caddy-docker-proxy reloads Caddy whenever any proxied container changes,
and Caddy closes every WebSocket on reload by default. Set
stream_close_delay on app, service, and dashboard reverse_proxy routes.
Closes#7942
A preview renames its services to <name>-pr-<id>, so services that call
each other by their Compose names failed to start. Add the original name as an alias on the preview network.
Closes#8030
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Docker Compose gives a recreated container the old mount at each path
that the image declares with VOLUME, also a volume deleted in Coolify.
Before `up`, remove only containers that still mount a Coolify volume
whose storage entry was deleted. The stale volume delete dialog now
warns when a container still uses the volume.
Closes#6875
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Each dump and S3 upload got the full backup timeout, so a long dump plus
an upload passed the worker timeout. The worker then killed the job
without cleanup: the execution stayed running, and the upload container
and the dump file stayed on the server.
- Give each step only the time that is left of the backup timeout, so a
run that takes too long fails inside the job and cleans up.
- Run the dump once. An SSH retry started a second dump into the same
file while the first could still run in the container.
- Explain exit code 124 and say in the timeout help that it covers the
complete run.
- Remove backup upload containers of executions that are not running
in the daily helper container cleanup.
Closes#8139
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The MinIO client rejects endpoints such as `/storage/v1/s3`. Transfers to
these endpoints now use curl with a presigned URL that Coolify signs, for
database backups, volume backups, and S3 restores.
Closes#8530
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Validate that the OAuth redirect URI path matches the auth.callback
route for the provider. Any other path falls through to the catch-all
route and silently sends the user back to the login page, so reject it
with a clear validation error instead.
- Add SettingsOauth tests that reject redirect URIs off the provider
callback route and accept the callback route with or without a
trailing slash
- Add a compose preview test checking that every domain of a
multi-domain service gets a PR-prefixed domain and its own Traefik
Host rule
- Add a clone test checking that cloning a service to another server
keeps its generated database credentials and copies its volumes
- Refresh template_last_updated_at timestamps in the service templates
Team notifications sent through the instance email settings, the S3
connection error alert, and the channel disabled alert now use the
optional notification from address and name. Account mails keep the
default sender. Remove the unused emails command and its views.
Each new SSH connection opens a systemd-logind session. Some systemd
versions leak closed sessions until the host refuses logins at 8192.
The connection check now opens one new login (the probe), not three.
Closes#9148
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Docker frees the name of a stopped --rm container in the background, so
the second helper docker run for build secrets could fail with a name
conflict. Remove the old helper with docker rm -f before the run.
Closes#9363
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A build-time HOME or DOCKER_CONFIG variable moved the Docker CLI in the
helper away from /root/.docker/cli-plugins, so BuildKit builds failed with
"buildx component is missing or broken". Force DOCKER_CONFIG=/root/.docker
for the build command and for the helper when build secrets are passed.
Closes#9726
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A preview deployment set COOLIFY_BRANCH in three places with three
values: the Compose shell variables used the application branch
(main), the Compose parser used pull/<id>/head, and other build packs
used the fetched refspec (pull/<id>/head:pr-<id>-coolify) or the
application branch. A variable that refers to ${COOLIFY_BRANCH} then
got a different value than the container. All paths now use
Application::coolifyBranch(), which gives pull/<id>/head for previews
and git_branch for production deployments.
Closes#9572
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Rybbit template had a proxy route only for the client, so the
/api requests of the browser got a 404 from the client and sign-up
and login failed. The backend now declares SERVICE_URL_RYBBIT_3001=/api
on the same host and keeps the /api prefix. The backend is listed
before the client, so SERVICE_URL_RYBBIT (used in BASE_URL) stays the
root URL.
Closes#9055
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Status checks now queue a delayed check for each application, preview,
service part, or database that goes from up to exited. After 2 minutes
it sends the "Resource status changes" notification if the resource is
still stopped, no deployment runs, and Coolify did not stop it. Each
resource sends at most one notification in 15 minutes.
Closes#9493
Retry GET requests of githubApi() up to three times when GitHub answers
with a 5xx error or the connection fails. One 502 or one timeout on the
repository lookup before a deployment failed the deployment. Writes are
not retried, so a pull request comment is not posted two times. The
installation token request uses the same retry rule.
Closes#9785
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Stop calling /zen before each installation token request. A short
network problem to GitHub failed deployments with a cURL timeout on
/zen. assertGithubClockInSync now takes the failed response and reads
its Date header, so the "System time is out of sync" error still shows
when GitHub rejects the JWT.
Call it on failed JWT requests in the webhook installation check, the
permission job, the source connection test, and the server transfer
checklist. Remove the /zen fakes from the tests.
S3 storages with a self-signed or private CA certificate failed with
"cURL error 60", because the Coolify container and the backup helper do
not use the CA certificates of the host. The new opt-in setting turns off
the certificate check in the PHP S3 clients and sets MC_INSECURE for mc.
Closes#9762
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
New Outline versions run CREATE OR REPLACE TRIGGER in a migration,
which needs PostgreSQL 14 or later. On postgres:12-alpine the migration
failed and the Outline container restarted in a loop.
Closes#12345
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
AppFlowy Web runs on its own domain and sends a Redirect_to header to
/gotrue/magiclink on the admin domain. GoTrue does not allow that
header by default, so the CORS preflight failed and email sign-in
showed "Network error". Set GOTRUE_CORS_ALLOWED_HEADERS=redirect_to.
Closes#10545
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The template used mysql:latest with binary logging on and no limit,
so the binary logs filled the disk and Bugsink stopped. Use
postgres:17-alpine and bugsink/bugsink:2, as the Bugsink Docker
Compose sample does. Existing services keep MySQL; the changelog
tells how to purge the logs and turn binary logging off.
Closes#10626
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Deleting a server with "Delete all resources" (UI) or ?force=true (API)
deleted every application that used the server, also applications that
use it only as an additional destination, for example after Promote.
Server delete now deletes only resources whose main destination is on
the server. Applications that use it only as an additional destination
lose their additional_destinations row for the server, and their
containers on it are stopped (best effort). The check for resources and
the transfer archive path use the same Server::primaryResources().
The delete confirmation lists the resources to delete and the
applications that keep running on another server.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Use usesend/usesend:v1.10.0 instead of latest, so servers do not keep
an old cached image without the v1.10.0 security updates. The template
never used MinIO, so the RustFS change of v1.10.0 does not apply.
Closes#12443
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The stuck resources cleanup selected every column of every deployment,
including logs, and ran out of memory during app:init. Select only the
id and application_id. Also drop the unused executions property on the
backup pages and an unused execution loader.
Closes#12435
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The MCP deploy tool and control start skipped the deployment queue, so
two rolling updates of one application could run at once and remove the
new container of each other. A rolling update now also removes only the
containers that ran before it started.
Closes#12442
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Traefik renews every certificate in acme.json, also when no route uses
its domain. The TLS certificates page now marks certificates that no
Traefik label, proxy config file, or resource domain on the server uses,
and a "Delete unused" button removes them in one write with one backup.
Closes#12447
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Use the only reported disk when no known root mount is reported, and stop
filtering disk history by mount names so Sentinel 1.1.4+ keeps that disk.
Closes#12448
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
