coolify/app/Actions/Server/UpdateCoolify.php

<?php

namespace App\Actions\Server;

use App\Models\Server;
use Illuminate\Support\Facades\Http;
use Illuminate\Support\Facades\Log;
use Illuminate\Support\Sleep;
use Lorisleiva\Actions\Concerns\AsAction;

class UpdateCoolify
{
    use AsAction;

    public ?Server $server = null;

    public ?string $latestVersion = null;

    public ?string $currentVersion = null;

    public function handle($manual_update = false)
    {
        if (isDev()) {
            Sleep::for(10)->seconds();

            return;
        }
        $settings = instanceSettings();
        $this->server = Server::find(0);
        if (! $this->server) {
            return;
        }

        // Fetch fresh version from CDN instead of using cache
        try {
            $response = Http::retry(3, 1000)->timeout(10)
                ->get(config('constants.coolify.versions_url'));

            if ($response->successful()) {
                $versions = $response->json();
                $this->latestVersion = data_get($versions, 'coolify.v4.version');
            } else {
                // Fallback to cache if CDN unavailable
                $cacheVersion = get_latest_version_of_coolify();

                // Validate cache version against current running version
                if ($cacheVersion && version_compare($cacheVersion, config('constants.coolify.version'), '<')) {
                    Log::error('Failed to fetch fresh version from CDN and cache is corrupted/outdated', [
                        'cached_version' => $cacheVersion,
                        'current_version' => config('constants.coolify.version'),
                    ]);
                    throw new \Exception(
                        'Cannot determine latest version: CDN unavailable and cache version '.
                        "({$cacheVersion}) is older than running version (".config('constants.coolify.version').')'
                    );
                }

                $this->latestVersion = $cacheVersion;
                Log::warning('Failed to fetch fresh version from CDN (unsuccessful response), using validated cache', [
                    'version' => $cacheVersion,
                ]);
            }
        } catch (\Throwable $e) {
            $cacheVersion = get_latest_version_of_coolify();

            // Validate cache version against current running version
            if ($cacheVersion && version_compare($cacheVersion, config('constants.coolify.version'), '<')) {
                Log::error('Failed to fetch fresh version from CDN and cache is corrupted/outdated', [
                    'error' => $e->getMessage(),
                    'cached_version' => $cacheVersion,
                    'current_version' => config('constants.coolify.version'),
                ]);
                throw new \Exception(
                    'Cannot determine latest version: CDN unavailable and cache version '.
                    "({$cacheVersion}) is older than running version (".config('constants.coolify.version').')'
                );
            }

            $this->latestVersion = $cacheVersion;
            Log::warning('Failed to fetch fresh version from CDN, using validated cache', [
                'error' => $e->getMessage(),
                'version' => $cacheVersion,
            ]);
        }

        $this->currentVersion = config('constants.coolify.version');
        if (! $manual_update) {
            if (! $settings->is_auto_update_enabled) {
                return;
            }
            if ($this->latestVersion === $this->currentVersion) {
                return;
            }
            if (version_compare($this->latestVersion, $this->currentVersion, '<')) {
                return;
            }
        }

        // ALWAYS check for downgrades (even for manual updates)
        if (version_compare($this->latestVersion, $this->currentVersion, '<')) {
            Log::error('Downgrade prevented', [
                'target_version' => $this->latestVersion,
                'current_version' => $this->currentVersion,
                'manual_update' => $manual_update,
            ]);
            throw new \Exception(
                "Cannot downgrade from {$this->currentVersion} to {$this->latestVersion}. ".
                'If you need to downgrade, please do so manually via Docker commands.'
            );
        }

        $this->update();
        $settings->new_version_available = false;
        $settings->save();
    }

    private function update()
    {
        $latestHelperImageVersion = getHelperVersion();
        $upgradeScriptUrl = config('constants.coolify.upgrade_script_url');
        // MapleDeploy branding: always use the fork registry default, ignoring per-instance overrides
        $registryUrl = config('constants.coolify.registry_url');

        // MapleDeploy: artifact verification (H5, cdn-artifact-signing).
        // upgrade.sh is fetched into a temp dir and executed only after its
        // sha256 matches the Ed25519-signed manifest published beside it.
        // upgrade.sh then verifies its own downloads the same way. The
        // pinned public key must match scripts/artifact-signing-pubkey.pem
        // (CI asserts this). A verification failure aborts before anything
        // is written to /data/coolify/source.
        // NOTE: this path assumes Server 0 is root (MapleDeploy provisions it
        // that way). remote_process's non-root sudo parser rewrites per array
        // ELEMENT, which would mangle this multi-line script; if the fork ever
        // supports non-root instance servers, this must be revisited.
        $cdnBase = dirname($upgradeScriptUrl);
        $manifestUrl = escapeshellarg($cdnBase.'/artifacts.manifest');
        $manifestSigUrl = escapeshellarg($cdnBase.'/artifacts.manifest.sig');
        $upgradeUrl = escapeshellarg($upgradeScriptUrl);
        $upgradeArgs = escapeshellarg($this->latestVersion).' '.
            escapeshellarg($latestHelperImageVersion).' '.
            escapeshellarg($registryUrl);

        // upgrade.sh is executed from the root-owned staging dir, not from
        // /data/coolify/source (bind-mounted into the container, so uid 9999
        // could swap the file between verify and execute); the copy installed
        // there is for the emergency SSH fallback and the next run's serial
        // state only.
        $script = <<<BASH
        set -euo pipefail
        STAGING=\$(mktemp -d)
        trap 'rm -rf "\$STAGING"' EXIT
        curl -fsSL {$manifestUrl} -o "\$STAGING/artifacts.manifest"
        curl -fsSL {$manifestSigUrl} -o "\$STAGING/artifacts.manifest.sig"
        curl -fsSL {$upgradeUrl} -o "\$STAGING/upgrade.sh"
        printf '%s\\n' '-----BEGIN PUBLIC KEY-----' 'MCowBQYDK2VwAyEAS2KmuRRjkdub0vjbO7wfmIdo60xYSvxx2hJ7oRYU+/k=' '-----END PUBLIC KEY-----' > "\$STAGING/pubkey.pem"
        openssl base64 -d -in "\$STAGING/artifacts.manifest.sig" -out "\$STAGING/sig.bin"
        openssl pkeyutl -verify -pubin -inkey "\$STAGING/pubkey.pem" -rawin -in "\$STAGING/artifacts.manifest" -sigfile "\$STAGING/sig.bin" >/dev/null
        head -1 "\$STAGING/artifacts.manifest" | grep -q '^mapledeploy-coolify-artifacts-v1\$'
        EXPECTED=\$(awk '\$2 == "upgrade.sh" { print \$1 }' "\$STAGING/artifacts.manifest")
        test -n "\$EXPECTED"
        ACTUAL=\$(sha256sum "\$STAGING/upgrade.sh" | cut -d' ' -f1)
        test "\$EXPECTED" = "\$ACTUAL"
        cp "\$STAGING/upgrade.sh" /data/coolify/source/upgrade.sh
        bash "\$STAGING/upgrade.sh" {$upgradeArgs}
        BASH;

        remote_process([$script], $this->server);
    }
}