Commit Graph
16370 Commits
Author SHA1 Message Date
Andras Bacsai 6ee75cfa65 fix(api): remove deprecated docker compose application endpoint
Drop the unstable applications/dockercompose route and controller path now that
service creation is handled by POST /api/v1/services. Add coverage to ensure the
deprecated endpoint stays unregistered while the services endpoint remains
available.
2026-05-11 13:20:05 +02:00
Andras Bacsai a37c39e6c1 Merge remote-tracking branch 'origin/next' into feat/railpack 2026-05-11 12:57:58 +02:00
Andras BacsaiandGitHub 95dcd09517 fix(docker): use HTTPS for nginx apk repository (#10026) 2026-05-11 12:57:48 +02:00
Andras Bacsai 14679e73b2 fix(docker): use HTTPS for nginx apk repository 2026-05-11 12:57:17 +02:00
Andras Bacsai 12aba41d9a fix(api): gate service server secrets by sensitive scope
Only eager load nested server settings for service responses when the API token has read:sensitive, preventing read-only tokens from exposing sentinel fields while preserving sensitive access.
2026-05-11 11:53:22 +02:00
Andras Bacsai c97f916052 fix(api): hide application compose PR fields
Add compose PR fields to the Application hidden attributes and allow database list queries to eager load nested server settings when sensitive access is permitted.
2026-05-11 11:46:05 +02:00
Andras Bacsai ffa494d391 Merge remote-tracking branch 'origin/next' into api-sensitive-data-scrubber 2026-05-11 11:36:24 +02:00
Andras Bacsai 9f380b8495 Merge remote-tracking branch 'origin/next' into feat/railpack 2026-05-11 10:58:13 +02:00
Andras BacsaiandGitHub 61b124b434 fix(magic env) HEX secrets creating double the length of their name (#9820) 2026-05-11 10:56:23 +02:00
ShadowArcanistandGitHub 39a30b60a9 chore(service): disable litequeen
Service not updated for 10 months and official website is available for sale (domain expired)
2026-05-11 10:42:01 +05:30
ShadowArcanist 7c5dc8bae1 fix(service): set correct SERVICE_HEX magic env for open archive ENCRYPTION_KEY and STORAGE_ENCRYPTION_KEY 2026-05-09 19:35:15 +05:30
ShadowArcanist 4453fec7cc fix(service): set correct SERVICE_HEX magic env for homarr SECRET_ENCRYPTION_KEY 2026-05-09 19:30:07 +05:30
ShadowArcanist 02373e1b3e fix(service): set correct SERVICE_HEX magic env for Convex INSTANCE_SECRET 2026-05-09 19:26:30 +05:30
ShadowArcanist 13077db1d8 fix(service): set correct SERVICE_HEX magic env for bluesky-pds JWTSECRET and ROTATIONKEY 2026-05-09 19:19:48 +05:30
ShadowArcanist 4ccb769e33 fix(service): set correct SERVICE_HEX magic env for Outline SECRET_KEY 2026-05-09 19:19:29 +05:30
Andras Bacsai c6ac52dc38 fix(env): generate encoded secrets from raw random bytes
Use random_bytes before hex and base64 encoding so generated env values
match the expected decoded byte lengths. Add Pest coverage for HEX and
REALBASE64 magic variables.
2026-05-09 14:49:39 +02:00
Romain ROCHASandGitHub 0065970521 Merge branch 'next' into update-homarr 2026-05-08 19:16:02 +07:00
michalzard 684e7c2388 fix: requested changes
fix: changes

fix: revert jsons

revert:jsons

fix: revert
2026-05-07 17:53:48 +02:00
michalzard 7540b3b9f8 fix: category 2026-05-07 17:21:21 +02:00
michalzard 1942be9320 feat: gitea runner template 2026-05-07 16:45:12 +02:00
Andras Bacsai 224b9e4397 Merge remote-tracking branch 'origin/next' into api-sensitive-data-scrubber 2026-05-07 16:36:58 +02:00
Andras Bacsai 8044045f13 fix(ui): replace border-l dirty indicator with box-shadow
Use inset box-shadow instead of left border to show unsaved env var
state, avoiding layout shift and border-radius interference.
2026-05-07 13:46:11 +02:00
Andras Bacsai df87a49381 docs: add design reference to AGENTS.md and CLAUDE.md
Point agents and Claude to DESIGN.md in the coollabsio/architecture
repo for UI/UX specs, principles, and visual standards.
2026-05-07 12:26:15 +02:00
Andras Bacsai ac6f05c003 chore: remove conductor.json configuration file 2026-05-07 12:25:17 +02:00
Andras Bacsai 635b9732b6 chore: remove DESIGN.md design specification file 2026-05-07 12:22:59 +02:00
dependabot[bot]andGitHub 4e446559a8 build(deps): bump phpseclib/phpseclib from 3.0.51 to 3.0.52
Bumps [phpseclib/phpseclib](https://github.com/phpseclib/phpseclib) from 3.0.51 to 3.0.52.
- [Release notes](https://github.com/phpseclib/phpseclib/releases)
- [Changelog](https://github.com/phpseclib/phpseclib/blob/master/CHANGELOG.md)
- [Commits](https://github.com/phpseclib/phpseclib/compare/3.0.51...3.0.52)

---
updated-dependencies:
- dependency-name: phpseclib/phpseclib
  dependency-version: 3.0.52
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-05-06 17:58:22 +00:00
ShadowArcanist 7c97b8bfb3 fix(onboarding): validate ssh username 2026-05-06 21:21:57 +05:30
ShadowArcanist ff4794ffec fix(server): allow dots in ssh username 2026-05-06 21:21:37 +05:30
Andras BacsaiandGitHub 84b0f9ba7a feat(ui): add collapsible sidebar with tooltip and team menu (#9945) 2026-05-06 15:31:12 +02:00
Andras Bacsai b623c9e5be fix(ui): move top padding to collapsed/expanded states in navbar
Padding `lg:pt-6` moved from static class to expanded-state Alpine binding,
and `lg:pt-8` added for collapsed state, so top spacing responds correctly
to sidebar collapse toggle.
2026-05-06 15:01:12 +02:00
Andras Bacsai 02dd8093a3 feat(ui): add collapsible sidebar with tooltip and team menu
Sidebar collapses to icon-only mode on lg breakpoint. State persists
in localStorage. Collapsed state shows logo icon, team initial button
with flyout menu, and hover tooltips for nav items.
2026-05-06 14:56:13 +02:00
Andras Bacsai fe934dd139 Merge remote-tracking branch 'origin/next' into feat/railpack 2026-05-06 14:33:22 +02:00
Andras Bacsai c553b6aef9 Merge remote-tracking branch 'origin/next' into api-sensitive-data-scrubber 2026-05-06 14:33:19 +02:00
Andras BacsaiandGitHub be6604913b fix(scheduled-task): guard against undefined relationships in server() method (#9922) 2026-05-06 14:32:36 +02:00
Andras Bacsai 29d41ba041 Merge remote-tracking branch 'origin/next' into 9916-investigate-undefined-relationship 2026-05-06 14:32:16 +02:00
Andras Bacsai 0888198a81 Merge remote-tracking branch 'origin/next' into api-sensitive-data-scrubber 2026-05-05 22:09:34 +02:00
Andras BacsaiandGitHub 7e5e046563 feat(mcp): add instance-level MCP server toggle via API and UI (#9862) 2026-05-05 22:09:17 +02:00
Andras Bacsai 45f65481e6 fix(mcp): change enable/disable endpoints from GET to POST and fix service/app listing
- `/mcp/enable` and `/mcp/disable` now use POST (state-mutating ops)
- `ListServices` queries DB directly instead of loading all projects into memory
- `ListApplications` validates tag arg rejects empty string (not just falsy)
2026-05-05 22:07:58 +02:00
Andras Bacsai 5f124ae8ec Merge remote-tracking branch 'origin/next' into api-sensitive-data-scrubber 2026-05-05 22:04:49 +02:00
Andras Bacsai d5e34c2249 Merge remote-tracking branch 'origin/next' into mcp-server-instance-toggle 2026-05-05 22:04:13 +02:00
Andras Bacsai 10d3657fc1 Merge remote-tracking branch 'origin/next' into feat/railpack 2026-05-05 21:59:30 +02:00
Andras Bacsai 14359490f0 Merge remote-tracking branch 'origin/next' into 9916-investigate-undefined-relationship 2026-05-05 21:59:25 +02:00
Andras Bacsai 2cbb449a06 docs(sponsors): add Capture.page as big sponsor 2026-05-05 21:04:25 +02:00
Andras Bacsai d1a416f256 docs(sponsors): add LumaDock as big sponsor 2026-05-05 20:52:17 +02:00
Andras Bacsai 22a2c05a1d test(railpack): add API, Livewire UI tests and e2e smoke script
Add feature tests covering railpack build pack via REST API and
Livewire UI components, plus a bash smoke test that deploys seeded
railpack-* example apps against the local dev stack and verifies
COOLIFY_*, SOURCE_COMMIT, and RAILPACK_* env vars land correctly.
2026-05-05 15:32:43 +02:00
Andras Bacsai 52f68c22ed Merge remote-tracking branch 'origin/next' into feat/railpack 2026-05-05 15:32:19 +02:00
Andras Bacsai e89820b465 refactor(deployment): move copyLogs to client-side and hide refund when ineligible
Move copyLogs from PHP Livewire method to Alpine.js to avoid
unnecessary server round-trips. Extract collectVisibleLogs()
helper shared by both copy and download actions.

Hide refund section entirely when not eligible instead of
rendering a permanently disabled button.
2026-05-05 15:30:32 +02:00
Andras Bacsai 1849b5903e refactor(scheduled-task): simplify server() with nullsafe operators and add return type
Replace nested null checks with nullsafe operator chains, add ?Server
return type, drop unreachable database branch, and cover all paths with
feature tests.
2026-05-04 12:26:15 +02:00
Josh Salway 3b763d54cc test(deploy): remove coercion test to keep PR focused on the fix 2026-05-03 00:03:14 +10:00
Josh Salway 6eb527d0ab test(deploy): expand force param tests to cover all coercion cases
Adds datasets for falsy (false, 0) and truthy (true, 1) query string
values, covering the full coercion table from the PR description.
2026-05-02 23:37:57 +10:00