-        $this->dispatch('activityMonitor', $activity->id, ServiceStatusChanged::class);
+            $this->js("window.dispatchEvent(new CustomEvent('startdatabase'))");
+            $this->dispatch('activityMonitor', $activity->id, ServiceStatusChanged::class);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function start()
     {
-        $this->authorize('manage', $this->database);
+        try {
+            $this->authorize('manage', $this->database);
 
-        $activity = StartDatabase::run($this->database);
+            $activity = StartDatabase::run($this->database);
-        $this->dispatch('activityMonitor', $activity->id, ServiceStatusChanged::class);
+            $this->js("window.dispatchEvent(new CustomEvent('startdatabase'))");
+            $this->dispatch('activityMonitor', $activity->id, ServiceStatusChanged::class);
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function render()

app/Livewire/Project/Database/ImportForm.php

@@ -14,6 +14,8 @@
 use App\Models\StandaloneMysql;
 use App\Models\StandalonePostgresql;
 use App\Models\StandaloneRedis;
+use App\Rules\SafeWebhookUrl;
+use App\Support\DatabaseBackupFileValidator;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Storage;
@@ -27,11 +29,10 @@ class ImportForm extends Component
 
     /**
      * Validate that a string is safe for use as an S3 bucket name.
-     * Allows alphanumerics, dots, dashes, and underscores.
      */
     private function validateBucketName(string $bucket): bool
     {
-        return preg_match('/^[a-zA-Z0-9.\-_]+$/', $bucket) === 1;
+        return ValidationPatterns::isValidS3BucketName($bucket);
     }
 
     /**
@@ -451,10 +452,20 @@ public function runImport(string $password = ''): bool|string
             // Check if an uploaded file exists first (takes priority over custom location)
             if (Storage::exists($backupFileName)) {
                 $path = Storage::path($backupFileName);
+
+                // Reject malicious PostgreSQL payloads before transferring the file anywhere.
+                if ($this->isPostgresqlRestore() && DatabaseBackupFileValidator::fileContainsPostgresqlProgramExecution($path)) {
+                    Storage::delete($backupFileName);
+                    $this->dispatch('error', 'The uploaded backup contains disallowed PostgreSQL restore directives (COPY ... PROGRAM or psql shell commands) and was rejected.');
+
+                    return true;
+                }
+
                 $tmpPath = '/tmp/'.basename($backupFileName).'_'.$this->resourceUuid;
                 instant_scp($path, $tmpPath, $this->server);
                 Storage::delete($backupFileName);
                 $this->importCommands[] = "docker cp {$tmpPath} {$this->container}:{$tmpPath}";
+                $this->addRestoreSafetyCheckCommand($this->importCommands, $tmpPath);
             } elseif (filled($this->customLocation)) {
                 // Validate the custom location to prevent command injection
                 if (! $this->validateServerPath($this->customLocation)) {
@@ -465,6 +476,7 @@ public function runImport(string $password = ''): bool|string
                 $tmpPath = '/tmp/restore_'.$this->resourceUuid;
                 $escapedCustomLocation = escapeshellarg($this->customLocation);
                 $this->importCommands[] = "docker cp {$escapedCustomLocation} {$this->container}:{$tmpPath}";
+                $this->addRestoreSafetyCheckCommand($this->importCommands, $tmpPath);
             } else {
                 $this->dispatch('error', 'The file does not exist or has been deleted.');
 
@@ -570,7 +582,7 @@ public function checkS3File()
 
             // Validate bucket name early
             if (! $this->validateBucketName($s3Storage->bucket)) {
-                $this->dispatch('error', 'Invalid S3 bucket name. Bucket name must contain only alphanumerics, dots, dashes, and underscores.');
+                $this->dispatch('error', 'Invalid S3 bucket name. Bucket name must contain only lowercase letters, numbers, dots, and dashes, and must follow S3 bucket naming rules.');
 
                 return;
             }
@@ -587,6 +599,7 @@ public function checkS3File()
                 'bucket' => $s3Storage->bucket,
                 'endpoint' => $s3Storage->endpoint,
                 'use_path_style_endpoint' => true,
+                'http' => SafeWebhookUrl::httpClientOptions($s3Storage->endpoint),
             ]);
 
             // Check if file exists
@@ -651,7 +664,7 @@ public function restoreFromS3(string $password = ''): bool|string
 
             // Validate bucket name to prevent command injection
             if (! $this->validateBucketName($bucket)) {
-                $this->dispatch('error', 'Invalid S3 bucket name. Bucket name must contain only alphanumerics, dots, dashes, and underscores.');
+                $this->dispatch('error', 'Invalid S3 bucket name. Bucket name must contain only lowercase letters, numbers, dots, and dashes, and must follow S3 bucket naming rules.');
 
                 return true;
             }
@@ -667,7 +680,7 @@ public function restoreFromS3(string $password = ''): bool|string
             }
 
             // Get helper image
-            $helperImage = config('constants.coolify.helper_image');
+            $helperImage = coolifyHelperImage();
             $latestVersion = getHelperVersion();
             $fullImageName = "{$helperImage}:{$latestVersion}";
 
@@ -721,6 +734,7 @@ public function restoreFromS3(string $password = ''): bool|string
             // 6. Copy from helper to server, then immediately to database container
             $commands[] = "docker cp {$escapedHelperContainerPath} {$escapedServerTmpPath}";
             $commands[] = "docker cp {$escapedServerTmpPath} {$escapedDatabaseContainerTmpPath}";
+            $this->addRestoreSafetyCheckCommand($commands, $containerTmpPath);
 
             // 7. Cleanup helper container and server temp file immediately (no longer needed)
             $commands[] = "docker rm -f {$containerName} 2>/dev/null || true";
@@ -765,6 +779,69 @@ public function restoreFromS3(string $password = ''): bool|string
         return true;
     }
 
+    public function buildRestoreSafetyCheckCommand(string $tmpPath): ?string
+    {
+        $script = $this->buildPostgresRestoreScanScript($tmpPath);
+
+        if ($script === null) {
+            return null;
+        }
+
+        return "docker exec {$this->container} sh -c ".escapeshellarg($script);
+    }
+
+    /**
+     * Build the POSIX shell snippet that aborts (exit 1) when a PostgreSQL
+     * backup contains directives leading to OS command execution.
+     *
+     * Hardened against bypasses:
+     *  - decompresses gzip backups before scanning,
+     *  - strips `--` line comments and flattens newlines so multi-line and
+     *    comment-separated payloads (e.g. `FROM/**​/PROGRAM`) are caught,
+     *  - matches a literal `\!` shell escape and `\o|`/`\g|` pipe redirects.
+     */
+    public function buildPostgresRestoreScanScript(string $tmpPath): ?string
+    {
+        if (! $this->isPostgresqlRestore()) {
+            return null;
+        }
+
+        $escapedTmpPath = escapeshellarg($tmpPath);
+
+        // Token separator PostgreSQL treats as whitespace: real whitespace or a
+        // /* ... */ block comment (used to split keywords like FROM/**/PROGRAM).
+        $sep = '([[:space:]]|/\\*[^*]*\\*/)';
+
+        $pattern = implode('|', [
+            "copy{$sep}+[^;]*(from|to){$sep}+program",
+            '(^|[[:space:]])\\\\!',
+            "(^|[[:space:]])\\\\(o|g){$sep}*\\|",
+        ]);
+        $escapedPattern = escapeshellarg($pattern);
+
+        return "if (gunzip -cf {$escapedTmpPath} 2>/dev/null || cat {$escapedTmpPath}) | sed 's/--.*//' | tr '\n\r\t' '   ' | grep -Eiq {$escapedPattern}; then echo 'Blocked PostgreSQL restore: COPY ... PROGRAM and psql shell commands are not allowed.'; exit 1; fi";
+    }
+
+    private function addRestoreSafetyCheckCommand(array &$commands, string $tmpPath): void
+    {
+        $command = $this->buildRestoreSafetyCheckCommand($tmpPath);
+
+        if ($command !== null) {
+            $commands[] = $command;
+        }
+    }
+
+    private function isPostgresqlRestore(): bool
+    {
+        $morphClass = $this->resource->getMorphClass();
+
+        if ($morphClass === ServiceDatabase::class) {
+            return str_contains($this->resource->databaseType(), 'postgres');
+        }
+
+        return $morphClass === StandalonePostgresql::class || $morphClass === 'postgresql';
+    }
+
     public function buildRestoreCommand(string $tmpPath): string
     {
         $escapedTmpPath = escapeshellarg($tmpPath);

app/Livewire/Project/Database/InitScript.php

@@ -2,13 +2,20 @@
 
 namespace App\Livewire\Project\Database;
 
+use App\Models\StandalonePostgresql;
 use Exception;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
 class InitScript extends Component
 {
+    use AuthorizesRequests;
+
+    #[Locked]
+    public StandalonePostgresql $database;
+
     #[Locked]
     public array $script;
 
@@ -35,6 +42,7 @@ public function mount()
     public function submit()
     {
         try {
+            $this->authorize('update', $this->database);
             $this->validate();
             $this->script['index'] = $this->index;
             $this->script['content'] = $this->content;
@@ -48,6 +56,7 @@ public function submit()
     public function delete()
     {
         try {
+            $this->authorize('update', $this->database);
             $this->dispatch('delete_init_script', $this->script);
         } catch (Exception $e) {
             return handleError($e, $this);

app/Livewire/Project/Database/Keydb/General.php

@@ -42,6 +42,8 @@ class General extends Component
 
     public bool $isLogDrainEnabled = false;
 
+    public bool $isPasswordHiddenForMember = false;
+
     public function getListeners(): array
     {
         $user = Auth::user();
@@ -72,6 +74,11 @@ public function mount()
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->keydbPassword = '';
+        }
     }
 
     protected function rules(): array

app/Livewire/Project/Database/Mariadb/General.php

@@ -47,6 +47,8 @@ class General extends Component
 
     public ?string $customDockerRunOptions = null;
 
+    public bool $isPasswordHiddenForMember = false;
+
     protected function rules(): array
     {
         return [
@@ -126,6 +128,12 @@ public function mount()
         } catch (Exception $e) {
             return handleError($e, $this);
         }
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->mariadbRootPassword = '';
+            $this->mariadbPassword = '';
+        }
     }
 
     public function syncData(bool $toModel = false)

app/Livewire/Project/Database/Mongodb/General.php

@@ -45,6 +45,8 @@ class General extends Component
 
     public ?string $customDockerRunOptions = null;
 
+    public bool $isPasswordHiddenForMember = false;
+
     protected function rules(): array
     {
         return [
@@ -119,6 +121,11 @@ public function mount()
         } catch (Exception $e) {
             return handleError($e, $this);
         }
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->mongoInitdbRootPassword = '';
+        }
     }
 
     public function syncData(bool $toModel = false)

app/Livewire/Project/Database/Mysql/General.php

@@ -47,6 +47,8 @@ class General extends Component
 
     public ?string $customDockerRunOptions = null;
 
+    public bool $isPasswordHiddenForMember = false;
+
     protected function rules(): array
     {
         return [
@@ -126,6 +128,12 @@ public function mount()
         } catch (Exception $e) {
             return handleError($e, $this);
         }
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->mysqlRootPassword = '';
+            $this->mysqlPassword = '';
+        }
     }
 
     public function syncData(bool $toModel = false)

app/Livewire/Project/Database/Postgresql/General.php

@@ -55,6 +55,8 @@ class General extends Component
 
     public string $new_content;
 
+    public bool $isPasswordHiddenForMember = false;
+
     protected $listeners = [
         'save_init_script',
         'delete_init_script',
@@ -140,6 +142,11 @@ public function mount()
         } catch (Exception $e) {
             return handleError($e, $this);
         }
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->postgresPassword = '';
+        }
     }
 
     public function syncData(bool $toModel = false)

app/Livewire/Project/Database/Redis/General.php

@@ -45,6 +45,8 @@ class General extends Component
 
     public string $redisVersion;
 
+    public bool $isPasswordHiddenForMember = false;
+
     protected $listeners = [
         'envsUpdated' => 'refresh',
     ];
@@ -118,6 +120,11 @@ public function mount()
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
+
+        $this->isPasswordHiddenForMember = auth()->user()?->isMember() ?? false;
+        if ($this->isPasswordHiddenForMember) {
+            $this->redisPassword = '';
+        }
     }
 
     public function syncData(bool $toModel = false)

app/Livewire/Project/Database/ScheduledBackups.php

@@ -3,6 +3,7 @@
 namespace App\Livewire\Project\Database;
 
 use App\Models\ScheduledDatabaseBackup;
+use App\Models\ServiceDatabase;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
@@ -34,7 +35,7 @@ public function mount(): void
             $this->setSelectedBackup($this->selectedBackupId, true);
         }
         $this->parameters = get_route_parameters();
-        if ($this->database->getMorphClass() === \App\Models\ServiceDatabase::class) {
+        if ($this->database->getMorphClass() === ServiceDatabase::class) {
             $this->type = 'service-database';
         } else {
             $this->type = 'database';
@@ -56,22 +57,30 @@ public function setSelectedBackup($backupId, $force = false)
 
     public function setCustomType()
     {
-        $this->authorize('update', $this->database);
+        try {
+            $this->authorize('update', $this->database);
 
-        $this->database->custom_type = $this->custom_type;
+            $this->database->custom_type = $this->custom_type;
-        $this->database->save();
+            $this->database->save();
-        $this->dispatch('success', 'Database type set.');
+            $this->dispatch('success', 'Database type set.');
-        $this->refreshScheduledBackups();
+            $this->refreshScheduledBackups();
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
     }
 
     public function delete($scheduled_backup_id): void
     {
-        $backup = $this->database->scheduledBackups->find($scheduled_backup_id);
+        try {
-        $this->authorize('manageBackups', $this->database);
+            $this->authorize('manageBackups', $this->database);
 
-        $backup->delete();
+            $backup = $this->database->scheduledBackups->find($scheduled_backup_id);
-        $this->dispatch('success', 'Scheduled backup deleted.');
+            $backup->delete();
-        $this->refreshScheduledBackups();
+            $this->dispatch('success', 'Scheduled backup deleted.');
+            $this->refreshScheduledBackups();
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
     }
 
     public function refreshScheduledBackups(?int $id = null): void

app/Livewire/Project/DeleteEnvironment.php

@@ -28,18 +28,22 @@ public function mount()
 
     public function delete()
     {
-        $this->validate([
+        try {
-            'environment_id' => 'required|int',
+            $this->validate([
-        ]);
+                'environment_id' => 'required|int',
-        $environment = Environment::ownedByCurrentTeam()->findOrFail($this->environment_id);
+            ]);
-        $this->authorize('delete', $environment);
+            $environment = Environment::ownedByCurrentTeam()->findOrFail($this->environment_id);
+            $this->authorize('delete', $environment);
 
-        if ($environment->isEmpty()) {
+            if ($environment->isEmpty()) {
-            $environment->delete();
+                $environment->delete();
 
-            return redirectRoute($this, 'project.show', ['project_uuid' => $this->parameters['project_uuid']]);
+                return redirectRoute($this, 'project.show', ['project_uuid' => $this->parameters['project_uuid']]);
+            }
+
+            return $this->dispatch('error', "<strong>Environment {$environment->name}</strong> has defined resources, please delete them first.");
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-
-        return $this->dispatch('error', "<strong>Environment {$environment->name}</strong> has defined resources, please delete them first.");
     }
 }

app/Livewire/Project/DeleteProject.php

@@ -26,18 +26,22 @@ public function mount()
 
     public function delete()
     {
-        $this->validate([
+        try {
-            'project_id' => 'required|int',
+            $this->validate([
-        ]);
+                'project_id' => 'required|int',
-        $project = Project::ownedByCurrentTeam()->findOrFail($this->project_id);
+            ]);
-        $this->authorize('delete', $project);
+            $project = Project::ownedByCurrentTeam()->findOrFail($this->project_id);
+            $this->authorize('delete', $project);
 
-        if ($project->isEmpty()) {
+            if ($project->isEmpty()) {
-            $project->delete();
+                $project->delete();
 
-            return redirectRoute($this, 'project.index');
+                return redirectRoute($this, 'project.index');
+            }
+
+            return $this->dispatch('error', "<strong>Project {$project->name}</strong> has resources defined, please delete them first.");
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
         }
-
-        return $this->dispatch('error', "<strong>Project {$project->name}</strong> has resources defined, please delete them first.");
     }
 }

app/Livewire/Project/Edit.php

@@ -4,10 +4,13 @@
 
 use App\Models\Project;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Edit extends Component
 {
+    use AuthorizesRequests;
+
     public Project $project;
 
     public string $name;
@@ -54,6 +57,7 @@ public function syncData(bool $toModel = false)
     public function submit()
     {
         try {
+            $this->authorize('update', $this->project);
             $this->syncData(true);
             $this->dispatch('success', 'Project updated.');
         } catch (\Throwable $e) {

app/Livewire/Project/EnvironmentEdit.php

@@ -5,11 +5,14 @@
 use App\Models\Application;
 use App\Models\Project;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Component;
 
 class EnvironmentEdit extends Component
 {
+    use AuthorizesRequests;
+
     public Project $project;
 
     public Application $application;
@@ -62,6 +65,7 @@ public function syncData(bool $toModel = false)
     public function submit()
     {
         try {
+            $this->authorize('update', $this->environment);
             $this->syncData(true);
             redirectRoute($this, 'project.environment.edit', [
                 'environment_uuid' => $this->environment->uuid,

app/Livewire/Project/New/DockerCompose.php

@@ -5,11 +5,14 @@
 use App\Models\EnvironmentVariable;
 use App\Models\Project;
 use App\Models\Service;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 use Symfony\Component\Yaml\Yaml;
 
 class DockerCompose extends Component
 {
+    use AuthorizesRequests;
+
     public string $dockerComposeRaw = '';
 
     public string $envFile = '';
@@ -30,6 +33,8 @@ public function mount()
     public function submit()
     {
         try {
+            $this->authorize('create', Service::class);
+
             $this->validate([
                 'dockerComposeRaw' => 'required',
             ]);

app/Livewire/Project/New/DockerImage.php

@@ -6,11 +6,13 @@
 use App\Models\Project;
 use App\Services\DockerImageParser;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class DockerImage extends Component
 {
+    use AuthorizesRequests;
+
     public string $imageName = '';
 
     public string $imageTag = '';
@@ -81,6 +83,8 @@ public function updatedImageName(): void
 
     public function submit()
     {
+        $this->authorize('create', Application::class);
+
         $this->validate([
             'imageName' => ValidationPatterns::dockerImageNameRules(required: true),
             'imageTag' => ValidationPatterns::dockerImageTagRules(),
@@ -130,7 +134,7 @@ public function submit()
         $imageTag = $parser->isImageHash() ? 'sha256-'.$parser->getTag() : $parser->getTag();
 
         $application = Application::create([
-            'name' => 'docker-image-'.new Cuid2,
+            'name' => 'docker-image-'.new_public_id(),
             'repository_project_id' => 0,
             'git_repository' => 'coollabsio/coolify',
             'git_branch' => 'main',

app/Livewire/Project/New/EmptyProject.php

@@ -3,17 +3,21 @@
 namespace App\Livewire\Project\New;
 
 use App\Models\Project;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class EmptyProject extends Component
 {
+    use AuthorizesRequests;
+
     public function createEmptyProject()
     {
+        $this->authorize('create', Project::class);
+
         $project = Project::create([
             'name' => generate_random_name(),
             'team_id' => currentTeam()->id,
-            'uuid' => (string) new Cuid2,
+            'uuid' => new_public_id(),
         ]);
 
         return redirectRoute($this, 'project.show', ['project_uuid' => $project->uuid, 'environment_uuid' => $project->environments->first()->uuid]);

app/Livewire/Project/New/GithubPrivateRepository.php

@@ -7,6 +7,7 @@
 use App\Models\Project;
 use App\Rules\ValidGitBranch;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Route;
 use Livewire\Attributes\Locked;
@@ -14,6 +15,8 @@
 
 class GithubPrivateRepository extends Component
 {
+    use AuthorizesRequests;
+
     public $current_step = 'github_apps';
 
     public $github_apps;
@@ -169,6 +172,8 @@ protected function loadBranchByPage()
     public function submit()
     {
         try {
+            $this->authorize('create', Application::class);
+
             // Validate git repository parts and branch
             $validator = validator([
                 'selected_repository_owner' => $this->selected_repository_owner,

app/Livewire/Project/New/GithubPrivateRepositoryDeployKey.php

@@ -10,12 +10,15 @@
 use App\Rules\ValidGitBranch;
 use App\Rules\ValidGitRepositoryUrl;
 use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Str;
 use Livewire\Component;
 use Spatie\Url\Url;
 
 class GithubPrivateRepositoryDeployKey extends Component
 {
+    use AuthorizesRequests;
+
     public $current_step = 'private_keys';
 
     public $parameters;
@@ -128,6 +131,8 @@ public function setPrivateKey($private_key_id)
 
     public function submit()
     {
+        $this->authorize('create', Application::class);
+
         $this->validate();
         try {
             $destination_uuid = $this->query['destination'] ?? null;

app/Livewire/Project/New/PublicGitRepository.php

@@ -6,16 +6,18 @@
 use App\Models\GithubApp;
 use App\Models\GitlabApp;
 use App\Models\Project;
-use App\Models\Service;
 use App\Rules\ValidGitBranch;
 use App\Rules\ValidGitRepositoryUrl;
 use App\Support\ValidationPatterns;
 use Carbon\Carbon;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 use Spatie\Url\Url;
 
 class PublicGitRepository extends Component
 {
+    use AuthorizesRequests;
+
     public string $repository_url;
 
     public int $port = 3000;
@@ -260,6 +262,8 @@ private function getBranch()
     public function submit()
     {
         try {
+            $this->authorize('create', Application::class);
+
             $this->validate();
 
             // Additional validation for git repository and branch
@@ -295,33 +299,6 @@ public function submit()
             $project = Project::ownedByCurrentTeam()->where('uuid', $project_uuid)->firstOrFail();
             $environment = $project->environments()->where('uuid', $environment_uuid)->firstOrFail();
 
-            if ($this->build_pack === 'dockercompose' && isDev() && $this->new_compose_services) {
-                $server = $destination->server;
-                $new_service = [
-                    'name' => 'service'.str()->random(10),
-                    'docker_compose_raw' => 'coolify',
-                    'environment_id' => $environment->id,
-                    'server_id' => $server->id,
-                ];
-                if ($this->git_source === 'other') {
-                    $new_service['git_repository'] = $this->git_repository;
-                    $new_service['git_branch'] = $this->git_branch;
-                } else {
-                    $new_service['git_repository'] = $this->git_repository;
-                    $new_service['git_branch'] = $this->git_branch;
-                    $new_service['source_id'] = $this->git_source->id;
-                    $new_service['source_type'] = $this->git_source->getMorphClass();
-                }
-                $service = Service::create($new_service);
-
-                return redirect()->route('project.service.configuration', [
-                    'service_uuid' => $service->uuid,
-                    'environment_uuid' => $environment->uuid,
-                    'project_uuid' => $project->uuid,
-                ]);
-
-                return;
-            }
             if ($this->git_source === 'other') {
                 $application_init = [
                     'name' => generate_random_name(),

app/Livewire/Project/New/Select.php

@@ -112,14 +112,17 @@ public function loadServices()
             $default_logo = 'images/default.webp';
             $logo = data_get($service, 'logo', $default_logo);
             $local_logo_path = public_path($logo);
+            $serviceKey = (string) $key;
 
             return [
-                'name' => str($key)->headline(),
+                'id' => $serviceKey,
+                'name' => str($serviceKey)->headline(),
+                'docsSlug' => str($serviceKey)->lower()->value(),
                 'logo' => asset($logo),
                 'logo_github_url' => file_exists($local_logo_path)
                     ? 'https://raw.githubusercontent.com/coollabsio/coolify/refs/heads/main/public/'.$logo
                     : asset($default_logo),
-                'templateLastUpdated' => $templateLastUpdatedMap[(string) $key] ?? null,
+                'templateLastUpdated' => $templateLastUpdatedMap[$serviceKey] ?? null,
             ] + (array) $service;
         })->all();
 
@@ -336,7 +339,10 @@ private function formatLastModified(string $path): ?string
 
     public function setType(string $type)
     {
-        $type = str($type)->lower()->slug()->value();
+        if (! str($type)->startsWith('one-click-service-')) {
+            $type = str($type)->lower()->slug()->value();
+        }
+
         if ($this->loading) {
             return;
         }

app/Livewire/Project/New/SimpleDockerfile.php

@@ -5,11 +5,13 @@
 use App\Models\Application;
 use App\Models\GithubApp;
 use App\Models\Project;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
-use Visus\Cuid2\Cuid2;
 
 class SimpleDockerfile extends Component
 {
+    use AuthorizesRequests;
+
     public string $dockerfile = '';
 
     public array $parameters;
@@ -30,6 +32,8 @@ public function mount()
 
     public function submit()
     {
+        $this->authorize('create', Application::class);
+
         $this->validate([
             'dockerfile' => 'required',
         ]);
@@ -48,7 +52,7 @@ public function submit()
             $port = 80;
         }
         $application = Application::create([
-            'name' => 'dockerfile-'.new Cuid2,
+            'name' => 'dockerfile-'.new_public_id(),
             'repository_project_id' => 0,
             'git_repository' => 'coollabsio/coolify',
             'git_branch' => 'main',

app/Livewire/Project/Resource/Create.php

@@ -4,16 +4,20 @@
 
 use App\Models\EnvironmentVariable;
 use App\Models\Service;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Create extends Component
 {
+    use AuthorizesRequests;
+
     public $type;
 
     public $project;
 
     public function mount()
     {
+        $this->authorize('createAnyResource');
 
         $type = str(request()->query('type'));
         $destination_uuid = request()->query('destination');

app/Livewire/Project/Service/EditCompose.php

@@ -3,10 +3,13 @@
 namespace App\Livewire\Project\Service;
 
 use App\Models\Service;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class EditCompose extends Component
 {
+    use AuthorizesRequests;
+
     public Service $service;
 
     public $serviceId;
@@ -72,19 +75,29 @@ public function validateCompose()
 
     public function saveEditedCompose()
     {
-        $this->dispatch('info', 'Saving new docker compose...');
+        try {
-        $this->dispatch('saveCompose', $this->dockerComposeRaw);
+            $this->authorize('update', $this->service);
-        $this->dispatch('refreshStorages');
+            $this->dispatch('info', 'Saving new docker compose...');
+            $this->dispatch('saveCompose', $this->dockerComposeRaw);
+            $this->dispatch('refreshStorages');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function instantSave()
     {
-        $this->validate([
+        try {
-            'isContainerLabelEscapeEnabled' => 'required',
+            $this->authorize('update', $this->service);
-        ]);
+            $this->validate([
-        $this->syncData(true);
+                'isContainerLabelEscapeEnabled' => 'required',
-        $this->service->save(['is_container_label_escape_enabled' => $this->isContainerLabelEscapeEnabled]);
+            ]);
-        $this->dispatch('success', 'Service updated successfully');
+            $this->syncData(true);
+            $this->service->save(['is_container_label_escape_enabled' => $this->isContainerLabelEscapeEnabled]);
+            $this->dispatch('success', 'Service updated successfully');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function render()

app/Livewire/Project/Service/EditDomain.php

@@ -3,10 +3,10 @@
 namespace App\Livewire\Project\Service;
 
 use App\Models\ServiceApplication;
+use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
-use Spatie\Url\Url;
 
 class EditDomain extends Component
 {
@@ -28,12 +28,15 @@ class EditDomain extends Component
 
     public $requiredPort = null;
 
-    #[Validate(['nullable'])]
+    #[Validate]
     public ?string $fqdn = null;
 
-    protected $rules = [
+    protected function rules(): array
-        'fqdn' => 'nullable',
+    {
-    ];
+        return [
+            'fqdn' => ValidationPatterns::applicationDomainRules(),
+        ];
+    }
 
     public function mount()
     {
@@ -82,15 +85,9 @@ public function submit()
     {
         try {
             $this->authorize('update', $this->application);
-            $this->fqdn = str($this->fqdn)->replaceEnd(',', '')->trim()->toString();
+            $this->validate();
-            $this->fqdn = str($this->fqdn)->replaceStart(',', '')->trim()->toString();
-            $domains = str($this->fqdn)->trim()->explode(',')->map(function ($domain) {
-                $domain = trim($domain);
-                Url::fromString($domain, ['http', 'https']);
 
-                return str($domain)->lower();
+            $this->fqdn = ValidationPatterns::normalizeApplicationDomains($this->fqdn);
-            });
-            $this->fqdn = $domains->unique()->implode(',');
             $warning = sslipDomainWarning($this->fqdn);
             if ($warning) {
                 $this->dispatch('warning', __('warning.sslipdomain'));

app/Livewire/Project/Service/FileStorage.php

@@ -94,6 +94,10 @@ public function convertToDirectory()
         try {
             $this->authorize('update', $this->resource);
 
+            if ($this->fileStorage->is_host_file) {
+                throw new \Exception('Host file mounts are bind-only and cannot be converted.');
+            }
+
             $this->fileStorage->deleteStorageOnServer();
             $this->fileStorage->is_directory = true;
             $this->fileStorage->content = null;
@@ -110,8 +114,11 @@ public function convertToDirectory()
     public function loadStorageOnServer()
     {
         try {
-            // Loading content is a read operation, so we use 'view' permission
+            $this->authorize('update', $this->resource);
-            $this->authorize('view', $this->resource);
+
+            if ($this->fileStorage->is_host_file) {
+                throw new \Exception('Host file mounts are bind-only and cannot be loaded from the server.');
+            }
 
             $this->fileStorage->loadStorageOnServer();
             $this->syncData();
@@ -128,6 +135,10 @@ public function convertToFile()
         try {
             $this->authorize('update', $this->resource);
 
+            if ($this->fileStorage->is_host_file) {
+                throw new \Exception('Host file mounts are bind-only and cannot be converted.');
+            }
+
             $this->fileStorage->deleteStorageOnServer();
             $this->fileStorage->is_directory = false;
             $this->fileStorage->content = null;
@@ -155,8 +166,10 @@ public function delete($password, $selectedActions = [])
             $message = 'File deleted.';
             if ($this->fileStorage->is_directory) {
                 $message = 'Directory deleted.';
+            } elseif ($this->fileStorage->is_host_file) {
+                $message = 'Host file mount removed.';
             }
-            if ($this->permanently_delete) {
+            if ($this->permanently_delete && ! $this->fileStorage->is_host_file) {
                 $message = 'Directory deleted from the server.';
                 $this->fileStorage->deleteStorageOnServer();
             }
@@ -175,6 +188,12 @@ public function submit()
     {
         $this->authorize('update', $this->resource);
 
+        if ($this->fileStorage->is_host_file) {
+            $this->dispatch('error', 'Host file mounts are bind-only and cannot be edited from the UI.');
+
+            return;
+        }
+
         if ($this->fileStorage->is_too_large) {
             $this->dispatch('error', 'File on server is too large to edit from the UI.');
 
@@ -206,6 +225,12 @@ public function submit()
     public function instantSave(): void
     {
         $this->authorize('update', $this->resource);
+        if ($this->fileStorage->is_host_file) {
+            $this->dispatch('error', 'Host file mounts are bind-only and cannot be edited from the UI.');
+
+            return;
+        }
+
         if ($this->fileStorage->is_too_large) {
             $this->dispatch('error', 'File on server is too large to edit from the UI.');
 
@@ -224,6 +249,9 @@ public function render()
             'fileDeletionCheckboxes' => [
                 ['id' => 'permanently_delete', 'label' => 'The selected file will be permanently deleted form the server.'],
             ],
+            'hostFileDeletionCheckboxes' => [
+                ['id' => 'permanently_delete', 'label' => 'Only the mount configuration will be removed. The host file will not be deleted.'],
+            ],
         ]);
     }
 }