rosslh/coolify
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
16176 commits 1 branch 0 tags 102 MiB
Commit graph

972 commits

Author SHA1 Message Date
Andras Bacsai
6872f63f5f fix(api): audit moved resources 2026-07-07 21:20:41 +02:00
Andras Bacsai
f244b5e25d test(api): assert target env authorization on moves 2026-07-07 21:07:50 +02:00
Andras Bacsai
676161a627 fix(api): authorize target environment moves 2026-07-07 20:56:55 +02:00
Andras Bacsai
cf63c7d154 Merge remote-tracking branch 'origin/next' into feat/api-move-resources-between-projects 2026-07-07 18:13:37 +02:00
Andras Bacsai
9f13434273 fix(docker): escape container status commands 
Build container status commands with escaped container names in the
Docker helper so callers can pass raw identifiers consistently.
 2026-07-07 18:00:40 +02:00
Andras Bacsai
a165e03d06 fix(service-apps): harden updates and docker commands 
Escape service application lifecycle command arguments for deploy, restart, stop, and log status checks.
Validate API update payloads from JSON/form data before applying allowed fields, preserving explicit boolean and null values.
Add coverage for service application API authorization, team isolation, validation, and command escaping.
 2026-07-07 15:10:24 +02:00
Andras Bacsai
95a3c453d8 Merge remote-tracking branch 'origin/next' into 9249-pr-investigation 2026-07-07 14:45:48 +02:00
Andras Bacsai
a8000ac2ad fix(hetzner): require at least one public IP protocol 2026-07-07 14:41:17 +02:00
Andras Bacsai
c9ffa0db96 Merge remote-tracking branch 'origin/next' into feat/hetzner-firewalls-and-internal-networks 2026-07-07 14:37:54 +02:00
Andras Bacsai
b939e09f12 refactor(hetzner): move advanced options into dropdown 2026-07-07 14:36:11 +02:00
Andras Bacsai
d723a52d9c fix(hetzner): secure token-backed option fetches 
Authorize stored Hetzner cloud provider tokens before fetching
firewalls or networks, hide provider error details, and keep server
creation intact if backup activation fails.

Collapse advanced Hetzner server options by default while preserving
visibility when advanced values are selected.
 2026-07-07 14:24:15 +02:00
Andras Bacsai
aded45acbe Merge remote-tracking branch 'origin/next' into feat/api/tag-management 2026-07-07 14:02:45 +02:00
Andras Bacsai
11b35ba3c1 feat(api): add tags to resource creation 
Normalize tag names before attaching them, reject names that are too short
after sanitization, and return 404 when removing tags not attached to the
resource.

Adds a per-team unique tag-name index and migrates duplicate tags onto the
kept record before creating the constraint.
 2026-07-07 13:56:33 +02:00
Andras Bacsai
2ad11fdd9a Merge remote-tracking branch 'origin/next' into feat/hetzner-firewalls-and-internal-networks 2026-07-07 13:47:51 +02:00
Andras Bacsai
ff976a134f Merge remote-tracking branch 'origin/next' into api-sensitive-data-scrubber 2026-07-07 12:56:19 +02:00
Andras Bacsai
9a2c432c79 fix(api): expose sensitive fields for privileged tokens 
Privileged API tokens can read hidden resource fields in environment and
resource responses, including instance-admin team tokens with team_id 0.

Configuration hashes now include hidden environment variable values so
secret edits trigger restart detection.
 2026-07-07 12:53:34 +02:00
Andras Bacsai
f617e58401 Merge remote-tracking branch 'origin/next' into feat/api/tag-management 
# Conflicts:
#	app/Http/Controllers/Api/ApplicationsController.php
 2026-07-07 12:49:19 +02:00
Andras Bacsai
00a3738ec7 Merge remote-tracking branch 'origin/next' into api-application-preview-deployments 2026-07-07 12:38:37 +02:00
Andras Bacsai
cf12e1d7ef feat(api): allow preview deployments on app create 
Expose is_preview_deployments_enabled in the application create API
schema and validation, and skip deployment configuration column casts on
sqlite migrations.
 2026-07-07 12:36:35 +02:00
Andras Bacsai
2caa5e67ff
fix(github): derive API URLs from GitHub HTML hosts (#10610) 2026-07-07 12:29:15 +02:00
Andras Bacsai
21bd8fa2bc fix(github): reject malformed app URL origins 2026-07-07 12:24:52 +02:00
Andras Bacsai
b50839d451 Merge remote-tracking branch 'origin/next' into fix/url-validator-underscore-hostnames 2026-07-07 12:24:32 +02:00
Andras Bacsai
bce871d991 fix(domains): reject non-HTTP URL schemes 2026-07-07 12:20:26 +02:00
Andras Bacsai
d01e3a9730
fix(parsers): populate docker_compose_domains for API-created Docker Compose apps (#9300) 2026-07-07 12:17:52 +02:00
Andras Bacsai
d657c10df3
fix(api): allow source commit build setting (#10551) 2026-07-07 12:12:32 +02:00
Andras Bacsai
6c42ca82cb
fix: only strip git_host from repository_url when git_host is github.com (#10274) 2026-07-07 12:11:45 +02:00
Andras Bacsai
2741bc1d0d test(api): cover public git repository URL storage 2026-07-07 12:10:38 +02:00
Andras Bacsai
ff5cfd4253 fix(api): normalize log endpoint query handling 
Clamp log line counts, parse timestamp flags consistently, and filter
service subcontainers by Coolify labels. Document log endpoint timestamp
parameters and database/service log routes in OpenAPI.
 2026-07-06 23:58:12 +02:00
Andras Bacsai
b6a4c7383a
fix(env): preserve empty service variable values (#10850) 2026-07-03 20:47:18 +02:00
Andras Bacsai
1adeed2a48 fix(github): preserve custom app API URLs 2026-07-03 12:01:16 +02:00
Andras Bacsai
eddcbe819b fix(parser): populate compose domains from service env keys 2026-07-03 11:57:02 +02:00
Andras Bacsai
9b060958aa
fix(ray): remove Ray debug hooks from runtime (#10847) 2026-07-03 11:40:20 +02:00
Andras Bacsai
e551f9c176 Merge remote-tracking branch 'origin/next' into fix/docker-compose-domains-api-9211 2026-07-03 11:32:41 +02:00
Andras Bacsai
29c122b31a fix(api): return deployment UUID strings directly 2026-07-03 11:31:49 +02:00
Andras Bacsai
a7dddccd2e Merge remote-tracking branch 'origin/next' into ghe-support-helpers 2026-07-03 10:26:58 +02:00
Andras Bacsai
b5ba40b049 Merge remote-tracking branch 'origin/next' into fix/docker-compose-domains-api-9211 2026-07-03 10:26:19 +02:00
Andras Bacsai
8ce054c10c
fix(git): use cloud install path for ghe apps (#10576) 2026-07-03 10:24:04 +02:00
Andras Bacsai
b90380f542 Merge remote-tracking branch 'origin/next' into ghe-support-helpers 2026-07-03 10:15:29 +02:00
Andras Bacsai
67693acce7
fix(parser): preserve file volume state (#10843) 2026-07-03 10:14:39 +02:00
Andras Bacsai
d73649ca15 Merge remote-tracking branch 'origin/next' into fix-ghe-app-install-url 2026-07-03 10:10:39 +02:00
Andras Bacsai
08e0d02643 Merge remote-tracking branch 'origin/next' into next 2026-07-03 10:09:50 +02:00
Andras Bacsai
4435a46f07 fix(server): hide sentinel status before validation 2026-07-03 10:08:55 +02:00
Andras Bacsai
58f6f9e05b
feat(dev): add Lima testing server fixtures (#10844) 2026-07-03 10:07:55 +02:00
Andras Bacsai
c0866d4cb3 fix(auth): preserve invite login with database sessions 2026-07-03 09:38:05 +02:00
Andras Bacsai
eb56287b57 Merge remote-tracking branch 'origin/next' into 10633-invitation-link-redirect 2026-07-02 18:55:25 +02:00
Andras Bacsai
bb2f70ac3b
fix(railpack): isolate buildx from Docker client env (#10840) 2026-07-02 18:53:00 +02:00
Andras Bacsai
cf6f5a2678
feat(registry): add configurable docker registry url (#9017) 2026-07-02 18:52:46 +02:00
Andras Bacsai
99f60228ad fix(api): avoid lazy loading nested server secrets 2026-07-02 17:47:22 +02:00
Andras Bacsai
c6c7ec1c31 fix(security): validate application domains safely 
Use shared domain validation and normalization for application, service, and
preview domains so unsafe host input is rejected consistently.

Cover command-substitution payloads in application domain tests.
 2026-07-02 17:47:04 +02:00
Andras Bacsai
cc4f666ba2 Merge remote-tracking branch 'origin/next' into improve-application-url-handling 2026-07-02 17:40:31 +02:00