There was no API for creating GitLab sources. Add /api/v1/gitlab-apps
list/create/update/delete with OpenAPI docs, sensitive-field redaction,
and feature coverage mirroring the GitHub Apps API.
Webhook secret was stored and shown as plaintext. Use a password field,
encrypt at rest (with legacy plaintext read support), and look up tokens
via findByWebhookToken so encrypted values still authenticate webhooks.
Match application status layout by placing the Connected badge next to
the page heading, and drop the redundant Disconnect action (re-auth is
done via Connect after tokens expire or credentials are updated).
Match the GitHub App endpoint picker so self-hosted / tunnel setups can
select FQDN, IP, app URL, or a custom base. Redirect URI is derived as
{base}/webhooks/source/gitlab/redirect and persisted for token exchange.
The secret was always stored encrypted, but the setup form wiped the
input on every load. Load it back for admins (GitHub App parity) so a
reload no longer looks like a failed save.
Use the red incomplete-setup alert like GitHub, keep name + OAuth
credentials front-and-center, and tuck GitLab URL / API / SSH / system
wide options into an Advanced accordion for self-hosted users.
Match the GitHub create modal layout: intro copy, name/group row,
system-wide warning, self-hosted accordion (URL/API/SSH), and a
bottom Continue button instead of a duplicate header Save.
GitlabAppPolicy previously allowed any authenticated user to update,
delete, and create GitLab sources. Align it with GithubAppPolicy, require
Application create authorization on the private-repo wizard, and reject
OAuth callbacks from non-admins so members cannot escalate privileges.
Adds self-hosted GitLab OAuth sources so Coolify can connect to a self-managed GitLab instance, list private repositories, clone over an OAuth token, and deploy (the GitLab counterpart to GitHub Apps).
Hardening: authenticated, one-time team-bound OAuth callback state; token redaction in deploy logs; custom host port/path kept in clone and ls-remote URLs; submodule OAuth auth; system-wide source selection. Covered by unit and feature tests.
cosigned by OpenAI Codex at M1 Max
- Gate volume backup retention and S3 controls by update permission
- Preserve backup records when S3 deletion fails
- Share SFTP download streaming with consistent missing-file handling
- Handle schedule creation errors and link service database backups
Introduce V5Feature and config so V5 routes, jobs, commands, morph maps,
and model queries run only when enabled. Move V5 migrations to
migrations-v5 (loaded only when enabled), remove Flux from production
Docker/install paths, and add isolation tests.
Make start/stop/restart, deploy, enable/disable, and server validate
POST-only, with GET returning 405. Server validate accepts optional
install and uses ValidateAndInstallServerJob. Update OpenAPI and tests.
Keep the dev container as root for s6 init so composer can create
vendor/ on root-owned mounts, then chown writable paths to www-data.
Move init-setup into a shell script and expose VITE_HOST/PORT for
remote HMR (LAN/Tailscale) with Vite listening on 0.0.0.0.
