drewmt
bfdf3d3d2b
fix(api): regenerate basic auth labels after updates
2026-08-12 09:13:47 +03:00
Andras Bacsai
003e44d123
Merge remote-tracking branch 'origin/next' into feat/noindex-domains
2026-08-08 11:26:20 +02:00
Andras Bacsai and GitHub
c15e3b35fd
feat(resources): add cross-server resource migration (dev-only) ( #11165 )
2026-08-07 23:01:31 +02:00
8ae56587d5
feat(ui): Shadow UI redesign, domain management, and DNS autoconfigure ( #11119 )
...
Co-authored-by: ShadowArcanist <162910371+ShadowArcanist@users.noreply.github.com >
2026-08-03 23:11:54 +02:00
Andras Bacsai and GitHub
e560bdf9e0
fix(api): secure proxy config, clone volumes, and rollback tags ( #11003 )
2026-07-22 14:52:11 +02:00
Andras Bacsai
bf72fd5d88
refactor(backups): centralize storage deletion guard
2026-07-19 23:20:46 +02:00
Andras Bacsai
b97a97e955
Merge remote-tracking branch 'origin/next' into volume-backups-server-s3
2026-07-19 21:45:26 +02:00
Andras Bacsai
0633b543ee
feat(api): require POST for state-changing endpoints
...
Make start/stop/restart, deploy, enable/disable, and server validate
POST-only, with GET returning 405. Server validate accepts optional
install and uses ValidateAndInstallServerJob. Update OpenAPI and tests.
2026-07-19 11:42:04 +02:00
Andras Bacsai
662633399f
Merge remote-tracking branch 'origin/next' into volume-backups-server-s3
2026-07-18 16:07:26 +02:00
Andras Bacsai
28f8867567
feat(api): add volume backup schedule delete endpoints
...
Expose DELETE for application, database, and service storage backup
schedules (with OpenAPI docs), reject storage deletes while schedules
exist, skip retention cleanup when no limits are set, and remove S3
archives using the execution’s S3 storage.
2026-07-16 21:44:48 +02:00
Andras Bacsai and GitHub
913d033c75
fix(resources): clarify build server hosting restrictions ( #10961 )
2026-07-16 21:35:23 +02:00
Andras Bacsai
54adea26c2
Merge remote-tracking branch 'origin/next' into feat/noindex-domains
2026-07-14 14:04:06 +02:00
Andras Bacsai
34e6a6dd5d
feat(api): add application settings to application endpoints
2026-07-14 13:44:45 +02:00
Alberto Rizzi
4afe131905
feat(domains): add per-domain noindex support
...
Flagged domains are served with X-Robots-Tag: noindex, nofollow via
Traefik and Caddy routing labels, so an auto-generated technical domain
can be excluded from indexing while the production domain on the same
resource stays indexable.
2026-07-12 13:59:09 +02:00
Andras Bacsai
cf63c7d154
Merge remote-tracking branch 'origin/next' into feat/api-move-resources-between-projects
2026-07-07 18:13:37 +02:00
Andras Bacsai
aded45acbe
Merge remote-tracking branch 'origin/next' into feat/api/tag-management
2026-07-07 14:02:45 +02:00
Andras Bacsai
11b35ba3c1
feat(api): add tags to resource creation
...
Normalize tag names before attaching them, reject names that are too short
after sanitization, and return 404 when removing tags not attached to the
resource.
Adds a per-team unique tag-name index and migrates duplicate tags onto the
kept record before creating the constraint.
2026-07-07 13:56:33 +02:00
Andras Bacsai
ff976a134f
Merge remote-tracking branch 'origin/next' into api-sensitive-data-scrubber
2026-07-07 12:56:19 +02:00
Andras Bacsai
f617e58401
Merge remote-tracking branch 'origin/next' into feat/api/tag-management
...
# Conflicts:
# app/Http/Controllers/Api/ApplicationsController.php
2026-07-07 12:49:19 +02:00
Andras Bacsai
00a3738ec7
Merge remote-tracking branch 'origin/next' into api-application-preview-deployments
2026-07-07 12:38:37 +02:00
Andras Bacsai
b50839d451
Merge remote-tracking branch 'origin/next' into fix/url-validator-underscore-hostnames
2026-07-07 12:24:32 +02:00
Andras Bacsai and GitHub
d01e3a9730
fix(parsers): populate docker_compose_domains for API-created Docker Compose apps ( #9300 )
2026-07-07 12:17:52 +02:00
Andras Bacsai and GitHub
d657c10df3
fix(api): allow source commit build setting ( #10551 )
2026-07-07 12:12:32 +02:00
Andras Bacsai
59b158381c
fix(api): preserve source commit flag until cleanup
2026-07-07 12:12:20 +02:00
Andras Bacsai and GitHub
6c42ca82cb
fix: only strip git_host from repository_url when git_host is github.com ( #10274 )
2026-07-07 12:11:45 +02:00
Andras Bacsai
6baabf9eda
fix(api): document source commit build option
2026-07-07 12:08:07 +02:00
Andras Bacsai
ff5cfd4253
fix(api): normalize log endpoint query handling
...
Clamp log line counts, parse timestamp flags consistently, and filter
service subcontainers by Coolify labels. Document log endpoint timestamp
parameters and database/service log routes in OpenAPI.
2026-07-06 23:58:12 +02:00
Andras Bacsai
adc4b3091f
Merge remote-tracking branch 'origin/next' into feat/database-service-logs-endpoint
2026-07-06 23:29:54 +02:00
Andras Bacsai
e551f9c176
Merge remote-tracking branch 'origin/next' into fix/docker-compose-domains-api-9211
2026-07-03 11:32:41 +02:00
Andras Bacsai
29c122b31a
fix(api): return deployment UUID strings directly
2026-07-03 11:31:49 +02:00
Andras Bacsai
b5ba40b049
Merge remote-tracking branch 'origin/next' into fix/docker-compose-domains-api-9211
2026-07-03 10:26:19 +02:00
Andras Bacsai
99f60228ad
fix(api): avoid lazy loading nested server secrets
2026-07-02 17:47:22 +02:00
Andras Bacsai
bbff70c8d0
fix: improve application URL handling
2026-07-02 16:52:07 +02:00
Andras Bacsai
13172849e1
Merge remote-tracking branch 'origin/next' into api-sensitive-data-scrubber
2026-07-02 15:57:43 +02:00
Andras Bacsai
6871160623
fix(api): gate sensitive storage and GitHub fields
...
Expose GitHub app secrets and file storage content only when the request has sensitive read access. Hide LocalFileVolume content by default and resolve application UUIDs from route parameters.
2026-07-02 15:50:43 +02:00
Andras Bacsai
a06c1a7bf5
Improve storage mount path handling
2026-07-02 14:54:38 +02:00
Julien Bouquillon and GitHub
77086e28af
Merge branch 'v4.x' into api-application-preview-deployments
2026-07-01 19:11:16 +02:00
Andras Bacsai
87d4744390
Validate environment variable keys
2026-06-25 18:19:58 +02:00
Andras Bacsai
f5ecdfa4ce
Merge remote-tracking branch 'origin/next' into api-sensitive-data-scrubber
2026-06-15 13:29:25 +02:00
Osamaali313
74b1077010
fix: accept underscores in domain hostnames for API URL validation
...
PHP's FILTER_VALIDATE_URL rejects underscores in the host, so domains
like https://myapp_service.example.com were rejected by the API and
never got a Let's Encrypt certificate. Add an isValidDomainUrl() helper
that validates a copy with underscores replaced by hyphens, and route
domain validation in the Applications and Services API controllers
through it.
Fixes #10597
2026-06-13 22:46:04 +03:00
vaguul and vuguul
63ba33261b
fix(api): allow source commit build setting
2026-06-04 17:51:17 -06:00
Andras Bacsai
70eda65d19
fix(api): hide nested server secrets from read tokens
...
Require read:sensitive for nested server logdrain and sentinel fields in
application and database API responses.
Limit deployment configuration column migration SQL to PostgreSQL.
2026-06-04 16:51:52 +02:00
Andras Bacsai
062ad57740
fix(security): enforce team access on mutable actions
...
Authorize cloud provider token access, audit sensitive operations, and
standardize public IDs across deployment and resource flows.
2026-06-04 11:03:06 +02:00
Andras Bacsai
b01c2dd52b
Merge remote-tracking branch 'origin/next' into api-sensitive-data-scrubber
2026-06-04 10:58:07 +02:00
Andras Bacsai
9dca7ca351
Merge remote-tracking branch 'origin/next' into audit-policies
2026-06-04 10:18:54 +02:00
Andras Bacsai
07f381b88c
Merge remote-tracking branch 'origin/next' into jean/port-exposes-improvement
2026-06-03 10:32:57 +02:00
Andras Bacsai
973632b49c
Merge remote-tracking branch 'origin/next' into audit-policies
2026-06-02 12:03:38 +02:00
Andras Bacsai
0038a8f5c9
Merge remote-tracking branch 'origin/next' into api-sensitive-data-scrubber
2026-06-02 11:57:13 +02:00
Andras Bacsai
d72c1e2a47
fix(applications): harden image validation
2026-06-02 11:11:33 +02:00
Julien Bouquillon and GitHub
a0d3da372e
Merge branch 'v4.x' into api-application-preview-deployments
2026-05-28 10:26:02 +02:00
drewmt