Move internal hostname loading and breadcrumb status into dedicated
Livewire components with live refresh. Merge public/internal access
into one Access section, bind Enter to save on the unsaved bar, and
drop x-teleport wrappers from popup and global search.
Only show the copy control when isSecureContext and clipboard.writeText
are available, and style the empty internal hostname state as a readonly
input to match adjacent fields.
Dispatch edit-domain-saved so Alpine closes the domain edit modal,
wire Save to updateDomain, and force white active log toolbar text in
dark mode. Seed railpack examples on the local Docker destination only
and remove Lima servers, environments, and V5DevLimaSeeder.
Group service domain tables with inline redirect controls, live-save
redirects without full refreshes, and only auto-pair www hosts when a
www redirect is active. Align helper tooltips, server-timing HUD, and
loading spinners with dark-theme accents; default theme-color to dark.
Make button and helper tooltips keyboard-focusable with ARIA roles,
close helper popups on outside pointer/focus leave, reserve select
chevron padding, rotate DNS chevron when open, and re-key the service
domain list after row changes.
Standardize highlighted buttons, selected controls, and loading
indicators on coollabs accent colors; improve light-mode log toolbar
styling; enhance small popups with compact/icon modes; and align
navbars, helpers, and related layouts with matching tests.
Move email verification and team invitation into x-auth.shell with
shared guidance/alert patterns. Truncate long team names in the mobile
header switcher so actions stay visible. Cover both with markup tests.
Add an application Internal access section that loads the running
container hostname (skipped for Compose apps), densify configuration
diff and popup-small defaults, dock the server-timing HUD into the
mobile top bar, restyle the 2FA challenge with the auth shell, and
enforce 16px mobile form fonts to prevent iOS zoom.
Use flex-col-reverse when the sidebar is collapsed, apply the shared
input focus class on the server filter field, and mark the selected
server with a check-circle icon. Update navbar layout tests.
Teleport application/database/service heading actions into a fixed
#resource-action-hud-slot so they no longer overlay page content.
Render the account menu in the sidebar footer (with collapse-aware
layout) instead of the header, and drop the project card hover arrow.
Move proxy, sentinel, resources, and terminal into the server sidebar
with nested routes and icons; extract navbar status into a shared
status-summary component; add full-width service links and compact
loading support.
Extract shared settings-layout components and a dedicated team
danger-zone page. Enable modal editing for security resources,
polish OAuth/API-token controls, and align notification and
service configuration UI with the new navigation patterns.
Move profile email change into a modal with Alpine focus/close handling,
show a loading overlay during command-palette navigation, and adjust
volumes/config-diff grids plus related service/storage UI. Cover with
feature tests for search, profile, storage, and domains.
Improve project resource UIs: sort domains by DNS failure, stop re-adding www pairs on refresh, lazy-load storage tabs with counts, tighten env-var tables, keep application tabs active across Livewire polls, unify database type labels, and update related CSS/JS and tests.
Add PUSHER_FORCE_WS so Echo/Pusher can prefer plain WebSocket
transports, redesign the real-time connection warning popup, and
give copy-button inputs durable right padding in settings forms.
Add a shared resource-heading-tabs scroller with overflow chevrons,
wire it into resource/server navbars, keep links menus outside overflow,
and default new git apps to Railpack instead of Nixpacks.
After delete, Livewire still re-renders the source change view (modal
$refresh / morph). Policy @can checks then call isAdminOfTeam() with a
null team_id and throw a TypeError (HTTP 500) before the redirect.
Guard null team_id in GitlabAppPolicy and GithubAppPolicy, clear the
Livewire model after delete, and skip @can when the model is gone.
libcurl overrides an existing host:port DNS cache entry each time a new
one is added, so one entry per address left only the last pinned. That is
IPv6 whenever the target has AAAA records, which broke every request on
hosts without IPv6. Join them into one comma separated entry instead.
S3 backup uploads fail when the endpoint has an AAAA record: mc parses
--resolve values with netip.ParseAddr and rejects the bracketed IPv6
form. Its resolver map also keeps only one IP per host, so emit a single
entry, preferring IPv4, without brackets.
There was no API for creating GitLab sources. Add /api/v1/gitlab-apps
list/create/update/delete with OpenAPI docs, sensitive-field redaction,
and feature coverage mirroring the GitHub Apps API.
Webhook secret was stored and shown as plaintext. Use a password field,
encrypt at rest (with legacy plaintext read support), and look up tokens
via findByWebhookToken so encrypted values still authenticate webhooks.
Match the GitHub App endpoint picker so self-hosted / tunnel setups can
select FQDN, IP, app URL, or a custom base. Redirect URI is derived as
{base}/webhooks/source/gitlab/redirect and persisted for token exchange.
The secret was always stored encrypted, but the setup form wiped the
input on every load. Load it back for admins (GitHub App parity) so a
reload no longer looks like a failed save.
Use the red incomplete-setup alert like GitHub, keep name + OAuth
credentials front-and-center, and tuck GitLab URL / API / SSH / system
wide options into an Advanced accordion for self-hosted users.
Match the GitHub create modal layout: intro copy, name/group row,
system-wide warning, self-hosted accordion (URL/API/SSH), and a
bottom Continue button instead of a duplicate header Save.
GitlabAppPolicy previously allowed any authenticated user to update,
delete, and create GitLab sources. Align it with GithubAppPolicy, require
Application create authorization on the private-repo wizard, and reject
OAuth callbacks from non-admins so members cannot escalate privileges.
Adds self-hosted GitLab OAuth sources so Coolify can connect to a self-managed GitLab instance, list private repositories, clone over an OAuth token, and deploy (the GitLab counterpart to GitHub Apps).
Hardening: authenticated, one-time team-bound OAuth callback state; token redaction in deploy logs; custom host port/path kept in clone and ls-remote URLs; submodule OAuth auth; system-wide source selection. Covered by unit and feature tests.
cosigned by OpenAI Codex at M1 Max
- Gate volume backup retention and S3 controls by update permission
- Preserve backup records when S3 deletion fails
- Share SFTP download streaming with consistent missing-file handling
- Handle schedule creation errors and link service database backups
