From e57cc16b9134e028c73be94e7a5a1c7fa6751e7a Mon Sep 17 00:00:00 2001
From: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com>
Date: Tue, 3 Feb 2026 22:00:12 +0100
Subject: [PATCH] fix(validation): enforce url validation for instance domain
 (#8078)

---
 app/Livewire/Settings/Index.php                   | 7 ++++++-
 resources/views/livewire/settings/index.blade.php | 6 ++++--
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/app/Livewire/Settings/Index.php b/app/Livewire/Settings/Index.php
index 2d7de9e58..9a51d107d 100644
--- a/app/Livewire/Settings/Index.php
+++ b/app/Livewire/Settings/Index.php
@@ -14,7 +14,7 @@ class Index extends Component
 
     public ?Server $server = null;
 
-    #[Validate('nullable|string|max:255')]
+    #[Validate('nullable|string|max:255|url')]
     public ?string $fqdn = null;
 
     #[Validate('required|integer|min:1025|max:65535')]
@@ -46,6 +46,11 @@ class Index extends Component
 
     public $buildActivityId = null;
 
+    protected array $messages = [
+        'fqdn.url' => 'Invalid instance URL.',
+        'fqdn.max' => 'URL must not exceed 255 characters.',
+    ];
+
     public function render()
     {
         return view('livewire.settings.index');
diff --git a/resources/views/livewire/settings/index.blade.php b/resources/views/livewire/settings/index.blade.php
index deba90291..5a6319bc8 100644
--- a/resources/views/livewire/settings/index.blade.php
+++ b/resources/views/livewire/settings/index.blade.php
@@ -18,8 +18,10 @@ class="flex flex-col h-full gap-8 sm:flex-row">
                 <div class="flex flex-col gap-2">
                     <div class="flex flex-wrap items-end gap-2">
                         <div class="flex gap-2 md:flex-row flex-col w-full">
-                            <x-forms.input canGate="update" :canResource="$settings" id="fqdn" label="Domain"
-                                helper="Enter the full domain name (FQDN) of the instance, including 'https://' if you want to secure the dashboard with HTTPS. Setting this will make the dashboard accessible via this domain, secured by HTTPS, instead of just the IP address."
+                            <x-forms.input canGate="update" :canResource="$settings" id="fqdn" label="URL"
+                                helper="Enter the full URL of the instance (for example, https://dashboard.example.com).<br><br>
+                                <span class='dark:text-warning text-coollabs'>Important: </span>
+                                If you want the dashboard to be accessible over HTTPS, you must include <b>https://</b> at the start of the URL. Without it, the dashboard will use HTTP and won’t be secured."
                                 placeholder="https://coolify.yourdomain.com" />
                             <x-forms.input canGate="update" :canResource="$settings" id="instance_name" label="Name" placeholder="Coolify"
                                 helper="Custom name for your Coolify instance, shown in the URL." />