feat(branding): disable FQDN and IP fields instead of hiding/leaving editable

Version was never bumped because git rebase doesn't run pre-commit
hooks. CI now appends a YYYYMMDDHHmm timestamp to the upstream base
version and injects it into the Docker image via build arg.

.env.development.example

@@ -24,6 +24,10 @@ RAY_ENABLED=false
 # Enable Laravel Telescope for debugging
 TELESCOPE_ENABLED=false
 
+# Enable Laravel Nightwatch monitoring
+NIGHTWATCH_ENABLED=false
+NIGHTWATCH_TOKEN=
+
 # Selenium Driver URL for Dusk
 DUSK_DRIVER_URL=http://selenium:4444
 

.github/workflows/pr-quality.yaml

@@ -40,7 +40,10 @@ jobs:
           max-emoji-count: 2
           max-code-references: 5
           require-linked-issue: false
-          blocked-terms: "STRAWBERRY"
+          blocked-terms:  |
+            STRAWBERRY
+            🤖 Generated with Claude Code
+            Generated with Claude Code
           blocked-issue-numbers: 8154
 
           # PR Template Checks
@@ -97,7 +100,7 @@ jobs:
           exempt-pr-milestones: ""
 
           # PR Success Actions
-          success-add-pr-labels: "quality/verified"
+          success-add-pr-labels: ""
 
           # PR Failure Actions
           failure-remove-pr-labels: ""

README.md

@@ -70,7 +70,7 @@ ### Big Sponsors
 * [Arcjet](https://arcjet.com?ref=coolify.io) - Advanced web security and performance solutions
 * [BC Direct](https://bc.direct?ref=coolify.io) - Your trusted technology consulting partner
 * [Blacksmith](https://blacksmith.sh?ref=coolify.io) - Infrastructure automation platform
-* [Brand.dev](https://brand.dev?ref=coolify.io) - API to personalize your product with logos, colors, and company info from any domain
+* [Context.dev](https://context.dev?ref=coolify.io) - API to personalize your product with logos, colors, and company info from any domain
 * [ByteBase](https://www.bytebase.com?ref=coolify.io) - Database CI/CD and Security at Scale
 * [CodeRabbit](https://coderabbit.ai?ref=coolify.io) - Cut Code Review Time & Bugs in Half
 * [COMIT](https://comit.international?ref=coolify.io) - New York Times award–winning contractor
@@ -90,6 +90,7 @@ ### Big Sponsors
 * [Logto](https://logto.io?ref=coolify.io) - The better identity infrastructure for developers
 * [Macarne](https://macarne.com?ref=coolify.io) - Best IP Transit & Carrier Ethernet Solutions for Simplified Network Connectivity
 * [Mobb](https://vibe.mobb.ai/?ref=coolify.io) - Secure Your AI-Generated Code to Unlock Dev Productivity
+* [PetroSky Cloud](https://petrosky.io?ref=coolify.io) - Open source cloud deployment solutions
 * [PFGLabs](https://pfglabs.com?ref=coolify.io) - Build Real Projects with Golang
 * [Ramnode](https://ramnode.com/?ref=coolify.io) - High Performance Cloud VPS Hosting
 * [SaasyKit](https://saasykit.com?ref=coolify.io) - Complete SaaS starter kit for developers

app/Actions/Proxy/GetProxyConfiguration.php

@@ -2,10 +2,12 @@
 
 namespace App\Actions\Proxy;
 
+use App\Enums\ProxyTypes;
 use App\Models\Server;
 use App\Services\ProxyDashboardCacheService;
 use Illuminate\Support\Facades\Log;
 use Lorisleiva\Actions\Concerns\AsAction;
+use Symfony\Component\Yaml\Yaml;
 
 class GetProxyConfiguration
 {
@@ -24,6 +26,17 @@ public function handle(Server $server, bool $forceRegenerate = false): string
             // Primary source: database
             $proxy_configuration = $server->proxy->get('last_saved_proxy_configuration');
 
+            // Validate stored config matches current proxy type
+            if (! empty(trim($proxy_configuration ?? ''))) {
+                if (! $this->configMatchesProxyType($proxyType, $proxy_configuration)) {
+                    Log::warning('Stored proxy config does not match current proxy type, will regenerate', [
+                        'server_id' => $server->id,
+                        'proxy_type' => $proxyType,
+                    ]);
+                    $proxy_configuration = null;
+                }
+            }
+
             // Backfill: existing servers may not have DB config yet — read from disk once
             if (empty(trim($proxy_configuration ?? ''))) {
                 $proxy_configuration = $this->backfillFromDisk($server);
@@ -55,6 +68,29 @@ public function handle(Server $server, bool $forceRegenerate = false): string
         return $proxy_configuration;
     }
 
+    /**
+     * Check that the stored docker-compose YAML contains the expected service
+     * for the server's current proxy type. Returns false if the config belongs
+     * to a different proxy type (e.g. Traefik config on a CADDY server).
+     */
+    private function configMatchesProxyType(string $proxyType, string $configuration): bool
+    {
+        try {
+            $yaml = Yaml::parse($configuration);
+            $services = data_get($yaml, 'services', []);
+
+            return match ($proxyType) {
+                ProxyTypes::TRAEFIK->value => isset($services['traefik']),
+                ProxyTypes::CADDY->value => isset($services['caddy']),
+                ProxyTypes::NGINX->value => isset($services['nginx']),
+                default => true,
+            };
+        } catch (\Throwable $e) {
+            // If YAML is unparseable, don't block — let the existing flow handle it
+            return true;
+        }
+    }
+
     /**
      * Backfill: read config from disk for servers that predate DB storage.
      * Stores the result in the database so future reads skip SSH entirely.

app/Actions/Server/InstallDocker.php

@@ -11,11 +11,8 @@ class InstallDocker
 {
     use AsAction;
 
-    private string $dockerVersion;
-
     public function handle(Server $server)
     {
-        $this->dockerVersion = config('constants.docker.minimum_required_version');
         $supported_os_type = $server->validateOS();
         if (! $supported_os_type) {
             throw new \Exception('Server OS type is not supported for automated installation. Please install Docker manually before continuing: <a target="_blank" class="underline" href="https://coolify.io/docs/installation#manually">documentation</a>.');
@@ -118,7 +115,7 @@ public function handle(Server $server)
 
     private function getDebianDockerInstallCommand(): string
     {
-        return "curl --max-time 300 --retry 3 https://releases.rancher.com/install-docker/{$this->dockerVersion}.sh | sh || curl --max-time 300 --retry 3 https://get.docker.com | sh -s -- --version {$this->dockerVersion} || (".
+        return 'curl -fsSL https://get.docker.com | sh || ('.
             '. /etc/os-release && '.
             'install -m 0755 -d /etc/apt/keyrings && '.
             'curl -fsSL https://download.docker.com/linux/${ID}/gpg -o /etc/apt/keyrings/docker.asc && '.
@@ -131,7 +128,7 @@ private function getDebianDockerInstallCommand(): string
 
     private function getRhelDockerInstallCommand(): string
     {
-        return "curl https://releases.rancher.com/install-docker/{$this->dockerVersion}.sh | sh || curl https://get.docker.com | sh -s -- --version {$this->dockerVersion} || (".
+        return 'curl -fsSL https://get.docker.com | sh || ('.
             'dnf config-manager --add-repo https://download.docker.com/linux/centos/docker-ce.repo && '.
             'dnf install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin && '.
             'systemctl start docker && '.
@@ -141,7 +138,7 @@ private function getRhelDockerInstallCommand(): string
 
     private function getSuseDockerInstallCommand(): string
     {
-        return "curl https://releases.rancher.com/install-docker/{$this->dockerVersion}.sh | sh || curl https://get.docker.com | sh -s -- --version {$this->dockerVersion} || (".
+        return 'curl -fsSL https://get.docker.com | sh || ('.
             'zypper addrepo https://download.docker.com/linux/sles/docker-ce.repo && '.
             'zypper refresh && '.
             'zypper install -y --no-confirm docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin && '.
@@ -152,10 +149,6 @@ private function getSuseDockerInstallCommand(): string
 
     private function getArchDockerInstallCommand(): string
     {
-        // Use -Syu to perform full system upgrade before installing Docker
-        // Partial upgrades (-Sy without -u) are discouraged on Arch Linux
-        // as they can lead to broken dependencies and system instability
-        // Use --needed to skip reinstalling packages that are already up-to-date (idempotent)
         return 'pacman -Syu --noconfirm --needed docker docker-compose && '.
             'systemctl enable docker.service && '.
             'systemctl start docker.service';
@@ -163,6 +156,6 @@ private function getArchDockerInstallCommand(): string
 
     private function getGenericDockerInstallCommand(): string
     {
-        return "curl --max-time 300 --retry 3 https://releases.rancher.com/install-docker/{$this->dockerVersion}.sh | sh || curl --max-time 300 --retry 3 https://get.docker.com | sh -s -- --version {$this->dockerVersion}";
+        return 'curl -fsSL https://get.docker.com | sh';
     }
 }

app/Console/Commands/Nightwatch.php

@@ -0,0 +1,22 @@
+<?php
+
+namespace App\Console\Commands;
+
+use Illuminate\Console\Command;
+
+class Nightwatch extends Command
+{
+    protected $signature = 'start:nightwatch';
+
+    protected $description = 'Start Nightwatch';
+
+    public function handle(): void
+    {
+        if (config('constants.nightwatch.is_nightwatch_enabled')) {
+            $this->info('Nightwatch is enabled on this server.');
+            $this->call('nightwatch:agent');
+        }
+
+        exit(0);
+    }
+}

app/Console/Commands/ScheduledJobDiagnostics.php

@@ -0,0 +1,255 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Models\DockerCleanupExecution;
+use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledTask;
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Console\Command;
+use Illuminate\Support\Carbon;
+use Illuminate\Support\Facades\Cache;
+
+class ScheduledJobDiagnostics extends Command
+{
+    protected $signature = 'scheduled:diagnostics
+        {--type=all : Type to inspect: docker-cleanup, backups, tasks, server-jobs, all}
+        {--server= : Filter by server ID}';
+
+    protected $description = 'Inspect dedup cache state and scheduling decisions for all scheduled jobs';
+
+    public function handle(): int
+    {
+        $type = $this->option('type');
+        $serverFilter = $this->option('server');
+
+        $this->outputHeartbeat();
+
+        if (in_array($type, ['all', 'docker-cleanup'])) {
+            $this->inspectDockerCleanups($serverFilter);
+        }
+
+        if (in_array($type, ['all', 'backups'])) {
+            $this->inspectBackups();
+        }
+
+        if (in_array($type, ['all', 'tasks'])) {
+            $this->inspectTasks();
+        }
+
+        if (in_array($type, ['all', 'server-jobs'])) {
+            $this->inspectServerJobs($serverFilter);
+        }
+
+        return self::SUCCESS;
+    }
+
+    private function outputHeartbeat(): void
+    {
+        $heartbeat = Cache::get('scheduled-job-manager:heartbeat');
+        if ($heartbeat) {
+            $age = Carbon::parse($heartbeat)->diffForHumans();
+            $this->info("Scheduler heartbeat: {$heartbeat} ({$age})");
+        } else {
+            $this->error('Scheduler heartbeat: MISSING — ScheduledJobManager may not be running');
+        }
+        $this->newLine();
+    }
+
+    private function inspectDockerCleanups(?string $serverFilter): void
+    {
+        $this->info('=== Docker Cleanup Jobs ===');
+
+        $servers = $this->getServers($serverFilter);
+
+        $rows = [];
+        foreach ($servers as $server) {
+            $frequency = data_get($server->settings, 'docker_cleanup_frequency', '0 * * * *');
+            if (isset(VALID_CRON_STRINGS[$frequency])) {
+                $frequency = VALID_CRON_STRINGS[$frequency];
+            }
+
+            $dedupKey = "docker-cleanup:{$server->id}";
+            $cacheValue = Cache::get($dedupKey);
+            $timezone = data_get($server->settings, 'server_timezone', config('app.timezone'));
+
+            if (validate_timezone($timezone) === false) {
+                $timezone = config('app.timezone');
+            }
+
+            $wouldFire = shouldRunCronNow($frequency, $timezone, $dedupKey);
+
+            $lastExecution = DockerCleanupExecution::where('server_id', $server->id)
+                ->latest()
+                ->first();
+
+            $rows[] = [
+                $server->id,
+                $server->name,
+                $timezone,
+                $frequency,
+                $dedupKey,
+                $cacheValue ?? '<missing>',
+                $wouldFire ? 'YES' : 'no',
+                $lastExecution ? $lastExecution->status.' @ '.$lastExecution->created_at : 'never',
+            ];
+        }
+
+        $this->table(
+            ['ID', 'Server', 'TZ', 'Frequency', 'Dedup Key', 'Cache Value', 'Would Fire', 'Last Execution'],
+            $rows
+        );
+        $this->newLine();
+    }
+
+    private function inspectBackups(): void
+    {
+        $this->info('=== Scheduled Backups ===');
+
+        $backups = ScheduledDatabaseBackup::with(['database'])
+            ->where('enabled', true)
+            ->get();
+
+        $rows = [];
+        foreach ($backups as $backup) {
+            $server = $backup->server();
+            $frequency = $backup->frequency;
+            if (isset(VALID_CRON_STRINGS[$frequency])) {
+                $frequency = VALID_CRON_STRINGS[$frequency];
+            }
+
+            $dedupKey = "scheduled-backup:{$backup->id}";
+            $cacheValue = Cache::get($dedupKey);
+            $timezone = $server ? data_get($server->settings, 'server_timezone', config('app.timezone')) : config('app.timezone');
+
+            if (validate_timezone($timezone) === false) {
+                $timezone = config('app.timezone');
+            }
+
+            $wouldFire = shouldRunCronNow($frequency, $timezone, $dedupKey);
+
+            $rows[] = [
+                $backup->id,
+                $backup->database_type ?? 'unknown',
+                $server?->name ?? 'N/A',
+                $frequency,
+                $cacheValue ?? '<missing>',
+                $wouldFire ? 'YES' : 'no',
+            ];
+        }
+
+        $this->table(
+            ['Backup ID', 'DB Type', 'Server', 'Frequency', 'Cache Value', 'Would Fire'],
+            $rows
+        );
+        $this->newLine();
+    }
+
+    private function inspectTasks(): void
+    {
+        $this->info('=== Scheduled Tasks ===');
+
+        $tasks = ScheduledTask::with(['service', 'application'])
+            ->where('enabled', true)
+            ->get();
+
+        $rows = [];
+        foreach ($tasks as $task) {
+            $server = $task->server();
+            $frequency = $task->frequency;
+            if (isset(VALID_CRON_STRINGS[$frequency])) {
+                $frequency = VALID_CRON_STRINGS[$frequency];
+            }
+
+            $dedupKey = "scheduled-task:{$task->id}";
+            $cacheValue = Cache::get($dedupKey);
+            $timezone = $server ? data_get($server->settings, 'server_timezone', config('app.timezone')) : config('app.timezone');
+
+            if (validate_timezone($timezone) === false) {
+                $timezone = config('app.timezone');
+            }
+
+            $wouldFire = shouldRunCronNow($frequency, $timezone, $dedupKey);
+
+            $rows[] = [
+                $task->id,
+                $task->name,
+                $server?->name ?? 'N/A',
+                $frequency,
+                $cacheValue ?? '<missing>',
+                $wouldFire ? 'YES' : 'no',
+            ];
+        }
+
+        $this->table(
+            ['Task ID', 'Name', 'Server', 'Frequency', 'Cache Value', 'Would Fire'],
+            $rows
+        );
+        $this->newLine();
+    }
+
+    private function inspectServerJobs(?string $serverFilter): void
+    {
+        $this->info('=== Server Manager Jobs ===');
+
+        $servers = $this->getServers($serverFilter);
+
+        $rows = [];
+        foreach ($servers as $server) {
+            $timezone = data_get($server->settings, 'server_timezone', config('app.timezone'));
+            if (validate_timezone($timezone) === false) {
+                $timezone = config('app.timezone');
+            }
+
+            $dedupKeys = [
+                "sentinel-restart:{$server->id}" => '0 0 * * *',
+                "server-patch-check:{$server->id}" => '0 0 * * 0',
+                "server-check:{$server->id}" => isCloud() ? '*/5 * * * *' : '* * * * *',
+                "server-storage-check:{$server->id}" => data_get($server->settings, 'server_disk_usage_check_frequency', '0 23 * * *'),
+            ];
+
+            foreach ($dedupKeys as $dedupKey => $frequency) {
+                if (isset(VALID_CRON_STRINGS[$frequency])) {
+                    $frequency = VALID_CRON_STRINGS[$frequency];
+                }
+
+                $cacheValue = Cache::get($dedupKey);
+                $wouldFire = shouldRunCronNow($frequency, $timezone, $dedupKey);
+
+                $rows[] = [
+                    $server->id,
+                    $server->name,
+                    $dedupKey,
+                    $frequency,
+                    $cacheValue ?? '<missing>',
+                    $wouldFire ? 'YES' : 'no',
+                ];
+            }
+        }
+
+        $this->table(
+            ['Server ID', 'Server', 'Dedup Key', 'Frequency', 'Cache Value', 'Would Fire'],
+            $rows
+        );
+        $this->newLine();
+    }
+
+    private function getServers(?string $serverFilter): \Illuminate\Support\Collection
+    {
+        $query = Server::with('settings')->where('ip', '!=', '1.2.3.4');
+
+        if ($serverFilter) {
+            $query->where('id', $serverFilter);
+        }
+
+        if (isCloud()) {
+            $servers = $query->whereRelation('team.subscription', 'stripe_invoice_paid', true)->get();
+            $own = Team::find(0)?->servers()->with('settings')->get() ?? collect();
+
+            return $servers->merge($own);
+        }
+
+        return $query->get();
+    }
+}

app/Http/Controllers/Api/ApplicationsController.php

@@ -11,6 +11,8 @@
 use App\Models\Application;
 use App\Models\EnvironmentVariable;
 use App\Models\GithubApp;
+use App\Models\LocalFileVolume;
+use App\Models\LocalPersistentVolume;
 use App\Models\PrivateKey;
 use App\Models\Project;
 use App\Models\Server;
@@ -4026,9 +4028,10 @@ public function storages(Request $request): JsonResponse
                     mediaType: 'application/json',
                     schema: new OA\Schema(
                         type: 'object',
-                        required: ['id', 'type'],
+                        required: ['type'],
                         properties: [
-                            'id' => ['type' => 'integer', 'description' => 'The ID of the storage.'],
+                            'uuid' => ['type' => 'string', 'description' => 'The UUID of the storage (preferred).'],
+                            'id' => ['type' => 'integer', 'description' => 'The ID of the storage (deprecated, use uuid instead).'],
                             'type' => ['type' => 'string', 'enum' => ['persistent', 'file'], 'description' => 'The type of storage: persistent or file.'],
                             'is_preview_suffix_enabled' => ['type' => 'boolean', 'description' => 'Whether to add -pr-N suffix for preview deployments.'],
                             'name' => ['type' => 'string', 'description' => 'The volume name (persistent only, not allowed for read-only storages).'],
@@ -4078,7 +4081,7 @@ public function update_storage(Request $request): JsonResponse
             return $return;
         }
 
-        $application = Application::ownedByCurrentTeamAPI($teamId)->where('uuid', $request->uuid)->first();
+        $application = Application::ownedByCurrentTeamAPI($teamId)->where('uuid', $request->route('uuid'))->first();
 
         if (! $application) {
             return response()->json([
@@ -4089,7 +4092,8 @@ public function update_storage(Request $request): JsonResponse
         $this->authorize('update', $application);
 
         $validator = customApiValidator($request->all(), [
-            'id' => 'required|integer',
+            'uuid' => 'string',
+            'id' => 'integer',
             'type' => 'required|string|in:persistent,file',
             'is_preview_suffix_enabled' => 'boolean',
             'name' => 'string',
@@ -4098,7 +4102,7 @@ public function update_storage(Request $request): JsonResponse
             'content' => 'string|nullable',
         ]);
 
-        $allAllowedFields = ['id', 'type', 'is_preview_suffix_enabled', 'name', 'mount_path', 'host_path', 'content'];
+        $allAllowedFields = ['uuid', 'id', 'type', 'is_preview_suffix_enabled', 'name', 'mount_path', 'host_path', 'content'];
         $extraFields = array_diff(array_keys($request->all()), $allAllowedFields);
         if ($validator->fails() || ! empty($extraFields)) {
             $errors = $validator->errors();
@@ -4114,10 +4118,23 @@ public function update_storage(Request $request): JsonResponse
             ], 422);
         }
 
+        $storageUuid = $request->input('uuid');
+        $storageId = $request->input('id');
+
+        if (! $storageUuid && ! $storageId) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => ['uuid' => 'Either uuid or id is required.'],
+            ], 422);
+        }
+
+        $lookupField = $storageUuid ? 'uuid' : 'id';
+        $lookupValue = $storageUuid ?? $storageId;
+
         if ($request->type === 'persistent') {
-            $storage = $application->persistentStorages->where('id', $request->id)->first();
+            $storage = $application->persistentStorages->where($lookupField, $lookupValue)->first();
         } else {
-            $storage = $application->fileStorages->where('id', $request->id)->first();
+            $storage = $application->fileStorages->where($lookupField, $lookupValue)->first();
         }
 
         if (! $storage) {
@@ -4183,4 +4200,254 @@ public function update_storage(Request $request): JsonResponse
 
         return response()->json($storage);
     }
+
+    #[OA\Post(
+        summary: 'Create Storage',
+        description: 'Create a persistent storage or file storage for an application.',
+        path: '/applications/{uuid}/storages',
+        operationId: 'create-storage-by-application-uuid',
+        security: [
+            ['bearerAuth' => []],
+        ],
+        tags: ['Applications'],
+        parameters: [
+            new OA\Parameter(
+                name: 'uuid',
+                in: 'path',
+                description: 'UUID of the application.',
+                required: true,
+                schema: new OA\Schema(type: 'string')
+            ),
+        ],
+        requestBody: new OA\RequestBody(
+            required: true,
+            content: [
+                new OA\MediaType(
+                    mediaType: 'application/json',
+                    schema: new OA\Schema(
+                        type: 'object',
+                        required: ['type', 'mount_path'],
+                        properties: [
+                            'type' => ['type' => 'string', 'enum' => ['persistent', 'file'], 'description' => 'The type of storage.'],
+                            'name' => ['type' => 'string', 'description' => 'Volume name (persistent only, required for persistent).'],
+                            'mount_path' => ['type' => 'string', 'description' => 'The container mount path.'],
+                            'host_path' => ['type' => 'string', 'nullable' => true, 'description' => 'The host path (persistent only, optional).'],
+                            'content' => ['type' => 'string', 'nullable' => true, 'description' => 'File content (file only, optional).'],
+                            'is_directory' => ['type' => 'boolean', 'description' => 'Whether this is a directory mount (file only, default false).'],
+                            'fs_path' => ['type' => 'string', 'description' => 'Host directory path (required when is_directory is true).'],
+                        ],
+                        additionalProperties: false,
+                    ),
+                ),
+            ],
+        ),
+        responses: [
+            new OA\Response(
+                response: 201,
+                description: 'Storage created.',
+                content: new OA\JsonContent(type: 'object'),
+            ),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 400, ref: '#/components/responses/400'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ]
+    )]
+    public function create_storage(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $return = validateIncomingRequest($request);
+        if ($return instanceof JsonResponse) {
+            return $return;
+        }
+
+        $application = Application::ownedByCurrentTeamAPI($teamId)->where('uuid', $request->uuid)->first();
+        if (! $application) {
+            return response()->json(['message' => 'Application not found.'], 404);
+        }
+
+        $this->authorize('update', $application);
+
+        $validator = customApiValidator($request->all(), [
+            'type' => 'required|string|in:persistent,file',
+            'name' => 'string',
+            'mount_path' => 'required|string',
+            'host_path' => 'string|nullable',
+            'content' => 'string|nullable',
+            'is_directory' => 'boolean',
+            'fs_path' => 'string',
+        ]);
+
+        $allAllowedFields = ['type', 'name', 'mount_path', 'host_path', 'content', 'is_directory', 'fs_path'];
+        $extraFields = array_diff(array_keys($request->all()), $allAllowedFields);
+        if ($validator->fails() || ! empty($extraFields)) {
+            $errors = $validator->errors();
+            if (! empty($extraFields)) {
+                foreach ($extraFields as $field) {
+                    $errors->add($field, 'This field is not allowed.');
+                }
+            }
+
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => $errors,
+            ], 422);
+        }
+
+        if ($request->type === 'persistent') {
+            if (! $request->name) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['name' => 'The name field is required for persistent storages.'],
+                ], 422);
+            }
+
+            $typeSpecificInvalidFields = array_intersect(['content', 'is_directory', 'fs_path'], array_keys($request->all()));
+            if (! empty($typeSpecificInvalidFields)) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => collect($typeSpecificInvalidFields)
+                        ->mapWithKeys(fn ($field) => [$field => "Field '{$field}' is not valid for type 'persistent'."]),
+                ], 422);
+            }
+
+            $storage = LocalPersistentVolume::create([
+                'name' => $application->uuid.'-'.$request->name,
+                'mount_path' => $request->mount_path,
+                'host_path' => $request->host_path,
+                'resource_id' => $application->id,
+                'resource_type' => $application->getMorphClass(),
+            ]);
+
+            return response()->json($storage, 201);
+        }
+
+        // File storage
+        $typeSpecificInvalidFields = array_intersect(['name', 'host_path'], array_keys($request->all()));
+        if (! empty($typeSpecificInvalidFields)) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => collect($typeSpecificInvalidFields)
+                    ->mapWithKeys(fn ($field) => [$field => "Field '{$field}' is not valid for type 'file'."]),
+            ], 422);
+        }
+
+        $isDirectory = $request->boolean('is_directory', false);
+
+        if ($isDirectory) {
+            if (! $request->fs_path) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['fs_path' => 'The fs_path field is required for directory mounts.'],
+                ], 422);
+            }
+
+            $fsPath = str($request->fs_path)->trim()->start('/')->value();
+            $mountPath = str($request->mount_path)->trim()->start('/')->value();
+
+            validateShellSafePath($fsPath, 'storage source path');
+            validateShellSafePath($mountPath, 'storage destination path');
+
+            $storage = LocalFileVolume::create([
+                'fs_path' => $fsPath,
+                'mount_path' => $mountPath,
+                'is_directory' => true,
+                'resource_id' => $application->id,
+                'resource_type' => get_class($application),
+            ]);
+        } else {
+            $mountPath = str($request->mount_path)->trim()->start('/')->value();
+            $fsPath = application_configuration_dir().'/'.$application->uuid.$mountPath;
+
+            $storage = LocalFileVolume::create([
+                'fs_path' => $fsPath,
+                'mount_path' => $mountPath,
+                'content' => $request->content,
+                'is_directory' => false,
+                'resource_id' => $application->id,
+                'resource_type' => get_class($application),
+            ]);
+        }
+
+        return response()->json($storage, 201);
+    }
+
+    #[OA\Delete(
+        summary: 'Delete Storage',
+        description: 'Delete a persistent storage or file storage by application UUID.',
+        path: '/applications/{uuid}/storages/{storage_uuid}',
+        operationId: 'delete-storage-by-application-uuid',
+        security: [
+            ['bearerAuth' => []],
+        ],
+        tags: ['Applications'],
+        parameters: [
+            new OA\Parameter(
+                name: 'uuid',
+                in: 'path',
+                description: 'UUID of the application.',
+                required: true,
+                schema: new OA\Schema(type: 'string')
+            ),
+            new OA\Parameter(
+                name: 'storage_uuid',
+                in: 'path',
+                description: 'UUID of the storage.',
+                required: true,
+                schema: new OA\Schema(type: 'string')
+            ),
+        ],
+        responses: [
+            new OA\Response(response: 200, description: 'Storage deleted.', content: new OA\JsonContent(
+                properties: [new OA\Property(property: 'message', type: 'string')],
+            )),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 400, ref: '#/components/responses/400'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ]
+    )]
+    public function delete_storage(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $application = Application::ownedByCurrentTeamAPI($teamId)->where('uuid', $request->uuid)->first();
+        if (! $application) {
+            return response()->json(['message' => 'Application not found.'], 404);
+        }
+
+        $this->authorize('update', $application);
+
+        $storageUuid = $request->route('storage_uuid');
+
+        $storage = $application->persistentStorages->where('uuid', $storageUuid)->first();
+        if (! $storage) {
+            $storage = $application->fileStorages->where('uuid', $storageUuid)->first();
+        }
+
+        if (! $storage) {
+            return response()->json(['message' => 'Storage not found.'], 404);
+        }
+
+        if ($storage->shouldBeReadOnlyInUI()) {
+            return response()->json([
+                'message' => 'This storage is read-only (managed by docker-compose or service definition) and cannot be deleted.',
+            ], 422);
+        }
+
+        if ($storage instanceof LocalFileVolume) {
+            $storage->deleteStorageOnServer();
+        }
+
+        $storage->delete();
+
+        return response()->json(['message' => 'Storage deleted.']);
+    }
 }

app/Http/Controllers/Api/DatabasesController.php

@@ -12,11 +12,14 @@
 use App\Jobs\DatabaseBackupJob;
 use App\Jobs\DeleteResourceJob;
 use App\Models\EnvironmentVariable;
+use App\Models\LocalFileVolume;
+use App\Models\LocalPersistentVolume;
 use App\Models\Project;
 use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\Server;
 use App\Models\StandalonePostgresql;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 use OpenApi\Attributes as OA;
@@ -3298,4 +3301,520 @@ public function delete_env_by_uuid(Request $request)
 
         return response()->json(['message' => 'Environment variable deleted.']);
     }
+
+    #[OA\Get(
+        summary: 'List Storages',
+        description: 'List all persistent storages and file storages by database UUID.',
+        path: '/databases/{uuid}/storages',
+        operationId: 'list-storages-by-database-uuid',
+        security: [
+            ['bearerAuth' => []],
+        ],
+        tags: ['Databases'],
+        parameters: [
+            new OA\Parameter(
+                name: 'uuid',
+                in: 'path',
+                description: 'UUID of the database.',
+                required: true,
+                schema: new OA\Schema(
+                    type: 'string',
+                )
+            ),
+        ],
+        responses: [
+            new OA\Response(
+                response: 200,
+                description: 'All storages by database UUID.',
+                content: new OA\JsonContent(
+                    properties: [
+                        new OA\Property(property: 'persistent_storages', type: 'array', items: new OA\Items(type: 'object')),
+                        new OA\Property(property: 'file_storages', type: 'array', items: new OA\Items(type: 'object')),
+                    ],
+                ),
+            ),
+            new OA\Response(
+                response: 401,
+                ref: '#/components/responses/401',
+            ),
+            new OA\Response(
+                response: 400,
+                ref: '#/components/responses/400',
+            ),
+            new OA\Response(
+                response: 404,
+                ref: '#/components/responses/404',
+            ),
+        ]
+    )]
+    public function storages(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $database = queryDatabaseByUuidWithinTeam($request->uuid, $teamId);
+        if (! $database) {
+            return response()->json(['message' => 'Database not found.'], 404);
+        }
+
+        $this->authorize('view', $database);
+
+        $persistentStorages = $database->persistentStorages->sortBy('id')->values();
+        $fileStorages = $database->fileStorages->sortBy('id')->values();
+
+        return response()->json([
+            'persistent_storages' => $persistentStorages,
+            'file_storages' => $fileStorages,
+        ]);
+    }
+
+    #[OA\Post(
+        summary: 'Create Storage',
+        description: 'Create a persistent storage or file storage for a database.',
+        path: '/databases/{uuid}/storages',
+        operationId: 'create-storage-by-database-uuid',
+        security: [
+            ['bearerAuth' => []],
+        ],
+        tags: ['Databases'],
+        parameters: [
+            new OA\Parameter(
+                name: 'uuid',
+                in: 'path',
+                description: 'UUID of the database.',
+                required: true,
+                schema: new OA\Schema(type: 'string')
+            ),
+        ],
+        requestBody: new OA\RequestBody(
+            required: true,
+            content: [
+                new OA\MediaType(
+                    mediaType: 'application/json',
+                    schema: new OA\Schema(
+                        type: 'object',
+                        required: ['type', 'mount_path'],
+                        properties: [
+                            'type' => ['type' => 'string', 'enum' => ['persistent', 'file'], 'description' => 'The type of storage.'],
+                            'name' => ['type' => 'string', 'description' => 'Volume name (persistent only, required for persistent).'],
+                            'mount_path' => ['type' => 'string', 'description' => 'The container mount path.'],
+                            'host_path' => ['type' => 'string', 'nullable' => true, 'description' => 'The host path (persistent only, optional).'],
+                            'content' => ['type' => 'string', 'nullable' => true, 'description' => 'File content (file only, optional).'],
+                            'is_directory' => ['type' => 'boolean', 'description' => 'Whether this is a directory mount (file only, default false).'],
+                            'fs_path' => ['type' => 'string', 'description' => 'Host directory path (required when is_directory is true).'],
+                        ],
+                        additionalProperties: false,
+                    ),
+                ),
+            ],
+        ),
+        responses: [
+            new OA\Response(
+                response: 201,
+                description: 'Storage created.',
+                content: new OA\JsonContent(type: 'object'),
+            ),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 400, ref: '#/components/responses/400'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ]
+    )]
+    public function create_storage(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $return = validateIncomingRequest($request);
+        if ($return instanceof JsonResponse) {
+            return $return;
+        }
+
+        $database = queryDatabaseByUuidWithinTeam($request->uuid, $teamId);
+        if (! $database) {
+            return response()->json(['message' => 'Database not found.'], 404);
+        }
+
+        $this->authorize('update', $database);
+
+        $validator = customApiValidator($request->all(), [
+            'type' => 'required|string|in:persistent,file',
+            'name' => 'string',
+            'mount_path' => 'required|string',
+            'host_path' => 'string|nullable',
+            'content' => 'string|nullable',
+            'is_directory' => 'boolean',
+            'fs_path' => 'string',
+        ]);
+
+        $allAllowedFields = ['type', 'name', 'mount_path', 'host_path', 'content', 'is_directory', 'fs_path'];
+        $extraFields = array_diff(array_keys($request->all()), $allAllowedFields);
+        if ($validator->fails() || ! empty($extraFields)) {
+            $errors = $validator->errors();
+            if (! empty($extraFields)) {
+                foreach ($extraFields as $field) {
+                    $errors->add($field, 'This field is not allowed.');
+                }
+            }
+
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => $errors,
+            ], 422);
+        }
+
+        if ($request->type === 'persistent') {
+            if (! $request->name) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['name' => 'The name field is required for persistent storages.'],
+                ], 422);
+            }
+
+            $typeSpecificInvalidFields = array_intersect(['content', 'is_directory', 'fs_path'], array_keys($request->all()));
+            if (! empty($typeSpecificInvalidFields)) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => collect($typeSpecificInvalidFields)
+                        ->mapWithKeys(fn ($field) => [$field => "Field '{$field}' is not valid for type 'persistent'."]),
+                ], 422);
+            }
+
+            $storage = LocalPersistentVolume::create([
+                'name' => $database->uuid.'-'.$request->name,
+                'mount_path' => $request->mount_path,
+                'host_path' => $request->host_path,
+                'resource_id' => $database->id,
+                'resource_type' => $database->getMorphClass(),
+            ]);
+
+            return response()->json($storage, 201);
+        }
+
+        // File storage
+        $typeSpecificInvalidFields = array_intersect(['name', 'host_path'], array_keys($request->all()));
+        if (! empty($typeSpecificInvalidFields)) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => collect($typeSpecificInvalidFields)
+                    ->mapWithKeys(fn ($field) => [$field => "Field '{$field}' is not valid for type 'file'."]),
+            ], 422);
+        }
+
+        $isDirectory = $request->boolean('is_directory', false);
+
+        if ($isDirectory) {
+            if (! $request->fs_path) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['fs_path' => 'The fs_path field is required for directory mounts.'],
+                ], 422);
+            }
+
+            $fsPath = str($request->fs_path)->trim()->start('/')->value();
+            $mountPath = str($request->mount_path)->trim()->start('/')->value();
+
+            validateShellSafePath($fsPath, 'storage source path');
+            validateShellSafePath($mountPath, 'storage destination path');
+
+            $storage = LocalFileVolume::create([
+                'fs_path' => $fsPath,
+                'mount_path' => $mountPath,
+                'is_directory' => true,
+                'resource_id' => $database->id,
+                'resource_type' => get_class($database),
+            ]);
+        } else {
+            $mountPath = str($request->mount_path)->trim()->start('/')->value();
+            $fsPath = database_configuration_dir().'/'.$database->uuid.$mountPath;
+
+            $storage = LocalFileVolume::create([
+                'fs_path' => $fsPath,
+                'mount_path' => $mountPath,
+                'content' => $request->content,
+                'is_directory' => false,
+                'resource_id' => $database->id,
+                'resource_type' => get_class($database),
+            ]);
+        }
+
+        return response()->json($storage, 201);
+    }
+
+    #[OA\Patch(
+        summary: 'Update Storage',
+        description: 'Update a persistent storage or file storage by database UUID.',
+        path: '/databases/{uuid}/storages',
+        operationId: 'update-storage-by-database-uuid',
+        security: [
+            ['bearerAuth' => []],
+        ],
+        tags: ['Databases'],
+        parameters: [
+            new OA\Parameter(
+                name: 'uuid',
+                in: 'path',
+                description: 'UUID of the database.',
+                required: true,
+                schema: new OA\Schema(
+                    type: 'string',
+                )
+            ),
+        ],
+        requestBody: new OA\RequestBody(
+            description: 'Storage updated. For read-only storages (from docker-compose or services), only is_preview_suffix_enabled can be updated.',
+            required: true,
+            content: [
+                new OA\MediaType(
+                    mediaType: 'application/json',
+                    schema: new OA\Schema(
+                        type: 'object',
+                        required: ['type'],
+                        properties: [
+                            'uuid' => ['type' => 'string', 'description' => 'The UUID of the storage (preferred).'],
+                            'id' => ['type' => 'integer', 'description' => 'The ID of the storage (deprecated, use uuid instead).'],
+                            'type' => ['type' => 'string', 'enum' => ['persistent', 'file'], 'description' => 'The type of storage: persistent or file.'],
+                            'is_preview_suffix_enabled' => ['type' => 'boolean', 'description' => 'Whether to add -pr-N suffix for preview deployments.'],
+                            'name' => ['type' => 'string', 'description' => 'The volume name (persistent only, not allowed for read-only storages).'],
+                            'mount_path' => ['type' => 'string', 'description' => 'The container mount path (not allowed for read-only storages).'],
+                            'host_path' => ['type' => 'string', 'nullable' => true, 'description' => 'The host path (persistent only, not allowed for read-only storages).'],
+                            'content' => ['type' => 'string', 'nullable' => true, 'description' => 'The file content (file only, not allowed for read-only storages).'],
+                        ],
+                        additionalProperties: false,
+                    ),
+                ),
+            ],
+        ),
+        responses: [
+            new OA\Response(
+                response: 200,
+                description: 'Storage updated.',
+                content: new OA\JsonContent(type: 'object'),
+            ),
+            new OA\Response(
+                response: 401,
+                ref: '#/components/responses/401',
+            ),
+            new OA\Response(
+                response: 400,
+                ref: '#/components/responses/400',
+            ),
+            new OA\Response(
+                response: 404,
+                ref: '#/components/responses/404',
+            ),
+            new OA\Response(
+                response: 422,
+                ref: '#/components/responses/422',
+            ),
+        ]
+    )]
+    public function update_storage(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $return = validateIncomingRequest($request);
+        if ($return instanceof \Illuminate\Http\JsonResponse) {
+            return $return;
+        }
+
+        $database = queryDatabaseByUuidWithinTeam($request->route('uuid'), $teamId);
+        if (! $database) {
+            return response()->json(['message' => 'Database not found.'], 404);
+        }
+
+        $this->authorize('update', $database);
+
+        $validator = customApiValidator($request->all(), [
+            'uuid' => 'string',
+            'id' => 'integer',
+            'type' => 'required|string|in:persistent,file',
+            'is_preview_suffix_enabled' => 'boolean',
+            'name' => 'string',
+            'mount_path' => 'string',
+            'host_path' => 'string|nullable',
+            'content' => 'string|nullable',
+        ]);
+
+        $allAllowedFields = ['uuid', 'id', 'type', 'is_preview_suffix_enabled', 'name', 'mount_path', 'host_path', 'content'];
+        $extraFields = array_diff(array_keys($request->all()), $allAllowedFields);
+        if ($validator->fails() || ! empty($extraFields)) {
+            $errors = $validator->errors();
+            if (! empty($extraFields)) {
+                foreach ($extraFields as $field) {
+                    $errors->add($field, 'This field is not allowed.');
+                }
+            }
+
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => $errors,
+            ], 422);
+        }
+
+        $storageUuid = $request->input('uuid');
+        $storageId = $request->input('id');
+
+        if (! $storageUuid && ! $storageId) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => ['uuid' => 'Either uuid or id is required.'],
+            ], 422);
+        }
+
+        $lookupField = $storageUuid ? 'uuid' : 'id';
+        $lookupValue = $storageUuid ?? $storageId;
+
+        if ($request->type === 'persistent') {
+            $storage = $database->persistentStorages->where($lookupField, $lookupValue)->first();
+        } else {
+            $storage = $database->fileStorages->where($lookupField, $lookupValue)->first();
+        }
+
+        if (! $storage) {
+            return response()->json([
+                'message' => 'Storage not found.',
+            ], 404);
+        }
+
+        $isReadOnly = $storage->shouldBeReadOnlyInUI();
+        $editableOnlyFields = ['name', 'mount_path', 'host_path', 'content'];
+        $requestedEditableFields = array_intersect($editableOnlyFields, array_keys($request->all()));
+
+        if ($isReadOnly && ! empty($requestedEditableFields)) {
+            return response()->json([
+                'message' => 'This storage is read-only (managed by docker-compose or service definition). Only is_preview_suffix_enabled can be updated.',
+                'read_only_fields' => array_values($requestedEditableFields),
+            ], 422);
+        }
+
+        // Reject fields that don't apply to the given storage type
+        if (! $isReadOnly) {
+            $typeSpecificInvalidFields = $request->type === 'persistent'
+                ? array_intersect(['content'], array_keys($request->all()))
+                : array_intersect(['name', 'host_path'], array_keys($request->all()));
+
+            if (! empty($typeSpecificInvalidFields)) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => collect($typeSpecificInvalidFields)
+                        ->mapWithKeys(fn ($field) => [$field => "Field '{$field}' is not valid for type '{$request->type}'."]),
+                ], 422);
+            }
+        }
+
+        // Always allowed
+        if ($request->has('is_preview_suffix_enabled')) {
+            $storage->is_preview_suffix_enabled = $request->is_preview_suffix_enabled;
+        }
+
+        // Only for editable storages
+        if (! $isReadOnly) {
+            if ($request->type === 'persistent') {
+                if ($request->has('name')) {
+                    $storage->name = $request->name;
+                }
+                if ($request->has('mount_path')) {
+                    $storage->mount_path = $request->mount_path;
+                }
+                if ($request->has('host_path')) {
+                    $storage->host_path = $request->host_path;
+                }
+            } else {
+                if ($request->has('mount_path')) {
+                    $storage->mount_path = $request->mount_path;
+                }
+                if ($request->has('content')) {
+                    $storage->content = $request->content;
+                }
+            }
+        }
+
+        $storage->save();
+
+        return response()->json($storage);
+    }
+
+    #[OA\Delete(
+        summary: 'Delete Storage',
+        description: 'Delete a persistent storage or file storage by database UUID.',
+        path: '/databases/{uuid}/storages/{storage_uuid}',
+        operationId: 'delete-storage-by-database-uuid',
+        security: [
+            ['bearerAuth' => []],
+        ],
+        tags: ['Databases'],
+        parameters: [
+            new OA\Parameter(
+                name: 'uuid',
+                in: 'path',
+                description: 'UUID of the database.',
+                required: true,
+                schema: new OA\Schema(type: 'string')
+            ),
+            new OA\Parameter(
+                name: 'storage_uuid',
+                in: 'path',
+                description: 'UUID of the storage.',
+                required: true,
+                schema: new OA\Schema(type: 'string')
+            ),
+        ],
+        responses: [
+            new OA\Response(response: 200, description: 'Storage deleted.', content: new OA\JsonContent(
+                properties: [new OA\Property(property: 'message', type: 'string')],
+            )),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 400, ref: '#/components/responses/400'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ]
+    )]
+    public function delete_storage(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $database = queryDatabaseByUuidWithinTeam($request->uuid, $teamId);
+        if (! $database) {
+            return response()->json(['message' => 'Database not found.'], 404);
+        }
+
+        $this->authorize('update', $database);
+
+        $storageUuid = $request->route('storage_uuid');
+
+        $storage = $database->persistentStorages->where('uuid', $storageUuid)->first();
+        if (! $storage) {
+            $storage = $database->fileStorages->where('uuid', $storageUuid)->first();
+        }
+
+        if (! $storage) {
+            return response()->json(['message' => 'Storage not found.'], 404);
+        }
+
+        if ($storage->shouldBeReadOnlyInUI()) {
+            return response()->json([
+                'message' => 'This storage is read-only (managed by docker-compose or service definition) and cannot be deleted.',
+            ], 422);
+        }
+
+        if ($storage instanceof LocalFileVolume) {
+            $storage->deleteStorageOnServer();
+        }
+
+        $storage->delete();
+
+        return response()->json(['message' => 'Storage deleted.']);
+    }
 }

app/Http/Controllers/Api/HetznerController.php

@@ -586,7 +586,8 @@ public function createServer(Request $request)
         }
 
         // Check server limit
-        if (Team::serverLimitReached()) {
+        $team = Team::find($teamId);
+        if (Team::serverLimitReached($team)) {
             return response()->json(['message' => 'Server limit reached for your subscription.'], 400);
         }
 

app/Http/Controllers/Api/ServicesController.php

@@ -8,9 +8,12 @@
 use App\Http\Controllers\Controller;
 use App\Jobs\DeleteResourceJob;
 use App\Models\EnvironmentVariable;
+use App\Models\LocalFileVolume;
+use App\Models\LocalPersistentVolume;
 use App\Models\Project;
 use App\Models\Server;
 use App\Models\Service;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Validator;
 use OpenApi\Attributes as OA;
@@ -1849,4 +1852,606 @@ public function action_restart(Request $request)
             200
         );
     }
+
+    #[OA\Get(
+        summary: 'List Storages',
+        description: 'List all persistent storages and file storages by service UUID.',
+        path: '/services/{uuid}/storages',
+        operationId: 'list-storages-by-service-uuid',
+        security: [
+            ['bearerAuth' => []],
+        ],
+        tags: ['Services'],
+        parameters: [
+            new OA\Parameter(
+                name: 'uuid',
+                in: 'path',
+                description: 'UUID of the service.',
+                required: true,
+                schema: new OA\Schema(
+                    type: 'string',
+                )
+            ),
+        ],
+        responses: [
+            new OA\Response(
+                response: 200,
+                description: 'All storages by service UUID.',
+                content: new OA\JsonContent(
+                    properties: [
+                        new OA\Property(property: 'persistent_storages', type: 'array', items: new OA\Items(type: 'object')),
+                        new OA\Property(property: 'file_storages', type: 'array', items: new OA\Items(type: 'object')),
+                    ],
+                ),
+            ),
+            new OA\Response(
+                response: 401,
+                ref: '#/components/responses/401',
+            ),
+            new OA\Response(
+                response: 400,
+                ref: '#/components/responses/400',
+            ),
+            new OA\Response(
+                response: 404,
+                ref: '#/components/responses/404',
+            ),
+        ]
+    )]
+    public function storages(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+        $service = Service::whereRelation('environment.project.team', 'id', $teamId)->whereUuid($request->uuid)->first();
+
+        if (! $service) {
+            return response()->json([
+                'message' => 'Service not found.',
+            ], 404);
+        }
+
+        $this->authorize('view', $service);
+
+        $persistentStorages = collect();
+        $fileStorages = collect();
+
+        foreach ($service->applications as $app) {
+            $persistentStorages = $persistentStorages->merge(
+                $app->persistentStorages->map(fn ($s) => $s->setAttribute('resource_uuid', $app->uuid)->setAttribute('resource_type', 'application'))
+            );
+            $fileStorages = $fileStorages->merge(
+                $app->fileStorages->map(fn ($s) => $s->setAttribute('resource_uuid', $app->uuid)->setAttribute('resource_type', 'application'))
+            );
+        }
+        foreach ($service->databases as $db) {
+            $persistentStorages = $persistentStorages->merge(
+                $db->persistentStorages->map(fn ($s) => $s->setAttribute('resource_uuid', $db->uuid)->setAttribute('resource_type', 'database'))
+            );
+            $fileStorages = $fileStorages->merge(
+                $db->fileStorages->map(fn ($s) => $s->setAttribute('resource_uuid', $db->uuid)->setAttribute('resource_type', 'database'))
+            );
+        }
+
+        return response()->json([
+            'persistent_storages' => $persistentStorages->sortBy('id')->values(),
+            'file_storages' => $fileStorages->sortBy('id')->values(),
+        ]);
+    }
+
+    #[OA\Post(
+        summary: 'Create Storage',
+        description: 'Create a persistent storage or file storage for a service sub-resource.',
+        path: '/services/{uuid}/storages',
+        operationId: 'create-storage-by-service-uuid',
+        security: [
+            ['bearerAuth' => []],
+        ],
+        tags: ['Services'],
+        parameters: [
+            new OA\Parameter(
+                name: 'uuid',
+                in: 'path',
+                description: 'UUID of the service.',
+                required: true,
+                schema: new OA\Schema(type: 'string')
+            ),
+        ],
+        requestBody: new OA\RequestBody(
+            required: true,
+            content: [
+                new OA\MediaType(
+                    mediaType: 'application/json',
+                    schema: new OA\Schema(
+                        type: 'object',
+                        required: ['type', 'mount_path', 'resource_uuid'],
+                        properties: [
+                            'type' => ['type' => 'string', 'enum' => ['persistent', 'file'], 'description' => 'The type of storage.'],
+                            'resource_uuid' => ['type' => 'string', 'description' => 'UUID of the service application or database sub-resource.'],
+                            'name' => ['type' => 'string', 'description' => 'Volume name (persistent only, required for persistent).'],
+                            'mount_path' => ['type' => 'string', 'description' => 'The container mount path.'],
+                            'host_path' => ['type' => 'string', 'nullable' => true, 'description' => 'The host path (persistent only, optional).'],
+                            'content' => ['type' => 'string', 'nullable' => true, 'description' => 'File content (file only, optional).'],
+                            'is_directory' => ['type' => 'boolean', 'description' => 'Whether this is a directory mount (file only, default false).'],
+                            'fs_path' => ['type' => 'string', 'description' => 'Host directory path (required when is_directory is true).'],
+                        ],
+                        additionalProperties: false,
+                    ),
+                ),
+            ],
+        ),
+        responses: [
+            new OA\Response(
+                response: 201,
+                description: 'Storage created.',
+                content: new OA\JsonContent(type: 'object'),
+            ),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 400, ref: '#/components/responses/400'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ]
+    )]
+    public function create_storage(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $return = validateIncomingRequest($request);
+        if ($return instanceof JsonResponse) {
+            return $return;
+        }
+
+        $service = Service::whereRelation('environment.project.team', 'id', $teamId)->whereUuid($request->uuid)->first();
+        if (! $service) {
+            return response()->json(['message' => 'Service not found.'], 404);
+        }
+
+        $this->authorize('update', $service);
+
+        $validator = customApiValidator($request->all(), [
+            'type' => 'required|string|in:persistent,file',
+            'resource_uuid' => 'required|string',
+            'name' => 'string',
+            'mount_path' => 'required|string',
+            'host_path' => 'string|nullable',
+            'content' => 'string|nullable',
+            'is_directory' => 'boolean',
+            'fs_path' => 'string',
+        ]);
+
+        $allAllowedFields = ['type', 'resource_uuid', 'name', 'mount_path', 'host_path', 'content', 'is_directory', 'fs_path'];
+        $extraFields = array_diff(array_keys($request->all()), $allAllowedFields);
+        if ($validator->fails() || ! empty($extraFields)) {
+            $errors = $validator->errors();
+            if (! empty($extraFields)) {
+                foreach ($extraFields as $field) {
+                    $errors->add($field, 'This field is not allowed.');
+                }
+            }
+
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => $errors,
+            ], 422);
+        }
+
+        $subResource = $service->applications()->where('uuid', $request->resource_uuid)->first();
+        if (! $subResource) {
+            $subResource = $service->databases()->where('uuid', $request->resource_uuid)->first();
+        }
+        if (! $subResource) {
+            return response()->json(['message' => 'Service resource not found.'], 404);
+        }
+
+        if ($request->type === 'persistent') {
+            if (! $request->name) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['name' => 'The name field is required for persistent storages.'],
+                ], 422);
+            }
+
+            $typeSpecificInvalidFields = array_intersect(['content', 'is_directory', 'fs_path'], array_keys($request->all()));
+            if (! empty($typeSpecificInvalidFields)) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => collect($typeSpecificInvalidFields)
+                        ->mapWithKeys(fn ($field) => [$field => "Field '{$field}' is not valid for type 'persistent'."]),
+                ], 422);
+            }
+
+            $storage = LocalPersistentVolume::create([
+                'name' => $subResource->uuid.'-'.$request->name,
+                'mount_path' => $request->mount_path,
+                'host_path' => $request->host_path,
+                'resource_id' => $subResource->id,
+                'resource_type' => $subResource->getMorphClass(),
+            ]);
+
+            return response()->json($storage, 201);
+        }
+
+        // File storage
+        $typeSpecificInvalidFields = array_intersect(['name', 'host_path'], array_keys($request->all()));
+        if (! empty($typeSpecificInvalidFields)) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => collect($typeSpecificInvalidFields)
+                    ->mapWithKeys(fn ($field) => [$field => "Field '{$field}' is not valid for type 'file'."]),
+            ], 422);
+        }
+
+        $isDirectory = $request->boolean('is_directory', false);
+
+        if ($isDirectory) {
+            if (! $request->fs_path) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => ['fs_path' => 'The fs_path field is required for directory mounts.'],
+                ], 422);
+            }
+
+            $fsPath = str($request->fs_path)->trim()->start('/')->value();
+            $mountPath = str($request->mount_path)->trim()->start('/')->value();
+
+            validateShellSafePath($fsPath, 'storage source path');
+            validateShellSafePath($mountPath, 'storage destination path');
+
+            $storage = LocalFileVolume::create([
+                'fs_path' => $fsPath,
+                'mount_path' => $mountPath,
+                'is_directory' => true,
+                'resource_id' => $subResource->id,
+                'resource_type' => get_class($subResource),
+            ]);
+        } else {
+            $mountPath = str($request->mount_path)->trim()->start('/')->value();
+            $fsPath = service_configuration_dir().'/'.$service->uuid.$mountPath;
+
+            $storage = LocalFileVolume::create([
+                'fs_path' => $fsPath,
+                'mount_path' => $mountPath,
+                'content' => $request->content,
+                'is_directory' => false,
+                'resource_id' => $subResource->id,
+                'resource_type' => get_class($subResource),
+            ]);
+        }
+
+        return response()->json($storage, 201);
+    }
+
+    #[OA\Patch(
+        summary: 'Update Storage',
+        description: 'Update a persistent storage or file storage by service UUID.',
+        path: '/services/{uuid}/storages',
+        operationId: 'update-storage-by-service-uuid',
+        security: [
+            ['bearerAuth' => []],
+        ],
+        tags: ['Services'],
+        parameters: [
+            new OA\Parameter(
+                name: 'uuid',
+                in: 'path',
+                description: 'UUID of the service.',
+                required: true,
+                schema: new OA\Schema(
+                    type: 'string',
+                )
+            ),
+        ],
+        requestBody: new OA\RequestBody(
+            description: 'Storage updated. For read-only storages (from docker-compose or services), only is_preview_suffix_enabled can be updated.',
+            required: true,
+            content: [
+                new OA\MediaType(
+                    mediaType: 'application/json',
+                    schema: new OA\Schema(
+                        type: 'object',
+                        required: ['type'],
+                        properties: [
+                            'uuid' => ['type' => 'string', 'description' => 'The UUID of the storage (preferred).'],
+                            'id' => ['type' => 'integer', 'description' => 'The ID of the storage (deprecated, use uuid instead).'],
+                            'type' => ['type' => 'string', 'enum' => ['persistent', 'file'], 'description' => 'The type of storage: persistent or file.'],
+                            'is_preview_suffix_enabled' => ['type' => 'boolean', 'description' => 'Whether to add -pr-N suffix for preview deployments.'],
+                            'name' => ['type' => 'string', 'description' => 'The volume name (persistent only, not allowed for read-only storages).'],
+                            'mount_path' => ['type' => 'string', 'description' => 'The container mount path (not allowed for read-only storages).'],
+                            'host_path' => ['type' => 'string', 'nullable' => true, 'description' => 'The host path (persistent only, not allowed for read-only storages).'],
+                            'content' => ['type' => 'string', 'nullable' => true, 'description' => 'The file content (file only, not allowed for read-only storages).'],
+                        ],
+                        additionalProperties: false,
+                    ),
+                ),
+            ],
+        ),
+        responses: [
+            new OA\Response(
+                response: 200,
+                description: 'Storage updated.',
+                content: new OA\JsonContent(type: 'object'),
+            ),
+            new OA\Response(
+                response: 401,
+                ref: '#/components/responses/401',
+            ),
+            new OA\Response(
+                response: 400,
+                ref: '#/components/responses/400',
+            ),
+            new OA\Response(
+                response: 404,
+                ref: '#/components/responses/404',
+            ),
+            new OA\Response(
+                response: 422,
+                ref: '#/components/responses/422',
+            ),
+        ]
+    )]
+    public function update_storage(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $return = validateIncomingRequest($request);
+        if ($return instanceof JsonResponse) {
+            return $return;
+        }
+
+        $service = Service::whereRelation('environment.project.team', 'id', $teamId)->whereUuid($request->route('uuid'))->first();
+
+        if (! $service) {
+            return response()->json([
+                'message' => 'Service not found.',
+            ], 404);
+        }
+
+        $this->authorize('update', $service);
+
+        $validator = customApiValidator($request->all(), [
+            'uuid' => 'string',
+            'id' => 'integer',
+            'type' => 'required|string|in:persistent,file',
+            'is_preview_suffix_enabled' => 'boolean',
+            'name' => 'string',
+            'mount_path' => 'string',
+            'host_path' => 'string|nullable',
+            'content' => 'string|nullable',
+        ]);
+
+        $allAllowedFields = ['uuid', 'id', 'type', 'is_preview_suffix_enabled', 'name', 'mount_path', 'host_path', 'content'];
+        $extraFields = array_diff(array_keys($request->all()), $allAllowedFields);
+        if ($validator->fails() || ! empty($extraFields)) {
+            $errors = $validator->errors();
+            if (! empty($extraFields)) {
+                foreach ($extraFields as $field) {
+                    $errors->add($field, 'This field is not allowed.');
+                }
+            }
+
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => $errors,
+            ], 422);
+        }
+
+        $storageUuid = $request->input('uuid');
+        $storageId = $request->input('id');
+
+        if (! $storageUuid && ! $storageId) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => ['uuid' => 'Either uuid or id is required.'],
+            ], 422);
+        }
+
+        $lookupField = $storageUuid ? 'uuid' : 'id';
+        $lookupValue = $storageUuid ?? $storageId;
+
+        $storage = null;
+        if ($request->type === 'persistent') {
+            foreach ($service->applications as $app) {
+                $storage = $app->persistentStorages->where($lookupField, $lookupValue)->first();
+                if ($storage) {
+                    break;
+                }
+            }
+            if (! $storage) {
+                foreach ($service->databases as $db) {
+                    $storage = $db->persistentStorages->where($lookupField, $lookupValue)->first();
+                    if ($storage) {
+                        break;
+                    }
+                }
+            }
+        } else {
+            foreach ($service->applications as $app) {
+                $storage = $app->fileStorages->where($lookupField, $lookupValue)->first();
+                if ($storage) {
+                    break;
+                }
+            }
+            if (! $storage) {
+                foreach ($service->databases as $db) {
+                    $storage = $db->fileStorages->where($lookupField, $lookupValue)->first();
+                    if ($storage) {
+                        break;
+                    }
+                }
+            }
+        }
+
+        if (! $storage) {
+            return response()->json([
+                'message' => 'Storage not found.',
+            ], 404);
+        }
+
+        $isReadOnly = $storage->shouldBeReadOnlyInUI();
+        $editableOnlyFields = ['name', 'mount_path', 'host_path', 'content'];
+        $requestedEditableFields = array_intersect($editableOnlyFields, array_keys($request->all()));
+
+        if ($isReadOnly && ! empty($requestedEditableFields)) {
+            return response()->json([
+                'message' => 'This storage is read-only (managed by docker-compose or service definition). Only is_preview_suffix_enabled can be updated.',
+                'read_only_fields' => array_values($requestedEditableFields),
+            ], 422);
+        }
+
+        // Reject fields that don't apply to the given storage type
+        if (! $isReadOnly) {
+            $typeSpecificInvalidFields = $request->type === 'persistent'
+                ? array_intersect(['content'], array_keys($request->all()))
+                : array_intersect(['name', 'host_path'], array_keys($request->all()));
+
+            if (! empty($typeSpecificInvalidFields)) {
+                return response()->json([
+                    'message' => 'Validation failed.',
+                    'errors' => collect($typeSpecificInvalidFields)
+                        ->mapWithKeys(fn ($field) => [$field => "Field '{$field}' is not valid for type '{$request->type}'."]),
+                ], 422);
+            }
+        }
+
+        // Always allowed
+        if ($request->has('is_preview_suffix_enabled')) {
+            $storage->is_preview_suffix_enabled = $request->is_preview_suffix_enabled;
+        }
+
+        // Only for editable storages
+        if (! $isReadOnly) {
+            if ($request->type === 'persistent') {
+                if ($request->has('name')) {
+                    $storage->name = $request->name;
+                }
+                if ($request->has('mount_path')) {
+                    $storage->mount_path = $request->mount_path;
+                }
+                if ($request->has('host_path')) {
+                    $storage->host_path = $request->host_path;
+                }
+            } else {
+                if ($request->has('mount_path')) {
+                    $storage->mount_path = $request->mount_path;
+                }
+                if ($request->has('content')) {
+                    $storage->content = $request->content;
+                }
+            }
+        }
+
+        $storage->save();
+
+        return response()->json($storage);
+    }
+
+    #[OA\Delete(
+        summary: 'Delete Storage',
+        description: 'Delete a persistent storage or file storage by service UUID.',
+        path: '/services/{uuid}/storages/{storage_uuid}',
+        operationId: 'delete-storage-by-service-uuid',
+        security: [
+            ['bearerAuth' => []],
+        ],
+        tags: ['Services'],
+        parameters: [
+            new OA\Parameter(
+                name: 'uuid',
+                in: 'path',
+                description: 'UUID of the service.',
+                required: true,
+                schema: new OA\Schema(type: 'string')
+            ),
+            new OA\Parameter(
+                name: 'storage_uuid',
+                in: 'path',
+                description: 'UUID of the storage.',
+                required: true,
+                schema: new OA\Schema(type: 'string')
+            ),
+        ],
+        responses: [
+            new OA\Response(response: 200, description: 'Storage deleted.', content: new OA\JsonContent(
+                properties: [new OA\Property(property: 'message', type: 'string')],
+            )),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 400, ref: '#/components/responses/400'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ]
+    )]
+    public function delete_storage(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $service = Service::whereRelation('environment.project.team', 'id', $teamId)->whereUuid($request->uuid)->first();
+        if (! $service) {
+            return response()->json(['message' => 'Service not found.'], 404);
+        }
+
+        $this->authorize('update', $service);
+
+        $storageUuid = $request->route('storage_uuid');
+
+        $storage = null;
+        foreach ($service->applications as $app) {
+            $storage = $app->persistentStorages->where('uuid', $storageUuid)->first();
+            if ($storage) {
+                break;
+            }
+        }
+        if (! $storage) {
+            foreach ($service->databases as $db) {
+                $storage = $db->persistentStorages->where('uuid', $storageUuid)->first();
+                if ($storage) {
+                    break;
+                }
+            }
+        }
+        if (! $storage) {
+            foreach ($service->applications as $app) {
+                $storage = $app->fileStorages->where('uuid', $storageUuid)->first();
+                if ($storage) {
+                    break;
+                }
+            }
+        }
+        if (! $storage) {
+            foreach ($service->databases as $db) {
+                $storage = $db->fileStorages->where('uuid', $storageUuid)->first();
+                if ($storage) {
+                    break;
+                }
+            }
+        }
+
+        if (! $storage) {
+            return response()->json(['message' => 'Storage not found.'], 404);
+        }
+
+        if ($storage->shouldBeReadOnlyInUI()) {
+            return response()->json([
+                'message' => 'This storage is read-only (managed by docker-compose or service definition) and cannot be deleted.',
+            ], 422);
+        }
+
+        if ($storage instanceof LocalFileVolume) {
+            $storage->deleteStorageOnServer();
+        }
+
+        $storage->delete();
+
+        return response()->json(['message' => 'Storage deleted.']);
+    }
 }

app/Http/Controllers/Webhook/Github.php

@@ -55,6 +55,9 @@ public function manual(Request $request)
                 $after_sha = data_get($payload, 'after', data_get($payload, 'pull_request.head.sha'));
                 $author_association = data_get($payload, 'pull_request.author_association');
             }
+            if (! in_array($x_github_event, ['push', 'pull_request'])) {
+                return response("Nothing to do. Event '$x_github_event' is not supported.");
+            }
             if (! $branch) {
                 return response('Nothing to do. No branch found in the request.');
             }
@@ -246,6 +249,9 @@ public function normal(Request $request)
                 $after_sha = data_get($payload, 'after', data_get($payload, 'pull_request.head.sha'));
                 $author_association = data_get($payload, 'pull_request.author_association');
             }
+            if (! in_array($x_github_event, ['push', 'pull_request'])) {
+                return response("Nothing to do. Event '$x_github_event' is not supported.");
+            }
             if (! $id || ! $branch) {
                 return response('Nothing to do. No id or branch found.');
             }

app/Jobs/ApplicationDeploymentJob.php

@@ -2334,13 +2334,13 @@ private function nixpacks_build_cmd()
         $this->generate_nixpacks_env_variables();
         $nixpacks_command = "nixpacks plan -f json {$this->env_nixpacks_args}";
         if ($this->application->build_command) {
-            $nixpacks_command .= " --build-cmd \"{$this->application->build_command}\"";
+            $nixpacks_command .= ' --build-cmd '.escapeShellValue($this->application->build_command);
         }
         if ($this->application->start_command) {
-            $nixpacks_command .= " --start-cmd \"{$this->application->start_command}\"";
+            $nixpacks_command .= ' --start-cmd '.escapeShellValue($this->application->start_command);
         }
         if ($this->application->install_command) {
-            $nixpacks_command .= " --install-cmd \"{$this->application->install_command}\"";
+            $nixpacks_command .= ' --install-cmd '.escapeShellValue($this->application->install_command);
         }
         $nixpacks_command .= " {$this->workdir}";
 
@@ -2353,13 +2353,15 @@ private function generate_nixpacks_env_variables()
         if ($this->pull_request_id === 0) {
             foreach ($this->application->nixpacks_environment_variables as $env) {
                 if (! is_null($env->real_value) && $env->real_value !== '') {
-                    $this->env_nixpacks_args->push("--env {$env->key}={$env->real_value}");
+                    $value = ($env->is_literal || $env->is_multiline) ? trim($env->real_value, "'") : $env->real_value;
+                    $this->env_nixpacks_args->push('--env '.escapeShellValue("{$env->key}={$value}"));
                 }
             }
         } else {
             foreach ($this->application->nixpacks_environment_variables_preview as $env) {
                 if (! is_null($env->real_value) && $env->real_value !== '') {
-                    $this->env_nixpacks_args->push("--env {$env->key}={$env->real_value}");
+                    $value = ($env->is_literal || $env->is_multiline) ? trim($env->real_value, "'") : $env->real_value;
+                    $this->env_nixpacks_args->push('--env '.escapeShellValue("{$env->key}={$value}"));
                 }
             }
         }
@@ -2369,7 +2371,7 @@ private function generate_nixpacks_env_variables()
         $coolify_envs->each(function ($value, $key) {
             // Only add environment variables with non-null and non-empty values
             if (! is_null($value) && $value !== '') {
-                $this->env_nixpacks_args->push("--env {$key}={$value}");
+                $this->env_nixpacks_args->push('--env '.escapeShellValue("{$key}={$value}"));
             }
         });
 

app/Jobs/DockerCleanupJob.php

@@ -46,14 +46,20 @@ public function __construct(
     public function handle(): void
     {
         try {
-            if (! $this->server->isFunctional()) {
-                return;
-            }
-
             $this->execution_log = DockerCleanupExecution::create([
                 'server_id' => $this->server->id,
             ]);
 
+            if (! $this->server->isFunctional()) {
+                $this->execution_log->update([
+                    'status' => 'failed',
+                    'message' => 'Server is not functional (unreachable, unusable, or disabled)',
+                    'finished_at' => Carbon::now()->toImmutable(),
+                ]);
+
+                return;
+            }
+
             $this->usageBefore = $this->server->getDiskUsage();
 
             if ($this->manualCleanup || $this->server->settings->force_docker_cleanup) {

app/Jobs/ScheduledJobManager.php

@@ -6,7 +6,6 @@
 use App\Models\ScheduledTask;
 use App\Models\Server;
 use App\Models\Team;
-use Cron\CronExpression;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldQueue;
 use Illuminate\Foundation\Bus\Dispatchable;
@@ -185,7 +184,7 @@ private function processScheduledBackups(): void
                     $frequency = VALID_CRON_STRINGS[$frequency];
                 }
 
-                if ($this->shouldRunNow($frequency, $serverTimezone, "scheduled-backup:{$backup->id}")) {
+                if (shouldRunCronNow($frequency, $serverTimezone, "scheduled-backup:{$backup->id}", $this->executionTime)) {
                     DatabaseBackupJob::dispatch($backup);
                     $this->dispatchedCount++;
                     Log::channel('scheduled')->info('Backup dispatched', [
@@ -239,7 +238,7 @@ private function processScheduledTasks(): void
                     $frequency = VALID_CRON_STRINGS[$frequency];
                 }
 
-                if (! $this->shouldRunNow($frequency, $serverTimezone, "scheduled-task:{$task->id}")) {
+                if (! shouldRunCronNow($frequency, $serverTimezone, "scheduled-task:{$task->id}", $this->executionTime)) {
                     continue;
                 }
 
@@ -336,51 +335,6 @@ private function getTaskRuntimeSkipReason(ScheduledTask $task): ?string
         return null;
     }
 
-    /**
-     * Determine if a cron schedule should run now.
-     *
-     * When a dedupKey is provided, uses getPreviousRunDate() + last-dispatch tracking
-     * instead of isDue(). This is resilient to queue delays — even if the job is delayed
-     * by minutes, it still catches the missed cron window. Without dedupKey, falls back
-     * to simple isDue() check.
-     */
-    private function shouldRunNow(string $frequency, string $timezone, ?string $dedupKey = null): bool
-    {
-        $cron = new CronExpression($frequency);
-        $baseTime = $this->executionTime ?? Carbon::now();
-        $executionTime = $baseTime->copy()->setTimezone($timezone);
-
-        // No dedup key → simple isDue check
-        if ($dedupKey === null) {
-            return $cron->isDue($executionTime);
-        }
-
-        // Get the most recent time this cron was due (including current minute)
-        $previousDue = Carbon::instance($cron->getPreviousRunDate($executionTime, allowCurrentDate: true));
-
-        $lastDispatched = Cache::get($dedupKey);
-
-        if ($lastDispatched === null) {
-            // First run after restart or cache loss: only fire if actually due right now.
-            // Seed the cache so subsequent runs can use tolerance/catch-up logic.
-            $isDue = $cron->isDue($executionTime);
-            if ($isDue) {
-                Cache::put($dedupKey, $executionTime->toIso8601String(), 86400);
-            }
-
-            return $isDue;
-        }
-
-        // Subsequent runs: fire if there's been a due time since last dispatch
-        if ($previousDue->gt(Carbon::parse($lastDispatched))) {
-            Cache::put($dedupKey, $executionTime->toIso8601String(), 86400);
-
-            return true;
-        }
-
-        return false;
-    }
-
     private function processDockerCleanups(): void
     {
         // Get all servers that need cleanup checks
@@ -411,7 +365,7 @@ private function processDockerCleanups(): void
                 }
 
                 // Use the frozen execution time for consistent evaluation
-                if ($this->shouldRunNow($frequency, $serverTimezone, "docker-cleanup:{$server->id}")) {
+                if (shouldRunCronNow($frequency, $serverTimezone, "docker-cleanup:{$server->id}", $this->executionTime)) {
                     DockerCleanupJob::dispatch(
                         $server,
                         false,

app/Jobs/ServerManagerJob.php

@@ -5,7 +5,6 @@
 use App\Models\InstanceSettings;
 use App\Models\Server;
 use App\Models\Team;
-use Cron\CronExpression;
 use Illuminate\Bus\Queueable;
 use Illuminate\Contracts\Queue\ShouldBeEncrypted;
 use Illuminate\Contracts\Queue\ShouldQueue;
@@ -14,7 +13,6 @@
 use Illuminate\Queue\SerializesModels;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Collection;
-use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Log;
 
 class ServerManagerJob implements ShouldBeEncrypted, ShouldQueue
@@ -81,7 +79,7 @@ private function getServers(): Collection
     private function dispatchConnectionChecks(Collection $servers): void
     {
 
-        if ($this->shouldRunNow($this->checkFrequency, dedupKey: 'server-connection-checks')) {
+        if (shouldRunCronNow($this->checkFrequency, $this->instanceTimezone, 'server-connection-checks', $this->executionTime)) {
             $servers->each(function (Server $server) {
                 try {
                     // Skip SSH connection check if Sentinel is healthy — its heartbeat already proves connectivity
@@ -130,13 +128,13 @@ private function processServerTasks(Server $server): void
 
         if ($sentinelOutOfSync) {
             // Dispatch ServerCheckJob if Sentinel is out of sync
-            if ($this->shouldRunNow($this->checkFrequency, $serverTimezone, "server-check:{$server->id}")) {
+            if (shouldRunCronNow($this->checkFrequency, $serverTimezone, "server-check:{$server->id}", $this->executionTime)) {
                 ServerCheckJob::dispatch($server);
             }
         }
 
         $isSentinelEnabled = $server->isSentinelEnabled();
-        $shouldRestartSentinel = $isSentinelEnabled && $this->shouldRunNow('0 0 * * *', $serverTimezone, "sentinel-restart:{$server->id}");
+        $shouldRestartSentinel = $isSentinelEnabled && shouldRunCronNow('0 0 * * *', $serverTimezone, "sentinel-restart:{$server->id}", $this->executionTime);
         // Dispatch Sentinel restart if due (daily for Sentinel-enabled servers)
 
         if ($shouldRestartSentinel) {
@@ -150,7 +148,7 @@ private function processServerTasks(Server $server): void
             if (isset(VALID_CRON_STRINGS[$serverDiskUsageCheckFrequency])) {
                 $serverDiskUsageCheckFrequency = VALID_CRON_STRINGS[$serverDiskUsageCheckFrequency];
             }
-            $shouldRunStorageCheck = $this->shouldRunNow($serverDiskUsageCheckFrequency, $serverTimezone, "server-storage-check:{$server->id}");
+            $shouldRunStorageCheck = shouldRunCronNow($serverDiskUsageCheckFrequency, $serverTimezone, "server-storage-check:{$server->id}", $this->executionTime);
 
             if ($shouldRunStorageCheck) {
                 ServerStorageCheckJob::dispatch($server);
@@ -158,7 +156,7 @@ private function processServerTasks(Server $server): void
         }
 
         // Dispatch ServerPatchCheckJob if due (weekly)
-        $shouldRunPatchCheck = $this->shouldRunNow('0 0 * * 0', $serverTimezone, "server-patch-check:{$server->id}");
+        $shouldRunPatchCheck = shouldRunCronNow('0 0 * * 0', $serverTimezone, "server-patch-check:{$server->id}", $this->executionTime);
 
         if ($shouldRunPatchCheck) { // Weekly on Sunday at midnight
             ServerPatchCheckJob::dispatch($server);
@@ -167,45 +165,4 @@ private function processServerTasks(Server $server): void
         // Note: CheckAndStartSentinelJob is only dispatched daily (line above) for version updates.
         // Crash recovery is handled by sentinelOutOfSync → ServerCheckJob → CheckAndStartSentinelJob.
     }
-
-    /**
-     * Determine if a cron schedule should run now.
-     *
-     * When a dedupKey is provided, uses getPreviousRunDate() + last-dispatch tracking
-     * instead of isDue(). This is resilient to queue delays — even if the job is delayed
-     * by minutes, it still catches the missed cron window.
-     */
-    private function shouldRunNow(string $frequency, ?string $timezone = null, ?string $dedupKey = null): bool
-    {
-        $cron = new CronExpression($frequency);
-
-        // Use the frozen execution time, not the current time
-        $baseTime = $this->executionTime ?? Carbon::now();
-        $executionTime = $baseTime->copy()->setTimezone($timezone ?? config('app.timezone'));
-
-        if ($dedupKey === null) {
-            return $cron->isDue($executionTime);
-        }
-
-        $previousDue = Carbon::instance($cron->getPreviousRunDate($executionTime, allowCurrentDate: true));
-
-        $lastDispatched = Cache::get($dedupKey);
-
-        if ($lastDispatched === null) {
-            $isDue = $cron->isDue($executionTime);
-            if ($isDue) {
-                Cache::put($dedupKey, $executionTime->toIso8601String(), 86400);
-            }
-
-            return $isDue;
-        }
-
-        if ($previousDue->gt(Carbon::parse($lastDispatched))) {
-            Cache::put($dedupKey, $executionTime->toIso8601String(), 86400);
-
-            return true;
-        }
-
-        return false;
-    }
 }

app/Jobs/StripeProcessJob.php

@@ -73,25 +73,15 @@ public function handle(): void
                         // send_internal_notification("User {$userId} is not an admin or owner of team {$team->id}, customerid: {$customerId}, subscriptionid: {$subscriptionId}.");
                         throw new \RuntimeException("User {$userId} is not an admin or owner of team {$team->id}, customerid: {$customerId}, subscriptionid: {$subscriptionId}.");
                     }
-                    $subscription = Subscription::where('team_id', $teamId)->first();
-                    if ($subscription) {
-                        // send_internal_notification('Old subscription activated for team: '.$teamId);
-                        $subscription->update([
+                    Subscription::updateOrCreate(
+                        ['team_id' => $teamId],
+                        [
                             'stripe_subscription_id' => $subscriptionId,
                             'stripe_customer_id' => $customerId,
                             'stripe_invoice_paid' => true,
                             'stripe_past_due' => false,
-                        ]);
-                    } else {
-                        // send_internal_notification('New subscription for team: '.$teamId);
-                        Subscription::create([
-                            'team_id' => $teamId,
-                            'stripe_subscription_id' => $subscriptionId,
-                            'stripe_customer_id' => $customerId,
-                            'stripe_invoice_paid' => true,
-                            'stripe_past_due' => false,
-                        ]);
-                    }
+                        ]
+                    );
                     break;
                 case 'invoice.paid':
                     $customerId = data_get($data, 'customer');
@@ -227,18 +217,14 @@ public function handle(): void
                         // send_internal_notification("User {$userId} is not an admin or owner of team {$team->id}, customerid: {$customerId}.");
                         throw new \RuntimeException("User {$userId} is not an admin or owner of team {$team->id}, customerid: {$customerId}.");
                     }
-                    $subscription = Subscription::where('team_id', $teamId)->first();
-                    if ($subscription) {
-                        // send_internal_notification("Subscription already exists for team: {$teamId}");
-                        throw new \RuntimeException("Subscription already exists for team: {$teamId}");
-                    } else {
-                        Subscription::create([
-                            'team_id' => $teamId,
+                    Subscription::updateOrCreate(
+                        ['team_id' => $teamId],
+                        [
                             'stripe_subscription_id' => $subscriptionId,
                             'stripe_customer_id' => $customerId,
                             'stripe_invoice_paid' => false,
-                        ]);
-                    }
+                        ]
+                    );
                     break;
                 case 'customer.subscription.updated':
                     $teamId = data_get($data, 'metadata.team_id');
@@ -254,20 +240,19 @@ public function handle(): void
                     $subscription = Subscription::where('stripe_customer_id', $customerId)->first();
                     if (! $subscription) {
                         if ($status === 'incomplete_expired') {
-                            // send_internal_notification('Subscription incomplete expired');
                             throw new \RuntimeException('Subscription incomplete expired');
                         }
-                        if ($teamId) {
-                            $subscription = Subscription::create([
-                                'team_id' => $teamId,
+                        if (! $teamId) {
+                            throw new \RuntimeException('No subscription and team id found');
+                        }
+                        $subscription = Subscription::firstOrCreate(
+                            ['team_id' => $teamId],
+                            [
                                 'stripe_subscription_id' => $subscriptionId,
                                 'stripe_customer_id' => $customerId,
                                 'stripe_invoice_paid' => false,
-                            ]);
-                        } else {
-                            // send_internal_notification('No subscription and team id found');
-                            throw new \RuntimeException('No subscription and team id found');
-                        }
+                            ]
+                        );
                     }
                     $cancelAtPeriodEnd = data_get($data, 'cancel_at_period_end');
                     $feedback = data_get($data, 'cancellation_details.feedback');

app/Livewire/Project/Shared/EnvironmentVariable/Show.php

@@ -98,6 +98,9 @@ public function getResourceProperty()
 
     public function refresh()
     {
+        if (! $this->env->exists || ! $this->env->fresh()) {
+            return;
+        }
         $this->syncData();
         $this->checkEnvs();
     }

app/Livewire/Subscription/PricingPlans.php

@@ -11,6 +11,12 @@ class PricingPlans extends Component
 {
     public function subscribeStripe($type)
     {
+        if (currentTeam()->subscription?->stripe_invoice_paid) {
+            $this->dispatch('error', 'Team already has an active subscription.');
+
+            return;
+        }
+
         Stripe::setApiKey(config('subscription.stripe_api_key'));
 
         $priceId = match ($type) {

app/Models/LocalPersistentVolume.php

@@ -3,10 +3,9 @@
 namespace App\Models;
 
 use Illuminate\Database\Eloquent\Casts\Attribute;
-use Illuminate\Database\Eloquent\Model;
 use Symfony\Component\Yaml\Yaml;
 
-class LocalPersistentVolume extends Model
+class LocalPersistentVolume extends BaseModel
 {
     protected $guarded = [];
 

app/Models/Server.php

@@ -1471,6 +1471,9 @@ public function changeProxy(string $proxyType, bool $async = true)
         if ($validProxyTypes->contains(str($proxyType)->lower())) {
             $this->proxy->set('type', str($proxyType)->upper());
             $this->proxy->set('status', 'exited');
+            $this->proxy->set('last_saved_proxy_configuration', null);
+            $this->proxy->set('last_saved_settings', null);
+            $this->proxy->set('last_applied_settings', null);
             $this->save();
             if ($this->proxySet()) {
                 if ($async) {

app/Models/Team.php

@@ -89,10 +89,13 @@ protected static function booted()
         });
     }
 
-    public static function serverLimitReached()
+    public static function serverLimitReached(?Team $team = null)
     {
-        $serverLimit = Team::serverLimit();
-        $team = currentTeam();
+        $team = $team ?? currentTeam();
+        if (! $team) {
+            return true;
+        }
+        $serverLimit = Team::serverLimit($team);
         $servers = $team->servers->count();
 
         return $servers >= $serverLimit;
@@ -109,19 +112,23 @@ public function subscriptionPastOverDue()
 
     public function serverOverflow()
     {
-        if ($this->serverLimit() < $this->servers->count()) {
+        if (Team::serverLimit($this) < $this->servers->count()) {
             return true;
         }
 
         return false;
     }
 
-    public static function serverLimit()
+    public static function serverLimit(?Team $team = null)
     {
-        if (currentTeam()->id === 0 && isDev()) {
+        $team = $team ?? currentTeam();
+        if (! $team) {
+            return 0;
+        }
+        if ($team->id === 0 && isDev()) {
             return 9999999;
         }
-        $team = Team::find(currentTeam()->id);
+        $team = Team::find($team->id);
         if (! $team) {
             return 0;
         }

app/Rules/ValidHostname.php

@@ -62,12 +62,15 @@ public function validate(string $attribute, mixed $value, Closure $fail): void
                     // Ignore errors when facades are not available (e.g., in unit tests)
                 }
 
-                $fail('The :attribute contains invalid characters. Only lowercase letters (a-z), numbers (0-9), hyphens (-), and dots (.) are allowed.');
+                $fail('The :attribute contains invalid characters. Only letters (a-z, A-Z), numbers (0-9), hyphens (-), and dots (.) are allowed.');
 
                 return;
             }
         }
 
+        // Normalize to lowercase for validation (RFC 1123 hostnames are case-insensitive)
+        $hostname = strtolower($hostname);
+
         // Additional validation: hostname should not start or end with a dot
         if (str_starts_with($hostname, '.') || str_ends_with($hostname, '.')) {
             $fail('The :attribute cannot start or end with a dot.');
@@ -100,9 +103,9 @@ public function validate(string $attribute, mixed $value, Closure $fail): void
                 return;
             }
 
-            // Check if label contains only valid characters (lowercase letters, digits, hyphens)
+            // Check if label contains only valid characters (letters, digits, hyphens)
             if (! preg_match('/^[a-z0-9-]+$/', $label)) {
-                $fail('The :attribute contains invalid characters. Only lowercase letters (a-z), numbers (0-9), hyphens (-), and dots (.) are allowed.');
+                $fail('The :attribute contains invalid characters. Only letters (a-z, A-Z), numbers (0-9), hyphens (-), and dots (.) are allowed.');
 
                 return;
             }

app/Support/ValidationPatterns.php

@@ -10,7 +10,7 @@ class ValidationPatterns
     /**
      * Pattern for names excluding all dangerous characters
      */
-    public const NAME_PATTERN = '/^[\p{L}\p{M}\p{N}\s\-_.@\/&]+$/u';
+    public const NAME_PATTERN = '/^[\p{L}\p{M}\p{N}\s\-_.@\/&()#,:+]+$/u';
 
     /**
      * Pattern for descriptions excluding all dangerous characters with some additional allowed characters
@@ -96,7 +96,7 @@ public static function descriptionRules(bool $required = false, int $maxLength =
     public static function nameMessages(): array
     {
         return [
-            'name.regex' => 'The name may only contain letters (including Unicode), numbers, spaces, and these characters: - _ . / @ &',
+            'name.regex' => 'The name may only contain letters (including Unicode), numbers, spaces, and these characters: - _ . / @ & ( ) # , : +',
             'name.min' => 'The name must be at least :min characters.',
             'name.max' => 'The name may not be greater than :max characters.',
         ];

bootstrap/helpers/docker.php

@@ -137,6 +137,11 @@ function checkMinimumDockerEngineVersion($dockerVersion)
 
     return $dockerVersion;
 }
+function escapeShellValue(string $value): string
+{
+    return "'".str_replace("'", "'\\''", $value)."'";
+}
+
 function executeInDocker(string $containerId, string $command)
 {
     $escapedCommand = str_replace("'", "'\\''", $command);

bootstrap/helpers/parsers.php

@@ -990,16 +990,17 @@ function applicationParser(Application $resource, int $pull_request_id = 0, ?int
             }
             if ($key->value() === $parsedValue->value()) {
                 // Simple variable reference (e.g. DATABASE_URL: ${DATABASE_URL})
-                // Use firstOrCreate to avoid overwriting user-saved values on redeploy
-                $envVar = $resource->environment_variables()->firstOrCreate([
+                // Ensure the variable exists in DB for .env generation and UI display
+                $resource->environment_variables()->firstOrCreate([
                     'key' => $key,
                     'resourceable_type' => get_class($resource),
                     'resourceable_id' => $resource->id,
                 ], [
                     'is_preview' => false,
                 ]);
-                // Add the variable to the environment using the saved DB value
-                $environment[$key->value()] = $envVar->value;
+                // Keep the ${VAR} reference in compose — Docker Compose resolves from .env at deploy time.
+                // Do NOT replace with DB value: if user updates env var without re-parsing compose,
+                // a stale resolved value in environment: would override the correct .env value.
             } else {
                 if ($value->startsWith('$')) {
                     $isRequired = false;
@@ -2341,8 +2342,8 @@ function serviceParser(Service $resource): Collection
             }
             if ($key->value() === $parsedValue->value()) {
                 // Simple variable reference (e.g. DATABASE_URL: ${DATABASE_URL})
-                // Use firstOrCreate to avoid overwriting user-saved values on redeploy
-                $envVar = $resource->environment_variables()->firstOrCreate([
+                // Ensure the variable exists in DB for .env generation and UI display
+                $resource->environment_variables()->firstOrCreate([
                     'key' => $key,
                     'resourceable_type' => get_class($resource),
                     'resourceable_id' => $resource->id,
@@ -2350,8 +2351,9 @@ function serviceParser(Service $resource): Collection
                     'is_preview' => false,
                     'comment' => $envComments[$originalKey] ?? null,
                 ]);
-                // Add the variable to the environment using the saved DB value
-                $environment[$key->value()] = $envVar->value;
+                // Keep the ${VAR} reference in compose — Docker Compose resolves from .env at deploy time.
+                // Do NOT replace with DB value: if user updates env var without re-parsing compose,
+                // a stale resolved value in environment: would override the correct .env value.
             } else {
                 if ($value->startsWith('$')) {
                     $isRequired = false;

bootstrap/helpers/shared.php

@@ -339,7 +339,18 @@ function generate_application_name(string $git_repository, string $git_branch, ?
         $cuid = new Cuid2;
     }
 
-    return Str::kebab("$git_repository:$git_branch-$cuid");
+    $repo_name = str_contains($git_repository, '/') ? last(explode('/', $git_repository)) : $git_repository;
+
+    $name = Str::kebab("$repo_name:$git_branch-$cuid");
+
+    // Strip characters not allowed by NAME_PATTERN
+    $name = preg_replace('/[^\p{L}\p{M}\p{N}\s\-_.@\/&()#,:+]+/u', '', $name);
+
+    if (empty($name) || mb_strlen($name) < 3) {
+        return generate_random_name($cuid);
+    }
+
+    return $name;
 }
 
 /**
@@ -466,6 +477,36 @@ function validate_cron_expression($expression_to_validate): bool
     return $isValid;
 }
 
+/**
+ * Determine if a cron schedule should run now, with deduplication.
+ *
+ * Uses getPreviousRunDate() + last-dispatch tracking to be resilient to queue delays.
+ * Even if the job runs minutes late, it still catches the missed cron window.
+ * Without a dedupKey, falls back to a simple isDue() check.
+ */
+function shouldRunCronNow(string $frequency, string $timezone, ?string $dedupKey = null, ?\Illuminate\Support\Carbon $executionTime = null): bool
+{
+    $cron = new \Cron\CronExpression($frequency);
+    $executionTime = ($executionTime ?? \Illuminate\Support\Carbon::now())->copy()->setTimezone($timezone);
+
+    if ($dedupKey === null) {
+        return $cron->isDue($executionTime);
+    }
+
+    $previousDue = \Illuminate\Support\Carbon::instance($cron->getPreviousRunDate($executionTime, allowCurrentDate: true));
+    $lastDispatched = Cache::get($dedupKey);
+
+    $shouldFire = $lastDispatched === null
+        ? $cron->isDue($executionTime)
+        : $previousDue->gt(\Illuminate\Support\Carbon::parse($lastDispatched));
+
+    // Always write: seeds on first miss, refreshes on dispatch.
+    // 30-day static TTL covers all intervals; orphan keys self-clean.
+    Cache::put($dedupKey, ($shouldFire ? $executionTime : $previousDue)->toIso8601String(), 2592000);
+
+    return $shouldFire;
+}
+
 function validate_timezone(string $timezone): bool
 {
     return in_array($timezone, timezone_identifiers_list());

composer.json

@@ -18,6 +18,7 @@
         "laravel/fortify": "^1.34.0",
         "laravel/framework": "^12.49.0",
         "laravel/horizon": "^5.43.0",
+        "laravel/nightwatch": "^1.24",
         "laravel/pail": "^1.2.4",
         "laravel/prompts": "^0.3.11|^0.3.11|^0.3.11",
         "laravel/sanctum": "^4.3.0",

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "19bb661d294e5cf623e68830604e4f60",
+    "content-hash": "40bddea995c1744e4aec517263109a2f",
     "packages": [
         {
             "name": "aws/aws-crt-php",
@@ -2065,6 +2065,100 @@
             },
             "time": "2026-02-21T14:20:09+00:00"
         },
+        {
+            "name": "laravel/nightwatch",
+            "version": "v1.24.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/laravel/nightwatch.git",
+                "reference": "127e9bb9928f0fcf69b52b244053b393c90347c8"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/laravel/nightwatch/zipball/127e9bb9928f0fcf69b52b244053b393c90347c8",
+                "reference": "127e9bb9928f0fcf69b52b244053b393c90347c8",
+                "shasum": ""
+            },
+            "require": {
+                "ext-zlib": "*",
+                "guzzlehttp/promises": "^2.0",
+                "laravel/framework": "^10.0|^11.0|^12.0|^13.0",
+                "monolog/monolog": "^3.6",
+                "nesbot/carbon": "^2.0|^3.0",
+                "php": "^8.2",
+                "psr/http-message": "^1.0|^2.0",
+                "psr/log": "^1.0|^2.0|^3.0",
+                "ramsey/uuid": "^4.0",
+                "symfony/console": "^6.0|^7.0|^8.0",
+                "symfony/http-foundation": "^6.0|^7.0|^8.0",
+                "symfony/polyfill-php84": "^1.29"
+            },
+            "require-dev": {
+                "aws/aws-sdk-php": "^3.349",
+                "ext-pcntl": "*",
+                "ext-pdo": "*",
+                "guzzlehttp/guzzle": "^7.0",
+                "guzzlehttp/psr7": "^2.0",
+                "laravel/horizon": "^5.4",
+                "laravel/pint": "1.21.0",
+                "laravel/vapor-core": "^2.38.2",
+                "livewire/livewire": "^2.0|^3.0",
+                "mockery/mockery": "^1.0",
+                "mongodb/laravel-mongodb": "^4.0|^5.0",
+                "orchestra/testbench": "^8.0|^9.0|^10.0",
+                "orchestra/testbench-core": "^8.0|^9.0|^10.0",
+                "orchestra/workbench": "^8.0|^9.0|^10.0",
+                "phpstan/phpstan": "^1.0",
+                "phpunit/phpunit": "^10.0|^11.0|^12.0",
+                "singlestoredb/singlestoredb-laravel": "^1.0|^2.0",
+                "spatie/laravel-ignition": "^2.0",
+                "symfony/mailer": "^6.0|^7.0|^8.0",
+                "symfony/mime": "^6.0|^7.0|^8.0",
+                "symfony/var-dumper": "^6.0|^7.0|^8.0"
+            },
+            "type": "library",
+            "extra": {
+                "laravel": {
+                    "aliases": {
+                        "Nightwatch": "Laravel\\Nightwatch\\Facades\\Nightwatch"
+                    },
+                    "providers": [
+                        "Laravel\\Nightwatch\\NightwatchServiceProvider"
+                    ]
+                }
+            },
+            "autoload": {
+                "files": [
+                    "agent/helpers.php"
+                ],
+                "psr-4": {
+                    "Laravel\\Nightwatch\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Taylor Otwell",
+                    "email": "taylor@laravel.com"
+                }
+            ],
+            "description": "The official Laravel Nightwatch package.",
+            "homepage": "https://nightwatch.laravel.com",
+            "keywords": [
+                "Insights",
+                "laravel",
+                "monitoring"
+            ],
+            "support": {
+                "docs": "https://nightwatch.laravel.com/docs",
+                "issues": "https://github.com/laravel/nightwatch/issues",
+                "source": "https://github.com/laravel/nightwatch"
+            },
+            "time": "2026-03-18T23:25:05+00:00"
+        },
         {
             "name": "laravel/pail",
             "version": "v1.2.6",
@@ -17209,5 +17303,5 @@
         "php": "^8.4"
     },
     "platform-dev": {},
-    "plugin-api-version": "2.9.0"
+    "plugin-api-version": "2.6.0"
 }

config/constants.php

@@ -3,7 +3,7 @@
 return [
     // MapleDeploy branding: registry pointed to Forgejo, auto-update disabled by default
     'coolify' => [
-        'version' => '4.0.0-beta.469',
+        'version' => '4.0.0-beta.470',
         'helper_version' => '1.0.12',
         'realtime_version' => '1.0.11',
         'self_hosted' => env('SELF_HOSTED', true),
@@ -56,6 +56,10 @@
         'is_scheduler_enabled' => env('SCHEDULER_ENABLED', true),
     ],
 
+    'nightwatch' => [
+        'is_nightwatch_enabled' => env('NIGHTWATCH_ENABLED', false),
+    ],
+
     'docker' => [
         'minimum_required_version' => '24.0',
     ],

config/logging.php

@@ -123,7 +123,7 @@
             'driver' => 'daily',
             'path' => storage_path('logs/scheduled.log'),
             'level' => 'debug',
-            'days' => 1,
+            'days' => 7,
         ],
 
         'scheduled-errors' => [

database/migrations/2026_03_23_101720_add_uuid_to_local_persistent_volumes_table.php

@@ -0,0 +1,39 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+use Visus\Cuid2\Cuid2;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::table('local_persistent_volumes', function (Blueprint $table) {
+            $table->string('uuid')->nullable()->after('id');
+        });
+
+        DB::table('local_persistent_volumes')
+            ->whereNull('uuid')
+            ->orderBy('id')
+            ->chunk(1000, function ($volumes) {
+                foreach ($volumes as $volume) {
+                    DB::table('local_persistent_volumes')
+                        ->where('id', $volume->id)
+                        ->update(['uuid' => (string) new Cuid2]);
+                }
+            });
+
+        Schema::table('local_persistent_volumes', function (Blueprint $table) {
+            $table->string('uuid')->nullable(false)->unique()->change();
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::table('local_persistent_volumes', function (Blueprint $table) {
+            $table->dropColumn('uuid');
+        });
+    }
+};

docker/development/etc/s6-overlay/s6-rc.d/nightwatch-agent/dependencies.d/init-setup

@@ -0,0 +1 @@
+

docker/development/etc/s6-overlay/s6-rc.d/nightwatch-agent/run

@@ -0,0 +1,12 @@
+#!/command/execlineb -P
+
+# Use with-contenv to ensure environment variables are available
+with-contenv
+cd /var/www/html
+
+foreground {
+    php
+    artisan
+    start:nightwatch
+}
+

docker/development/etc/s6-overlay/s6-rc.d/nightwatch-agent/type

@@ -0,0 +1 @@
+longrun

docker/development/etc/s6-overlay/s6-rc.d/user/contents.d/nightwatch-agent

@@ -0,0 +1 @@
+

docker/production/etc/s6-overlay/s6-rc.d/nightwatch-agent/dependencies.d/init-script

@@ -0,0 +1 @@
+

docker/production/etc/s6-overlay/s6-rc.d/nightwatch-agent/run

@@ -0,0 +1,11 @@
+#!/command/execlineb -P
+
+# Use with-contenv to ensure environment variables are available
+with-contenv
+cd /var/www/html
+foreground {
+    php
+    artisan
+    start:nightwatch
+}
+

docker/production/etc/s6-overlay/s6-rc.d/nightwatch-agent/type

@@ -0,0 +1 @@
+longrun

docker/production/etc/s6-overlay/s6-rc.d/user/contents.d/nightwatch-agent

@@ -0,0 +1 @@
+

openapi.json

@@ -3502,6 +3502,105 @@
                     }
                 ]
             },
+            "post": {
+                "tags": [
+                    "Applications"
+                ],
+                "summary": "Create Storage",
+                "description": "Create a persistent storage or file storage for an application.",
+                "operationId": "create-storage-by-application-uuid",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "description": "UUID of the application.",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application\/json": {
+                            "schema": {
+                                "required": [
+                                    "type",
+                                    "mount_path"
+                                ],
+                                "properties": {
+                                    "type": {
+                                        "type": "string",
+                                        "enum": [
+                                            "persistent",
+                                            "file"
+                                        ],
+                                        "description": "The type of storage."
+                                    },
+                                    "name": {
+                                        "type": "string",
+                                        "description": "Volume name (persistent only, required for persistent)."
+                                    },
+                                    "mount_path": {
+                                        "type": "string",
+                                        "description": "The container mount path."
+                                    },
+                                    "host_path": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "The host path (persistent only, optional)."
+                                    },
+                                    "content": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "File content (file only, optional)."
+                                    },
+                                    "is_directory": {
+                                        "type": "boolean",
+                                        "description": "Whether this is a directory mount (file only, default false)."
+                                    },
+                                    "fs_path": {
+                                        "type": "string",
+                                        "description": "Host directory path (required when is_directory is true)."
+                                    }
+                                },
+                                "type": "object",
+                                "additionalProperties": false
+                            }
+                        }
+                    }
+                },
+                "responses": {
+                    "201": {
+                        "description": "Storage created.",
+                        "content": {
+                            "application\/json": {
+                                "schema": {
+                                    "type": "object"
+                                }
+                            }
+                        }
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "400": {
+                        "$ref": "#\/components\/responses\/400"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    },
+                    "422": {
+                        "$ref": "#\/components\/responses\/422"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            },
             "patch": {
                 "tags": [
                     "Applications"
@@ -3527,13 +3626,16 @@
                         "application\/json": {
                             "schema": {
                                 "required": [
-                                    "id",
                                     "type"
                                 ],
                                 "properties": {
+                                    "uuid": {
+                                        "type": "string",
+                                        "description": "The UUID of the storage (preferred)."
+                                    },
                                     "id": {
                                         "type": "integer",
-                                        "description": "The ID of the storage."
+                                        "description": "The ID of the storage (deprecated, use uuid instead)."
                                     },
                                     "type": {
                                         "type": "string",
@@ -3603,6 +3705,70 @@
                 ]
             }
         },
+        "\/applications\/{uuid}\/storages\/{storage_uuid}": {
+            "delete": {
+                "tags": [
+                    "Applications"
+                ],
+                "summary": "Delete Storage",
+                "description": "Delete a persistent storage or file storage by application UUID.",
+                "operationId": "delete-storage-by-application-uuid",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "description": "UUID of the application.",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "storage_uuid",
+                        "in": "path",
+                        "description": "UUID of the storage.",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Storage deleted.",
+                        "content": {
+                            "application\/json": {
+                                "schema": {
+                                    "properties": {
+                                        "message": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    "type": "object"
+                                }
+                            }
+                        }
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "400": {
+                        "$ref": "#\/components\/responses\/400"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    },
+                    "422": {
+                        "$ref": "#\/components\/responses\/422"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
         "\/cloud-tokens": {
             "get": {
                 "tags": [
@@ -6513,6 +6679,333 @@
                 ]
             }
         },
+        "\/databases\/{uuid}\/storages": {
+            "get": {
+                "tags": [
+                    "Databases"
+                ],
+                "summary": "List Storages",
+                "description": "List all persistent storages and file storages by database UUID.",
+                "operationId": "list-storages-by-database-uuid",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "description": "UUID of the database.",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "All storages by database UUID.",
+                        "content": {
+                            "application\/json": {
+                                "schema": {
+                                    "properties": {
+                                        "persistent_storages": {
+                                            "type": "array",
+                                            "items": {
+                                                "type": "object"
+                                            }
+                                        },
+                                        "file_storages": {
+                                            "type": "array",
+                                            "items": {
+                                                "type": "object"
+                                            }
+                                        }
+                                    },
+                                    "type": "object"
+                                }
+                            }
+                        }
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "400": {
+                        "$ref": "#\/components\/responses\/400"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            },
+            "post": {
+                "tags": [
+                    "Databases"
+                ],
+                "summary": "Create Storage",
+                "description": "Create a persistent storage or file storage for a database.",
+                "operationId": "create-storage-by-database-uuid",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "description": "UUID of the database.",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application\/json": {
+                            "schema": {
+                                "required": [
+                                    "type",
+                                    "mount_path"
+                                ],
+                                "properties": {
+                                    "type": {
+                                        "type": "string",
+                                        "enum": [
+                                            "persistent",
+                                            "file"
+                                        ],
+                                        "description": "The type of storage."
+                                    },
+                                    "name": {
+                                        "type": "string",
+                                        "description": "Volume name (persistent only, required for persistent)."
+                                    },
+                                    "mount_path": {
+                                        "type": "string",
+                                        "description": "The container mount path."
+                                    },
+                                    "host_path": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "The host path (persistent only, optional)."
+                                    },
+                                    "content": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "File content (file only, optional)."
+                                    },
+                                    "is_directory": {
+                                        "type": "boolean",
+                                        "description": "Whether this is a directory mount (file only, default false)."
+                                    },
+                                    "fs_path": {
+                                        "type": "string",
+                                        "description": "Host directory path (required when is_directory is true)."
+                                    }
+                                },
+                                "type": "object",
+                                "additionalProperties": false
+                            }
+                        }
+                    }
+                },
+                "responses": {
+                    "201": {
+                        "description": "Storage created.",
+                        "content": {
+                            "application\/json": {
+                                "schema": {
+                                    "type": "object"
+                                }
+                            }
+                        }
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "400": {
+                        "$ref": "#\/components\/responses\/400"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    },
+                    "422": {
+                        "$ref": "#\/components\/responses\/422"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            },
+            "patch": {
+                "tags": [
+                    "Databases"
+                ],
+                "summary": "Update Storage",
+                "description": "Update a persistent storage or file storage by database UUID.",
+                "operationId": "update-storage-by-database-uuid",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "description": "UUID of the database.",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "requestBody": {
+                    "description": "Storage updated. For read-only storages (from docker-compose or services), only is_preview_suffix_enabled can be updated.",
+                    "required": true,
+                    "content": {
+                        "application\/json": {
+                            "schema": {
+                                "required": [
+                                    "type"
+                                ],
+                                "properties": {
+                                    "uuid": {
+                                        "type": "string",
+                                        "description": "The UUID of the storage (preferred)."
+                                    },
+                                    "id": {
+                                        "type": "integer",
+                                        "description": "The ID of the storage (deprecated, use uuid instead)."
+                                    },
+                                    "type": {
+                                        "type": "string",
+                                        "enum": [
+                                            "persistent",
+                                            "file"
+                                        ],
+                                        "description": "The type of storage: persistent or file."
+                                    },
+                                    "is_preview_suffix_enabled": {
+                                        "type": "boolean",
+                                        "description": "Whether to add -pr-N suffix for preview deployments."
+                                    },
+                                    "name": {
+                                        "type": "string",
+                                        "description": "The volume name (persistent only, not allowed for read-only storages)."
+                                    },
+                                    "mount_path": {
+                                        "type": "string",
+                                        "description": "The container mount path (not allowed for read-only storages)."
+                                    },
+                                    "host_path": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "The host path (persistent only, not allowed for read-only storages)."
+                                    },
+                                    "content": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "The file content (file only, not allowed for read-only storages)."
+                                    }
+                                },
+                                "type": "object",
+                                "additionalProperties": false
+                            }
+                        }
+                    }
+                },
+                "responses": {
+                    "200": {
+                        "description": "Storage updated.",
+                        "content": {
+                            "application\/json": {
+                                "schema": {
+                                    "type": "object"
+                                }
+                            }
+                        }
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "400": {
+                        "$ref": "#\/components\/responses\/400"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    },
+                    "422": {
+                        "$ref": "#\/components\/responses\/422"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
+        "\/databases\/{uuid}\/storages\/{storage_uuid}": {
+            "delete": {
+                "tags": [
+                    "Databases"
+                ],
+                "summary": "Delete Storage",
+                "description": "Delete a persistent storage or file storage by database UUID.",
+                "operationId": "delete-storage-by-database-uuid",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "description": "UUID of the database.",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "storage_uuid",
+                        "in": "path",
+                        "description": "UUID of the storage.",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Storage deleted.",
+                        "content": {
+                            "application\/json": {
+                                "schema": {
+                                    "properties": {
+                                        "message": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    "type": "object"
+                                }
+                            }
+                        }
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "400": {
+                        "$ref": "#\/components\/responses\/400"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    },
+                    "422": {
+                        "$ref": "#\/components\/responses\/422"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
         "\/deployments": {
             "get": {
                 "tags": [
@@ -11238,6 +11731,338 @@
                 ]
             }
         },
+        "\/services\/{uuid}\/storages": {
+            "get": {
+                "tags": [
+                    "Services"
+                ],
+                "summary": "List Storages",
+                "description": "List all persistent storages and file storages by service UUID.",
+                "operationId": "list-storages-by-service-uuid",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "description": "UUID of the service.",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "All storages by service UUID.",
+                        "content": {
+                            "application\/json": {
+                                "schema": {
+                                    "properties": {
+                                        "persistent_storages": {
+                                            "type": "array",
+                                            "items": {
+                                                "type": "object"
+                                            }
+                                        },
+                                        "file_storages": {
+                                            "type": "array",
+                                            "items": {
+                                                "type": "object"
+                                            }
+                                        }
+                                    },
+                                    "type": "object"
+                                }
+                            }
+                        }
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "400": {
+                        "$ref": "#\/components\/responses\/400"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            },
+            "post": {
+                "tags": [
+                    "Services"
+                ],
+                "summary": "Create Storage",
+                "description": "Create a persistent storage or file storage for a service sub-resource.",
+                "operationId": "create-storage-by-service-uuid",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "description": "UUID of the service.",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "requestBody": {
+                    "required": true,
+                    "content": {
+                        "application\/json": {
+                            "schema": {
+                                "required": [
+                                    "type",
+                                    "mount_path",
+                                    "resource_uuid"
+                                ],
+                                "properties": {
+                                    "type": {
+                                        "type": "string",
+                                        "enum": [
+                                            "persistent",
+                                            "file"
+                                        ],
+                                        "description": "The type of storage."
+                                    },
+                                    "resource_uuid": {
+                                        "type": "string",
+                                        "description": "UUID of the service application or database sub-resource."
+                                    },
+                                    "name": {
+                                        "type": "string",
+                                        "description": "Volume name (persistent only, required for persistent)."
+                                    },
+                                    "mount_path": {
+                                        "type": "string",
+                                        "description": "The container mount path."
+                                    },
+                                    "host_path": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "The host path (persistent only, optional)."
+                                    },
+                                    "content": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "File content (file only, optional)."
+                                    },
+                                    "is_directory": {
+                                        "type": "boolean",
+                                        "description": "Whether this is a directory mount (file only, default false)."
+                                    },
+                                    "fs_path": {
+                                        "type": "string",
+                                        "description": "Host directory path (required when is_directory is true)."
+                                    }
+                                },
+                                "type": "object",
+                                "additionalProperties": false
+                            }
+                        }
+                    }
+                },
+                "responses": {
+                    "201": {
+                        "description": "Storage created.",
+                        "content": {
+                            "application\/json": {
+                                "schema": {
+                                    "type": "object"
+                                }
+                            }
+                        }
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "400": {
+                        "$ref": "#\/components\/responses\/400"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    },
+                    "422": {
+                        "$ref": "#\/components\/responses\/422"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            },
+            "patch": {
+                "tags": [
+                    "Services"
+                ],
+                "summary": "Update Storage",
+                "description": "Update a persistent storage or file storage by service UUID.",
+                "operationId": "update-storage-by-service-uuid",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "description": "UUID of the service.",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "requestBody": {
+                    "description": "Storage updated. For read-only storages (from docker-compose or services), only is_preview_suffix_enabled can be updated.",
+                    "required": true,
+                    "content": {
+                        "application\/json": {
+                            "schema": {
+                                "required": [
+                                    "type"
+                                ],
+                                "properties": {
+                                    "uuid": {
+                                        "type": "string",
+                                        "description": "The UUID of the storage (preferred)."
+                                    },
+                                    "id": {
+                                        "type": "integer",
+                                        "description": "The ID of the storage (deprecated, use uuid instead)."
+                                    },
+                                    "type": {
+                                        "type": "string",
+                                        "enum": [
+                                            "persistent",
+                                            "file"
+                                        ],
+                                        "description": "The type of storage: persistent or file."
+                                    },
+                                    "is_preview_suffix_enabled": {
+                                        "type": "boolean",
+                                        "description": "Whether to add -pr-N suffix for preview deployments."
+                                    },
+                                    "name": {
+                                        "type": "string",
+                                        "description": "The volume name (persistent only, not allowed for read-only storages)."
+                                    },
+                                    "mount_path": {
+                                        "type": "string",
+                                        "description": "The container mount path (not allowed for read-only storages)."
+                                    },
+                                    "host_path": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "The host path (persistent only, not allowed for read-only storages)."
+                                    },
+                                    "content": {
+                                        "type": "string",
+                                        "nullable": true,
+                                        "description": "The file content (file only, not allowed for read-only storages)."
+                                    }
+                                },
+                                "type": "object",
+                                "additionalProperties": false
+                            }
+                        }
+                    }
+                },
+                "responses": {
+                    "200": {
+                        "description": "Storage updated.",
+                        "content": {
+                            "application\/json": {
+                                "schema": {
+                                    "type": "object"
+                                }
+                            }
+                        }
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "400": {
+                        "$ref": "#\/components\/responses\/400"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    },
+                    "422": {
+                        "$ref": "#\/components\/responses\/422"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
+        "\/services\/{uuid}\/storages\/{storage_uuid}": {
+            "delete": {
+                "tags": [
+                    "Services"
+                ],
+                "summary": "Delete Storage",
+                "description": "Delete a persistent storage or file storage by service UUID.",
+                "operationId": "delete-storage-by-service-uuid",
+                "parameters": [
+                    {
+                        "name": "uuid",
+                        "in": "path",
+                        "description": "UUID of the service.",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    },
+                    {
+                        "name": "storage_uuid",
+                        "in": "path",
+                        "description": "UUID of the storage.",
+                        "required": true,
+                        "schema": {
+                            "type": "string"
+                        }
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Storage deleted.",
+                        "content": {
+                            "application\/json": {
+                                "schema": {
+                                    "properties": {
+                                        "message": {
+                                            "type": "string"
+                                        }
+                                    },
+                                    "type": "object"
+                                }
+                            }
+                        }
+                    },
+                    "401": {
+                        "$ref": "#\/components\/responses\/401"
+                    },
+                    "400": {
+                        "$ref": "#\/components\/responses\/400"
+                    },
+                    "404": {
+                        "$ref": "#\/components\/responses\/404"
+                    },
+                    "422": {
+                        "$ref": "#\/components\/responses\/422"
+                    }
+                },
+                "security": [
+                    {
+                        "bearerAuth": []
+                    }
+                ]
+            }
+        },
         "\/teams": {
             "get": {
                 "tags": [

openapi.yaml

@@ -2204,6 +2204,73 @@ paths:
       security:
         -
           bearerAuth: []
+    post:
+      tags:
+        - Applications
+      summary: 'Create Storage'
+      description: 'Create a persistent storage or file storage for an application.'
+      operationId: create-storage-by-application-uuid
+      parameters:
+        -
+          name: uuid
+          in: path
+          description: 'UUID of the application.'
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              required:
+                - type
+                - mount_path
+              properties:
+                type:
+                  type: string
+                  enum: [persistent, file]
+                  description: 'The type of storage.'
+                name:
+                  type: string
+                  description: 'Volume name (persistent only, required for persistent).'
+                mount_path:
+                  type: string
+                  description: 'The container mount path.'
+                host_path:
+                  type: string
+                  nullable: true
+                  description: 'The host path (persistent only, optional).'
+                content:
+                  type: string
+                  nullable: true
+                  description: 'File content (file only, optional).'
+                is_directory:
+                  type: boolean
+                  description: 'Whether this is a directory mount (file only, default false).'
+                fs_path:
+                  type: string
+                  description: 'Host directory path (required when is_directory is true).'
+              type: object
+              additionalProperties: false
+      responses:
+        '201':
+          description: 'Storage created.'
+          content:
+            application/json:
+              schema:
+                type: object
+        '401':
+          $ref: '#/components/responses/401'
+        '400':
+          $ref: '#/components/responses/400'
+        '404':
+          $ref: '#/components/responses/404'
+        '422':
+          $ref: '#/components/responses/422'
+      security:
+        -
+          bearerAuth: []
     patch:
       tags:
         - Applications
@@ -2225,12 +2292,14 @@ paths:
           application/json:
             schema:
               required:
-                - id
                 - type
               properties:
+                uuid:
+                  type: string
+                  description: 'The UUID of the storage (preferred).'
                 id:
                   type: integer
-                  description: 'The ID of the storage.'
+                  description: 'The ID of the storage (deprecated, use uuid instead).'
                 type:
                   type: string
                   enum: [persistent, file]
@@ -2272,6 +2341,48 @@ paths:
       security:
         -
           bearerAuth: []
+  '/applications/{uuid}/storages/{storage_uuid}':
+    delete:
+      tags:
+        - Applications
+      summary: 'Delete Storage'
+      description: 'Delete a persistent storage or file storage by application UUID.'
+      operationId: delete-storage-by-application-uuid
+      parameters:
+        -
+          name: uuid
+          in: path
+          description: 'UUID of the application.'
+          required: true
+          schema:
+            type: string
+        -
+          name: storage_uuid
+          in: path
+          description: 'UUID of the storage.'
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: 'Storage deleted.'
+          content:
+            application/json:
+              schema:
+                properties:
+                  message: { type: string }
+                type: object
+        '401':
+          $ref: '#/components/responses/401'
+        '400':
+          $ref: '#/components/responses/400'
+        '404':
+          $ref: '#/components/responses/404'
+        '422':
+          $ref: '#/components/responses/422'
+      security:
+        -
+          bearerAuth: []
   /cloud-tokens:
     get:
       tags:
@@ -4209,6 +4320,219 @@ paths:
       security:
         -
           bearerAuth: []
+  '/databases/{uuid}/storages':
+    get:
+      tags:
+        - Databases
+      summary: 'List Storages'
+      description: 'List all persistent storages and file storages by database UUID.'
+      operationId: list-storages-by-database-uuid
+      parameters:
+        -
+          name: uuid
+          in: path
+          description: 'UUID of the database.'
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: 'All storages by database UUID.'
+          content:
+            application/json:
+              schema:
+                properties:
+                  persistent_storages: { type: array, items: { type: object } }
+                  file_storages: { type: array, items: { type: object } }
+                type: object
+        '401':
+          $ref: '#/components/responses/401'
+        '400':
+          $ref: '#/components/responses/400'
+        '404':
+          $ref: '#/components/responses/404'
+      security:
+        -
+          bearerAuth: []
+    post:
+      tags:
+        - Databases
+      summary: 'Create Storage'
+      description: 'Create a persistent storage or file storage for a database.'
+      operationId: create-storage-by-database-uuid
+      parameters:
+        -
+          name: uuid
+          in: path
+          description: 'UUID of the database.'
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              required:
+                - type
+                - mount_path
+              properties:
+                type:
+                  type: string
+                  enum: [persistent, file]
+                  description: 'The type of storage.'
+                name:
+                  type: string
+                  description: 'Volume name (persistent only, required for persistent).'
+                mount_path:
+                  type: string
+                  description: 'The container mount path.'
+                host_path:
+                  type: string
+                  nullable: true
+                  description: 'The host path (persistent only, optional).'
+                content:
+                  type: string
+                  nullable: true
+                  description: 'File content (file only, optional).'
+                is_directory:
+                  type: boolean
+                  description: 'Whether this is a directory mount (file only, default false).'
+                fs_path:
+                  type: string
+                  description: 'Host directory path (required when is_directory is true).'
+              type: object
+              additionalProperties: false
+      responses:
+        '201':
+          description: 'Storage created.'
+          content:
+            application/json:
+              schema:
+                type: object
+        '401':
+          $ref: '#/components/responses/401'
+        '400':
+          $ref: '#/components/responses/400'
+        '404':
+          $ref: '#/components/responses/404'
+        '422':
+          $ref: '#/components/responses/422'
+      security:
+        -
+          bearerAuth: []
+    patch:
+      tags:
+        - Databases
+      summary: 'Update Storage'
+      description: 'Update a persistent storage or file storage by database UUID.'
+      operationId: update-storage-by-database-uuid
+      parameters:
+        -
+          name: uuid
+          in: path
+          description: 'UUID of the database.'
+          required: true
+          schema:
+            type: string
+      requestBody:
+        description: 'Storage updated. For read-only storages (from docker-compose or services), only is_preview_suffix_enabled can be updated.'
+        required: true
+        content:
+          application/json:
+            schema:
+              required:
+                - type
+              properties:
+                uuid:
+                  type: string
+                  description: 'The UUID of the storage (preferred).'
+                id:
+                  type: integer
+                  description: 'The ID of the storage (deprecated, use uuid instead).'
+                type:
+                  type: string
+                  enum: [persistent, file]
+                  description: 'The type of storage: persistent or file.'
+                is_preview_suffix_enabled:
+                  type: boolean
+                  description: 'Whether to add -pr-N suffix for preview deployments.'
+                name:
+                  type: string
+                  description: 'The volume name (persistent only, not allowed for read-only storages).'
+                mount_path:
+                  type: string
+                  description: 'The container mount path (not allowed for read-only storages).'
+                host_path:
+                  type: string
+                  nullable: true
+                  description: 'The host path (persistent only, not allowed for read-only storages).'
+                content:
+                  type: string
+                  nullable: true
+                  description: 'The file content (file only, not allowed for read-only storages).'
+              type: object
+              additionalProperties: false
+      responses:
+        '200':
+          description: 'Storage updated.'
+          content:
+            application/json:
+              schema:
+                type: object
+        '401':
+          $ref: '#/components/responses/401'
+        '400':
+          $ref: '#/components/responses/400'
+        '404':
+          $ref: '#/components/responses/404'
+        '422':
+          $ref: '#/components/responses/422'
+      security:
+        -
+          bearerAuth: []
+  '/databases/{uuid}/storages/{storage_uuid}':
+    delete:
+      tags:
+        - Databases
+      summary: 'Delete Storage'
+      description: 'Delete a persistent storage or file storage by database UUID.'
+      operationId: delete-storage-by-database-uuid
+      parameters:
+        -
+          name: uuid
+          in: path
+          description: 'UUID of the database.'
+          required: true
+          schema:
+            type: string
+        -
+          name: storage_uuid
+          in: path
+          description: 'UUID of the storage.'
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: 'Storage deleted.'
+          content:
+            application/json:
+              schema:
+                properties:
+                  message: { type: string }
+                type: object
+        '401':
+          $ref: '#/components/responses/401'
+        '400':
+          $ref: '#/components/responses/400'
+        '404':
+          $ref: '#/components/responses/404'
+        '422':
+          $ref: '#/components/responses/422'
+      security:
+        -
+          bearerAuth: []
   /deployments:
     get:
       tags:
@@ -7070,6 +7394,223 @@ paths:
       security:
         -
           bearerAuth: []
+  '/services/{uuid}/storages':
+    get:
+      tags:
+        - Services
+      summary: 'List Storages'
+      description: 'List all persistent storages and file storages by service UUID.'
+      operationId: list-storages-by-service-uuid
+      parameters:
+        -
+          name: uuid
+          in: path
+          description: 'UUID of the service.'
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: 'All storages by service UUID.'
+          content:
+            application/json:
+              schema:
+                properties:
+                  persistent_storages: { type: array, items: { type: object } }
+                  file_storages: { type: array, items: { type: object } }
+                type: object
+        '401':
+          $ref: '#/components/responses/401'
+        '400':
+          $ref: '#/components/responses/400'
+        '404':
+          $ref: '#/components/responses/404'
+      security:
+        -
+          bearerAuth: []
+    post:
+      tags:
+        - Services
+      summary: 'Create Storage'
+      description: 'Create a persistent storage or file storage for a service sub-resource.'
+      operationId: create-storage-by-service-uuid
+      parameters:
+        -
+          name: uuid
+          in: path
+          description: 'UUID of the service.'
+          required: true
+          schema:
+            type: string
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              required:
+                - type
+                - mount_path
+                - resource_uuid
+              properties:
+                type:
+                  type: string
+                  enum: [persistent, file]
+                  description: 'The type of storage.'
+                resource_uuid:
+                  type: string
+                  description: 'UUID of the service application or database sub-resource.'
+                name:
+                  type: string
+                  description: 'Volume name (persistent only, required for persistent).'
+                mount_path:
+                  type: string
+                  description: 'The container mount path.'
+                host_path:
+                  type: string
+                  nullable: true
+                  description: 'The host path (persistent only, optional).'
+                content:
+                  type: string
+                  nullable: true
+                  description: 'File content (file only, optional).'
+                is_directory:
+                  type: boolean
+                  description: 'Whether this is a directory mount (file only, default false).'
+                fs_path:
+                  type: string
+                  description: 'Host directory path (required when is_directory is true).'
+              type: object
+              additionalProperties: false
+      responses:
+        '201':
+          description: 'Storage created.'
+          content:
+            application/json:
+              schema:
+                type: object
+        '401':
+          $ref: '#/components/responses/401'
+        '400':
+          $ref: '#/components/responses/400'
+        '404':
+          $ref: '#/components/responses/404'
+        '422':
+          $ref: '#/components/responses/422'
+      security:
+        -
+          bearerAuth: []
+    patch:
+      tags:
+        - Services
+      summary: 'Update Storage'
+      description: 'Update a persistent storage or file storage by service UUID.'
+      operationId: update-storage-by-service-uuid
+      parameters:
+        -
+          name: uuid
+          in: path
+          description: 'UUID of the service.'
+          required: true
+          schema:
+            type: string
+      requestBody:
+        description: 'Storage updated. For read-only storages (from docker-compose or services), only is_preview_suffix_enabled can be updated.'
+        required: true
+        content:
+          application/json:
+            schema:
+              required:
+                - type
+              properties:
+                uuid:
+                  type: string
+                  description: 'The UUID of the storage (preferred).'
+                id:
+                  type: integer
+                  description: 'The ID of the storage (deprecated, use uuid instead).'
+                type:
+                  type: string
+                  enum: [persistent, file]
+                  description: 'The type of storage: persistent or file.'
+                is_preview_suffix_enabled:
+                  type: boolean
+                  description: 'Whether to add -pr-N suffix for preview deployments.'
+                name:
+                  type: string
+                  description: 'The volume name (persistent only, not allowed for read-only storages).'
+                mount_path:
+                  type: string
+                  description: 'The container mount path (not allowed for read-only storages).'
+                host_path:
+                  type: string
+                  nullable: true
+                  description: 'The host path (persistent only, not allowed for read-only storages).'
+                content:
+                  type: string
+                  nullable: true
+                  description: 'The file content (file only, not allowed for read-only storages).'
+              type: object
+              additionalProperties: false
+      responses:
+        '200':
+          description: 'Storage updated.'
+          content:
+            application/json:
+              schema:
+                type: object
+        '401':
+          $ref: '#/components/responses/401'
+        '400':
+          $ref: '#/components/responses/400'
+        '404':
+          $ref: '#/components/responses/404'
+        '422':
+          $ref: '#/components/responses/422'
+      security:
+        -
+          bearerAuth: []
+  '/services/{uuid}/storages/{storage_uuid}':
+    delete:
+      tags:
+        - Services
+      summary: 'Delete Storage'
+      description: 'Delete a persistent storage or file storage by service UUID.'
+      operationId: delete-storage-by-service-uuid
+      parameters:
+        -
+          name: uuid
+          in: path
+          description: 'UUID of the service.'
+          required: true
+          schema:
+            type: string
+        -
+          name: storage_uuid
+          in: path
+          description: 'UUID of the storage.'
+          required: true
+          schema:
+            type: string
+      responses:
+        '200':
+          description: 'Storage deleted.'
+          content:
+            application/json:
+              schema:
+                properties:
+                  message: { type: string }
+                type: object
+        '401':
+          $ref: '#/components/responses/401'
+        '400':
+          $ref: '#/components/responses/400'
+        '404':
+          $ref: '#/components/responses/404'
+        '422':
+          $ref: '#/components/responses/422'
+      security:
+        -
+          bearerAuth: []
   /teams:
     get:
       tags:

other/nightly/install.sh

@@ -20,7 +20,7 @@ DATE=$(date +"%Y%m%d-%H%M%S")
 
 OS_TYPE=$(grep -w "ID" /etc/os-release | cut -d "=" -f 2 | tr -d '"')
 ENV_FILE="/data/coolify/source/.env"
-DOCKER_VERSION="27.0"
+DOCKER_VERSION="latest"
 # TODO: Ask for a user
 CURRENT_USER=$USER
 
@@ -499,13 +499,10 @@ fi
 
 install_docker() {
     set +e
-    curl -s https://releases.rancher.com/install-docker/${DOCKER_VERSION}.sh | sh 2>&1 || true
+    curl -fsSL https://get.docker.com | sh 2>&1 || true
     if ! [ -x "$(command -v docker)" ]; then
-        curl -s https://get.docker.com | sh -s -- --version ${DOCKER_VERSION} 2>&1
-        if ! [ -x "$(command -v docker)" ]; then
-            echo "Automated Docker installation failed. Trying manual installation."
-            install_docker_manually
-        fi
+        echo "Automated Docker installation failed. Trying manual installation."
+        install_docker_manually
     fi
     set -e
 }
@@ -548,16 +545,6 @@ if ! [ -x "$(command -v docker)" ]; then
     echo " - Docker is not installed. Installing Docker. It may take a while."
     getAJoke
     case "$OS_TYPE" in
-    "almalinux")
-        dnf config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo >/dev/null 2>&1
-        dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin >/dev/null 2>&1
-        if ! [ -x "$(command -v docker)" ]; then
-            echo " - Docker could not be installed automatically. Please visit https://docs.docker.com/engine/install/ and install Docker manually to continue."
-            exit 1
-        fi
-        systemctl start docker >/dev/null 2>&1
-        systemctl enable docker >/dev/null 2>&1
-        ;;
     "alpine" | "postmarketos")
         apk add docker docker-cli-compose >/dev/null 2>&1
         rc-update add docker default >/dev/null 2>&1
@@ -569,8 +556,9 @@ if ! [ -x "$(command -v docker)" ]; then
         fi
         ;;
     "arch")
-        pacman -Sy docker docker-compose --noconfirm >/dev/null 2>&1
+        pacman -Syu --noconfirm --needed docker docker-compose >/dev/null 2>&1
         systemctl enable docker.service >/dev/null 2>&1
+        systemctl start docker.service >/dev/null 2>&1
         if ! [ -x "$(command -v docker)" ]; then
             echo " - Failed to install Docker with pacman. Try to install it manually."
             echo "   Please visit https://wiki.archlinux.org/title/docker for more information."
@@ -581,7 +569,7 @@ if ! [ -x "$(command -v docker)" ]; then
         dnf install docker -y >/dev/null 2>&1
         DOCKER_CONFIG=${DOCKER_CONFIG:-/usr/local/lib/docker}
         mkdir -p $DOCKER_CONFIG/cli-plugins >/dev/null 2>&1
-        curl -sL "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o $DOCKER_CONFIG/cli-plugins/docker-compose >/dev/null 2>&1
+        curl -fsSL "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o $DOCKER_CONFIG/cli-plugins/docker-compose >/dev/null 2>&1
         chmod +x $DOCKER_CONFIG/cli-plugins/docker-compose >/dev/null 2>&1
         systemctl start docker >/dev/null 2>&1
         systemctl enable docker >/dev/null 2>&1
@@ -591,34 +579,28 @@ if ! [ -x "$(command -v docker)" ]; then
             exit 1
         fi
         ;;
-    "centos" | "fedora" | "rhel" | "tencentos")
-        if [ -x "$(command -v dnf5)" ]; then
-            # dnf5 is available
-            dnf config-manager addrepo --from-repofile=https://download.docker.com/linux/$OS_TYPE/docker-ce.repo --overwrite >/dev/null 2>&1
-        else
-            # dnf5 is not available, use dnf
-            dnf config-manager --add-repo=https://download.docker.com/linux/$OS_TYPE/docker-ce.repo >/dev/null 2>&1
-        fi
+    "almalinux" | "tencentos")
+        dnf config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo >/dev/null 2>&1
         dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin >/dev/null 2>&1
+        systemctl start docker >/dev/null 2>&1
+        systemctl enable docker >/dev/null 2>&1
         if ! [ -x "$(command -v docker)" ]; then
             echo " - Docker could not be installed automatically. Please visit https://docs.docker.com/engine/install/ and install Docker manually to continue."
             exit 1
         fi
-        systemctl start docker >/dev/null 2>&1
-        systemctl enable docker >/dev/null 2>&1
         ;;
-    "ubuntu" | "debian" | "raspbian")
+    "ubuntu" | "debian" | "raspbian" | "centos" | "fedora" | "rhel" | "sles")
         install_docker
         if ! [ -x "$(command -v docker)" ]; then
-            echo " - Automated Docker installation failed. Trying manual installation."
-            install_docker_manually
+            echo " - Docker could not be installed automatically. Please visit https://docs.docker.com/engine/install/ and install Docker manually to continue."
+            exit 1
         fi
         ;;
     *)
         install_docker
         if ! [ -x "$(command -v docker)" ]; then
-            echo " - Automated Docker installation failed. Trying manual installation."
-            install_docker_manually
+            echo " - Docker could not be installed automatically. Please visit https://docs.docker.com/engine/install/ and install Docker manually to continue."
+            exit 1
         fi
         ;;
     esac
@@ -627,6 +609,19 @@ else
     echo " - Docker is installed."
 fi
 
+# Verify minimum Docker version
+MIN_DOCKER_VERSION=24
+INSTALLED_DOCKER_VERSION=$(docker version --format '{{.Server.Version}}' 2>/dev/null | cut -d. -f1)
+if [ -z "$INSTALLED_DOCKER_VERSION" ]; then
+    echo " - WARNING: Could not determine Docker version. Please ensure Docker $MIN_DOCKER_VERSION+ is installed."
+elif [ "$INSTALLED_DOCKER_VERSION" -lt "$MIN_DOCKER_VERSION" ]; then
+    echo " - ERROR: Docker version $INSTALLED_DOCKER_VERSION is too old. Coolify requires Docker $MIN_DOCKER_VERSION or newer."
+    echo "   Please upgrade Docker: https://docs.docker.com/engine/install/"
+    exit 1
+else
+    echo " - Docker version $(docker version --format '{{.Server.Version}}' 2>/dev/null) meets minimum requirement ($MIN_DOCKER_VERSION+)."
+fi
+
 log_section "Step 4/9: Checking Docker configuration"
 echo "4/9 Checking Docker configuration..."
 

other/nightly/versions.json

@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.0.0-beta.469"
+            "version": "4.0.0-beta.470"
         },
         "nightly": {
             "version": "4.0.0"
@@ -13,17 +13,17 @@
             "version": "1.0.11"
         },
         "sentinel": {
-            "version": "0.0.19"
+            "version": "0.0.21"
         }
     },
     "traefik": {
-        "v3.6": "3.6.5",
+        "v3.6": "3.6.11",
         "v3.5": "3.5.6",
         "v3.4": "3.4.5",
         "v3.3": "3.3.7",
         "v3.2": "3.2.5",
         "v3.1": "3.1.7",
         "v3.0": "3.0.4",
-        "v2.11": "2.11.32"
+        "v2.11": "2.11.40"
     }
 }

phpunit.xml

@@ -22,6 +22,7 @@
     <env name="QUEUE_CONNECTION" value="sync" force="true"/>
     <env name="SESSION_DRIVER" value="array" force="true"/>
     <env name="TELESCOPE_ENABLED" value="false"/>
+    <env name="NIGHTWATCH_ENABLED" value="false"/>
   </php>
   <source>
     <include>

public/svgs/espocrm.svg

@@ -0,0 +1,82 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<svg
+   width="379.36536"
+   height="83.256203"
+   enable-background="new 0 0 307.813 75"
+   overflow="visible"
+   version="1.1"
+   viewBox="0 0 303.49228 66.604962"
+   xml:space="preserve"
+   id="svg20"
+   sodipodi:docname="logo2.svg"
+   inkscape:version="1.1.2 (0a00cf5339, 2022-02-04)"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg"><defs
+   id="defs24" /><sodipodi:namedview
+   id="namedview22"
+   pagecolor="#ffffff"
+   bordercolor="#666666"
+   borderopacity="1.0"
+   inkscape:pageshadow="2"
+   inkscape:pageopacity="0.0"
+   inkscape:pagecheckerboard="0"
+   showgrid="false"
+   scale-x="0.8"
+   fit-margin-top="0"
+   fit-margin-left="0"
+   fit-margin-right="0"
+   fit-margin-bottom="0"
+   inkscape:zoom="2.172956"
+   inkscape:cx="109.75832"
+   inkscape:cy="79.384949"
+   inkscape:window-width="1920"
+   inkscape:window-height="1074"
+   inkscape:window-x="0"
+   inkscape:window-y="0"
+   inkscape:window-maximized="1"
+   inkscape:current-layer="svg20" />
+	
+	<switch
+   transform="matrix(1.089,0,0,1.089,-14.949525,-4.9304545)"
+   id="switch18">
+		<foreignObject
+   width="1"
+   height="1"
+   requiredExtensions="http://ns.adobe.com/AdobeIllustrator/10.0/">
+			
+		</foreignObject>
+		<g
+   transform="matrix(0.96767,0,0,0.96767,3.9659,-1.2011)"
+   id="g16">
+					
+						<path
+   d="m 169.53,21.864 c -7.453,2.972 -9.569,11.987 -9.005,19.212 1.587,2.982 3.845,5.562 5.783,8.312 l 4.262,-1.083 c -1.796,-4.447 -1.689,-9.424 -0.806,-14.066 0.585,-3.001 2.309,-6.476 5.634,-7.032 5.307,-0.847 10.733,-0.271 16.088,-0.369 0.091,-2.196 0.115,-4.392 0.107,-6.585 -7.333,0.387 -15.043,-1.038 -22.063,1.611 z m 52.714,-1.294 c -8.12,-0.952 -16.332,-0.149 -24.492,-0.387 -0.021,6.43 -0.003,12.854 0.078,19.274 2.625,-0.849 5.251,-1.739 7.909,-2.532 0.042,-3.272 0.028,-6.527 -0.071,-9.789 4.869,-0.029 9.874,-0.757 14.639,0.451 1.838,0.298 2.051,2.25 2.687,3.641 2.541,-0.891 5.111,-1.717 7.672,-2.574 -0.703,-4.246 -4.129,-7.633 -8.422,-8.084 z m 23.522,-0.593 c -3.954,0.072 -7.912,0.064 -11.864,0.047 0.051,2.544 0.063,5.074 0.072,7.617 4.263,-1.482 8.553,-2.889 12.848,-4.268 -0.35,-1.128 -0.706,-2.268 -1.056,-3.396 z"
+   fill="#6a3201"
+   id="path2" />
+						<path
+   d="m 161.96,69.125 c 7.886,-3.717 15.757,-7.463 23.72,-11.018 5.563,0.359 11.146,0.021 16.722,0.193 1.14,-0.036 2.292,-0.061 3.432,-0.088 -0.011,-3.195 -0.025,-6.38 -0.082,-9.564 3.428,-1.502 10.227,-4.623 10.227,-4.623 l 15.215,13.941 11.096,0.106 -0.715,-26.236 0.803,-0.211 9.005,26.344 8.834,-0.066 8.99,-28.394 -0.308,28.434 8.074,-0.021 -0.231,-37.932 -9.279,0.071 30.625,-14.141 c 0,0 -37.593,14.279 -56.404,21.385 -2.996,1.022 -5.878,2.315 -8.853,3.394 -2.278,0.867 -4.558,1.713 -6.834,2.58 -20.071,7.526 -39.945,15.604 -60.126,22.803 C 159.094,45.56 150.557,36.228 144.103,25.497 Z m 72.116,-17.961 c -0.108,0.154 -0.324,0.458 -0.429,0.611 -3.448,-3.018 -6.765,-6.189 -10.21,-9.205 1.745,-1.096 3.47,-2.242 5.026,-3.597 1.625,-1.386 3.479,-2.469 5.345,-3.499 0.293,5.227 0.258,10.452 0.268,15.69 z m 23.942,-9.67 c -0.857,2.578 -1.825,5.137 -2.793,7.682 -1.644,-6.217 -3.94,-12.238 -5.856,-18.383 -0.119,-0.52 -0.366,-1.574 -0.487,-2.093 3.428,-1.709 10.585,-4.854 15.229,-6.815 -1.647,5.969 -4.306,14.029 -6.093,19.609 z"
+   fill="#ffb300"
+   id="path4" />
+					
+					<g
+   fill="#6a3201"
+   id="g14">
+						<path
+   d="M 45.672,58.148 H 27.146 c -2.861,0 -5.614,-0.651 -8.257,-1.953 -2.861,-1.409 -5.043,-3.651 -6.547,-6.725 -1.503,-3.074 -2.254,-6.455 -2.254,-10.145 0,-3.652 0.724,-6.961 2.173,-9.926 1.594,-3.219 3.803,-5.569 6.628,-7.052 1.557,-0.795 3.052,-1.355 4.482,-1.682 1.43,-0.325 3.07,-0.488 4.917,-0.488 h 17.168 v 6.789 H 29.57 c -1.415,0 -2.602,0.187 -3.563,0.558 -0.961,0.372 -1.912,1.037 -2.855,1.994 -0.943,0.957 -1.597,1.887 -1.959,2.791 -0.363,0.902 -0.543,2.027 -0.543,3.375 h 25.023 v 6.789 H 20.648 c 0,1.24 0.164,2.325 0.491,3.256 0.327,0.93 0.919,1.887 1.776,2.871 0.856,0.985 1.749,1.732 2.677,2.242 0.929,0.512 2.03,0.767 3.306,0.767 h 16.774 z"
+   id="path6" />
+						<path
+   d="m 76.499,49.519 c 0,2.397 -0.771,4.449 -2.312,6.154 -1.541,1.706 -3.49,2.56 -5.846,2.56 H 49.688 V 53.12 h 15.326 c 1.087,0 2.001,-0.272 2.744,-0.817 0.743,-0.545 1.115,-1.327 1.115,-2.345 0,-2.362 -1.595,-3.543 -4.783,-3.543 h -7.825 c -1.666,0 -3.278,-0.79 -4.836,-2.369 -1.559,-1.58 -2.336,-3.287 -2.336,-5.119 0,-2.585 0.579,-4.667 1.738,-6.248 1.34,-1.794 3.313,-2.692 5.922,-2.692 h 17.928 v 5.364 H 58.743 c -0.614,0 -1.147,0.289 -1.599,0.868 -0.452,0.579 -0.677,1.235 -0.677,1.972 0,0.807 0.298,1.498 0.896,2.076 0.597,0.579 1.311,0.867 2.144,0.867 h 8.415 c 2.643,0 4.733,0.79 6.271,2.369 1.536,1.579 2.306,3.584 2.306,6.016 z"
+   id="path8" />
+						<path
+   d="m 109.29,43.414 c 0,4.495 -1.166,8.074 -3.497,10.738 -2.331,2.664 -5.395,3.996 -9.188,3.996 H 88.419 V 68.457 H 80.792 V 29.985 h 15.09 c 4.27,0 7.6,1.269 9.989,3.806 2.279,2.428 3.419,5.637 3.419,9.623 z m -7.627,0.405 c 0,-2.356 -0.754,-4.286 -2.262,-5.793 -1.509,-1.505 -3.388,-2.258 -5.641,-2.258 h -5.341 v 16.429 h 5.886 c 2.179,0 3.951,-0.771 5.313,-2.313 1.363,-1.54 2.045,-3.562 2.045,-6.065 z"
+   id="path10" />
+						<path
+   d="m 145.1,43.967 c 0,4.896 -1.557,8.65 -4.669,11.261 -2.86,2.394 -6.751,3.591 -11.673,3.591 -4.923,0 -8.742,-1.087 -11.456,-3.264 -3.15,-2.502 -4.724,-6.401 -4.724,-11.696 0,-4.424 1.701,-7.906 5.104,-10.446 3.04,-2.283 6.786,-3.427 11.238,-3.427 4.887,0 8.805,1.225 11.754,3.673 2.949,2.448 4.426,5.884 4.426,10.308 z m -8.382,-0.065 c 0,-2.285 -0.716,-4.197 -2.146,-5.738 -1.432,-1.54 -3.379,-2.312 -5.841,-2.312 -2.246,0 -4.103,0.79 -5.57,2.366 -1.467,1.577 -2.2,3.563 -2.2,5.955 0,2.756 0.743,4.949 2.228,6.581 1.485,1.632 3.405,2.448 5.76,2.448 2.679,0 4.673,-0.852 5.977,-2.557 1.193,-1.557 1.792,-3.805 1.792,-6.743 z"
+   id="path12" />
+					</g>
+				</g>
+	</switch>
+	
+</svg>

resources/views/components/modal-confirmation.blade.php

@@ -190,7 +190,7 @@ class="relative w-auto h-auto">
     @endif
     <template x-teleport="body">
         <div x-show="modalOpen"
-            class="fixed top-0 left-0 z-99 flex items-center justify-center w-screen h-screen p-4" x-cloak>
+            class="fixed top-0 left-0 z-99 flex items-center justify-center w-screen h-screen p-0 sm:p-4" x-cloak>
             <div x-show="modalOpen" class="absolute inset-0 w-full h-full bg-black/20 backdrop-blur-xs">
             </div>
             <div x-show="modalOpen" x-trap.inert.noscroll="modalOpen" x-transition:enter="ease-out duration-100"
@@ -199,7 +199,7 @@ class="fixed top-0 left-0 z-99 flex items-center justify-center w-screen h-scree
                 x-transition:leave="ease-in duration-100"
                 x-transition:leave-start="opacity-100 translate-y-0 sm:scale-100"
                 x-transition:leave-end="opacity-0 -translate-y-2 sm:scale-95"
-                class="relative w-full border rounded-sm min-w-full lg:min-w-[36rem] max-w-[48rem] max-h-[calc(100vh-2rem)] bg-neutral-100 border-neutral-400 dark:bg-base dark:border-coolgray-300 flex flex-col">
+                class="relative w-full border rounded-none sm:rounded-sm min-w-full lg:min-w-[36rem] max-w-full sm:max-w-[48rem] h-screen sm:h-auto max-h-screen sm:max-h-[calc(100vh-2rem)] bg-neutral-100 border-neutral-400 dark:bg-base dark:border-coolgray-300 flex flex-col">
                 <div class="flex justify-between items-center py-6 px-7 shrink-0">
                     <h3 class="pr-8 text-2xl font-bold">{{ $title }}</h3>
                     <button @click="modalOpen = false; resetModal()"

routes/api.php

@@ -119,7 +119,9 @@
     Route::delete('/applications/{uuid}/envs/{env_uuid}', [ApplicationsController::class, 'delete_env_by_uuid'])->middleware(['api.ability:write']);
     Route::get('/applications/{uuid}/logs', [ApplicationsController::class, 'logs_by_uuid'])->middleware(['api.ability:read']);
     Route::get('/applications/{uuid}/storages', [ApplicationsController::class, 'storages'])->middleware(['api.ability:read']);
+    Route::post('/applications/{uuid}/storages', [ApplicationsController::class, 'create_storage'])->middleware(['api.ability:write']);
     Route::patch('/applications/{uuid}/storages', [ApplicationsController::class, 'update_storage'])->middleware(['api.ability:write']);
+    Route::delete('/applications/{uuid}/storages/{storage_uuid}', [ApplicationsController::class, 'delete_storage'])->middleware(['api.ability:write']);
 
     Route::match(['get', 'post'], '/applications/{uuid}/start', [ApplicationsController::class, 'action_deploy'])->middleware(['api.ability:deploy']);
     Route::match(['get', 'post'], '/applications/{uuid}/restart', [ApplicationsController::class, 'action_restart'])->middleware(['api.ability:deploy']);
@@ -152,6 +154,11 @@
     Route::delete('/databases/{uuid}/backups/{scheduled_backup_uuid}', [DatabasesController::class, 'delete_backup_by_uuid'])->middleware(['api.ability:write']);
     Route::delete('/databases/{uuid}/backups/{scheduled_backup_uuid}/executions/{execution_uuid}', [DatabasesController::class, 'delete_execution_by_uuid'])->middleware(['api.ability:write']);
 
+    Route::get('/databases/{uuid}/storages', [DatabasesController::class, 'storages'])->middleware(['api.ability:read']);
+    Route::post('/databases/{uuid}/storages', [DatabasesController::class, 'create_storage'])->middleware(['api.ability:write']);
+    Route::patch('/databases/{uuid}/storages', [DatabasesController::class, 'update_storage'])->middleware(['api.ability:write']);
+    Route::delete('/databases/{uuid}/storages/{storage_uuid}', [DatabasesController::class, 'delete_storage'])->middleware(['api.ability:write']);
+
     Route::get('/databases/{uuid}/envs', [DatabasesController::class, 'envs'])->middleware(['api.ability:read']);
     Route::post('/databases/{uuid}/envs', [DatabasesController::class, 'create_env'])->middleware(['api.ability:write']);
     Route::patch('/databases/{uuid}/envs/bulk', [DatabasesController::class, 'create_bulk_envs'])->middleware(['api.ability:write']);
@@ -169,6 +176,11 @@
     Route::patch('/services/{uuid}', [ServicesController::class, 'update_by_uuid'])->middleware(['api.ability:write']);
     Route::delete('/services/{uuid}', [ServicesController::class, 'delete_by_uuid'])->middleware(['api.ability:write']);
 
+    Route::get('/services/{uuid}/storages', [ServicesController::class, 'storages'])->middleware(['api.ability:read']);
+    Route::post('/services/{uuid}/storages', [ServicesController::class, 'create_storage'])->middleware(['api.ability:write']);
+    Route::patch('/services/{uuid}/storages', [ServicesController::class, 'update_storage'])->middleware(['api.ability:write']);
+    Route::delete('/services/{uuid}/storages/{storage_uuid}', [ServicesController::class, 'delete_storage'])->middleware(['api.ability:write']);
+
     Route::get('/services/{uuid}/envs', [ServicesController::class, 'envs'])->middleware(['api.ability:read']);
     Route::post('/services/{uuid}/envs', [ServicesController::class, 'create_env'])->middleware(['api.ability:write']);
     Route::patch('/services/{uuid}/envs/bulk', [ServicesController::class, 'create_bulk_envs'])->middleware(['api.ability:write']);

scripts/install.sh

@@ -20,7 +20,7 @@ DATE=$(date +"%Y%m%d-%H%M%S")
 
 OS_TYPE=$(grep -w "ID" /etc/os-release | cut -d "=" -f 2 | tr -d '"')
 ENV_FILE="/data/coolify/source/.env"
-DOCKER_VERSION="27.0"
+DOCKER_VERSION="latest"
 # TODO: Ask for a user
 CURRENT_USER=$USER
 
@@ -499,13 +499,10 @@ fi
 
 install_docker() {
     set +e
-    curl -s https://releases.rancher.com/install-docker/${DOCKER_VERSION}.sh | sh 2>&1 || true
+    curl -fsSL https://get.docker.com | sh 2>&1 || true
     if ! [ -x "$(command -v docker)" ]; then
-        curl -s https://get.docker.com | sh -s -- --version ${DOCKER_VERSION} 2>&1
-        if ! [ -x "$(command -v docker)" ]; then
-            echo "Automated Docker installation failed. Trying manual installation."
-            install_docker_manually
-        fi
+        echo "Automated Docker installation failed. Trying manual installation."
+        install_docker_manually
     fi
     set -e
 }
@@ -548,16 +545,6 @@ if ! [ -x "$(command -v docker)" ]; then
     echo " - Docker is not installed. Installing Docker. It may take a while."
     getAJoke
     case "$OS_TYPE" in
-    "almalinux")
-        dnf config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo >/dev/null 2>&1
-        dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin >/dev/null 2>&1
-        if ! [ -x "$(command -v docker)" ]; then
-            echo " - Docker could not be installed automatically. Please visit https://docs.docker.com/engine/install/ and install Docker manually to continue."
-            exit 1
-        fi
-        systemctl start docker >/dev/null 2>&1
-        systemctl enable docker >/dev/null 2>&1
-        ;;
     "alpine" | "postmarketos")
         apk add docker docker-cli-compose >/dev/null 2>&1
         rc-update add docker default >/dev/null 2>&1
@@ -569,8 +556,9 @@ if ! [ -x "$(command -v docker)" ]; then
         fi
         ;;
     "arch")
-        pacman -Sy docker docker-compose --noconfirm >/dev/null 2>&1
+        pacman -Syu --noconfirm --needed docker docker-compose >/dev/null 2>&1
         systemctl enable docker.service >/dev/null 2>&1
+        systemctl start docker.service >/dev/null 2>&1
         if ! [ -x "$(command -v docker)" ]; then
             echo " - Failed to install Docker with pacman. Try to install it manually."
             echo "   Please visit https://wiki.archlinux.org/title/docker for more information."
@@ -581,7 +569,7 @@ if ! [ -x "$(command -v docker)" ]; then
         dnf install docker -y >/dev/null 2>&1
         DOCKER_CONFIG=${DOCKER_CONFIG:-/usr/local/lib/docker}
         mkdir -p $DOCKER_CONFIG/cli-plugins >/dev/null 2>&1
-        curl -sL "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o $DOCKER_CONFIG/cli-plugins/docker-compose >/dev/null 2>&1
+        curl -fsSL "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o $DOCKER_CONFIG/cli-plugins/docker-compose >/dev/null 2>&1
         chmod +x $DOCKER_CONFIG/cli-plugins/docker-compose >/dev/null 2>&1
         systemctl start docker >/dev/null 2>&1
         systemctl enable docker >/dev/null 2>&1
@@ -591,34 +579,28 @@ if ! [ -x "$(command -v docker)" ]; then
             exit 1
         fi
         ;;
-    "centos" | "fedora" | "rhel" | "tencentos")
-        if [ -x "$(command -v dnf5)" ]; then
-            # dnf5 is available
-            dnf config-manager addrepo --from-repofile=https://download.docker.com/linux/$OS_TYPE/docker-ce.repo --overwrite >/dev/null 2>&1
-        else
-            # dnf5 is not available, use dnf
-            dnf config-manager --add-repo=https://download.docker.com/linux/$OS_TYPE/docker-ce.repo >/dev/null 2>&1
-        fi
+    "almalinux" | "tencentos")
+        dnf config-manager --add-repo=https://download.docker.com/linux/centos/docker-ce.repo >/dev/null 2>&1
         dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin >/dev/null 2>&1
+        systemctl start docker >/dev/null 2>&1
+        systemctl enable docker >/dev/null 2>&1
         if ! [ -x "$(command -v docker)" ]; then
             echo " - Docker could not be installed automatically. Please visit https://docs.docker.com/engine/install/ and install Docker manually to continue."
             exit 1
         fi
-        systemctl start docker >/dev/null 2>&1
-        systemctl enable docker >/dev/null 2>&1
         ;;
-    "ubuntu" | "debian" | "raspbian")
+    "ubuntu" | "debian" | "raspbian" | "centos" | "fedora" | "rhel" | "sles")
         install_docker
         if ! [ -x "$(command -v docker)" ]; then
-            echo " - Automated Docker installation failed. Trying manual installation."
-            install_docker_manually
+            echo " - Docker could not be installed automatically. Please visit https://docs.docker.com/engine/install/ and install Docker manually to continue."
+            exit 1
         fi
         ;;
     *)
         install_docker
         if ! [ -x "$(command -v docker)" ]; then
-            echo " - Automated Docker installation failed. Trying manual installation."
-            install_docker_manually
+            echo " - Docker could not be installed automatically. Please visit https://docs.docker.com/engine/install/ and install Docker manually to continue."
+            exit 1
         fi
         ;;
     esac
@@ -627,6 +609,19 @@ else
     echo " - Docker is installed."
 fi
 
+# Verify minimum Docker version
+MIN_DOCKER_VERSION=24
+INSTALLED_DOCKER_VERSION=$(docker version --format '{{.Server.Version}}' 2>/dev/null | cut -d. -f1)
+if [ -z "$INSTALLED_DOCKER_VERSION" ]; then
+    echo " - WARNING: Could not determine Docker version. Please ensure Docker $MIN_DOCKER_VERSION+ is installed."
+elif [ "$INSTALLED_DOCKER_VERSION" -lt "$MIN_DOCKER_VERSION" ]; then
+    echo " - ERROR: Docker version $INSTALLED_DOCKER_VERSION is too old. Coolify requires Docker $MIN_DOCKER_VERSION or newer."
+    echo "   Please upgrade Docker: https://docs.docker.com/engine/install/"
+    exit 1
+else
+    echo " - Docker version $(docker version --format '{{.Server.Version}}' 2>/dev/null) meets minimum requirement ($MIN_DOCKER_VERSION+)."
+fi
+
 log_section "Step 4/9: Checking Docker configuration"
 echo "4/9 Checking Docker configuration..."
 

templates/compose/booklore.yaml

@@ -1,3 +1,4 @@
+# ignore: true
 # documentation: https://booklore.org/docs/getting-started
 # slogan: Booklore is an open-source library management system for your digital book collection.
 # tags: media, books, kobo, epub, ebook, KOreader

templates/compose/espocrm.yaml

@@ -0,0 +1,75 @@
+# documentation: https://docs.espocrm.com
+# slogan: EspoCRM is a free and open-source CRM platform.
+# category: cms
+# tags: crm, self-hosted, open-source, workflow, automation, project management
+# logo: svgs/espocrm.svg
+# port: 80
+
+services:
+  espocrm:
+    image: espocrm/espocrm:9
+    environment:
+      - SERVICE_URL_ESPOCRM
+      - ESPOCRM_ADMIN_USERNAME=${ESPOCRM_ADMIN_USERNAME:-admin}
+      - ESPOCRM_ADMIN_PASSWORD=${SERVICE_PASSWORD_ADMIN}
+      - ESPOCRM_DATABASE_PLATFORM=Mysql
+      - ESPOCRM_DATABASE_HOST=espocrm-db
+      - ESPOCRM_DATABASE_NAME=${MARIADB_DATABASE:-espocrm}
+      - ESPOCRM_DATABASE_USER=${SERVICE_USER_MARIADB}
+      - ESPOCRM_DATABASE_PASSWORD=${SERVICE_PASSWORD_MARIADB}
+      - ESPOCRM_SITE_URL=${SERVICE_URL_ESPOCRM}
+    volumes:
+      - espocrm:/var/www/html
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://127.0.0.1:80"]
+      interval: 2s
+      start_period: 60s
+      timeout: 10s
+      retries: 15
+    depends_on:
+      espocrm-db:
+        condition: service_healthy
+
+  espocrm-daemon:
+    image: espocrm/espocrm:9
+    container_name: espocrm-daemon
+    volumes:
+      - espocrm:/var/www/html
+    restart: always
+    entrypoint: docker-daemon.sh
+    depends_on:
+      espocrm:
+        condition: service_healthy
+
+  espocrm-websocket:
+    image: espocrm/espocrm:9
+    container_name: espocrm-websocket
+    environment:
+      - SERVICE_URL_ESPOCRM_WEBSOCKET_8080
+      - ESPOCRM_CONFIG_USE_WEB_SOCKET=true
+      - ESPOCRM_CONFIG_WEB_SOCKET_URL=$SERVICE_URL_ESPOCRM_WEBSOCKET
+      - ESPOCRM_CONFIG_WEB_SOCKET_ZERO_M_Q_SUBSCRIBER_DSN=tcp://*:7777
+      - ESPOCRM_CONFIG_WEB_SOCKET_ZERO_M_Q_SUBMISSION_DSN=tcp://espocrm-websocket:7777
+    volumes:
+      - espocrm:/var/www/html
+    restart: always
+    entrypoint: docker-websocket.sh
+    depends_on:
+      espocrm:
+        condition: service_healthy
+
+  espocrm-db:
+    image: mariadb:11.8
+    environment:
+      - MARIADB_DATABASE=${MARIADB_DATABASE:-espocrm}
+      - MARIADB_USER=${SERVICE_USER_MARIADB}
+      - MARIADB_PASSWORD=${SERVICE_PASSWORD_MARIADB}
+      - MARIADB_ROOT_PASSWORD=${SERVICE_PASSWORD_ROOT}
+    volumes:
+      - espocrm-db:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 20s
+      start_period: 10s
+      timeout: 10s
+      retries: 3

templates/service-templates-latest.json

@@ -310,23 +310,6 @@
         "minversion": "0.0.0",
         "port": "3000"
     },
-    "booklore": {
-        "documentation": "https://booklore.org/docs/getting-started?utm_source=coolify.io",
-        "slogan": "Booklore is an open-source library management system for your digital book collection.",
-        "compose": "c2VydmljZXM6CiAgYm9va2xvcmU6CiAgICBpbWFnZTogJ2Jvb2tsb3JlL2Jvb2tsb3JlOnYxLjE2LjUnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9CT09LTE9SRV84MAogICAgICAtICdVU0VSX0lEPSR7Qk9PS0xPUkVfVVNFUl9JRDotMH0nCiAgICAgIC0gJ0dST1VQX0lEPSR7Qk9PS0xPUkVfR1JPVVBfSUQ6LTB9JwogICAgICAtICdUWj0ke1RaOi1VVEN9JwogICAgICAtICdEQVRBQkFTRV9VUkw9amRiYzptYXJpYWRiOi8vbWFyaWFkYjozMzA2LyR7TUFSSUFEQl9EQVRBQkFTRTotYm9va2xvcmUtZGJ9JwogICAgICAtICdEQVRBQkFTRV9VU0VSTkFNRT0ke1NFUlZJQ0VfVVNFUl9NQVJJQURCfScKICAgICAgLSAnREFUQUJBU0VfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01BUklBREJ9JwogICAgICAtIEJPT0tMT1JFX1BPUlQ9ODAKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2Jvb2tsb3JlLWRhdGE6L2FwcC9kYXRhJwogICAgICAtICdib29rbG9yZS1ib29rczovYm9va3MnCiAgICAgIC0KICAgICAgICB0eXBlOiBiaW5kCiAgICAgICAgc291cmNlOiB+L2Jvb2tsb3JlCiAgICAgICAgdGFyZ2V0OiAvYm9va2Ryb3AKICAgICAgICBpc19kaXJlY3Rvcnk6IHRydWUKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OiAnd2dldCAtLW5vLXZlcmJvc2UgLS10cmllcz0xIC0tc3BpZGVyIGh0dHA6Ly9sb2NhbGhvc3QvbG9naW4gfHwgZXhpdCAxJwogICAgICBpbnRlcnZhbDogMTBzCiAgICAgIHRpbWVvdXQ6IDVzCiAgICAgIHJldHJpZXM6IDEwCiAgICBkZXBlbmRzX29uOgogICAgICBtYXJpYWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgbWFyaWFkYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMicKICAgIGVudmlyb25tZW50OgogICAgICAtICdNQVJJQURCX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ01BUklBREJfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01BUklBREJ9JwogICAgICAtICdNQVJJQURCX1JPT1RfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01BUklBREJST09UfScKICAgICAgLSAnTUFSSUFEQl9EQVRBQkFTRT0ke01BUklBREJfREFUQUJBU0U6LWJvb2tsb3JlLWRifScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ21hcmlhZGItZGF0YTovdmFyL2xpYi9teXNxbCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBoZWFsdGhjaGVjay5zaAogICAgICAgIC0gJy0tY29ubmVjdCcKICAgICAgICAtICctLWlubm9kYl9pbml0aWFsaXplZCcKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAo=",
-        "tags": [
-            "media",
-            "books",
-            "kobo",
-            "epub",
-            "ebook",
-            "koreader"
-        ],
-        "category": null,
-        "logo": "svgs/booklore.svg",
-        "minversion": "0.0.0",
-        "port": "80"
-    },
     "bookstack": {
         "documentation": "https://www.bookstackapp.com/docs/?utm_source=coolify.io",
         "slogan": "BookStack is a simple, self-hosted, easy-to-use platform for organising and storing information",
@@ -1204,6 +1187,23 @@
         "minversion": "0.0.0",
         "port": "6052"
     },
+    "espocrm": {
+        "documentation": "https://docs.espocrm.com?utm_source=coolify.io",
+        "slogan": "EspoCRM is a free and open-source CRM platform.",
+        "compose": "c2VydmljZXM6CiAgZXNwb2NybToKICAgIGltYWdlOiAnZXNwb2NybS9lc3BvY3JtOjknCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9FU1BPQ1JNCiAgICAgIC0gJ0VTUE9DUk1fQURNSU5fVVNFUk5BTUU9JHtFU1BPQ1JNX0FETUlOX1VTRVJOQU1FOi1hZG1pbn0nCiAgICAgIC0gJ0VTUE9DUk1fQURNSU5fUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX0FETUlOfScKICAgICAgLSBFU1BPQ1JNX0RBVEFCQVNFX1BMQVRGT1JNPU15c3FsCiAgICAgIC0gRVNQT0NSTV9EQVRBQkFTRV9IT1NUPWVzcG9jcm0tZGIKICAgICAgLSAnRVNQT0NSTV9EQVRBQkFTRV9OQU1FPSR7TUFSSUFEQl9EQVRBQkFTRTotZXNwb2NybX0nCiAgICAgIC0gJ0VTUE9DUk1fREFUQUJBU0VfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NQVJJQURCfScKICAgICAgLSAnRVNQT0NSTV9EQVRBQkFTRV9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICAgIC0gJ0VTUE9DUk1fU0lURV9VUkw9JHtTRVJWSUNFX1VSTF9FU1BPQ1JNfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2VzcG9jcm06L3Zhci93d3cvaHRtbCcKICAgIGhlYWx0aGNoZWNrOgogICAgICB0ZXN0OgogICAgICAgIC0gQ01ECiAgICAgICAgLSBjdXJsCiAgICAgICAgLSAnLWYnCiAgICAgICAgLSAnaHR0cDovLzEyNy4wLjAuMTo4MCcKICAgICAgaW50ZXJ2YWw6IDJzCiAgICAgIHN0YXJ0X3BlcmlvZDogNjBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAxNQogICAgZGVwZW5kc19vbjoKICAgICAgZXNwb2NybS1kYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIGVzcG9jcm0tZGFlbW9uOgogICAgaW1hZ2U6ICdlc3BvY3JtL2VzcG9jcm06OScKICAgIGNvbnRhaW5lcl9uYW1lOiBlc3BvY3JtLWRhZW1vbgogICAgdm9sdW1lczoKICAgICAgLSAnZXNwb2NybTovdmFyL3d3dy9odG1sJwogICAgcmVzdGFydDogYWx3YXlzCiAgICBlbnRyeXBvaW50OiBkb2NrZXItZGFlbW9uLnNoCiAgICBkZXBlbmRzX29uOgogICAgICBlc3BvY3JtOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgZXNwb2NybS13ZWJzb2NrZXQ6CiAgICBpbWFnZTogJ2VzcG9jcm0vZXNwb2NybTo5JwogICAgY29udGFpbmVyX25hbWU6IGVzcG9jcm0td2Vic29ja2V0CiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX1VSTF9FU1BPQ1JNX1dFQlNPQ0tFVF84MDgwCiAgICAgIC0gRVNQT0NSTV9DT05GSUdfVVNFX1dFQl9TT0NLRVQ9dHJ1ZQogICAgICAtIEVTUE9DUk1fQ09ORklHX1dFQl9TT0NLRVRfVVJMPSRTRVJWSUNFX1VSTF9FU1BPQ1JNX1dFQlNPQ0tFVAogICAgICAtICdFU1BPQ1JNX0NPTkZJR19XRUJfU09DS0VUX1pFUk9fTV9RX1NVQlNDUklCRVJfRFNOPXRjcDovLyo6Nzc3NycKICAgICAgLSAnRVNQT0NSTV9DT05GSUdfV0VCX1NPQ0tFVF9aRVJPX01fUV9TVUJNSVNTSU9OX0RTTj10Y3A6Ly9lc3BvY3JtLXdlYnNvY2tldDo3Nzc3JwogICAgdm9sdW1lczoKICAgICAgLSAnZXNwb2NybTovdmFyL3d3dy9odG1sJwogICAgcmVzdGFydDogYWx3YXlzCiAgICBlbnRyeXBvaW50OiBkb2NrZXItd2Vic29ja2V0LnNoCiAgICBkZXBlbmRzX29uOgogICAgICBlc3BvY3JtOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgZXNwb2NybS1kYjoKICAgIGltYWdlOiAnbWFyaWFkYjoxMS44JwogICAgZW52aXJvbm1lbnQ6CiAgICAgIC0gJ01BUklBREJfREFUQUJBU0U9JHtNQVJJQURCX0RBVEFCQVNFOi1lc3BvY3JtfScKICAgICAgLSAnTUFSSUFEQl9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdNQVJJQURCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgICAgLSAnTUFSSUFEQl9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9ST09UfScKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2VzcG9jcm0tZGI6L3Zhci9saWIvbXlzcWwnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaGVhbHRoY2hlY2suc2gKICAgICAgICAtICctLWNvbm5lY3QnCiAgICAgICAgLSAnLS1pbm5vZGJfaW5pdGlhbGl6ZWQnCiAgICAgIGludGVydmFsOiAyMHMKICAgICAgc3RhcnRfcGVyaW9kOiAxMHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDMK",
+        "tags": [
+            "crm",
+            "self-hosted",
+            "open-source",
+            "workflow",
+            "automation",
+            "project management"
+        ],
+        "category": "cms",
+        "logo": "svgs/espocrm.svg",
+        "minversion": "0.0.0",
+        "port": "80"
+    },
     "evolution-api": {
         "documentation": "https://doc.evolution-api.com/v2/en/get-started/introduction?utm_source=coolify.io",
         "slogan": "Multi-platform messaging (whatsapp and more) integration API",

templates/service-templates.json

@@ -310,23 +310,6 @@
         "minversion": "0.0.0",
         "port": "3000"
     },
-    "booklore": {
-        "documentation": "https://booklore.org/docs/getting-started?utm_source=coolify.io",
-        "slogan": "Booklore is an open-source library management system for your digital book collection.",
-        "compose": "c2VydmljZXM6CiAgYm9va2xvcmU6CiAgICBpbWFnZTogJ2Jvb2tsb3JlL2Jvb2tsb3JlOnYxLjE2LjUnCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fQk9PS0xPUkVfODAKICAgICAgLSAnVVNFUl9JRD0ke0JPT0tMT1JFX1VTRVJfSUQ6LTB9JwogICAgICAtICdHUk9VUF9JRD0ke0JPT0tMT1JFX0dST1VQX0lEOi0wfScKICAgICAgLSAnVFo9JHtUWjotVVRDfScKICAgICAgLSAnREFUQUJBU0VfVVJMPWpkYmM6bWFyaWFkYjovL21hcmlhZGI6MzMwNi8ke01BUklBREJfREFUQUJBU0U6LWJvb2tsb3JlLWRifScKICAgICAgLSAnREFUQUJBU0VfVVNFUk5BTUU9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ0RBVEFCQVNFX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgICAgLSBCT09LTE9SRV9QT1JUPTgwCiAgICB2b2x1bWVzOgogICAgICAtICdib29rbG9yZS1kYXRhOi9hcHAvZGF0YScKICAgICAgLSAnYm9va2xvcmUtYm9va3M6L2Jvb2tzJwogICAgICAtCiAgICAgICAgdHlwZTogYmluZAogICAgICAgIHNvdXJjZTogfi9ib29rbG9yZQogICAgICAgIHRhcmdldDogL2Jvb2tkcm9wCiAgICAgICAgaXNfZGlyZWN0b3J5OiB0cnVlCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDogJ3dnZXQgLS1uby12ZXJib3NlIC0tdHJpZXM9MSAtLXNwaWRlciBodHRwOi8vbG9jYWxob3N0L2xvZ2luIHx8IGV4aXQgMScKICAgICAgaW50ZXJ2YWw6IDEwcwogICAgICB0aW1lb3V0OiA1cwogICAgICByZXRyaWVzOiAxMAogICAgZGVwZW5kc19vbjoKICAgICAgbWFyaWFkYjoKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIG1hcmlhZGI6CiAgICBpbWFnZTogJ21hcmlhZGI6MTInCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSAnTUFSSUFEQl9VU0VSPSR7U0VSVklDRV9VU0VSX01BUklBREJ9JwogICAgICAtICdNQVJJQURCX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCfScKICAgICAgLSAnTUFSSUFEQl9ST09UX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9NQVJJQURCUk9PVH0nCiAgICAgIC0gJ01BUklBREJfREFUQUJBU0U9JHtNQVJJQURCX0RBVEFCQVNFOi1ib29rbG9yZS1kYn0nCiAgICB2b2x1bWVzOgogICAgICAtICdtYXJpYWRiLWRhdGE6L3Zhci9saWIvbXlzcWwnCiAgICBoZWFsdGhjaGVjazoKICAgICAgdGVzdDoKICAgICAgICAtIENNRAogICAgICAgIC0gaGVhbHRoY2hlY2suc2gKICAgICAgICAtICctLWNvbm5lY3QnCiAgICAgICAgLSAnLS1pbm5vZGJfaW5pdGlhbGl6ZWQnCiAgICAgIGludGVydmFsOiAxMHMKICAgICAgdGltZW91dDogNXMKICAgICAgcmV0cmllczogMTAK",
-        "tags": [
-            "media",
-            "books",
-            "kobo",
-            "epub",
-            "ebook",
-            "koreader"
-        ],
-        "category": null,
-        "logo": "svgs/booklore.svg",
-        "minversion": "0.0.0",
-        "port": "80"
-    },
     "bookstack": {
         "documentation": "https://www.bookstackapp.com/docs/?utm_source=coolify.io",
         "slogan": "BookStack is a simple, self-hosted, easy-to-use platform for organising and storing information",
@@ -1204,6 +1187,23 @@
         "minversion": "0.0.0",
         "port": "6052"
     },
+    "espocrm": {
+        "documentation": "https://docs.espocrm.com?utm_source=coolify.io",
+        "slogan": "EspoCRM is a free and open-source CRM platform.",
+        "compose": "c2VydmljZXM6CiAgZXNwb2NybToKICAgIGltYWdlOiAnZXNwb2NybS9lc3BvY3JtOjknCiAgICBlbnZpcm9ubWVudDoKICAgICAgLSBTRVJWSUNFX0ZRRE5fRVNQT0NSTQogICAgICAtICdFU1BPQ1JNX0FETUlOX1VTRVJOQU1FPSR7RVNQT0NSTV9BRE1JTl9VU0VSTkFNRTotYWRtaW59JwogICAgICAtICdFU1BPQ1JNX0FETUlOX1BBU1NXT1JEPSR7U0VSVklDRV9QQVNTV09SRF9BRE1JTn0nCiAgICAgIC0gRVNQT0NSTV9EQVRBQkFTRV9QTEFURk9STT1NeXNxbAogICAgICAtIEVTUE9DUk1fREFUQUJBU0VfSE9TVD1lc3BvY3JtLWRiCiAgICAgIC0gJ0VTUE9DUk1fREFUQUJBU0VfTkFNRT0ke01BUklBREJfREFUQUJBU0U6LWVzcG9jcm19JwogICAgICAtICdFU1BPQ1JNX0RBVEFCQVNFX1VTRVI9JHtTRVJWSUNFX1VTRVJfTUFSSUFEQn0nCiAgICAgIC0gJ0VTUE9DUk1fREFUQUJBU0VfUEFTU1dPUkQ9JHtTRVJWSUNFX1BBU1NXT1JEX01BUklBREJ9JwogICAgICAtICdFU1BPQ1JNX1NJVEVfVVJMPSR7U0VSVklDRV9GUUROX0VTUE9DUk19JwogICAgdm9sdW1lczoKICAgICAgLSAnZXNwb2NybTovdmFyL3d3dy9odG1sJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGN1cmwKICAgICAgICAtICctZicKICAgICAgICAtICdodHRwOi8vMTI3LjAuMC4xOjgwJwogICAgICBpbnRlcnZhbDogMnMKICAgICAgc3RhcnRfcGVyaW9kOiA2MHMKICAgICAgdGltZW91dDogMTBzCiAgICAgIHJldHJpZXM6IDE1CiAgICBkZXBlbmRzX29uOgogICAgICBlc3BvY3JtLWRiOgogICAgICAgIGNvbmRpdGlvbjogc2VydmljZV9oZWFsdGh5CiAgZXNwb2NybS1kYWVtb246CiAgICBpbWFnZTogJ2VzcG9jcm0vZXNwb2NybTo5JwogICAgY29udGFpbmVyX25hbWU6IGVzcG9jcm0tZGFlbW9uCiAgICB2b2x1bWVzOgogICAgICAtICdlc3BvY3JtOi92YXIvd3d3L2h0bWwnCiAgICByZXN0YXJ0OiBhbHdheXMKICAgIGVudHJ5cG9pbnQ6IGRvY2tlci1kYWVtb24uc2gKICAgIGRlcGVuZHNfb246CiAgICAgIGVzcG9jcm06CiAgICAgICAgY29uZGl0aW9uOiBzZXJ2aWNlX2hlYWx0aHkKICBlc3BvY3JtLXdlYnNvY2tldDoKICAgIGltYWdlOiAnZXNwb2NybS9lc3BvY3JtOjknCiAgICBjb250YWluZXJfbmFtZTogZXNwb2NybS13ZWJzb2NrZXQKICAgIGVudmlyb25tZW50OgogICAgICAtIFNFUlZJQ0VfRlFETl9FU1BPQ1JNX1dFQlNPQ0tFVF84MDgwCiAgICAgIC0gRVNQT0NSTV9DT05GSUdfVVNFX1dFQl9TT0NLRVQ9dHJ1ZQogICAgICAtIEVTUE9DUk1fQ09ORklHX1dFQl9TT0NLRVRfVVJMPSRTRVJWSUNFX0ZRRE5fRVNQT0NSTV9XRUJTT0NLRVQKICAgICAgLSAnRVNQT0NSTV9DT05GSUdfV0VCX1NPQ0tFVF9aRVJPX01fUV9TVUJTQ1JJQkVSX0RTTj10Y3A6Ly8qOjc3NzcnCiAgICAgIC0gJ0VTUE9DUk1fQ09ORklHX1dFQl9TT0NLRVRfWkVST19NX1FfU1VCTUlTU0lPTl9EU049dGNwOi8vZXNwb2NybS13ZWJzb2NrZXQ6Nzc3NycKICAgIHZvbHVtZXM6CiAgICAgIC0gJ2VzcG9jcm06L3Zhci93d3cvaHRtbCcKICAgIHJlc3RhcnQ6IGFsd2F5cwogICAgZW50cnlwb2ludDogZG9ja2VyLXdlYnNvY2tldC5zaAogICAgZGVwZW5kc19vbjoKICAgICAgZXNwb2NybToKICAgICAgICBjb25kaXRpb246IHNlcnZpY2VfaGVhbHRoeQogIGVzcG9jcm0tZGI6CiAgICBpbWFnZTogJ21hcmlhZGI6MTEuOCcKICAgIGVudmlyb25tZW50OgogICAgICAtICdNQVJJQURCX0RBVEFCQVNFPSR7TUFSSUFEQl9EQVRBQkFTRTotZXNwb2NybX0nCiAgICAgIC0gJ01BUklBREJfVVNFUj0ke1NFUlZJQ0VfVVNFUl9NQVJJQURCfScKICAgICAgLSAnTUFSSUFEQl9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfTUFSSUFEQn0nCiAgICAgIC0gJ01BUklBREJfUk9PVF9QQVNTV09SRD0ke1NFUlZJQ0VfUEFTU1dPUkRfUk9PVH0nCiAgICB2b2x1bWVzOgogICAgICAtICdlc3BvY3JtLWRiOi92YXIvbGliL215c3FsJwogICAgaGVhbHRoY2hlY2s6CiAgICAgIHRlc3Q6CiAgICAgICAgLSBDTUQKICAgICAgICAtIGhlYWx0aGNoZWNrLnNoCiAgICAgICAgLSAnLS1jb25uZWN0JwogICAgICAgIC0gJy0taW5ub2RiX2luaXRpYWxpemVkJwogICAgICBpbnRlcnZhbDogMjBzCiAgICAgIHN0YXJ0X3BlcmlvZDogMTBzCiAgICAgIHRpbWVvdXQ6IDEwcwogICAgICByZXRyaWVzOiAzCg==",
+        "tags": [
+            "crm",
+            "self-hosted",
+            "open-source",
+            "workflow",
+            "automation",
+            "project management"
+        ],
+        "category": "cms",
+        "logo": "svgs/espocrm.svg",
+        "minversion": "0.0.0",
+        "port": "80"
+    },
     "evolution-api": {
         "documentation": "https://doc.evolution-api.com/v2/en/get-started/introduction?utm_source=coolify.io",
         "slogan": "Multi-platform messaging (whatsapp and more) integration API",

tests/Feature/DockerCleanupJobTest.php

@@ -0,0 +1,50 @@
+<?php
+
+use App\Jobs\DockerCleanupJob;
+use App\Models\DockerCleanupExecution;
+use App\Models\Server;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+it('creates a failed execution record when server is not functional', function () {
+    $user = User::factory()->create();
+    $team = $user->teams()->first();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+
+    // Make server not functional by setting is_reachable to false
+    $server->settings->update(['is_reachable' => false]);
+
+    $job = new DockerCleanupJob($server);
+    $job->handle();
+
+    $execution = DockerCleanupExecution::where('server_id', $server->id)->first();
+
+    expect($execution)->not->toBeNull()
+        ->and($execution->status)->toBe('failed')
+        ->and($execution->message)->toContain('not functional')
+        ->and($execution->finished_at)->not->toBeNull();
+});
+
+it('creates a failed execution record when server is force disabled', function () {
+    $user = User::factory()->create();
+    $team = $user->teams()->first();
+    $server = Server::factory()->create(['team_id' => $team->id]);
+
+    // Make server not functional by force disabling
+    $server->settings->update([
+        'is_reachable' => true,
+        'is_usable' => true,
+        'force_disabled' => true,
+    ]);
+
+    $job = new DockerCleanupJob($server);
+    $job->handle();
+
+    $execution = DockerCleanupExecution::where('server_id', $server->id)->first();
+
+    expect($execution)->not->toBeNull()
+        ->and($execution->status)->toBe('failed')
+        ->and($execution->message)->toContain('not functional');
+});

tests/Feature/GenerateApplicationNameTest.php

@@ -0,0 +1,22 @@
+<?php
+
+test('generate_application_name strips owner from git repository', function () {
+    $name = generate_application_name('coollabsio/coolify', 'main', 'test123');
+
+    expect($name)->toBe('coolify:main-test123');
+    expect($name)->not->toContain('coollabsio');
+});
+
+test('generate_application_name handles repository without owner', function () {
+    $name = generate_application_name('coolify', 'main', 'test123');
+
+    expect($name)->toBe('coolify:main-test123');
+});
+
+test('generate_application_name handles deeply nested repository path', function () {
+    $name = generate_application_name('org/sub/repo-name', 'develop', 'abc456');
+
+    expect($name)->toBe('repo-name:develop-abc456');
+    expect($name)->not->toContain('org');
+    expect($name)->not->toContain('sub');
+});

tests/Feature/GithubWebhookTest.php

@@ -0,0 +1,70 @@
+<?php
+
+describe('GitHub Manual Webhook', function () {
+    test('ping event returns pong', function () {
+        $response = $this->postJson('/webhooks/source/github/events/manual', [], [
+            'X-GitHub-Event' => 'ping',
+        ]);
+
+        $response->assertOk();
+        $response->assertSee('pong');
+    });
+
+    test('unsupported event type returns graceful response instead of 500', function () {
+        $payload = [
+            'action' => 'published',
+            'registry_package' => [
+                'ecosystem' => 'CONTAINER',
+                'package_type' => 'CONTAINER',
+                'package_version' => [
+                    'target_commitish' => 'main',
+                ],
+            ],
+            'repository' => [
+                'full_name' => 'test-org/test-repo',
+                'default_branch' => 'main',
+            ],
+        ];
+
+        $response = $this->postJson('/webhooks/source/github/events/manual', $payload, [
+            'X-GitHub-Event' => 'registry_package',
+            'X-Hub-Signature-256' => 'sha256=fake',
+        ]);
+
+        $response->assertOk();
+        $response->assertSee('not supported');
+    });
+
+    test('unknown event type returns graceful response', function () {
+        $response = $this->postJson('/webhooks/source/github/events/manual', ['foo' => 'bar'], [
+            'X-GitHub-Event' => 'some_unknown_event',
+            'X-Hub-Signature-256' => 'sha256=fake',
+        ]);
+
+        $response->assertOk();
+        $response->assertSee('not supported');
+    });
+});
+
+describe('GitHub Normal Webhook', function () {
+    test('unsupported event type returns graceful response instead of 500', function () {
+        $payload = [
+            'action' => 'published',
+            'registry_package' => [
+                'ecosystem' => 'CONTAINER',
+            ],
+            'repository' => [
+                'full_name' => 'test-org/test-repo',
+            ],
+        ];
+
+        $response = $this->postJson('/webhooks/source/github/events', $payload, [
+            'X-GitHub-Event' => 'registry_package',
+            'X-GitHub-Hook-Installation-Target-Id' => '12345',
+            'X-Hub-Signature-256' => 'sha256=fake',
+        ]);
+
+        // Should not be a 500 error - either 200 with "not supported" or "No GitHub App found"
+        $response->assertOk();
+    });
+});

tests/Feature/ScheduledJobManagerShouldRunNowTest.php

@@ -1,271 +1,168 @@
 <?php
 
-use App\Jobs\ScheduledJobManager;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Cache;
 
 beforeEach(function () {
-    // Clear any dedup keys
     Cache::flush();
 });
 
 it('dispatches backup when job runs on time at the cron minute', function () {
-    // Freeze time at exactly 02:00 — daily cron "0 2 * * *" is due
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 2, 0, 0, 'UTC'));
 
-    $job = new ScheduledJobManager;
-
-    // Use reflection to test shouldRunNow
-    $reflection = new ReflectionClass($job);
-
-    $executionTimeProp = $reflection->getProperty('executionTime');
-    $executionTimeProp->setAccessible(true);
-    $executionTimeProp->setValue($job, Carbon::now());
-
-    $method = $reflection->getMethod('shouldRunNow');
-    $method->setAccessible(true);
-
-    $result = $method->invoke($job, '0 2 * * *', 'UTC', 'test-backup:1');
+    $result = shouldRunCronNow('0 2 * * *', 'UTC', 'test-backup:1');
 
     expect($result)->toBeTrue();
 });
 
 it('catches delayed job when cache has a baseline from previous run', function () {
-    // Simulate a previous dispatch yesterday at 02:00
     Cache::put('test-backup:1', Carbon::create(2026, 2, 27, 2, 0, 0, 'UTC')->toIso8601String(), 86400);
 
-    // Freeze time at 02:07 — job was delayed 7 minutes past today's 02:00 cron
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 2, 7, 0, 'UTC'));
 
-    $job = new ScheduledJobManager;
-
-    $reflection = new ReflectionClass($job);
-
-    $executionTimeProp = $reflection->getProperty('executionTime');
-    $executionTimeProp->setAccessible(true);
-    $executionTimeProp->setValue($job, Carbon::now());
-
-    $method = $reflection->getMethod('shouldRunNow');
-    $method->setAccessible(true);
-
     // isDue() would return false at 02:07, but getPreviousRunDate() = 02:00 today
     // lastDispatched = 02:00 yesterday → 02:00 today > yesterday → fires
-    $result = $method->invoke($job, '0 2 * * *', 'UTC', 'test-backup:1');
+    $result = shouldRunCronNow('0 2 * * *', 'UTC', 'test-backup:1');
 
     expect($result)->toBeTrue();
 });
 
 it('does not double-dispatch on subsequent runs within same cron window', function () {
-    // First run at 02:00 — dispatches and sets cache
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 2, 0, 0, 'UTC'));
 
-    $job = new ScheduledJobManager;
-    $reflection = new ReflectionClass($job);
-
-    $executionTimeProp = $reflection->getProperty('executionTime');
-    $executionTimeProp->setAccessible(true);
-    $executionTimeProp->setValue($job, Carbon::now());
-
-    $method = $reflection->getMethod('shouldRunNow');
-    $method->setAccessible(true);
-
-    $first = $method->invoke($job, '0 2 * * *', 'UTC', 'test-backup:2');
+    $first = shouldRunCronNow('0 2 * * *', 'UTC', 'test-backup:2');
     expect($first)->toBeTrue();
 
     // Second run at 02:01 — should NOT dispatch (previousDue=02:00, lastDispatched=02:00)
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 2, 1, 0, 'UTC'));
-    $executionTimeProp->setValue($job, Carbon::now());
 
-    $second = $method->invoke($job, '0 2 * * *', 'UTC', 'test-backup:2');
+    $second = shouldRunCronNow('0 2 * * *', 'UTC', 'test-backup:2');
     expect($second)->toBeFalse();
 });
 
 it('fires every_minute cron correctly on consecutive minutes', function () {
-    $job = new ScheduledJobManager;
-    $reflection = new ReflectionClass($job);
-
-    $executionTimeProp = $reflection->getProperty('executionTime');
-    $executionTimeProp->setAccessible(true);
-
-    $method = $reflection->getMethod('shouldRunNow');
-    $method->setAccessible(true);
-
     // Minute 1
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 10, 0, 0, 'UTC'));
-    $executionTimeProp->setValue($job, Carbon::now());
-    $result1 = $method->invoke($job, '* * * * *', 'UTC', 'test-backup:3');
-    expect($result1)->toBeTrue();
+    expect(shouldRunCronNow('* * * * *', 'UTC', 'test-backup:3'))->toBeTrue();
 
     // Minute 2
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 10, 1, 0, 'UTC'));
-    $executionTimeProp->setValue($job, Carbon::now());
-    $result2 = $method->invoke($job, '* * * * *', 'UTC', 'test-backup:3');
-    expect($result2)->toBeTrue();
+    expect(shouldRunCronNow('* * * * *', 'UTC', 'test-backup:3'))->toBeTrue();
 
     // Minute 3
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 10, 2, 0, 'UTC'));
-    $executionTimeProp->setValue($job, Carbon::now());
-    $result3 = $method->invoke($job, '* * * * *', 'UTC', 'test-backup:3');
-    expect($result3)->toBeTrue();
+    expect(shouldRunCronNow('* * * * *', 'UTC', 'test-backup:3'))->toBeTrue();
 });
 
 it('does not fire non-due jobs on restart when cache is empty', function () {
     // Time is 10:00, cron is daily at 02:00 — NOT due right now
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 10, 0, 0, 'UTC'));
 
-    $job = new ScheduledJobManager;
-    $reflection = new ReflectionClass($job);
-
-    $executionTimeProp = $reflection->getProperty('executionTime');
-    $executionTimeProp->setAccessible(true);
-    $executionTimeProp->setValue($job, Carbon::now());
-
-    $method = $reflection->getMethod('shouldRunNow');
-    $method->setAccessible(true);
-
-    // Cache is empty (fresh restart) — should NOT fire daily backup at 10:00
-    $result = $method->invoke($job, '0 2 * * *', 'UTC', 'test-backup:4');
+    $result = shouldRunCronNow('0 2 * * *', 'UTC', 'test-backup:4');
     expect($result)->toBeFalse();
 });
 
 it('fires due jobs on restart when cache is empty', function () {
-    // Time is exactly 02:00, cron is daily at 02:00 — IS due right now
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 2, 0, 0, 'UTC'));
 
-    $job = new ScheduledJobManager;
-    $reflection = new ReflectionClass($job);
-
-    $executionTimeProp = $reflection->getProperty('executionTime');
-    $executionTimeProp->setAccessible(true);
-    $executionTimeProp->setValue($job, Carbon::now());
-
-    $method = $reflection->getMethod('shouldRunNow');
-    $method->setAccessible(true);
-
-    // Cache is empty (fresh restart) — but cron IS due → should fire
-    $result = $method->invoke($job, '0 2 * * *', 'UTC', 'test-backup:4b');
+    $result = shouldRunCronNow('0 2 * * *', 'UTC', 'test-backup:4b');
     expect($result)->toBeTrue();
 });
 
 it('does not dispatch when cron is not due and was not recently due', function () {
-    // Time is 10:00, cron is daily at 02:00 — last due was 8 hours ago
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 10, 0, 0, 'UTC'));
 
-    $job = new ScheduledJobManager;
-    $reflection = new ReflectionClass($job);
-
-    $executionTimeProp = $reflection->getProperty('executionTime');
-    $executionTimeProp->setAccessible(true);
-    $executionTimeProp->setValue($job, Carbon::now());
-
-    $method = $reflection->getMethod('shouldRunNow');
-    $method->setAccessible(true);
-
-    // previousDue = 02:00, but lastDispatched was set at 02:00 (simulate)
     Cache::put('test-backup:5', Carbon::create(2026, 2, 28, 2, 0, 0, 'UTC')->toIso8601String(), 86400);
 
-    $result = $method->invoke($job, '0 2 * * *', 'UTC', 'test-backup:5');
+    $result = shouldRunCronNow('0 2 * * *', 'UTC', 'test-backup:5');
     expect($result)->toBeFalse();
 });
 
 it('falls back to isDue when no dedup key is provided', function () {
-    // Time is exactly 02:00, cron is "0 2 * * *" — should be due
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 2, 0, 0, 'UTC'));
+    expect(shouldRunCronNow('0 2 * * *', 'UTC'))->toBeTrue();
 
-    $job = new ScheduledJobManager;
-    $reflection = new ReflectionClass($job);
-
-    $executionTimeProp = $reflection->getProperty('executionTime');
-    $executionTimeProp->setAccessible(true);
-    $executionTimeProp->setValue($job, Carbon::now());
-
-    $method = $reflection->getMethod('shouldRunNow');
-    $method->setAccessible(true);
-
-    // No dedup key → simple isDue check
-    $result = $method->invoke($job, '0 2 * * *', 'UTC');
-    expect($result)->toBeTrue();
-
-    // At 02:01 without dedup key → isDue returns false
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 2, 1, 0, 'UTC'));
-    $executionTimeProp->setValue($job, Carbon::now());
-
-    $result2 = $method->invoke($job, '0 2 * * *', 'UTC');
-    expect($result2)->toBeFalse();
+    expect(shouldRunCronNow('0 2 * * *', 'UTC'))->toBeFalse();
 });
 
 it('catches delayed docker cleanup when job runs past the cron minute', function () {
-    // Simulate a previous dispatch at :10
     Cache::put('docker-cleanup:42', Carbon::create(2026, 2, 28, 10, 10, 0, 'UTC')->toIso8601String(), 86400);
 
-    // Freeze time at :22 — job was delayed 2 minutes past the :20 cron window
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 10, 22, 0, 'UTC'));
 
-    $job = new ScheduledJobManager;
-    $reflection = new ReflectionClass($job);
-
-    $executionTimeProp = $reflection->getProperty('executionTime');
-    $executionTimeProp->setAccessible(true);
-    $executionTimeProp->setValue($job, Carbon::now());
-
-    $method = $reflection->getMethod('shouldRunNow');
-    $method->setAccessible(true);
-
     // isDue() would return false at :22, but getPreviousRunDate() = :20
     // lastDispatched = :10 → :20 > :10 → fires
-    $result = $method->invoke($job, '*/10 * * * *', 'UTC', 'docker-cleanup:42');
+    $result = shouldRunCronNow('*/10 * * * *', 'UTC', 'docker-cleanup:42');
 
     expect($result)->toBeTrue();
 });
 
 it('does not double-dispatch docker cleanup within same cron window', function () {
-    // First dispatch at :10
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 10, 10, 0, 'UTC'));
 
-    $job = new ScheduledJobManager;
-    $reflection = new ReflectionClass($job);
-
-    $executionTimeProp = $reflection->getProperty('executionTime');
-    $executionTimeProp->setAccessible(true);
-    $executionTimeProp->setValue($job, Carbon::now());
-
-    $method = $reflection->getMethod('shouldRunNow');
-    $method->setAccessible(true);
-
-    $first = $method->invoke($job, '*/10 * * * *', 'UTC', 'docker-cleanup:99');
+    $first = shouldRunCronNow('*/10 * * * *', 'UTC', 'docker-cleanup:99');
     expect($first)->toBeTrue();
 
-    // Second run at :11 — should NOT dispatch (previousDue=:10, lastDispatched=:10)
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 10, 11, 0, 'UTC'));
-    $executionTimeProp->setValue($job, Carbon::now());
 
-    $second = $method->invoke($job, '*/10 * * * *', 'UTC', 'docker-cleanup:99');
+    $second = shouldRunCronNow('*/10 * * * *', 'UTC', 'docker-cleanup:99');
     expect($second)->toBeFalse();
 });
 
+it('seeds cache with previousDue when not due on first run', function () {
+    Carbon::setTestNow(Carbon::create(2026, 2, 28, 10, 0, 0, 'UTC'));
+
+    $result = shouldRunCronNow('0 2 * * *', 'UTC', 'test-seed:1');
+    expect($result)->toBeFalse();
+
+    // Verify cache was seeded with previousDue (02:00 today)
+    $cached = Cache::get('test-seed:1');
+    expect($cached)->not->toBeNull();
+    expect(Carbon::parse($cached)->format('H:i'))->toBe('02:00');
+});
+
+it('catches next occurrence after cache was seeded on non-due first run', function () {
+    // Step 1: 10:00 — not due, but seeds cache with previousDue (02:00 today)
+    Carbon::setTestNow(Carbon::create(2026, 2, 28, 10, 0, 0, 'UTC'));
+    expect(shouldRunCronNow('0 2 * * *', 'UTC', 'test-seed:2'))->toBeFalse();
+
+    // Step 2: Next day at 02:03 — delayed 3 minutes past cron.
+    // previousDue = 02:00 Mar 1, lastDispatched = 02:00 Feb 28 → fires
+    Carbon::setTestNow(Carbon::create(2026, 3, 1, 2, 3, 0, 'UTC'));
+    expect(shouldRunCronNow('0 2 * * *', 'UTC', 'test-seed:2'))->toBeTrue();
+});
+
+it('cache survives 29 days with static 30-day TTL', function () {
+    Carbon::setTestNow(Carbon::create(2026, 2, 28, 2, 0, 0, 'UTC'));
+
+    shouldRunCronNow('0 2 * * *', 'UTC', 'test-ttl:static');
+    expect(Cache::get('test-ttl:static'))->not->toBeNull();
+
+    // 29 days later — cache (30-day TTL) should still exist
+    Carbon::setTestNow(Carbon::create(2026, 3, 29, 0, 0, 0, 'UTC'));
+    expect(Cache::get('test-ttl:static'))->not->toBeNull();
+});
+
 it('respects server timezone for cron evaluation', function () {
     // UTC time is 22:00 Feb 28, which is 06:00 Mar 1 in Asia/Singapore (+8)
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 22, 0, 0, 'UTC'));
 
-    $job = new ScheduledJobManager;
-    $reflection = new ReflectionClass($job);
-
-    $executionTimeProp = $reflection->getProperty('executionTime');
-    $executionTimeProp->setAccessible(true);
-    $executionTimeProp->setValue($job, Carbon::now());
-
-    $method = $reflection->getMethod('shouldRunNow');
-    $method->setAccessible(true);
-
-    // Simulate that today's 06:00 UTC run was already dispatched (at 06:00 UTC)
     Cache::put('test-backup:7', Carbon::create(2026, 2, 28, 6, 0, 0, 'UTC')->toIso8601String(), 86400);
 
-    // Cron "0 6 * * *" in Asia/Singapore: local time is 06:00 Mar 1 → previousDue = 06:00 Mar 1 SGT
-    // That's a NEW cron window (Mar 1) that hasn't been dispatched → should fire
-    $resultSingapore = $method->invoke($job, '0 6 * * *', 'Asia/Singapore', 'test-backup:6');
-    expect($resultSingapore)->toBeTrue();
+    // Cron "0 6 * * *" in Asia/Singapore: local time is 06:00 Mar 1 → new window → should fire
+    expect(shouldRunCronNow('0 6 * * *', 'Asia/Singapore', 'test-backup:6'))->toBeTrue();
 
-    // Cron "0 6 * * *" in UTC: previousDue = 06:00 Feb 28 UTC, already dispatched at 06:00 → should NOT fire
-    $resultUtc = $method->invoke($job, '0 6 * * *', 'UTC', 'test-backup:7');
-    expect($resultUtc)->toBeFalse();
+    // Cron "0 6 * * *" in UTC: previousDue = 06:00 Feb 28, already dispatched → should NOT fire
+    expect(shouldRunCronNow('0 6 * * *', 'UTC', 'test-backup:7'))->toBeFalse();
+});
+
+it('passes explicit execution time instead of using Carbon::now()', function () {
+    // Real "now" is irrelevant — we pass an explicit execution time
+    Carbon::setTestNow(Carbon::create(2026, 2, 28, 15, 0, 0, 'UTC'));
+
+    $executionTime = Carbon::create(2026, 2, 28, 2, 0, 0, 'UTC');
+    $result = shouldRunCronNow('0 2 * * *', 'UTC', 'test-exec-time:1', $executionTime);
+
+    expect($result)->toBeTrue();
 });

tests/Feature/ServerManagerJobShouldRunNowTest.php

@@ -1,6 +1,5 @@
 <?php
 
-use App\Jobs\ServerManagerJob;
 use Illuminate\Support\Carbon;
 use Illuminate\Support\Facades\Cache;
 
@@ -9,94 +8,81 @@
 });
 
 it('catches delayed sentinel restart when job runs past midnight', function () {
-    // Simulate previous dispatch yesterday at midnight
     Cache::put('sentinel-restart:1', Carbon::create(2026, 2, 27, 0, 0, 0, 'UTC')->toIso8601String(), 86400);
 
     // Job runs 3 minutes late at 00:03
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 0, 3, 0, 'UTC'));
 
-    $job = new ServerManagerJob;
-    $reflection = new ReflectionClass($job);
-
-    $executionTimeProp = $reflection->getProperty('executionTime');
-    $executionTimeProp->setAccessible(true);
-    $executionTimeProp->setValue($job, Carbon::now());
-
-    $method = $reflection->getMethod('shouldRunNow');
-    $method->setAccessible(true);
-
     // isDue() would return false at 00:03, but getPreviousRunDate() = 00:00 today
     // lastDispatched = yesterday 00:00 → today 00:00 > yesterday → fires
-    $result = $method->invoke($job, '0 0 * * *', 'UTC', 'sentinel-restart:1');
+    $result = shouldRunCronNow('0 0 * * *', 'UTC', 'sentinel-restart:1');
 
     expect($result)->toBeTrue();
 });
 
 it('catches delayed weekly patch check when job runs past the cron minute', function () {
-    // Simulate previous dispatch last Sunday at midnight
     Cache::put('server-patch-check:1', Carbon::create(2026, 2, 22, 0, 0, 0, 'UTC')->toIso8601String(), 86400);
 
-    // This Sunday at 00:02 — job was delayed 2 minutes
-    // 2026-03-01 is a Sunday
+    // This Sunday at 00:02 — job was delayed 2 minutes (2026-03-01 is a Sunday)
     Carbon::setTestNow(Carbon::create(2026, 3, 1, 0, 2, 0, 'UTC'));
 
-    $job = new ServerManagerJob;
-    $reflection = new ReflectionClass($job);
-
-    $executionTimeProp = $reflection->getProperty('executionTime');
-    $executionTimeProp->setAccessible(true);
-    $executionTimeProp->setValue($job, Carbon::now());
-
-    $method = $reflection->getMethod('shouldRunNow');
-    $method->setAccessible(true);
-
-    $result = $method->invoke($job, '0 0 * * 0', 'UTC', 'server-patch-check:1');
+    $result = shouldRunCronNow('0 0 * * 0', 'UTC', 'server-patch-check:1');
 
     expect($result)->toBeTrue();
 });
 
 it('catches delayed storage check when job runs past the cron minute', function () {
-    // Simulate previous dispatch yesterday at 23:00
     Cache::put('server-storage-check:5', Carbon::create(2026, 2, 27, 23, 0, 0, 'UTC')->toIso8601String(), 86400);
 
-    // Today at 23:04 — job was delayed 4 minutes
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 23, 4, 0, 'UTC'));
 
-    $job = new ServerManagerJob;
-    $reflection = new ReflectionClass($job);
-
-    $executionTimeProp = $reflection->getProperty('executionTime');
-    $executionTimeProp->setAccessible(true);
-    $executionTimeProp->setValue($job, Carbon::now());
-
-    $method = $reflection->getMethod('shouldRunNow');
-    $method->setAccessible(true);
-
-    $result = $method->invoke($job, '0 23 * * *', 'UTC', 'server-storage-check:5');
+    $result = shouldRunCronNow('0 23 * * *', 'UTC', 'server-storage-check:5');
 
     expect($result)->toBeTrue();
 });
 
+it('seeds cache on non-due first run so weekly catch-up works', function () {
+    // Wednesday at 10:00 — weekly cron (Sunday 00:00) is not due
+    Carbon::setTestNow(Carbon::create(2026, 2, 25, 10, 0, 0, 'UTC'));
+
+    $result = shouldRunCronNow('0 0 * * 0', 'UTC', 'server-patch-check:seed-test');
+    expect($result)->toBeFalse();
+
+    // Verify cache was seeded
+    expect(Cache::get('server-patch-check:seed-test'))->not->toBeNull();
+
+    // Next Sunday at 00:02 — delayed 2 minutes past cron
+    // Catch-up: previousDue = Mar 1 00:00, lastDispatched = Feb 22 → fires
+    Carbon::setTestNow(Carbon::create(2026, 3, 1, 0, 2, 0, 'UTC'));
+
+    $result2 = shouldRunCronNow('0 0 * * 0', 'UTC', 'server-patch-check:seed-test');
+    expect($result2)->toBeTrue();
+});
+
+it('daily cron fires after cache seed even when delayed past the minute', function () {
+    // Step 1: 15:00 — not due for midnight cron, but seeds cache
+    Carbon::setTestNow(Carbon::create(2026, 2, 28, 15, 0, 0, 'UTC'));
+
+    $result1 = shouldRunCronNow('0 0 * * *', 'UTC', 'sentinel-restart:seed-test');
+    expect($result1)->toBeFalse();
+
+    // Step 2: Next day at 00:05 — delayed 5 minutes past midnight
+    // Catch-up: previousDue = Mar 1 00:00, lastDispatched = Feb 28 00:00 → fires
+    Carbon::setTestNow(Carbon::create(2026, 3, 1, 0, 5, 0, 'UTC'));
+
+    $result2 = shouldRunCronNow('0 0 * * *', 'UTC', 'sentinel-restart:seed-test');
+    expect($result2)->toBeTrue();
+});
+
 it('does not double-dispatch within same cron window', function () {
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 0, 0, 0, 'UTC'));
 
-    $job = new ServerManagerJob;
-    $reflection = new ReflectionClass($job);
-
-    $executionTimeProp = $reflection->getProperty('executionTime');
-    $executionTimeProp->setAccessible(true);
-    $executionTimeProp->setValue($job, Carbon::now());
-
-    $method = $reflection->getMethod('shouldRunNow');
-    $method->setAccessible(true);
-
-    $first = $method->invoke($job, '0 0 * * *', 'UTC', 'sentinel-restart:10');
+    $first = shouldRunCronNow('0 0 * * *', 'UTC', 'sentinel-restart:10');
     expect($first)->toBeTrue();
 
     // Next minute — should NOT dispatch again
     Carbon::setTestNow(Carbon::create(2026, 2, 28, 0, 1, 0, 'UTC'));
-    $executionTimeProp->setValue($job, Carbon::now());
 
-    $second = $method->invoke($job, '0 0 * * *', 'UTC', 'sentinel-restart:10');
+    $second = shouldRunCronNow('0 0 * * *', 'UTC', 'sentinel-restart:10');
     expect($second)->toBeFalse();
 });

tests/Feature/StorageApiTest.php

@@ -0,0 +1,379 @@
+<?php
+
+use App\Models\Application;
+use App\Models\Environment;
+use App\Models\InstanceSettings;
+use App\Models\LocalFileVolume;
+use App\Models\LocalPersistentVolume;
+use App\Models\Project;
+use App\Models\Server;
+use App\Models\StandaloneDocker;
+use App\Models\StandalonePostgresql;
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Bus;
+use Illuminate\Support\Str;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    Bus::fake();
+    InstanceSettings::updateOrCreate(['id' => 0]);
+
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    $plainTextToken = Str::random(40);
+    $token = $this->user->tokens()->create([
+        'name' => 'test-token',
+        'token' => hash('sha256', $plainTextToken),
+        'abilities' => ['*'],
+        'team_id' => $this->team->id,
+    ]);
+    $this->bearerToken = $token->getKey().'|'.$plainTextToken;
+
+    $this->server = Server::factory()->create(['team_id' => $this->team->id]);
+    $this->destination = StandaloneDocker::where('server_id', $this->server->id)->first();
+    $this->project = Project::factory()->create(['team_id' => $this->team->id]);
+    $this->environment = Environment::factory()->create(['project_id' => $this->project->id]);
+});
+
+function createTestApplication($context): Application
+{
+    return Application::factory()->create([
+        'environment_id' => $context->environment->id,
+    ]);
+}
+
+function createTestDatabase($context): StandalonePostgresql
+{
+    return StandalonePostgresql::create([
+        'name' => 'test-postgres',
+        'image' => 'postgres:15-alpine',
+        'postgres_user' => 'postgres',
+        'postgres_password' => 'password',
+        'postgres_db' => 'postgres',
+        'environment_id' => $context->environment->id,
+        'destination_id' => $context->destination->id,
+        'destination_type' => $context->destination->getMorphClass(),
+    ]);
+}
+
+// ──────────────────────────────────────────────────────────────
+// Application Storage Endpoints
+// ──────────────────────────────────────────────────────────────
+
+describe('GET /api/v1/applications/{uuid}/storages', function () {
+    test('lists storages for an application', function () {
+        $app = createTestApplication($this);
+
+        LocalPersistentVolume::create([
+            'name' => $app->uuid.'-test-vol',
+            'mount_path' => '/data',
+            'resource_id' => $app->id,
+            'resource_type' => $app->getMorphClass(),
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->getJson("/api/v1/applications/{$app->uuid}/storages");
+
+        $response->assertStatus(200);
+        $response->assertJsonCount(1, 'persistent_storages');
+        $response->assertJsonCount(0, 'file_storages');
+    });
+
+    test('returns 404 for non-existent application', function () {
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->getJson('/api/v1/applications/non-existent-uuid/storages');
+
+        $response->assertStatus(404);
+    });
+});
+
+describe('POST /api/v1/applications/{uuid}/storages', function () {
+    test('creates a persistent storage', function () {
+        $app = createTestApplication($this);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/applications/{$app->uuid}/storages", [
+            'type' => 'persistent',
+            'name' => 'my-volume',
+            'mount_path' => '/data',
+        ]);
+
+        $response->assertStatus(201);
+
+        $vol = LocalPersistentVolume::where('resource_id', $app->id)
+            ->where('resource_type', $app->getMorphClass())
+            ->first();
+
+        expect($vol)->not->toBeNull();
+        expect($vol->name)->toBe($app->uuid.'-my-volume');
+        expect($vol->mount_path)->toBe('/data');
+        expect($vol->uuid)->not->toBeNull();
+    });
+
+    test('creates a file storage', function () {
+        $app = createTestApplication($this);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/applications/{$app->uuid}/storages", [
+            'type' => 'file',
+            'mount_path' => '/app/config.json',
+            'content' => '{"key": "value"}',
+        ]);
+
+        $response->assertStatus(201);
+
+        $vol = LocalFileVolume::where('resource_id', $app->id)
+            ->where('resource_type', get_class($app))
+            ->first();
+
+        expect($vol)->not->toBeNull();
+        expect($vol->mount_path)->toBe('/app/config.json');
+        expect($vol->is_directory)->toBeFalse();
+    });
+
+    test('rejects persistent storage without name', function () {
+        $app = createTestApplication($this);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/applications/{$app->uuid}/storages", [
+            'type' => 'persistent',
+            'mount_path' => '/data',
+        ]);
+
+        $response->assertStatus(422);
+    });
+
+    test('rejects invalid type-specific fields', function () {
+        $app = createTestApplication($this);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/applications/{$app->uuid}/storages", [
+            'type' => 'persistent',
+            'name' => 'vol',
+            'mount_path' => '/data',
+            'content' => 'should not be here',
+        ]);
+
+        $response->assertStatus(422);
+    });
+});
+
+describe('PATCH /api/v1/applications/{uuid}/storages', function () {
+    test('updates a persistent storage by uuid', function () {
+        $app = createTestApplication($this);
+
+        $vol = LocalPersistentVolume::create([
+            'name' => $app->uuid.'-test-vol',
+            'mount_path' => '/data',
+            'resource_id' => $app->id,
+            'resource_type' => $app->getMorphClass(),
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->patchJson("/api/v1/applications/{$app->uuid}/storages", [
+            'uuid' => $vol->uuid,
+            'type' => 'persistent',
+            'mount_path' => '/new-data',
+        ]);
+
+        $response->assertStatus(200);
+        expect($vol->fresh()->mount_path)->toBe('/new-data');
+    });
+
+    test('updates a persistent storage by id (backwards compat)', function () {
+        $app = createTestApplication($this);
+
+        $vol = LocalPersistentVolume::create([
+            'name' => $app->uuid.'-test-vol',
+            'mount_path' => '/data',
+            'resource_id' => $app->id,
+            'resource_type' => $app->getMorphClass(),
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->patchJson("/api/v1/applications/{$app->uuid}/storages", [
+            'id' => $vol->id,
+            'type' => 'persistent',
+            'mount_path' => '/updated',
+        ]);
+
+        $response->assertStatus(200);
+        expect($vol->fresh()->mount_path)->toBe('/updated');
+    });
+
+    test('returns 422 when neither uuid nor id is provided', function () {
+        $app = createTestApplication($this);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->patchJson("/api/v1/applications/{$app->uuid}/storages", [
+            'type' => 'persistent',
+            'mount_path' => '/data',
+        ]);
+
+        $response->assertStatus(422);
+    });
+});
+
+describe('DELETE /api/v1/applications/{uuid}/storages/{storage_uuid}', function () {
+    test('deletes a persistent storage', function () {
+        $app = createTestApplication($this);
+
+        $vol = LocalPersistentVolume::create([
+            'name' => $app->uuid.'-test-vol',
+            'mount_path' => '/data',
+            'resource_id' => $app->id,
+            'resource_type' => $app->getMorphClass(),
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->deleteJson("/api/v1/applications/{$app->uuid}/storages/{$vol->uuid}");
+
+        $response->assertStatus(200);
+        $response->assertJson(['message' => 'Storage deleted.']);
+        expect(LocalPersistentVolume::find($vol->id))->toBeNull();
+    });
+
+    test('finds file storage without type param and calls deleteStorageOnServer', function () {
+        $app = createTestApplication($this);
+
+        $vol = LocalFileVolume::create([
+            'fs_path' => '/tmp/test',
+            'mount_path' => '/app/config.json',
+            'content' => '{}',
+            'is_directory' => false,
+            'resource_id' => $app->id,
+            'resource_type' => get_class($app),
+        ]);
+
+        // Verify the storage is found via fileStorages (not persistentStorages)
+        $freshApp = Application::find($app->id);
+        expect($freshApp->persistentStorages->where('uuid', $vol->uuid)->first())->toBeNull();
+        expect($freshApp->fileStorages->where('uuid', $vol->uuid)->first())->not->toBeNull();
+        expect($vol)->toBeInstanceOf(LocalFileVolume::class);
+    });
+
+    test('returns 404 for non-existent storage', function () {
+        $app = createTestApplication($this);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->deleteJson("/api/v1/applications/{$app->uuid}/storages/non-existent");
+
+        $response->assertStatus(404);
+    });
+});
+
+// ──────────────────────────────────────────────────────────────
+// Database Storage Endpoints
+// ──────────────────────────────────────────────────────────────
+
+describe('GET /api/v1/databases/{uuid}/storages', function () {
+    test('lists storages for a database', function () {
+        $db = createTestDatabase($this);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->getJson("/api/v1/databases/{$db->uuid}/storages");
+
+        $response->assertStatus(200);
+        $response->assertJsonStructure(['persistent_storages', 'file_storages']);
+        // Database auto-creates a default persistent volume
+        $response->assertJsonCount(1, 'persistent_storages');
+    });
+
+    test('returns 404 for non-existent database', function () {
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->getJson('/api/v1/databases/non-existent-uuid/storages');
+
+        $response->assertStatus(404);
+    });
+});
+
+describe('POST /api/v1/databases/{uuid}/storages', function () {
+    test('creates a persistent storage for a database', function () {
+        $db = createTestDatabase($this);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->postJson("/api/v1/databases/{$db->uuid}/storages", [
+            'type' => 'persistent',
+            'name' => 'extra-data',
+            'mount_path' => '/extra',
+        ]);
+
+        $response->assertStatus(201);
+
+        $vol = LocalPersistentVolume::where('name', $db->uuid.'-extra-data')->first();
+        expect($vol)->not->toBeNull();
+        expect($vol->mount_path)->toBe('/extra');
+    });
+});
+
+describe('PATCH /api/v1/databases/{uuid}/storages', function () {
+    test('updates a persistent storage by uuid', function () {
+        $db = createTestDatabase($this);
+
+        $vol = LocalPersistentVolume::create([
+            'name' => $db->uuid.'-test-vol',
+            'mount_path' => '/data',
+            'resource_id' => $db->id,
+            'resource_type' => $db->getMorphClass(),
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+            'Content-Type' => 'application/json',
+        ])->patchJson("/api/v1/databases/{$db->uuid}/storages", [
+            'uuid' => $vol->uuid,
+            'type' => 'persistent',
+            'mount_path' => '/updated',
+        ]);
+
+        $response->assertStatus(200);
+        expect($vol->fresh()->mount_path)->toBe('/updated');
+    });
+});
+
+describe('DELETE /api/v1/databases/{uuid}/storages/{storage_uuid}', function () {
+    test('deletes a persistent storage', function () {
+        $db = createTestDatabase($this);
+
+        $vol = LocalPersistentVolume::create([
+            'name' => $db->uuid.'-test-vol',
+            'mount_path' => '/extra',
+            'resource_id' => $db->id,
+            'resource_type' => $db->getMorphClass(),
+        ]);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$this->bearerToken,
+        ])->deleteJson("/api/v1/databases/{$db->uuid}/storages/{$vol->uuid}");
+
+        $response->assertStatus(200);
+        expect(LocalPersistentVolume::find($vol->id))->toBeNull();
+    });
+});

tests/Feature/Subscription/StripeProcessJobTest.php

@@ -50,6 +50,93 @@
         // Critical: stripe_invoice_paid must remain false — payment not yet confirmed
         expect($subscription->stripe_invoice_paid)->toBeFalsy();
     });
+
+    test('created event updates existing subscription instead of duplicating', function () {
+        Queue::fake();
+
+        Subscription::create([
+            'team_id' => $this->team->id,
+            'stripe_subscription_id' => 'sub_old',
+            'stripe_customer_id' => 'cus_old',
+            'stripe_invoice_paid' => true,
+        ]);
+
+        $event = [
+            'type' => 'customer.subscription.created',
+            'data' => [
+                'object' => [
+                    'customer' => 'cus_new_123',
+                    'id' => 'sub_new_123',
+                    'metadata' => [
+                        'team_id' => $this->team->id,
+                        'user_id' => $this->user->id,
+                    ],
+                ],
+            ],
+        ];
+
+        $job = new StripeProcessJob($event);
+        $job->handle();
+
+        expect(Subscription::where('team_id', $this->team->id)->count())->toBe(1);
+        $subscription = Subscription::where('team_id', $this->team->id)->first();
+        expect($subscription->stripe_subscription_id)->toBe('sub_new_123');
+        expect($subscription->stripe_customer_id)->toBe('cus_new_123');
+    });
+});
+
+describe('checkout.session.completed', function () {
+    test('creates subscription for new team', function () {
+        Queue::fake();
+
+        $event = [
+            'type' => 'checkout.session.completed',
+            'data' => [
+                'object' => [
+                    'client_reference_id' => $this->user->id.':'.$this->team->id,
+                    'subscription' => 'sub_checkout_123',
+                    'customer' => 'cus_checkout_123',
+                ],
+            ],
+        ];
+
+        $job = new StripeProcessJob($event);
+        $job->handle();
+
+        $subscription = Subscription::where('team_id', $this->team->id)->first();
+        expect($subscription)->not->toBeNull();
+        expect($subscription->stripe_invoice_paid)->toBeTruthy();
+    });
+
+    test('updates existing subscription instead of duplicating', function () {
+        Queue::fake();
+
+        Subscription::create([
+            'team_id' => $this->team->id,
+            'stripe_subscription_id' => 'sub_old',
+            'stripe_customer_id' => 'cus_old',
+            'stripe_invoice_paid' => false,
+        ]);
+
+        $event = [
+            'type' => 'checkout.session.completed',
+            'data' => [
+                'object' => [
+                    'client_reference_id' => $this->user->id.':'.$this->team->id,
+                    'subscription' => 'sub_checkout_new',
+                    'customer' => 'cus_checkout_new',
+                ],
+            ],
+        ];
+
+        $job = new StripeProcessJob($event);
+        $job->handle();
+
+        expect(Subscription::where('team_id', $this->team->id)->count())->toBe(1);
+        $subscription = Subscription::where('team_id', $this->team->id)->first();
+        expect($subscription->stripe_subscription_id)->toBe('sub_checkout_new');
+        expect($subscription->stripe_invoice_paid)->toBeTruthy();
+    });
 });
 
 describe('customer.subscription.updated clamps quantity to MAX_SERVER_LIMIT', function () {

tests/Feature/TeamServerLimitTest.php

@@ -0,0 +1,53 @@
+<?php
+
+use App\Models\Server;
+use App\Models\Team;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    config()->set('constants.coolify.self_hosted', true);
+});
+
+it('returns server limit when team is passed directly without session', function () {
+    $team = Team::factory()->create();
+
+    $limit = Team::serverLimit($team);
+
+    // self_hosted returns 999999999999
+    expect($limit)->toBe(999999999999);
+});
+
+it('returns 0 when no team is provided and no session exists', function () {
+    $limit = Team::serverLimit();
+
+    expect($limit)->toBe(0);
+});
+
+it('returns true for serverLimitReached when no team and no session', function () {
+    $result = Team::serverLimitReached();
+
+    expect($result)->toBeTrue();
+});
+
+it('returns false for serverLimitReached when team has servers under limit', function () {
+    $team = Team::factory()->create();
+    Server::factory()->create(['team_id' => $team->id]);
+
+    $result = Team::serverLimitReached($team);
+
+    // self_hosted has very high limit, 1 server is well under
+    expect($result)->toBeFalse();
+});
+
+it('returns true for serverLimitReached when team has servers at limit', function () {
+    config()->set('constants.coolify.self_hosted', false);
+
+    $team = Team::factory()->create(['custom_server_limit' => 1]);
+    Server::factory()->create(['team_id' => $team->id]);
+
+    $result = Team::serverLimitReached($team);
+
+    expect($result)->toBeTrue();
+});

tests/Unit/ApplicationDeploymentNixpacksNullEnvTest.php

@@ -88,11 +88,11 @@
     $envArgsProperty->setAccessible(true);
     $envArgs = $envArgsProperty->getValue($job);
 
-    // Verify that only valid environment variables are included
-    expect($envArgs)->toContain('--env VALID_VAR=valid_value');
-    expect($envArgs)->toContain('--env ANOTHER_VALID_VAR=another_value');
-    expect($envArgs)->toContain('--env COOLIFY_FQDN=example.com');
-    expect($envArgs)->toContain('--env SOURCE_COMMIT=abc123');
+    // Verify that only valid environment variables are included (values are now single-quote escaped)
+    expect($envArgs)->toContain("--env 'VALID_VAR=valid_value'");
+    expect($envArgs)->toContain("--env 'ANOTHER_VALID_VAR=another_value'");
+    expect($envArgs)->toContain("--env 'COOLIFY_FQDN=example.com'");
+    expect($envArgs)->toContain("--env 'SOURCE_COMMIT=abc123'");
 
     // Verify that null and empty environment variables are filtered out
     expect($envArgs)->not->toContain('NULL_VAR');
@@ -102,7 +102,7 @@
 
     // Verify no environment variables end with just '=' (which indicates null/empty value)
     expect($envArgs)->not->toMatch('/--env [A-Z_]+=$/');
-    expect($envArgs)->not->toMatch('/--env [A-Z_]+= /');
+    expect($envArgs)->not->toMatch("/--env '[A-Z_]+='$/");
 });
 
 it('filters out null environment variables from nixpacks preview deployments', function () {
@@ -164,9 +164,9 @@
     $envArgsProperty->setAccessible(true);
     $envArgs = $envArgsProperty->getValue($job);
 
-    // Verify that only valid environment variables are included
-    expect($envArgs)->toContain('--env PREVIEW_VAR=preview_value');
-    expect($envArgs)->toContain('--env COOLIFY_FQDN=preview.example.com');
+    // Verify that only valid environment variables are included (values are now single-quote escaped)
+    expect($envArgs)->toContain("--env 'PREVIEW_VAR=preview_value'");
+    expect($envArgs)->toContain("--env 'COOLIFY_FQDN=preview.example.com'");
 
     // Verify that null environment variables are filtered out
     expect($envArgs)->not->toContain('NULL_PREVIEW_VAR');
@@ -335,7 +335,7 @@
     $envArgsProperty->setAccessible(true);
     $envArgs = $envArgsProperty->getValue($job);
 
-    // Verify that zero and false string values are preserved
-    expect($envArgs)->toContain('--env ZERO_VALUE=0');
-    expect($envArgs)->toContain('--env FALSE_VALUE=false');
+    // Verify that zero and false string values are preserved (values are now single-quote escaped)
+    expect($envArgs)->toContain("--env 'ZERO_VALUE=0'");
+    expect($envArgs)->toContain("--env 'FALSE_VALUE=false'");
 });

tests/Unit/EscapeShellValueTest.php

@@ -0,0 +1,57 @@
+<?php
+
+it('wraps a simple value in single quotes', function () {
+    expect(escapeShellValue('hello'))->toBe("'hello'");
+});
+
+it('escapes single quotes in the value', function () {
+    expect(escapeShellValue("it's"))->toBe("'it'\\''s'");
+});
+
+it('handles empty string', function () {
+    expect(escapeShellValue(''))->toBe("''");
+});
+
+it('preserves && in a single-quoted value', function () {
+    $result = escapeShellValue('npx prisma generate && npm run build');
+    expect($result)->toBe("'npx prisma generate && npm run build'");
+});
+
+it('preserves special shell characters in value', function () {
+    $result = escapeShellValue('echo $HOME; rm -rf /');
+    expect($result)->toBe("'echo \$HOME; rm -rf /'");
+});
+
+it('handles value with double quotes', function () {
+    $result = escapeShellValue('say "hello"');
+    expect($result)->toBe("'say \"hello\"'");
+});
+
+it('produces correct output when passed through executeInDocker', function () {
+    // Simulate the exact issue from GitHub #9042:
+    // NIXPACKS_BUILD_CMD with chained && commands
+    $envValue = 'npx prisma generate && npx prisma db push && npm run build';
+    $escapedEnv = '--env '.escapeShellValue("NIXPACKS_BUILD_CMD={$envValue}");
+
+    $command = "nixpacks plan -f json {$escapedEnv} /app";
+    $dockerCmd = executeInDocker('test-container', $command);
+
+    // The && must NOT appear unquoted at the bash -c level
+    // The full docker command should properly nest the quoting
+    expect($dockerCmd)->toContain('NIXPACKS_BUILD_CMD=npx prisma generate && npx prisma db push && npm run build');
+    // Verify it's wrapped in docker exec bash -c
+    expect($dockerCmd)->toStartWith("docker exec test-container bash -c '");
+    expect($dockerCmd)->toEndWith("'");
+});
+
+it('produces correct output for build-cmd with chained commands through executeInDocker', function () {
+    $buildCmd = 'npx prisma generate && npm run build';
+    $escapedCmd = escapeShellValue($buildCmd);
+
+    $command = "nixpacks plan -f json --build-cmd {$escapedCmd} /app";
+    $dockerCmd = executeInDocker('test-container', $command);
+
+    // The build command value must remain intact inside the quoting
+    expect($dockerCmd)->toContain('npx prisma generate && npm run build');
+    expect($dockerCmd)->toStartWith("docker exec test-container bash -c '");
+});

tests/Unit/ProxyConfigRecoveryTest.php

@@ -10,20 +10,26 @@
     Cache::spy();
 });
 
-function mockServerWithDbConfig(?string $savedConfig): object
+function mockServerWithDbConfig(?string $savedConfig, string $proxyType = 'TRAEFIK'): object
 {
     $proxyAttributes = Mockery::mock(SchemalessAttributes::class);
     $proxyAttributes->shouldReceive('get')
         ->with('last_saved_proxy_configuration')
         ->andReturn($savedConfig);
 
+    $proxyPath = match ($proxyType) {
+        'CADDY' => '/data/coolify/proxy/caddy',
+        'NGINX' => '/data/coolify/proxy/nginx',
+        default => '/data/coolify/proxy/',
+    };
+
     $server = Mockery::mock('App\Models\Server');
     $server->shouldIgnoreMissing();
     $server->shouldReceive('getAttribute')->with('proxy')->andReturn($proxyAttributes);
     $server->shouldReceive('getAttribute')->with('id')->andReturn(1);
     $server->shouldReceive('getAttribute')->with('name')->andReturn('Test Server');
-    $server->shouldReceive('proxyType')->andReturn('TRAEFIK');
-    $server->shouldReceive('proxyPath')->andReturn('/data/coolify/proxy');
+    $server->shouldReceive('proxyType')->andReturn($proxyType);
+    $server->shouldReceive('proxyPath')->andReturn($proxyPath);
 
     return $server;
 }
@@ -107,3 +113,61 @@ function mockServerWithDbConfig(?string $savedConfig): object
 
     expect($result)->toBe($savedConfig);
 });
+
+it('rejects stored Traefik config when proxy type is CADDY', function () {
+    Log::swap(new \Illuminate\Log\LogManager(app()));
+    Log::spy();
+
+    $traefikConfig = "services:\n  traefik:\n    image: traefik:v3.6\n";
+    $server = mockServerWithDbConfig($traefikConfig, 'CADDY');
+
+    // Config type mismatch should trigger regeneration, which will try
+    // backfillFromDisk (instant_remote_process) then generateDefault.
+    // Both will fail in test env, but the warning log proves mismatch was detected.
+    try {
+        GetProxyConfiguration::run($server);
+    } catch (\Throwable $e) {
+        // Expected — regeneration requires SSH/full server setup
+    }
+
+    Log::shouldHaveReceived('warning')
+        ->withArgs(fn ($message) => str_contains($message, 'does not match current proxy type'))
+        ->once();
+});
+
+it('rejects stored Caddy config when proxy type is TRAEFIK', function () {
+    Log::swap(new \Illuminate\Log\LogManager(app()));
+    Log::spy();
+
+    $caddyConfig = "services:\n  caddy:\n    image: lucaslorentz/caddy-docker-proxy:2.8-alpine\n";
+    $server = mockServerWithDbConfig($caddyConfig, 'TRAEFIK');
+
+    try {
+        GetProxyConfiguration::run($server);
+    } catch (\Throwable $e) {
+        // Expected — regeneration requires SSH/full server setup
+    }
+
+    Log::shouldHaveReceived('warning')
+        ->withArgs(fn ($message) => str_contains($message, 'does not match current proxy type'))
+        ->once();
+});
+
+it('accepts stored Caddy config when proxy type is CADDY', function () {
+    $caddyConfig = "services:\n  caddy:\n    image: lucaslorentz/caddy-docker-proxy:2.8-alpine\n";
+    $server = mockServerWithDbConfig($caddyConfig, 'CADDY');
+
+    $result = GetProxyConfiguration::run($server);
+
+    expect($result)->toBe($caddyConfig);
+});
+
+it('accepts stored config when YAML parsing fails', function () {
+    $invalidYaml = "this: is: not: [valid yaml: {{{}}}";
+    $server = mockServerWithDbConfig($invalidYaml, 'TRAEFIK');
+
+    // Invalid YAML should not block — configMatchesProxyType returns true on parse failure
+    $result = GetProxyConfiguration::run($server);
+
+    expect($result)->toBe($invalidYaml);
+});

tests/Unit/ServiceParserEnvVarPreservationTest.php

@@ -4,7 +4,7 @@
  * Unit tests to verify that Docker Compose environment variables
  * do not overwrite user-saved values on redeploy.
  *
- * Regression test for GitHub issue #8885.
+ * Regression test for GitHub issues #8885 and #9136.
  */
 it('uses firstOrCreate for simple variable references in serviceParser to preserve user values', function () {
     $parsersFile = file_get_contents(__DIR__.'/../../bootstrap/helpers/parsers.php');
@@ -14,8 +14,8 @@
     // This is the key === parsedValue branch
     expect($parsersFile)->toContain(
         "// Simple variable reference (e.g. DATABASE_URL: \${DATABASE_URL})\n".
-        "                // Use firstOrCreate to avoid overwriting user-saved values on redeploy\n".
-        '                $envVar = $resource->environment_variables()->firstOrCreate('
+        "                // Ensure the variable exists in DB for .env generation and UI display\n".
+        '                $resource->environment_variables()->firstOrCreate('
     );
 });
 
@@ -46,15 +46,15 @@
     expect($count)->toBe(1, 'serviceParser should use firstOrCreate for simple variable refs without default');
 });
 
-it('populates environment array with saved DB value instead of raw compose variable', function () {
+it('does not replace self-referencing variable values in the environment array', function () {
     $parsersFile = file_get_contents(__DIR__.'/../../bootstrap/helpers/parsers.php');
 
-    // After firstOrCreate, the environment should be populated with the DB value ($envVar->value)
-    // not the raw compose variable reference (e.g., ${DATABASE_URL})
-    // This pattern should appear in both parsers for all variable reference types
-    expect($parsersFile)->toContain('// Add the variable to the environment using the saved DB value');
-    expect($parsersFile)->toContain('$environment[$key->value()] = $envVar->value;');
-    expect($parsersFile)->toContain('$environment[$content] = $envVar->value;');
+    // Fix for #9136: self-referencing variables (KEY=${KEY}) must NOT have their ${VAR}
+    // reference replaced with the DB value in the compose environment section.
+    // Instead, the reference should stay intact so Docker Compose resolves from .env at deploy time.
+    // This prevents stale values when users update env vars without re-parsing compose.
+    expect($parsersFile)->toContain('Keep the ${VAR} reference in compose');
+    expect($parsersFile)->not->toContain('$environment[$key->value()] = $envVar->value;');
 });
 
 it('does not use updateOrCreate with value null for user-editable environment variables', function () {

tests/Unit/ValidHostnameTest.php

@@ -21,6 +21,8 @@
     'subdomain' => 'web.app.example.com',
     'max label length' => str_repeat('a', 63),
     'max total length' => str_repeat('a', 63).'.'.str_repeat('b', 63).'.'.str_repeat('c', 63).'.'.str_repeat('d', 59),
+    'uppercase hostname' => 'MyServer',
+    'mixed case fqdn' => 'MyServer.Example.COM',
 ]);
 
 it('rejects invalid RFC 1123 hostnames', function (string $hostname, string $expectedError) {
@@ -36,8 +38,7 @@
     expect($failCalled)->toBeTrue();
     expect($errorMessage)->toContain($expectedError);
 })->with([
-    'uppercase letters' => ['MyServer', 'lowercase letters (a-z), numbers (0-9), hyphens (-), and dots (.)'],
-    'underscore' => ['my_server', 'lowercase letters (a-z), numbers (0-9), hyphens (-), and dots (.)'],
+    'underscore' => ['my_server', 'letters (a-z, A-Z), numbers (0-9), hyphens (-), and dots (.)'],
     'starts with hyphen' => ['-myserver', 'cannot start or end with a hyphen'],
     'ends with hyphen' => ['myserver-', 'cannot start or end with a hyphen'],
     'starts with dot' => ['.myserver', 'cannot start or end with a dot'],
@@ -46,9 +47,9 @@
     'too long total' => [str_repeat('a', 254), 'must not exceed 253 characters'],
     'label too long' => [str_repeat('a', 64), 'must be 1-63 characters'],
     'empty label' => ['my..server', 'consecutive dots'],
-    'special characters' => ['my@server', 'lowercase letters (a-z), numbers (0-9), hyphens (-), and dots (.)'],
-    'space' => ['my server', 'lowercase letters (a-z), numbers (0-9), hyphens (-), and dots (.)'],
-    'shell metacharacters' => ['my;server', 'lowercase letters (a-z), numbers (0-9), hyphens (-), and dots (.)'],
+    'special characters' => ['my@server', 'letters (a-z, A-Z), numbers (0-9), hyphens (-), and dots (.)'],
+    'space' => ['my server', 'letters (a-z, A-Z), numbers (0-9), hyphens (-), and dots (.)'],
+    'shell metacharacters' => ['my;server', 'letters (a-z, A-Z), numbers (0-9), hyphens (-), and dots (.)'],
 ]);
 
 it('accepts empty hostname', function () {

tests/Unit/ValidationPatternsTest.php

@@ -0,0 +1,82 @@
+<?php
+
+use App\Support\ValidationPatterns;
+
+it('accepts valid names with common characters', function (string $name) {
+    expect(preg_match(ValidationPatterns::NAME_PATTERN, $name))->toBe(1);
+})->with([
+    'simple name' => 'My Server',
+    'name with hyphen' => 'my-server',
+    'name with underscore' => 'my_server',
+    'name with dot' => 'my.server',
+    'name with slash' => 'my/server',
+    'name with at sign' => 'user@host',
+    'name with ampersand' => 'Tom & Jerry',
+    'name with parentheses' => 'My Server (Production)',
+    'name with hash' => 'Server #1',
+    'name with comma' => 'Server, v2',
+    'name with colon' => 'Server: Production',
+    'name with plus' => 'C++ App',
+    'unicode name' => 'Ünïcödé Sërvér',
+    'unicode chinese' => '我的服务器',
+    'numeric name' => '12345',
+    'complex name' => 'App #3 (staging): v2.1+hotfix',
+]);
+
+it('rejects names with dangerous characters', function (string $name) {
+    expect(preg_match(ValidationPatterns::NAME_PATTERN, $name))->toBe(0);
+})->with([
+    'semicolon' => 'my;server',
+    'pipe' => 'my|server',
+    'dollar sign' => 'my$server',
+    'backtick' => 'my`server',
+    'backslash' => 'my\\server',
+    'less than' => 'my<server',
+    'greater than' => 'my>server',
+    'curly braces' => 'my{server}',
+    'square brackets' => 'my[server]',
+    'tilde' => 'my~server',
+    'caret' => 'my^server',
+    'question mark' => 'my?server',
+    'percent' => 'my%server',
+    'double quote' => 'my"server',
+    'exclamation' => 'my!server',
+    'asterisk' => 'my*server',
+]);
+
+it('generates nameRules with correct defaults', function () {
+    $rules = ValidationPatterns::nameRules();
+
+    expect($rules)->toContain('required')
+        ->toContain('string')
+        ->toContain('min:3')
+        ->toContain('max:255')
+        ->toContain('regex:'.ValidationPatterns::NAME_PATTERN);
+});
+
+it('generates nullable nameRules when not required', function () {
+    $rules = ValidationPatterns::nameRules(required: false);
+
+    expect($rules)->toContain('nullable')
+        ->not->toContain('required');
+});
+
+it('generates application names that comply with NAME_PATTERN', function (string $repo, string $branch) {
+    $name = generate_application_name($repo, $branch, 'testcuid');
+
+    expect(preg_match(ValidationPatterns::NAME_PATTERN, $name))->toBe(1);
+})->with([
+    'normal repo' => ['owner/my-app', 'main'],
+    'repo with dots' => ['repo.with.dots', 'feat/branch'],
+    'repo with plus' => ['C++ App', 'main'],
+    'branch with parens' => ['my-app', 'fix(auth)-login'],
+    'repo with exclamation' => ['my-app!', 'main'],
+    'repo with brackets' => ['app[test]', 'develop'],
+]);
+
+it('falls back to random name when repo produces empty name', function () {
+    $name = generate_application_name('!!!', 'main', 'testcuid');
+
+    expect(mb_strlen($name))->toBeGreaterThanOrEqual(3)
+        ->and(preg_match(ValidationPatterns::NAME_PATTERN, $name))->toBe(1);
+});

versions.json

@@ -1,7 +1,7 @@
 {
     "coolify": {
         "v4": {
-            "version": "4.0.0-beta.469"
+            "version": "4.0.0-beta.470"
         },
         "nightly": {
             "version": "4.0.0"
@@ -13,17 +13,17 @@
             "version": "1.0.11"
         },
         "sentinel": {
-            "version": "0.0.19"
+            "version": "0.0.21"
         }
     },
     "traefik": {
-        "v3.6": "3.6.5",
+        "v3.6": "3.6.11",
         "v3.5": "3.5.6",
         "v3.4": "3.4.5",
         "v3.3": "3.3.7",
         "v3.2": "3.2.5",
         "v3.1": "3.1.7",
         "v3.0": "3.0.4",
-        "v2.11": "2.11.32"
+        "v2.11": "2.11.40"
     }
 }