fix(security): write Traefik basic-auth middleware after DB commit on update

2026-10-19 07:01:35 +00:00 · 2026-09-04 02:52:38 +00:00
277 changed files with 8045 additions and 86378 deletions
@@ -16,7 +16,7 @@ No instance is running yet — start your own, isolated to this worktree:
   until it answers (usually ~10-15s).
 3. Use `http://localhost:$PORT` as the base URL for Playwright navigation.

-Note: `mcp__dokploy__*` resolves its URL from
+Note: `mcp__dokploy__*` (this repo's `.mcp.json`) resolves its URL from
 `$DOKPLOY_BASE_URL` once, at session startup — it cannot pick up a port
 discovered mid-session. If those tools are unavailable or point at the wrong
 instance, fall back to `curl`/`gh api` for API-level checks, or ask the user
@@ -14,34 +14,34 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get version from package.json
-        run: echo "VERSION=$(jq -r .version ./apps/dokploy/package.json)" >> "$GITHUB_ENV"
+        run: echo "VERSION=$(jq -r .version ./apps/dokploy/package.json)" >> $GITHUB_ENV

      - name: Get latest GitHub tag
        run: |
          LATEST_TAG=$(git ls-remote --tags origin | awk -F'/' '{print $3}' | sort -V | tail -n1)
-          echo "LATEST_TAG=$LATEST_TAG" >> "$GITHUB_ENV"
-          echo "$LATEST_TAG"
+          echo "LATEST_TAG=$LATEST_TAG" >> $GITHUB_ENV
+          echo $LATEST_TAG
      - name: Compare versions
        run: |
-          if [ "$VERSION" != "$LATEST_TAG" ]; then
+          if [ "${{ env.VERSION }}" != "${{ env.LATEST_TAG }}" ]; then
            VERSION_CHANGED="true"
          else
            VERSION_CHANGED="false"
          fi
-          echo "VERSION_CHANGED=$VERSION_CHANGED" >> "$GITHUB_ENV"
+          echo "VERSION_CHANGED=$VERSION_CHANGED" >> $GITHUB_ENV
          echo "Comparing versions:"
-          echo "Current version: $VERSION"
-          echo "Latest tag: $LATEST_TAG"
+          echo "Current version: ${{ env.VERSION }}"
+          echo "Latest tag: ${{ env.LATEST_TAG }}"
          echo "Version changed: $VERSION_CHANGED"
      - name: Check if a PR already exists
        run: |
          PR_EXISTS=$(gh pr list --state open --base main --head canary --json number --jq '. | length')
-          echo "PR_EXISTS=$PR_EXISTS" >> "$GITHUB_ENV"
+          echo "PR_EXISTS=$PR_EXISTS" >> $GITHUB_ENV
        env:
          GH_TOKEN: ${{ secrets.GH_PAT }}

@@ -56,12 +56,12 @@ jobs:
          git push origin canary

          gh pr create \
-            --title "🚀 Release $VERSION" \
-            --body "
-            This PR promotes changes from \`canary\` to \`main\` for version $VERSION.
+            --title "🚀 Release ${{ env.VERSION }}" \
+            --body '
+            This PR promotes changes from `canary` to `main` for version ${{ env.VERSION }}.

            ### 🔍 Changes Include:
-            - Version bump to $VERSION
+            - Version bump to ${{ env.VERSION }}
            - All changes from canary branch

            ### ✅ Pre-merge Checklist:
@@ -69,7 +69,7 @@ jobs:
            - [ ] Documentation updated
            - [ ] Docker images built and tested

-            > 🤖 This PR was automatically generated by [GitHub Actions](https://github.com/actions)" \
+            > 🤖 This PR was automatically generated by [GitHub Actions](https://github.com/actions)' \
            --base main \
            --head canary \
            --label "release" --label "automated pr" || true \
@@ -5,38 +5,33 @@ on:
    branches: [main, canary]
  workflow_dispatch:

-permissions:
-  contents: read
-
 jobs:
  build-and-push-cloud-image:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v3

      - name: Set tag and version
        id: meta-cloud
        run: |
          VERSION=$(jq -r .version apps/dokploy/package.json)
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
-            echo "tags=siumauricio/cloud:latest,siumauricio/cloud:${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            echo "tags=siumauricio/cloud:latest,siumauricio/cloud:${VERSION}" >> $GITHUB_OUTPUT
          else
-            echo "tags=siumauricio/cloud:canary" >> "$GITHUB_OUTPUT"
+            echo "tags=siumauricio/cloud:canary" >> $GITHUB_OUTPUT
          fi

      - name: Log in to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v4
        with:
          context: .
          file: ./Dockerfile.cloud
@@ -53,28 +48,26 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v3

      - name: Set tag and version
        id: meta-schedule
        run: |
          VERSION=$(jq -r .version apps/dokploy/package.json)
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
-            echo "tags=siumauricio/schedule:latest,siumauricio/schedule:${VERSION}" >> "$GITHUB_OUTPUT"
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            echo "tags=siumauricio/schedule:latest,siumauricio/schedule:${VERSION}" >> $GITHUB_OUTPUT
          else
-            echo "tags=siumauricio/schedule:canary" >> "$GITHUB_OUTPUT"
+            echo "tags=siumauricio/schedule:canary" >> $GITHUB_OUTPUT
          fi

      - name: Log in to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v4
        with:
          context: .
          file: ./Dockerfile.schedule
@@ -87,28 +80,26 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v3

      - name: Set tag and version
        id: meta-server
        run: |
          VERSION=$(jq -r .version apps/dokploy/package.json)
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
-            echo "tags=siumauricio/server:latest,siumauricio/server:${VERSION}" >> "$GITHUB_OUTPUT"
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            echo "tags=siumauricio/server:latest,siumauricio/server:${VERSION}" >> $GITHUB_OUTPUT
          else
-            echo "tags=siumauricio/server:canary" >> "$GITHUB_OUTPUT"
+            echo "tags=siumauricio/server:canary" >> $GITHUB_OUTPUT
          fi

      - name: Log in to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v4
        with:
          context: .
          file: ./Dockerfile.server
@@ -8,23 +8,18 @@ on:
 env:
  IMAGE_NAME: dokploy/dokploy

-permissions:
-  contents: read
-
 jobs:
  docker-amd:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -32,15 +27,15 @@ jobs:
      - name: Set tag and version
        id: meta
        run: |
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
            TAG="latest"
            VERSION=$(node -p "require('./apps/dokploy/package.json').version")
-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
            TAG="canary"
          else
            TAG="feature"
          fi
-          echo "tags=${IMAGE_NAME}:${TAG}-amd64" >> "$GITHUB_OUTPUT"
+          echo "tags=${IMAGE_NAME}:${TAG}-amd64" >> $GITHUB_OUTPUT

      - name: Prepare env file
        run: |
@@ -48,7 +43,7 @@ jobs:
          cp apps/dokploy/.env.production.example apps/dokploy/.env.production

      - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64
@@ -58,15 +53,13 @@ jobs:
    runs-on: ubuntu-24.04-arm
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -75,15 +68,15 @@ jobs:
        id: meta
        run: |
          VERSION=$(node -p "require('./apps/dokploy/package.json').version")
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
            TAG="latest"
            VERSION=$(node -p "require('./apps/dokploy/package.json').version")
-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
            TAG="canary"
          else
            TAG="feature"
          fi
-          echo "tags=${IMAGE_NAME}:${TAG}-arm64" >> "$GITHUB_OUTPUT"
+          echo "tags=${IMAGE_NAME}:${TAG}-arm64" >> $GITHUB_OUTPUT

      - name: Prepare env file
        run: |
@@ -91,7 +84,7 @@ jobs:
          cp apps/dokploy/.env.production.example apps/dokploy/.env.production

      - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/arm64
@@ -103,22 +96,20 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Create and push manifests
        run: |
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
            VERSION=$(node -p "require('./apps/dokploy/package.json').version")
            TAG="latest"

@@ -130,7 +121,7 @@ jobs:
              ${IMAGE_NAME}:${TAG}-amd64 \
              ${IMAGE_NAME}:${TAG}-arm64

-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
            TAG="canary"
            docker buildx imagetools create -t ${IMAGE_NAME}:${TAG} \
              ${IMAGE_NAME}:${TAG}-amd64 \
@@ -147,37 +138,32 @@ jobs:
    needs: [combine-manifests]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
-    permissions:
-      contents: write
    outputs:
      version: ${{ steps.get_version.outputs.version }}
      npm_version: ${{ steps.get_version.outputs.npm_version }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0
-          persist-credentials: false

      - name: Get version
        id: get_version
        run: |
          VERSION=$(node -p "require('./apps/dokploy/package.json').version")
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "npm_version=${VERSION#v}" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "npm_version=${VERSION#v}" >> $GITHUB_OUTPUT

      - name: Fetch install.sh
-        env:
-          RELEASE_VERSION: ${{ steps.get_version.outputs.version }}
        run: |
          curl -fsSL https://raw.githubusercontent.com/Dokploy/website/main/apps/website/public/install.sh -o install.sh
          head -1 install.sh | grep -q '^#!' || { echo "Downloaded install.sh is not a shell script"; exit 1; }
          grep -q 'DOKPLOY_VERSION' install.sh || { echo "install.sh no longer supports DOKPLOY_VERSION pinning"; exit 1; }
-          { head -1 install.sh; echo "DOKPLOY_VERSION=\"\${DOKPLOY_VERSION:-${RELEASE_VERSION}}\""; tail -n +2 install.sh; } > install-pinned.sh
+          { head -1 install.sh; echo "DOKPLOY_VERSION=\"\${DOKPLOY_VERSION:-${{ steps.get_version.outputs.version }}}\""; tail -n +2 install.sh; } > install-pinned.sh
          mv install-pinned.sh install.sh

      - name: Create Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.get_version.outputs.version }}
          target_commitish: ${{ github.sha }}
@@ -193,19 +179,15 @@ jobs:
    needs: [generate-release]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
-    env:
-      NPM_VERSION: ${{ needs.generate-release.outputs.npm_version }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v4
        with:
          version: 10.22.0

-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v4
        with:
          node-version: 24.4.0
          cache: pnpm
@@ -220,63 +202,63 @@ jobs:
          git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/mcp.git /tmp/mcp-repo
          cd /tmp/mcp-repo

-          jq --arg v "$NPM_VERSION" '.version = $v' package.json > package.json.tmp
+          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
          mv package.json.tmp package.json

-          cp $GITHUB_WORKSPACE/openapi.json src/generated/openapi.json
+          cp ${{ github.workspace }}/openapi.json src/generated/openapi.json
          pnpm install
          pnpm run generate

          git config user.name "Dokploy Bot"
          git config user.email "bot@dokploy.com"
          git add -A
-          git commit -m "chore: bump version to $NPM_VERSION" \
-            -m "Source: $GITHUB_REPOSITORY@$GITHUB_SHA" \
+          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
+            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
            --allow-empty
          git push

-          echo "✅ MCP repo synced to version $NPM_VERSION"
+          echo "✅ MCP repo synced to version ${{ needs.generate-release.outputs.npm_version }}"

      - name: Sync version to CLI repository
        run: |
          git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/cli.git /tmp/cli-repo
          cd /tmp/cli-repo

-          jq --arg v "$NPM_VERSION" '.version = $v' package.json > package.json.tmp
+          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
          mv package.json.tmp package.json

-          cp $GITHUB_WORKSPACE/openapi.json ./openapi.json
+          cp ${{ github.workspace }}/openapi.json ./openapi.json
          pnpm install
          pnpm run generate

          git config user.name "Dokploy Bot"
          git config user.email "bot@dokploy.com"
          git add -A
-          git commit -m "chore: bump version to $NPM_VERSION" \
-            -m "Source: $GITHUB_REPOSITORY@$GITHUB_SHA" \
+          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
+            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
            --allow-empty
          git push

-          echo "✅ CLI repo synced to version $NPM_VERSION"
+          echo "✅ CLI repo synced to version ${{ needs.generate-release.outputs.npm_version }}"

      - name: Sync version to SDK repository
        run: |
          git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/sdk.git /tmp/sdk-repo
          cd /tmp/sdk-repo

-          jq --arg v "$NPM_VERSION" '.version = $v' package.json > package.json.tmp
+          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
          mv package.json.tmp package.json

-          cp $GITHUB_WORKSPACE/openapi.json ./openapi.json
+          cp ${{ github.workspace }}/openapi.json ./openapi.json
          pnpm install
          pnpm run generate

          git config user.name "Dokploy Bot"
          git config user.email "bot@dokploy.com"
          git add -A
-          git commit -m "chore: bump version to $NPM_VERSION" \
-            -m "Source: $GITHUB_REPOSITORY@$GITHUB_SHA" \
+          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
+            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
            --allow-empty
          git push

-          echo "✅ SDK repo synced to version $NPM_VERSION"
+          echo "✅ SDK repo synced to version ${{ needs.generate-release.outputs.npm_version }}"
@@ -6,20 +6,15 @@ on:
  pull_request:
    branches: [canary]

-permissions:
-  contents: read
-
 jobs:
  format:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v5

      - name: Setup biomeJs
-        uses: biomejs/setup-biome@v2
+        uses: biomejs/setup-biome@v2  

      - name: Run Biome formatter
        run:  biome format --write
@@ -16,19 +16,17 @@ jobs:
      contents: write
    steps:
      - name: Checkout main
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
        with:
          ref: main
          fetch-depth: 0
          token: ${{ secrets.HOTFIX_PUSH_TOKEN }}

      - name: Cherry-pick fix to main
-        env:
-          MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
        run: |
          git config user.name "Dokploy Bot"
          git config user.email "bot@dokploy.com"
-          SHA="$MERGE_SHA"
+          SHA="${{ github.event.pull_request.merge_commit_sha }}"
          if [ "$(git rev-list --parents -n1 "$SHA" | wc -w)" -gt 2 ]; then
            git cherry-pick -x -m 1 "$SHA"
          else
@@ -7,16 +7,12 @@ concurrency:
  group: hotfix-to-main
  cancel-in-progress: false

-# Push to main goes through HOTFIX_PUSH_TOKEN, not the workflow token.
-permissions:
-  contents: read
-
 jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout main
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
        with:
          ref: main
          token: ${{ secrets.HOTFIX_PUSH_TOKEN }}
@@ -7,23 +7,18 @@ on:
 env:
  IMAGE_NAME: dokploy/monitoring

-permissions:
-  contents: read
-
 jobs:
  docker-amd:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -31,17 +26,17 @@ jobs:
      - name: Set tag
        id: meta
        run: |
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
            TAG="latest"
-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
            TAG="canary"
          else
            TAG="feature"
          fi
-          echo "tags=${IMAGE_NAME}:${TAG}-amd64" >> "$GITHUB_OUTPUT"
+          echo "tags=${IMAGE_NAME}:${TAG}-amd64" >> $GITHUB_OUTPUT

      - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile.monitoring
@@ -52,15 +47,13 @@ jobs:
    runs-on: ubuntu-24.04-arm
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -68,17 +61,17 @@ jobs:
      - name: Set
        id: meta
        run: |
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
            TAG="latest"
-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
            TAG="canary"
          else
            TAG="feature"
          fi
-          echo "tags=${IMAGE_NAME}:${TAG}-arm64" >> "$GITHUB_OUTPUT"
+          echo "tags=${IMAGE_NAME}:${TAG}-arm64" >> $GITHUB_OUTPUT

      - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile.monitoring
@@ -91,29 +84,27 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Create and push manifests
        run: |
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
            TAG="latest"

            docker buildx imagetools create -t ${IMAGE_NAME}:${TAG} \
              ${IMAGE_NAME}:${TAG}-amd64 \
              ${IMAGE_NAME}:${TAG}-arm64

-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
            TAG="canary"
            docker buildx imagetools create -t ${IMAGE_NAME}:${TAG} \
              ${IMAGE_NAME}:${TAG}-amd64 \
@@ -14,11 +14,9 @@ jobs:
      matrix:
        job: [build, test, typecheck]
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@v5
+      - uses: pnpm/action-setup@v5
+      - uses: actions/setup-node@v5
        with:
          node-version: 24.4.0
          cache: "pnpm"
@@ -12,20 +12,17 @@ on:

  workflow_dispatch:

-permissions:
-  contents: read
-
 jobs:
  generate-and-commit:
    name: Generate OpenAPI and commit to Dokploy repo
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Dokploy repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
        with:
-          persist-credentials: false
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v7
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
        with:
          node-version: 24.4.0
          cache: "pnpm"
@@ -28,9 +28,6 @@ env:
  DOKPLOY_SERVICE: dokploy
  DOKPLOY_PORT:    3000

-permissions:
-  contents: read
-
 # ──────────────────────────────────────────────────────────────────────────────
 jobs:

@@ -424,10 +421,8 @@ jobs:
      # ── Job summary ────────────────────────────────────────────────────────
      - name: Write job summary
        if: always()
-        env:
-          JOB_STATUS: ${{ job.status }}
        run: |
-          STATUS="$JOB_STATUS"
+          STATUS="${{ job.status }}"
          ICON="✅"; [ "$STATUS" != "success" ] && ICON="❌"
          cat >> "$GITHUB_STEP_SUMMARY" <<EOF
          ## ${ICON} ${{ matrix.pair.from }} → ${{ matrix.pair.to }}: ${STATUS^^}
@@ -123,13 +123,13 @@ pnpm run docker:push
 In the case you lost your password, you can reset the owner's password using the following command

 ```bash
-pnpm --filter=dokploy run reset-password
+pnpm run reset-password
 ```

 To reset the password of a specific user instead, pass their email as an argument

 ```bash
-pnpm --filter=dokploy run reset-password user@example.com
+pnpm run reset-password -- user@example.com
 ```

 Both commands print the new randomly generated password to the console.
@@ -26,7 +26,6 @@ Dokploy includes multiple features to make your life easier.
 - **Templates**: Deploy open-source templates (Plausible, Pocketbase, Calcom, etc.) with a single click.
 - **Traefik Integration**: Automatically integrates with Traefik for routing and load balancing.
 - **Real-time Monitoring**: Monitor CPU, memory, storage, and network usage for every resource.
- **Logs & Metrics**: Ship container logs and host/container metrics to Grafana (Loki, Prometheus/Mimir), Datadog, New Relic, InfluxDB, VictoriaMetrics, Better Stack, Elasticsearch/OpenSearch, Splunk, or AWS CloudWatch, tagged by project/environment/application.
 - **Docker Management**: Easily deploy and manage Docker containers.
 - **CLI/API**: Manage your applications and databases using the command line or through the API.
 - **Notifications**: Get notified when your deployments succeed or fail (via Slack, Discord, Telegram, Email, etc.).
@@ -10,12 +10,12 @@
 		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
-		"inngest": "3.54.0",
+		"inngest": "3.40.1",
 		"@dokploy/server": "workspace:*",
-		"@hono/node-server": "^1.19.15",
+		"@hono/node-server": "^1.14.3",
 		"@hono/zod-validator": "0.7.6",
 		"dotenv": "^16.4.5",
-		"hono": "^4.13.5",
+		"hono": "^4.11.7",
 		"pino": "9.4.0",
 		"pino-pretty": "11.2.2",
 		"react": "19.2.7",
@@ -1,156 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockUpdateApplication = vi.hoisted(() => vi.fn());
-
-vi.mock("@dokploy/server/services/permission", () => {
-	return {
-		checkServicePermissionAndAccess: vi.fn(async () => undefined),
-	};
-});
-
-vi.mock("@dokploy/server/index", () => ({
-	IS_CLOUD: true,
-	hasValidLicense: vi.fn(async () => false),
-	updateApplication: mockUpdateApplication,
-	findApplicationById: vi.fn(async () => ({
-		applicationId: "app-1",
-		appName: "example-app",
-	})),
-}));
-
-vi.mock("@dokploy/server/lib/auth", () => ({
-	validateRequest: vi.fn(),
-}));
-
-vi.mock("@/server/api/utils/audit", () => ({
-	audit: vi.fn(async () => undefined),
-}));
-
-const { applicationRouter } = await import("@/server/api/routers/application");
-
-const caller = applicationRouter.createCaller({
-	session: { activeOrganizationId: "org-1" },
-	user: { id: "user-1", email: "user@example.com", role: "owner" },
-} as Parameters<typeof applicationRouter.createCaller>[0]);
-
-const providerChanges = [
-	{
-		name: "GitHub",
-		sourceType: "github",
-		save: () =>
-			caller.saveGithubProvider({
-				applicationId: "app-1",
-				repository: "example-repo",
-				owner: "example-owner",
-				branch: "main",
-				buildPath: "/",
-				githubId: "provider-1",
-				watchPaths: ["src/**"],
-				triggerType: "push",
-				enableSubmodules: false,
-			}),
-	},
-	{
-		name: "GitLab",
-		sourceType: "gitlab",
-		save: () =>
-			caller.saveGitlabProvider({
-				applicationId: "app-1",
-				gitlabRepository: "example-repo",
-				gitlabOwner: "example-owner",
-				gitlabBranch: "main",
-				gitlabBuildPath: "/",
-				gitlabId: "provider-1",
-				gitlabProjectId: 1,
-				gitlabPathNamespace: "example-owner/example-repo",
-			}),
-	},
-	{
-		name: "Bitbucket",
-		sourceType: "bitbucket",
-		save: () =>
-			caller.saveBitbucketProvider({
-				applicationId: "app-1",
-				bitbucketRepository: "example-repo",
-				bitbucketRepositorySlug: "example-repo",
-				bitbucketOwner: "example-owner",
-				bitbucketBranch: "main",
-				bitbucketBuildPath: "/",
-				bitbucketId: "provider-1",
-			}),
-	},
-	{
-		name: "Gitea",
-		sourceType: "gitea",
-		save: () =>
-			caller.saveGiteaProvider({
-				applicationId: "app-1",
-				giteaRepository: "example-repo",
-				giteaOwner: "example-owner",
-				giteaBranch: "main",
-				giteaBuildPath: "/",
-				giteaId: "provider-1",
-			}),
-	},
-	{
-		name: "Docker",
-		sourceType: "docker",
-		save: () =>
-			caller.saveDockerProvider({
-				applicationId: "app-1",
-				dockerImage: "nginx:alpine",
-				username: "",
-				password: "",
-				registryUrl: "",
-			}),
-	},
-	{
-		name: "custom Git",
-		sourceType: "git",
-		save: () =>
-			caller.saveGitProvider({
-				applicationId: "app-1",
-				customGitUrl: "https://example.com/repo.git",
-				customGitBranch: "main",
-				customGitBuildPath: "/",
-				customGitSSHKeyId: "key-1",
-				watchPaths: ["src/**"],
-				enableSubmodules: false,
-			}),
-	},
-	{
-		name: "disconnect Git provider",
-		sourceType: "github",
-		save: () => caller.disconnectGitProvider({ applicationId: "app-1" }),
-	},
-];
-
-describe("saving an application provider", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-	});
-
-	it.each(providerChanges)(
-		"keeps the status when $name settings change",
-		async ({ save, sourceType }) => {
-			for (const status of ["done", "running"]) {
-				mockUpdateApplication.mockClear();
-				let savedStatus = status;
-				mockUpdateApplication.mockImplementation(async (_id, update) => {
-					if (update.applicationStatus !== undefined) {
-						savedStatus = update.applicationStatus;
-					}
-				});
-
-				await save();
-
-				expect(savedStatus).toBe(status);
-				expect(mockUpdateApplication).toHaveBeenCalledTimes(1);
-				expect(mockUpdateApplication).toHaveBeenCalledWith(
-					"app-1",
-					expect.objectContaining({ sourceType }),
-				);
-			}
-		},
-	);
-});
@@ -1,6 +1,4 @@
-import type { Destination } from "@dokploy/server/services/destination";
 import { redactRcloneCredentials } from "@dokploy/server/utils/backups/redact";
-import { getS3Credentials } from "@dokploy/server/utils/backups/utils";
 import { describe, expect, it } from "vitest";

 describe("redactRcloneCredentials (#4621)", () => {
@@ -50,48 +48,3 @@ describe("redactRcloneCredentials (#4621)", () => {
 		expect(redacted).toContain("[REDACTED]");
 	});
 });
-
-describe("redactRcloneCredentials with getS3Credentials output (#5519)", () => {
-	const buildCommand = (accessKey: string, secretAccessKey: string) =>
-		`rclone rcat ${getS3Credentials({
-			accessKey,
-			secretAccessKey,
-			region: "us-west-001",
-			endpoint: "https://s3.us-west-001.backblazeb2.com",
-			provider: "Other",
-		} as Destination).join(" ")} :s3:bucket/file.gz`;
-
-	it.each([
-		[
-			"plain alphanumeric",
-			"001aaaabbbbccccdd0000000001",
-			"K001FAKEfakeFAKEfake",
-		],
-		[
-			"containing slashes",
-			"AKIAIOSFODNN7EXAMPLE",
-			"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
-		],
-		["containing spaces", "key with space", "secret with space"],
-		["containing quotes", "it's-a-key", `say "hi" it's`],
-		["containing shell metacharacters", "key$HOME", "sec;ret`id`&|\\x"],
-	])("redacts credentials %s", (_, accessKey, secretAccessKey) => {
-		const redacted = redactRcloneCredentials(
-			buildCommand(accessKey, secretAccessKey),
-		);
-		expect(redacted).toContain(
-			'--s3-access-key-id="[REDACTED]" --s3-secret-access-key="[REDACTED]" --s3-region=us-west-001',
-		);
-		expect(redacted).not.toContain(accessKey);
-		expect(redacted).not.toContain(secretAccessKey);
-		expect(redacted).toContain(":s3:bucket/file.gz");
-	});
-
-	it("redacts credentials embedded in an error string", () => {
-		const errorStr = `Error: Command failed: ${buildCommand("MYKEY", "MY/SECRET")}`;
-		const redacted = redactRcloneCredentials(errorStr);
-		expect(redacted).not.toContain("MYKEY");
-		expect(redacted).not.toContain("MY/SECRET");
-		expect(redacted).toContain("[REDACTED]");
-	});
-});
@@ -1,14 +0,0 @@
-import { describe, it, expect } from "vitest";
-
-describe("Remote Server Action Tooltips", () => {
-	it("should close the tooltip when the dialog trigger is clicked", () => {
-		// Note: The UI layer in this project is not currently tested with DOM simulation tools
-		// like React Testing Library or JSDOM.
-		//
-		// The structural fix implemented (passing TooltipTrigger asChild -> DialogTrigger asChild)
-		// inherently guarantees that Radix UI's composeEventHandlers properly propagates the
-		// onPointerDown event to dismiss the tooltip simultaneously as the dialog opens.
-
-		expect(true).toBe(true);
-	});
-});
@@ -1,44 +0,0 @@
-import { createCommand } from "@dokploy/server/utils/builders/compose";
-import { describe, expect, it } from "vitest";
-
-const base = {
-	composeType: "docker-compose" as const,
-	appName: "compose-app",
-	sourceType: "github" as const,
-	composePath: "./docker-compose.yml",
-	command: "",
-};
-
-describe("compose createCommand --pull always", () => {
-	it("adds --pull always when pullImages is enabled", () => {
-		const cmd = createCommand({ ...base, pullImages: true } as any);
-
-		expect(cmd).toContain("up -d --build --remove-orphans --pull always");
-	});
-
-	it("omits --pull when pullImages is disabled", () => {
-		const cmd = createCommand({ ...base, pullImages: false } as any);
-
-		expect(cmd).not.toContain("--pull");
-	});
-
-	it("does not add --pull to stack deploy", () => {
-		const cmd = createCommand({
-			...base,
-			composeType: "stack",
-			pullImages: true,
-		} as any);
-
-		expect(cmd).not.toContain("--pull");
-	});
-
-	it("leaves a custom command untouched", () => {
-		const cmd = createCommand({
-			...base,
-			command: "compose -p compose-app up -d",
-			pullImages: true,
-		} as any);
-
-		expect(cmd).toBe("compose -p compose-app up -d");
-	});
-});
@@ -33,16 +33,8 @@ services:
 volumes:
  test-data:
 `,
-			composeId: "compose-1",
-			name: "raw-stack",
 			composePath: "./docker-compose.yml",
 			composeType: "stack",
-			environment: {
-				environmentId: "env-1",
-				name: "production",
-				projectId: "project-1",
-				project: { name: "shop", organizationId: "org-1" },
-			},
 			isolatedDeployment: false,
 			isolatedDeploymentsVolume: false,
 			randomize: false,
@@ -62,72 +54,6 @@ volumes:
 			},
 		]);
 		expect(converted?.services?.test?.tmpfs).toEqual(["/cache"]);
-		expect(converted?.services?.test?.labels).toEqual(
-			expect.arrayContaining([
-				"dokploy.organization.id=org-1",
-				"dokploy.project=shop",
-				"dokploy.service=test",
-			]),
-		);
-		expect(converted?.services?.test?.deploy?.labels).toEqual(
-			expect.arrayContaining(["dokploy.organization.id=org-1"]),
-		);
 		expect(execAsyncRemote).not.toHaveBeenCalled();
 	});
-
-	it("escapes `$` in the Dokploy label values so compose keeps them literal", async () => {
-		const compose = {
-			appName: "dollar-stack",
-			composeFile: `
-services:
-  mapped:
-    image: alpine:latest
-    labels:
-      custom: keep
-    deploy:
-      labels:
-        custom: keep
-  listed:
-    image: alpine:latest
-    labels:
-      - custom=keep
-`,
-			composeId: "compose-1",
-			name: "app $DB_PASSWORD",
-			composePath: "./docker-compose.yml",
-			composeType: "stack",
-			environment: {
-				environmentId: "env-1",
-				name: "env ${HOME}",
-				projectId: "project-1",
-				project: { name: "Budget $100", organizationId: "org-1" },
-			},
-			isolatedDeployment: false,
-			isolatedDeploymentsVolume: false,
-			randomize: false,
-			serverId: null,
-			sourceType: "raw",
-			suffix: "",
-		} as unknown as Parameters<typeof addDomainToCompose>[0];
-
-		const converted = await addDomainToCompose(compose, []);
-		const escaped = {
-			"dokploy.project": "Budget $$100",
-			"dokploy.environment": "env $${HOME}",
-			"dokploy.application": "app $$DB_PASSWORD",
-		};
-
-		const mapped = converted?.services?.mapped;
-		expect(mapped?.labels).toMatchObject({ custom: "keep", ...escaped });
-		expect(mapped?.deploy?.labels).toMatchObject({
-			custom: "keep",
-			...escaped,
-		});
-		const listed = converted?.services?.listed;
-		const asList = Object.entries(escaped).map(([k, v]) => `${k}=${v}`);
-		expect(listed?.labels).toEqual(
-			expect.arrayContaining(["custom=keep", ...asList]),
-		);
-		expect(listed?.deploy?.labels).toEqual(expect.arrayContaining(asList));
-	});
 });
@@ -1,113 +0,0 @@
-import type { Compose, ComposeSpecification } from "@dokploy/server";
-import {
-	addAppNameToPreventCollision,
-	addSuffixToAllProperties,
-} from "@dokploy/server";
-import { addDomainToCompose } from "@dokploy/server/utils/docker/domain";
-import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
-import { expect, test, vi } from "vitest";
-import { stringify } from "yaml";
-import composeSpec from "../../../components/shared/compose-spec.json";
-
-vi.mock("@dokploy/server/utils/process/execAsync", async (importOriginal) => ({
-	...(await importOriginal<
-		typeof import("@dokploy/server/utils/process/execAsync")
-	>()),
-	execAsyncRemote: vi.fn(),
-}));
-
-const modelCompose = {
-	services: {
-		app: {
-			image: "my-chat-app",
-			models: ["llm"],
-		},
-		worker: {
-			image: "my-worker",
-			models: {
-				llm: {
-					endpoint_var: "LLM_URL",
-					model_var: "LLM_MODEL",
-				},
-			},
-		},
-	},
-	models: {
-		llm: {
-			model: "ai/smollm2",
-			context_size: 2048,
-			runtime_flags: ["--verbose"],
-		},
-	},
-} satisfies ComposeSpecification;
-
-test("bundled compose schema declares models", () => {
-	expect(composeSpec.properties).toHaveProperty("models");
-	expect(composeSpec.definitions.model.required).toEqual(["model"]);
-	expect(composeSpec.definitions.service.properties).toHaveProperty("models");
-});
-
-test("suffixing does not rename model identifiers or drop model config", () => {
-	const updated = addSuffixToAllProperties(
-		structuredClone(modelCompose),
-		"testhash",
-	);
-
-	expect(updated.models?.llm?.model).toBe("ai/smollm2");
-	expect(updated.models?.llm?.context_size).toBe(2048);
-	expect(updated.models?.llm?.runtime_flags).toEqual(["--verbose"]);
-	expect(updated.services?.["app-testhash"]?.models).toEqual(["llm"]);
-	expect(updated.services?.["worker-testhash"]?.models).toEqual({
-		llm: {
-			endpoint_var: "LLM_URL",
-			model_var: "LLM_MODEL",
-		},
-	});
-	expect(updated.services).not.toHaveProperty("app");
-	expect(updated.models).not.toHaveProperty("llm-testhash");
-});
-
-test("isolated deployment preserves model identifiers", () => {
-	const updated = addAppNameToPreventCollision(
-		structuredClone(modelCompose),
-		"chat-app",
-		false,
-	);
-
-	expect(updated.models?.llm?.model).toBe("ai/smollm2");
-	expect(updated.services?.app?.models).toEqual(["llm"]);
-	expect(updated.services?.worker?.models).toEqual({
-		llm: {
-			endpoint_var: "LLM_URL",
-			model_var: "LLM_MODEL",
-		},
-	});
-});
-
-test("raw remote compose conversion preserves models", async () => {
-	const converted = await addDomainToCompose(
-		{
-			appName: "chat-app",
-			composeFile: stringify(modelCompose, { lineWidth: 1000 }),
-			composePath: "./docker-compose.yml",
-			composeType: "docker-compose",
-			isolatedDeployment: false,
-			isolatedDeploymentsVolume: false,
-			randomize: false,
-			serverId: "remote-server",
-			sourceType: "raw",
-			suffix: "",
-		} as unknown as Compose,
-		[],
-	);
-
-	expect(execAsyncRemote).not.toHaveBeenCalled();
-	expect(converted?.models?.llm?.model).toBe("ai/smollm2");
-	expect(converted?.services?.app?.models).toEqual(["llm"]);
-	expect(converted?.services?.worker?.models).toEqual({
-		llm: {
-			endpoint_var: "LLM_URL",
-			model_var: "LLM_MODEL",
-		},
-	});
-});
@@ -1,66 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockUpdateCompose = vi.hoisted(() => vi.fn());
-
-vi.mock("@dokploy/server/services/permission", () => ({
-	checkServicePermissionAndAccess: vi.fn(async () => undefined),
-}));
-
-vi.mock("@dokploy/server", () => ({
-	IS_CLOUD: true,
-	findComposeById: vi.fn(async () => ({
-		composeId: "compose-1",
-		name: "example-compose",
-	})),
-	updateCompose: mockUpdateCompose,
-}));
-
-vi.mock("@dokploy/server/lib/auth", () => ({
-	validateRequest: vi.fn(),
-}));
-
-vi.mock("@/server/api/utils/audit", () => ({
-	audit: vi.fn(async () => undefined),
-}));
-
-vi.mock("@/server/queues/queueSetup", () => ({
-	cleanQueuesByCompose: vi.fn(),
-	killDockerBuild: vi.fn(),
-	myQueue: {
-		add: vi.fn(),
-	},
-}));
-
-const { composeRouter } = await import("@/server/api/routers/compose");
-
-const caller = composeRouter.createCaller({
-	session: { activeOrganizationId: "org-1" },
-	user: { id: "user-1", email: "user@example.com", role: "owner" },
-} as Parameters<typeof composeRouter.createCaller>[0]);
-
-describe("saving a compose provider", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-	});
-
-	it.each(["done", "running"])(
-		"keeps the %s status when disconnecting a Git provider",
-		async (status) => {
-			let savedStatus = status;
-			mockUpdateCompose.mockImplementation(async (_id, update) => {
-				if (update.composeStatus !== undefined) {
-					savedStatus = update.composeStatus;
-				}
-			});
-
-			await caller.disconnectGitProvider({ composeId: "compose-1" });
-
-			expect(savedStatus).toBe(status);
-			expect(mockUpdateCompose).toHaveBeenCalledTimes(1);
-			expect(mockUpdateCompose).toHaveBeenCalledWith(
-				"compose-1",
-				expect.objectContaining({ sourceType: "github" }),
-			);
-		},
-	);
-});
@@ -323,11 +323,9 @@ describe("cloudflareClient.upsertRecord", () => {
 		expect(createInit.method).toBe("POST");
 	});

-	it("updates the existing record when content matches", async () => {
+	it("updates the existing record instead of creating a duplicate", async () => {
 		mockFetch
-			.mockResolvedValueOnce(
-				cfSuccess([{ id: "existing-1", type: "A", content: "5.6.7.8" }]),
-			)
+			.mockResolvedValueOnce(cfSuccess([{ id: "existing-1" }]))
 			.mockResolvedValueOnce(cfSuccess({ id: "existing-1" }));

 		const result = await cloudflareClient.upsertRecord(config, {
@@ -346,25 +344,6 @@ describe("cloudflareClient.upsertRecord", () => {
 		expect(updateInit.method).toBe("PUT");
 	});

-	it("creates a new record when content differs from existing", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				cfSuccess([{ id: "existing-1", type: "A", content: "1.1.1.1" }]),
-			)
-			.mockResolvedValueOnce(cfSuccess({ id: "new-2" }));
-
-		const result = await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "A",
-			name: "app.example.com",
-			content: "5.6.7.8",
-		});
-
-		expect(result).toEqual({ id: "new-2" });
-		const [, createInit] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect(createInit.method).toBe("POST");
-	});
-
 	it("defaults ttl to 1 (automatic) when not provided", async () => {
 		mockFetch
 			.mockResolvedValueOnce(cfSuccess([]))
@@ -1,486 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockFetch = vi.fn();
-global.fetch = mockFetch as typeof fetch;
-
-import { infomaniakClient } from "@dokploy/server/utils/dns/infomaniak";
-
-const jsonResponse = (body: unknown, ok = true, status = 200) =>
-	({
-		ok,
-		status,
-		json: async () => body,
-	}) as Response;
-
-const ikSuccess = (data: unknown) => jsonResponse({ result: "success", data });
-
-const ikPage = (data: unknown, page: number, pages: number) =>
-	jsonResponse({ result: "success", data, page, pages });
-
-const ikError = (description: string, status = 400) =>
-	jsonResponse(
-		{ result: "error", error: { code: "not_authorized", description } },
-		false,
-		status,
-	);
-
-const config = {
-	providerType: "infomaniak" as const,
-	apiToken: "ik_test_token",
-};
-
-const lastCall = () =>
-	mockFetch.mock.calls.at(-1) as [string, RequestInit & { method?: string }];
-
-const lastBody = () => JSON.parse(lastCall()[1].body as string);
-
-beforeEach(() => {
-	mockFetch.mockReset();
-});
-
-describe("infomaniakClient.listZones", () => {
-	it("exposes each domain product as a zone keyed by its name", async () => {
-		mockFetch.mockResolvedValue(
-			ikPage(
-				[
-					{ id: 1, customer_name: "example.com" },
-					{ id: 2, customer_name: "example.ch" },
-				],
-				1,
-				1,
-			),
-		);
-
-		const zones = await infomaniakClient.listZones(config);
-
-		expect(zones).toEqual([
-			{ id: "example.com", name: "example.com" },
-			{ id: "example.ch", name: "example.ch" },
-		]);
-		const [url, init] = lastCall();
-		// The documented endpoint is the plural one; the singular is legacy and
-		// returns no pagination metadata at all.
-		expect(url).toContain("/1/products?service_name=domain");
-		expect(url).toContain("page=1");
-		expect(init.headers).toMatchObject({
-			Authorization: "Bearer ik_test_token",
-		});
-	});
-
-	it("walks every page so accounts with many domains keep all their zones", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikPage([{ id: 1, customer_name: "a.com" }], 1, 3))
-			.mockResolvedValueOnce(ikPage([{ id: 2, customer_name: "b.com" }], 2, 3))
-			.mockResolvedValueOnce(ikPage([{ id: 3, customer_name: "c.com" }], 3, 3));
-
-		const zones = await infomaniakClient.listZones(config);
-
-		expect(zones.map((zone) => zone.name)).toEqual(["a.com", "b.com", "c.com"]);
-		expect(mockFetch).toHaveBeenCalledTimes(3);
-		expect((mockFetch.mock.calls[2] as [string])[0]).toContain("page=3");
-	});
-
-	it("stops after a single page when the response has no pagination", async () => {
-		mockFetch.mockResolvedValue(ikSuccess([{ id: 1, customer_name: "a.com" }]));
-
-		const zones = await infomaniakClient.listZones(config);
-
-		expect(zones).toEqual([{ id: "a.com", name: "a.com" }]);
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-	});
-
-	it("propagates the API error description", async () => {
-		mockFetch.mockResolvedValue(ikError("Authorization required", 401));
-
-		await expect(infomaniakClient.listZones(config)).rejects.toThrow(
-			"Authorization required",
-		);
-	});
-});
-
-describe("infomaniakClient.listRecords", () => {
-	it("rebuilds the fqdn from the relative source", async () => {
-		mockFetch.mockResolvedValue(
-			ikSuccess([
-				{ id: 10, type: "A", source: "app", target: "1.2.3.4", ttl: 300 },
-				{ id: 11, type: "A", source: "", target: "5.6.7.8", ttl: 600 },
-			]),
-		);
-
-		const records = await infomaniakClient.listRecords(config, "example.com");
-
-		expect(records).toEqual([
-			{
-				id: "10",
-				type: "A",
-				name: "app.example.com",
-				content: "1.2.3.4",
-				ttl: 300,
-			},
-			{
-				id: "11",
-				type: "A",
-				name: "example.com",
-				content: "5.6.7.8",
-				ttl: 600,
-			},
-		]);
-		expect(lastCall()[0]).toBe(
-			"https://api.infomaniak.com/2/zones/example.com/records?with=records_description",
-		);
-	});
-
-	it.each([".", "", "@"])("treats a %s source as the apex", async (source) => {
-		mockFetch.mockResolvedValue(
-			ikSuccess([{ id: 12, type: "A", source, target: "1.2.3.4", ttl: 300 }]),
-		);
-
-		const records = await infomaniakClient.listRecords(config, "example.com");
-
-		expect(records[0]?.name).toBe("example.com");
-	});
-
-	it("unquotes TXT targets", async () => {
-		mockFetch.mockResolvedValue(
-			ikSuccess([
-				{
-					id: 13,
-					type: "TXT",
-					source: "_acme-challenge",
-					target: '"token-value"',
-					ttl: 300,
-				},
-			]),
-		);
-
-		const records = await infomaniakClient.listRecords(config, "example.com");
-
-		expect(records[0]?.content).toBe("token-value");
-	});
-
-	it("leaves a CAA target untouched", async () => {
-		mockFetch.mockResolvedValue(
-			ikSuccess([
-				{
-					id: 14,
-					type: "CAA",
-					source: "",
-					target: '0 issue "letsencrypt.org"',
-					ttl: 300,
-				},
-			]),
-		);
-
-		const records = await infomaniakClient.listRecords(config, "example.com");
-
-		expect(records[0]?.content).toBe('0 issue "letsencrypt.org"');
-	});
-});
-
-describe("infomaniakClient.upsertRecord", () => {
-	it("creates the record when no matching source and type exists", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikSuccess([]))
-			.mockResolvedValueOnce(ikSuccess({ id: 42 }));
-
-		const result = await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-			ttl: 600,
-		});
-
-		expect(result).toEqual({ id: "42" });
-		const [url, init] = lastCall();
-		expect(url).toBe("https://api.infomaniak.com/2/zones/example.com/records");
-		expect(init.method).toBe("POST");
-		expect(lastBody()).toEqual({
-			type: "A",
-			source: "app",
-			target: "1.2.3.4",
-			ttl: 600,
-		});
-	});
-
-	it("updates the existing record when content matches", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				ikSuccess([
-					{ id: 7, type: "A", source: "app", target: "1.2.3.4", ttl: 300 },
-				]),
-			)
-			.mockResolvedValueOnce(ikSuccess({ id: 7 }));
-
-		const result = await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "7" });
-		const [url, init] = lastCall();
-		expect(url).toBe(
-			"https://api.infomaniak.com/2/zones/example.com/records/7",
-		);
-		expect(init.method).toBe("PUT");
-		expect(lastBody().ttl).toBe(300);
-	});
-
-	it("creates a new record when content differs from existing", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				ikSuccess([
-					{ id: 7, type: "A", source: "app", target: "1.1.1.1", ttl: 300 },
-				]),
-			)
-			.mockResolvedValueOnce(ikSuccess({ id: 50 }));
-
-		const result = await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "50" });
-		const [url, init] = lastCall();
-		expect(url).toBe("https://api.infomaniak.com/2/zones/example.com/records");
-		expect(init.method).toBe("POST");
-	});
-
-	it("writes a root dot as the source for an apex record and strips the trailing dot", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikSuccess([]))
-			.mockResolvedValueOnce(ikSuccess({ id: 43 }));
-
-		await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "example.com.",
-			content: "1.2.3.4",
-		});
-
-		expect(lastBody().source).toBe(".");
-	});
-
-	it.each([".", "", "@"])(
-		"matches an existing apex record stored with a %s source",
-		async (source) => {
-			mockFetch
-				.mockResolvedValueOnce(
-					ikSuccess([
-						{ id: 8, type: "A", source, target: "1.2.3.4", ttl: 3600 },
-					]),
-				)
-				.mockResolvedValueOnce(ikSuccess({ id: 8 }));
-
-			const result = await infomaniakClient.upsertRecord(config, {
-				zoneId: "example.com",
-				type: "A",
-				name: "example.com",
-				content: "1.2.3.4",
-			});
-
-			expect(result).toEqual({ id: "8" });
-			expect(lastCall()[1].method).toBe("PUT");
-		},
-	);
-
-	it("matches the existing apex record instead of creating a duplicate", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				ikSuccess([
-					{
-						id: 8,
-						type: "TXT",
-						source: ".",
-						target: '"v=spf1 -all"',
-						ttl: 3600,
-					},
-				]),
-			)
-			.mockResolvedValueOnce(ikSuccess({ id: 8 }));
-
-		const result = await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "TXT",
-			name: "example.com",
-			content: "v=spf1 -all",
-		});
-
-		expect(result).toEqual({ id: "8" });
-		const [url, init] = lastCall();
-		expect(init.method).toBe("PUT");
-		expect(url).toBe(
-			"https://api.infomaniak.com/2/zones/example.com/records/8",
-		);
-		expect(lastBody().target).toBe('"v=spf1 -all"');
-	});
-
-	it("quotes a TXT target on write", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikSuccess([]))
-			.mockResolvedValueOnce(ikSuccess({ id: 44 }));
-
-		await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "TXT",
-			name: "_acme-challenge.example.com",
-			content: "token-value",
-		});
-
-		expect(lastBody().target).toBe('"token-value"');
-	});
-
-	it("does not double-quote a TXT target that is already quoted", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikSuccess([]))
-			.mockResolvedValueOnce(ikSuccess({ id: 45 }));
-
-		await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "TXT",
-			name: "_acme-challenge.example.com",
-			content: '"token-value"',
-		});
-
-		expect(lastBody().target).toBe('"token-value"');
-	});
-
-	it("queries the API with a source and type filter instead of the whole zone", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikSuccess([]))
-			.mockResolvedValueOnce(ikSuccess({ id: 50 }));
-
-		await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		const [url] = mockFetch.mock.calls[0] as [string];
-		expect(url).toContain("filter%5Bsource%5D=app");
-		expect(url).toContain("filter%5Btypes%5D%5B%5D=A");
-	});
-
-	it("ignores a partial filter hit rather than overwriting a different record", async () => {
-		// filter[source] matches substrings: asking for "auto" also returns
-		// "autoconfig" and "autodiscover". Trusting it would overwrite one of them.
-		mockFetch
-			.mockResolvedValueOnce(
-				ikSuccess([
-					{
-						id: 61,
-						type: "CNAME",
-						source: "autoconfig",
-						target: "a.example.net",
-						ttl: 300,
-					},
-					{
-						id: 62,
-						type: "CNAME",
-						source: "autodiscover",
-						target: "b.example.net",
-						ttl: 300,
-					},
-				]),
-			)
-			.mockResolvedValueOnce(ikSuccess({ id: 63 }));
-
-		const result = await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "CNAME",
-			name: "auto.example.com",
-			content: "c.example.net",
-		});
-
-		expect(result).toEqual({ id: "63" });
-		expect(lastCall()[1].method).toBe("POST");
-	});
-});
-
-describe("infomaniakClient.updateRecord", () => {
-	it("updates the record and keeps its id", async () => {
-		mockFetch.mockResolvedValue(ikSuccess({ id: 7 }));
-
-		const result = await infomaniakClient.updateRecord(
-			config,
-			"example.com",
-			"7",
-			{
-				type: "CNAME",
-				name: "www.example.com",
-				content: "example.com",
-				ttl: 900,
-			},
-		);
-
-		expect(result).toEqual({ id: "7" });
-		const [url, init] = lastCall();
-		expect(url).toBe(
-			"https://api.infomaniak.com/2/zones/example.com/records/7",
-		);
-		expect(init.method).toBe("PUT");
-		expect(lastBody()).toEqual({
-			type: "CNAME",
-			source: "www",
-			target: "example.com",
-			ttl: 900,
-		});
-	});
-
-	it("falls back to the default ttl when none is provided", async () => {
-		mockFetch.mockResolvedValue(ikSuccess({ id: 7 }));
-
-		await infomaniakClient.updateRecord(config, "example.com", "7", {
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(lastBody().ttl).toBe(300);
-	});
-});
-
-describe("infomaniakClient.deleteRecord", () => {
-	it("deletes the record", async () => {
-		mockFetch.mockResolvedValue(ikSuccess(null));
-
-		await infomaniakClient.deleteRecord(config, "example.com", "7");
-
-		const [url, init] = lastCall();
-		expect(url).toBe(
-			"https://api.infomaniak.com/2/zones/example.com/records/7",
-		);
-		expect(init.method).toBe("DELETE");
-	});
-
-	it("propagates a delete failure", async () => {
-		mockFetch.mockResolvedValue(ikError("Record not found", 404));
-
-		await expect(
-			infomaniakClient.deleteRecord(config, "example.com", "7"),
-		).rejects.toThrow("Record not found");
-	});
-});
-
-describe("infomaniakClient.testConnection", () => {
-	it("resolves when the domain listing succeeds", async () => {
-		mockFetch.mockResolvedValue(ikSuccess([]));
-
-		await expect(
-			infomaniakClient.testConnection(config),
-		).resolves.toBeUndefined();
-	});
-
-	it("rejects on an invalid token", async () => {
-		mockFetch.mockResolvedValue(ikError("Authorization required", 401));
-
-		await expect(infomaniakClient.testConnection(config)).rejects.toThrow(
-			"Infomaniak: request to /1/products?service_name=domain&per_page=1 failed: Authorization required",
-		);
-	});
-});
@@ -1,642 +0,0 @@
-import { createHash } from "node:crypto";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockFetch = vi.fn();
-global.fetch = mockFetch as typeof fetch;
-
-import { ovhClient } from "@dokploy/server/utils/dns/ovh";
-
-const textResponse = (body: string, ok = true, status = 200) =>
-	({
-		ok,
-		status,
-		text: async () => body,
-	}) as Response;
-
-const ovhSuccess = (data: unknown) =>
-	textResponse(data === undefined ? "" : JSON.stringify(data));
-
-const ovhError = (message: string, status = 403) =>
-	textResponse(JSON.stringify({ message }), false, status);
-
-const SERVER_TIME = 1788268225;
-
-const config = {
-	providerType: "ovh" as const,
-	endpoint: "ovh-eu" as const,
-	applicationKey: "app-key",
-	applicationSecret: "app-secret",
-	consumerKey: "consumer-key",
-};
-
-// Each test uses a distinct endpoint so the module-level clock-skew cache, which
-// is keyed by base url, never leaks a measurement between them.
-let endpointCursor = 0;
-const endpoints = [
-	"ovh-eu",
-	"ovh-ca",
-	"ovh-us",
-	"kimsufi-eu",
-	"kimsufi-ca",
-	"soyoustart-eu",
-	"soyoustart-ca",
-] as const;
-const baseUrls: Record<(typeof endpoints)[number], string> = {
-	"ovh-eu": "https://eu.api.ovh.com/1.0",
-	"ovh-ca": "https://ca.api.ovh.com/1.0",
-	"ovh-us": "https://api.us.ovhcloud.com/1.0",
-	"kimsufi-eu": "https://eu.api.kimsufi.com/1.0",
-	"kimsufi-ca": "https://ca.api.kimsufi.com/1.0",
-	"soyoustart-eu": "https://eu.api.soyoustart.com/1.0",
-	"soyoustart-ca": "https://ca.api.soyoustart.com/1.0",
-};
-
-/** A config on a not-yet-used endpoint, so the first call always fetches /auth/time. */
-const freshConfig = () => {
-	const endpoint = endpoints[
-		endpointCursor % endpoints.length
-	] as (typeof endpoints)[number];
-	endpointCursor += 1;
-	return { ...config, endpoint, baseUrl: baseUrls[endpoint] };
-};
-
-/** Replies to /auth/time, then to each queued API response in order. */
-const mockApi = (...responses: Response[]) => {
-	let call = 0;
-	mockFetch.mockImplementation((url: string) => {
-		if (url.endsWith("/auth/time")) {
-			return Promise.resolve(textResponse(String(SERVER_TIME)));
-		}
-		const response = responses[call];
-		call += 1;
-		return Promise.resolve(response ?? ovhSuccess(null));
-	});
-};
-
-const apiCalls = () =>
-	mockFetch.mock.calls.filter(
-		([url]) => !(url as string).endsWith("/auth/time"),
-	) as [string, RequestInit][];
-
-beforeEach(() => {
-	mockFetch.mockReset();
-});
-
-describe("ovhClient request signing", () => {
-	it("signs the request with the API server clock, not the local one", async () => {
-		const { baseUrl, ...cfg } = freshConfig();
-		mockApi(ovhSuccess(["example.com"]));
-		vi.spyOn(Date, "now").mockReturnValue((SERVER_TIME - 120) * 1000);
-
-		await ovhClient.listZones(cfg);
-
-		const [url, init] = apiCalls()[0] as [string, RequestInit];
-		const headers = init.headers as Record<string, string>;
-		expect(url).toBe(`${baseUrl}/domain/zone`);
-		expect(headers["X-Ovh-Timestamp"]).toBe(String(SERVER_TIME));
-		expect(headers["X-Ovh-Application"]).toBe("app-key");
-		expect(headers["X-Ovh-Consumer"]).toBe("consumer-key");
-
-		const expected = createHash("sha1")
-			.update(
-				["app-secret", "consumer-key", "GET", url, "", SERVER_TIME].join("+"),
-			)
-			.digest("hex");
-		expect(headers["X-Ovh-Signature"]).toBe(`$1$${expected}`);
-
-		vi.restoreAllMocks();
-	});
-
-	it("signs a request body when one is sent", async () => {
-		const { baseUrl, ...cfg } = freshConfig();
-		mockApi(ovhSuccess([]), ovhSuccess({ id: 5 }), ovhSuccess(null));
-		vi.spyOn(Date, "now").mockReturnValue(SERVER_TIME * 1000);
-
-		await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		const [url, init] = apiCalls()[1] as [string, RequestInit];
-		const headers = init.headers as Record<string, string>;
-		const body = init.body as string;
-		expect(body).not.toBe("");
-		const expected = createHash("sha1")
-			.update(
-				["app-secret", "consumer-key", "POST", url, body, SERVER_TIME].join(
-					"+",
-				),
-			)
-			.digest("hex");
-		expect(headers["X-Ovh-Signature"]).toBe(`$1$${expected}`);
-
-		vi.restoreAllMocks();
-	});
-});
-
-describe("ovhClient.listZones", () => {
-	it("maps each zone name to a zone", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess(["example.com", "example.fr"]));
-
-		const zones = await ovhClient.listZones(cfg);
-
-		expect(zones).toEqual([
-			{ id: "example.com", name: "example.com" },
-			{ id: "example.fr", name: "example.fr" },
-		]);
-	});
-
-	it("names the missing root right when OVH refuses the zone listing", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhError("This call has not been granted", 403));
-
-		// A `GET /domain/zone/*` rule does not cover the bare `GET /domain/zone`,
-		// so the raw OVH message would send users looking in the wrong place.
-		await expect(ovhClient.listZones(cfg)).rejects.toThrow(
-			/missing the `GET \/domain\/zone` right/,
-		);
-	});
-
-	it("propagates the API error message", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhError("Invalid signature", 403));
-
-		await expect(ovhClient.listZones(cfg)).rejects.toThrow("Invalid signature");
-	});
-
-	it("returns only the configured zone without listing every zone", async () => {
-		const cfg = { ...freshConfig(), zone: "example.com" };
-		mockApi();
-
-		const zones = await ovhClient.listZones(cfg);
-
-		expect(zones).toEqual([{ id: "example.com", name: "example.com" }]);
-		expect(apiCalls()).toHaveLength(0);
-	});
-});
-
-describe("ovhClient.listRecords", () => {
-	it("resolves each id into a full record", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess([1, 2]),
-			ovhSuccess({
-				id: 1,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.2.3.4",
-				ttl: 600,
-			}),
-			ovhSuccess({
-				id: 2,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: null,
-				target: "5.6.7.8",
-				ttl: null,
-			}),
-		);
-
-		const records = await ovhClient.listRecords(cfg, "example.com");
-
-		expect(records).toEqual([
-			{
-				id: "1",
-				type: "A",
-				name: "app.example.com",
-				content: "1.2.3.4",
-				ttl: 600,
-			},
-			{
-				id: "2",
-				type: "A",
-				name: "example.com",
-				content: "5.6.7.8",
-				ttl: 0,
-			},
-		]);
-	});
-
-	it("keeps the records in the order of the returned ids", async () => {
-		const cfg = freshConfig();
-		const record = (id: number, subDomain: string) => ({
-			id,
-			zone: "example.com",
-			fieldType: "A",
-			subDomain,
-			target: `10.0.0.${id}`,
-			ttl: 60,
-		});
-		mockApi(
-			ovhSuccess([1, 2, 3, 4, 5]),
-			...[1, 2, 3, 4, 5].map((id) => ovhSuccess(record(id, `host${id}`))),
-		);
-
-		const records = await ovhClient.listRecords(cfg, "example.com");
-
-		expect(records.map((r) => r.id)).toEqual(["1", "2", "3", "4", "5"]);
-	});
-});
-
-describe("ovhClient.upsertRecord", () => {
-	it("creates the record then refreshes the zone", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess([]), ovhSuccess({ id: 9 }), ovhSuccess(null));
-
-		const result = await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-			ttl: 600,
-		});
-
-		expect(result).toEqual({ id: "9" });
-		const calls = apiCalls();
-		expect(calls[0]?.[0]).toContain(
-			"/domain/zone/example.com/record?fieldType=A&subDomain=app",
-		);
-		expect(calls[1]?.[1].method).toBe("POST");
-		expect(JSON.parse(calls[1]?.[1].body as string)).toEqual({
-			fieldType: "A",
-			subDomain: "app",
-			target: "1.2.3.4",
-			ttl: 600,
-		});
-		expect(calls[2]?.[0]).toContain("/domain/zone/example.com/refresh");
-		expect(calls[2]?.[1].method).toBe("POST");
-	});
-
-	it("updates the existing record when content matches", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess([4]),
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.2.3.4",
-				ttl: 60,
-			}),
-			ovhSuccess(null),
-			ovhSuccess(null),
-		);
-
-		const result = await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "4" });
-		const calls = apiCalls();
-		expect(calls[2]?.[0]).toContain("/domain/zone/example.com/record/4");
-		expect(calls[2]?.[1].method).toBe("PUT");
-		expect(calls[3]?.[0]).toContain("/refresh");
-	});
-
-	it("creates a new record when content differs from existing", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess([4]),
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess({ id: 10 }),
-			ovhSuccess(null),
-		);
-
-		const result = await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "5.6.7.8",
-		});
-
-		expect(result).toEqual({ id: "10" });
-		const calls = apiCalls();
-		expect(calls[2]?.[1].method).toBe("POST");
-		expect(calls[3]?.[0]).toContain("/refresh");
-	});
-
-	it("omits the ttl so OVH applies the zone default", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess([]), ovhSuccess({ id: 9 }), ovhSuccess(null));
-
-		await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(JSON.parse(apiCalls()[1]?.[1].body as string)).not.toHaveProperty(
-			"ttl",
-		);
-	});
-
-	it("writes an empty subDomain for the apex and strips the trailing dot", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess([]), ovhSuccess({ id: 9 }), ovhSuccess(null));
-
-		await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "example.com.",
-			content: "1.2.3.4",
-		});
-
-		expect(apiCalls()[0]?.[0]).toContain("subDomain=");
-		expect(JSON.parse(apiCalls()[1]?.[1].body as string).subDomain).toBe("");
-	});
-});
-
-describe("ovhClient.updateRecord", () => {
-	it("updates in place when the type is unchanged", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess(null),
-			ovhSuccess(null),
-		);
-
-		const result = await ovhClient.updateRecord(cfg, "example.com", "4", {
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-			ttl: 300,
-		});
-
-		expect(result).toEqual({ id: "4" });
-		const calls = apiCalls();
-		expect(calls[1]?.[1].method).toBe("PUT");
-		expect(JSON.parse(calls[1]?.[1].body as string)).toEqual({
-			subDomain: "app",
-			target: "1.2.3.4",
-			ttl: 300,
-		});
-		expect(calls[2]?.[0]).toContain("/refresh");
-	});
-
-	it("replaces the record when the type changes, since PUT carries no fieldType", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess(null),
-			ovhSuccess({ id: 11 }),
-			ovhSuccess(null),
-		);
-
-		const result = await ovhClient.updateRecord(cfg, "example.com", "4", {
-			type: "CNAME",
-			name: "app.example.com",
-			content: "example.com",
-		});
-
-		expect(result).toEqual({ id: "11" });
-		const calls = apiCalls();
-		expect(calls[1]?.[1].method).toBe("DELETE");
-		expect(calls[2]?.[1].method).toBe("POST");
-		expect(JSON.parse(calls[2]?.[1].body as string).fieldType).toBe("CNAME");
-		expect(calls[3]?.[0]).toContain("/refresh");
-	});
-
-	it("restores the original record when the replacement fails", async () => {
-		const cfg = freshConfig();
-		const original = {
-			id: 4,
-			zone: "example.com",
-			fieldType: "A",
-			subDomain: "app",
-			target: "1.1.1.1",
-			ttl: 60,
-		};
-		mockApi(
-			ovhSuccess(original),
-			ovhSuccess(null),
-			ovhError("Invalid target", 400),
-			ovhSuccess({ id: 12 }),
-			ovhSuccess(null),
-		);
-
-		await expect(
-			ovhClient.updateRecord(cfg, "example.com", "4", {
-				type: "CNAME",
-				name: "app.example.com",
-				content: "not a valid target",
-			}),
-		).rejects.toThrow("Invalid target");
-
-		const calls = apiCalls();
-		expect(calls[1]?.[1].method).toBe("DELETE");
-		expect(calls[2]?.[1].method).toBe("POST");
-		// The original record is put back with its own type, target and ttl.
-		expect(JSON.parse(calls[3]?.[1].body as string)).toEqual({
-			fieldType: "A",
-			subDomain: "app",
-			target: "1.1.1.1",
-			ttl: 60,
-		});
-		expect(calls[4]?.[0]).toContain("/refresh");
-	});
-
-	it("reports the lost record when the restore also fails", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess(null),
-			ovhError("Invalid target", 400),
-			ovhError("Service unavailable", 503),
-		);
-
-		await expect(
-			ovhClient.updateRecord(cfg, "example.com", "4", {
-				type: "CNAME",
-				name: "app.example.com",
-				content: "not a valid target",
-			}),
-		).rejects.toThrow(
-			/Recreate it manually: A app\.example\.com -> 1\.1\.1\.1/,
-		);
-	});
-
-	it("says the change was applied when only the zone refresh fails", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess(null),
-			ovhSuccess({ id: 11 }),
-			ovhError("Service unavailable", 503),
-		);
-
-		// The replacement succeeded, so the record exists at the provider — only
-		// publishing failed. Rolling back would destroy correct state.
-		await expect(
-			ovhClient.updateRecord(cfg, "example.com", "4", {
-				type: "CNAME",
-				name: "app.example.com",
-				content: "example.com",
-			}),
-		).rejects.toThrow(/was applied, but refreshing zone "example\.com" failed/);
-	});
-
-	it("does not tell the user to recreate a record that was restored but not published", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess(null), // DELETE de l'ancien
-			ovhError("Invalid target", 400), // POST de remplacement -> échec
-			ovhSuccess({ id: 12 }), // POST de restauration -> succès
-			ovhError("Service unavailable", 503), // refresh -> échec
-		);
-
-		const attempt = ovhClient.updateRecord(cfg, "example.com", "4", {
-			type: "CNAME",
-			name: "app.example.com",
-			content: "not a valid target",
-		});
-
-		// L'enregistrement existe de nouveau chez OVH : le recréer le dupliquerait.
-		await expect(attempt).rejects.toThrow(/was restored, but refreshing zone/);
-		await expect(attempt).rejects.not.toThrow(/Recreate it manually/);
-	});
-});
-
-describe("ovhClient.deleteRecord", () => {
-	it("deletes the record then refreshes the zone", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess(null), ovhSuccess(null));
-
-		await ovhClient.deleteRecord(cfg, "example.com", "4");
-
-		const calls = apiCalls();
-		expect(calls[0]?.[0]).toContain("/domain/zone/example.com/record/4");
-		expect(calls[0]?.[1].method).toBe("DELETE");
-		expect(calls[1]?.[0]).toContain("/domain/zone/example.com/refresh");
-	});
-
-	it("does not refresh the zone when the delete fails", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhError("This object does not exist", 404));
-
-		await expect(
-			ovhClient.deleteRecord(cfg, "example.com", "4"),
-		).rejects.toThrow("This object does not exist");
-		expect(apiCalls()).toHaveLength(1);
-	});
-});
-
-describe("ovhClient.testConnection", () => {
-	it("resolves when the zone listing succeeds", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess([]));
-
-		await expect(ovhClient.testConnection(cfg)).resolves.toBeUndefined();
-	});
-
-	it("rejects on invalid credentials", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhError("Invalid signature", 403));
-
-		await expect(ovhClient.testConnection(cfg)).rejects.toThrow(
-			"Invalid signature",
-		);
-	});
-
-	it("checks the configured zone instead of listing all zones", async () => {
-		const cfg = { ...freshConfig(), zone: "example.com" };
-		mockApi(ovhSuccess({ name: "example.com" }));
-
-		await expect(ovhClient.testConnection(cfg)).resolves.toBeUndefined();
-
-		const calls = apiCalls();
-		expect(calls).toHaveLength(1);
-		expect(calls[0]?.[0]).toBe(`${cfg.baseUrl}/domain/zone/example.com`);
-	});
-});
-
-describe("ovhClient with a configured zone", () => {
-	const record = {
-		type: "A" as const,
-		name: "app.other.org",
-		content: "1.2.3.4",
-	};
-
-	it("refuses record operations on any other zone without calling OVH", async () => {
-		const cfg = { ...freshConfig(), zone: "example.com" };
-		mockApi();
-
-		const message = /restricted to the zone "example.com"/;
-		await expect(ovhClient.listRecords(cfg, "other.org")).rejects.toThrow(
-			message,
-		);
-		await expect(
-			ovhClient.upsertRecord(cfg, { ...record, zoneId: "other.org" }),
-		).rejects.toThrow(message);
-		await expect(
-			ovhClient.updateRecord(cfg, "other.org", "1", record),
-		).rejects.toThrow(message);
-		await expect(ovhClient.deleteRecord(cfg, "other.org", "1")).rejects.toThrow(
-			message,
-		);
-		expect(apiCalls()).toHaveLength(0);
-	});
-
-	it("still allows operations on the configured zone", async () => {
-		const cfg = { ...freshConfig(), zone: "example.com" };
-		mockApi(ovhSuccess(null), ovhSuccess(null));
-
-		await expect(
-			ovhClient.deleteRecord(cfg, "example.com", "1"),
-		).resolves.toBeUndefined();
-		expect(apiCalls()[0]?.[0]).toBe(
-			`${cfg.baseUrl}/domain/zone/example.com/record/1`,
-		);
-	});
-});
@@ -121,11 +121,9 @@ describe("porkbunClient.upsertRecord", () => {
 		expect(lookupUrl).toContain("/dns/retrieveByNameType/example.com/A/");
 	});

-	it("edits the existing record when content matches", async () => {
+	it("edits the existing record instead of creating a duplicate", async () => {
 		mockFetch
-			.mockResolvedValueOnce(
-				pbSuccess({ records: [{ id: "existing-1", content: "5.6.7.8" }] }),
-			)
+			.mockResolvedValueOnce(pbSuccess({ records: [{ id: "existing-1" }] }))
 			.mockResolvedValueOnce(pbSuccess({}));

 		const result = await porkbunClient.upsertRecord(config, {
@@ -140,30 +138,6 @@ describe("porkbunClient.upsertRecord", () => {
 		expect(editUrl).toContain("/dns/edit/example.com/existing-1");
 	});

-	it("creates a new record when content differs from existing", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				pbSuccess({ records: [{ id: "existing-1", content: "1.1.1.1" }] }),
-			)
-			.mockResolvedValueOnce(pbSuccess({ id: "new-2" }));
-
-		const result = await porkbunClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "5.6.7.8",
-		});
-
-		expect(result).toEqual({ id: "new-2" });
-		const [createUrl, createInit] = mockFetch.mock.calls[1] as [
-			string,
-			RequestInit,
-		];
-		expect(createUrl).toContain("/dns/create/example.com");
-		const body = JSON.parse(createInit.body as string);
-		expect(body).toMatchObject({ name: "app", type: "A", content: "5.6.7.8" });
-	});
-
 	it("defaults ttl to 600 when not provided", async () => {
 		mockFetch
 			.mockResolvedValueOnce(pbSuccess({ records: [] }))
@@ -111,54 +111,6 @@ describe("route53Client.listRecords", () => {
 		]);
 	});

-	it("decodes octal escapes such as \\052 for wildcard names", async () => {
-		send.mockResolvedValueOnce({
-			ResourceRecordSets: [
-				{
-					Name: "\\052.example.com.",
-					Type: "A",
-					TTL: 300,
-					ResourceRecords: [{ Value: "1.2.3.4" }],
-				},
-			],
-			IsTruncated: false,
-		});
-
-		const records = await route53Client.listRecords(config, "Z123");
-
-		expect(records[0]).toMatchObject({
-			id: "A:*.example.com",
-			name: "*.example.com",
-		});
-	});
-
-	it("keeps escaped dots so they stay distinct from label separators", async () => {
-		send.mockResolvedValueOnce({
-			ResourceRecordSets: [
-				{
-					Name: "a\\056b.example.com.",
-					Type: "A",
-					TTL: 300,
-					ResourceRecords: [{ Value: "1.2.3.4" }],
-				},
-				{
-					Name: "a.b.example.com.",
-					Type: "A",
-					TTL: 300,
-					ResourceRecords: [{ Value: "5.6.7.8" }],
-				},
-			],
-			IsTruncated: false,
-		});
-
-		const records = await route53Client.listRecords(config, "Z123");
-
-		expect(records.map((r) => r.id)).toEqual([
-			"A:a\\056b.example.com",
-			"A:a.b.example.com",
-		]);
-	});
-
 	it("skips record sets with no ResourceRecords (e.g. alias targets)", async () => {
 		send.mockResolvedValueOnce({
 			ResourceRecordSets: [
@@ -403,24 +355,6 @@ describe("route53Client.deleteRecord", () => {
 		]);
 	});

-	it("finds a wildcard record set that Route53 returns escaped", async () => {
-		const existingSet = {
-			Name: "\\052.example.com.",
-			Type: "A",
-			TTL: 300,
-			ResourceRecords: [{ Value: "1.2.3.4" }],
-		};
-		send.mockResolvedValueOnce({ ResourceRecordSets: [existingSet] });
-		send.mockResolvedValueOnce({});
-
-		await route53Client.deleteRecord(config, "Z123", "A:*.example.com");
-
-		const changeCommand = send.mock.calls[1]?.[0] as HasInput;
-		expect(changeCommand.input.ChangeBatch.Changes).toEqual([
-			{ Action: "DELETE", ResourceRecordSet: existingSet },
-		]);
-	});
-
 	it("throws when the record no longer exists", async () => {
 		send.mockResolvedValueOnce({ ResourceRecordSets: [] });

@@ -1,149 +0,0 @@
-import os from "node:os";
-import {
-	getServerIpCandidates,
-	validateDomain,
-} from "@dokploy/server/services/domain";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	execAsyncRemote: vi.fn(),
-	findServerById: vi.fn(),
-	getPublicIpWithFallback: vi.fn(),
-	getWebServerSettings: vi.fn(),
-	resolve4: vi.fn(),
-	resolve6: vi.fn(),
-}));
-
-vi.mock("node:dns", () => ({
-	default: {
-		resolve4: mocks.resolve4,
-		resolve6: mocks.resolve6,
-	},
-}));
-
-vi.mock("@dokploy/server/utils/process/execAsync", () => ({
-	execAsyncRemote: mocks.execAsyncRemote,
-}));
-
-vi.mock("@dokploy/server/services/server", () => ({
-	findServerById: mocks.findServerById,
-}));
-
-vi.mock("@dokploy/server/services/web-server-settings", () => ({
-	getWebServerSettings: mocks.getWebServerSettings,
-}));
-
-vi.mock("@dokploy/server/wss/utils", () => ({
-	getPublicIpWithFallback: mocks.getPublicIpWithFallback,
-}));
-
-describe("getServerIpCandidates", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-	});
-
-	afterEach(() => {
-		vi.restoreAllMocks();
-		vi.useRealTimers();
-	});
-
-	it("includes every address reported by a multi-homed remote server", async () => {
-		mocks.findServerById.mockResolvedValue({
-			ipAddress: "10.0.0.10",
-		});
-		mocks.execAsyncRemote.mockResolvedValue({
-			stdout: ["10.0.0.10", "192.0.2.10", "2001:db8::10"].join("\n"),
-			stderr: "",
-		});
-
-		await expect(getServerIpCandidates("server-id")).resolves.toEqual([
-			"10.0.0.10",
-			"192.0.2.10",
-			"2001:db8::10",
-		]);
-		expect(mocks.execAsyncRemote).toHaveBeenCalledWith(
-			"server-id",
-			expect.stringContaining("ip -o addr show scope global"),
-		);
-	});
-
-	it("includes every address assigned to the local Dokploy host", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			serverIp: "10.0.0.10",
-		});
-		mocks.getPublicIpWithFallback.mockResolvedValue("2001:db8::10");
-		vi.spyOn(os, "networkInterfaces").mockReturnValue({
-			eth0: [
-				{
-					address: "192.0.2.10",
-					netmask: "255.255.255.0",
-					family: "IPv4",
-					mac: "00:00:00:00:00:00",
-					internal: false,
-					cidr: "192.0.2.10/24",
-				},
-			],
-		});
-
-		await expect(getServerIpCandidates()).resolves.toEqual([
-			"10.0.0.10",
-			"192.0.2.10",
-			"2001:db8::10",
-		]);
-	});
-
-	it("retains remote interface addresses when public IP detection times out", async () => {
-		vi.useFakeTimers();
-		mocks.findServerById.mockResolvedValue({
-			ipAddress: "10.0.0.10",
-		});
-		mocks.execAsyncRemote.mockImplementation(
-			(_serverId: string, command: string) => {
-				if (command.includes("curl")) {
-					return new Promise(() => undefined);
-				}
-				return Promise.resolve({
-					stdout: "192.0.2.10\n",
-					stderr: "",
-				});
-			},
-		);
-
-		const candidatesPromise = getServerIpCandidates("server-id");
-		await vi.advanceTimersByTimeAsync(7000);
-
-		await expect(candidatesPromise).resolves.toEqual([
-			"10.0.0.10",
-			"192.0.2.10",
-		]);
-	});
-});
-
-describe("validateDomain", () => {
-	afterEach(() => {
-		vi.clearAllMocks();
-	});
-
-	it("validates an IPv6-only domain against an IPv6 server address", async () => {
-		const noIpv4 = Object.assign(new Error("queryA ENODATA example.com"), {
-			code: "ENODATA",
-		});
-		mocks.resolve4.mockImplementation(
-			(_domain: string, callback: (error: Error | null) => void) =>
-				callback(noIpv4),
-		);
-		mocks.resolve6.mockImplementation(
-			(
-				_domain: string,
-				callback: (error: Error | null, addresses?: string[]) => void,
-			) => callback(null, ["2001:db8::10"]),
-		);
-
-		await expect(
-			validateDomain("example.com", ["2001:db8::10"]),
-		).resolves.toMatchObject({
-			isValid: true,
-			resolvedIp: "2001:db8::10",
-		});
-	});
-});
@@ -1,195 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-type HasInput = { input: Record<string, unknown> };
-
-const findMany = vi.hoisted(() => vi.fn());
-
-const {
-	send,
-	paginate,
-	SSMClient,
-	GetParametersCommand,
-	DescribeParametersCommand,
-} = vi.hoisted(() => {
-	class FakeCommand {
-		input: Record<string, unknown>;
-		constructor(input: Record<string, unknown>) {
-			this.input = input;
-		}
-	}
-	const send = vi.fn();
-	const paginate = vi.fn();
-	class SSMClient {
-		send(command: unknown) {
-			return send(command);
-		}
-	}
-	return {
-		send,
-		paginate,
-		SSMClient,
-		GetParametersCommand: class extends FakeCommand {},
-		DescribeParametersCommand: class extends FakeCommand {},
-	};
-});
-
-vi.mock("@aws-sdk/client-ssm", () => ({
-	SSMClient,
-	GetParametersCommand,
-	DescribeParametersCommand,
-	paginateDescribeParameters: paginate,
-}));
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: {
-			vaultProvider: {
-				findMany: (...args: unknown[]) => findMany(...args),
-			},
-		},
-	},
-}));
-
-import { resolveVaultReferences } from "@dokploy/server/utils/vault";
-import { awsParameterStoreClient } from "@dokploy/server/utils/vault/aws-parameter-store";
-
-const config = {
-	providerType: "aws-parameter-store" as const,
-	region: "eu-central-1",
-	accessKeyId: "AKIA_TEST",
-	secretAccessKey: "secret",
-};
-
-beforeEach(() => {
-	send.mockReset();
-	paginate.mockReset();
-	findMany.mockReset();
-});
-
-describe("awsParameterStoreClient", () => {
-	it("decrypts parameters in batches of ten and preserves selectors", async () => {
-		const refs = [
-			"/prod/database:CURRENT",
-			...Array.from({ length: 10 }, (_, index) => `/prod/secret-${index}`),
-		];
-		send.mockImplementation(async (command: HasInput) => ({
-			Parameters: (command.input.Names as string[]).map((ref) => {
-				if (ref === "/prod/database:CURRENT") {
-					return {
-						Name: "/prod/database",
-						Selector: ":CURRENT",
-						Value: "selected-value",
-					};
-				}
-				return { Name: ref, Value: `value-for-${ref}` };
-			}),
-		}));
-
-		const result = await awsParameterStoreClient.getSecrets(config, refs);
-
-		expect(send).toHaveBeenCalledTimes(2);
-		expect((send.mock.calls[0]?.[0] as HasInput).input).toMatchObject({
-			WithDecryption: true,
-		});
-		expect(
-			((send.mock.calls[0]?.[0] as HasInput).input.Names as string[]).length,
-		).toBe(10);
-		expect(
-			((send.mock.calls[1]?.[0] as HasInput).input.Names as string[]).length,
-		).toBe(1);
-		expect(result["/prod/database:CURRENT"]).toBe("selected-value");
-		expect(result["/prod/secret-9"]).toBe("value-for-/prod/secret-9");
-	});
-
-	it("reports a missing parameter without exposing other values", async () => {
-		send.mockResolvedValue({ Parameters: [], InvalidParameters: ["/missing"] });
-
-		await expect(
-			awsParameterStoreClient.getSecrets(config, ["/missing"]),
-		).rejects.toThrow('AWS Parameter Store: parameter "/missing" not found');
-	});
-
-	it("tests the connection within the configured hierarchy", async () => {
-		send.mockResolvedValue({ Parameters: [] });
-
-		await awsParameterStoreClient.testConnection({
-			...config,
-			parameterPath: "/production/my-app/",
-		});
-
-		expect(send).toHaveBeenCalledTimes(1);
-		expect((send.mock.calls[0]?.[0] as HasInput).input).toEqual({
-			ParameterFilters: [
-				{
-					Key: "Path",
-					Option: "Recursive",
-					Values: ["/production/my-app"],
-				},
-			],
-			MaxResults: 1,
-		});
-	});
-
-	it("explains the discovery permission when connection testing is denied", async () => {
-		const error = new Error("not authorized");
-		error.name = "AccessDeniedException";
-		send.mockRejectedValue(error);
-
-		await expect(
-			awsParameterStoreClient.testConnection(config),
-		).rejects.toThrow("ssm:DescribeParameters");
-	});
-
-	it("lists parameter names across pages within the configured hierarchy", async () => {
-		paginate.mockReturnValue(
-			(async function* () {
-				yield { Parameters: [{ Name: "/prod/db" }] };
-				yield { Parameters: [{ Name: "/prod/api" }] };
-			})(),
-		);
-
-		const names = await awsParameterStoreClient.listSecretNames?.({
-			...config,
-			parameterPath: " /production/my-app/ ",
-		});
-
-		expect(names).toEqual(["/prod/db", "/prod/api"]);
-		expect(paginate).toHaveBeenCalledWith(
-			expect.objectContaining({ pageSize: 50 }),
-			{
-				ParameterFilters: [
-					{
-						Key: "Path",
-						Option: "Recursive",
-						Values: ["/production/my-app"],
-					},
-				],
-			},
-		);
-	});
-
-	it("resolves a vault reference through the registered provider", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "ssm-prod",
-				providerType: "aws-parameter-store",
-				config,
-				assignments: [{ projectId: "project-1", environmentIds: [] }],
-			},
-		]);
-		send.mockResolvedValue({
-			Parameters: [{ Name: "/prod/database-password", Value: "resolved" }],
-		});
-
-		const result = await resolveVaultReferences(
-			"DB_PASSWORD=${{vault.ssm-prod./prod/database-password}}",
-			{
-				organizationId: "organization-1",
-				projectId: "project-1",
-				environmentId: "environment-1",
-			},
-		);
-
-		expect(result).toBe("DB_PASSWORD=resolved");
-	});
-});
@@ -20,7 +20,6 @@ import {
 import { azureClient } from "@dokploy/server/utils/vault/azure";
 import { dopplerClient } from "@dokploy/server/utils/vault/doppler";
 import { hashicorpClient } from "@dokploy/server/utils/vault/hashicorp";
-import { infisicalClient } from "@dokploy/server/utils/vault/infisical";
 import { phaseClient } from "@dokploy/server/utils/vault/phase";
 import { scalewayClient } from "@dokploy/server/utils/vault/scaleway";

@@ -432,223 +431,6 @@ describe("azure client", () => {
 	});
 });

-describe("infisical client", () => {
-	const config = {
-		providerType: "infisical" as const,
-		siteUrl: "https://app.infisical.com",
-		clientId: "client-1",
-		clientSecret: "client-secret",
-		projectId: "workspace-1",
-		environmentSlug: "prod",
-		secretPath: "/frontend",
-	};
-
-	const loginResponse = () => jsonResponse({ accessToken: "token-1" });
-	const list = (secrets: Record<string, string>) =>
-		jsonResponse({
-			secrets: Object.entries(secrets).map(([secretKey, secretValue]) => ({
-				secretKey,
-				secretValue,
-			})),
-		});
-	const listPathOf = (callIndex: number) => {
-		const [url] = mockFetch.mock.calls[callIndex] as [string];
-		return new URL(url).searchParams.get("secretPath");
-	};
-
-	it("asks the list endpoint to expand secret references", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(list({ DB_URL: "postgres://real" }));
-
-		const result = await infisicalClient.getSecrets(config, ["DB_URL"]);
-
-		expect(result).toEqual({ DB_URL: "postgres://real" });
-		const [listUrl] = mockFetch.mock.calls[1] as [string];
-		const params = new URL(listUrl).searchParams;
-		expect(params.get("expandSecretReferences")).toBe("true");
-		expect(params.get("workspaceId")).toBe("workspace-1");
-		expect(params.get("environment")).toBe("prod");
-		expect(params.get("secretPath")).toBe("/frontend");
-	});
-
-	it("asks for imported secrets and merges them", async () => {
-		mockFetch.mockResolvedValueOnce(loginResponse()).mockResolvedValueOnce(
-			jsonResponse({
-				secrets: [],
-				imports: [
-					{
-						secretPath: "/shared",
-						secrets: [
-							{ secretKey: "DB_URL", secretValue: "postgres://imported" },
-						],
-					},
-				],
-			}),
-		);
-
-		const result = await infisicalClient.getSecrets(config, ["DB_URL"]);
-
-		expect(result).toEqual({ DB_URL: "postgres://imported" });
-		const [listUrl] = mockFetch.mock.calls[1] as [string];
-		// snake_case on purpose: `includeImports` is silently ignored and the
-		// response comes back with an empty `imports` array.
-		expect(new URL(listUrl).searchParams.get("include_imports")).toBe("true");
-	});
-
-	it("lets the later import win when two define the same key", async () => {
-		mockFetch.mockResolvedValueOnce(loginResponse()).mockResolvedValueOnce(
-			jsonResponse({
-				secrets: [],
-				imports: [
-					{
-						secretPath: "/base",
-						secrets: [{ secretKey: "DB_URL", secretValue: "postgres://base" }],
-					},
-					{
-						secretPath: "/override",
-						secrets: [
-							{ secretKey: "DB_URL", secretValue: "postgres://override" },
-						],
-					},
-				],
-			}),
-		);
-
-		const result = await infisicalClient.getSecrets(config, ["DB_URL"]);
-
-		// Infisical documents this order: "If two imports carry a secret with the
-		// same name, the value from the bottom-most import wins." The response
-		// lists imports in that order, so assigning them in sequence matches it.
-		expect(result).toEqual({ DB_URL: "postgres://override" });
-	});
-
-	it("lets a folder's own secret win over an imported one of the same name", async () => {
-		mockFetch.mockResolvedValueOnce(loginResponse()).mockResolvedValueOnce(
-			jsonResponse({
-				secrets: [{ secretKey: "DB_URL", secretValue: "postgres://local" }],
-				imports: [
-					{
-						secretPath: "/shared",
-						secrets: [
-							{ secretKey: "DB_URL", secretValue: "postgres://imported" },
-						],
-					},
-				],
-			}),
-		);
-
-		const result = await infisicalClient.getSecrets(config, ["DB_URL"]);
-
-		expect(result).toEqual({ DB_URL: "postgres://local" });
-	});
-
-	it("throws a clear error for a missing secret", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(jsonResponse({ secrets: [] }));
-
-		await expect(
-			infisicalClient.getSecrets(config, ["ABSENT"]),
-		).rejects.toThrow('secret "ABSENT" not found in environment "prod"');
-	});
-
-	it("propagates authentication failures with the status code", async () => {
-		mockFetch.mockResolvedValueOnce(jsonResponse({}, false, 401));
-
-		await expect(
-			infisicalClient.getSecrets(config, ["DB_URL"]),
-		).rejects.toThrow("authentication failed (status 401)");
-	});
-
-	it("resolves a relative <path>:<KEY> ref against the provider path", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(list({ SENTRY_DSN: "https://key@sentry.io/1" }));
-
-		const result = await infisicalClient.getSecrets(config, [
-			"shared/sentry:SENTRY_DSN",
-		]);
-
-		expect(result).toEqual({
-			"shared/sentry:SENTRY_DSN": "https://key@sentry.io/1",
-		});
-		expect(listPathOf(1)).toBe("/frontend/shared/sentry");
-	});
-
-	it("treats a leading slash as an absolute path", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(list({ SENTRY_DSN: "https://key@sentry.io/1" }));
-
-		await infisicalClient.getSecrets(config, ["/external/sentry:SENTRY_DSN"]);
-
-		expect(listPathOf(1)).toBe("/external/sentry");
-	});
-
-	it("keeps the root path clean when the provider sits at /", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(list({ KEY: "value" }));
-
-		await infisicalClient.getSecrets({ ...config, secretPath: "/" }, [
-			"external/sentry:KEY",
-		]);
-
-		expect(listPathOf(1)).toBe("/external/sentry");
-	});
-
-	it("logs in once and fetches each path once", async () => {
-		const byPath: Record<string, Record<string, string>> = {
-			"/frontend": { A: "a", B: "b" },
-			"/frontend/other": { C: "c" },
-		};
-		mockFetch.mockImplementation(async (url: string) => {
-			if (url.includes("/auth/universal-auth/login")) return loginResponse();
-			const path = new URL(url).searchParams.get("secretPath") as string;
-			return list(byPath[path] ?? {});
-		});
-
-		const result = await infisicalClient.getSecrets(config, [
-			"A",
-			"B",
-			"other:C",
-		]);
-
-		expect(result).toEqual({ A: "a", B: "b", "other:C": "c" });
-
-		const urls = mockFetch.mock.calls.map(([url]) => url as string);
-		expect(urls.filter((u) => u.includes("/login"))).toHaveLength(1);
-		expect(
-			urls
-				.filter((u) => u.includes("/secrets/raw?"))
-				.map((u) => new URL(u).searchParams.get("secretPath"))
-				.sort(),
-		).toEqual(["/frontend", "/frontend/other"]);
-	});
-
-	it("names the path when a secret is missing from an explicit one", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(list({}));
-
-		await expect(
-			infisicalClient.getSecrets(config, ["external/sentry:ABSENT"]),
-		).rejects.toThrow(
-			'secret "ABSENT" not found at "/frontend/external/sentry"',
-		);
-	});
-
-	it("rejects a ref with an empty path or key", async () => {
-		await expect(infisicalClient.getSecrets(config, [":KEY"])).rejects.toThrow(
-			"expected format <path>:<KEY>",
-		);
-		await expect(
-			infisicalClient.getSecrets(config, ["external/sentry:"]),
-		).rejects.toThrow("expected format <path>:<KEY>");
-	});
-});
-
 describe("doppler client", () => {
 	it("propagates auth errors with the status code", async () => {
 		mockFetch.mockResolvedValue(jsonResponse({}, false, 401));
@@ -1,99 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const store = vi.hoisted(() => ({
-	provider: {} as Record<string, unknown>,
-}));
-
-vi.mock("@dokploy/server/services/gitlab", () => ({
-	findGitlabById: vi.fn(async () => ({ ...store.provider })),
-	updateGitlab: vi.fn(async (_id: string, values: Record<string, unknown>) => {
-		store.provider = { ...store.provider, ...values };
-	}),
-}));
-
-const { refreshGitlabToken } = await import(
-	"@dokploy/server/utils/providers/gitlab"
-);
-
-const GITLAB_ID = "gitlab-1";
-
-// Behaves like GitLab: a refresh returns a new pair and invalidates the refresh token it used
-const createGitlab = () => {
-	let validRefreshToken = "refresh-1";
-	let issued = 1;
-	let failNext = false;
-
-	const fetch = vi.fn(async (_url: string, init: RequestInit) => {
-		const body = new URLSearchParams(init.body as string);
-		// Keeps the request open, so concurrent callers overlap as two deployments do
-		await new Promise((resolve) => setTimeout(resolve, 20));
-
-		if (failNext) {
-			failNext = false;
-			return new Response(null, {
-				status: 500,
-				statusText: "Internal Server Error",
-			});
-		}
-
-		if (body.get("refresh_token") !== validRefreshToken) {
-			return new Response(null, { status: 400, statusText: "Bad Request" });
-		}
-
-		issued++;
-		validRefreshToken = `refresh-${issued}`;
-		return Response.json({
-			access_token: `access-${issued}`,
-			refresh_token: validRefreshToken,
-			expires_in: 7200,
-		});
-	});
-
-	return {
-		fetch,
-		failNextRequest: () => {
-			failNext = true;
-		},
-	};
-};
-
-describe("refreshGitlabToken", () => {
-	let gitlab: ReturnType<typeof createGitlab>;
-
-	beforeEach(() => {
-		store.provider = {
-			gitlabId: GITLAB_ID,
-			gitlabUrl: "https://gitlab.example.com",
-			gitlabInternalUrl: null,
-			applicationId: "app-id",
-			secret: "app-secret",
-			accessToken: "access-1",
-			refreshToken: "refresh-1",
-			expiresAt: 0,
-		};
-		gitlab = createGitlab();
-		vi.stubGlobal("fetch", gitlab.fetch);
-	});
-
-	it("sends one refresh request when two callers find the token expired at the same time", async () => {
-		await Promise.all([
-			refreshGitlabToken(GITLAB_ID),
-			refreshGitlabToken(GITLAB_ID),
-		]);
-
-		expect(gitlab.fetch).toHaveBeenCalledTimes(1);
-		expect(store.provider.refreshToken).toBe("refresh-2");
-	});
-
-	it("refreshes again after a failed refresh", async () => {
-		gitlab.failNextRequest();
-
-		await expect(refreshGitlabToken(GITLAB_ID)).rejects.toThrow(
-			"Failed to refresh token: Internal Server Error",
-		);
-		await refreshGitlabToken(GITLAB_ID);
-
-		expect(gitlab.fetch).toHaveBeenCalledTimes(2);
-		expect(store.provider.refreshToken).toBe("refresh-2");
-	});
-});
@@ -1,46 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { isHttpsRequest, secureSetCookie } from "@/lib/secure-cookies";
-
-describe("isHttpsRequest", () => {
-	it("returns true when X-Forwarded-Proto is https", () => {
-		expect(isHttpsRequest("https")).toBe(true);
-	});
-
-	it("returns false for http or a missing header", () => {
-		expect(isHttpsRequest("http")).toBe(false);
-		expect(isHttpsRequest(undefined)).toBe(false);
-	});
-
-	it("uses the left-most value of a proxy chain", () => {
-		expect(isHttpsRequest("https, http")).toBe(true);
-		expect(isHttpsRequest("http, https")).toBe(false);
-	});
-
-	it("handles an array header value and is case-insensitive", () => {
-		expect(isHttpsRequest(["HTTPS", "http"])).toBe(true);
-	});
-});
-
-describe("secureSetCookie", () => {
-	it("adds Secure to a cookie that lacks it", () => {
-		expect(
-			secureSetCookie("better-auth.session_token=abc; Path=/; HttpOnly"),
-		).toBe("better-auth.session_token=abc; Path=/; HttpOnly; Secure");
-	});
-
-	it("does not duplicate Secure when already present", () => {
-		const cookie = "better-auth.session_token=abc; Path=/; Secure; HttpOnly";
-		expect(secureSetCookie(cookie)).toBe(cookie);
-	});
-
-	it("applies to every cookie in an array", () => {
-		expect(secureSetCookie(["a=1; Path=/", "b=2; Path=/; Secure"])).toEqual([
-			"a=1; Path=/; Secure",
-			"b=2; Path=/; Secure",
-		]);
-	});
-
-	it("passes a numeric header value through untouched", () => {
-		expect(secureSetCookie(123)).toBe(123);
-	});
-});
@@ -1,66 +0,0 @@
-import { apiCreateLibsql } from "@dokploy/server/db/schema";
-import { APP_NAME_MESSAGE } from "@dokploy/server/db/schema/utils";
-import { describe, expect, it } from "vitest";
-
-describe("apiCreateLibsql appName", () => {
-	const validBase = {
-		name: "My libSQL",
-		dockerImage: "ghcr.io/tursodatabase/libsql-server:v0.24.32",
-		environmentId: "env-1",
-		description: null,
-		databaseUser: "admin",
-		databasePassword: "secretPassword1",
-		sqldNode: "primary" as const,
-		sqldPrimaryUrl: null,
-		enableNamespaces: false,
-		serverId: null,
-	};
-
-	it.each([
-		["a space", "my libsql"],
-		["an at sign", "repro@lib"],
-		["a slash", "team/libsql"],
-		["a colon", "libsql:1"],
-	])("refuses an appName with %s", (_, appName) => {
-		const result = apiCreateLibsql.safeParse({ ...validBase, appName });
-		expect(result.success).toBe(false);
-		if (!result.success) {
-			const appNameIssues = result.error.issues.filter(
-				(issue) => issue.path[0] === "appName",
-			);
-			expect(appNameIssues.map((issue) => issue.message)).toEqual([
-				APP_NAME_MESSAGE,
-			]);
-		}
-	});
-
-	it("accepts an appName of letters, numbers, dots, underscores and hyphens", () => {
-		const result = apiCreateLibsql.safeParse({
-			...validBase,
-			appName: "my-libsql.db_1",
-		});
-		expect(result.success).toBe(true);
-	});
-
-	it("refuses an appName longer than 63 characters", () => {
-		const result = apiCreateLibsql.safeParse({
-			...validBase,
-			appName: "a".repeat(64),
-		});
-		expect(result.success).toBe(false);
-		if (!result.success) {
-			const appNameIssues = result.error.issues.filter(
-				(issue) => issue.path[0] === "appName",
-			);
-			expect(appNameIssues.map((issue) => issue.code)).toEqual(["too_big"]);
-		}
-	});
-
-	it("accepts an appName of 63 characters", () => {
-		const result = apiCreateLibsql.safeParse({
-			...validBase,
-			appName: "a".repeat(63),
-		});
-		expect(result.success).toBe(true);
-	});
-});
@@ -1,56 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	findOwnedOrganizations: vi.fn(),
-	transaction: vi.fn(),
-	removeVectorAgents: vi.fn(),
-	calls: [] as string[],
-}));
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: { organization: { findMany: mocks.findOwnedOrganizations } },
-		transaction: mocks.transaction,
-	},
-}));
-vi.mock("@dokploy/server/services/organization", () => ({
-	removeVectorAgents: mocks.removeVectorAgents,
-}));
-
-const { deleteUserAccountData } = await import(
-	"@dokploy/server/services/account-deletion"
-);
-
-beforeEach(() => {
-	mocks.calls.length = 0;
-	mocks.findOwnedOrganizations.mockReset();
-	mocks.removeVectorAgents
-		.mockReset()
-		.mockImplementation(async (id: string) => mocks.calls.push(`agents:${id}`));
-	mocks.transaction.mockReset().mockImplementation(async () => {
-		mocks.calls.push("delete");
-		return { email: "a@b.c", organizationsDeleted: 2 };
-	});
-});
-
-describe("deleteUserAccountData", () => {
-	it("removes the Vector agents of every owned organization before deleting the user", async () => {
-		mocks.findOwnedOrganizations.mockResolvedValue([
-			{ id: "org-a" },
-			{ id: "org-b" },
-		]);
-
-		await deleteUserAccountData("user-1");
-
-		expect(mocks.calls).toEqual(["agents:org-a", "agents:org-b", "delete"]);
-	});
-
-	it("deletes the user without touching agents when it owns no organization", async () => {
-		mocks.findOwnedOrganizations.mockResolvedValue([]);
-
-		await deleteUserAccountData("user-1");
-
-		expect(mocks.removeVectorAgents).not.toHaveBeenCalled();
-		expect(mocks.calls).toEqual(["delete"]);
-	});
-});
@@ -1,542 +0,0 @@
-import {
-	getTelemetryProviderAdapter,
-	telemetryProviderAdapters,
-} from "@dokploy/server/services/logs-and-metrics/providers/registry";
-import type { TelemetryProviderRuntimeConfig } from "@dokploy/server/services/logs-and-metrics/types";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-const aws = vi.hoisted(() => ({
-	describeLogGroups: vi.fn(),
-	putMetricData: vi.fn(),
-}));
-
-vi.mock("node:dns/promises", () => ({
-	lookup: async () => [{ address: "93.184.216.34" }],
-}));
-vi.mock("@aws-sdk/client-cloudwatch-logs", () => ({
-	CloudWatchLogsClient: class {
-		send = aws.describeLogGroups;
-	},
-	DescribeLogGroupsCommand: class {
-		constructor(public input: unknown) {}
-	},
-}));
-vi.mock("@aws-sdk/client-cloudwatch", () => ({
-	CloudWatchClient: class {
-		send = aws.putMetricData;
-	},
-	PutMetricDataCommand: class {
-		constructor(public input: unknown) {}
-	},
-}));
-
-const baseConfig: TelemetryProviderRuntimeConfig = {
-	telemetryProviderId: "provider-1",
-	name: "test",
-	signals: ["metrics"],
-	endpoint: null,
-	apiKey: null,
-	apiSecret: null,
-	extraConfig: null,
-};
-
-const originalFetch = global.fetch;
-const fetchMock = vi.fn();
-
-const respond = (status: number, body: unknown = "") =>
-	new Response(
-		status === 204
-			? null
-			: typeof body === "string"
-				? body
-				: JSON.stringify(body),
-		{ status },
-	);
-
-beforeEach(() => {
-	fetchMock.mockReset();
-	aws.describeLogGroups.mockReset();
-	aws.putMetricData.mockReset();
-	global.fetch = fetchMock as unknown as typeof fetch;
-});
-
-afterEach(() => {
-	global.fetch = originalFetch;
-});
-
-const calledUrls = () => fetchMock.mock.calls.map((call) => String(call[0]));
-
-describe("registry", () => {
-	it("resolves the nine provider types, each with a non-empty valid signal list", () => {
-		const types = [
-			"loki",
-			"prometheus_remote_write",
-			"new_relic",
-			"influxdb",
-			"datadog",
-			"aws_cloudwatch",
-			"splunk_hec",
-			"elasticsearch",
-			"betterstack",
-		] as const;
-		expect(Object.keys(telemetryProviderAdapters).sort()).toEqual(
-			[...types].sort(),
-		);
-		for (const type of types) {
-			const adapter = getTelemetryProviderAdapter(type);
-			expect(adapter.type).toBe(type);
-			expect(adapter.signals.length).toBeGreaterThan(0);
-			expect(
-				adapter.signals.every((s) => s === "logs" || s === "metrics"),
-			).toBe(true);
-		}
-		expect(telemetryProviderAdapters.loki.signals).toEqual(["logs"]);
-		expect(telemetryProviderAdapters.prometheus_remote_write.signals).toEqual([
-			"metrics",
-		]);
-		expect(telemetryProviderAdapters.datadog.signals).toEqual([
-			"logs",
-			"metrics",
-		]);
-	});
-});
-
-describe("prometheusRemoteWriteAdapter", () => {
-	const adapter = telemetryProviderAdapters.prometheus_remote_write;
-	const endpoint = "http://prom.example.com:9090/api/v1/write";
-
-	it("builds a sink without auth, with the healthcheck disabled", () => {
-		const sink = adapter.toVectorSink(
-			{ ...baseConfig, endpoint },
-			"sink_1",
-			"dokploy_metrics_scope",
-			"metrics",
-		);
-		expect(sink).toMatchObject({
-			type: "prometheus_remote_write",
-			inputs: ["dokploy_metrics_scope"],
-			endpoint,
-			healthcheck: { enabled: false },
-		});
-		expect(sink.auth).toBeUndefined();
-		expect(sink.tenant_id).toBeUndefined();
-	});
-
-	it("uses basic auth with a username, bearer with a token alone, and sets tenant_id", () => {
-		const basic = adapter.toVectorSink(
-			{
-				...baseConfig,
-				endpoint,
-				apiKey: "pw",
-				extraConfig: { username: "12345", tenantId: "team-a" },
-			},
-			"sink_1",
-			"scope",
-			"metrics",
-		);
-		expect(basic.auth).toEqual({
-			strategy: "basic",
-			user: "12345",
-			password: "pw",
-		});
-		expect(basic.tenant_id).toBe("team-a");
-
-		const bearer = adapter.toVectorSink(
-			{ ...baseConfig, endpoint, apiKey: "tok" },
-			"sink_1",
-			"scope",
-			"metrics",
-		);
-		expect(bearer.auth).toEqual({ strategy: "bearer", token: "tok" });
-	});
-
-	it("rejects an endpoint that is not an http(s) URL", () => {
-		expect(() =>
-			adapter.validateConfig?.({ ...baseConfig, endpoint: "not a url" }),
-		).toThrow(/valid http\(s\) URL/);
-		expect(() =>
-			adapter.validateConfig?.({ ...baseConfig, endpoint: "ftp://x" }),
-		).toThrow(/valid http\(s\) URL/);
-	});
-
-	it("treats 2xx and 400 as success and gives distinct errors for 401 and 404", async () => {
-		fetchMock.mockResolvedValueOnce(respond(204));
-		await expect(
-			adapter.testConnection?.({ ...baseConfig, endpoint }),
-		).resolves.toBeUndefined();
-
-		fetchMock.mockResolvedValueOnce(respond(400));
-		await expect(
-			adapter.testConnection?.({ ...baseConfig, endpoint }),
-		).resolves.toBeUndefined();
-
-		fetchMock.mockResolvedValueOnce(respond(401));
-		await expect(
-			adapter.testConnection?.({ ...baseConfig, endpoint, apiKey: "bad" }),
-		).rejects.toThrow(/rejected the credentials \(status 401\)/);
-
-		fetchMock.mockResolvedValueOnce(respond(404));
-		await expect(
-			adapter.testConnection?.({ ...baseConfig, endpoint }),
-		).rejects.toThrow(/not found at this URL \(status 404\)/);
-	});
-
-	it("sends the auth header and the tenant header on the test request", async () => {
-		fetchMock.mockResolvedValueOnce(respond(204));
-		await adapter.testConnection?.({
-			...baseConfig,
-			endpoint,
-			apiKey: "tok",
-			extraConfig: { tenantId: "team-a" },
-		});
-		const init = fetchMock.mock.calls[0]?.[1] as RequestInit;
-		expect(init.method).toBe("POST");
-		expect(init.headers).toMatchObject({
-			Authorization: "Bearer tok",
-			"X-Scope-OrgID": "team-a",
-		});
-	});
-});
-
-describe("newRelicAdapter", () => {
-	const adapter = telemetryProviderAdapters.new_relic;
-	const config = {
-		...baseConfig,
-		apiKey: "license",
-		extraConfig: { accountId: "123" },
-	};
-
-	it("defaults to the us region and accepts eu", () => {
-		expect(adapter.toVectorSink(config, "s", "scope", "metrics")).toMatchObject(
-			{
-				type: "new_relic",
-				api: "metrics",
-				license_key: "license",
-				account_id: "123",
-				region: "us",
-			},
-		);
-		expect(
-			adapter.toVectorSink(
-				{ ...config, extraConfig: { accountId: "123", region: "EU" } },
-				"s",
-				"scope",
-				"metrics",
-			).region,
-		).toBe("eu");
-	});
-
-	it("rejects an unknown region", () => {
-		expect(() =>
-			adapter.validateConfig?.({
-				...config,
-				extraConfig: { accountId: "123", region: "jp" },
-			}),
-		).toThrow(/"us" or "eu"/);
-	});
-
-	it("posts a gauge to the regional metric API: 202 passes, 403 is an invalid key", async () => {
-		fetchMock.mockResolvedValueOnce(respond(202));
-		await expect(
-			adapter.testConnection?.({
-				...config,
-				extraConfig: { accountId: "123", region: "eu" },
-			}),
-		).resolves.toBeUndefined();
-		expect(calledUrls()[0]).toBe(
-			"https://metric-api.eu.newrelic.com/metric/v1",
-		);
-
-		fetchMock.mockResolvedValueOnce(respond(403));
-		await expect(adapter.testConnection?.(config)).rejects.toThrow(
-			/rejected the license key/,
-		);
-		expect(calledUrls()[1]).toBe("https://metric-api.newrelic.com/metric/v1");
-	});
-});
-
-describe("influxdbAdapter", () => {
-	const adapter = telemetryProviderAdapters.influxdb;
-	const config = {
-		...baseConfig,
-		endpoint: "http://influx.example.com:8086",
-		apiKey: "token",
-		extraConfig: { org: "dokploy", bucket: "metrics" },
-	};
-
-	it("builds an influxdb_metrics v2 sink", () => {
-		expect(adapter.toVectorSink(config, "s", "scope", "metrics")).toEqual({
-			type: "influxdb_metrics",
-			inputs: ["scope"],
-			endpoint: "http://influx.example.com:8086",
-			org: "dokploy",
-			bucket: "metrics",
-			token: "token",
-			default_namespace: "dokploy",
-			version: "2",
-			buffer: { type: "disk", max_size: 268_435_488, when_full: "block" },
-		});
-	});
-
-	it("writes a test point: 204 passes, 401 and 404 give distinct errors", async () => {
-		fetchMock.mockResolvedValueOnce(respond(204));
-		await expect(adapter.testConnection?.(config)).resolves.toBeUndefined();
-		expect(calledUrls()[0]).toBe(
-			"http://influx.example.com:8086/api/v2/write?org=dokploy&bucket=metrics&precision=s",
-		);
-
-		fetchMock.mockResolvedValueOnce(respond(401));
-		await expect(adapter.testConnection?.(config)).rejects.toThrow(
-			/rejected the token/,
-		);
-
-		fetchMock.mockResolvedValueOnce(respond(404));
-		await expect(adapter.testConnection?.(config)).rejects.toThrow(
-			/organization or bucket not found/,
-		);
-	});
-});
-
-describe("datadogAdapter with metrics", () => {
-	const adapter = telemetryProviderAdapters.datadog;
-	const config = {
-		...baseConfig,
-		signals: ["logs", "metrics"] as const,
-		apiKey: "dd",
-	};
-
-	it("ships metrics through datadog_metrics without a transform", () => {
-		expect(
-			adapter.toVectorTransform?.(config as never, "t", "scope", "metrics"),
-		).toBeNull();
-		expect(
-			adapter.toVectorSink(config as never, "s", "scope", "metrics"),
-		).toMatchObject({
-			type: "datadog_metrics",
-			inputs: ["scope"],
-			default_api_key: "dd",
-			site: "datadoghq.com",
-		});
-	});
-
-	it("keeps the logs sink and ddtags transform unchanged", () => {
-		expect(
-			adapter.toVectorTransform?.(config as never, "t", "scope", "logs"),
-		).toMatchObject({ type: "remap", inputs: ["scope"] });
-		expect(adapter.toVectorSink(config as never, "s", "t", "logs").type).toBe(
-			"datadog_logs",
-		);
-	});
-});
-
-describe("betterStackAdapter with metrics", () => {
-	const adapter = telemetryProviderAdapters.betterstack;
-	const config = {
-		...baseConfig,
-		endpoint: "in.logs.betterstack.com",
-		apiKey: "token",
-	};
-
-	it("posts metrics to /metrics without a transform", () => {
-		expect(
-			adapter.toVectorTransform?.(config, "t", "scope", "metrics"),
-		).toBeNull();
-		expect(adapter.toVectorSink(config, "s", "scope", "metrics")).toMatchObject(
-			{
-				type: "http",
-				uri: "https://in.logs.betterstack.com/metrics",
-				auth: { strategy: "bearer", token: "token" },
-			},
-		);
-		expect(adapter.toVectorSink(config, "s", "scope", "logs").uri).toBe(
-			"https://in.logs.betterstack.com/",
-		);
-	});
-
-	it("tests each selected signal: two requests for logs and metrics, one for logs only", async () => {
-		fetchMock.mockResolvedValue(respond(202));
-		await adapter.testConnection?.({ ...config, signals: ["logs", "metrics"] });
-		expect(calledUrls()).toEqual([
-			"https://in.logs.betterstack.com/",
-			"https://in.logs.betterstack.com/metrics",
-		]);
-
-		fetchMock.mockClear();
-		await adapter.testConnection?.({ ...config, signals: ["logs"] });
-		expect(calledUrls()).toEqual(["https://in.logs.betterstack.com/"]);
-	});
-});
-
-describe("awsCloudwatchAdapter with metrics", () => {
-	const adapter = telemetryProviderAdapters.aws_cloudwatch;
-	const config = {
-		...baseConfig,
-		apiKey: "AKIA",
-		apiSecret: "secret",
-		extraConfig: {
-			region: "us-east-1",
-			logGroup: "/dokploy/logs",
-			metricsNamespace: "Dokploy",
-		},
-	};
-
-	it("scopes the log fields to logs and the namespace to metrics", () => {
-		const bySignal = Object.fromEntries(
-			adapter.credentialFields.map((f) => [f.key, f.signal]),
-		);
-		expect(bySignal).toMatchObject({
-			logGroup: "logs",
-			logStream: "logs",
-			metricsNamespace: "metrics",
-		});
-		expect(bySignal.region).toBeUndefined();
-	});
-
-	it("rejects a namespace starting with AWS/ only when metrics are selected", () => {
-		const bad = {
-			...config,
-			extraConfig: { ...config.extraConfig, metricsNamespace: "AWS/Foo" },
-		};
-		expect(() => adapter.validateConfig?.(bad)).toThrow(
-			/cannot start with AWS\//,
-		);
-		expect(() =>
-			adapter.validateConfig?.({ ...bad, signals: ["logs"] }),
-		).not.toThrow();
-	});
-
-	it("filters metrics to the allowlist and sets the namespace in the transform", () => {
-		const transform = adapter.toVectorTransform?.(
-			config,
-			"t",
-			"scope",
-			"metrics",
-		);
-		expect(transform).toMatchObject({
-			type: "remap",
-			inputs: ["scope"],
-			drop_on_abort: true,
-		});
-		expect(transform?.source).toContain(
-			'if !includes(["cpu_seconds_total","memory_used_bytes","memory_total_bytes","filesystem_used_bytes","filesystem_total_bytes","network_receive_bytes_total","network_transmit_bytes_total","load1","load5","load15","container_cpu_usage_seconds_total","container_memory_usage_bytes","container_network_receive_bytes_total","container_network_transmit_bytes_total"], .name) { abort }',
-		);
-		expect(transform?.source).toContain('.namespace = "Dokploy"');
-		expect(adapter.toVectorSink(config, "s", "t", "metrics")).toMatchObject({
-			type: "aws_cloudwatch_metrics",
-			inputs: ["t"],
-			default_namespace: "Dokploy",
-			region: "us-east-1",
-			auth: { access_key_id: "AKIA", secret_access_key: "secret" },
-		});
-	});
-
-	it("tests metrics with PutMetricData only, and translates AccessDenied", async () => {
-		aws.putMetricData.mockResolvedValue({});
-		await adapter.testConnection?.({ ...config, signals: ["metrics"] });
-		expect(aws.putMetricData).toHaveBeenCalledTimes(1);
-		expect(aws.describeLogGroups).not.toHaveBeenCalled();
-		expect(aws.putMetricData.mock.calls[0]?.[0]).toMatchObject({
-			input: { Namespace: "Dokploy" },
-		});
-
-		aws.putMetricData.mockRejectedValue(
-			Object.assign(new Error("denied"), { name: "AccessDenied" }),
-		);
-		await expect(
-			adapter.testConnection?.({ ...config, signals: ["metrics"] }),
-		).rejects.toThrow(/needs cloudwatch:PutMetricData/);
-	});
-
-	it("tests logs with DescribeLogGroups only", async () => {
-		aws.describeLogGroups.mockResolvedValue({});
-		await adapter.testConnection?.({ ...config, signals: ["logs"] });
-		expect(aws.describeLogGroups).toHaveBeenCalledTimes(1);
-		expect(aws.putMetricData).not.toHaveBeenCalled();
-	});
-});
-
-describe("splunkAdapter with metrics", () => {
-	const adapter = telemetryProviderAdapters.splunk_hec;
-	const config = {
-		...baseConfig,
-		endpoint: "https://splunk.example.com:8088",
-		apiKey: "hec",
-		extraConfig: { metricsIndex: "dokploy_metrics" },
-	};
-
-	it("requires the metrics index only for metrics", () => {
-		const field = adapter.credentialFields.find(
-			(f) => f.key === "metricsIndex",
-		);
-		expect(field).toMatchObject({ required: true, signal: "metrics" });
-		expect(
-			adapter.credentialFields.find((f) => f.key === "index")?.signal,
-		).toBe("logs");
-	});
-
-	it("builds a splunk_hec_metrics sink", () => {
-		expect(adapter.toVectorSink(config, "s", "scope", "metrics")).toMatchObject(
-			{
-				type: "splunk_hec_metrics",
-				endpoint: "https://splunk.example.com:8088",
-				default_token: "hec",
-				index: "dokploy_metrics",
-				source: "dokploy",
-				sourcetype: "dokploy:metrics",
-			},
-		);
-	});
-
-	it("writes a test metric and translates HEC code 7", async () => {
-		fetchMock.mockResolvedValueOnce(respond(200, { text: "Success", code: 0 }));
-		await expect(adapter.testConnection?.(config)).resolves.toBeUndefined();
-		expect(calledUrls()).toEqual([
-			"https://splunk.example.com:8088/services/collector",
-		]);
-
-		fetchMock.mockResolvedValueOnce(
-			respond(400, { text: "Incorrect index", code: 7 }),
-		);
-		await expect(adapter.testConnection?.(config)).rejects.toThrow(
-			/can't write to the metrics index "dokploy_metrics"/,
-		);
-	});
-
-	it("only checks the health endpoint for logs", async () => {
-		fetchMock.mockResolvedValueOnce(respond(200));
-		await adapter.testConnection?.({ ...config, signals: ["logs"] });
-		expect(calledUrls()).toEqual([
-			"https://splunk.example.com:8088/services/collector/health",
-		]);
-	});
-});
-
-describe("elasticsearchAdapter with metrics", () => {
-	const adapter = telemetryProviderAdapters.elasticsearch;
-	const config = { ...baseConfig, endpoint: "https://es.example.com:9200" };
-
-	it("uses the daily default metrics index when none is set, and the custom one otherwise", () => {
-		expect(
-			adapter.toVectorTransform?.(config, "t", "scope", "metrics"),
-		).toBeNull();
-		expect(adapter.toVectorSink(config, "s", "scope", "metrics")).toMatchObject(
-			{
-				type: "elasticsearch",
-				api_version: "v8",
-				bulk: { index: "dokploy-metrics-%Y.%m.%d" },
-			},
-		);
-		expect(
-			adapter.toVectorSink(
-				{ ...config, extraConfig: { metricsIndex: "metrics-custom" } },
-				"s",
-				"scope",
-				"metrics",
-			).bulk,
-		).toEqual({ index: "metrics-custom" });
-	});
-
-	it("keeps the logs sink without a bulk index unless one is set", () => {
-		expect(adapter.toVectorSink(config, "s", "t", "logs").bulk).toBeUndefined();
-	});
-});
@@ -1,85 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	findServersByOrganizationForVectorAgent: vi.fn(),
-	getWebServerSettings: vi.fn(),
-	releaseWebServerAgent: vi.fn(),
-	removeVectorAgent: vi.fn(),
-	deleteWhere: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/constants", () => ({ IS_CLOUD: false }));
-vi.mock("@dokploy/server/db", () => ({
-	db: { delete: () => ({ where: mocks.deleteWhere }) },
-}));
-vi.mock("@dokploy/server/services/server", () => ({
-	findServersByOrganizationForVectorAgent:
-		mocks.findServersByOrganizationForVectorAgent,
-}));
-vi.mock("@dokploy/server/services/web-server-settings", () => ({
-	getWebServerSettings: mocks.getWebServerSettings,
-	releaseWebServerAgent: mocks.releaseWebServerAgent,
-}));
-vi.mock("@dokploy/server/setup/vector-setup", () => ({
-	removeVectorAgent: mocks.removeVectorAgent,
-	withVectorTargetLock: (_: string | undefined, fn: () => Promise<unknown>) =>
-		fn(),
-}));
-
-const { deleteOrganization } = await import(
-	"@dokploy/server/services/organization"
-);
-
-beforeEach(() => {
-	for (const mock of Object.values(mocks)) mock.mockReset();
-	mocks.findServersByOrganizationForVectorAgent.mockResolvedValue([]);
-	mocks.deleteWhere.mockResolvedValue({ count: 1 });
-	vi.spyOn(console, "error").mockImplementation(() => {});
-});
-
-describe("deleteOrganization", () => {
-	it("attempts cleanup on every server, even with an empty selection, and swallows errors", async () => {
-		mocks.findServersByOrganizationForVectorAgent.mockResolvedValue([
-			{ serverId: "server-1", telemetryProviderIds: ["lp-1"] },
-			{ serverId: "server-2", telemetryProviderIds: ["lp-1"] },
-			{ serverId: "server-3", telemetryProviderIds: [] },
-		]);
-		mocks.removeVectorAgent.mockImplementation(async (serverId?: string) => {
-			if (serverId === "server-1") throw new Error("ssh down");
-		});
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: null,
-		});
-
-		await deleteOrganization("org-a");
-
-		expect(mocks.removeVectorAgent).toHaveBeenCalledWith("server-1");
-		expect(mocks.removeVectorAgent).toHaveBeenCalledWith("server-2");
-		expect(mocks.removeVectorAgent).toHaveBeenCalledWith("server-3");
-		expect(mocks.deleteWhere).toHaveBeenCalled();
-	});
-
-	it("leaves the local agent alone when another organization owns it", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-b",
-		});
-
-		await deleteOrganization("org-a");
-
-		expect(mocks.removeVectorAgent).not.toHaveBeenCalled();
-		expect(mocks.releaseWebServerAgent).not.toHaveBeenCalled();
-	});
-
-	it("releases the local agent even when removing it fails", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-		});
-		mocks.removeVectorAgent.mockRejectedValue(new Error("docker down"));
-
-		await deleteOrganization("org-a");
-
-		expect(mocks.removeVectorAgent).toHaveBeenCalledWith();
-		expect(mocks.releaseWebServerAgent).toHaveBeenCalledWith("org-a");
-		expect(mocks.deleteWhere).toHaveBeenCalled();
-	});
-});
@@ -1,220 +0,0 @@
-import { createServer, type Server } from "node:http";
-import type { AddressInfo } from "node:net";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	lookup: vi.fn(),
-}));
-
-vi.mock("node:dns", () => ({
-	lookup: mocks.lookup,
-}));
-
-const loadModule = async (isCloud: boolean) => {
-	vi.resetModules();
-	vi.doMock("@dokploy/server/constants", () => ({ IS_CLOUD: isCloud }));
-	return await import(
-		"@dokploy/server/services/logs-and-metrics/provider-fetch"
-	);
-};
-
-const loadFetch = async (isCloud: boolean) =>
-	(await loadModule(isCloud)).providerFetch;
-
-const resolvesTo = (...addresses: string[]) =>
-	mocks.lookup.mockImplementation(
-		(_host: string, _options: unknown, callback: Function) =>
-			callback(
-				null,
-				addresses.map((address) => ({
-					address,
-					family: address.includes(":") ? 6 : 4,
-				})),
-			),
-	);
-
-describe("providerFetch — blocked endpoint guard", () => {
-	const originalFetch = global.fetch;
-
-	beforeEach(() => {
-		mocks.lookup.mockReset();
-		global.fetch = vi.fn().mockResolvedValue(new Response("ok"));
-	});
-
-	afterEach(() => {
-		global.fetch = originalFetch;
-	});
-
-	it("rejects a literal AWS/GCP/Azure metadata IP without ever calling fetch", async () => {
-		const providerFetch = await loadFetch(false);
-		await expect(
-			providerFetch("http://169.254.169.254/latest/meta-data/"),
-		).rejects.toThrow(/metadata/i);
-		expect(global.fetch).not.toHaveBeenCalled();
-		expect(mocks.lookup).not.toHaveBeenCalled();
-	});
-
-	it("rejects the metadata IP written as an IPv4-mapped IPv6 address", async () => {
-		const providerFetch = await loadFetch(false);
-		for (const address of ["[::ffff:169.254.169.254]", "[::ffff:a9fe:a9fe]"]) {
-			await expect(
-				providerFetch(`http://${address}/latest/meta-data/`),
-				`expected ${address} to be rejected`,
-			).rejects.toThrow(/metadata/i);
-		}
-		expect(global.fetch).not.toHaveBeenCalled();
-	});
-
-	it("rejects the AWS ECS metadata IPv6 address", async () => {
-		const providerFetch = await loadFetch(false);
-		await expect(
-			providerFetch("http://[fd00:ec2::254]/v2/credentials"),
-		).rejects.toThrow(/metadata/i);
-		expect(global.fetch).not.toHaveBeenCalled();
-	});
-
-	it("rejects every fe80::/10 link-local address, not just literal fe80: ones", async () => {
-		const providerFetch = await loadFetch(false);
-		for (const address of [
-			"[fe80::1]",
-			"[fe90::1]",
-			"[fea0::1]",
-			"[febf::1]",
-		]) {
-			await expect(
-				providerFetch(`http://${address}/`),
-				`expected ${address} to be rejected`,
-			).rejects.toThrow(/metadata/i);
-		}
-		expect(global.fetch).not.toHaveBeenCalled();
-	});
-
-	it("does not block a hostname just because it starts like a link-local prefix", async () => {
-		const providerFetch = await loadFetch(false);
-
-		await providerFetch("https://feature-logs.example.com/ready");
-		expect(global.fetch).toHaveBeenCalledTimes(1);
-	});
-
-	it("rejects the GCP metadata hostname without needing DNS resolution", async () => {
-		const providerFetch = await loadFetch(false);
-		await expect(
-			providerFetch("http://metadata.google.internal/computeMetadata/v1/"),
-		).rejects.toThrow(/metadata/i);
-		expect(global.fetch).not.toHaveBeenCalled();
-		expect(mocks.lookup).not.toHaveBeenCalled();
-	});
-
-	it("rejects loopback and private-network endpoints in cloud", async () => {
-		const providerFetch = await loadFetch(true);
-
-		for (const url of [
-			"http://10.0.0.5:3100/ready",
-			"http://127.0.0.1:3100/ready",
-			"http://localhost:3100/ready",
-			"http://[::1]:3100/ready",
-			"http://0.0.0.0:3100/ready",
-			"http://100.100.100.200/latest/meta-data/",
-			"http://[::]:3100/ready",
-		]) {
-			await expect(
-				providerFetch(url),
-				`expected ${url} to be rejected`,
-			).rejects.toThrow(/blocked/i);
-		}
-		expect(global.fetch).not.toHaveBeenCalled();
-	});
-
-	it("does not follow redirects", async () => {
-		const providerFetch = await loadFetch(false);
-
-		await providerFetch("https://logs.example.com/ready");
-		expect(global.fetch).toHaveBeenCalledWith(
-			"https://logs.example.com/ready",
-			expect.objectContaining({ redirect: "error" }),
-		);
-	});
-});
-
-describe("providerFetch — address checked at connect time", () => {
-	let server: Server;
-	let port: number;
-	let hostHeader: string | undefined;
-
-	beforeEach(async () => {
-		mocks.lookup.mockReset();
-		hostHeader = undefined;
-		server = createServer((req, res) => {
-			hostHeader = req.headers.host;
-			res.end("ok");
-		});
-		await new Promise<void>((resolve) =>
-			server.listen(0, "127.0.0.1", resolve),
-		);
-		port = (server.address() as AddressInfo).port;
-	});
-
-	afterEach(async () => {
-		await new Promise((resolve) => server.close(resolve));
-	});
-
-	it("rejects a hostname whose lookup returns a metadata address", async () => {
-		const providerFetch = await loadFetch(false);
-		resolvesTo("203.0.113.10", "169.254.169.254");
-
-		await expect(
-			providerFetch("http://attacker-controlled.example.com/"),
-		).rejects.toThrow(/metadata/i);
-		expect(mocks.lookup).toHaveBeenCalledWith(
-			"attacker-controlled.example.com",
-			expect.anything(),
-			expect.any(Function),
-		);
-	});
-
-	it("rejects a hostname resolving to a private address in cloud", async () => {
-		const providerFetch = await loadFetch(true);
-		resolvesTo("127.0.0.1");
-
-		await expect(
-			providerFetch(`http://loki.internal.example.com:${port}/ready`),
-		).rejects.toThrow(/blocked/i);
-		expect(hostHeader).toBeUndefined();
-	});
-
-	it("rejects when DNS resolution fails", async () => {
-		const providerFetch = await loadFetch(false);
-		mocks.lookup.mockImplementation(
-			(_host: string, _options: unknown, callback: Function) =>
-				callback(Object.assign(new Error("ENOTFOUND"), { code: "ENOTFOUND" })),
-		);
-
-		await expect(
-			providerFetch("http://does-not-exist.invalid/"),
-		).rejects.toThrow();
-		expect(hostHeader).toBeUndefined();
-	});
-
-	it("connects to the address it validated, keeping the original Host header (self-hosted private endpoint)", async () => {
-		const providerFetch = await loadFetch(false);
-		resolvesTo("127.0.0.1");
-
-		const response = await providerFetch(
-			`http://loki.internal.example.com:${port}/ready`,
-		);
-		expect(await response.text()).toBe("ok");
-		expect(hostHeader).toBe(`loki.internal.example.com:${port}`);
-	});
-
-	it("passes a public address through in cloud", async () => {
-		const { guardedLookup } = await loadModule(true);
-		resolvesTo("203.0.113.10");
-
-		const result = await new Promise((resolve, reject) =>
-			guardedLookup("api.datadoghq.com", { all: true }, (error, addresses) =>
-				error ? reject(error) : resolve(addresses),
-			),
-		);
-		expect(result).toEqual([{ address: "203.0.113.10", family: 4 }]);
-	});
-});
@@ -1,16 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { providerLabel } from "@/components/dashboard/settings/logs-and-metrics/show-servers";
-
-describe("providerLabel", () => {
-	it("names what the provider sends next to its name", () => {
-		expect(providerLabel({ name: "Loki prod", signals: ["logs"] })).toBe(
-			"Loki prod (logs)",
-		);
-		expect(providerLabel({ name: "Splunk", signals: ["metrics"] })).toBe(
-			"Splunk (metrics)",
-		);
-		expect(
-			providerLabel({ name: "Datadog", signals: ["logs", "metrics"] }),
-		).toBe("Datadog (logs and metrics)");
-	});
-});
@@ -1,101 +0,0 @@
-import type { SQL } from "drizzle-orm";
-import { PgDialect } from "drizzle-orm/pg-core";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	deleted: [] as unknown[],
-	updates: [] as Array<{ table: unknown; values: Record<string, unknown> }>,
-	updatedServers: [] as Array<{ serverId: string }>,
-	updatedLocal: [] as Array<{ id: string }>,
-	queried: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/db", () => {
-	const tx = {
-		delete: () => ({
-			where: () => ({
-				returning: () => Promise.resolve(mocks.deleted),
-			}),
-		}),
-		update: (table: unknown) => ({
-			set: (values: Record<string, unknown>) => ({
-				where: () => ({
-					returning: () => {
-						mocks.updates.push({ table, values });
-						return Promise.resolve(
-							mocks.updates.length === 1
-								? mocks.updatedServers
-								: mocks.updatedLocal,
-						);
-					},
-				}),
-			}),
-		}),
-	};
-	return {
-		db: {
-			transaction: (fn: (tx: unknown) => unknown) => fn(tx),
-			query: {
-				server: { findMany: mocks.queried },
-				webServerSettings: { findFirst: mocks.queried },
-			},
-		},
-	};
-});
-
-const { server, webServerSettings } = await import("@dokploy/server/db/schema");
-const { removeTelemetryProvider } = await import(
-	"@dokploy/server/services/logs-and-metrics/service"
-);
-
-const render = (value: unknown) => new PgDialect().sqlToQuery(value as SQL).sql;
-
-describe("removeTelemetryProvider", () => {
-	beforeEach(() => {
-		mocks.updates = [];
-		mocks.updatedServers = [{ serverId: "server-1" }];
-		mocks.updatedLocal = [{ id: "ws-1" }];
-		mocks.queried.mockReset();
-	});
-
-	it("drops the provider id from the selection of every server and of the local host", async () => {
-		mocks.deleted = [{ telemetryProviderId: "lp-1" }];
-
-		const { provider, targets } = await removeTelemetryProvider("lp-1");
-		expect(provider).toEqual({ telemetryProviderId: "lp-1" });
-		expect(targets).toEqual(["server-1", null]);
-
-		expect(mocks.updates.map((u) => u.table)).toEqual([
-			server,
-			webServerSettings,
-		]);
-		expect(render(mocks.updates[0]?.values.telemetryProviderIds)).toBe(
-			'array_remove("server"."telemetryProviderIds", $1)',
-		);
-		expect(render(mocks.updates[1]?.values.telemetryProviderIds)).toBe(
-			'array_remove("webServerSettings"."telemetryProviderIds", $1)',
-		);
-		expect(render(mocks.updates[1]?.values.vectorAgentOrganizationId)).toBe(
-			'CASE WHEN cardinality(array_remove("webServerSettings"."telemetryProviderIds", $1)) = 0 THEN NULL ELSE "webServerSettings"."vectorAgentOrganizationId" END',
-		);
-	});
-
-	it("reconciles exactly the hosts whose selection the transaction updated", async () => {
-		mocks.deleted = [{ telemetryProviderId: "lp-1" }];
-		mocks.updatedServers = [{ serverId: "server-1" }, { serverId: "server-2" }];
-		mocks.updatedLocal = [];
-
-		const { targets } = await removeTelemetryProvider("lp-1");
-		expect(targets).toEqual(["server-1", "server-2"]);
-		expect(mocks.queried).not.toHaveBeenCalled();
-	});
-
-	it("does not touch assignments when the provider does not exist", async () => {
-		mocks.deleted = [];
-
-		await expect(removeTelemetryProvider("missing")).rejects.toMatchObject({
-			code: "NOT_FOUND",
-		});
-		expect(mocks.updates).toEqual([]);
-	});
-});
@@ -1,392 +0,0 @@
-import {
-	getTelemetryProviderAdapter,
-	telemetryProviderAdapters,
-} from "@dokploy/server/services/logs-and-metrics/providers/registry";
-import type { TelemetryProviderRuntimeConfig } from "@dokploy/server/services/logs-and-metrics/types";
-import { describe, expect, it } from "vitest";
-
-const baseConfig: TelemetryProviderRuntimeConfig = {
-	telemetryProviderId: "provider-1",
-	name: "test",
-	signals: ["logs"],
-	endpoint: null,
-	apiKey: null,
-	apiSecret: null,
-	extraConfig: null,
-};
-
-describe("getTelemetryProviderAdapter", () => {
-	it("returns the registered adapter for each known type", () => {
-		expect(getTelemetryProviderAdapter("loki").type).toBe("loki");
-		expect(getTelemetryProviderAdapter("datadog").type).toBe("datadog");
-		expect(getTelemetryProviderAdapter("betterstack").type).toBe("betterstack");
-		expect(getTelemetryProviderAdapter("elasticsearch").type).toBe(
-			"elasticsearch",
-		);
-		expect(getTelemetryProviderAdapter("splunk_hec").type).toBe("splunk_hec");
-		expect(getTelemetryProviderAdapter("aws_cloudwatch").type).toBe(
-			"aws_cloudwatch",
-		);
-	});
-
-	it("throws an explicit error for an unregistered type", () => {
-		// @ts-expect-error: intentionally an unregistered type
-		expect(() => getTelemetryProviderAdapter("unknown")).toThrow(
-			/No TelemetryProviderAdapter registered/,
-		);
-	});
-});
-
-describe("lokiAdapter.toVectorSink", () => {
-	it("maps endpoint + labels, without tenant_id if not set", () => {
-		const adapter = telemetryProviderAdapters.loki;
-		const sink = adapter.toVectorSink(
-			{ ...baseConfig, endpoint: "https://loki.example.com" },
-			"sink_1",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(sink.type).toBe("loki");
-		expect(sink.inputs).toEqual(["dokploy_scope"]);
-		expect(sink.endpoint).toBe("https://loki.example.com");
-		expect(sink.labels).toMatchObject({
-			dokploy_project: "{{ dokploy_project }}",
-			dokploy_environment: "{{ dokploy_environment }}",
-			dokploy_application: "{{ dokploy_application }}",
-			dokploy_organization: "{{ dokploy_organization }}",
-			dokploy_server: "{{ dokploy_server }}",
-		});
-		expect(sink.tenant_id).toBeUndefined();
-		expect(sink.buffer).toEqual({
-			type: "disk",
-			max_size: 268_435_488,
-			when_full: "block",
-		});
-	});
-
-	it("includes tenant_id when present in extraConfig", () => {
-		const adapter = telemetryProviderAdapters.loki;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				endpoint: "https://loki.example.com",
-				extraConfig: { tenantId: "tenant-a" },
-			},
-			"sink_1",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(sink.tenant_id).toBe("tenant-a");
-	});
-
-	it("has no toVectorTransform — goes directly scope -> sink", () => {
-		expect(telemetryProviderAdapters.loki.toVectorTransform).toBeUndefined();
-	});
-});
-
-describe("datadogAdapter.toVectorSink", () => {
-	it("defaults site to datadoghq.com and sets no `tags` field (datadog_logs has none)", () => {
-		const adapter = telemetryProviderAdapters.datadog;
-		const sink = adapter.toVectorSink(
-			{ ...baseConfig, apiKey: "dd-key" },
-			"sink_2",
-			"transform_2",
-			"logs",
-		);
-		expect(sink.type).toBe("datadog_logs");
-		expect(sink.default_api_key).toBe("dd-key");
-		expect(sink.site).toBe("datadoghq.com");
-		expect(sink.tags).toBeUndefined();
-		expect(sink.inputs).toEqual(["transform_2"]);
-	});
-
-	it("uses extraConfig.site when present", () => {
-		const adapter = telemetryProviderAdapters.datadog;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				apiKey: "dd-key",
-				extraConfig: { site: "datadoghq.eu" },
-			},
-			"sink_2",
-			"transform_2",
-			"logs",
-		);
-		expect(sink.site).toBe("datadoghq.eu");
-	});
-
-	it("strips a pasted scheme/trailing slash from extraConfig.site instead of interpolating it as-is", () => {
-		const adapter = telemetryProviderAdapters.datadog;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				apiKey: "dd-key",
-				extraConfig: { site: "https://datadoghq.eu/" },
-			},
-			"sink_2",
-			"transform_2",
-			"logs",
-		);
-		expect(sink.site).toBe("datadoghq.eu");
-	});
-
-	it("builds .ddtags from the scoping fields in toVectorTransform, since datadog_logs has no `tags` option (vector generate-schema)", () => {
-		const adapter = telemetryProviderAdapters.datadog;
-		expect(adapter.toVectorTransform).toBeDefined();
-		const transform = adapter.toVectorTransform?.(
-			baseConfig,
-			"transform_2",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(transform?.type).toBe("remap");
-		expect(transform?.inputs).toEqual(["dokploy_scope"]);
-		expect(transform?.source).toContain(".ddtags");
-		expect(transform?.source).toContain(
-			'"dokploy_server:" + replace(to_string!(.dokploy_server), ",", "_")',
-		);
-	});
-
-	it("escapes commas in scoping field values before building .ddtags, since ddtags is itself comma delimited", () => {
-		const adapter = telemetryProviderAdapters.datadog;
-		const transform = adapter.toVectorTransform?.(
-			baseConfig,
-			"transform_2",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(transform?.source).toContain(
-			'replace(to_string!(.dokploy_project), ",", "_")',
-		);
-	});
-});
-
-describe("betterStackAdapter", () => {
-	it("toVectorTransform renames timestamp to dt, inputs point to scope transform", () => {
-		const adapter = telemetryProviderAdapters.betterstack;
-		expect(adapter.toVectorTransform).toBeDefined();
-		const transform = adapter.toVectorTransform?.(
-			baseConfig,
-			"transform_1",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(transform).toEqual({
-			type: "remap",
-			inputs: ["dokploy_scope"],
-			source: ".dt = del(.timestamp)",
-		});
-	});
-
-	it("toVectorSink builds a generic http sink with bearer auth, reading from the transform id", () => {
-		const adapter = telemetryProviderAdapters.betterstack;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				endpoint: "https://in.logs.betterstack.com",
-				apiKey: "source-token",
-			},
-			"sink_3",
-			"transform_1",
-			"logs",
-		);
-		expect(sink.type).toBe("http");
-		expect(sink.inputs).toEqual(["transform_1"]);
-		expect(sink.uri).toBe("https://in.logs.betterstack.com/");
-		expect(sink.auth).toEqual({ strategy: "bearer", token: "source-token" });
-		expect(sink.compression).toBe("gzip");
-	});
-});
-
-describe("elasticsearchAdapter", () => {
-	it("has a toVectorTransform that flattens .label to a JSON string", () => {
-		const adapter = telemetryProviderAdapters.elasticsearch;
-		expect(adapter.toVectorTransform).toBeDefined();
-		const transform = adapter.toVectorTransform?.(
-			baseConfig,
-			"transform_4",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(transform?.type).toBe("remap");
-		expect(transform?.inputs).toEqual(["dokploy_scope"]);
-		expect(transform?.source).toContain("encode_json(.label)");
-	});
-
-	it("uses basic auth when a username is set", () => {
-		const adapter = telemetryProviderAdapters.elasticsearch;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				endpoint: "https://es.example.com:9200",
-				apiKey: "secret",
-				extraConfig: { username: "elastic" },
-			},
-			"sink_4",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(sink.type).toBe("elasticsearch");
-		expect(sink.endpoints).toEqual(["https://es.example.com:9200"]);
-		expect(sink.auth).toEqual({
-			strategy: "basic",
-			user: "elastic",
-			password: "secret",
-		});
-		expect(sink.request).toBeUndefined();
-	});
-
-	it("falls back to an ApiKey header when no username is set", () => {
-		const adapter = telemetryProviderAdapters.elasticsearch;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				endpoint: "https://es.example.com:9200",
-				apiKey: "key-123",
-			},
-			"sink_4",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(sink.auth).toBeUndefined();
-		expect(sink.request).toEqual({
-			headers: { Authorization: "ApiKey key-123" },
-		});
-	});
-
-	it("rejects a username set without a password instead of silently shipping unauthenticated", () => {
-		const adapter = telemetryProviderAdapters.elasticsearch;
-		expect(() =>
-			adapter.toVectorSink(
-				{
-					...baseConfig,
-					endpoint: "https://es.example.com:9200",
-					extraConfig: { username: "elastic" },
-				},
-				"sink_4",
-				"dokploy_scope",
-				"logs",
-			),
-		).toThrow(/Password.*required/i);
-	});
-
-	it("includes bulk.index only when extraConfig.index is set", () => {
-		const adapter = telemetryProviderAdapters.elasticsearch;
-		const withoutIndex = adapter.toVectorSink(
-			{ ...baseConfig, endpoint: "https://es.example.com:9200" },
-			"sink_4",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(withoutIndex.bulk).toBeUndefined();
-		const withIndex = adapter.toVectorSink(
-			{
-				...baseConfig,
-				endpoint: "https://es.example.com:9200",
-				extraConfig: { index: "dokploy-%Y.%m.%d" },
-			},
-			"sink_4",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(withIndex.bulk).toEqual({ index: "dokploy-%Y.%m.%d" });
-	});
-});
-
-describe("splunkAdapter", () => {
-	it("has no toVectorTransform — scoping fields ride along as plain JSON fields", () => {
-		expect(
-			telemetryProviderAdapters.splunk_hec.toVectorTransform,
-		).toBeUndefined();
-	});
-
-	it("toVectorSink maps endpoint/token, only sets index/sourcetype when present", () => {
-		const adapter = telemetryProviderAdapters.splunk_hec;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				endpoint: "https://splunk.example.com:8088",
-				apiKey: "hec-token",
-			},
-			"sink_5",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(sink.type).toBe("splunk_hec_logs");
-		expect(sink.endpoint).toBe("https://splunk.example.com:8088");
-		expect(sink.default_token).toBe("hec-token");
-		expect(sink.encoding).toEqual({ codec: "json" });
-		expect(sink.index).toBeUndefined();
-		expect(sink.sourcetype).toBeUndefined();
-
-		const withExtras = adapter.toVectorSink(
-			{
-				...baseConfig,
-				endpoint: "https://splunk.example.com:8088",
-				apiKey: "hec-token",
-				extraConfig: { index: "dokploy", sourcetype: "docker" },
-			},
-			"sink_5",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(withExtras.index).toBe("dokploy");
-		expect(withExtras.sourcetype).toBe("docker");
-	});
-});
-
-describe("awsCloudwatchAdapter", () => {
-	it("has no logs transform — scoping fields ride along as plain JSON fields", () => {
-		expect(
-			telemetryProviderAdapters.aws_cloudwatch.toVectorTransform?.(
-				baseConfig,
-				"transform_1",
-				"dokploy_scope",
-				"logs",
-			),
-		).toBeNull();
-	});
-
-	it("toVectorSink maps access key/secret, region and log group/stream", () => {
-		const adapter = telemetryProviderAdapters.aws_cloudwatch;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				apiKey: "AKIA...",
-				apiSecret: "shh",
-				extraConfig: { region: "us-east-1", logGroup: "/dokploy/logs" },
-			},
-			"sink_6",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(sink.type).toBe("aws_cloudwatch_logs");
-		expect(sink.group_name).toBe("/dokploy/logs");
-		expect(sink.stream_name).toBe("{{ container_name }}");
-		expect(sink.region).toBe("us-east-1");
-		expect(sink.auth).toEqual({
-			access_key_id: "AKIA...",
-			secret_access_key: "shh",
-		});
-	});
-
-	it("uses extraConfig.logStream as the stream template when set", () => {
-		const adapter = telemetryProviderAdapters.aws_cloudwatch;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				apiKey: "AKIA...",
-				apiSecret: "shh",
-				extraConfig: {
-					region: "us-east-1",
-					logGroup: "/dokploy/logs",
-					logStream: "{{ dokploy_application }}",
-				},
-			},
-			"sink_6",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(sink.stream_name).toBe("{{ dokploy_application }}");
-	});
-});
@@ -1,661 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	insertValues: vi.fn(),
-	updateSet: vi.fn(),
-	findFirst: vi.fn(),
-	findMany: vi.fn(),
-	serverFindFirst: vi.fn(),
-	serverFindMany: vi.fn(),
-	webServerFindFirst: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		insert: () => ({
-			values: (v: any) => ({
-				returning: () => Promise.resolve(mocks.insertValues(v)),
-			}),
-		}),
-		update: () => ({
-			set: (v: any) => ({
-				where: () => ({
-					returning: () => Promise.resolve(mocks.updateSet(v)),
-				}),
-			}),
-		}),
-		query: {
-			telemetryProvider: {
-				findFirst: mocks.findFirst,
-				findMany: mocks.findMany,
-			},
-			server: {
-				findFirst: mocks.serverFindFirst,
-				findMany: mocks.serverFindMany,
-			},
-			webServerSettings: { findFirst: mocks.webServerFindFirst },
-		},
-	},
-}));
-
-const {
-	assertProvidersBelongToOrg,
-	assertSignalsSupported,
-	createTelemetryProvider,
-	testTelemetryProviderConnection,
-	updateTelemetryProvider,
-} = await import("@dokploy/server/services/logs-and-metrics/service");
-const { telemetryProviderAdapters } = await import(
-	"@dokploy/server/services/logs-and-metrics/providers/registry"
-);
-
-beforeEach(() => {
-	mocks.serverFindMany.mockResolvedValue([]);
-	mocks.webServerFindFirst.mockResolvedValue(undefined);
-});
-
-describe("updateTelemetryProvider — targets to re-apply", () => {
-	const existing = {
-		telemetryProviderId: "lp-1",
-		name: "loki",
-		providerType: "loki",
-		signals: ["logs"],
-		endpoint: "https://loki.example.com",
-		apiKey: "old",
-		apiSecret: null,
-		extraConfig: null,
-		enabled: true,
-	};
-
-	beforeEach(() => {
-		mocks.findFirst.mockResolvedValue(existing);
-		mocks.updateSet.mockReturnValue([{ ...existing, apiKey: "new" }]);
-		mocks.serverFindMany.mockResolvedValue([{ serverId: "server-1" }]);
-		mocks.webServerFindFirst.mockResolvedValue({ id: "ws-1" });
-	});
-
-	it("returns the servers and the local host that ship with it when a credential changes", async () => {
-		const { targets } = await updateTelemetryProvider("lp-1", {
-			apiKey: "new",
-		});
-		expect(targets).toEqual(["server-1", null]);
-	});
-
-	it("returns the same targets when the provider is disabled", async () => {
-		const { targets } = await updateTelemetryProvider("lp-1", {
-			enabled: false,
-		});
-		expect(targets).toEqual(["server-1", null]);
-	});
-
-	it("returns no targets when only the name changes or a value is re-sent unchanged", async () => {
-		expect(
-			(await updateTelemetryProvider("lp-1", { name: "renamed" })).targets,
-		).toEqual([]);
-		expect(
-			(
-				await updateTelemetryProvider("lp-1", {
-					endpoint: "https://loki.example.com",
-				})
-			).targets,
-		).toEqual([]);
-	});
-});
-
-describe("createTelemetryProvider — required credential fields per adapter", () => {
-	it("rejects a loki provider without endpoint", async () => {
-		await expect(
-			createTelemetryProvider(
-				{ name: "loki-prod", providerType: "loki", signals: ["logs"] } as any,
-				"org-1",
-			),
-		).rejects.toThrow(/endpoint/i);
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-
-	it("rejects a datadog provider without apiKey", async () => {
-		await expect(
-			createTelemetryProvider(
-				{ name: "dd", providerType: "datadog", signals: ["logs"] } as any,
-				"org-1",
-			),
-		).rejects.toThrow();
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-
-	it("rejects a betterstack provider missing either field", async () => {
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "bs",
-					providerType: "betterstack",
-					signals: ["logs"],
-					apiKey: "token-only",
-				} as any,
-				"org-1",
-			),
-		).rejects.toThrow();
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-
-	it("rejects a splunk_hec provider without a HEC token", async () => {
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "splunk",
-					providerType: "splunk_hec",
-					signals: ["logs"],
-					endpoint: "https://splunk.example.com:8088",
-				} as any,
-				"org-1",
-			),
-		).rejects.toThrow(/token/i);
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-
-	it("rejects an aws_cloudwatch provider missing required extraConfig fields (region/log group)", async () => {
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "cw",
-					providerType: "aws_cloudwatch",
-					signals: ["logs"],
-					apiKey: "AKIA...",
-					apiSecret: "shh",
-				} as any,
-				"org-1",
-			),
-		).rejects.toThrow(/region|log group/i);
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-
-	it("rejects a datadog provider whose apiKey only exists inside extraConfig, not the real column", async () => {
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "dd",
-					providerType: "datadog",
-					signals: ["logs"],
-					extraConfig: { apiKey: "sneaky-value" },
-				} as any,
-				"org-1",
-			),
-		).rejects.toThrow(/api key/i);
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-
-	it("rejects an elasticsearch provider with a username but no password (adapter.validateConfig)", async () => {
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "es",
-					providerType: "elasticsearch",
-					signals: ["logs"],
-					endpoint: "https://es.example.com:9200",
-					extraConfig: { username: "elastic" },
-				} as any,
-				"org-1",
-			),
-		).rejects.toThrow(/password.*required/i);
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-
-	it("accepts an aws_cloudwatch provider with region and log group set via extraConfig", async () => {
-		mocks.insertValues.mockReturnValue([
-			{
-				telemetryProviderId: "lp-2",
-				name: "cw",
-				providerType: "aws_cloudwatch",
-				signals: ["logs"],
-			},
-		]);
-		const created = await createTelemetryProvider(
-			{
-				name: "cw",
-				providerType: "aws_cloudwatch",
-				signals: ["logs"],
-				apiKey: "AKIA...",
-				apiSecret: "shh",
-				extraConfig: { region: "us-east-1", logGroup: "/dokploy/logs" },
-			} as any,
-			"org-1",
-		);
-		expect(created.telemetryProviderId).toBe("lp-2");
-	});
-
-	it("accepts a loki provider with endpoint", async () => {
-		mocks.insertValues.mockReturnValue([
-			{ telemetryProviderId: "lp-1", name: "loki-prod", providerType: "loki" },
-		]);
-		const created = await createTelemetryProvider(
-			{
-				name: "loki-prod",
-				providerType: "loki",
-				signals: ["logs"],
-				endpoint: "https://loki.example.com",
-			} as any,
-			"org-1",
-		);
-		expect(created.telemetryProviderId).toBe("lp-1");
-		expect(mocks.insertValues).toHaveBeenCalled();
-	});
-});
-
-describe("updateTelemetryProvider — merges partial update with existing row before validating", () => {
-	it("allows updating just the name without re-sending existing credentials", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "lp-1",
-			name: "old-name",
-			providerType: "loki",
-			signals: ["logs"],
-			endpoint: "https://loki.example.com",
-			apiKey: null,
-			apiSecret: null,
-			extraConfig: null,
-		});
-		mocks.updateSet.mockReturnValue([
-			{ telemetryProviderId: "lp-1", name: "new-name" },
-		]);
-
-		const { provider: updated, targets } = await updateTelemetryProvider(
-			"lp-1",
-			{ name: "new-name" },
-		);
-		expect(updated.name).toBe("new-name");
-		expect(targets).toEqual([]);
-	});
-
-	it("rejects clearing the only required field via update", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "lp-1",
-			name: "loki-prod",
-			providerType: "loki",
-			signals: ["logs"],
-			endpoint: "https://loki.example.com",
-			apiKey: null,
-			apiSecret: null,
-			extraConfig: null,
-		});
-
-		await expect(
-			updateTelemetryProvider("lp-1", { endpoint: null }),
-		).rejects.toThrow(/endpoint/i);
-	});
-
-	it("clears the old provider's credentials when providerType changes, unless new values are given", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "lp-1",
-			name: "dd-prod",
-			providerType: "datadog",
-			signals: ["logs"],
-			endpoint: null,
-			apiKey: "old-datadog-key",
-			apiSecret: null,
-			extraConfig: { site: "datadoghq.com" },
-		});
-		mocks.updateSet.mockReturnValue([{ telemetryProviderId: "lp-1" }]);
-
-		await updateTelemetryProvider("lp-1", {
-			providerType: "loki",
-			signals: ["logs"],
-			endpoint: "https://loki.example.com",
-		});
-
-		expect(mocks.updateSet).toHaveBeenCalledWith(
-			expect.objectContaining({
-				providerType: "loki",
-				signals: ["logs"],
-				endpoint: "https://loki.example.com",
-				apiKey: null,
-				apiSecret: null,
-				extraConfig: null,
-			}),
-		);
-	});
-
-	it("merges a partial extraConfig update instead of replacing it wholesale", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "lp-1",
-			name: "es-prod",
-			providerType: "elasticsearch",
-			signals: ["logs"],
-			endpoint: "https://es.example.com:9200",
-			apiKey: "secret",
-			apiSecret: null,
-			extraConfig: { username: "elastic", index: "custom-index" },
-		});
-		mocks.updateSet.mockReturnValue([{ telemetryProviderId: "lp-1" }]);
-
-		await updateTelemetryProvider("lp-1", {
-			extraConfig: { username: "new-user" },
-		});
-
-		expect(mocks.updateSet).toHaveBeenCalledWith(
-			expect.objectContaining({
-				extraConfig: { username: "new-user", index: "custom-index" },
-			}),
-		);
-	});
-
-	it("clears extraConfig entirely when explicitly set to null, instead of merging", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "lp-1",
-			name: "es-prod",
-			providerType: "elasticsearch",
-			signals: ["logs"],
-			endpoint: "https://es.example.com:9200",
-			apiKey: null,
-			apiSecret: null,
-			extraConfig: { username: "elastic" },
-		});
-		mocks.updateSet.mockReturnValue([{ telemetryProviderId: "lp-1" }]);
-
-		await updateTelemetryProvider("lp-1", { extraConfig: null });
-
-		expect(mocks.updateSet).toHaveBeenCalledWith(
-			expect.objectContaining({ extraConfig: null }),
-		);
-	});
-
-	it("clears an optional credential when it is explicitly set to null", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "lp-1",
-			name: "loki-prod",
-			providerType: "loki",
-			signals: ["logs"],
-			endpoint: "https://loki.example.com",
-			apiKey: "old-token",
-			apiSecret: null,
-			extraConfig: { username: "user" },
-		});
-		mocks.updateSet.mockReturnValue([{ telemetryProviderId: "lp-1" }]);
-
-		await updateTelemetryProvider("lp-1", { apiKey: null });
-
-		expect(mocks.updateSet).toHaveBeenCalledWith(
-			expect.objectContaining({ apiKey: null }),
-		);
-	});
-
-	it("rejects clearing the elasticsearch password while a username stays saved", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "lp-1",
-			name: "es-prod",
-			providerType: "elasticsearch",
-			signals: ["logs"],
-			endpoint: "https://es.example.com:9200",
-			apiKey: "old-password",
-			apiSecret: null,
-			extraConfig: { username: "elastic" },
-		});
-
-		await expect(
-			updateTelemetryProvider("lp-1", { apiKey: null }),
-		).rejects.toThrow(/Password/);
-	});
-
-	it("rejects a providerType change that doesn't satisfy the new type's required fields", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "lp-1",
-			name: "dd-prod",
-			providerType: "datadog",
-			signals: ["logs"],
-			endpoint: null,
-			apiKey: "old-datadog-key",
-			apiSecret: null,
-			extraConfig: null,
-		});
-
-		await expect(
-			updateTelemetryProvider("lp-1", { providerType: "loki" }),
-		).rejects.toThrow(/endpoint/i);
-	});
-});
-
-describe("assertSignalsSupported", () => {
-	it("rejects a repeated signal", () => {
-		expect(() => assertSignalsSupported("loki", ["logs", "logs"])).toThrow(
-			/only be selected once/,
-		);
-	});
-
-	it("rejects a signal the type cannot send", () => {
-		expect(() => assertSignalsSupported("loki", ["metrics"])).toThrow(
-			/Grafana Loki cannot send metrics/,
-		);
-	});
-
-	it("accepts a supported subset", () => {
-		expect(() => assertSignalsSupported("loki", ["logs"])).not.toThrow();
-	});
-});
-
-describe("createTelemetryProvider — signals", () => {
-	it("rejects a provider whose type cannot send the selected signal", async () => {
-		mocks.insertValues.mockClear();
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "loki",
-					providerType: "loki",
-					signals: ["metrics"],
-					endpoint: "https://loki.example.com",
-				} as any,
-				"org-1",
-			),
-		).rejects.toThrow(/cannot send metrics/);
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-});
-
-describe("assertProvidersBelongToOrg", () => {
-	beforeEach(() => {
-		mocks.findMany.mockResolvedValue([
-			{
-				telemetryProviderId: "lp-1",
-				name: "loki",
-				enabled: true,
-				signals: ["logs"],
-			},
-		]);
-	});
-
-	it("accepts a provider of the organization regardless of what it sends", async () => {
-		await expect(
-			assertProvidersBelongToOrg(["lp-1"], "org-1"),
-		).resolves.toBeUndefined();
-	});
-
-	it("rejects an id that is not in the organization", async () => {
-		await expect(
-			assertProvidersBelongToOrg(["lp-9"], "org-1"),
-		).rejects.toMatchObject({ code: "UNAUTHORIZED" });
-	});
-
-	it("rejects a selection where every provider is disabled", async () => {
-		mocks.findMany.mockResolvedValue([
-			{
-				telemetryProviderId: "lp-1",
-				name: "loki",
-				enabled: false,
-				signals: ["logs"],
-			},
-		]);
-		await expect(assertProvidersBelongToOrg(["lp-1"], "org-1")).rejects.toThrow(
-			/at least one enabled provider/,
-		);
-	});
-});
-
-describe("required fields scoped to a signal", () => {
-	beforeEach(() => {
-		mocks.insertValues.mockReset();
-		mocks.insertValues.mockReturnValue([{ telemetryProviderId: "cw-1" }]);
-	});
-
-	it("does not require the log group when only metrics are selected", async () => {
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "cw",
-					providerType: "aws_cloudwatch",
-					signals: ["metrics"],
-					apiKey: "AKIA",
-					apiSecret: "shh",
-					extraConfig: { region: "us-east-1", metricsNamespace: "Dokploy" },
-				} as any,
-				"org-1",
-			),
-		).resolves.toMatchObject({ telemetryProviderId: "cw-1" });
-	});
-
-	it("does not require the metrics namespace when only logs are selected", async () => {
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "cw",
-					providerType: "aws_cloudwatch",
-					signals: ["logs"],
-					apiKey: "AKIA",
-					apiSecret: "shh",
-					extraConfig: { region: "us-east-1", logGroup: "/dokploy/logs" },
-				} as any,
-				"org-1",
-			),
-		).resolves.toMatchObject({ telemetryProviderId: "cw-1" });
-	});
-
-	it("requires the metrics namespace when metrics are selected", async () => {
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "cw",
-					providerType: "aws_cloudwatch",
-					signals: ["logs", "metrics"],
-					apiKey: "AKIA",
-					apiSecret: "shh",
-					extraConfig: { region: "us-east-1", logGroup: "/dokploy/logs" },
-				} as any,
-				"org-1",
-			),
-		).rejects.toThrow(/Metrics namespace/);
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-});
-
-describe("signals are stored in a fixed order", () => {
-	it("normalizes the order on create", async () => {
-		mocks.insertValues.mockReset();
-		mocks.insertValues.mockReturnValue([{ telemetryProviderId: "dd-1" }]);
-
-		await createTelemetryProvider(
-			{
-				name: "dd",
-				providerType: "datadog",
-				signals: ["metrics", "logs"],
-				apiKey: "dd-key",
-			} as any,
-			"org-1",
-		);
-
-		expect(mocks.insertValues).toHaveBeenCalledWith(
-			expect.objectContaining({ signals: ["logs", "metrics"] }),
-		);
-	});
-
-	it("normalizes the order on update", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "dd-1",
-			name: "dd",
-			providerType: "datadog",
-			signals: ["logs"],
-			endpoint: null,
-			apiKey: "dd-key",
-			apiSecret: null,
-			extraConfig: null,
-		});
-		mocks.updateSet.mockReturnValue([{ telemetryProviderId: "dd-1" }]);
-
-		await updateTelemetryProvider("dd-1", { signals: ["metrics", "logs"] });
-
-		expect(mocks.updateSet).toHaveBeenCalledWith(
-			expect.objectContaining({ signals: ["logs", "metrics"] }),
-		);
-	});
-});
-
-describe("testTelemetryProviderConnection by id", () => {
-	it("tests the saved provider with the signals override from the form", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "bs-1",
-			name: "bs",
-			providerType: "betterstack",
-			signals: ["logs"],
-			endpoint: "in.logs.betterstack.com",
-			apiKey: "token",
-			apiSecret: null,
-			extraConfig: null,
-		});
-		const spy = vi
-			.spyOn(telemetryProviderAdapters.betterstack, "testConnection")
-			.mockResolvedValue(undefined);
-
-		await testTelemetryProviderConnection({
-			telemetryProviderId: "bs-1",
-			signals: ["logs", "metrics"],
-		});
-
-		expect(spy).toHaveBeenCalledWith(
-			expect.objectContaining({
-				apiKey: "token",
-				signals: ["logs", "metrics"],
-			}),
-		);
-		spy.mockRestore();
-	});
-});
-
-describe("updateTelemetryProvider — signals", () => {
-	const existing = {
-		telemetryProviderId: "dd-1",
-		name: "datadog",
-		providerType: "datadog",
-		signals: ["logs", "metrics"],
-		endpoint: null,
-		apiKey: "dd-key",
-		apiSecret: null,
-		extraConfig: null,
-	};
-
-	beforeEach(() => {
-		mocks.updateSet.mockReset();
-		mocks.serverFindFirst.mockReset();
-		mocks.webServerFindFirst.mockReset();
-		mocks.findFirst.mockResolvedValue(existing);
-		mocks.updateSet.mockReturnValue([{ ...existing, signals: ["metrics"] }]);
-	});
-
-	it("allows removing a signal while the provider is assigned and returns its targets to re-apply", async () => {
-		mocks.serverFindMany.mockResolvedValue([{ serverId: "server-1" }]);
-		mocks.webServerFindFirst.mockResolvedValue({ id: "ws-1" });
-
-		await expect(
-			updateTelemetryProvider("dd-1", { signals: ["metrics"] }),
-		).resolves.toMatchObject({
-			provider: { signals: ["metrics"] },
-			targets: ["server-1", null],
-		});
-		expect(mocks.updateSet).toHaveBeenCalledWith(
-			expect.objectContaining({ signals: ["metrics"] }),
-		);
-	});
-
-	it("rejects a type change that cannot send the saved signals", async () => {
-		await expect(
-			updateTelemetryProvider("dd-1", {
-				providerType: "loki",
-				endpoint: "https://loki.example.com",
-			}),
-		).rejects.toThrow(/Grafana Loki cannot send metrics/);
-	});
-});
@@ -1,305 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	setWebServerProviderIds: vi.fn(),
-	setServerProviderIds: vi.fn(),
-	getAccessibleServerIds: vi.fn(),
-	reconcileVectorAgent: vi.fn(),
-	removeVectorAgent: vi.fn(),
-	findServerById: vi.fn(),
-	assertProvidersBelongToOrg: vi.fn(),
-}));
-
-const loadAgent = async (isCloud: boolean) => {
-	vi.resetModules();
-	vi.doMock("@dokploy/server/constants", () => ({ IS_CLOUD: isCloud }));
-	vi.doMock("@dokploy/server/services/server", () => ({
-		findServerById: mocks.findServerById,
-		setServerProviderIds: mocks.setServerProviderIds,
-		getAccessibleServerIds: mocks.getAccessibleServerIds,
-	}));
-	vi.doMock("@dokploy/server/services/web-server-settings", () => ({
-		setWebServerProviderIds: mocks.setWebServerProviderIds,
-	}));
-	const locks = new Map<string, Promise<unknown>>();
-	vi.doMock("@dokploy/server/setup/vector-setup", () => ({
-		LOCAL_SERVER_NAME: "Dokploy Server (local)",
-		reconcileVectorAgent: mocks.reconcileVectorAgent,
-		removeVectorAgent: mocks.removeVectorAgent,
-		withVectorTargetLock: (
-			serverId: string | undefined,
-			fn: () => Promise<unknown>,
-		) => {
-			const key = serverId ?? "local";
-			const current = (locks.get(key) ?? Promise.resolve())
-				.catch(() => {})
-				.then(fn);
-			locks.set(key, current);
-			return current;
-		},
-	}));
-	vi.doMock("@dokploy/server/services/logs-and-metrics/service", () => ({
-		assertProvidersBelongToOrg: mocks.assertProvidersBelongToOrg,
-	}));
-	return await import("@dokploy/server/services/logs-and-metrics/vector-agent");
-};
-
-const sessionA = { userId: "user-a", activeOrganizationId: "org-a" };
-const sessionB = { userId: "user-b", activeOrganizationId: "org-b" };
-
-beforeEach(() => {
-	for (const mock of Object.values(mocks)) mock.mockReset();
-	mocks.getAccessibleServerIds.mockResolvedValue(new Set(["server-1"]));
-	mocks.findServerById.mockImplementation(async (serverId: string) => ({
-		serverId,
-		name: `name-of-${serverId}`,
-		organizationId: "org-a",
-		sshKeyId: "key-1",
-	}));
-	mocks.setWebServerProviderIds.mockResolvedValue({ id: "ws-1" });
-	mocks.setServerProviderIds.mockResolvedValue({ serverId: "server-1" });
-});
-
-describe("applyVectorAgentSelection on the local host", () => {
-	it("rejects the local host in cloud without touching the database", async () => {
-		const { applyVectorAgentSelection } = await loadAgent(true);
-
-		await expect(
-			applyVectorAgentSelection(sessionA, undefined, ["lp-1"]),
-		).rejects.toMatchObject({ code: "BAD_REQUEST" });
-		expect(mocks.setWebServerProviderIds).not.toHaveBeenCalled();
-		expect(mocks.reconcileVectorAgent).not.toHaveBeenCalled();
-	});
-
-	it("rejects with CONFLICT when another organization owns the local agent, without reconciling", async () => {
-		mocks.setWebServerProviderIds.mockResolvedValue(null);
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await expect(
-			applyVectorAgentSelection(sessionB, undefined, ["mp-1"]),
-		).rejects.toMatchObject({ code: "CONFLICT" });
-		expect(mocks.setWebServerProviderIds).toHaveBeenCalledWith("org-b", [
-			"mp-1",
-		]);
-		expect(mocks.reconcileVectorAgent).not.toHaveBeenCalled();
-	});
-
-	it("saves the selection and then reconciles", async () => {
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await applyVectorAgentSelection(sessionA, undefined, ["lp-1"]);
-		expect(mocks.assertProvidersBelongToOrg).toHaveBeenCalledWith(
-			["lp-1"],
-			"org-a",
-		);
-		expect(mocks.setWebServerProviderIds).toHaveBeenCalledWith("org-a", [
-			"lp-1",
-		]);
-		expect(mocks.reconcileVectorAgent).toHaveBeenCalledWith(undefined);
-		expect(
-			mocks.setWebServerProviderIds.mock.invocationCallOrder[0],
-		).toBeLessThan(mocks.reconcileVectorAgent.mock.invocationCallOrder[0] ?? 0);
-	});
-
-	it("removing the agent saves an empty selection without checking providers", async () => {
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await applyVectorAgentSelection(sessionA, undefined, []);
-		expect(mocks.assertProvidersBelongToOrg).not.toHaveBeenCalled();
-		expect(mocks.setWebServerProviderIds).toHaveBeenCalledWith("org-a", []);
-		expect(mocks.reconcileVectorAgent).toHaveBeenCalledWith(undefined);
-	});
-});
-
-describe("applyVectorAgentSelection on a remote server", () => {
-	it("still manages remote servers in cloud", async () => {
-		const { applyVectorAgentSelection } = await loadAgent(true);
-
-		const result = await applyVectorAgentSelection(sessionA, "server-1", []);
-		expect(result).toEqual({ serverName: "name-of-server-1" });
-		expect(mocks.setServerProviderIds).toHaveBeenCalledWith("server-1", []);
-		expect(mocks.reconcileVectorAgent).toHaveBeenCalledWith("server-1");
-	});
-
-	it("rejects a server of another organization", async () => {
-		mocks.findServerById.mockResolvedValue({
-			serverId: "server-1",
-			organizationId: "org-b",
-			sshKeyId: "key-1",
-		});
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await expect(
-			applyVectorAgentSelection(sessionA, "server-1", ["lp-1"]),
-		).rejects.toMatchObject({ code: "UNAUTHORIZED" });
-		expect(mocks.setServerProviderIds).not.toHaveBeenCalled();
-	});
-
-	it("rejects a server without an SSH key before saving anything", async () => {
-		mocks.findServerById.mockResolvedValue({
-			serverId: "server-1",
-			organizationId: "org-a",
-			sshKeyId: null,
-		});
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await expect(
-			applyVectorAgentSelection(sessionA, "server-1", ["lp-1"]),
-		).rejects.toMatchObject({ code: "BAD_REQUEST" });
-		expect(mocks.setServerProviderIds).not.toHaveBeenCalled();
-		expect(mocks.reconcileVectorAgent).not.toHaveBeenCalled();
-	});
-
-	it("rejects a server the member cannot access", async () => {
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await expect(
-			applyVectorAgentSelection(sessionA, "server-2", ["lp-1"]),
-		).rejects.toMatchObject({ code: "UNAUTHORIZED" });
-		expect(mocks.getAccessibleServerIds).toHaveBeenCalledWith(sessionA);
-		expect(mocks.setServerProviderIds).not.toHaveBeenCalled();
-		expect(mocks.reconcileVectorAgent).not.toHaveBeenCalled();
-	});
-
-	it("saves the array and only then reconciles", async () => {
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await applyVectorAgentSelection(sessionA, "server-1", ["mp-1"]);
-		expect(mocks.setServerProviderIds).toHaveBeenCalledWith("server-1", [
-			"mp-1",
-		]);
-		expect(mocks.setServerProviderIds.mock.invocationCallOrder[0]).toBeLessThan(
-			mocks.reconcileVectorAgent.mock.invocationCallOrder[0] ?? 0,
-		);
-	});
-
-	it("keeps the saved selection when the reconcile fails", async () => {
-		mocks.reconcileVectorAgent.mockRejectedValue(
-			new Error("validation failed"),
-		);
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await expect(
-			applyVectorAgentSelection(sessionA, "server-1", ["lp-2"]),
-		).rejects.toThrow("validation failed");
-		expect(mocks.setServerProviderIds).toHaveBeenCalledWith("server-1", [
-			"lp-2",
-		]);
-	});
-
-	it("serializes concurrent selections on the same host so the last reconcile sees the last selection", async () => {
-		const saved: string[][] = [];
-		const seen: string[][] = [];
-		mocks.setServerProviderIds.mockImplementation(
-			async (_serverId: string, ids: string[]) => {
-				saved.push(ids);
-				return { serverId: "server-1" };
-			},
-		);
-		mocks.reconcileVectorAgent.mockImplementation(async () => {
-			seen.push(saved.at(-1) ?? []);
-			await new Promise((resolve) => setTimeout(resolve, 20));
-		});
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await Promise.all([
-			applyVectorAgentSelection(sessionA, "server-1", ["lp-1"]),
-			applyVectorAgentSelection(sessionA, "server-1", ["lp-2"]),
-		]);
-		expect(seen).toEqual([["lp-1"], ["lp-2"]]);
-	});
-});
-
-describe("removeServerVectorAgent", () => {
-	it("removes the agent on server deletion when providers are assigned", async () => {
-		const { removeServerVectorAgent } = await loadAgent(false);
-
-		await expect(
-			removeServerVectorAgent({
-				serverId: "server-1",
-				sshKeyId: "key-1",
-				telemetryProviderIds: ["lp-1"],
-			} as never),
-		).resolves.toBeUndefined();
-		expect(mocks.removeVectorAgent).toHaveBeenCalledWith("server-1");
-	});
-
-	it("attempts cleanup even with an empty selection, since a failed Remove can leave the agent running", async () => {
-		const { removeServerVectorAgent } = await loadAgent(false);
-
-		await expect(
-			removeServerVectorAgent({
-				serverId: "server-1",
-				sshKeyId: "key-1",
-				telemetryProviderIds: [],
-			} as never),
-		).resolves.toBeUndefined();
-		expect(mocks.removeVectorAgent).toHaveBeenCalledWith("server-1");
-	});
-
-	it("skips servers without an SSH key, warning when providers were assigned", async () => {
-		const { removeServerVectorAgent } = await loadAgent(false);
-
-		await expect(
-			removeServerVectorAgent({
-				serverId: "server-1",
-				sshKeyId: null,
-				telemetryProviderIds: [],
-			} as never),
-		).resolves.toBeUndefined();
-		await expect(
-			removeServerVectorAgent({
-				serverId: "server-1",
-				sshKeyId: null,
-				telemetryProviderIds: ["lp-1"],
-			} as never),
-		).resolves.toMatch(/no SSH key/);
-		expect(mocks.removeVectorAgent).not.toHaveBeenCalled();
-	});
-
-	it("returns the failure as a message instead of throwing", async () => {
-		mocks.removeVectorAgent.mockRejectedValue(new Error("docker down"));
-		const { removeServerVectorAgent } = await loadAgent(false);
-
-		await expect(
-			removeServerVectorAgent({
-				serverId: "server-1",
-				sshKeyId: "k",
-				telemetryProviderIds: ["lp-1"],
-			} as never),
-		).resolves.toBe("docker down");
-	});
-});
-
-describe("reconcileVectorTargets", () => {
-	it("re-applies every target under its lock and reports failures as a warning", async () => {
-		mocks.reconcileVectorAgent.mockImplementation(async (serverId?: string) => {
-			if (serverId === "server-2") throw new Error("ssh down");
-		});
-		const { reconcileVectorTargets } = await loadAgent(false);
-
-		const warning = await reconcileVectorTargets([
-			"server-1",
-			"server-2",
-			null,
-		]);
-		expect(mocks.reconcileVectorAgent.mock.calls.map((c) => c[0])).toEqual([
-			"server-1",
-			"server-2",
-			undefined,
-		]);
-		expect(warning).toBe(
-			"The Vector agent could not be re-applied on server-2: ssh down",
-		);
-	});
-
-	it("returns no warning when every target reconciles, and skips the local host in cloud", async () => {
-		const { reconcileVectorTargets } = await loadAgent(true);
-
-		await expect(
-			reconcileVectorTargets(["server-1", null]),
-		).resolves.toBeUndefined();
-		expect(mocks.reconcileVectorAgent).toHaveBeenCalledTimes(1);
-		expect(mocks.reconcileVectorAgent).toHaveBeenCalledWith("server-1");
-	});
-});
@@ -1,375 +0,0 @@
-import { vrlString } from "@dokploy/server/services/logs-and-metrics/types";
-import {
-	buildMetricsScopeTransformSource,
-	buildVectorConfigYaml,
-	collectSecretValues,
-	redactSecrets,
-} from "@dokploy/server/setup/vector-setup";
-import { describe, expect, it } from "vitest";
-import { parse } from "yaml";
-
-const provider = (overrides: Record<string, unknown>) =>
-	({
-		apiKey: null,
-		apiSecret: null,
-		endpoint: null,
-		extraConfig: null,
-		signals: ["logs"],
-		...overrides,
-	}) as any;
-
-const loki = provider({
-	telemetryProviderId: "loki-1",
-	name: "loki",
-	providerType: "loki",
-	endpoint: "https://loki.example.com",
-});
-
-const prom = provider({
-	telemetryProviderId: "prom-1",
-	name: "prom",
-	providerType: "prometheus_remote_write",
-	signals: ["metrics"],
-	endpoint: "http://prom.example.com:9090/api/v1/write",
-});
-
-const datadog = provider({
-	telemetryProviderId: "dd-1",
-	name: "datadog",
-	providerType: "datadog",
-	signals: ["logs", "metrics"],
-	apiKey: "dd-key",
-});
-
-const build = (
-	overrides: Partial<Parameters<typeof buildVectorConfigYaml>[0]>,
-) =>
-	parse(
-		buildVectorConfigYaml({
-			logProviders: [],
-			metricsProviders: [],
-			serverName: "my server",
-			...overrides,
-		}),
-	) as any;
-
-describe("buildVectorConfigYaml — logs", () => {
-	it("generates a source, a dokploy_scope transform and one sink per provider, and nothing for metrics", () => {
-		const config = build({ logProviders: [loki] });
-
-		expect(config.data_dir).toBe("/var/lib/vector");
-		expect(config.sources.docker_logs_source.type).toBe("docker_logs");
-		expect(config.transforms.dokploy_scope.type).toBe("remap");
-		expect(config.transforms.dokploy_scope.inputs).toEqual([
-			"docker_logs_source",
-		]);
-		expect(Object.keys(config.sinks)).toEqual(["sink_loki-1"]);
-		expect(config.sinks["sink_loki-1"].type).toBe("loki");
-		expect(config.sinks["sink_loki-1"].inputs).toEqual(["dokploy_scope"]);
-
-		expect(config.sources.host_metrics_source).toBeUndefined();
-		expect(config.sources.cadvisor_source).toBeUndefined();
-		expect(config.transforms.dokploy_metrics_scope).toBeUndefined();
-	});
-
-	it("chains scope -> transform -> sink for betterstack/datadog, and scope -> sink direct for loki", () => {
-		const config = build({
-			logProviders: [
-				loki,
-				provider({
-					telemetryProviderId: "bs-1",
-					name: "betterstack",
-					providerType: "betterstack",
-					endpoint: "https://in.logs.betterstack.com",
-					apiKey: "token",
-				}),
-				datadog,
-			],
-		});
-
-		expect(config.sinks["sink_loki-1"].inputs).toEqual(["dokploy_scope"]);
-		expect(config.transforms["transform_bs-1"].inputs).toEqual([
-			"dokploy_scope",
-		]);
-		expect(config.sinks["sink_bs-1"].inputs).toEqual(["transform_bs-1"]);
-		expect(config.transforms["transform_dd-1"].inputs).toEqual([
-			"dokploy_scope",
-		]);
-		expect(config.sinks["sink_dd-1"].inputs).toEqual(["transform_dd-1"]);
-	});
-
-	it("tags every log with the server name and reads the Dokploy metadata straight off the container labels, with empty defaults for containers Dokploy did not deploy", () => {
-		const config = build({ logProviders: [loki], serverName: 'srv "quoted"' });
-
-		expect(config.transforms.dokploy_scope.source).toBe(
-			[
-				'.dokploy_server = "srv \\"quoted\\""',
-				'.dokploy_organization = .label."dokploy.organization.id" || ""',
-				'.dokploy_project = .label."dokploy.project" || ""',
-				'.dokploy_project_id = .label."dokploy.project.id" || ""',
-				'.dokploy_environment = .label."dokploy.environment" || ""',
-				'.dokploy_environment_id = .label."dokploy.environment.id" || ""',
-				'.dokploy_application = .label."dokploy.application" || ""',
-				'.dokploy_application_id = .label."dokploy.application.id" || ""',
-				'.dokploy_service = .label."dokploy.service" || ""',
-			].join("\n"),
-		);
-	});
-
-	it("skips a provider whose config an adapter rejects at build time, instead of failing the whole org's config", () => {
-		const config = build({
-			logProviders: [
-				provider({
-					telemetryProviderId: "broken-es",
-					name: "es-broken",
-					providerType: "elasticsearch",
-					endpoint: "https://es.example.com:9200",
-					extraConfig: { username: "elastic" },
-				}),
-				loki,
-			],
-		});
-
-		expect(Object.keys(config.sinks)).toEqual(["sink_loki-1"]);
-	});
-
-	it("only keeps containers of the owning organization on the local host, which is shared by every organization", () => {
-		const config = build({ logProviders: [loki], organizationId: "org-a" });
-
-		expect(config.transforms.dokploy_scope_local_only).toEqual({
-			type: "filter",
-			inputs: ["dokploy_scope"],
-			condition: '.dokploy_organization == "org-a"',
-		});
-		expect(config.sinks["sink_loki-1"].inputs).toEqual([
-			"dokploy_scope_local_only",
-		]);
-	});
-
-	it("does not add the organization filter for the per-server (non-local) path", () => {
-		const config = build({ logProviders: [loki] });
-
-		expect(config.transforms.dokploy_scope_local_only).toBeUndefined();
-	});
-});
-
-describe("buildVectorConfigYaml — metrics", () => {
-	it("with only metrics providers it emits the host and cAdvisor sources and no logs pipeline", () => {
-		const config = build({ metricsProviders: [prom] });
-
-		expect(config.sources.docker_logs_source).toBeUndefined();
-		expect(config.transforms.dokploy_scope).toBeUndefined();
-		expect(config.sources.host_metrics_source).toMatchObject({
-			type: "host_metrics",
-			scrape_interval_secs: 30,
-			collectors: [
-				"cpu",
-				"memory",
-				"disk",
-				"filesystem",
-				"network",
-				"load",
-				"host",
-			],
-		});
-		expect(
-			config.sources.host_metrics_source.filesystem.filesystems.excludes,
-		).toEqual(
-			expect.arrayContaining([
-				"overlay",
-				"tmpfs",
-				"squashfs",
-				"devtmpfs",
-				"nsfs",
-				"proc",
-				"sysfs",
-				"devpts",
-				"cgroup2",
-			]),
-		);
-		expect(config.sources.host_metrics_source.network.devices.excludes).toEqual(
-			["veth*", "br-*", "docker*"],
-		);
-		expect(config.sources.cadvisor_source).toEqual({
-			type: "prometheus_scrape",
-			endpoints: ["http://127.0.0.1:4510/metrics"],
-			scrape_interval_secs: 30,
-			scrape_timeout_secs: 10,
-		});
-		expect(config.transforms.dokploy_metrics_scope).toMatchObject({
-			type: "remap",
-			inputs: ["host_metrics_source", "cadvisor_source"],
-			drop_on_abort: true,
-		});
-		expect(Object.keys(config.sinks)).toEqual(["sink_prom-1_metrics"]);
-		expect(config.sinks["sink_prom-1_metrics"]).toMatchObject({
-			type: "prometheus_remote_write",
-			inputs: ["dokploy_metrics_scope"],
-		});
-		expect(config.transforms.dokploy_metrics_scope_local_only).toBeUndefined();
-	});
-
-	it("on the local host it lets host series through and keeps only the owning organization's containers", () => {
-		const config = build({ metricsProviders: [prom], organizationId: "org-a" });
-
-		expect(config.transforms.dokploy_metrics_scope_local_only).toEqual({
-			type: "filter",
-			inputs: ["dokploy_metrics_scope"],
-			condition:
-				'.namespace == "host" || .tags.dokploy_organization == "org-a"',
-		});
-		expect(config.sinks["sink_prom-1_metrics"].inputs).toEqual([
-			"dokploy_metrics_scope_local_only",
-		]);
-	});
-
-	it("a provider assigned to both signals gets a logs sink and a metrics sink without clashing", () => {
-		const config = build({
-			logProviders: [datadog],
-			metricsProviders: [datadog],
-			organizationId: "org-a",
-		});
-
-		expect(config.sinks["sink_dd-1"]).toMatchObject({
-			type: "datadog_logs",
-			inputs: ["transform_dd-1"],
-		});
-		expect(config.sinks["sink_dd-1_metrics"]).toMatchObject({
-			type: "datadog_metrics",
-			inputs: ["dokploy_metrics_scope_local_only"],
-		});
-		expect(config.transforms["transform_dd-1_metrics"]).toBeUndefined();
-	});
-
-	it("tags every series with the server name, promotes non-empty dokploy labels and drops the cgroup id", () => {
-		const source = buildMetricsScopeTransformSource('srv "quoted"');
-
-		expect(source).toContain('.tags.dokploy_server = "srv \\"quoted\\""');
-		expect(source).toContain(
-			'if .namespace != "host" && !starts_with(string!(.name), "container_") { abort }',
-		);
-		expect(source).toContain(
-			'value = del(.tags.container_label_dokploy_application)\nif is_string(value) && value != "" { .tags.dokploy_application = value }',
-		);
-		expect(source.trim().endsWith("del(.tags.id)")).toBe(true);
-		expect(
-			build({ metricsProviders: [prom] }).transforms.dokploy_metrics_scope
-				.source,
-		).toBe(buildMetricsScopeTransformSource("my server"));
-	});
-});
-
-describe("buildVectorConfigYaml — dollar signs", () => {
-	it("keeps every $ literal because the agent runs without env var interpolation", () => {
-		const yamlStr = buildVectorConfigYaml({
-			logProviders: [
-				provider({
-					telemetryProviderId: "loki-1",
-					name: "loki",
-					providerType: "loki",
-					endpoint: "https://loki.example.com",
-					apiKey: "Pa$5w0rd$HOME",
-					extraConfig: { username: "12345" },
-				}),
-			],
-			metricsProviders: [prom],
-			serverName: "srv $ONE",
-		});
-
-		expect(yamlStr).not.toContain("$$");
-		expect(yamlStr).toContain("srv $ONE");
-		expect(parse(yamlStr).sinks["sink_loki-1"].auth.password).toBe(
-			"Pa$5w0rd$HOME",
-		);
-	});
-});
-
-describe("collectSecretValues / redactSecrets", () => {
-	it("collects endpoint/apiKey/apiSecret across all providers but only the password-type extraConfig fields", () => {
-		const providers = [
-			{
-				providerType: "loki",
-				endpoint: "https://loki.example.com",
-				apiKey: "loki-key",
-				apiSecret: null,
-				extraConfig: { tenantId: "tenant-a", username: "12345" },
-			},
-			{
-				providerType: "datadog",
-				endpoint: null,
-				apiKey: "dd-key",
-				apiSecret: null,
-				extraConfig: { site: "datadoghq.eu" },
-			},
-			{
-				providerType: "aws_cloudwatch",
-				endpoint: null,
-				apiKey: "AKIA",
-				apiSecret: "shh",
-				extraConfig: { region: "us-east-1", metricsNamespace: "Dokploy" },
-			},
-		] as any;
-
-		const values = collectSecretValues(providers);
-		expect(values).toEqual(
-			expect.arrayContaining([
-				"https://loki.example.com",
-				"loki-key",
-				"dd-key",
-				"AKIA",
-				"shh",
-			]),
-		);
-		for (const plain of [
-			"tenant-a",
-			"12345",
-			"datadoghq.eu",
-			"us-east-1",
-			"Dokploy",
-		]) {
-			expect(values).not.toContain(plain);
-		}
-	});
-
-	it("ignores null/empty credentials", () => {
-		const providers = [
-			{
-				providerType: "elasticsearch",
-				endpoint: null,
-				apiKey: null,
-				apiSecret: null,
-				extraConfig: { limit: 10, enabled: true, empty: "" },
-			},
-		] as any;
-		expect(collectSecretValues(providers)).toEqual([]);
-	});
-
-	it("redacts every collected secret, longest first so a short one can't eat part of a longer one", () => {
-		const providers = [
-			{
-				providerType: "loki",
-				endpoint: null,
-				apiKey: "hunter2-long-suffix",
-				apiSecret: "hunter2",
-				extraConfig: null,
-			},
-		] as any;
-		const text =
-			"sink validation error near apiKey=hunter2-long-suffix and hunter2";
-
-		const redacted = redactSecrets(text, collectSecretValues(providers));
-
-		expect(redacted).not.toContain("hunter2");
-		expect(redacted).toBe(
-			"sink validation error near apiKey=[redacted] and [redacted]",
-		);
-	});
-});
-
-describe("vrlString", () => {
-	it("quotes and escapes like JSON but drops the control characters VRL rejects", () => {
-		expect(vrlString('my "server"')).toBe('"my \\"server\\""');
-		expect(vrlString("back\\slash")).toBe('"back\\\\slash"');
-		expect(vrlString("a\u0008b\u000cc\u0000d\u007fe\nf")).toBe('"abcdef"');
-	});
-});
@@ -1,526 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import { parse } from "yaml";
-
-const mocks = vi.hoisted(() => ({
-	findServerById: vi.fn(),
-	getWebServerSettings: vi.fn(),
-	findEnabledTelemetryProvidersByOrganization: vi.fn(),
-	execAsync: vi.fn(),
-	execAsyncRemote: vi.fn(),
-	inspectService: vi.fn(),
-	updateService: vi.fn(),
-	removeService: vi.fn(),
-	createService: vi.fn(),
-	getService: vi.fn(),
-	listContainers: vi.fn(),
-	killContainer: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/db", () => ({ db: {} }));
-vi.mock("@dokploy/server/constants", () => ({
-	IS_CLOUD: false,
-	paths: (isServer: boolean) => ({
-		VECTOR_PATH: isServer ? "/etc/dokploy/vector" : "/local/dokploy/vector",
-	}),
-}));
-vi.mock("@dokploy/server/services/server", () => ({
-	findServerById: mocks.findServerById,
-	findServersByOrganizationForVectorAgent: vi.fn(),
-	getAccessibleServerIds: vi.fn(),
-}));
-vi.mock("@dokploy/server/services/web-server-settings", () => ({
-	getWebServerSettings: mocks.getWebServerSettings,
-}));
-vi.mock(
-	"@dokploy/server/services/logs-and-metrics/service",
-	async (importOriginal) => ({
-		...(await importOriginal<
-			typeof import("@dokploy/server/services/logs-and-metrics/service")
-		>()),
-		findEnabledTelemetryProvidersByOrganization:
-			mocks.findEnabledTelemetryProvidersByOrganization,
-	}),
-);
-vi.mock("@dokploy/server/utils/process/execAsync", () => ({
-	execAsync: mocks.execAsync,
-	execAsyncRemote: mocks.execAsyncRemote,
-}));
-vi.mock("@dokploy/server/utils/servers/remote-docker", () => ({
-	getRemoteDocker: async () => ({
-		getService: mocks.getService,
-		createService: mocks.createService,
-		listContainers: mocks.listContainers,
-		getContainer: () => ({ kill: mocks.killContainer }),
-	}),
-}));
-
-const { reconcileVectorAgent, removeVectorAgent } = await import(
-	"@dokploy/server/setup/vector-setup"
-);
-
-const lokiProvider = {
-	telemetryProviderId: "lp-1",
-	name: "loki",
-	providerType: "loki",
-	signals: ["logs"],
-	endpoint: "https://loki.example.com",
-	apiKey: "sekret-token",
-	apiSecret: null,
-	extraConfig: null,
-	enabled: true,
-	organizationId: "org-a",
-};
-
-const promProvider = {
-	...lokiProvider,
-	telemetryProviderId: "mp-1",
-	name: "prom",
-	providerType: "prometheus_remote_write",
-	signals: ["metrics"],
-	endpoint: "http://prom.example.com:9090/api/v1/write",
-	apiKey: null,
-};
-
-const notFound = () =>
-	Object.assign(new Error("not found"), { statusCode: 404 });
-
-const writtenYaml = (command: string) => {
-	const match = command.match(/echo "([^"]+)" \| base64 -d/);
-	return parse(Buffer.from(match?.[1] ?? "", "base64").toString("utf8"));
-};
-
-const commandsOf = (mock: typeof mocks.execAsync) =>
-	mock.mock.calls.map((call) => String(call[call.length - 1]));
-
-beforeEach(() => {
-	for (const mock of Object.values(mocks)) mock.mockReset();
-	mocks.getService.mockImplementation(() => ({
-		inspect: mocks.inspectService,
-		update: mocks.updateService,
-		remove: mocks.removeService,
-	}));
-	mocks.inspectService.mockRejectedValue(notFound());
-	mocks.removeService.mockRejectedValue(notFound());
-	mocks.execAsync.mockResolvedValue({ stdout: "", stderr: "" });
-	mocks.execAsyncRemote.mockResolvedValue({ stdout: "", stderr: "" });
-	mocks.listContainers.mockResolvedValue([{ Id: "vector-container" }]);
-	mocks.killContainer.mockResolvedValue(undefined);
-});
-
-describe("reconcileVectorAgent", () => {
-	it("writes, validates and applies the YAML and deploys Vector for the saved selection", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-
-		await reconcileVectorAgent();
-
-		const commands = commandsOf(mocks.execAsync);
-		expect(commands).toHaveLength(3);
-		expect(commands[0]).toContain(
-			"/local/dokploy/vector/vector.yaml.candidate.",
-		);
-		expect(commands[1]).toMatch(
-			/timberio\/vector:\d+\.\d+\.\d+-alpine validate --skip-healthchecks/,
-		);
-		expect(commands[2]).toMatch(
-			/^mv \/local\/dokploy\/vector\/vector\.yaml\.candidate\.\S+ \/local\/dokploy\/vector\/vector\.yaml$/,
-		);
-		expect(mocks.execAsyncRemote).not.toHaveBeenCalled();
-
-		const config = writtenYaml(commands[0] ?? "");
-		expect(config.sinks["sink_lp-1"].inputs).toEqual([
-			"dokploy_scope_local_only",
-		]);
-		expect(config.sources.host_metrics_source).toBeUndefined();
-
-		expect(mocks.createService).toHaveBeenCalledTimes(1);
-		expect(mocks.createService.mock.calls[0]?.[0]).toMatchObject({
-			Name: "dokploy-vector",
-		});
-		expect(mocks.getService).toHaveBeenCalledWith("dokploy-cadvisor");
-		expect(mocks.removeService).toHaveBeenCalledTimes(1);
-	});
-
-	it("splits one selection into the logs and metrics pipelines by what each provider sends", async () => {
-		const datadogProvider = {
-			...lokiProvider,
-			telemetryProviderId: "dd-1",
-			name: "datadog",
-			providerType: "datadog",
-			signals: ["logs", "metrics"],
-			endpoint: null,
-			apiKey: "dd-key",
-		};
-		const unselected = { ...lokiProvider, telemetryProviderId: "lp-9" };
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1", "mp-1", "dd-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-			promProvider,
-			datadogProvider,
-			unselected,
-		]);
-
-		await reconcileVectorAgent();
-
-		const config = writtenYaml(commandsOf(mocks.execAsync)[0] ?? "");
-		const sinkIds = Object.keys(config.sinks);
-		expect(sinkIds.some((id) => id.includes("lp-1"))).toBe(true);
-		expect(sinkIds.some((id) => id.includes("mp-1"))).toBe(true);
-		expect(sinkIds.filter((id) => id.includes("dd-1")).length).toBe(2);
-		expect(sinkIds.some((id) => id.includes("lp-9"))).toBe(false);
-		expect(config.sources.docker_logs_source).toBeDefined();
-		expect(config.sources.cadvisor_source).toBeDefined();
-		expect(mocks.createService.mock.calls.map((c) => c[0].Name)).toEqual([
-			"dokploy-vector",
-			"dokploy-cadvisor",
-		]);
-	});
-
-	it("removes cAdvisor but keeps Vector when no selected provider sends metrics", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1", "mp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-
-		await reconcileVectorAgent();
-
-		const config = writtenYaml(commandsOf(mocks.execAsync)[0] ?? "");
-		expect(config.sources.cadvisor_source).toBeUndefined();
-		expect(mocks.createService.mock.calls.map((c) => c[0].Name)).toEqual([
-			"dokploy-vector",
-		]);
-		expect(mocks.getService).toHaveBeenCalledWith("dokploy-cadvisor");
-		expect(mocks.removeService).toHaveBeenCalledTimes(1);
-	});
-
-	it("filters by the organization only on the local host and runs on the server over SSH", async () => {
-		mocks.findServerById.mockResolvedValue({
-			serverId: "server-1",
-			organizationId: "org-a",
-			name: "edge-1",
-			telemetryProviderIds: ["lp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-
-		await reconcileVectorAgent("server-1");
-
-		expect(mocks.execAsync).not.toHaveBeenCalled();
-		expect(
-			mocks.execAsyncRemote.mock.calls.every((c) => c[0] === "server-1"),
-		).toBe(true);
-		const config = writtenYaml(commandsOf(mocks.execAsyncRemote)[0] ?? "");
-		expect(config.transforms.dokploy_scope_local_only).toBeUndefined();
-		expect(config.sinks["sink_lp-1"].inputs).toEqual(["dokploy_scope"]);
-	});
-
-	it("does not apply a config that vector validate rejects, redacts secrets and leaves the selection alone", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-		mocks.execAsync.mockImplementation(async (command: string) => {
-			if (command.includes("validate")) {
-				throw new Error("bad sink: password sekret-token rejected");
-			}
-			return { stdout: "", stderr: "" };
-		});
-
-		await expect(reconcileVectorAgent()).rejects.toThrow(
-			/failed validation, not applying it: bad sink: password \[redacted\] rejected/,
-		);
-
-		const commands = commandsOf(mocks.execAsync);
-		expect(commands.some((c) => c.startsWith("mv "))).toBe(false);
-		expect(commands.some((c) => c.startsWith("rm -f "))).toBe(true);
-		expect(mocks.createService).not.toHaveBeenCalled();
-	});
-
-	it("removes the agent when no enabled provider is left in the selection", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["deleted-or-disabled"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([]);
-
-		await reconcileVectorAgent();
-
-		expect(mocks.getService).toHaveBeenCalledWith("dokploy-cadvisor");
-		expect(mocks.getService).toHaveBeenCalledWith("dokploy-vector");
-		expect(mocks.removeService).toHaveBeenCalledTimes(2);
-		expect(commandsOf(mocks.execAsync)).toEqual([
-			"rm -rf /local/dokploy/vector",
-		]);
-		expect(mocks.createService).not.toHaveBeenCalled();
-	});
-
-	it("removes the agent when the selection is empty, without an owner", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: null,
-			telemetryProviderIds: [],
-		});
-
-		await reconcileVectorAgent();
-
-		expect(
-			mocks.findEnabledTelemetryProvidersByOrganization,
-		).not.toHaveBeenCalled();
-		expect(mocks.removeService).toHaveBeenCalledTimes(2);
-	});
-
-	it("deploys cAdvisor next to Vector when metrics providers are assigned", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["mp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			promProvider,
-		]);
-
-		await reconcileVectorAgent();
-
-		const config = writtenYaml(commandsOf(mocks.execAsync)[0] ?? "");
-		expect(config.sources.docker_logs_source).toBeUndefined();
-		expect(config.sources.cadvisor_source.endpoints).toEqual([
-			"http://127.0.0.1:4510/metrics",
-		]);
-
-		expect(mocks.createService.mock.calls.map((c) => c[0].Name)).toEqual([
-			"dokploy-vector",
-			"dokploy-cadvisor",
-		]);
-		const cadvisor = mocks.createService.mock.calls[1]?.[0];
-		expect(cadvisor.TaskTemplate.ContainerSpec.Image).toMatch(
-			/^ghcr\.io\/google\/cadvisor:v\d+\.\d+\.\d+$/,
-		);
-		expect(cadvisor.TaskTemplate.ContainerSpec.Args).toEqual(
-			expect.arrayContaining([
-				"--listen_ip=127.0.0.1",
-				"--port=4510",
-				"--docker_only=true",
-				"--store_container_labels=false",
-			]),
-		);
-		expect(cadvisor.TaskTemplate.ContainerSpec.HealthCheck).toEqual({
-			Test: ["NONE"],
-		});
-		expect(cadvisor.TaskTemplate.Networks).toEqual([{ Target: "host" }]);
-		expect(mocks.removeService).not.toHaveBeenCalled();
-	});
-
-	it("removes the agent on a remote server when the selection is empty", async () => {
-		mocks.findServerById.mockResolvedValue({
-			serverId: "server-1",
-			sshKeyId: "key-1",
-			organizationId: "org-a",
-			name: "edge-1",
-			telemetryProviderIds: [],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([]);
-
-		await reconcileVectorAgent("server-1");
-
-		expect(
-			mocks.findEnabledTelemetryProvidersByOrganization,
-		).toHaveBeenCalled();
-		expect(mocks.removeService).toHaveBeenCalledTimes(2);
-		expect(mocks.createService).not.toHaveBeenCalled();
-		expect(commandsOf(mocks.execAsyncRemote)).toEqual([
-			"rm -rf /etc/dokploy/vector",
-		]);
-	});
-
-	it("redacts the config and secrets when writing or applying the candidate fails", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-		const echoCommand = async (command: string) => {
-			if (command.includes("base64 -d") || command.startsWith("mv ")) {
-				throw new Error(`Command failed: ${command} (token sekret-token)`);
-			}
-			return { stdout: "", stderr: "" };
-		};
-		mocks.execAsync.mockImplementation(echoCommand);
-
-		const writeError = await reconcileVectorAgent().catch(
-			(e: Error) => e.message,
-		);
-		expect(writeError).toMatch(/^Failed to write the Vector config: /);
-		expect(writeError).not.toContain("sekret-token");
-		expect(writeError).not.toContain(
-			Buffer.from("data_dir").toString("base64").slice(0, 8),
-		);
-		expect(writeError).toContain("[redacted]");
-
-		mocks.execAsync.mockImplementation(async (command: string) => {
-			if (command.startsWith("mv ")) return echoCommand(command);
-			return { stdout: "", stderr: "" };
-		});
-		const applyError = await reconcileVectorAgent().catch(
-			(e: Error) => e.message,
-		);
-		expect(applyError).toMatch(/^Failed to apply the Vector config: /);
-		expect(applyError).not.toContain("sekret-token");
-		expect(mocks.createService).not.toHaveBeenCalled();
-	});
-
-	it("propagates a rejected service update instead of pretending the create succeeded", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-		mocks.inspectService.mockResolvedValue({
-			Version: { Index: "7" },
-			Spec: { TaskTemplate: { ForceUpdate: 2 } },
-		});
-		mocks.updateService.mockRejectedValue(
-			new Error("rpc error: invalid mount"),
-		);
-
-		await expect(reconcileVectorAgent()).rejects.toThrow("invalid mount");
-		expect(mocks.createService).not.toHaveBeenCalled();
-	});
-
-	it("propagates an inspect failure that is not a 404", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-		mocks.inspectService.mockRejectedValue(
-			Object.assign(new Error("daemon unreachable"), { statusCode: 500 }),
-		);
-
-		await expect(reconcileVectorAgent()).rejects.toThrow("daemon unreachable");
-		expect(mocks.createService).not.toHaveBeenCalled();
-	});
-
-	it("does not restart Vector on a config-only redeploy", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-		mocks.inspectService.mockImplementation(async () => ({
-			Version: { Index: "7" },
-			Spec: {
-				TaskTemplate: {
-					ForceUpdate: 2,
-					ContainerSpec: mocks.createService.mock.calls[0]?.[0]
-						? undefined
-						: undefined,
-				},
-			},
-		}));
-
-		await reconcileVectorAgent();
-		expect(mocks.killContainer).toHaveBeenCalledWith({ signal: "SIGHUP" });
-		expect(mocks.listContainers).toHaveBeenCalledWith({
-			filters: JSON.stringify({
-				label: ["com.docker.swarm.service.name=dokploy-vector"],
-			}),
-		});
-		const firstSpec = mocks.updateService.mock.calls[0]?.[0];
-		mocks.inspectService.mockResolvedValue({
-			Version: { Index: "8" },
-			Spec: { TaskTemplate: { ...firstSpec.TaskTemplate, ForceUpdate: 3 } },
-		});
-		mocks.updateService.mockClear();
-
-		await reconcileVectorAgent();
-		expect(mocks.updateService).toHaveBeenCalledWith(
-			expect.objectContaining({
-				version: 8,
-				TaskTemplate: expect.objectContaining({ ForceUpdate: 3 }),
-			}),
-		);
-	});
-
-	it("updates an existing Vector service instead of creating it", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-		mocks.inspectService.mockResolvedValue({
-			Version: { Index: "7" },
-			Spec: { TaskTemplate: { ForceUpdate: 2 } },
-		});
-
-		await reconcileVectorAgent();
-
-		expect(mocks.createService).not.toHaveBeenCalled();
-		expect(mocks.updateService).toHaveBeenCalledWith(
-			expect.objectContaining({
-				version: 7,
-				TaskTemplate: expect.objectContaining({ ForceUpdate: 3 }),
-			}),
-		);
-	});
-});
-
-describe("removeVectorAgent", () => {
-	it("removes cAdvisor, then Vector, then the config directory", async () => {
-		await removeVectorAgent();
-
-		expect(mocks.getService.mock.calls.map((c) => c[0])).toEqual([
-			"dokploy-cadvisor",
-			"dokploy-vector",
-		]);
-		expect(commandsOf(mocks.execAsync)).toEqual([
-			"rm -rf /local/dokploy/vector",
-		]);
-	});
-
-	it("keeps going when cAdvisor cannot be removed", async () => {
-		mocks.removeService
-			.mockRejectedValueOnce(new Error("docker hiccup"))
-			.mockRejectedValueOnce(notFound());
-
-		await removeVectorAgent();
-
-		expect(mocks.removeService).toHaveBeenCalledTimes(2);
-		expect(commandsOf(mocks.execAsync)).toEqual([
-			"rm -rf /local/dokploy/vector",
-		]);
-	});
-
-	it("refuses a server without an SSH key before touching cAdvisor or Vector", async () => {
-		mocks.findServerById.mockResolvedValue({
-			serverId: "server-1",
-			sshKeyId: null,
-		});
-
-		await expect(removeVectorAgent("server-1")).rejects.toThrow(/SSH key/);
-		expect(mocks.getService).not.toHaveBeenCalled();
-		expect(mocks.execAsyncRemote).not.toHaveBeenCalled();
-	});
-});
@@ -1,214 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	listTasks: vi.fn(),
-	inspectService: vi.fn(),
-	findServersByOrganizationForVectorAgent: vi.fn(),
-	getAccessibleServerIds: vi.fn(),
-	getWebServerSettings: vi.fn(),
-	findTelemetryProvidersByOrganization: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/db", () => ({ db: {} }));
-vi.mock("@dokploy/server/constants", () => ({
-	IS_CLOUD: false,
-	paths: () => ({ VECTOR_PATH: "/etc/dokploy/vector" }),
-}));
-vi.mock("@dokploy/server/services/server", () => ({
-	findServerById: vi.fn(),
-	findServersByOrganizationForVectorAgent:
-		mocks.findServersByOrganizationForVectorAgent,
-	getAccessibleServerIds: mocks.getAccessibleServerIds,
-}));
-vi.mock("@dokploy/server/services/web-server-settings", () => ({
-	getWebServerSettings: mocks.getWebServerSettings,
-}));
-vi.mock(
-	"@dokploy/server/services/logs-and-metrics/service",
-	async (importOriginal) => ({
-		...(await importOriginal<
-			typeof import("@dokploy/server/services/logs-and-metrics/service")
-		>()),
-		findTelemetryProvidersByOrganization:
-			mocks.findTelemetryProvidersByOrganization,
-	}),
-);
-vi.mock("@dokploy/server/utils/servers/remote-docker", () => ({
-	getRemoteDocker: async () => ({
-		listTasks: mocks.listTasks,
-		getService: () => ({ inspect: mocks.inspectService }),
-	}),
-}));
-
-const { getVectorAgentTargets, withVectorTargetLock } = await import(
-	"@dokploy/server/setup/vector-setup"
-);
-
-const session = { userId: "user-1", activeOrganizationId: "org-1" };
-
-describe("getVectorAgentTargets", () => {
-	beforeEach(() => {
-		for (const mock of Object.values(mocks)) mock.mockReset();
-		mocks.findServersByOrganizationForVectorAgent.mockResolvedValue([]);
-		mocks.inspectService.mockResolvedValue({});
-		mocks.getAccessibleServerIds.mockResolvedValue(new Set());
-		mocks.findTelemetryProvidersByOrganization.mockResolvedValue([
-			{ telemetryProviderId: "lp-1", enabled: true, signals: ["logs"] },
-			{ telemetryProviderId: "mp-1", enabled: true, signals: ["metrics"] },
-			{ telemetryProviderId: "mp-off", enabled: false, signals: ["metrics"] },
-		]);
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-1",
-			telemetryProviderIds: ["lp-1"],
-		});
-	});
-
-	it("requires a running cAdvisor task when the target ships metrics", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-1",
-			telemetryProviderIds: ["mp-1"],
-		});
-		mocks.listTasks.mockImplementation(
-			async ({ filters }: { filters: string }) =>
-				JSON.parse(filters).service[0] === "dokploy-vector"
-					? [{ Status: { State: "running" } }]
-					: [],
-		);
-
-		const [local] = await getVectorAgentTargets(session);
-		expect(local?.status).toBe("not-running");
-		expect(mocks.listTasks).toHaveBeenCalledTimes(2);
-	});
-
-	it("reports running when both Vector and cAdvisor have a running task", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-1",
-			telemetryProviderIds: ["mp-1"],
-		});
-		mocks.listTasks.mockResolvedValue([{ Status: { State: "running" } }]);
-
-		const [local] = await getVectorAgentTargets(session);
-		expect(local?.status).toBe("running");
-	});
-
-	it("does not look at cAdvisor for a logs-only target", async () => {
-		mocks.listTasks.mockResolvedValue([{ Status: { State: "running" } }]);
-
-		await getVectorAgentTargets(session);
-		expect(mocks.listTasks).toHaveBeenCalledTimes(1);
-	});
-
-	it("does not look at cAdvisor when the only metrics provider is disabled", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-1",
-			telemetryProviderIds: ["lp-1", "mp-off"],
-		});
-		mocks.listTasks.mockResolvedValue([{ Status: { State: "running" } }]);
-
-		const [local] = await getVectorAgentTargets(session);
-		expect(local?.status).toBe("running");
-		expect(mocks.listTasks).toHaveBeenCalledTimes(1);
-	});
-
-	it("reports running only when a task of the service is running", async () => {
-		mocks.listTasks.mockResolvedValue([{ Status: { State: "running" } }]);
-
-		const [local] = await getVectorAgentTargets(session);
-		expect(local?.status).toBe("running");
-		expect(mocks.listTasks).toHaveBeenCalledWith({
-			filters: JSON.stringify({
-				service: ["dokploy-vector"],
-				"desired-state": ["running"],
-			}),
-		});
-	});
-
-	it("reports not-running when the service has no running task", async () => {
-		mocks.listTasks.mockResolvedValue([{ Status: { State: "pending" } }]);
-
-		const [local] = await getVectorAgentTargets(session);
-		expect(local?.status).toBe("not-running");
-	});
-
-	it("reports stopped when the service does not exist", async () => {
-		mocks.inspectService.mockRejectedValue(
-			Object.assign(new Error("not found"), { statusCode: 404 }),
-		);
-		mocks.listTasks.mockResolvedValue([]);
-
-		const [local] = await getVectorAgentTargets(session);
-		expect(local?.status).toBe("stopped");
-		expect(mocks.listTasks).not.toHaveBeenCalled();
-	});
-
-	it("reports unknown on any other docker error", async () => {
-		mocks.inspectService.mockRejectedValue(new Error("connect ECONNREFUSED"));
-
-		const [local] = await getVectorAgentTargets(session);
-		expect(local?.status).toBe("unknown");
-	});
-
-	it("reports an empty selection for an unowned local host, even with ids left by a deleted organization", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: null,
-			telemetryProviderIds: ["lp-from-deleted-org", "mp-from-deleted-org"],
-		});
-		mocks.listTasks.mockResolvedValue([]);
-
-		const [local] = await getVectorAgentTargets(session);
-		expect(local).toMatchObject({
-			serverId: null,
-			telemetryProviderIds: [],
-		});
-	});
-
-	it("hides servers the member cannot access", async () => {
-		mocks.listTasks.mockResolvedValue([]);
-		mocks.findServersByOrganizationForVectorAgent.mockResolvedValue([
-			{
-				serverId: "server-1",
-				name: "one",
-				ipAddress: "1.1.1.1",
-				telemetryProviderIds: [],
-			},
-			{
-				serverId: "server-2",
-				name: "two",
-				ipAddress: "2.2.2.2",
-				telemetryProviderIds: [],
-			},
-		]);
-		mocks.getAccessibleServerIds.mockResolvedValue(new Set(["server-2"]));
-
-		const targets = await getVectorAgentTargets(session);
-		expect(targets.map((t) => t.serverId)).toEqual([null, "server-2"]);
-	});
-});
-
-describe("withVectorTargetLock", () => {
-	it("runs operations on the same target one after another", async () => {
-		const events: string[] = [];
-		let releaseFirst = () => {};
-		const first = withVectorTargetLock("server-1", async () => {
-			events.push("first:start");
-			await new Promise<void>((resolve) => {
-				releaseFirst = resolve;
-			});
-			events.push("first:end");
-			throw new Error("first failed");
-		});
-		const second = withVectorTargetLock("server-1", async () => {
-			events.push("second");
-		});
-		const other = withVectorTargetLock("server-2", async () => {
-			events.push("other");
-		});
-
-		await other;
-		expect(events).toEqual(["first:start", "other"]);
-		releaseFirst();
-		await expect(first).rejects.toThrow("first failed");
-		await second;
-		expect(events).toEqual(["first:start", "other", "first:end", "second"]);
-	});
-});
@@ -1,197 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { mkdtempSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import {
-	buildVectorConfigYaml,
-	VECTOR_IMAGE,
-} from "@dokploy/server/setup/vector-setup";
-import { describe, expect, it } from "vitest";
-
-const dockerAvailable = (() => {
-	try {
-		execFileSync("docker", ["info"], { stdio: "ignore", timeout: 10_000 });
-		return true;
-	} catch {
-		return false;
-	}
-})();
-
-const provider = (overrides: Record<string, unknown>) =>
-	({
-		apiKey: null,
-		apiSecret: null,
-		endpoint: null,
-		extraConfig: null,
-		enabled: true,
-		...overrides,
-	}) as any;
-
-const logsOnly = [
-	provider({
-		telemetryProviderId: "loki1",
-		name: "loki",
-		providerType: "loki",
-		signals: ["logs"],
-		endpoint: "http://loki.example.com:3100",
-		apiKey: "Pa$5w0rd$HOME",
-		extraConfig: { username: "12345" },
-	}),
-];
-
-const metricsOnly = [
-	provider({
-		telemetryProviderId: "prom1",
-		name: "prom",
-		providerType: "prometheus_remote_write",
-		signals: ["metrics"],
-		endpoint: "http://prom.example.com:9090/api/v1/write",
-		apiKey: "token",
-		extraConfig: { tenantId: "team-a" },
-	}),
-	provider({
-		telemetryProviderId: "nr1",
-		name: "new relic",
-		providerType: "new_relic",
-		signals: ["metrics"],
-		apiKey: "license",
-		extraConfig: { accountId: "123", region: "eu" },
-	}),
-	provider({
-		telemetryProviderId: "influx1",
-		name: "influx",
-		providerType: "influxdb",
-		signals: ["metrics"],
-		endpoint: "http://influx.example.com:8086",
-		apiKey: "token",
-		extraConfig: { org: "dokploy", bucket: "metrics" },
-	}),
-];
-
-const both = [
-	provider({
-		telemetryProviderId: "dd1",
-		name: "datadog",
-		providerType: "datadog",
-		signals: ["logs", "metrics"],
-		apiKey: "dd-key",
-	}),
-	provider({
-		telemetryProviderId: "cw1",
-		name: "cloudwatch",
-		providerType: "aws_cloudwatch",
-		signals: ["logs", "metrics"],
-		apiKey: "AKIAFAKE",
-		apiSecret: "secret",
-		extraConfig: {
-			region: "us-east-1",
-			logGroup: "/dokploy/logs",
-			metricsNamespace: "Dokploy",
-		},
-	}),
-	provider({
-		telemetryProviderId: "splunk1",
-		name: "splunk",
-		providerType: "splunk_hec",
-		signals: ["logs", "metrics"],
-		endpoint: "https://splunk.example.com:8088",
-		apiKey: "hec",
-		extraConfig: { index: "main", metricsIndex: "dokploy_metrics" },
-	}),
-	provider({
-		telemetryProviderId: "es1",
-		name: "elastic",
-		providerType: "elasticsearch",
-		signals: ["logs", "metrics"],
-		endpoint: "http://es.example.com:9200",
-		apiKey: "pw",
-		extraConfig: { username: "elastic" },
-	}),
-	provider({
-		telemetryProviderId: "bs1",
-		name: "better stack",
-		providerType: "betterstack",
-		signals: ["logs", "metrics"],
-		endpoint: "in.logs.betterstack.com",
-		apiKey: "token",
-	}),
-];
-
-const cases: Array<[string, Parameters<typeof buildVectorConfigYaml>[0]]> = [
-	[
-		"local logs only",
-		{
-			logProviders: logsOnly,
-			metricsProviders: [],
-			organizationId: "org_a",
-			serverName: "Dokploy Server (local)",
-		},
-	],
-	[
-		"local metrics only",
-		{
-			logProviders: [],
-			metricsProviders: metricsOnly,
-			organizationId: "org_a",
-			serverName: "Dokploy Server (local)",
-		},
-	],
-	[
-		"local every provider on both signals",
-		{
-			logProviders: [...logsOnly, ...both],
-			metricsProviders: [...metricsOnly, ...both],
-			organizationId: "org_a",
-			serverName: 'Dokploy "Server" $HOSTNAME (local)',
-		},
-	],
-	[
-		"remote metrics only",
-		{ logProviders: [], metricsProviders: metricsOnly, serverName: "edge-1" },
-	],
-	[
-		"remote every provider on both signals",
-		{
-			logProviders: [...logsOnly, ...both],
-			metricsProviders: [...metricsOnly, ...both],
-			serverName: "edge-1",
-		},
-	],
-];
-
-describe.skipIf(!dockerAvailable)(
-	"vector validate on generated configs",
-	() => {
-		const dir = mkdtempSync(path.join(os.tmpdir(), "vector-validate-"));
-
-		it.each(cases)(
-			"%s",
-			(name, input) => {
-				const file = path.join(dir, `${name.replace(/\W+/g, "-")}.yaml`);
-				writeFileSync(file, buildVectorConfigYaml(input));
-				const output = execFileSync(
-					"docker",
-					[
-						"run",
-						"--rm",
-						"-v",
-						"/var/run/docker.sock:/var/run/docker.sock:ro",
-						"-v",
-						`${file}:/etc/vector/vector.yaml:ro`,
-						VECTOR_IMAGE,
-						"validate",
-						"--skip-healthchecks",
-						"/etc/vector/vector.yaml",
-					],
-					{
-						encoding: "utf8",
-						stdio: ["ignore", "pipe", "pipe"],
-						timeout: 120_000,
-					},
-				);
-				expect(output).toContain("Validated");
-			},
-			150_000,
-		);
-	},
-);
@@ -1,86 +0,0 @@
-import type { SQL } from "drizzle-orm";
-import { PgDialect } from "drizzle-orm/pg-core";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	findFirst: vi.fn(),
-	updates: [] as Array<{ values: Record<string, unknown>; where: unknown }>,
-	returning: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: { webServerSettings: { findFirst: mocks.findFirst } },
-		update: () => ({
-			set: (values: Record<string, unknown>) => ({
-				where: (where: unknown) => {
-					mocks.updates.push({ values, where });
-					return { returning: () => Promise.resolve(mocks.returning()) };
-				},
-			}),
-		}),
-	},
-}));
-
-const { releaseWebServerAgent, setWebServerProviderIds } = await import(
-	"@dokploy/server/services/web-server-settings"
-);
-
-const render = (value: unknown) => new PgDialect().sqlToQuery(value as SQL).sql;
-
-beforeEach(() => {
-	mocks.updates = [];
-	mocks.findFirst.mockResolvedValue({
-		id: "ws-1",
-		vectorAgentOrganizationId: "org-a",
-	});
-	mocks.returning.mockReturnValue([{ id: "ws-1" }]);
-});
-
-describe("setWebServerProviderIds", () => {
-	it("claims the local agent for the organization when assigning providers", async () => {
-		const row = await setWebServerProviderIds("org-a", ["lp-1", "mp-1"]);
-
-		expect(row).toEqual({ id: "ws-1" });
-		const update = mocks.updates[0];
-		expect(update?.values).toMatchObject({
-			telemetryProviderIds: ["lp-1", "mp-1"],
-			vectorAgentOrganizationId: "org-a",
-		});
-		expect(render(update?.where)).toBe(
-			'("webServerSettings"."id" = $1 and ("webServerSettings"."vectorAgentOrganizationId" is null or "webServerSettings"."vectorAgentOrganizationId" = $2))',
-		);
-	});
-
-	it("releases the owner when the selection is cleared", async () => {
-		await setWebServerProviderIds("org-a", []);
-
-		expect(mocks.updates[0]?.values).toMatchObject({
-			telemetryProviderIds: [],
-			vectorAgentOrganizationId: null,
-		});
-	});
-
-	it("returns null when another organization owns the local agent", async () => {
-		mocks.returning.mockReturnValue([]);
-
-		await expect(
-			setWebServerProviderIds("org-b", ["lp-9"]),
-		).resolves.toBeNull();
-	});
-});
-
-describe("releaseWebServerAgent", () => {
-	it("clears the selection and the owner only for the owning organization", async () => {
-		await releaseWebServerAgent("org-a");
-
-		const update = mocks.updates[0];
-		expect(update?.values).toMatchObject({
-			telemetryProviderIds: [],
-			vectorAgentOrganizationId: null,
-		});
-		expect(render(update?.where)).toBe(
-			'"webServerSettings"."vectorAgentOrganizationId" = $1',
-		);
-	});
-});
@@ -1,104 +0,0 @@
-import {
-	getHostSystemStats,
-	isPhysicalDisk,
-} from "@dokploy/server/monitoring/utils";
-import { describe, expect, it, vi } from "vitest";
-
-const GiB = 1024 ** 3;
-const diskStat = (device: string, readGiB: number, writeGiB: number) => ({
-	device,
-	readBytes: { toBytes: () => readGiB * GiB },
-	writeBytes: { toBytes: () => writeGiB * GiB },
-});
-
-vi.mock("node-os-utils", () => ({
-	OSUtils: class {
-		cpu = { usage: async () => ({ success: false }) };
-		memory = { info: async () => ({ success: false }) };
-		network = { overview: async () => ({ success: false }) };
-		disk = {
-			stats: async () => ({
-				success: true,
-				data: [
-					diskStat("nvme0n1", 50, 100),
-					diskStat("nvme0n1p1", 50, 100),
-					diskStat("nvme1n1", 50, 100),
-					diskStat("nvme1n1p1", 50, 100),
-					diskStat("md0", 50, 100),
-					diskStat("md0p1", 50, 100),
-					diskStat("dm-0", 50, 100),
-					diskStat("zram0", 10, 20),
-				],
-			}),
-		};
-	},
-}));
-
-describe("isPhysicalDisk (#5513, #5385)", () => {
-	it.each([
-		"sda",
-		"sdab",
-		"hda",
-		"vda",
-		"xvda",
-		"nvme0n1",
-		"nvme1n1",
-		"mmcblk0",
-	])("counts whole disk %s", (device) => {
-		expect(isPhysicalDisk(device)).toBe(true);
-	});
-
-	it.each([
-		"sda1",
-		"sdab12",
-		"hda1",
-		"vda1",
-		"xvda1",
-		"nvme0n1p1",
-		"nvme1n1p4",
-		"mmcblk0p1",
-	])("skips partition %s", (device) => {
-		expect(isPhysicalDisk(device)).toBe(false);
-	});
-
-	it.each(["md0", "md127", "md0p1", "md_d0p1", "dm-0", "dm-12"])(
-		"skips stacked device %s",
-		(device) => {
-			expect(isPhysicalDisk(device)).toBe(false);
-		},
-	);
-
-	it.each(["loop0", "ram0", "zram0", "sr0", "fd0"])(
-		"skips virtual device %s",
-		(device) => {
-			expect(isPhysicalDisk(device)).toBe(false);
-		},
-	);
-
-	it("counts each write once on an mdadm RAID1 host", () => {
-		const devices = [
-			"nvme0n1",
-			"nvme0n1p1",
-			"nvme0n1p2",
-			"nvme0n1p3",
-			"nvme0n1p4",
-			"nvme1n1",
-			"nvme1n1p1",
-			"nvme1n1p2",
-			"nvme1n1p3",
-			"nvme1n1p4",
-			"md0",
-			"md1",
-			"md2",
-			"md3",
-		];
-		expect(devices.filter(isPhysicalDisk)).toEqual(["nvme0n1", "nvme1n1"]);
-	});
-});
-
-describe("getHostSystemStats Block I/O (#5513, #5385)", () => {
-	it("sums only whole physical disks", async () => {
-		const stats = await getHostSystemStats();
-		expect(stats.BlockIO).toBe("100.00GiB / 200.00GiB");
-	});
-});
@@ -73,20 +73,6 @@ describe("owner and admin bypass enterprise resources", () => {
 		).resolves.toBeUndefined();
 	});

-	it("owner bypasses telemetryProvider.read", async () => {
-		memberToReturn = mockMemberData("owner");
-		await expect(
-			checkPermission(ctx, { telemetryProvider: ["read"] }),
-		).resolves.toBeUndefined();
-	});
-
-	it("admin bypasses telemetryProvider.create", async () => {
-		memberToReturn = mockMemberData("admin");
-		await expect(
-			checkPermission(ctx, { telemetryProvider: ["create"] }),
-		).resolves.toBeUndefined();
-	});
-
 	it("owner bypasses multiple enterprise permissions at once", async () => {
 		memberToReturn = mockMemberData("owner");
 		await expect(
@@ -153,20 +139,6 @@ describe("member is denied org-level enterprise resources (CVE: bypass via stati
 			checkPermission(ctx, { registry: ["create"] }),
 		).rejects.toThrow();
 	});
-
-	it("member is denied telemetryProvider.read", async () => {
-		memberToReturn = mockMemberData("member");
-		await expect(
-			checkPermission(ctx, { telemetryProvider: ["read"] }),
-		).rejects.toThrow();
-	});
-
-	it("member is denied telemetryProvider.create", async () => {
-		memberToReturn = mockMemberData("member");
-		await expect(
-			checkPermission(ctx, { telemetryProvider: ["create"] }),
-		).rejects.toThrow();
-	});
 });

 describe("static roles validate free-tier resources", () => {
@@ -18,7 +18,6 @@ const FREE_TIER_RESOURCES = [
 	"gitProviders",
 	"traefikFiles",
 	"api",
-	"telemetryProvider",
 ];

 const ENTERPRISE_RESOURCES = [
@@ -42,7 +41,6 @@ const ENTERPRISE_RESOURCES = [
 	"auditLog",
 	"vaultProvider",
 	"dnsProvider",
-	"ai",
 ];

 describe("enterpriseOnlyResources set", () => {
@@ -111,7 +111,6 @@ describe("enterprise resources for static roles", () => {
 		expect(perms.destination.read).toBe(false);
 		expect(perms.notification.read).toBe(false);
 		expect(perms.auditLog.read).toBe(false);
-		expect(perms.telemetryProvider.read).toBe(false);
 	});
 });

@@ -0,0 +1,202 @@
+import { db } from "@dokploy/server/db";
+import { updateSecurityById } from "@dokploy/server/services/security";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const OLD_ROW = {
+	securityId: "sec-1",
+	username: "alice",
+	password: "oldpass",
+	applicationId: "app-1",
+	createdAt: "2024-01-01",
+};
+
+const NEW_ROW = {
+	securityId: "sec-1",
+	username: "bob",
+	password: "newpass",
+	applicationId: "app-1",
+	createdAt: "2024-01-01",
+};
+
+const APP = {
+	applicationId: "app-1",
+	appName: "myapp",
+	serverId: null,
+};
+
+const mocks = vi.hoisted(() => {
+	const returningMock = vi.fn();
+	const chain = {
+		set: vi.fn(),
+		where: vi.fn(),
+		returning: returningMock,
+	};
+	chain.set.mockReturnValue(chain);
+	chain.where.mockReturnValue(chain);
+	const tx = {
+		update: vi.fn(),
+	};
+	tx.update.mockReturnValue(chain);
+	return {
+		returningMock,
+		chain,
+		tx,
+		transaction: vi.fn(),
+		findFirst: vi.fn(),
+		findApplicationById: vi.fn(),
+		createSecurityMiddleware: vi.fn(),
+		removeSecurityMiddleware: vi.fn(),
+		replaceSecurityMiddlewareUser: vi.fn(),
+	};
+});
+
+vi.mock("@dokploy/server/db", () => ({
+	db: {
+		transaction: mocks.transaction,
+		query: {
+			security: {
+				findFirst: mocks.findFirst,
+			},
+		},
+	},
+}));
+
+vi.mock("@dokploy/server/services/application", () => ({
+	findApplicationById: mocks.findApplicationById,
+}));
+
+vi.mock("@dokploy/server/utils/traefik/security", () => ({
+	createSecurityMiddleware: mocks.createSecurityMiddleware,
+	removeSecurityMiddleware: mocks.removeSecurityMiddleware,
+	replaceSecurityMiddlewareUser: mocks.replaceSecurityMiddlewareUser,
+}));
+
+describe("updateSecurityById", () => {
+	beforeEach(() => {
+		mocks.findFirst.mockReset();
+		mocks.findApplicationById.mockReset();
+		mocks.returningMock.mockReset();
+		mocks.replaceSecurityMiddlewareUser.mockReset();
+		mocks.removeSecurityMiddleware.mockReset();
+		mocks.createSecurityMiddleware.mockReset();
+		mocks.transaction.mockReset();
+		mocks.tx.update.mockReset();
+		mocks.chain.set.mockReset();
+		mocks.chain.where.mockReset();
+
+		mocks.chain.set.mockReturnValue(mocks.chain);
+		mocks.chain.where.mockReturnValue(mocks.chain);
+		mocks.tx.update.mockReturnValue(mocks.chain);
+		mocks.transaction.mockImplementation(
+			async (cb: (tx: typeof mocks.tx) => unknown) => cb(mocks.tx),
+		);
+
+		mocks.findFirst.mockResolvedValue(OLD_ROW);
+		mocks.findApplicationById.mockResolvedValue(APP);
+		mocks.returningMock.mockResolvedValue([NEW_ROW]);
+		mocks.replaceSecurityMiddlewareUser.mockResolvedValue(undefined);
+		mocks.removeSecurityMiddleware.mockResolvedValue(undefined);
+		mocks.createSecurityMiddleware.mockResolvedValue(undefined);
+	});
+
+	it("performs a single middleware write after the DB transaction commits with old + new security", async () => {
+		await updateSecurityById("sec-1", { username: "bob", password: "newpass" });
+
+		expect(mocks.transaction).toHaveBeenCalledTimes(1);
+		expect(mocks.findFirst).toHaveBeenCalledTimes(1);
+		expect(mocks.findApplicationById).toHaveBeenCalledWith("app-1");
+		expect(mocks.tx.update).toHaveBeenCalledTimes(1);
+
+		expect(mocks.replaceSecurityMiddlewareUser).toHaveBeenCalledTimes(1);
+		expect(mocks.replaceSecurityMiddlewareUser).toHaveBeenCalledWith(
+			APP,
+			OLD_ROW,
+			NEW_ROW,
+		);
+		expect(mocks.removeSecurityMiddleware).not.toHaveBeenCalled();
+		expect(mocks.createSecurityMiddleware).not.toHaveBeenCalled();
+	});
+
+	it("does NOT touch the middleware file when tx.update throws (unique violation rollback)", async () => {
+		mocks.returningMock.mockRejectedValue(
+			new Error(
+				'duplicate key value violates unique constraint "security_username_applicationId_unique"',
+			),
+		);
+
+		await expect(
+			updateSecurityById("sec-1", { username: "bob" }),
+		).rejects.toThrow();
+
+		expect(mocks.replaceSecurityMiddlewareUser).not.toHaveBeenCalled();
+		expect(mocks.removeSecurityMiddleware).not.toHaveBeenCalled();
+		expect(mocks.createSecurityMiddleware).not.toHaveBeenCalled();
+		expect(mocks.tx.update).toHaveBeenCalledTimes(1);
+	});
+
+	it("rethrows a TRPCError BAD_REQUEST wrapping the underlying error on tx.update failure", async () => {
+		mocks.returningMock.mockRejectedValue(
+			new Error(
+				'duplicate key value violates unique constraint "security_username_applicationId_unique"',
+			),
+		);
+
+		await expect(
+			updateSecurityById("sec-1", { username: "bob" }),
+		).rejects.toMatchObject({
+			code: "BAD_REQUEST",
+		});
+	});
+
+	it("does NOT touch the middleware file when the security row is missing", async () => {
+		mocks.findFirst.mockResolvedValue(undefined);
+
+		await expect(updateSecurityById("missing", {})).rejects.toThrow();
+		expect(mocks.replaceSecurityMiddlewareUser).not.toHaveBeenCalled();
+		expect(mocks.removeSecurityMiddleware).not.toHaveBeenCalled();
+		expect(mocks.createSecurityMiddleware).not.toHaveBeenCalled();
+		expect(mocks.tx.update).not.toHaveBeenCalled();
+	});
+
+	it("commits the DB row even if the post-commit middleware write fails (stale-credential, not lockout)", async () => {
+		mocks.returningMock.mockResolvedValue([NEW_ROW]);
+		mocks.replaceSecurityMiddlewareUser.mockRejectedValue(
+			new Error("ssh failure"),
+		);
+
+		await expect(
+			updateSecurityById("sec-1", { username: "bob", password: "newpass" }),
+		).rejects.toThrow();
+
+		expect(mocks.tx.update).toHaveBeenCalledTimes(1);
+		expect(mocks.replaceSecurityMiddlewareUser).toHaveBeenCalledTimes(1);
+		expect(mocks.removeSecurityMiddleware).not.toHaveBeenCalled();
+		expect(mocks.createSecurityMiddleware).not.toHaveBeenCalled();
+	});
+
+	it("runs the middleware write only after the transaction callback returns (post-commit)", async () => {
+		let txReturned = false;
+		mocks.transaction.mockImplementation(
+			async (cb: (tx: typeof mocks.tx) => unknown) => {
+				await cb(mocks.tx);
+				txReturned = true;
+				return { oldSecurity: OLD_ROW, newSecurity: NEW_ROW, application: APP };
+			},
+		);
+		mocks.replaceSecurityMiddlewareUser.mockImplementation(async () => {
+			expect(txReturned).toBe(true);
+		});
+
+		await updateSecurityById("sec-1", { username: "bob" });
+
+		expect(mocks.replaceSecurityMiddlewareUser).toHaveBeenCalledTimes(1);
+	});
+});
+
+describe("updateSecurityById db mock sanity", () => {
+	it("exposes the mocked db used by the service under test", () => {
+		expect((db as unknown as { transaction: unknown }).transaction).toBe(
+			mocks.transaction,
+		);
+	});
+});
@@ -0,0 +1,306 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import type { ApplicationNested } from "@dokploy/server";
+import type { Security } from "@dokploy/server/services/security";
+import type { FileConfig } from "@dokploy/server/utils/traefik/file-types";
+import { replaceSecurityMiddlewareUser } from "@dokploy/server/utils/traefik/security";
+import * as bcrypt from "bcrypt";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { parse, stringify } from "yaml";
+
+const remoteMocks = vi.hoisted(() => ({
+	execAsyncRemote: vi.fn(),
+	writeFileRemote: vi.fn(),
+}));
+
+vi.mock("@dokploy/server/utils/process/execAsync", async (importOriginal) => {
+	const actual =
+		await importOriginal<
+			typeof import("@dokploy/server/utils/process/execAsync")
+		>();
+	return {
+		...actual,
+		execAsyncRemote: remoteMocks.execAsyncRemote,
+		writeFileRemote: remoteMocks.writeFileRemote,
+	};
+});
+
+const OLD: Security = {
+	securityId: "sec-1",
+	username: "alice",
+	password: "oldpass",
+	applicationId: "app-1",
+	createdAt: "2024-01-01",
+};
+
+const initialMiddlewares = (users: string[]): FileConfig => ({
+	http: {
+		middlewares: {
+			"auth-myapp": {
+				basicAuth: { removeHeader: true, users },
+			},
+		},
+	},
+});
+
+const initialAppConfig = (): FileConfig => ({
+	http: {
+		routers: {
+			"myapp-router-1": {
+				rule: "Host(`x`)",
+				service: "myapp-service",
+				middlewares: ["auth-myapp"],
+			},
+		},
+		services: {
+			"myapp-service": {
+				loadBalancer: {
+					servers: [{ url: "http://myapp:3000" }],
+					passHostHeader: true,
+				},
+			},
+		},
+	},
+});
+
+type BasicAuthMW = {
+	basicAuth?: { removeHeader?: boolean; users?: string[] };
+};
+
+const hashOf = (line: string): string => line.split(":")[1] ?? "";
+
+const readUsers = (file: string): string[] => {
+	const parsed = parse(fs.readFileSync(file, "utf8")) as FileConfig;
+	const mw = parsed.http?.middlewares?.["auth-myapp"] as
+		| BasicAuthMW
+		| undefined;
+	return mw?.basicAuth?.users ?? [];
+};
+
+describe("replaceSecurityMiddlewareUser (local filesystem)", () => {
+	let cwd: string;
+	let dynamicPath: string;
+	let middlewaresPath: string;
+	let appConfigPath: string;
+
+	const APP_LOCAL = {
+		applicationId: "app-1",
+		appName: "myapp",
+		serverId: null,
+	} as unknown as ApplicationNested;
+
+	beforeEach(() => {
+		cwd = fs.mkdtempSync(path.join(os.tmpdir(), "dokploy-security-"));
+		dynamicPath = path.join(cwd, ".docker", "traefik", "dynamic");
+		fs.mkdirSync(dynamicPath, { recursive: true });
+		middlewaresPath = path.join(dynamicPath, "middlewares.yml");
+		appConfigPath = path.join(dynamicPath, "myapp.yml");
+		vi.spyOn(process, "cwd").mockReturnValue(cwd);
+		vi.clearAllMocks();
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+		fs.rmSync(cwd, { recursive: true, force: true });
+	});
+
+	it("replaces the old username's hash with the new one in a single write (rename)", async () => {
+		fs.writeFileSync(
+			middlewaresPath,
+			stringify(initialMiddlewares(["alice:oldhash", "carol:carolhash"])),
+			"utf8",
+		);
+		fs.writeFileSync(appConfigPath, stringify(initialAppConfig()), "utf8");
+
+		const newSecurity: Security = {
+			...OLD,
+			username: "bob",
+			password: "newpass",
+		};
+
+		await replaceSecurityMiddlewareUser(APP_LOCAL, OLD, newSecurity);
+
+		const users = readUsers(middlewaresPath);
+		expect(users).not.toContain("alice:oldhash");
+		expect(users).toContain("carol:carolhash");
+		const bobLine = users.find((u) => u.startsWith("bob:"));
+		expect(bobLine).toBeDefined();
+		const [name, hash = ""] = bobLine!.split(":");
+		expect(name).toBe("bob");
+		expect(await bcrypt.compare("newpass", hash)).toBe(true);
+		expect(await bcrypt.compare("oldpass", hash)).toBe(false);
+
+		const appCfg = parse(fs.readFileSync(appConfigPath, "utf8")) as FileConfig;
+		expect(appCfg.http?.routers?.["myapp-router-1"]?.middlewares).toContain(
+			"auth-myapp",
+		);
+	});
+
+	it("replaces only the hash when the username is unchanged (password rotation)", async () => {
+		fs.writeFileSync(
+			middlewaresPath,
+			stringify(initialMiddlewares(["alice:oldhash", "carol:carolhash"])),
+			"utf8",
+		);
+		fs.writeFileSync(appConfigPath, stringify(initialAppConfig()), "utf8");
+
+		const newSecurity: Security = {
+			...OLD,
+			username: "alice",
+			password: "newpass",
+		};
+
+		await replaceSecurityMiddlewareUser(APP_LOCAL, OLD, newSecurity);
+
+		const users = readUsers(middlewaresPath);
+		expect(users).not.toContain("alice:oldhash");
+		expect(users).toContain("carol:carolhash");
+		const aliceLine = users.find((u) => u.startsWith("alice:"));
+		expect(aliceLine).toBeDefined();
+		expect(await bcrypt.compare("newpass", hashOf(aliceLine!))).toBe(true);
+		expect(await bcrypt.compare("oldpass", hashOf(aliceLine!))).toBe(false);
+		expect(users).toHaveLength(2);
+	});
+
+	it("creates the basicAuth middleware entry if it does not yet exist", async () => {
+		const otherMiddlewares: FileConfig = {
+			http: {
+				middlewares: {
+					"redirect-other": { redirectScheme: { scheme: "https" } },
+				},
+			},
+		};
+		fs.writeFileSync(middlewaresPath, stringify(otherMiddlewares), "utf8");
+		fs.writeFileSync(appConfigPath, stringify(initialAppConfig()), "utf8");
+
+		const newSecurity: Security = {
+			...OLD,
+			username: "bob",
+			password: "newpass",
+		};
+
+		await replaceSecurityMiddlewareUser(APP_LOCAL, OLD, newSecurity);
+
+		const parsed = parse(
+			fs.readFileSync(middlewaresPath, "utf8"),
+		) as FileConfig;
+		expect(parsed.http?.middlewares?.["redirect-other"]).toBeDefined();
+		const users = readUsers(middlewaresPath);
+		expect(users).toHaveLength(1);
+		const bobLine = users.find((u) => u.startsWith("bob:"));
+		expect(bobLine).toBeDefined();
+		expect(await bcrypt.compare("newpass", hashOf(bobLine!))).toBe(true);
+	});
+
+	it("attaches the middleware to routers that did not reference it yet", async () => {
+		fs.writeFileSync(
+			middlewaresPath,
+			stringify(initialMiddlewares(["alice:oldhash"])),
+			"utf8",
+		);
+		const appConfigNoMiddleware: FileConfig = {
+			http: {
+				routers: {
+					"myapp-router-1": {
+						rule: "Host(`x`)",
+						service: "myapp-service",
+					},
+				},
+				services: {
+					"myapp-service": {
+						loadBalancer: {
+							servers: [{ url: "http://myapp:3000" }],
+							passHostHeader: true,
+						},
+					},
+				},
+			},
+		};
+		fs.writeFileSync(appConfigPath, stringify(appConfigNoMiddleware), "utf8");
+
+		const newSecurity: Security = {
+			...OLD,
+			username: "alice",
+			password: "newpass",
+		};
+
+		await replaceSecurityMiddlewareUser(APP_LOCAL, OLD, newSecurity);
+
+		const appCfg = parse(fs.readFileSync(appConfigPath, "utf8")) as FileConfig;
+		expect(appCfg.http?.routers?.["myapp-router-1"]?.middlewares).toContain(
+			"auth-myapp",
+		);
+		const users = readUsers(middlewaresPath);
+		expect(users).not.toContain("alice:oldhash");
+		expect(await bcrypt.compare("newpass", hashOf(users[0]!))).toBe(true);
+	});
+});
+
+describe("replaceSecurityMiddlewareUser (remote serverId)", () => {
+	const APP_REMOTE = {
+		applicationId: "app-1",
+		appName: "myapp",
+		serverId: "server-1",
+	} as unknown as ApplicationNested;
+
+	beforeEach(() => {
+		vi.clearAllMocks();
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it("writes the remote middlewares.yml exactly once with the old user replaced", async () => {
+		remoteMocks.execAsyncRemote.mockImplementation(
+			async (_serverId, command) => {
+				if (command.includes("middlewares.yml")) {
+					return {
+						stdout: stringify(
+							initialMiddlewares(["alice:oldhash", "carol:carolhash"]),
+						),
+						stderr: "",
+					};
+				}
+				if (command.includes("myapp.yml")) {
+					return { stdout: stringify(initialAppConfig()), stderr: "" };
+				}
+				return { stdout: "", stderr: "" };
+			},
+		);
+		remoteMocks.writeFileRemote.mockResolvedValue(undefined);
+
+		const newSecurity: Security = {
+			...OLD,
+			username: "bob",
+			password: "newpass",
+		};
+
+		await replaceSecurityMiddlewareUser(APP_REMOTE, OLD, newSecurity);
+
+		const mwWrites = remoteMocks.writeFileRemote.mock.calls.filter(([, p]) =>
+			(p as string).includes("middlewares.yml"),
+		);
+		expect(mwWrites).toHaveLength(1);
+
+		const [, , content] = mwWrites[0]!;
+		const written = parse(content as string) as FileConfig;
+		const mw = written.http?.middlewares?.["auth-myapp"] as
+			| BasicAuthMW
+			| undefined;
+		const users = mw?.basicAuth?.users ?? [];
+		expect(users).not.toContain("alice:oldhash");
+		expect(users).toContain("carol:carolhash");
+		const bobLine = users.find((u) => u.startsWith("bob:"));
+		expect(bobLine).toBeDefined();
+		expect(await bcrypt.compare("newpass", hashOf(bobLine!))).toBe(true);
+
+		const appWrites = remoteMocks.writeFileRemote.mock.calls.filter(([, p]) =>
+			(p as string).includes("myapp.yml"),
+		);
+		expect(appWrites).toHaveLength(1);
+
+		expect(remoteMocks.execAsyncRemote).toHaveBeenCalledTimes(2);
+	});
+});
@@ -25,8 +25,6 @@ const baseSettings: WebServerSettings = {
 	letsEncryptEmail: null,
 	sshPrivateKey: null,
 	enableDockerCleanup: false,
-	telemetryProviderIds: [],
-	vectorAgentOrganizationId: null,
 	buildsConcurrency: 1,
 	logCleanupCron: null,
 	metricsConfig: {
@@ -62,12 +60,8 @@ const baseSettings: WebServerSettings = {
 		docsUrl: null,
 		errorPageTitle: null,
 		errorPageDescription: null,
-		ogImageUrl: null,
+		metaTitle: null,
 		footerText: null,
-		logoLightUrl: null,
-		loginLogoLightUrl: null,
-		faviconLightUrl: null,
-		dualModeBranding: false,
 	},
 	cleanupCacheApplications: false,
 	cleanupCacheOnCompose: false,
@@ -1,119 +0,0 @@
-import path from "node:path";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// apiReadTraefikConfig validates against the real local paths(), which outside
-// production live under the working directory.
-const traefikPath = vi.hoisted(() => `${process.cwd()}/.docker/traefik`);
-
-const mocks = vi.hoisted(() => ({
-	findServerById: vi.fn(),
-	readDirectory: vi.fn(),
-	readConfigInPath: vi.fn(),
-	writeTraefikConfigInPath: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/services/permission", () => ({
-	checkPermission: vi.fn(async () => undefined),
-}));
-
-vi.mock("@dokploy/server", () => ({
-	IS_CLOUD: false,
-	paths: () => ({ MAIN_TRAEFIK_PATH: traefikPath }),
-	...mocks,
-}));
-
-vi.mock("@dokploy/server/lib/auth", () => ({
-	validateRequest: vi.fn(),
-}));
-
-vi.mock("@/server/api/utils/audit", () => ({
-	audit: vi.fn(async () => undefined),
-}));
-
-vi.mock("@/server/queues/queueSetup", () => ({
-	cleanAllDeploymentQueue: vi.fn(),
-}));
-
-vi.mock("@/server/utils/backup", () => ({
-	removeJob: vi.fn(),
-	schedule: vi.fn(),
-}));
-
-const { settingsRouter } = await import("@/server/api/routers/settings");
-
-const caller = settingsRouter.createCaller({
-	session: { activeOrganizationId: "org-a" },
-	user: { id: "user-1", email: "user@example.com", role: "member" },
-} as Parameters<typeof settingsRouter.createCaller>[0]);
-
-const filePath = path.join(traefikPath, "dynamic/app.yml");
-
-describe("traefik file endpoints scope remote servers to the active organization", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-		mocks.findServerById.mockImplementation(async (serverId: string) => ({
-			serverId,
-			organizationId: serverId === "server-a" ? "org-a" : "org-b",
-		}));
-		mocks.readDirectory.mockResolvedValue([]);
-		mocks.readConfigInPath.mockResolvedValue("http: {}");
-	});
-
-	it("rejects listing a server from another organization", async () => {
-		await expect(
-			caller.readDirectories({ serverId: "server-b" }),
-		).rejects.toMatchObject({ code: "UNAUTHORIZED" });
-		expect(mocks.readDirectory).not.toHaveBeenCalled();
-	});
-
-	it("rejects writing to a server from another organization", async () => {
-		await expect(
-			caller.updateTraefikFile({
-				path: filePath,
-				traefikConfig: "http: {}",
-				serverId: "server-b",
-			}),
-		).rejects.toMatchObject({ code: "UNAUTHORIZED" });
-		expect(mocks.writeTraefikConfigInPath).not.toHaveBeenCalled();
-	});
-
-	it("rejects reading from a server from another organization", async () => {
-		await expect(
-			caller.readTraefikFile({ path: filePath, serverId: "server-b" }),
-		).rejects.toMatchObject({ code: "UNAUTHORIZED" });
-		expect(mocks.readConfigInPath).not.toHaveBeenCalled();
-	});
-
-	it("allows servers of the active organization", async () => {
-		await caller.readDirectories({ serverId: "server-a" });
-		await caller.readTraefikFile({ path: filePath, serverId: "server-a" });
-		await caller.updateTraefikFile({
-			path: filePath,
-			traefikConfig: "http: {}",
-			serverId: "server-a",
-		});
-
-		expect(mocks.readDirectory).toHaveBeenCalledWith(traefikPath, "server-a");
-		expect(mocks.readConfigInPath).toHaveBeenCalledWith(filePath, "server-a");
-		expect(mocks.writeTraefikConfigInPath).toHaveBeenCalledWith(
-			filePath,
-			"http: {}",
-			"server-a",
-		);
-	});
-
-	it("does not look up a server when none is given", async () => {
-		await caller.readDirectories({});
-		await caller.updateTraefikFile({
-			path: filePath,
-			traefikConfig: "http: {}",
-		});
-
-		expect(mocks.findServerById).not.toHaveBeenCalled();
-		expect(mocks.writeTraefikConfigInPath).toHaveBeenCalledWith(
-			filePath,
-			"http: {}",
-			undefined,
-		);
-	});
-});
@@ -1,182 +0,0 @@
-import {
-	checkDeletionCode,
-	generateDeletionCode,
-	serializeDeletionCode,
-} from "@dokploy/server/services/account-deletion";
-import { deleteHubSpotContactByEmail } from "@dokploy/server/utils/tracking/hubspot";
-import Stripe from "stripe";
-import { afterEach, describe, expect, test, vi } from "vitest";
-import { cancelStripeSubscriptions } from "@/server/utils/billing";
-
-const makeStripe = (
-	subscriptions: Array<{ id: string; status: string }>,
-	listError?: Error,
-) => {
-	const stripe = {
-		subscriptions: {
-			list: vi.fn(() =>
-				listError
-					? Promise.reject(listError)
-					: Promise.resolve({ data: subscriptions }),
-			),
-			cancel: vi.fn(() => Promise.resolve({})),
-		},
-	};
-	return stripe as unknown as Stripe & typeof stripe;
-};
-
-describe("cancelStripeSubscriptions", () => {
-	test("cancels every non-terminal subscription without invoicing", async () => {
-		const stripe = makeStripe([
-			{ id: "sub_active", status: "active" },
-			{ id: "sub_trial", status: "trialing" },
-			{ id: "sub_past_due", status: "past_due" },
-			{ id: "sub_canceled", status: "canceled" },
-			{ id: "sub_expired", status: "incomplete_expired" },
-		]);
-
-		const result = await cancelStripeSubscriptions("cus_1", stripe);
-
-		expect(stripe.subscriptions.list).toHaveBeenCalledWith({
-			customer: "cus_1",
-			status: "all",
-			limit: 100,
-		});
-		expect(stripe.subscriptions.cancel).toHaveBeenCalledTimes(3);
-		expect(stripe.subscriptions.cancel).toHaveBeenCalledWith("sub_active", {
-			invoice_now: false,
-			prorate: false,
-		});
-		expect(result).toEqual({
-			cancelledSubscriptions: ["sub_active", "sub_trial", "sub_past_due"],
-		});
-	});
-
-	test("treats a missing customer as having nothing to cancel", async () => {
-		const missing = new Stripe.errors.StripeInvalidRequestError({
-			type: "invalid_request_error",
-			code: "resource_missing",
-			message: "No such customer",
-		});
-		const stripe = makeStripe([], missing);
-
-		const result = await cancelStripeSubscriptions("cus_missing", stripe);
-
-		expect(stripe.subscriptions.cancel).not.toHaveBeenCalled();
-		expect(result).toEqual({ cancelledSubscriptions: [] });
-	});
-
-	test("propagates unexpected Stripe errors", async () => {
-		const failure = new Stripe.errors.StripeAPIError({
-			type: "api_error",
-			message: "boom",
-		});
-		const stripe = makeStripe([], failure);
-
-		await expect(cancelStripeSubscriptions("cus_1", stripe)).rejects.toBe(
-			failure,
-		);
-	});
-});
-
-describe("deleteHubSpotContactByEmail", () => {
-	afterEach(() => {
-		vi.unstubAllGlobals();
-	});
-
-	test("is skipped when no access token is configured", async () => {
-		const fetchMock = vi.fn();
-		vi.stubGlobal("fetch", fetchMock);
-
-		expect(await deleteHubSpotContactByEmail("a@b.com", undefined)).toBe(
-			"skipped",
-		);
-		expect(fetchMock).not.toHaveBeenCalled();
-	});
-
-	test("calls the GDPR delete endpoint with the email as id", async () => {
-		const fetchMock = vi.fn(() =>
-			Promise.resolve(new Response(null, { status: 204 })),
-		);
-		vi.stubGlobal("fetch", fetchMock);
-
-		expect(await deleteHubSpotContactByEmail("a@b.com", "token")).toBe(
-			"deleted",
-		);
-		const [url, init] = fetchMock.mock.calls[0] as unknown as [
-			string,
-			RequestInit,
-		];
-		expect(url).toBe(
-			"https://api.hubapi.com/crm/v3/objects/contacts/gdpr-delete",
-		);
-		expect(init.method).toBe("POST");
-		expect((init.headers as Record<string, string>).Authorization).toBe(
-			"Bearer token",
-		);
-		expect(JSON.parse(init.body as string)).toEqual({
-			idProperty: "email",
-			objectId: "a@b.com",
-		});
-	});
-
-	test("maps 404 to not_found and other errors to failed", async () => {
-		vi.stubGlobal(
-			"fetch",
-			vi.fn(() => Promise.resolve(new Response(null, { status: 404 }))),
-		);
-		expect(await deleteHubSpotContactByEmail("a@b.com", "token")).toBe(
-			"not_found",
-		);
-
-		vi.stubGlobal(
-			"fetch",
-			vi.fn(() => Promise.resolve(new Response("nope", { status: 500 }))),
-		);
-		expect(await deleteHubSpotContactByEmail("a@b.com", "token")).toBe(
-			"failed",
-		);
-	});
-});
-
-describe("account deletion codes", () => {
-	test("generates six-digit numeric codes", () => {
-		for (let i = 0; i < 50; i++) {
-			expect(generateDeletionCode()).toMatch(/^\d{6}$/);
-		}
-	});
-
-	test("accepts the right code, ignoring surrounding whitespace", () => {
-		const value = serializeDeletionCode("482913");
-
-		expect(checkDeletionCode(value, "482913")).toEqual({
-			valid: true,
-			attempts: 0,
-		});
-		expect(checkDeletionCode(value, " 482913 ").valid).toBe(true);
-	});
-
-	test("counts failed attempts without revealing the hash", () => {
-		const value = serializeDeletionCode("482913");
-
-		const first = checkDeletionCode(value, "000000");
-		expect(first.valid).toBe(false);
-		if (first.valid) throw new Error("unreachable");
-		expect(first.attempts).toBe(1);
-		expect(JSON.parse(first.nextValue)).toEqual({
-			...JSON.parse(value),
-			attempts: 1,
-		});
-
-		const second = checkDeletionCode(first.nextValue, "999999");
-		expect(second.valid).toBe(false);
-		if (second.valid) throw new Error("unreachable");
-		expect(second.attempts).toBe(2);
-
-		expect(checkDeletionCode(second.nextValue, "482913")).toEqual({
-			valid: true,
-			attempts: 2,
-		});
-		expect(value).not.toContain("482913");
-	});
-});
@@ -1,60 +0,0 @@
-import { promises as fs } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { describe, expect, it, vi } from "vitest";
-
-vi.mock("@dokploy/server/services/server", () => ({
-	findServerById: vi.fn(),
-}));
-
-import { pipeBetweenServers } from "@dokploy/server/utils/process/remoteStream";
-
-describe("pipeBetweenServers", () => {
-	it("delivers a short source stream that ends before the target is ready", async () => {
-		const bytes = await pipeBetweenServers({
-			source: { serverId: null, command: "printf 'hello world'" },
-			target: { serverId: null, command: "sleep 0.3; cat > /dev/null" },
-		});
-		expect(bytes).toBe(11);
-	}, 30_000);
-
-	it("pipes data larger than the pipe buffer unchanged", async () => {
-		const dir = await fs.mkdtemp(path.join(os.tmpdir(), "pipe-"));
-		const source = path.join(dir, "src.bin");
-		const target = path.join(dir, "dst.bin");
-		const size = 1024 * 1024;
-		const progress: number[] = [];
-
-		const bytes = await pipeBetweenServers({
-			source: {
-				serverId: null,
-				command: `head -c ${size} /dev/urandom | tee '${source}'`,
-			},
-			target: { serverId: null, command: `cat > '${target}'` },
-			onProgress: (transferred) => progress.push(transferred),
-		});
-
-		expect(bytes).toBe(size);
-		expect(progress.at(-1)).toBe(size);
-		expect(await fs.readFile(target)).toEqual(await fs.readFile(source));
-		await fs.rm(dir, { recursive: true, force: true });
-	}, 30_000);
-
-	it("reports a target failure with its stderr", async () => {
-		await expect(
-			pipeBetweenServers({
-				source: { serverId: null, command: "printf x" },
-				target: { serverId: null, command: "echo boom >&2; exit 3" },
-			}),
-		).rejects.toThrow("target exited with code 3: boom");
-	}, 30_000);
-
-	it("reports a source failure", async () => {
-		await expect(
-			pipeBetweenServers({
-				source: { serverId: null, command: "exit 2" },
-				target: { serverId: null, command: "cat > /dev/null" },
-			}),
-		).rejects.toThrow("source exited with code 2");
-	}, 30_000);
-});
@@ -1,169 +0,0 @@
-import { EventEmitter } from "node:events";
-import http from "node:http";
-import type { AddressInfo } from "node:net";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import WebSocket from "ws";
-
-class FakeChild extends EventEmitter {
-	stdout = new EventEmitter();
-	stderr = new EventEmitter();
-	killed = false;
-	exitCode: number | null = null;
-	signalCode: NodeJS.Signals | null = null;
-	signals: string[] = [];
-	// Mirrors ChildProcess: `killed` flips as soon as a signal is delivered,
-	// even if the process ignores it and keeps running.
-	ignoreSigterm = false;
-
-	kill(signal: NodeJS.Signals = "SIGTERM") {
-		this.signals.push(signal);
-		this.killed = true;
-		if (signal === "SIGTERM" && this.ignoreSigterm) return true;
-		this.signalCode = signal;
-		this.emit("close", null, signal);
-		return true;
-	}
-}
-
-const children = vi.hoisted(() => [] as FakeChild[]);
-const nextChild = vi.hoisted(() => ({ ignoreSigterm: false }));
-vi.mock("node:child_process", async (importOriginal) => ({
-	...(await importOriginal<typeof import("node:child_process")>()),
-	spawn: vi.fn(() => {
-		const child = new FakeChild();
-		child.ignoreSigterm = nextChild.ignoreSigterm;
-		children.push(child);
-		return child;
-	}),
-}));
-
-const sshClients = vi.hoisted(
-	() => [] as { connect: ReturnType<typeof vi.fn> }[],
-);
-vi.mock("ssh2", () => ({
-	Client: vi.fn(function (this: Record<string, unknown>) {
-		this.on = vi.fn(() => this);
-		this.connect = vi.fn(() => this);
-		this.end = vi.fn();
-		sshClients.push(this as never);
-	}),
-}));
-
-const mockValidateRequest = vi.hoisted(() => vi.fn());
-const mockFindServerById = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server", () => ({
-	IS_CLOUD: false,
-	validateRequest: mockValidateRequest,
-	findServerById: mockFindServerById,
-}));
-vi.mock("@dokploy/server/wss/utils", () => ({
-	readValidDirectory: () => true,
-}));
-
-import { setupDeploymentLogsWebSocketServer } from "@/server/wss/listen-deployment";
-
-const AUTH = {
-	user: { id: "user-1" },
-	session: { activeOrganizationId: "org-1" },
-};
-
-const deferred = <T>() => {
-	let resolve!: (value: T) => void;
-	const promise = new Promise<T>((r) => {
-		resolve = r;
-	});
-	return { promise, resolve };
-};
-
-const flush = () => new Promise((r) => setTimeout(r, 50));
-
-let server: http.Server;
-let url: string;
-
-beforeEach(async () => {
-	children.length = 0;
-	sshClients.length = 0;
-	nextChild.ignoreSigterm = false;
-	vi.clearAllMocks();
-	server = http.createServer();
-	setupDeploymentLogsWebSocketServer(server);
-	await new Promise<void>((r) => server.listen(0, "127.0.0.1", r));
-	const { port } = server.address() as AddressInfo;
-	url = `ws://127.0.0.1:${port}/listen-deployment?logPath=/etc/dokploy/logs/app/deploy.log`;
-});
-
-afterEach(async () => {
-	vi.useRealTimers();
-	await new Promise((r) => server.close(r));
-});
-
-const connect = async (query = "") => {
-	const ws = new WebSocket(`${url}${query}`);
-	await new Promise((r) => ws.once("open", r));
-	return ws;
-};
-
-const closeClient = async (ws: WebSocket) => {
-	ws.close();
-	await new Promise((r) => ws.once("close", r));
-	await flush();
-};
-
-describe("deployment logs websocket (#5518)", () => {
-	it("kills tail when the client disconnects", async () => {
-		mockValidateRequest.mockResolvedValue(AUTH);
-		const ws = await connect();
-		await flush();
-		expect(children).toHaveLength(1);
-
-		await closeClient(ws);
-		expect(children[0]!.signals).toContain("SIGTERM");
-	});
-
-	it("does not spawn tail when the client disconnects during auth", async () => {
-		const auth = deferred<typeof AUTH>();
-		mockValidateRequest.mockReturnValue(auth.promise);
-		const ws = await connect();
-
-		await closeClient(ws);
-		auth.resolve(AUTH);
-		await flush();
-
-		const leaked = children.filter(
-			(c) => c.exitCode === null && c.signalCode === null,
-		);
-		expect(leaked).toHaveLength(0);
-	});
-
-	it("does not open an SSH session when the client disconnects while loading the server", async () => {
-		mockValidateRequest.mockResolvedValue(AUTH);
-		const serverLookup = deferred<unknown>();
-		mockFindServerById.mockReturnValue(serverLookup.promise);
-		const ws = await connect("&serverId=srv-1");
-
-		await closeClient(ws);
-		serverLookup.resolve({
-			organizationId: "org-1",
-			sshKeyId: "key-1",
-			sshKey: { privateKey: "key" },
-			ipAddress: "10.0.0.1",
-			port: 22,
-			username: "root",
-		});
-		await flush();
-
-		const connected = sshClients.filter((c) => c.connect.mock.calls.length > 0);
-		expect(connected).toHaveLength(0);
-	});
-
-	it("force-kills tail with SIGKILL when SIGTERM does not stop it", async () => {
-		nextChild.ignoreSigterm = true;
-		mockValidateRequest.mockResolvedValue(AUTH);
-		const ws = await connect();
-		await flush();
-
-		await closeClient(ws);
-		await new Promise((r) => setTimeout(r, 1100));
-		expect(children[0]!.signals).toEqual(["SIGTERM", "SIGKILL"]);
-	});
-});
@@ -8,3 +8,4 @@ export { RestartPolicyForm } from "./restart-policy-form";
 export { RollbackConfigForm } from "./rollback-config-form";
 export { StopGracePeriodForm } from "./stop-grace-period-form";
 export { UpdateConfigForm } from "./update-config-form";
+export { filterEmptyValues, hasValues } from "./utils";
@@ -0,0 +1,31 @@
+/**
+ * Filters out undefined, null, and empty string values from form data
+ * Only returns fields that have actual values
+ */
+export const filterEmptyValues = (
+	formData: Record<string, any>,
+): Record<string, any> => {
+	return Object.entries(formData).reduce(
+		(acc, [key, value]) => {
+			// Keep arrays even if empty (they might be intentionally cleared)
+			if (Array.isArray(value)) {
+				if (value.length > 0) {
+					acc[key] = value;
+				}
+			}
+			// For other values, filter out undefined, null, and empty strings
+			else if (value !== undefined && value !== null && value !== "") {
+				acc[key] = value;
+			}
+			return acc;
+		},
+		{} as Record<string, any>,
+	);
+};
+
+/**
+ * Checks if filtered data has any values to save
+ */
+export const hasValues = (data: Record<string, any>): boolean => {
+	return Object.keys(data).length > 0;
+};
@@ -31,45 +31,6 @@ import { api } from "@/utils/api";

 // Railpack versions from https://github.com/railwayapp/railpack/releases
 export const RAILPACK_VERSIONS = [
-	"0.39.0",
-	"0.38.0",
-	"0.37.1",
-	"0.37.0",
-	"0.36.4",
-	"0.36.3",
-	"0.36.2",
-	"0.36.1",
-	"0.36.0",
-	"0.35.0",
-	"0.34.0",
-	"0.33.0",
-	"0.32.0",
-	"0.31.2",
-	"0.31.1",
-	"0.31.0",
-	"0.30.1",
-	"0.30.0",
-	"0.29.0",
-	"0.28.0",
-	"0.27.2",
-	"0.27.1",
-	"0.27.0",
-	"0.26.1",
-	"0.26.0",
-	"0.25.0",
-	"0.24.0",
-	"0.23.0",
-	"0.22.2",
-	"0.22.1",
-	"0.22.0",
-	"0.21.0",
-	"0.20.0",
-	"0.19.0",
-	"0.18.0",
-	"0.17.2",
-	"0.17.1",
-	"0.17.0",
-	"0.16.0",
 	"0.15.4",
 	"0.15.3",
 	"0.15.2",
@@ -84,22 +45,12 @@ export const RAILPACK_VERSIONS = [
 	"0.9.1",
 	"0.9.0",
 	"0.8.0",
-	"0.7.2",
-	"0.7.1",
 	"0.7.0",
-	"0.6.1",
 	"0.6.0",
-	"0.5.1",
 	"0.5.0",
 	"0.4.0",
 	"0.3.0",
-	"0.2.3",
 	"0.2.2",
-	"0.2.1",
-	"0.2.0",
-	"0.1.2",
-	"0.1.1",
-	"0.1.0",
 ] as const;

 export enum BuildType {
@@ -156,7 +156,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 			domainId,
 		},
 		{
-			enabled: isOpen && !!domainId,
+			enabled: !!domainId,
 		},
 	);

@@ -167,7 +167,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 						applicationId: id,
 					},
 					{
-						enabled: isOpen && !!id,
+						enabled: !!id,
 					},
 				)
 			: api.compose.one.useQuery(
@@ -175,7 +175,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 						composeId: id,
 					},
 					{
-						enabled: isOpen && !!id,
+						enabled: !!id,
 					},
 				);

@@ -187,14 +187,9 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 		api.domain.generateDomain.useMutation();

 	const { data: canGenerateTraefikMeDomains } =
-		api.domain.canGenerateTraefikMeDomains.useQuery(
-			{
-				serverId: application?.serverId || "",
-			},
-			{
-				enabled: isOpen,
-			},
-		);
+		api.domain.canGenerateTraefikMeDomains.useQuery({
+			serverId: application?.serverId || "",
+		});

 	const {
 		data: services,
@@ -209,7 +204,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 		{
 			retry: false,
 			refetchOnWindowFocus: false,
-			enabled: isOpen && type === "compose" && !!id,
+			enabled: type === "compose" && !!id,
 		},
 	);

@@ -84,9 +84,9 @@ export const ShowPatches = ({ id, type }: Props) => {

 	return (
 		<Card className="bg-background">
-			<CardHeader className="flex flex-row items-center flex-wrap gap-4 justify-between">
-				<div className="flex flex-col gap-1">
-					<CardTitle className="text-xl">Patches</CardTitle>
+			<CardHeader className="flex flex-row items-center justify-between">
+				<div>
+					<CardTitle>Patches</CardTitle>
 					<CardDescription>
 						Apply code patches to your repository during build. Patches are
 						applied after cloning the repository and before building.
@@ -77,19 +77,23 @@ export const ShowSchedules = ({ id, scheduleType = "application" }: Props) => {
 	};

 	return (
-		<Card className="bg-background h-full min-h-[50vh]">
-			<CardHeader className="flex flex-row items-center flex-wrap gap-4 justify-between">
-				<div className="flex flex-col gap-1">
-					<CardTitle className="text-xl">Scheduled Tasks</CardTitle>
-					<CardDescription>
-						Schedule tasks to run automatically at specified intervals.
-					</CardDescription>
+		<Card className=" px-6 shadow-none bg-transparent h-full min-h-[50vh]">
+			<CardHeader className="px-0">
+				<div className="flex justify-between items-center gap-y-2 flex-wrap">
+					<div className="flex flex-col gap-2">
+						<CardTitle className="text-xl font-bold flex items-center gap-2">
+							Scheduled Tasks
+						</CardTitle>
+						<CardDescription>
+							Schedule tasks to run automatically at specified intervals.
+						</CardDescription>
+					</div>
+					{schedules && schedules.length > 0 && (
+						<HandleSchedules id={id} scheduleType={scheduleType} />
+					)}
 				</div>
-				{schedules && schedules.length > 0 && (
-					<HandleSchedules id={id} scheduleType={scheduleType} />
-				)}
 			</CardHeader>
-			<CardContent>
+			<CardContent className="px-0">
 				{isLoadingSchedules ? (
 					<div className="flex gap-4 w-full items-center justify-center text-center mx-auto min-h-[45vh]">
 						<Loader2 className="size-4 text-muted-foreground/70 transition-colors animate-spin self-center" />
@@ -77,26 +77,35 @@ export const ShowVolumeBackups = ({
 	};

 	return (
-		<Card className="bg-background h-full min-h-[50vh]">
-			<CardHeader className="flex flex-row items-center flex-wrap gap-4 justify-between">
-				<div className="flex flex-col gap-1">
-					<CardTitle className="text-xl">Volume Backups</CardTitle>
-					<CardDescription>
-						Schedule volume backups to run automatically at specified intervals
-					</CardDescription>
-				</div>
-				<div className="flex items-center gap-2 flex-wrap">
-					{volumeBackups && volumeBackups.length > 0 && (
-						<>
-							<HandleVolumeBackups id={id} volumeBackupType={type} />
-							<div className="flex items-center gap-2">
-								<RestoreVolumeBackups id={id} type={type} serverId={serverId} />
-							</div>
-						</>
-					)}
+		<Card className=" px-6 shadow-none bg-transparent h-full min-h-[50vh]">
+			<CardHeader className="px-0">
+				<div className="flex justify-between items-center flex-wrap gap-2">
+					<div className="flex flex-col gap-2">
+						<CardTitle className="text-xl font-bold flex items-center gap-2">
+							Volume Backups
+						</CardTitle>
+						<CardDescription>
+							Schedule volume backups to run automatically at specified
+							intervals
+						</CardDescription>
+					</div>
+					<div className="flex items-center gap-2 flex-wrap">
+						{volumeBackups && volumeBackups.length > 0 && (
+							<>
+								<HandleVolumeBackups id={id} volumeBackupType={type} />
+								<div className="flex items-center gap-2">
+									<RestoreVolumeBackups
+										id={id}
+										type={type}
+										serverId={serverId}
+									/>
+								</div>
+							</>
+						)}
+					</div>
 				</div>
 			</CardHeader>
-			<CardContent>
+			<CardContent className="px-0">
 				{isLoadingVolumeBackups ? (
 					<div className="flex gap-4 w-full items-center justify-center text-center mx-auto min-h-[45vh]">
 						<Loader2 className="size-4 text-muted-foreground/70 transition-colors animate-spin self-center" />
@@ -1,47 +0,0 @@
-import { Rocket } from "lucide-react";
-import { useRouter } from "next/router";
-import { Button } from "@/components/ui/button";
-import { api } from "@/utils/api";
-
-export const TrialBanner = () => {
-	const router = useRouter();
-	const { data: billingStatus } = api.stripe.getBillingStatus.useQuery();
-	const { mutateAsync: createCustomerPortalSession, isPending } =
-		api.stripe.createCustomerPortalSession.useMutation();
-
-	const handleAddPaymentMethod = async () => {
-		const session = await createCustomerPortalSession().catch(() => null);
-		if (session?.url) {
-			window.open(session.url);
-			return;
-		}
-		router.push("/dashboard/settings/billing");
-	};
-
-	if (!billingStatus?.isOnTrial || billingStatus.hasPaymentMethod) {
-		return null;
-	}
-
-	const daysRemaining = billingStatus.trialDaysRemaining ?? 0;
-	const daysLabel = `${daysRemaining} day${daysRemaining === 1 ? "" : "s"}`;
-
-	return (
-		<div className="sticky top-0 z-20 mx-4 mt-4 flex flex-wrap items-center justify-center gap-x-3 gap-y-2 rounded-lg border border-primary/20 bg-primary/10 px-4 py-2 text-sm">
-			<span className="flex items-center gap-2">
-				<Rocket className="h-4 w-4 text-primary shrink-0" />
-				{daysRemaining > 0
-					? `You have ${daysLabel} left in your free trial. Add a payment method to keep your servers.`
-					: "Your free trial ends today. Add a payment method to keep your servers."}
-			</span>
-			<Button
-				size="sm"
-				variant="default"
-				className="h-7"
-				isLoading={isPending}
-				onClick={handleAddPaymentMethod}
-			>
-				Add payment method
-			</Button>
-		</div>
-	);
-};
@@ -22,7 +22,6 @@ import {
 	FormMessage,
 } from "@/components/ui/form";
 import { Input } from "@/components/ui/input";
-import { Switch } from "@/components/ui/switch";
 import { api } from "@/utils/api";

 interface Props {
@@ -31,7 +30,6 @@ interface Props {

 const AddRedirectSchema = z.object({
 	command: z.string(),
-	pullImages: z.boolean(),
 });

 type AddCommand = z.infer<typeof AddRedirectSchema>;
@@ -59,25 +57,22 @@ export const AddCommandCompose = ({ composeId }: Props) => {
 	const form = useForm<AddCommand>({
 		defaultValues: {
 			command: "",
-			pullImages: false,
 		},
 		resolver: zodResolver(AddRedirectSchema),
 	});

 	useEffect(() => {
-		if (data) {
+		if (data?.command) {
 			form.reset({
-				command: data.command || "",
-				pullImages: data.pullImages ?? false,
+				command: data?.command || "",
 			});
 		}
-	}, [form, form.reset, form.formState.isSubmitSuccessful, data]);
+	}, [form, form.reset, form.formState.isSubmitSuccessful, data?.command]);

-	const onSubmit = async (formData: AddCommand) => {
+	const onSubmit = async (data: AddCommand) => {
 		await mutateAsync({
 			composeId,
-			command: formData.command,
-			pullImages: formData.pullImages,
+			command: data?.command,
 		})
 			.then(async () => {
 				toast.success("Command Updated");
@@ -114,30 +109,6 @@ export const AddCommandCompose = ({ composeId }: Props) => {
 							<strong>docker</strong>.
 						</AlertBlock>
 						<div className="flex flex-col gap-4">
-							{data?.composeType === "docker-compose" && (
-								<FormField
-									control={form.control}
-									name="pullImages"
-									render={({ field }) => (
-										<FormItem className="flex flex-row items-center justify-between rounded-lg border p-3 shadow-xs">
-											<div className="space-y-0.5">
-												<FormLabel>Pull latest images on deploy</FormLabel>
-												<FormDescription>
-													Adds <strong>--pull always</strong> to the default
-													command so every deploy fetches the newest image for
-													each tag. Has no effect when a custom command is set.
-												</FormDescription>
-											</div>
-											<FormControl>
-												<Switch
-													checked={field.value}
-													onCheckedChange={field.onChange}
-												/>
-											</FormControl>
-										</FormItem>
-									)}
-								/>
-							)}
 							<FormField
 								control={form.control}
 								name="command"
@@ -1,216 +0,0 @@
-import { standardSchemaResolver as zodResolver } from "@hookform/resolvers/standard-schema";
-import copy from "copy-to-clipboard";
-import { AlertTriangle, Copy, HardDriveDownload } from "lucide-react";
-import { useRouter } from "next/router";
-import { useState } from "react";
-import { useForm } from "react-hook-form";
-import { toast } from "sonner";
-import { z } from "zod";
-import { AlertBlock } from "@/components/shared/alert-block";
-import { Badge } from "@/components/ui/badge";
-import { Button } from "@/components/ui/button";
-import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
-import {
-	Dialog,
-	DialogContent,
-	DialogDescription,
-	DialogFooter,
-	DialogHeader,
-	DialogTitle,
-	DialogTrigger,
-} from "@/components/ui/dialog";
-import {
-	Form,
-	FormControl,
-	FormField,
-	FormItem,
-	FormLabel,
-	FormMessage,
-} from "@/components/ui/form";
-import { Input } from "@/components/ui/input";
-import { api } from "@/utils/api";
-
-const freshVolumesSchema = z.object({
-	confirmName: z.string().min(1, {
-		message: "Compose name is required",
-	}),
-});
-
-type FreshVolumesForm = z.infer<typeof freshVolumesSchema>;
-
-interface Props {
-	composeId: string;
-}
-
-export const FreshVolumes = ({ composeId }: Props) => {
-	const router = useRouter();
-	const [isOpen, setIsOpen] = useState(false);
-	const { data: permissions } = api.user.getPermissions.useQuery();
-	const canDeploy = permissions?.deployment.create ?? false;
-	const { data, refetch } = api.compose.one.useQuery(
-		{ composeId },
-		{ enabled: !!composeId },
-	);
-	const { mutateAsync: deploy, isPending } = api.compose.deploy.useMutation();
-
-	const form = useForm<FreshVolumesForm>({
-		defaultValues: { confirmName: "" },
-		resolver: zodResolver(freshVolumesSchema),
-	});
-
-	const expectedName = `${data?.name}/${data?.appName}`;
-	const isRunning = data?.composeStatus === "running";
-
-	const onSubmit = async (formData: FreshVolumesForm) => {
-		if (formData.confirmName !== expectedName) {
-			form.setError("confirmName", {
-				message: `Compose name must match "${expectedName}"`,
-			});
-			return;
-		}
-		await deploy({ composeId, freshVolumes: true })
-			.then(() => {
-				toast.success("Compose deployed with fresh volumes");
-				setIsOpen(false);
-				form.reset();
-				refetch();
-				router.push(
-					`/dashboard/project/${data?.environment.projectId}/environment/${data?.environmentId}/services/compose/${composeId}?tab=deployments`,
-				);
-			})
-			.catch(() => {
-				toast.error("Error deploying compose");
-			});
-	};
-
-	if (!canDeploy || data?.composeType !== "docker-compose") return null;
-
-	return (
-		<Card className="bg-background border-destructive/50">
-			<CardHeader>
-				<CardTitle className="text-xl flex items-center gap-2">
-					<AlertTriangle className="h-5 w-5 text-destructive" />
-					Danger Zone
-				</CardTitle>
-			</CardHeader>
-			<CardContent>
-				<div className="flex flex-col gap-4">
-					<div className="flex flex-col gap-2">
-						<h3 className="text-base font-semibold">
-							Deploy with Fresh Volumes
-						</h3>
-						<p className="text-sm text-muted-foreground">
-							Permanently wipes every volume of this compose and redeploys it
-							from a clean state. All persistent data (databases, uploads,
-							caches) will be lost.
-						</p>
-					</div>
-					<Dialog
-						open={isOpen}
-						onOpenChange={(open) => {
-							setIsOpen(open);
-							if (!open) form.reset();
-						}}
-					>
-						<DialogTrigger asChild>
-							<Button
-								isLoading={isPending}
-								variant="outline"
-								className="w-full border-destructive/50 hover:bg-destructive/10 hover:text-destructive text-destructive"
-							>
-								<HardDriveDownload className="mr-2 h-4 w-4" />
-								Deploy with Fresh Volumes
-							</Button>
-						</DialogTrigger>
-						<DialogContent className="sm:max-w-lg">
-							<DialogHeader>
-								<DialogTitle className="flex items-center gap-2">
-									<AlertTriangle className="h-5 w-5 text-destructive" />
-									Are you absolutely sure?
-								</DialogTitle>
-								<DialogDescription asChild>
-									<div className="space-y-2">
-										<p>This action will:</p>
-										<ul className="list-disc list-inside space-y-1">
-											<li>Stop the current compose</li>
-											<li>Delete all volumes and their data</li>
-											<li>Redeploy the compose with empty volumes</li>
-										</ul>
-										<p className="font-medium text-destructive mt-4">
-											This action cannot be undone.
-										</p>
-									</div>
-								</DialogDescription>
-							</DialogHeader>
-							<Form {...form}>
-								<form
-									onSubmit={form.handleSubmit(onSubmit)}
-									id="hook-form-fresh-volumes"
-									className="grid w-full gap-4"
-								>
-									<FormField
-										control={form.control}
-										name="confirmName"
-										render={({ field }) => (
-											<FormItem>
-												<FormLabel className="flex items-center gap-2">
-													<span>
-														To confirm, type{" "}
-														<Badge
-															className="p-2 rounded-md ml-1 mr-1 hover:border-primary hover:text-primary-foreground hover:bg-primary hover:cursor-pointer"
-															variant="outline"
-															onClick={() => {
-																if (data?.name && data?.appName) {
-																	copy(expectedName);
-																	toast.success(
-																		"Copied to clipboard. Be careful!",
-																	);
-																}
-															}}
-														>
-															{expectedName}&nbsp;
-															<Copy className="h-4 w-4 ml-1 text-muted-foreground" />
-														</Badge>{" "}
-														in the box below:
-													</span>
-												</FormLabel>
-												<FormControl>
-													<Input
-														placeholder="Enter compose name to confirm"
-														autoComplete="off"
-														{...field}
-													/>
-												</FormControl>
-												<FormMessage />
-											</FormItem>
-										)}
-									/>
-								</form>
-							</Form>
-							{isRunning && (
-								<AlertBlock type="warning" className="w-full">
-									Cannot deploy with fresh volumes while a deployment is
-									running. Please wait for it to finish and then try again.
-								</AlertBlock>
-							)}
-							<DialogFooter>
-								<Button variant="secondary" onClick={() => setIsOpen(false)}>
-									Cancel
-								</Button>
-								<Button
-									isLoading={isPending}
-									disabled={isRunning}
-									form="hook-form-fresh-volumes"
-									type="submit"
-									variant="destructive"
-								>
-									Wipe volumes and deploy
-								</Button>
-							</DialogFooter>
-						</DialogContent>
-					</Dialog>
-				</div>
-			</CardContent>
-		</Card>
-	);
-};
@@ -1,4 +1,11 @@
-import { Ban, CheckCircle2, RefreshCcw, Rocket, Terminal } from "lucide-react";
+import {
+	Ban,
+	CheckCircle2,
+	HardDriveDownload,
+	RefreshCcw,
+	Rocket,
+	Terminal,
+} from "lucide-react";
 import { useRouter } from "next/router";
 import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { toast } from "sonner";
@@ -82,6 +89,51 @@ export const ComposeActions = ({ composeId }: Props) => {
 						</Button>
 					</DialogAction>
 				)}
+				{canDeploy && data?.composeType === "docker-compose" && (
+					<DialogAction
+						title="Deploy with Fresh Volumes"
+						description="This will remove all volumes and redeploy with a clean state. All persistent data will be permanently deleted."
+						type="destructive"
+						onClick={async () => {
+							await deploy({
+								composeId: composeId,
+								freshVolumes: true,
+							})
+								.then(() => {
+									toast.success("Compose deployed with fresh volumes");
+									refetch();
+									router.push(
+										`/dashboard/project/${data?.environment.projectId}/environment/${data?.environmentId}/services/compose/${composeId}?tab=deployments`,
+									);
+								})
+								.catch(() => {
+									toast.error("Error deploying compose");
+								});
+						}}
+					>
+						<Button
+							variant="outline"
+							isLoading={data?.composeStatus === "running"}
+							className="flex items-center gap-1.5 group focus-visible:ring-2 focus-visible:ring-offset-2"
+						>
+							<Tooltip>
+								<TooltipTrigger asChild>
+									<div className="flex items-center">
+										<HardDriveDownload className="size-4 mr-1" />
+										Fresh Volumes
+									</div>
+								</TooltipTrigger>
+								<TooltipPrimitive.Portal>
+									<TooltipContent sideOffset={5} className="z-[60]">
+										<p>
+											Deploy with fresh volumes (removes all persistent data)
+										</p>
+									</TooltipContent>
+								</TooltipPrimitive.Portal>
+							</Tooltip>
+						</Button>
+					</DialogAction>
+				)}
 				{canDeploy && (
 					<DialogAction
 						title="Rebuild Compose"
@@ -158,6 +158,7 @@ export const SaveBitbucketProviderCompose = ({ composeId }: Props) => {
 			composePath: data.composePath,
 			composeId,
 			sourceType: "bitbucket",
+			composeStatus: "idle",
 			watchPaths: data.watchPaths,
 			enableSubmodules: data.enableSubmodules,
 		})
@@ -97,6 +97,7 @@ export const SaveGitProviderCompose = ({ composeId }: Props) => {
 			composeId,
 			sourceType: "git",
 			composePath: values.composePath,
+			composeStatus: "idle",
 			watchPaths: values.watchPaths || [],
 			enableSubmodules: values.enableSubmodules,
 		})
@@ -157,6 +157,7 @@ export const SaveGiteaProviderCompose = ({ composeId }: Props) => {
 			giteaId: data.giteaId,
 			composeId,
 			sourceType: "gitea",
+			composeStatus: "idle",
 			watchPaths: data.watchPaths,
 			enableSubmodules: data.enableSubmodules,
 		} as any)
@@ -155,6 +155,7 @@ export const SaveGithubProviderCompose = ({ composeId }: Props) => {
 			composePath: data.composePath,
 			githubId: data.githubId,
 			sourceType: "github",
+			composeStatus: "idle",
 			watchPaths: data.watchPaths,
 			enableSubmodules: data.enableSubmodules,
 			triggerType: data.triggerType,
@@ -169,6 +169,7 @@ export const SaveGitlabProviderCompose = ({ composeId }: Props) => {
 			gitlabProjectId: data.repository.id,
 			gitlabPathNamespace: data.repository.gitlabPathNamespace,
 			sourceType: "gitlab",
+			composeStatus: "idle",
 			watchPaths: data.watchPaths,
 			enableSubmodules: data.enableSubmodules,
 		})
@@ -554,10 +554,7 @@ export const RestoreBackup = ({
 												value={field.value}
 												onValueChange={(value: DatabaseType) => {
 													field.onChange(value);
-													form.setValue("metadata", {
-														serviceName:
-															form.getValues("metadata.serviceName") ?? "",
-													});
+													form.setValue("metadata", {});
 												}}
 											>
 												<SelectTrigger>
@@ -584,7 +581,7 @@ export const RestoreBackup = ({
 											<div className="flex gap-2">
 												<Select
 													onValueChange={field.onChange}
-													value={field.value ?? ""}
+													value={field.value || undefined}
 												>
 													<FormControl>
 														<SelectTrigger>
@@ -1,4 +1,10 @@
-import { ClipboardList, DatabaseBackup, Play, Trash2 } from "lucide-react";
+import {
+	ClipboardList,
+	Database,
+	DatabaseBackup,
+	Play,
+	Trash2,
+} from "lucide-react";
 import Link from "next/link";
 import { useState } from "react";
 import { toast } from "sonner";
@@ -95,9 +101,12 @@ export const ShowBackups = ({

 	return (
 		<Card className="bg-background">
-			<CardHeader className="flex flex-row items-center flex-wrap gap-4 justify-between">
-				<div className="flex flex-col gap-1">
-					<CardTitle className="text-xl">Backups</CardTitle>
+			<CardHeader className="flex flex-row justify-between gap-4  flex-wrap">
+				<div className="flex flex-col gap-0.5">
+					<CardTitle className="text-xl flex flex-row gap-2">
+						<Database className="size-6 text-muted-foreground" />
+						Backups
+					</CardTitle>
 					<CardDescription>
 						Add backups to your database to save the data to a different
 						provider.
@@ -1,8 +1,10 @@
 "use client";

 import {
+	type ColumnFiltersState,
 	flexRender,
 	getCoreRowModel,
+	getFilteredRowModel,
 	getPaginationRowModel,
 	getSortedRowModel,
 	type PaginationState,
@@ -25,6 +27,7 @@ import Link from "next/link";
 import { useMemo, useState } from "react";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
 import {
 	Select,
 	SelectContent,
@@ -94,21 +97,14 @@ function getServiceInfo(d: DeploymentRow) {
 	return null;
 }

-interface ShowDeploymentsTableProps {
-	globalFilter: string;
-	statusFilter: string;
-	typeFilter: string;
-}
-
-export function ShowDeploymentsTable({
-	globalFilter,
-	statusFilter,
-	typeFilter,
-}: ShowDeploymentsTableProps) {
+export function ShowDeploymentsTable() {
 	const [sorting, setSorting] = useState<SortingState>([
 		{ id: "createdAt", desc: true },
 	]);
-
+	const [columnFilters, setColumnFilters] = useState<ColumnFiltersState>([]);
+	const [globalFilter, setGlobalFilter] = useState("");
+	const [statusFilter, setStatusFilter] = useState<string>("all");
+	const [typeFilter, setTypeFilter] = useState<string>("all");
 	const [pagination, setPagination] = useState<PaginationState>({
 		pageIndex: 0,
 		pageSize: 50,
@@ -450,140 +446,177 @@ export function ShowDeploymentsTable({
 		columns,
 		state: {
 			sorting,
+			columnFilters,
+			globalFilter,
 			pagination,
 		},
 		onSortingChange: setSorting,
+		onColumnFiltersChange: setColumnFilters,
+		onGlobalFilterChange: setGlobalFilter,
 		onPaginationChange: setPagination,
 		getCoreRowModel: getCoreRowModel(),
 		getSortedRowModel: getSortedRowModel(),
+		getFilteredRowModel: getFilteredRowModel(),
 		getPaginationRowModel: getPaginationRowModel(),
 	});

 	return (
-		<div className="px-0">
-			{isLoading ? (
-				<div className="flex gap-4 w-full items-center justify-center min-h-[45vh] text-muted-foreground">
-					<Loader2 className="size-4 animate-spin" />
-					<span>Loading deployments...</span>
-				</div>
-			) : (
-				<>
-					<div className="rounded-md border overflow-x-auto">
-						<Table>
-							<TableHeader>
-								{table.getHeaderGroups().map((headerGroup) => (
-									<TableRow key={headerGroup.id}>
-										{headerGroup.headers.map((header) => (
-											<TableHead key={header.id}>
-												{header.isPlaceholder
-													? null
-													: flexRender(
-															header.column.columnDef.header,
-															header.getContext(),
-														)}
-											</TableHead>
-										))}
-									</TableRow>
-								))}
-							</TableHeader>
-							<TableBody>
-								{table.getRowModel().rows?.length ? (
-									table.getRowModel().rows.map((row) => (
-										<TableRow key={row.id}>
-											{row.getVisibleCells().map((cell) => (
-												<TableCell key={cell.id}>
-													{flexRender(
-														cell.column.columnDef.cell,
-														cell.getContext(),
-													)}
-												</TableCell>
+		<div className="space-y-2">
+			<div className="flex flex-wrap items-center gap-2">
+				<Input
+					placeholder="Search by name, project, environment, server..."
+					value={globalFilter}
+					onChange={(e) => setGlobalFilter(e.target.value)}
+					className="max-w-xs"
+				/>
+				<Select value={statusFilter} onValueChange={setStatusFilter}>
+					<SelectTrigger className="w-[140px]">
+						<SelectValue placeholder="Status" />
+					</SelectTrigger>
+					<SelectContent>
+						<SelectItem value="all">All statuses</SelectItem>
+						<SelectItem value="running">Running</SelectItem>
+						<SelectItem value="done">Done</SelectItem>
+						<SelectItem value="error">Error</SelectItem>
+						<SelectItem value="cancelled">Cancelled</SelectItem>
+					</SelectContent>
+				</Select>
+				<Select value={typeFilter} onValueChange={setTypeFilter}>
+					<SelectTrigger className="w-[140px]">
+						<SelectValue placeholder="Type" />
+					</SelectTrigger>
+					<SelectContent>
+						<SelectItem value="all">All types</SelectItem>
+						<SelectItem value="application">Application</SelectItem>
+						<SelectItem value="compose">Compose</SelectItem>
+					</SelectContent>
+				</Select>
+			</div>
+			<div className="px-0">
+				{isLoading ? (
+					<div className="flex gap-4 w-full items-center justify-center min-h-[45vh] text-muted-foreground">
+						<Loader2 className="size-4 animate-spin" />
+						<span>Loading deployments...</span>
+					</div>
+				) : (
+					<>
+						<div className="rounded-md border overflow-x-auto">
+							<Table>
+								<TableHeader>
+									{table.getHeaderGroups().map((headerGroup) => (
+										<TableRow key={headerGroup.id}>
+											{headerGroup.headers.map((header) => (
+												<TableHead key={header.id}>
+													{header.isPlaceholder
+														? null
+														: flexRender(
+																header.column.columnDef.header,
+																header.getContext(),
+															)}
+												</TableHead>
 											))}
 										</TableRow>
-									))
-								) : (
-									<TableRow>
-										<TableCell
-											colSpan={columns.length}
-											className=" text-center"
-										>
-											<div className="flex flex-col min-h-[45vh] items-center justify-center gap-2 text-muted-foreground">
-												<Rocket className="size-8" />
-												<p className="font-medium">No deployments found</p>
-												<p className="text-sm">
-													Deployments from applications and compose will appear
-													here.
-												</p>
-											</div>
-										</TableCell>
-									</TableRow>
-								)}
-							</TableBody>
-						</Table>
-					</div>
-					<div className="flex flex-col gap-4 px-4 py-4 border-t sm:flex-row sm:items-center sm:justify-between">
-						<div className="flex items-center gap-2 flex-wrap">
-							<span className="text-sm text-muted-foreground whitespace-nowrap">
-								Rows per page
-							</span>
-							<Select
-								value={String(pagination.pageSize)}
-								onValueChange={(value) => {
-									setPagination((p) => ({
-										...p,
-										pageSize: Number(value),
-										pageIndex: 0,
-									}));
-								}}
-							>
-								<SelectTrigger className="h-8 w-[70px]">
-									<SelectValue />
-								</SelectTrigger>
-								<SelectContent side="top">
-									{[10, 25, 50, 100].map((size) => (
-										<SelectItem key={size} value={String(size)}>
-											{size}
-										</SelectItem>
 									))}
-								</SelectContent>
-							</Select>
-							<span className="text-sm text-muted-foreground whitespace-nowrap">
-								Showing{" "}
-								{filteredData.length === 0
-									? 0
-									: pagination.pageIndex * pagination.pageSize + 1}{" "}
-								to{" "}
-								{Math.min(
-									(pagination.pageIndex + 1) * pagination.pageSize,
-									filteredData.length,
-								)}{" "}
-								of {filteredData.length} entries
-							</span>
+								</TableHeader>
+								<TableBody>
+									{table.getRowModel().rows?.length ? (
+										table.getRowModel().rows.map((row) => (
+											<TableRow key={row.id}>
+												{row.getVisibleCells().map((cell) => (
+													<TableCell key={cell.id}>
+														{flexRender(
+															cell.column.columnDef.cell,
+															cell.getContext(),
+														)}
+													</TableCell>
+												))}
+											</TableRow>
+										))
+									) : (
+										<TableRow>
+											<TableCell
+												colSpan={columns.length}
+												className=" text-center"
+											>
+												<div className="flex flex-col min-h-[45vh] items-center justify-center gap-2 text-muted-foreground">
+													<Rocket className="size-8" />
+													<p className="font-medium">No deployments found</p>
+													<p className="text-sm">
+														Deployments from applications and compose will
+														appear here.
+													</p>
+												</div>
+											</TableCell>
+										</TableRow>
+									)}
+								</TableBody>
+							</Table>
 						</div>
-						<div className="flex items-center gap-2">
-							<Button
-								variant="outline"
-								size="sm"
-								className="h-8"
-								onClick={() => table.previousPage()}
-								disabled={!table.getCanPreviousPage()}
-							>
-								<ChevronLeft className="size-4" />
-								Previous
-							</Button>
-							<Button
-								variant="outline"
-								size="sm"
-								className="h-8"
-								onClick={() => table.nextPage()}
-								disabled={!table.getCanNextPage()}
-							>
-								Next
-								<ChevronRight className="size-4" />
-							</Button>
+						<div className="flex flex-col gap-4 px-4 py-4 border-t sm:flex-row sm:items-center sm:justify-between">
+							<div className="flex items-center gap-2 flex-wrap">
+								<span className="text-sm text-muted-foreground whitespace-nowrap">
+									Rows per page
+								</span>
+								<Select
+									value={String(pagination.pageSize)}
+									onValueChange={(value) => {
+										setPagination((p) => ({
+											...p,
+											pageSize: Number(value),
+											pageIndex: 0,
+										}));
+									}}
+								>
+									<SelectTrigger className="h-8 w-[70px]">
+										<SelectValue />
+									</SelectTrigger>
+									<SelectContent side="top">
+										{[10, 25, 50, 100].map((size) => (
+											<SelectItem key={size} value={String(size)}>
+												{size}
+											</SelectItem>
+										))}
+									</SelectContent>
+								</Select>
+								<span className="text-sm text-muted-foreground whitespace-nowrap">
+									Showing{" "}
+									{filteredData.length === 0
+										? 0
+										: pagination.pageIndex * pagination.pageSize + 1}{" "}
+									to{" "}
+									{Math.min(
+										(pagination.pageIndex + 1) * pagination.pageSize,
+										filteredData.length,
+									)}{" "}
+									of {filteredData.length} entries
+								</span>
+							</div>
+							<div className="flex items-center gap-2">
+								<Button
+									variant="outline"
+									size="sm"
+									className="h-8"
+									onClick={() => table.previousPage()}
+									disabled={!table.getCanPreviousPage()}
+								>
+									<ChevronLeft className="size-4" />
+									Previous
+								</Button>
+								<Button
+									variant="outline"
+									size="sm"
+									className="h-8"
+									onClick={() => table.nextPage()}
+									disabled={!table.getCanNextPage()}
+								>
+									Next
+									<ChevronRight className="size-4" />
+								</Button>
+							</div>
 						</div>
-					</div>
-				</>
-			)}
+					</>
+				)}
+			</div>
 		</div>
 	);
 }
@@ -45,19 +45,13 @@ function StatCard({
 	label,
 	value,
 	delta,
-	href,
 }: {
 	label: string;
 	value: string;
 	delta?: string;
-	href?: string;
 }) {
-	const content = (
-		<div
-			className={`rounded-xl border bg-background p-5 min-h-[140px] flex flex-col justify-between h-full ${
-				href ? "transition-colors hover:bg-muted/40 cursor-pointer" : ""
-			}`}
-		>
+	return (
+		<div className="rounded-xl border bg-background p-5 min-h-[140px] flex flex-col justify-between">
 			<span className="text-xs uppercase tracking-wider text-muted-foreground">
 				{label}
 			</span>
@@ -69,16 +63,6 @@ function StatCard({
 			</div>
 		</div>
 	);
-
-	if (href) {
-		return (
-			<Link href={href} className="block h-full">
-				{content}
-			</Link>
-		);
-	}
-
-	return content;
 }

 function StatusListCard({
@@ -198,7 +182,6 @@ export const ShowHome = () => {
 							label="Projects"
 							value={String(totals.projects)}
 							delta={`${totals.environments} ${totals.environments === 1 ? "environment" : "environments"}`}
-							href="/dashboard/projects"
 						/>
 						<StatCard
 							label="Services"
@@ -1,143 +0,0 @@
-import copy from "copy-to-clipboard";
-import { Copy, Loader2, Trash2 } from "lucide-react";
-import { useState } from "react";
-import { toast } from "sonner";
-import { AlertBlock } from "@/components/shared/alert-block";
-import { Button } from "@/components/ui/button";
-import {
-	Dialog,
-	DialogContent,
-	DialogDescription,
-	DialogFooter,
-	DialogHeader,
-	DialogTitle,
-	DialogTrigger,
-} from "@/components/ui/dialog";
-import { Input } from "@/components/ui/input";
-import { Label } from "@/components/ui/label";
-import { api } from "@/utils/api";
-
-const CONFIRMATION_WORD = "DELETE";
-
-export const DeleteAccountByEmail = () => {
-	const [open, setOpen] = useState(false);
-	const [email, setEmail] = useState("");
-	const [confirmation, setConfirmation] = useState("");
-	const [record, setRecord] = useState<string | null>(null);
-	const { mutateAsync, isPending } =
-		api.user.deleteAccountByEmail.useMutation();
-
-	const canConfirm =
-		email.trim().length > 0 && confirmation.trim() === CONFIRMATION_WORD;
-
-	const reset = () => {
-		setEmail("");
-		setConfirmation("");
-		setRecord(null);
-	};
-
-	const handleDelete = async () => {
-		try {
-			const result = await mutateAsync({ email: email.trim() });
-			setRecord(JSON.stringify(result, null, 2));
-			toast.success(`Account ${result.email} deleted`);
-		} catch (error) {
-			toast.error(
-				error instanceof Error ? error.message : "Error deleting account",
-			);
-		}
-	};
-
-	return (
-		<Dialog
-			open={open}
-			onOpenChange={(value) => {
-				setOpen(value);
-				if (!value) reset();
-			}}
-		>
-			<DialogTrigger asChild>
-				<Button variant="destructive" className="gap-2">
-					<Trash2 className="h-4 w-4" />
-					Delete account
-				</Button>
-			</DialogTrigger>
-			<DialogContent className="sm:max-w-lg">
-				<DialogHeader>
-					<DialogTitle>Delete an account by email</DialogTitle>
-					<DialogDescription>
-						Cancels every Stripe subscription and deletes the user with all the
-						organizations they own. Invoices stay in Stripe for accounting. Use
-						it to fulfil data deletion requests.
-					</DialogDescription>
-				</DialogHeader>
-				{record ? (
-					<div className="flex flex-col gap-3">
-						<AlertBlock type="success">
-							Deletion completed. Keep this record as evidence of the request
-							being fulfilled.
-						</AlertBlock>
-						<pre className="text-xs bg-muted rounded-md p-3 overflow-x-auto max-h-64">
-							{record}
-						</pre>
-						<Button
-							variant="outline"
-							size="sm"
-							className="gap-2 self-end"
-							onClick={() => {
-								copy(record);
-								toast.success("Deletion record copied to clipboard");
-							}}
-						>
-							<Copy className="h-4 w-4" />
-							Copy record
-						</Button>
-					</div>
-				) : (
-					<div className="flex flex-col gap-4">
-						<div className="flex flex-col gap-2">
-							<Label htmlFor="delete-account-email">Account email</Label>
-							<Input
-								id="delete-account-email"
-								type="email"
-								autoComplete="off"
-								placeholder="user@example.com"
-								value={email}
-								onChange={(e) => setEmail(e.target.value)}
-							/>
-						</div>
-						<div className="flex flex-col gap-2">
-							<Label htmlFor="delete-account-word">
-								Type <span className="font-mono">{CONFIRMATION_WORD}</span> to
-								confirm
-							</Label>
-							<Input
-								id="delete-account-word"
-								autoComplete="off"
-								placeholder={CONFIRMATION_WORD}
-								value={confirmation}
-								onChange={(e) => setConfirmation(e.target.value)}
-							/>
-						</div>
-					</div>
-				)}
-				<DialogFooter>
-					{record ? (
-						<Button variant="outline" onClick={() => setOpen(false)}>
-							Close
-						</Button>
-					) : (
-						<Button
-							variant="destructive"
-							disabled={!canConfirm || isPending}
-							onClick={handleDelete}
-						>
-							{isPending && <Loader2 className="h-4 w-4 animate-spin" />}
-							Delete account
-						</Button>
-					)}
-				</DialogFooter>
-			</DialogContent>
-		</Dialog>
-	);
-};
@@ -46,7 +46,6 @@ import { authClient } from "@/lib/auth-client";
 import { cn } from "@/lib/utils";
 import { api } from "@/utils/api";
 import { useWhitelabeling } from "@/utils/hooks/use-whitelabeling";
-import { DeleteAccountByEmail } from "./delete-account-by-email";

 type User = typeof authClient.$Infer.Session.user;

@@ -79,12 +78,12 @@ export const ImpersonationBar = () => {
 			});

 			const filteredUsers = response.data?.users.filter(
-				// @ts-expect-error
+				// @ts-ignore
 				(user) => user.allowImpersonation && data?.user?.email !== user.email,
 			);

 			if (!response.error) {
-				// @ts-expect-error
+				// @ts-ignore
 				setUsers(filteredUsers || []);
 			}
 		} catch (error) {
@@ -186,7 +185,6 @@ export const ImpersonationBar = () => {
 						<Logo
 							className="w-10 h-10"
 							logoUrl={whitelabeling?.logoUrl || undefined}
-							logoLightUrl={whitelabeling?.logoLightUrl || undefined}
 						/>
 						{!isImpersonating ? (
 							<div className="flex items-center gap-2 w-full">
@@ -284,7 +282,6 @@ export const ImpersonationBar = () => {
 									<Shield className="h-4 w-4" />
 									Impersonate
 								</Button>
-								<DeleteAccountByEmail />
 							</div>
 						) : (
 							<div className="flex items-center gap-4 w-full flex-wrap">
@@ -278,9 +278,8 @@ export const OnboardingWizard = ({ onClose }: Props) => {
 						<DialogTitle>Skip onboarding?</DialogTitle>
 						<DialogDescription>
 							If this is your first time using Dokploy, we recommend going
-							through these steps – it only takes a couple of minutes and gives
-							you a feel for how projects, servers, and deployments fit
-							together.
+							through these steps — it only takes a couple of minutes and gives
+							you a feel for how projects, servers and deployments fit together.
 						</DialogDescription>
 					</DialogHeader>
 					<DialogFooter>
@@ -11,54 +11,17 @@ import { Button } from "@/components/ui/button";
 import { api } from "@/utils/api";
 import { displayFont } from "../font";

-const stripePromise = process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY
-	? loadStripe(process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY)
-	: null;
-
-type Tier = "hobby" | "startup";
-
-const PLANS: {
-	tier: Tier;
-	name: string;
-	description: string;
-	price: number;
-	features: string[];
-	recommended?: boolean;
-}[] = [
-	{
-		tier: "hobby",
-		name: "Hobby",
-		description: "For individual developers",
-		price: calculatePriceHobby(1, false),
-		features: [
-			"Setup 1 server",
-			"Unlimited apps & databases",
-			"2 environments",
-			"Community support",
-		],
-	},
-	{
-		tier: "startup",
-		name: "Startup",
-		description: "For small to mid-size teams",
-		price: calculatePriceStartup(STARTUP_SERVERS_INCLUDED, false),
-		recommended: true,
-		features: [
-			`Setup up to ${STARTUP_SERVERS_INCLUDED} servers`,
-			"Unlimited users & environments",
-			"Basic RBAC + 2FA",
-			"Email & chat support",
-		],
-	},
-];
+const stripePromise = loadStripe(
+	process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY!,
+);

 interface Props {
 	onNext: () => void;
 }

 export const PlanStep = ({ onNext }: Props) => {
-	const [loading, setLoading] = useState<
-		`${"trial" | "checkout"}:${Tier}` | null
+	const [loadingTier, setLoadingTier] = useState<
+		"hobby" | "startup" | "trial" | null
 	>(null);
 	const { data } = api.stripe.getProducts.useQuery();
 	const { mutateAsync: createCheckoutSession } =
@@ -67,12 +30,12 @@ export const PlanStep = ({ onNext }: Props) => {
 		api.stripe.startFreeTrial.useMutation();
 	const utils = api.useUtils();

-	const handleCheckout = async (tier: Tier) => {
+	const handleCheckout = async (tier: "hobby" | "startup") => {
 		if (!data) return;
 		const productId =
 			tier === "hobby" ? data.hobbyProductId : data.startupProductId;
 		if (!productId) return;
-		setLoading(`checkout:${tier}`);
+		setLoadingTier(tier);
 		try {
 			const stripe = await stripePromise;
 			const session = await createCheckoutSession({
@@ -84,23 +47,23 @@ export const PlanStep = ({ onNext }: Props) => {
 			await stripe?.redirectToCheckout({ sessionId: session.sessionId });
 		} catch {
 			toast.error("Error starting checkout");
-			setLoading(null);
+			setLoadingTier(null);
 		}
 	};

-	const handleTrial = async (tier: Tier) => {
-		setLoading(`trial:${tier}`);
+	const handleTrial = async () => {
+		setLoadingTier("trial");
 		try {
-			await startFreeTrial({ tier });
+			await startFreeTrial();
 			await utils.project.onboardingStatus.invalidate();
-			toast.success("Your 7-day trial has started");
+			toast.success("Your 14-day trial has started");
 			onNext();
 		} catch (error) {
 			toast.error(
 				error instanceof Error ? error.message : "Error starting trial",
 			);
 		} finally {
-			setLoading(null);
+			setLoadingTier(null);
 		}
 	};

@@ -116,72 +79,134 @@ export const PlanStep = ({ onNext }: Props) => {
 					Start free, upgrade when ready.
 				</h1>
 				<p className="text-muted-foreground text-lg max-w-md leading-relaxed">
-					Try any plan free for 7 days. No credit card required — add one only
-					if you decide to stay.
+					No credit card for the trial — add one only if you decide to stay.
 				</p>
 			</div>

+			<div className="flex flex-col rounded-2xl bg-zinc-950 dark:bg-white text-white dark:text-zinc-950 overflow-hidden">
+				<div className="flex flex-col sm:flex-row sm:items-start justify-between gap-6 p-7">
+					<div>
+						<span className="inline-flex items-center rounded-full bg-white text-zinc-950 dark:bg-zinc-950 dark:text-white font-mono text-[10px] font-semibold uppercase tracking-[0.15em] px-2.5 py-1">
+							Recommended
+						</span>
+						<p className={`${displayFont.className} text-2xl mt-3`}>
+							14-day free trial
+						</p>
+						<p className="text-sm text-zinc-400 dark:text-zinc-600 mt-1 max-w-xs">
+							No card required — cancel anytime.
+						</p>
+						<ul className="flex flex-col gap-1.5 mt-4">
+							{[
+								"1 server included",
+								"Unlimited apps & databases",
+								"Community support",
+							].map((f) => (
+								<li
+									key={f}
+									className="flex items-center gap-2 text-sm text-zinc-300 dark:text-zinc-700"
+								>
+									<CheckIcon className="size-3.5 text-zinc-500 shrink-0" />
+									{f}
+								</li>
+							))}
+						</ul>
+					</div>
+					<Button
+						size="lg"
+						className="bg-white text-zinc-950 hover:bg-zinc-200 dark:bg-zinc-950 dark:text-white dark:hover:bg-zinc-800 w-fit shrink-0 px-6"
+						isLoading={loadingTier === "trial"}
+						disabled={loadingTier !== null}
+						onClick={handleTrial}
+					>
+						Start trial
+						<ArrowRightIcon className="size-4" />
+					</Button>
+				</div>
+			</div>
+
 			<div className="grid grid-cols-1 sm:grid-cols-2 gap-px bg-border rounded-2xl overflow-hidden border">
-				{PLANS.map((plan) => {
-					const productId =
-						plan.tier === "hobby"
-							? data?.hobbyProductId
-							: data?.startupProductId;
-					return (
-						<div
-							key={plan.tier}
-							className="flex flex-col justify-between gap-6 bg-background p-7"
-						>
-							<div>
-								{plan.recommended && (
-									<span className="inline-flex items-center rounded-full bg-primary text-primary-foreground font-mono text-[10px] font-semibold uppercase tracking-[0.15em] px-2.5 py-1 mb-3">
-										Recommended
-									</span>
-								)}
-								<p className="font-medium">{plan.name}</p>
-								<p className="text-sm text-muted-foreground mt-1">
-									{plan.description}
-								</p>
-								<p className="text-3xl font-semibold mt-4 tabular-nums">
-									${plan.price.toFixed(2)}
-									<span className="text-sm font-normal text-muted-foreground">
-										{" "}
-										/mo
-									</span>
-								</p>
-								<ul className="flex flex-col gap-1.5 mt-4">
-									{plan.features.map((f) => (
-										<li
-											key={f}
-											className="flex items-center gap-2 text-sm text-muted-foreground"
-										>
-											<CheckIcon className="size-3.5 shrink-0" />
-											{f}
-										</li>
-									))}
-								</ul>
-							</div>
-							<div className="flex flex-col gap-2">
-								<Button
-									isLoading={loading === `trial:${plan.tier}`}
-									disabled={loading !== null}
-									onClick={() => handleTrial(plan.tier)}
+				<div className="flex flex-col justify-between gap-6 bg-background p-7">
+					<div>
+						<p className="font-medium">Hobby</p>
+						<p className="text-sm text-muted-foreground mt-1">
+							For individual developers
+						</p>
+						<p className="text-3xl font-semibold mt-4 tabular-nums">
+							${calculatePriceHobby(1, false).toFixed(2)}
+							<span className="text-sm font-normal text-muted-foreground">
+								{" "}
+								/mo
+							</span>
+						</p>
+						<ul className="flex flex-col gap-1.5 mt-4">
+							{[
+								"1 server included",
+								"Unlimited apps & databases",
+								"2 environments",
+								"Community support",
+							].map((f) => (
+								<li
+									key={f}
+									className="flex items-center gap-2 text-sm text-muted-foreground"
 								>
-									Start 7-day free trial
-									<ArrowRightIcon className="size-4" />
-								</Button>
-								<Button
-									variant="outline"
-									isLoading={loading === `checkout:${plan.tier}`}
-									disabled={loading !== null || !productId}
-									onClick={() => handleCheckout(plan.tier)}
+									<CheckIcon className="size-3.5 shrink-0" />
+									{f}
+								</li>
+							))}
+						</ul>
+					</div>
+					<Button
+						variant="outline"
+						isLoading={loadingTier === "hobby"}
+						disabled={loadingTier !== null || !data?.hobbyProductId}
+						onClick={() => handleCheckout("hobby")}
+					>
+						Subscribe
+					</Button>
+				</div>
+
+				<div className="flex flex-col justify-between gap-6 bg-background p-7">
+					<div>
+						<p className="font-medium">Startup</p>
+						<p className="text-sm text-muted-foreground mt-1">
+							For small to mid-size teams
+						</p>
+						<p className="text-3xl font-semibold mt-4 tabular-nums">
+							$
+							{calculatePriceStartup(STARTUP_SERVERS_INCLUDED, false).toFixed(
+								2,
+							)}
+							<span className="text-sm font-normal text-muted-foreground">
+								{" "}
+								/mo
+							</span>
+						</p>
+						<ul className="flex flex-col gap-1.5 mt-4">
+							{[
+								`${STARTUP_SERVERS_INCLUDED} servers included`,
+								"Unlimited users & environments",
+								"Basic RBAC + 2FA",
+								"Email & chat support",
+							].map((f) => (
+								<li
+									key={f}
+									className="flex items-center gap-2 text-sm text-muted-foreground"
 								>
-									Subscribe now
-								</Button>
-							</div>
-						</div>
-					);
-				})}
+									<CheckIcon className="size-3.5 shrink-0" />
+									{f}
+								</li>
+							))}
+						</ul>
+					</div>
+					<Button
+						variant="outline"
+						isLoading={loadingTier === "startup"}
+						disabled={loadingTier !== null || !data?.startupProductId}
+						onClick={() => handleCheckout("startup")}
+					>
+						Subscribe
+					</Button>
+				</div>
 			</div>
 		</div>
 	);
@@ -65,7 +65,7 @@ export const ProjectStep = ({ onNext, plainTitle }: Props) => {
 				</span>
 				<h1 className={titleClassName}>Create your first project.</h1>
 				<p className="text-muted-foreground text-lg max-w-md leading-relaxed">
-					Projects group your apps, databases, and environments together.
+					Projects group your apps, databases and environments together.
 				</p>
 			</div>

@@ -1,12 +1,6 @@
 import { standardSchemaResolver as zodResolver } from "@hookform/resolvers/standard-schema";
 import copy from "copy-to-clipboard";
-import {
-	CheckCircle2,
-	CopyIcon,
-	InfoIcon,
-	Loader2,
-	XCircle,
-} from "lucide-react";
+import { CheckCircle2, CopyIcon, Loader2, XCircle } from "lucide-react";
 import { useEffect, useRef, useState } from "react";
 import { useForm } from "react-hook-form";
 import { toast } from "sonner";
@@ -206,19 +200,9 @@ export const ServerStep = ({ onNext, plainTitle }: Props) => {
 				</span>
 				<h1 className={titleClassName}>Connect a server.</h1>
 				<p className="text-muted-foreground text-lg max-w-md leading-relaxed">
-					Dokploy deploys to servers you own. Buy one from any VPS provider
+					Dokploy deploys to servers you own — buy one from any VPS provider
 					(Hetzner, DigitalOcean, Hostinger...) and paste its IP below.
 				</p>
-				<div className="flex items-start gap-2.5 rounded-lg border p-3 max-w-md">
-					<InfoIcon className="size-4 text-muted-foreground shrink-0 mt-0.5" />
-					<div className="flex flex-col gap-0.5">
-						<span className="text-sm font-medium">Requirements</span>
-						<span className="text-sm text-muted-foreground">
-							To ensure a smooth experience with Dokploy, your server should
-							have at least 1GB of RAM and 30GB of disk space.
-						</span>
-					</div>
-				</div>
 			</div>

 			{!createdServerId ? (
@@ -303,7 +287,7 @@ export const ServerStep = ({ onNext, plainTitle }: Props) => {
 						{isSettingUp ? (
 							<div className="flex items-center justify-center gap-3 py-4 text-sm text-muted-foreground">
 								<Loader2 className="size-4 animate-spin shrink-0" />
-								Setting up your server – installing Docker and dependencies…
+								Setting up your server — installing Docker and dependencies...
 							</div>
 						) : isValidating && !validation ? (
 							<div className="flex items-center justify-center gap-2 py-4 text-sm text-muted-foreground">
@@ -327,7 +311,7 @@ export const ServerStep = ({ onNext, plainTitle }: Props) => {
 					</div>
 					{!isReady && !isSettingUp && (
 						<AlertBlock type="info">
-							Setup runs after the server boots and this page checks for it
+							Setup usually takes a minute after the server boots — this checks
 							automatically. You can retry setup, or use "Skip for now" above to
 							continue and come back to this later.
 						</AlertBlock>
@@ -39,8 +39,8 @@ export const WelcomeStep = ({ onNext }: Props) => {
 					Let's get your first app <em className="not-italic">live</em>.
 				</h1>
 				<p className="text-muted-foreground text-lg max-w-md leading-relaxed">
-					It just takes a few steps: pick a plan, connect a server, ship
-					something. You'll have a working URL by the end.
+					A few steps — pick a plan, connect a server, ship something. You'll
+					have a working URL by the end.
 				</p>
 			</div>

@@ -1,11 +1,10 @@
 import { standardSchemaResolver as zodResolver } from "@hookform/resolvers/standard-schema";

-import { PenBoxIcon, Plus, X } from "lucide-react";
+import { GlobeIcon, PenBoxIcon, Plus, X } from "lucide-react";
 import { useEffect, useRef, useState } from "react";
 import { useForm } from "react-hook-form";
 import { toast } from "sonner";
 import { z } from "zod";
-import { Logo } from "@/components/shared/logo";
 import { Button } from "@/components/ui/button";
 import {
 	Dialog,
@@ -256,10 +255,8 @@ export function AddOrganization({
 							control={form.control}
 							name="name"
 							render={({ field }) => (
-								<FormItem className="items-center gap-4">
-									<div className="flex items-center justify-between">
-										<FormLabel className="text-right">Name</FormLabel>
-									</div>
+								<FormItem className="tems-center gap-4">
+									<FormLabel className="text-right">Name</FormLabel>
 									<FormControl>
 										<Input
 											placeholder="Organization name"
@@ -288,16 +285,16 @@ export function AddOrganization({
 										<FormControl>
 											<div className="col-span-3 flex flex-col gap-3">
 												<div className="flex items-center gap-3">
-													<div className="flex size-10 shrink-0 items-center justify-center rounded-md border bg-muted/50 overflow-hidden">
+													<div className="flex size-10 shrink-0 items-center justify-center rounded-md border bg-muted/50 p-1">
 														{field.value ? (
 															// biome-ignore lint/performance/noImgElement: user uploaded logo preview
 															<img
 																src={field.value}
 																alt="Logo preview"
-																className="size-full object-cover"
+																className="size-full object-contain"
 															/>
 														) : (
-															<Logo className="size-7" />
+															<GlobeIcon className="size-5 text-muted-foreground" />
 														)}
 													</div>
 													<div className="relative flex-1">
@@ -1,6 +1,5 @@
 import { Rocket } from "lucide-react";
 import { useRouter } from "next/router";
-import { useState } from "react";
 import { ShowDeploymentsTable } from "@/components/dashboard/deployments/show-deployments-table";
 import { ShowQueueTable } from "@/components/dashboard/deployments/show-queue-table";
 import {
@@ -9,14 +8,6 @@ import {
 	CardHeader,
 	CardTitle,
 } from "@/components/ui/card";
-import { Input } from "@/components/ui/input";
-import {
-	Select,
-	SelectContent,
-	SelectItem,
-	SelectTrigger,
-	SelectValue,
-} from "@/components/ui/select";
 import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";

 const SUBTAB_VALUES = ["deployments", "queue"] as const;
@@ -35,10 +26,6 @@ export const ShowOverviewDeployments = () => {
 			? router.query.subtab
 			: DEFAULT_SUBTAB;

-	const [globalFilter, setGlobalFilter] = useState("");
-	const [statusFilter, setStatusFilter] = useState<string>("all");
-	const [typeFilter, setTypeFilter] = useState<string>("all");
-
 	const setSubtab = (value: string) => {
 		if (!isValidSubtab(value)) return;
 		const { subtab: _current, ...query } = router.query;
@@ -72,50 +59,12 @@ export const ShowOverviewDeployments = () => {
 						onValueChange={setSubtab}
 						className="w-full min-w-0"
 					>
-						<div className="flex flex-col lg:flex-row lg:items-center gap-y-4 gap-x-3 mt-2">
-							<TabsList className="self-start shrink-0">
-								<TabsTrigger value="deployments">Deployments</TabsTrigger>
-								<TabsTrigger value="queue">Queue</TabsTrigger>
-							</TabsList>
-							{subtab === "deployments" && (
-								<div className="flex flex-wrap lg:flex-nowrap items-center gap-2 lg:ml-auto">
-									<Input
-										placeholder="Search by name, project, environment, server..."
-										value={globalFilter}
-										onChange={(e) => setGlobalFilter(e.target.value)}
-										className="max-w-xs"
-									/>
-									<Select value={statusFilter} onValueChange={setStatusFilter}>
-										<SelectTrigger className="w-[140px]">
-											<SelectValue placeholder="Status" />
-										</SelectTrigger>
-										<SelectContent>
-											<SelectItem value="all">All statuses</SelectItem>
-											<SelectItem value="running">Running</SelectItem>
-											<SelectItem value="done">Done</SelectItem>
-											<SelectItem value="error">Error</SelectItem>
-											<SelectItem value="cancelled">Cancelled</SelectItem>
-										</SelectContent>
-									</Select>
-									<Select value={typeFilter} onValueChange={setTypeFilter}>
-										<SelectTrigger className="w-[140px]">
-											<SelectValue placeholder="Type" />
-										</SelectTrigger>
-										<SelectContent>
-											<SelectItem value="all">All types</SelectItem>
-											<SelectItem value="application">Application</SelectItem>
-											<SelectItem value="compose">Compose</SelectItem>
-										</SelectContent>
-									</Select>
-								</div>
-							)}
-						</div>
+						<TabsList className="mt-2">
+							<TabsTrigger value="deployments">Deployments</TabsTrigger>
+							<TabsTrigger value="queue">Queue</TabsTrigger>
+						</TabsList>
 						<TabsContent value="deployments" className="mt-0 min-w-0 pt-4">
-							<ShowDeploymentsTable
-								globalFilter={globalFilter}
-								statusFilter={statusFilter}
-								typeFilter={typeFilter}
-							/>
+							<ShowDeploymentsTable />
 						</TabsContent>
 						<TabsContent value="queue" className="mt-0 pt-4">
 							<ShowQueueTable />
@@ -435,7 +435,7 @@ export const AddTemplate = ({ environmentId, baseUrl }: Props) => {
 												{viewMode === "detailed" &&
 													template?.tags?.length > 0 && (
 														<div className="flex flex-wrap justify-center gap-1.5">
-															{template.tags.slice(0, 6).map((tag) => (
+															{template?.tags?.map((tag) => (
 																<Badge
 																	key={tag}
 																	variant="green"
@@ -444,15 +444,6 @@ export const AddTemplate = ({ environmentId, baseUrl }: Props) => {
 																	{tag}
 																</Badge>
 															))}
-															{template.tags.length > 6 && (
-																<Badge
-																	variant="green"
-																	className="text-[10px] px-2 py-0"
-																	title={template.tags.slice(6).join(", ")}
-																>
-																	+{template.tags.length - 6}
-																</Badge>
-															)}
 														</div>
 													)}
 											</div>
@@ -18,9 +18,7 @@ import { HandleAiProviders } from "./handle-ai-providers";
 export const AiForm = () => {
 	const { data: aiConfigs, refetch, isPending } = api.ai.getAll.useQuery();
 	const { mutateAsync, isPending: isRemoving } = api.ai.delete.useMutation();
-	const { data: permissions } = api.user.getPermissions.useQuery();
 	const { data: currentUser } = api.user.get.useQuery();
-
 	const isOrgAdmin =
 		currentUser?.role === "owner" || currentUser?.role === "admin";

@@ -38,9 +36,7 @@ export const AiForm = () => {
 						</div>
 						<div className="flex flex-row gap-2">
 							{isOrgAdmin && <HandleAiProviders />}
-							{permissions?.ai.create && aiConfigs && aiConfigs?.length > 0 && (
-								<HandleAi />
-							)}
+							{aiConfigs && aiConfigs?.length > 0 && <HandleAi />}
 						</div>
 					</CardHeader>
 					<CardContent className="space-y-2 py-8 border-t">
@@ -57,7 +53,7 @@ export const AiForm = () => {
 										<span className="text-base text-muted-foreground text-center">
 											You don't have any AI configurations
 										</span>
-										{permissions?.ai.create && <HandleAi />}
+										<HandleAi />
 									</div>
 								) : (
 									<div className="flex flex-col gap-4 rounded-lg min-h-[25vh]">
@@ -74,37 +70,33 @@ export const AiForm = () => {
 														<CardDescription>{config.model}</CardDescription>
 													</div>
 													<div className="flex justify-between items-center">
-														{permissions?.ai.update && (
-															<HandleAi aiId={config.aiId} />
-														)}
-														{permissions?.ai.delete && (
-															<DialogAction
-																title="Delete AI"
-																description="Are you sure you want to delete this AI?"
-																type="destructive"
-																onClick={async () => {
-																	await mutateAsync({
-																		aiId: config.aiId,
+														<HandleAi aiId={config.aiId} />
+														<DialogAction
+															title="Delete AI"
+															description="Are you sure you want to delete this AI?"
+															type="destructive"
+															onClick={async () => {
+																await mutateAsync({
+																	aiId: config.aiId,
+																})
+																	.then(() => {
+																		toast.success("AI deleted successfully");
+																		refetch();
 																	})
-																		.then(() => {
-																			toast.success("AI deleted successfully");
-																			refetch();
-																		})
-																		.catch(() => {
-																			toast.error("Error deleting AI");
-																		});
-																}}
+																	.catch(() => {
+																		toast.error("Error deleting AI");
+																	});
+															}}
+														>
+															<Button
+																variant="ghost"
+																size="icon"
+																className="group hover:bg-red-500/10 "
+																isLoading={isRemoving}
 															>
-																<Button
-																	variant="ghost"
-																	size="icon"
-																	className="group hover:bg-red-500/10 "
-																	isLoading={isRemoving}
-																>
-																	<Trash2 className="size-4 text-primary group-hover:text-red-500" />
-																</Button>
-															</DialogAction>
-														)}
+																<Trash2 className="size-4 text-primary group-hover:text-red-500" />
+															</Button>
+														</DialogAction>
 													</div>
 												</div>
 											</div>
@@ -42,9 +42,9 @@ import { Tabs, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import { cn } from "@/lib/utils";
 import { api } from "@/utils/api";

-const stripePromise = process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY
-	? loadStripe(process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY)
-	: null;
+const stripePromise = loadStripe(
+	process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY!,
+);

 /** Precio legacy / Hobby: $4.50/mo primer servidor, $3.50 siguientes; anual $45.90 primero, $35.70 siguientes. */
 export const calculatePrice = (count: number, isAnnual = false) => {
@@ -105,65 +105,23 @@ export const ShowBilling = () => {
 		api.stripe.upgradeSubscription.useMutation();
 	const { mutateAsync: updateInvoiceNotifications } =
 		api.stripe.updateInvoiceNotifications.useMutation();
-	const { mutateAsync: startFreeTrial } =
+	const { mutateAsync: startFreeTrial, isPending: isStartingTrial } =
 		api.stripe.startFreeTrial.useMutation();
 	const utils = api.useUtils();
-	const [trialTier, setTrialTier] = useState<"hobby" | "startup" | null>(null);
-	const [switchingTrial, setSwitchingTrial] = useState(false);

-	const handleSwitchTrialPlan = async (
-		tier: "hobby" | "startup",
-		isAnnualPlan: boolean,
-		label?: string,
-	) => {
-		const planName =
-			label ??
-			`${tier === "startup" ? "Startup" : "Hobby"} ${isAnnualPlan ? "annual" : "monthly"}`;
-
-		const switchPlan = async () => {
-			await upgradeSubscription({
-				tier,
-				serverQuantity: tier === "startup" ? STARTUP_SERVERS_INCLUDED : 1,
-				isAnnual: isAnnualPlan,
-			});
-			await new Promise((resolve) => setTimeout(resolve, 3000));
-			await Promise.all([
-				utils.stripe.getBillingStatus.invalidate(),
-				utils.stripe.getProducts.invalidate(),
-				utils.user.get.invalidate(),
-				utils.server.count.invalidate(),
-			]);
-		};
-
-		setSwitchingTrial(true);
-		await toast
-			.promise(switchPlan(), {
-				loading: `Switching to ${planName}...`,
-				success: `Your trial is now on ${planName}`,
-				error: (error) =>
-					error instanceof Error ? error.message : "Error switching plan",
-			})
-			.unwrap()
-			.catch(() => undefined);
-		setSwitchingTrial(false);
-	};
-
-	const handleStartTrial = async (tier: "hobby" | "startup") => {
-		setTrialTier(tier);
+	const handleStartTrial = async () => {
 		try {
-			await startFreeTrial({ tier });
+			await startFreeTrial();
 			await Promise.all([
 				utils.stripe.getBillingStatus.invalidate(),
 				utils.stripe.getProducts.invalidate(),
 				utils.user.get.invalidate(),
 			]);
-			toast.success("Your 7-day trial has started");
+			toast.success("Your 14-day trial has started");
 		} catch (error) {
 			toast.error(
 				error instanceof Error ? error.message : "Error starting trial",
 			);
-		} finally {
-			setTrialTier(null);
 		}
 	};

@@ -212,23 +170,12 @@ export const ShowBilling = () => {

 	const useNewPricing = data?.hobbyProductId && data?.startupProductId;
 	const products = data?.products.filter((product) => {
-		// @ts-expect-error
+		// @ts-ignore
 		const interval = product?.default_price?.recurring?.interval;
 		return isAnnual ? interval === "year" : interval === "month";
 	});

 	const isEnterpriseCloud = admin?.user.isEnterpriseCloud ?? false;
-	const canStartTrial =
-		!isEnterpriseCloud &&
-		!!billingStatus &&
-		!billingStatus.plan &&
-		!billingStatus.isOnTrial &&
-		!billingStatus.hasUsedTrial;
-	/** Checkout would create a second subscription alongside a running trial. */
-	const canSubscribe =
-		!isEnterpriseCloud &&
-		(data?.subscriptions?.length ?? 0) === 0 &&
-		!billingStatus?.isOnTrial;
 	const maxServers = admin?.user.serversQuantity ?? 1;
 	const percentage = ((servers ?? 0) / maxServers) * 100;
 	const safePercentage = Math.min(percentage, 100);
@@ -342,11 +289,6 @@ export const ShowBilling = () => {
 													<Badge className="capitalize" variant="secondary">
 														{billingStatus.plan ?? "Trial"}
 													</Badge>
-													{billingStatus.plan && (
-														<Badge variant="outline">
-															{billingStatus.isAnnual ? "Annual" : "Monthly"}
-														</Badge>
-													)}
 												</div>
 												<span className="text-sm text-muted-foreground">
 													{billingStatus.isOnTrial
@@ -354,94 +296,67 @@ export const ShowBilling = () => {
 																billingStatus.trialEndsAt
 																	? ` · ends ${new Date(billingStatus.trialEndsAt).toLocaleDateString()}`
 																	: ""
-															}${
-																billingStatus.hasPaymentMethod
-																	? " · billing starts automatically"
-																	: " · add a card to keep your servers"
 															}`
 														: "You're subscribed and billed automatically."}
 												</span>
 											</div>
 										</div>
-										{admin?.user.stripeCustomerId && (
-											<div className="flex flex-wrap items-center gap-2">
-												{billingStatus.isOnTrial &&
-													useNewPricing &&
-													billingStatus.plan &&
-													billingStatus.plan !== "legacy" && (
-														<>
-															<Button
-																size="sm"
-																variant="outline"
-																isLoading={switchingTrial}
-																onClick={() =>
-																	handleSwitchTrialPlan(
-																		billingStatus.plan === "startup"
-																			? "hobby"
-																			: "startup",
-																		billingStatus.isAnnual,
-																	)
-																}
-															>
-																{billingStatus.plan === "startup"
-																	? "Switch to Hobby"
-																	: "Switch to Startup"}
-															</Button>
-															<Button
-																size="sm"
-																variant="outline"
-																isLoading={switchingTrial}
-																onClick={() =>
-																	handleSwitchTrialPlan(
-																		billingStatus.plan as "hobby" | "startup",
-																		!billingStatus.isAnnual,
-																		billingStatus.isAnnual
-																			? "monthly billing"
-																			: "annual billing",
-																	)
-																}
-															>
-																{billingStatus.isAnnual
-																	? "Switch to monthly"
-																	: "Switch to annual"}
-															</Button>
-														</>
-													)}
+										{billingStatus.isOnTrial &&
+											admin?.user.stripeCustomerId && (
 												<Button
 													size="sm"
-													variant={
-														billingStatus.isOnTrial &&
-														!billingStatus.hasPaymentMethod
-															? "default"
-															: "secondary"
-													}
+													variant="outline"
 													onClick={async () => {
 														const session = await createCustomerPortalSession();
 														window.open(session.url);
 													}}
 												>
-													{billingStatus.isOnTrial &&
-													!billingStatus.hasPaymentMethod
-														? "Add payment method"
-														: "Manage Subscription"}
+													Add payment method
 												</Button>
-											</div>
-										)}
+											)}
 									</div>
 								)}
-							{canStartTrial && (
-								<div className="flex items-center gap-3 rounded-xl border border-primary/30 bg-primary/5 p-4 max-w-2xl">
-									<Clock className="h-5 w-5 text-primary shrink-0" />
-									<div className="flex flex-col">
-										<span className="text-sm font-medium">
-											7-day free trial on any plan
-										</span>
-										<span className="text-sm text-muted-foreground">
-											No credit card required — pick Hobby or Startup below.
-										</span>
+							{!isEnterpriseCloud &&
+								billingStatus &&
+								!billingStatus.plan &&
+								!billingStatus.isOnTrial &&
+								!billingStatus.hasUsedTrial && (
+									<div className="flex flex-wrap items-center justify-between gap-4 rounded-xl border border-primary/30 bg-primary/5 p-4 max-w-2xl">
+										<div className="flex items-center gap-3">
+											<Clock className="h-5 w-5 text-primary shrink-0" />
+											<div className="flex flex-col gap-1.5">
+												<span className="text-sm font-medium">
+													14-day free trial
+												</span>
+												<span className="text-sm text-muted-foreground">
+													No credit card required — cancel anytime.
+												</span>
+												<ul className="flex flex-col gap-1 mt-1">
+													{[
+														"1 server included",
+														"Unlimited apps & databases",
+														"Community support",
+													].map((feature) => (
+														<li
+															key={feature}
+															className="flex items-center gap-2 text-sm text-muted-foreground"
+														>
+															<CheckIcon className="size-3.5 shrink-0" />
+															{feature}
+														</li>
+													))}
+												</ul>
+											</div>
+										</div>
+										<Button
+											size="sm"
+											isLoading={isStartingTrial}
+											onClick={handleStartTrial}
+										>
+											Start trial
+										</Button>
 									</div>
-								</div>
-							)}
+								)}
 							{(admin?.user.stripeSubscriptionId || isEnterpriseCloud) && (
 								<div className="space-y-2 flex flex-col">
 									<h3 className="text-lg font-medium">Servers Plan</h3>
@@ -1002,7 +917,7 @@ export const ShowBilling = () => {
 													"Unlimited Deployments",
 													"Unlimited Databases",
 													"Unlimited Applications",
-													"Setup 1 Server",
+													"1 Server Included",
 													"1 Organization",
 													"1 User",
 													"2 Environments",
@@ -1018,71 +933,68 @@ export const ShowBilling = () => {
 												))}
 											</ul>
 											<div className="mt-6 flex flex-col gap-3">
-												{canSubscribe && (
-													<div className="flex items-center gap-2">
-														<span className="text-sm text-muted-foreground">
-															Servers:
-														</span>
-														<Button
-															disabled={hobbyServerQuantity <= 1}
-															variant="outline"
-															size="icon"
-															onClick={() =>
-																setHobbyServerQuantity((q) =>
-																	Math.max(1, q - 1),
-																)
-															}
-														>
-															<MinusIcon className="h-4 w-4" />
-														</Button>
-														<NumberInput
-															value={hobbyServerQuantity}
-															onChange={(e) =>
-																setHobbyServerQuantity(
-																	Math.max(
-																		1,
-																		Number(
-																			(e.target as HTMLInputElement).value,
-																		) || 1,
-																	),
-																)
-															}
-															className="text-center"
-														/>
-														<Button
-															variant="outline"
-															size="icon"
-															onClick={() =>
-																setHobbyServerQuantity((q) => q + 1)
-															}
-														>
-															<PlusIcon className="h-4 w-4" />
-														</Button>
-													</div>
-												)}
+												<div className="flex items-center gap-2">
+													<span className="text-sm text-muted-foreground">
+														Servers:
+													</span>
+													<Button
+														disabled={hobbyServerQuantity <= 1}
+														variant="outline"
+														size="icon"
+														onClick={() =>
+															setHobbyServerQuantity((q) => Math.max(1, q - 1))
+														}
+													>
+														<MinusIcon className="h-4 w-4" />
+													</Button>
+													<NumberInput
+														value={hobbyServerQuantity}
+														onChange={(e) =>
+															setHobbyServerQuantity(
+																Math.max(
+																	1,
+																	Number(
+																		(e.target as HTMLInputElement).value,
+																	) || 1,
+																),
+															)
+														}
+														className="text-center"
+													/>
+													<Button
+														variant="outline"
+														size="icon"
+														onClick={() => setHobbyServerQuantity((q) => q + 1)}
+													>
+														<PlusIcon className="h-4 w-4" />
+													</Button>
+												</div>
 												<div className="flex flex-col gap-2 w-full">
-													{canStartTrial && (
+													{admin?.user.stripeCustomerId && (
 														<Button
+															variant="secondary"
 															className="w-full"
-															isLoading={trialTier === "hobby"}
-															disabled={trialTier !== null}
-															onClick={() => handleStartTrial("hobby")}
+															onClick={async () => {
+																const session =
+																	await createCustomerPortalSession();
+																window.open(session.url);
+															}}
 														>
-															Start 7-day free trial
-														</Button>
-													)}
-													{canSubscribe && (
-														<Button
-															className="w-full"
-															variant={canStartTrial ? "outline" : "default"}
-															onClick={() =>
-																handleCheckout("hobby", data!.hobbyProductId!)
-															}
-															disabled={hobbyServerQuantity < 1}
-														>
-															Get Started
+															Manage Subscription
 														</Button>
 													)}
+													{!isEnterpriseCloud &&
+														(data?.subscriptions?.length ?? 0) === 0 && (
+															<Button
+																className="w-full"
+																onClick={() =>
+																	handleCheckout("hobby", data!.hobbyProductId!)
+																}
+																disabled={hobbyServerQuantity < 1}
+															>
+																Get Started
+															</Button>
+														)}
 												</div>
 											</div>
 										</section>
@@ -1137,7 +1049,7 @@ export const ShowBilling = () => {
 													All the features of Hobby, plus…
 												</li>
 												{[
-													"Setup up to 3 Servers",
+													"3 Servers Included",
 													"3 Organizations",
 													"Unlimited Users",
 													"Unlimited Environments",
@@ -1155,83 +1067,85 @@ export const ShowBilling = () => {
 												))}
 											</ul>
 											<div className="mt-6 flex flex-col gap-3">
-												{canSubscribe && (
-													<div className="flex flex-col gap-2">
-														<span className="text-sm font-medium text-foreground">
-															Servers (min. {STARTUP_SERVERS_INCLUDED} included)
-														</span>
-														<div className="flex items-center gap-2">
-															<Button
-																disabled={
-																	startupServerQuantity <=
-																	STARTUP_SERVERS_INCLUDED
-																}
-																variant="outline"
-																size="icon"
-																className="h-8 w-8"
-																onClick={() =>
-																	setStartupServerQuantity((q) =>
-																		Math.max(STARTUP_SERVERS_INCLUDED, q - 1),
-																	)
-																}
-															>
-																<MinusIcon className="h-4 w-4" />
-															</Button>
-															<NumberInput
-																value={startupServerQuantity}
-																onChange={(e) =>
-																	setStartupServerQuantity(
-																		Math.max(
-																			STARTUP_SERVERS_INCLUDED,
-																			Number(
-																				(e.target as HTMLInputElement).value,
-																			) || STARTUP_SERVERS_INCLUDED,
-																		),
-																	)
-																}
-																className="h-8 text-center"
-															/>
-															<Button
-																variant="outline"
-																size="icon"
-																className="h-8 w-8"
-																onClick={() =>
-																	setStartupServerQuantity((q) => q + 1)
-																}
-															>
-																<PlusIcon className="h-4 w-4" />
-															</Button>
-														</div>
-													</div>
-												)}
-												<div className="flex flex-col gap-2 w-full">
-													{canStartTrial && (
+												<div className="flex flex-col gap-2">
+													<span className="text-sm font-medium text-foreground">
+														Servers (min. {STARTUP_SERVERS_INCLUDED} included)
+													</span>
+													<div className="flex items-center gap-2">
 														<Button
-															className="w-full"
-															isLoading={trialTier === "startup"}
-															disabled={trialTier !== null}
-															onClick={() => handleStartTrial("startup")}
-														>
-															Start 7-day free trial
-														</Button>
-													)}
-													{canSubscribe && (
-														<Button
-															className="w-full"
-															variant={canStartTrial ? "outline" : "default"}
+															disabled={
+																startupServerQuantity <=
+																STARTUP_SERVERS_INCLUDED
+															}
+															variant="outline"
+															size="icon"
+															className="h-8 w-8"
 															onClick={() =>
-																handleCheckout(
-																	"startup",
-																	data!.startupProductId!,
+																setStartupServerQuantity((q) =>
+																	Math.max(STARTUP_SERVERS_INCLUDED, q - 1),
 																)
 															}
-															disabled={
-																startupServerQuantity < STARTUP_SERVERS_INCLUDED
+														>
+															<MinusIcon className="h-4 w-4" />
+														</Button>
+														<NumberInput
+															value={startupServerQuantity}
+															onChange={(e) =>
+																setStartupServerQuantity(
+																	Math.max(
+																		STARTUP_SERVERS_INCLUDED,
+																		Number(
+																			(e.target as HTMLInputElement).value,
+																		) || STARTUP_SERVERS_INCLUDED,
+																	),
+																)
+															}
+															className="h-8 text-center"
+														/>
+														<Button
+															variant="outline"
+															size="icon"
+															className="h-8 w-8"
+															onClick={() =>
+																setStartupServerQuantity((q) => q + 1)
 															}
 														>
-															Get Started
+															<PlusIcon className="h-4 w-4" />
+														</Button>
+													</div>
+												</div>
+												<div className="flex flex-col gap-2 w-full">
+													{admin?.user.stripeCustomerId && (
+														<Button
+															variant="secondary"
+															className="w-full"
+															onClick={async () => {
+																const session =
+																	await createCustomerPortalSession();
+																window.open(session.url);
+															}}
+														>
+															Manage Subscription
 														</Button>
 													)}
+													{!isEnterpriseCloud &&
+														(data?.subscriptions?.length ?? 0) === 0 && (
+															<Button
+																className="w-full"
+																onClick={() =>
+																	handleCheckout(
+																		"startup",
+																		data!.startupProductId!,
+																	)
+																}
+																disabled={
+																	startupServerQuantity <
+																	STARTUP_SERVERS_INCLUDED
+																}
+															>
+																Get Started
+															</Button>
+														)}
 												</div>
 											</div>
 										</section>
@@ -1423,17 +1337,31 @@ export const ShowBilling = () => {
 															</Button>
 														</div>
 														<div className="flex flex-col gap-2 mt-4 w-full">
-															{canSubscribe && (
+															{admin?.user.stripeCustomerId && (
 																<Button
+																	variant="secondary"
 																	className="w-full"
 																	onClick={async () => {
-																		handleCheckout("legacy", product.id);
+																		const session =
+																			await createCustomerPortalSession();
+																		window.open(session.url);
 																	}}
-																	disabled={hobbyServerQuantity < 1}
 																>
-																	Subscribe
+																	Manage Subscription
 																</Button>
 															)}
+															{!isEnterpriseCloud &&
+																(data?.subscriptions?.length ?? 0) === 0 && (
+																	<Button
+																		className="w-full"
+																		onClick={async () => {
+																			handleCheckout("legacy", product.id);
+																		}}
+																		disabled={hobbyServerQuantity < 1}
+																	>
+																		Subscribe
+																	</Button>
+																)}
 														</div>
 													</div>
 												</section>
@@ -44,18 +44,6 @@ const providerLabels = {
 	cloudflare: "Cloudflare",
 	route53: "AWS Route53",
 	porkbun: "Porkbun",
-	infomaniak: "Infomaniak",
-	ovh: "OVHcloud",
-} as const;
-
-const ovhEndpointLabels = {
-	"ovh-eu": "OVHcloud Europe",
-	"ovh-ca": "OVHcloud Canada",
-	"ovh-us": "OVHcloud US",
-	"kimsufi-eu": "Kimsufi Europe",
-	"kimsufi-ca": "Kimsufi Canada",
-	"soyoustart-eu": "So you Start Europe",
-	"soyoustart-ca": "So you Start Canada",
 } as const;

 type ProviderType = keyof typeof providerLabels;
@@ -67,28 +55,12 @@ const DnsProviderSchema = z.object({
 		.regex(/^[a-zA-Z0-9_-]+$/, {
 			message: "Only letters, numbers, dashes and underscores",
 		}),
-	providerType: z.enum([
-		"cloudflare",
-		"route53",
-		"porkbun",
-		"infomaniak",
-		"ovh",
-	]),
+	providerType: z.enum(["cloudflare", "route53", "porkbun"]),
 	apiToken: z.string(),
 	accessKeyId: z.string(),
 	secretAccessKey: z.string(),
 	apiKey: z.string(),
 	secretApiKey: z.string(),
-	endpoint: z.enum(
-		Object.keys(ovhEndpointLabels) as [
-			keyof typeof ovhEndpointLabels,
-			...(keyof typeof ovhEndpointLabels)[],
-		],
-	),
-	applicationKey: z.string(),
-	applicationSecret: z.string(),
-	consumerKey: z.string(),
-	zone: z.string(),
 });

 type DnsProviderForm = z.infer<typeof DnsProviderSchema>;
@@ -101,11 +73,6 @@ const defaultValues: DnsProviderForm = {
 	secretAccessKey: "",
 	apiKey: "",
 	secretApiKey: "",
-	endpoint: "ovh-eu",
-	applicationKey: "",
-	applicationSecret: "",
-	consumerKey: "",
-	zone: "",
 };

 const buildConfig = (data: DnsProviderForm) => {
@@ -127,20 +94,6 @@ const buildConfig = (data: DnsProviderForm) => {
 				apiKey: data.apiKey,
 				secretApiKey: data.secretApiKey,
 			};
-		case "infomaniak":
-			return {
-				providerType: "infomaniak" as const,
-				apiToken: data.apiToken,
-			};
-		case "ovh":
-			return {
-				providerType: "ovh" as const,
-				endpoint: data.endpoint,
-				applicationKey: data.applicationKey,
-				applicationSecret: data.applicationSecret,
-				consumerKey: data.consumerKey,
-				zone: data.zone.trim() || undefined,
-			};
 	}
 };

@@ -202,16 +155,6 @@ export const HandleDnsProvider = ({ dnsProviderId }: Props) => {
 					apiKey: provider.config.apiKey,
 					secretApiKey: provider.config.secretApiKey,
 				}),
-				...(provider.config.providerType === "infomaniak" && {
-					apiToken: provider.config.apiToken,
-				}),
-				...(provider.config.providerType === "ovh" && {
-					endpoint: provider.config.endpoint,
-					applicationKey: provider.config.applicationKey,
-					applicationSecret: provider.config.applicationSecret,
-					consumerKey: provider.config.consumerKey,
-					zone: provider.config.zone ?? "",
-				}),
 			});
 		} else if (!dnsProviderId) {
 			form.reset(defaultValues);
@@ -440,139 +383,6 @@ export const HandleDnsProvider = ({ dnsProviderId }: Props) => {
 							</>
 						)}

-						{providerType === "infomaniak" && (
-							<FormField
-								control={form.control}
-								name="apiToken"
-								render={({ field }) => (
-									<FormItem>
-										<FormLabel>API Token</FormLabel>
-										<FormControl>
-											<Input type="password" {...field} />
-										</FormControl>
-										<FormDescription>
-											Create a token at manager.infomaniak.com with the{" "}
-											<code>domain:read</code>, <code>dns:read</code> and{" "}
-											<code>dns:write</code> scopes.
-										</FormDescription>
-										<FormMessage />
-									</FormItem>
-								)}
-							/>
-						)}
-
-						{providerType === "ovh" && (
-							<>
-								<FormField
-									control={form.control}
-									name="endpoint"
-									render={({ field }) => (
-										<FormItem>
-											<FormLabel>API Endpoint</FormLabel>
-											<Select
-												onValueChange={field.onChange}
-												value={field.value}
-											>
-												<FormControl>
-													<SelectTrigger>
-														<SelectValue placeholder="Select an endpoint" />
-													</SelectTrigger>
-												</FormControl>
-												<SelectContent>
-													{Object.entries(ovhEndpointLabels).map(
-														([value, label]) => (
-															<SelectItem key={value} value={value}>
-																{label}
-															</SelectItem>
-														),
-													)}
-												</SelectContent>
-											</Select>
-											<FormMessage />
-										</FormItem>
-									)}
-								/>
-								<FormField
-									control={form.control}
-									name="applicationKey"
-									render={({ field }) => (
-										<FormItem>
-											<FormLabel>Application Key</FormLabel>
-											<FormControl>
-												<Input {...field} />
-											</FormControl>
-											<FormMessage />
-										</FormItem>
-									)}
-								/>
-								<FormField
-									control={form.control}
-									name="applicationSecret"
-									render={({ field }) => (
-										<FormItem>
-											<FormLabel>Application Secret</FormLabel>
-											<FormControl>
-												<Input type="password" {...field} />
-											</FormControl>
-											<FormMessage />
-										</FormItem>
-									)}
-								/>
-								<FormField
-									control={form.control}
-									name="consumerKey"
-									render={({ field }) => (
-										<FormItem>
-											<FormLabel>Consumer Key</FormLabel>
-											<FormControl>
-												<Input type="password" {...field} />
-											</FormControl>
-											<FormDescription>
-												Create the three keys at once on
-												api.ovh.com/createToken, with exactly these five rights:
-												<br />
-												<code>GET /domain/zone</code>
-												<br />
-												<code>GET /domain/zone/*</code>
-												<br />
-												<code>POST /domain/zone/*</code>
-												<br />
-												<code>PUT /domain/zone/*</code>
-												<br />
-												<code>DELETE /domain/zone/*</code>
-												<br />
-												The first one lists your zones and has to be granted on
-												its own: OVH matches rights per exact path, so{" "}
-												<code>/domain/zone/*</code> does not cover it.
-											</FormDescription>
-											<FormMessage />
-										</FormItem>
-									)}
-								/>
-								<FormField
-									control={form.control}
-									name="zone"
-									render={({ field }) => (
-										<FormItem>
-											<FormLabel>Zone (optional)</FormLabel>
-											<FormControl>
-												<Input placeholder="example.com" {...field} />
-											</FormControl>
-											<FormDescription>
-												Restrict this provider to a single DNS zone: Dokploy
-												will only list and change records in it. Leave empty to
-												use every zone the credentials can access. When set, the{" "}
-												<code>GET /domain/zone</code> right is not needed. This
-												is enforced by Dokploy only, so also limit the OVH token
-												to that zone if you need a hard guarantee.
-											</FormDescription>
-											<FormMessage />
-										</FormItem>
-									)}
-								/>
-							</>
-						)}
-
 						<DialogFooter className="flex w-full flex-row justify-between gap-2 sm:justify-between">
 							<Button
 								type="button"
@@ -23,9 +23,6 @@ import { HandleDnsProvider } from "./handle-dns-provider";
 const providerLabels: Record<string, string> = {
 	cloudflare: "Cloudflare",
 	route53: "AWS Route53",
-	porkbun: "Porkbun",
-	infomaniak: "Infomaniak",
-	ovh: "OVHcloud",
 };

 export const ShowDnsProviders = () => {
@@ -148,7 +148,6 @@ export const HandleAi = ({ aiId }: Props) => {
 		{
 			apiUrl: apiUrl ?? "",
 			apiKey: apiKey ?? "",
-			...(aiId ? { aiId } : {}),
 		},
 		{
 			enabled: !!apiUrl && (isLocalOllama || !!apiKey),
@@ -483,7 +482,6 @@ export const HandleAi = ({ aiId }: Props) => {
 								apiUrl={apiUrl}
 								apiKey={apiKey}
 								model={form.watch("model")}
-								aiId={aiId}
 							/>
 							<Button type="submit" isLoading={isPending}>
 								{aiId ? "Update" : "Create"}
@@ -500,12 +498,10 @@ function TestConnectionButton({
 	apiUrl,
 	apiKey,
 	model,
-	aiId,
 }: {
 	apiUrl: string;
 	apiKey: string;
 	model: string;
-	aiId?: string;
 }) {
 	const { mutate, isPending } = api.ai.testConnection.useMutation({
 		onSuccess: () => {
@@ -525,9 +521,7 @@ function TestConnectionButton({
 			type="button"
 			variant="outline"
 			disabled={isDisabled || isPending}
-			onClick={() =>
-				mutate({ apiUrl, apiKey, model, ...(aiId ? { aiId } : {}) })
-			}
+			onClick={() => mutate({ apiUrl, apiKey, model })}
 		>
 			{isPending ? (
 				<Loader2 className="mr-2 h-4 w-4 animate-spin" />
@@ -1,575 +0,0 @@
-import type {
-	TelemetryProviderType,
-	TelemetrySignal,
-} from "@dokploy/server/services/logs-and-metrics/types";
-import { standardSchemaResolver as zodResolver } from "@hookform/resolvers/standard-schema";
-import { PenBoxIcon, PlusIcon } from "lucide-react";
-import { useEffect, useState } from "react";
-import { useForm } from "react-hook-form";
-import { toast } from "sonner";
-import { z } from "zod";
-import { telemetryProviderIcons } from "@/components/icons/telemetry-provider-icons";
-import { AlertBlock } from "@/components/shared/alert-block";
-import { Button } from "@/components/ui/button";
-import {
-	Dialog,
-	DialogContent,
-	DialogDescription,
-	DialogFooter,
-	DialogHeader,
-	DialogTitle,
-	DialogTrigger,
-} from "@/components/ui/dialog";
-import {
-	Form,
-	FormControl,
-	FormDescription,
-	FormField,
-	FormItem,
-	FormLabel,
-	FormMessage,
-} from "@/components/ui/form";
-import { Input } from "@/components/ui/input";
-import {
-	Select,
-	SelectContent,
-	SelectItem,
-	SelectTrigger,
-	SelectValue,
-} from "@/components/ui/select";
-import { Switch } from "@/components/ui/switch";
-import { api } from "@/utils/api";
-
-const TOP_LEVEL_KEYS = new Set(["endpoint", "apiKey", "apiSecret"]);
-
-const SIGNAL_OPTIONS: Array<{
-	value: string;
-	label: string;
-	signals: TelemetrySignal[];
-}> = [
-	{ value: "logs", label: "Logs", signals: ["logs"] },
-	{ value: "metrics", label: "Metrics", signals: ["metrics"] },
-	{
-		value: "logs,metrics",
-		label: "Logs & Metrics",
-		signals: ["logs", "metrics"],
-	},
-];
-
-const providerForm = z.object({
-	name: z.string().min(1, "Name is required"),
-	providerType: z.string().min(1, "Provider is required"),
-	signals: z.string().min(1, "Select what this provider sends"),
-	enabled: z.boolean(),
-	fields: z.record(z.string(), z.string().optional()),
-});
-
-type ProviderForm = z.infer<typeof providerForm>;
-
-const toSignals = (value: string) =>
-	SIGNAL_OPTIONS.find((option) => option.value === value)?.signals ?? [];
-
-interface Props {
-	telemetryProviderId?: string;
-}
-
-export const agentsUsingProvider = (
-	targets:
-		| Array<{
-				name: string;
-				telemetryProviderIds: string[];
-		  }>
-		| undefined,
-	telemetryProviderId: string,
-) =>
-	(targets ?? [])
-		.filter((target) =>
-			target.telemetryProviderIds.includes(telemetryProviderId),
-		)
-		.map((target) => target.name)
-		.join(", ");
-
-export const HandleTelemetryProvider = ({ telemetryProviderId }: Props) => {
-	const utils = api.useUtils();
-	const [isOpen, setIsOpen] = useState(false);
-	const [initialFields, setInitialFields] = useState<Record<string, string>>(
-		{},
-	);
-	const [clearedKeys, setClearedKeys] = useState<Record<string, boolean>>({});
-
-	const { data: availableTypes } =
-		api.telemetryProvider.availableTypes.useQuery();
-	const { data: provider } = api.telemetryProvider.one.useQuery(
-		{ telemetryProviderId: telemetryProviderId || "" },
-		{ enabled: !!telemetryProviderId, refetchOnWindowFocus: false },
-	);
-
-	const createMutation = api.telemetryProvider.create.useMutation();
-	const updateMutation = api.telemetryProvider.update.useMutation();
-	const {
-		isPending: isSaving,
-		error,
-		isError,
-	} = telemetryProviderId ? updateMutation : createMutation;
-	const {
-		mutateAsync: testConnection,
-		isPending: isTestingRaw,
-		error: testError,
-		isError: testIsError,
-	} = api.telemetryProvider.testConnection.useMutation();
-	const {
-		mutateAsync: testConnectionById,
-		isPending: isTestingById,
-		error: testByIdError,
-		isError: testByIdIsError,
-	} = api.telemetryProvider.testConnectionById.useMutation();
-
-	const form = useForm<ProviderForm>({
-		defaultValues: {
-			name: "",
-			providerType: "",
-			signals: "",
-			enabled: true,
-			fields: {},
-		},
-		resolver: zodResolver(providerForm),
-	});
-
-	const providerType = form.watch("providerType");
-	const signalsValue = form.watch("signals");
-	const fieldValues = form.watch("fields");
-	const signals = toSignals(signalsValue);
-
-	const selectedType = availableTypes?.find((t) => t.type === providerType);
-	const signalOptions = SIGNAL_OPTIONS.filter((option) =>
-		option.signals.every((s) => selectedType?.signals.includes(s)),
-	);
-	const visibleFields = (selectedType?.credentialFields ?? []).filter(
-		(field) => !field.signal || signals.includes(field.signal),
-	);
-
-	useEffect(() => {
-		if (provider) {
-			const extraConfig = (provider.extraConfig ?? {}) as Record<
-				string,
-				string
-			>;
-			form.reset({
-				name: provider.name,
-				providerType: provider.providerType,
-				signals: provider.signals.join(","),
-				enabled: provider.enabled,
-				fields: extraConfig,
-			});
-			setInitialFields(extraConfig);
-		} else {
-			form.reset();
-			setInitialFields({});
-		}
-		setClearedKeys({});
-	}, [form, provider, isOpen]);
-
-	const buildPayload = () => {
-		const payload: {
-			name: string;
-			providerType: TelemetryProviderType;
-			signals: TelemetrySignal[];
-			enabled: boolean;
-			endpoint?: string | null;
-			apiKey?: string | null;
-			apiSecret?: string | null;
-			extraConfig?: Record<string, string>;
-		} = {
-			name: form.getValues("name"),
-			providerType: providerType as TelemetryProviderType,
-			signals,
-			enabled: form.getValues("enabled"),
-		};
-		const extraConfig: Record<string, string> = {};
-		let hasExtraConfigFields = false;
-		for (const field of visibleFields) {
-			const value = fieldValues[field.key] ?? "";
-			if (
-				field.key === "endpoint" ||
-				field.key === "apiKey" ||
-				field.key === "apiSecret"
-			) {
-				if (value) {
-					payload[field.key] = value;
-				} else if (clearedKeys[field.key]) {
-					payload[field.key] = null;
-				}
-			} else {
-				hasExtraConfigFields = true;
-				extraConfig[field.key] = value;
-			}
-		}
-		if (hasExtraConfigFields) {
-			payload.extraConfig = extraConfig;
-		}
-		return payload;
-	};
-
-	// Required fields are per type and signal, so zod can't know them up front.
-	const validateRequiredFields = () => {
-		let valid = true;
-		for (const field of visibleFields) {
-			const value = fieldValues[field.key] ?? "";
-			const keepsStored =
-				!!telemetryProviderId &&
-				TOP_LEVEL_KEYS.has(field.key) &&
-				!clearedKeys[field.key];
-			if (field.required && !value && !keepsStored) {
-				form.setError(`fields.${field.key}`, {
-					message: `${field.label} is required`,
-				});
-				valid = false;
-			}
-		}
-		return valid;
-	};
-
-	const topLevelKeys = visibleFields
-		.filter((field) => TOP_LEVEL_KEYS.has(field.key))
-		.map((field) => field.key);
-	const touchedTopLevelKeys = topLevelKeys.filter(
-		(key) => !!fieldValues[key] || clearedKeys[key],
-	);
-	const touchedExtraConfigKeys = visibleFields
-		.filter((field) => !TOP_LEVEL_KEYS.has(field.key))
-		.map((field) => field.key)
-		.filter((key) => (fieldValues[key] ?? "") !== (initialFields[key] ?? ""));
-	const touchedAnyCredentialField =
-		touchedTopLevelKeys.length > 0 || touchedExtraConfigKeys.length > 0;
-	const isPartiallyTouched =
-		!!telemetryProviderId &&
-		touchedAnyCredentialField &&
-		touchedTopLevelKeys.length < topLevelKeys.length;
-	const signalsChanged =
-		!!provider && signalsValue !== provider.signals.join(",");
-
-	const showTestResult = (result: { warning?: string }) => {
-		if (result.warning) {
-			toast.message(result.warning);
-		} else {
-			toast.success("Connection tested successfully");
-		}
-	};
-
-	const onTest = async () => {
-		if (!(await form.trigger(["providerType", "signals"]))) return;
-		if (telemetryProviderId && !touchedAnyCredentialField) {
-			await testConnectionById({
-				telemetryProviderId,
-				...(signalsChanged ? { signals } : {}),
-			})
-				.then(showTestResult)
-				.catch((e) => {
-					toast.error(
-						e instanceof Error ? e.message : "Connection test failed",
-					);
-				});
-			return;
-		}
-		if (!validateRequiredFields()) return;
-		await testConnection(buildPayload())
-			.then(showTestResult)
-			.catch((e) => {
-				toast.error(e instanceof Error ? e.message : "Connection test failed");
-			});
-	};
-
-	const onSubmit = async () => {
-		if (!validateRequiredFields()) return;
-		const payload = buildPayload();
-		let warning: string | undefined;
-		let reapplied = false;
-		try {
-			if (telemetryProviderId) {
-				const result = await updateMutation.mutateAsync({
-					telemetryProviderId,
-					...payload,
-				});
-				warning = result.warning;
-				reapplied = result.reapplied;
-			} else {
-				await createMutation.mutateAsync(payload);
-			}
-		} catch {
-			toast.error(
-				telemetryProviderId
-					? "Error updating provider"
-					: "Error adding provider",
-			);
-			return;
-		}
-		utils.telemetryProvider.all.invalidate();
-		utils.telemetryProvider.serverStatus.invalidate();
-		if (telemetryProviderId) {
-			utils.telemetryProvider.one.invalidate({ telemetryProviderId });
-		}
-		const agents =
-			telemetryProviderId &&
-			agentsUsingProvider(
-				utils.telemetryProvider.serverStatus.getData(),
-				telemetryProviderId,
-			);
-		if (warning) {
-			toast.warning("Provider updated", { description: warning });
-		} else {
-			toast.success(
-				telemetryProviderId ? "Provider updated" : "Provider added",
-				reapplied && agents
-					? { description: `The Vector agent on ${agents} was re-applied.` }
-					: undefined,
-			);
-		}
-		setIsOpen(false);
-	};
-
-	const isTesting = isTestingRaw || isTestingById;
-
-	return (
-		<Dialog open={isOpen} onOpenChange={setIsOpen}>
-			<DialogTrigger asChild>
-				{telemetryProviderId ? (
-					<Button
-						variant="ghost"
-						size="icon"
-						className="group hover:bg-blue-500/10 "
-					>
-						<PenBoxIcon className="size-3.5  text-primary group-hover:text-blue-500" />
-					</Button>
-				) : (
-					<Button className="cursor-pointer space-x-3">
-						<PlusIcon className="h-4 w-4" />
-						Add provider
-					</Button>
-				)}
-			</DialogTrigger>
-			<DialogContent className="sm:max-w-lg max-h-[85vh] overflow-y-auto">
-				<DialogHeader>
-					<DialogTitle>
-						{telemetryProviderId ? "Edit provider" : "Add a provider"}
-					</DialogTitle>
-					<DialogDescription>
-						Vector ships container logs and host/container metrics from every
-						server you deploy it on to this provider.
-					</DialogDescription>
-				</DialogHeader>
-				{(isError || testIsError || testByIdIsError) && (
-					<AlertBlock type="error" className="w-full">
-						{testError?.message || testByIdError?.message || error?.message}
-					</AlertBlock>
-				)}
-
-				<Form {...form}>
-					<form
-						id="hook-form-telemetry-provider"
-						onSubmit={form.handleSubmit(onSubmit)}
-						className="grid w-full gap-4"
-					>
-						<FormField
-							control={form.control}
-							name="name"
-							render={({ field }) => (
-								<FormItem>
-									<FormLabel>Name</FormLabel>
-									<FormControl>
-										<Input placeholder="e.g. Production Loki" {...field} />
-									</FormControl>
-									<FormMessage />
-								</FormItem>
-							)}
-						/>
-						<FormField
-							control={form.control}
-							name="providerType"
-							render={({ field }) => (
-								<FormItem>
-									<FormLabel>Provider</FormLabel>
-									<Select
-										value={field.value}
-										onValueChange={(value) => {
-											field.onChange(value);
-											form.setValue("signals", "");
-											form.setValue("fields", {});
-											form.clearErrors();
-										}}
-										disabled={!!telemetryProviderId}
-									>
-										<FormControl>
-											<SelectTrigger>
-												<SelectValue placeholder="Select a provider" />
-											</SelectTrigger>
-										</FormControl>
-										<SelectContent>
-											{availableTypes?.map((type) => {
-												const ProviderIcon =
-													telemetryProviderIcons[
-														type.type as keyof typeof telemetryProviderIcons
-													];
-												return (
-													<SelectItem key={type.type} value={type.type}>
-														<div className="flex flex-row items-center gap-2">
-															{ProviderIcon && (
-																<ProviderIcon className="size-4 shrink-0" />
-															)}
-															{type.label}
-														</div>
-													</SelectItem>
-												);
-											})}
-										</SelectContent>
-									</Select>
-									<FormMessage />
-								</FormItem>
-							)}
-						/>
-
-						{selectedType && (
-							<FormField
-								control={form.control}
-								name="signals"
-								render={({ field }) => (
-									<FormItem>
-										<FormLabel>Sends</FormLabel>
-										<Select value={field.value} onValueChange={field.onChange}>
-											<FormControl>
-												<SelectTrigger>
-													<SelectValue placeholder="Select what this provider sends" />
-												</SelectTrigger>
-											</FormControl>
-											<SelectContent>
-												{signalOptions.map((option) => (
-													<SelectItem key={option.value} value={option.value}>
-														{option.label}
-													</SelectItem>
-												))}
-											</SelectContent>
-										</Select>
-										<FormMessage />
-									</FormItem>
-								)}
-							/>
-						)}
-
-						{visibleFields.map((credentialField) => (
-							<FormField
-								key={credentialField.key}
-								control={form.control}
-								name={`fields.${credentialField.key}`}
-								render={({ field }) => (
-									<FormItem>
-										<FormLabel>
-											{credentialField.label}
-											{!credentialField.required && " (Optional)"}
-										</FormLabel>
-										{credentialField.helpText && (
-											<FormDescription>
-												{credentialField.helpText}
-											</FormDescription>
-										)}
-										<div className="flex flex-row gap-2">
-											<FormControl>
-												<Input
-													type={
-														credentialField.type === "password"
-															? "password"
-															: "text"
-													}
-													disabled={!!clearedKeys[credentialField.key]}
-													placeholder={
-														clearedKeys[credentialField.key]
-															? "Will be cleared on update"
-															: telemetryProviderId &&
-																	TOP_LEVEL_KEYS.has(credentialField.key)
-																? "Leave blank to keep existing"
-																: credentialField.placeholder
-													}
-													autoComplete={
-														credentialField.type === "password"
-															? "new-password"
-															: "off"
-													}
-													{...field}
-													value={field.value ?? ""}
-												/>
-											</FormControl>
-											{telemetryProviderId &&
-												TOP_LEVEL_KEYS.has(credentialField.key) &&
-												!credentialField.required && (
-													<Button
-														type="button"
-														variant="outline"
-														onClick={() => {
-															setClearedKeys((prev) => ({
-																...prev,
-																[credentialField.key]:
-																	!prev[credentialField.key],
-															}));
-															field.onChange("");
-														}}
-													>
-														{clearedKeys[credentialField.key]
-															? "Keep"
-															: "Clear"}
-													</Button>
-												)}
-										</div>
-										<FormMessage />
-									</FormItem>
-								)}
-							/>
-						))}
-
-						<FormField
-							control={form.control}
-							name="enabled"
-							render={({ field }) => (
-								<FormItem className="flex flex-row items-center gap-2 space-y-0">
-									<FormControl>
-										<Switch
-											checked={field.value}
-											onCheckedChange={field.onChange}
-										/>
-									</FormControl>
-									<FormLabel>Enabled</FormLabel>
-								</FormItem>
-							)}
-						/>
-					</form>
-				</Form>
-
-				<DialogFooter className="flex flex-col w-full sm:justify-between gap-4 flex-wrap sm:flex-col">
-					{isPartiallyTouched && (
-						<span className="text-xs text-muted-foreground">
-							You changed something that needs a fresh credential to test — fill
-							in every credential field to test with the new values, or revert
-							it to test with what's already saved.
-						</span>
-					)}
-					<div className="flex flex-row gap-2 justify-between">
-						<Button
-							type="button"
-							variant="secondary"
-							isLoading={isTesting}
-							disabled={!providerType || isPartiallyTouched}
-							onClick={onTest}
-						>
-							Test connection
-						</Button>
-						<Button
-							type="submit"
-							form="hook-form-telemetry-provider"
-							isLoading={isSaving}
-							disabled={isSaving}
-						>
-							{telemetryProviderId ? "Update" : "Create"}
-						</Button>
-					</div>
-				</DialogFooter>
-			</DialogContent>
-		</Dialog>
-	);
-};
@@ -1,361 +0,0 @@
-import { Copy, Loader2, Server } from "lucide-react";
-import { useState } from "react";
-import { toast } from "sonner";
-import { telemetryProviderIcons } from "@/components/icons/telemetry-provider-icons";
-import { AlertBlock } from "@/components/shared/alert-block";
-import { DialogAction } from "@/components/shared/dialog-action";
-import { Badge } from "@/components/ui/badge";
-import { Button } from "@/components/ui/button";
-import {
-	Card,
-	CardContent,
-	CardDescription,
-	CardHeader,
-	CardTitle,
-} from "@/components/ui/card";
-import { Checkbox } from "@/components/ui/checkbox";
-import { Label } from "@/components/ui/label";
-import { api } from "@/utils/api";
-
-type Status = "running" | "not-running" | "stopped" | "unknown";
-
-const statusBadge = (status: Status) => {
-	if (status === "running") {
-		return <Badge variant="green">Running</Badge>;
-	}
-	if (status === "not-running") {
-		return <Badge variant="yellow">Not running</Badge>;
-	}
-	if (status === "stopped") {
-		return <Badge variant="secondary">Not deployed</Badge>;
-	}
-	return <Badge variant="destructive">Unreachable</Badge>;
-};
-
-export const providerLabel = (provider: { name: string; signals: string[] }) =>
-	`${provider.name} (${provider.signals.length === 2 ? "logs and metrics" : provider.signals[0]})`;
-
-export const ShowServers = () => {
-	const utils = api.useUtils();
-	const [selection, setSelection] = useState<Record<string, string[]>>({});
-	const [pendingTarget, setPendingTarget] = useState<string | null>(null);
-	const [errors, setErrors] = useState<
-		Record<string, { title: string; message: string }>
-	>({});
-
-	const { data: providers } = api.telemetryProvider.all.useQuery();
-	const { data: targets, isPending } =
-		api.telemetryProvider.serverStatus.useQuery(undefined, {
-			refetchOnWindowFocus: false,
-			staleTime: 30_000,
-			trpc: { context: { skipBatch: true } },
-		});
-
-	const { mutateAsync: deployOnServer } =
-		api.telemetryProvider.deployOnServer.useMutation();
-	const { mutateAsync: removeOnServer } =
-		api.telemetryProvider.removeOnServer.useMutation();
-
-	const keyOf = (serverId: string | null) => serverId ?? "local";
-
-	// The selection can still hold providers deleted since it was made.
-	const idsFor = (serverId: string | null, saved: string[]) => {
-		const ids = selection[keyOf(serverId)] ?? saved;
-		return providers
-			? ids.filter((id) => providers.some((p) => p.telemetryProviderId === id))
-			: ids;
-	};
-
-	const toggleProvider = (
-		serverId: string | null,
-		saved: string[],
-		telemetryProviderId: string,
-	) => {
-		const key = keyOf(serverId);
-		const current = idsFor(serverId, saved);
-		setSelection({
-			...selection,
-			[key]: current.includes(telemetryProviderId)
-				? current.filter((id) => id !== telemetryProviderId)
-				: [...current, telemetryProviderId],
-		});
-	};
-
-	const setError = (
-		serverId: string | null,
-		error?: { title: string; message: string },
-	) =>
-		setErrors((prev) => {
-			const next = { ...prev };
-			if (error) {
-				next[keyOf(serverId)] = error;
-			} else {
-				delete next[keyOf(serverId)];
-			}
-			return next;
-		});
-
-	// The task is still starting right after a deploy, so look again once it had time to come up.
-	const refreshStatus = () => {
-		utils.telemetryProvider.serverStatus.invalidate();
-		setTimeout(() => utils.telemetryProvider.serverStatus.invalidate(), 8_000);
-	};
-
-	const handleDeploy = async (serverId: string | null, ids: string[]) => {
-		setPendingTarget(keyOf(serverId));
-		setError(serverId);
-		await deployOnServer({ serverId, providerIds: ids })
-			.then(() => {
-				toast.success("Vector agent deployed");
-				refreshStatus();
-			})
-			.catch((error) => {
-				setError(serverId, {
-					title: "Deploy failed",
-					message:
-						error instanceof Error
-							? error.message
-							: "Failed to deploy the agent",
-				});
-				refreshStatus();
-			})
-			.finally(() => setPendingTarget(null));
-	};
-
-	const handleRemove = async (serverId: string | null) => {
-		setPendingTarget(keyOf(serverId));
-		setError(serverId);
-		await removeOnServer({ serverId })
-			.then(() => {
-				toast.success("Vector agent removed");
-				setSelection((prev) => ({ ...prev, [keyOf(serverId)]: [] }));
-				refreshStatus();
-			})
-			.catch((error) => {
-				setError(serverId, {
-					title: "Remove failed",
-					message:
-						error instanceof Error
-							? error.message
-							: "Failed to remove the agent",
-				});
-				refreshStatus();
-			})
-			.finally(() => setPendingTarget(null));
-	};
-
-	const hasProviders = (providers?.length ?? 0) > 0;
-	const visibleTargets = hasProviders
-		? targets
-		: targets?.filter(
-				(target) =>
-					target.telemetryProviderIds.length > 0 ||
-					target.status === "running" ||
-					target.status === "not-running",
-			);
-
-	return (
-		<div className="w-full">
-			<Card className="h-full bg-sidebar p-2.5 rounded-xl max-w-5xl mx-auto">
-				<div className="rounded-xl bg-background shadow-md">
-					<CardHeader>
-						<CardTitle className="text-xl flex flex-row gap-2">
-							<Server className="size-6 text-muted-foreground self-center" />
-							Servers
-						</CardTitle>
-						<CardDescription>
-							Pick which providers each server ships to, then deploy its Vector
-							agent; a provider receives every signal it sends, and cAdvisor
-							runs next to the agent on 127.0.0.1:4510 when metrics are shipped.
-							Services deployed before Logs & Metrics need a redeploy to get the
-							labels it uses; until then their logs and container metrics are
-							not shipped from the Dokploy server.
-						</CardDescription>
-					</CardHeader>
-					<CardContent className="space-y-2 py-8 border-t">
-						{isPending ? (
-							<div className="flex flex-row gap-2 items-center justify-center text-sm text-muted-foreground min-h-[15vh]">
-								<span>Checking servers...</span>
-								<Loader2 className="animate-spin size-4" />
-							</div>
-						) : !hasProviders && !visibleTargets?.length ? (
-							<div className="flex flex-col items-center gap-3 min-h-[15vh] justify-center">
-								<Server className="size-8 self-center text-muted-foreground" />
-								<span className="text-base text-muted-foreground text-center">
-									Add a provider first — there's nowhere to ship to yet
-								</span>
-							</div>
-						) : (
-							<div className="flex flex-col gap-4">
-								{visibleTargets?.map((target) => {
-									const key = keyOf(target.serverId);
-									const saved = target.telemetryProviderIds;
-									const ids = idsFor(target.serverId, saved);
-									const isBusy = pendingTarget === key;
-									const agentDeployed = target.status !== "stopped";
-									const hasEnabledSelected = ids.some(
-										(id) =>
-											providers?.find((p) => p.telemetryProviderId === id)
-												?.enabled,
-									);
-
-									return (
-										<div
-											key={key}
-											className="flex flex-col gap-3 rounded-lg border p-4"
-										>
-											<div className="flex items-center justify-between">
-												<div className="flex flex-col">
-													<span className="text-sm font-medium">
-														{target.name}
-													</span>
-													{target.ipAddress && (
-														<span className="text-xs text-muted-foreground">
-															{target.ipAddress}
-														</span>
-													)}
-												</div>
-												<div className="flex items-center gap-2">
-													{statusBadge(target.status as Status)}
-													{agentDeployed && (
-														<DialogAction
-															title="Remove the Vector agent"
-															description="This server stops shipping logs and metrics until you deploy it again. Continue?"
-															type="destructive"
-															onClick={() => handleRemove(target.serverId)}
-														>
-															<Button
-																variant="ghost"
-																size="sm"
-																isLoading={isBusy}
-															>
-																Remove
-															</Button>
-														</DialogAction>
-													)}
-												</div>
-											</div>
-
-											<div className="flex flex-col gap-2">
-												{hasProviders && (
-													<span className="text-xs font-medium">Providers</span>
-												)}
-												<div className="flex flex-col gap-2">
-													{providers?.map((provider) => {
-														const ProviderIcon =
-															telemetryProviderIcons[
-																provider.providerType as keyof typeof telemetryProviderIcons
-															];
-														return (
-															<div
-																key={provider.telemetryProviderId}
-																className={`flex flex-row items-center gap-2 text-sm ${
-																	provider.enabled ? "" : "opacity-60"
-																}`}
-															>
-																<Checkbox
-																	id={`${key}-${provider.telemetryProviderId}`}
-																	disabled={
-																		!provider.enabled &&
-																		!ids.includes(provider.telemetryProviderId)
-																	}
-																	checked={ids.includes(
-																		provider.telemetryProviderId,
-																	)}
-																	onCheckedChange={() =>
-																		toggleProvider(
-																			target.serverId,
-																			saved,
-																			provider.telemetryProviderId,
-																		)
-																	}
-																/>
-																{ProviderIcon && (
-																	<ProviderIcon className="size-4 shrink-0" />
-																)}
-																<Label
-																	htmlFor={`${key}-${provider.telemetryProviderId}`}
-																	className={`font-normal ${
-																		provider.enabled
-																			? "cursor-pointer"
-																			: "cursor-not-allowed"
-																	}`}
-																>
-																	{providerLabel(provider)}
-																</Label>
-																{!provider.enabled && (
-																	<Badge variant="secondary">Disabled</Badge>
-																)}
-															</div>
-														);
-													})}
-												</div>
-											</div>
-
-											{errors[key] && (
-												<AlertBlock type="error" className="items-start">
-													<div className="flex w-full flex-col gap-2">
-														<span className="font-medium">
-															{errors[key].title}
-														</span>
-														<pre className="max-h-48 overflow-auto whitespace-pre-wrap break-all rounded-md bg-background/50 p-2 font-mono text-xs">
-															{errors[key].message}
-														</pre>
-														<Button
-															variant="ghost"
-															size="sm"
-															className="w-fit"
-															onClick={() => {
-																navigator.clipboard.writeText(
-																	errors[key]?.message ?? "",
-																);
-																toast.success("Error copied");
-															}}
-														>
-															<Copy className="size-3.5" />
-															Copy
-														</Button>
-													</div>
-												</AlertBlock>
-											)}
-
-											{hasProviders && (
-												<div className="flex items-center justify-end gap-3">
-													{ids.length > 0 && !hasEnabledSelected && (
-														<span className="text-xs text-muted-foreground">
-															Every selected provider is disabled — nothing
-															would ship.
-														</span>
-													)}
-													<Button
-														size="sm"
-														isLoading={isBusy}
-														disabled={!hasEnabledSelected}
-														onClick={() => handleDeploy(target.serverId, ids)}
-													>
-														{agentDeployed || saved.length > 0
-															? "Redeploy"
-															: "Deploy"}
-													</Button>
-												</div>
-											)}
-										</div>
-									);
-								})}
-
-								{visibleTargets?.length === 0 && (
-									<div className="flex flex-col items-center gap-3 min-h-[15vh] justify-center">
-										<Server className="size-8 self-center text-muted-foreground" />
-										<span className="text-base text-muted-foreground text-center">
-											You don't have any server yet
-										</span>
-									</div>
-								)}
-							</div>
-						)}
-					</CardContent>
-				</div>
-			</Card>
-		</div>
-	);
-};
@@ -1,196 +0,0 @@
-import { Loader2, ScrollText, Trash2 } from "lucide-react";
-import { toast } from "sonner";
-import { telemetryProviderIcons } from "@/components/icons/telemetry-provider-icons";
-import { DialogAction } from "@/components/shared/dialog-action";
-import { Badge } from "@/components/ui/badge";
-import { Button } from "@/components/ui/button";
-import {
-	Card,
-	CardContent,
-	CardDescription,
-	CardHeader,
-	CardTitle,
-} from "@/components/ui/card";
-import { api } from "@/utils/api";
-import { HandleTelemetryProvider } from "./handle-telemetry-provider";
-
-interface TelemetryProviderRowProps {
-	provider: {
-		telemetryProviderId: string;
-		name: string;
-		enabled: boolean;
-		providerType: string;
-		signals: string[];
-	};
-	index: number;
-	typeLabel: string;
-	canEdit: boolean;
-	canDelete: boolean;
-	onDeleted: () => void;
-}
-
-const TelemetryProviderRow = ({
-	provider,
-	index,
-	typeLabel,
-	canEdit,
-	canDelete,
-	onDeleted,
-}: TelemetryProviderRowProps) => {
-	const { mutateAsync, isPending: isRemoving } =
-		api.telemetryProvider.remove.useMutation();
-	const ProviderIcon =
-		telemetryProviderIcons[
-			provider.providerType as keyof typeof telemetryProviderIcons
-		];
-
-	return (
-		<div className="flex items-center justify-between bg-sidebar p-1 w-full rounded-lg">
-			<div className="flex items-center justify-between p-3.5 rounded-lg bg-background border  w-full">
-				<div className="flex flex-row items-center gap-3">
-					{ProviderIcon && <ProviderIcon className="size-7 shrink-0" />}
-					<div className="flex gap-2 flex-col">
-						<span className="text-sm font-medium flex items-center gap-2">
-							{index + 1}. {provider.name}
-							<Badge variant={provider.enabled ? "green" : "secondary"}>
-								{provider.enabled ? "Enabled" : "Disabled"}
-							</Badge>
-							{provider.signals.includes("logs") && (
-								<Badge variant="blue">Logs</Badge>
-							)}
-							{provider.signals.includes("metrics") && (
-								<Badge variant="orange">Metrics</Badge>
-							)}
-						</span>
-						<div className="text-xs text-muted-foreground">{typeLabel}</div>
-					</div>
-				</div>
-
-				<div className="flex flex-row gap-1">
-					{canEdit && (
-						<HandleTelemetryProvider
-							telemetryProviderId={provider.telemetryProviderId}
-						/>
-					)}
-
-					{canDelete && (
-						<DialogAction
-							title="Delete provider"
-							description="Are you sure you want to delete this provider? Every agent shipping to it is re-applied without it, and removed if nothing is left."
-							type="destructive"
-							onClick={async () => {
-								await mutateAsync({
-									telemetryProviderId: provider.telemetryProviderId,
-								})
-									.then((result) => {
-										if (result.warning) {
-											toast.warning("Provider deleted", {
-												description: result.warning,
-											});
-										} else {
-											toast.success(
-												"Provider deleted — the agents that used it were re-applied",
-											);
-										}
-										onDeleted();
-									})
-									.catch(() => {
-										toast.error("Error deleting provider");
-									});
-							}}
-						>
-							<Button
-								variant="ghost"
-								size="icon"
-								className="group hover:bg-red-500/10 "
-								isLoading={isRemoving}
-							>
-								<Trash2 className="size-4 text-primary group-hover:text-red-500" />
-							</Button>
-						</DialogAction>
-					)}
-				</div>
-			</div>
-		</div>
-	);
-};
-
-export const ShowTelemetryProviders = () => {
-	const utils = api.useUtils();
-	const { data, isPending, refetch } = api.telemetryProvider.all.useQuery();
-	const { data: availableTypes } =
-		api.telemetryProvider.availableTypes.useQuery();
-	const { data: permissions } = api.user.getPermissions.useQuery();
-	const providerListLabel = availableTypes?.length
-		? ` (${availableTypes.map((t) => t.label).join(", ")})`
-		: "";
-
-	return (
-		<div className="w-full">
-			<Card className="h-full bg-sidebar  p-2.5 rounded-xl  max-w-5xl mx-auto">
-				<div className="rounded-xl bg-background shadow-md ">
-					<CardHeader className="">
-						<CardTitle className="text-xl flex flex-row gap-2">
-							<ScrollText className="size-6 text-muted-foreground self-center" />
-							Logs & Metrics
-						</CardTitle>
-						<CardDescription>
-							{`Ship container logs and host/container metrics to an external provider${providerListLabel}. Add one here, choose what it sends, then deploy the Vector agent on the servers below.`}
-						</CardDescription>
-					</CardHeader>
-					<CardContent className="space-y-2 py-8 border-t">
-						{isPending ? (
-							<div className="flex flex-row gap-2 items-center justify-center text-sm text-muted-foreground min-h-[25vh]">
-								<span>Loading...</span>
-								<Loader2 className="animate-spin size-4" />
-							</div>
-						) : (
-							<>
-								{data?.length === 0 ? (
-									<div className="flex flex-col items-center gap-3  min-h-[25vh] justify-center">
-										<ScrollText className="size-8 self-center text-muted-foreground" />
-										<span className="text-base text-muted-foreground text-center">
-											You don't have any provider configured
-										</span>
-										{permissions?.telemetryProvider.create && (
-											<HandleTelemetryProvider />
-										)}
-									</div>
-								) : (
-									<div className="flex flex-col gap-4  min-h-[25vh]">
-										<div className="flex flex-col gap-4 rounded-lg ">
-											{data?.map((provider, index) => (
-												<TelemetryProviderRow
-													key={provider.telemetryProviderId}
-													provider={provider}
-													index={index}
-													typeLabel={
-														availableTypes?.find(
-															(t) => t.type === provider.providerType,
-														)?.label ?? provider.providerType
-													}
-													canEdit={!!permissions?.telemetryProvider.create}
-													canDelete={!!permissions?.telemetryProvider.delete}
-													onDeleted={() => {
-														refetch();
-														utils.telemetryProvider.serverStatus.invalidate();
-													}}
-												/>
-											))}
-										</div>
-
-										{permissions?.telemetryProvider.create && (
-											<div className="flex flex-row gap-2 flex-wrap w-full justify-end mr-4">
-												<HandleTelemetryProvider />
-											</div>
-										)}
-									</div>
-								)}
-							</>
-						)}
-					</CardContent>
-				</div>
-			</Card>
-		</div>
-	);
-};
@@ -1,214 +0,0 @@
-import { Loader2, Trash2 } from "lucide-react";
-import { useRouter } from "next/router";
-import { useState } from "react";
-import { toast } from "sonner";
-import {
-	AlertDialog,
-	AlertDialogCancel,
-	AlertDialogContent,
-	AlertDialogDescription,
-	AlertDialogFooter,
-	AlertDialogHeader,
-	AlertDialogTitle,
-	AlertDialogTrigger,
-} from "@/components/ui/alert-dialog";
-import { Button } from "@/components/ui/button";
-import {
-	Card,
-	CardContent,
-	CardDescription,
-	CardHeader,
-	CardTitle,
-} from "@/components/ui/card";
-import { Input } from "@/components/ui/input";
-import { Label } from "@/components/ui/label";
-import { authClient } from "@/lib/auth-client";
-import { api } from "@/utils/api";
-
-const errorMessage = (error: unknown, fallback: string) =>
-	error instanceof Error ? error.message : fallback;
-
-export const DeleteAccount = () => {
-	const router = useRouter();
-	const [open, setOpen] = useState(false);
-	const [step, setStep] = useState<"request" | "confirm">("request");
-	const [password, setPassword] = useState("");
-	const [code, setCode] = useState("");
-	const [expiresInMinutes, setExpiresInMinutes] = useState(10);
-	const { data } = api.user.get.useQuery();
-	const { data: isCloud } = api.settings.isCloud.useQuery();
-	const { data: hasPassword } = api.user.hasPassword.useQuery();
-	const requestCode = api.user.requestAccountDeletionCode.useMutation();
-	const deleteAccount = api.user.deleteAccount.useMutation();
-
-	const email = data?.user?.email ?? "";
-	const isBusy = requestCode.isPending || deleteAccount.isPending;
-
-	if (!isCloud || !data || data.role !== "owner" || hasPassword === undefined) {
-		return null;
-	}
-
-	const reset = () => {
-		setStep("request");
-		setPassword("");
-		setCode("");
-	};
-
-	const handleRequestCode = async () => {
-		try {
-			const result = await requestCode.mutateAsync(
-				hasPassword ? { password } : {},
-			);
-			setExpiresInMinutes(result.expiresInMinutes);
-			setCode("");
-			setStep("confirm");
-			toast.success(`We sent a confirmation code to ${email}`);
-		} catch (error) {
-			toast.error(errorMessage(error, "Error sending the confirmation code"));
-		}
-	};
-
-	const handleDelete = async () => {
-		try {
-			await deleteAccount.mutateAsync({ code });
-			toast.success("Your account has been deleted");
-			await authClient.signOut().catch(() => undefined);
-			router.push("/");
-		} catch (error) {
-			toast.error(errorMessage(error, "Error deleting account"));
-		}
-	};
-
-	return (
-		<Card className="bg-transparent border-destructive/40">
-			<CardHeader>
-				<CardTitle className="text-xl flex items-center gap-2 text-destructive">
-					<Trash2 className="size-5" />
-					Delete account
-				</CardTitle>
-				<CardDescription>
-					Permanently remove your account and all the data associated with it.
-				</CardDescription>
-			</CardHeader>
-			<CardContent className="flex flex-col gap-4">
-				<ul className="text-sm text-muted-foreground list-disc pl-5 space-y-1">
-					<li>
-						Active subscriptions are cancelled immediately. Invoices already
-						issued are kept for accounting.
-					</li>
-					<li>
-						Every organization you own is deleted, including its projects,
-						services, environments, domains and server connections.
-					</li>
-					<li>
-						In organizations you belong to but do not own, only your membership,
-						API keys and the Git providers you connected are removed.
-						Applications using those providers keep running but must be
-						reconnected to redeploy.
-					</li>
-					<li>Containers already running on your servers are not touched.</li>
-					<li>
-						We will email a confirmation code to{" "}
-						<span className="font-medium text-foreground">{email}</span> before
-						anything is deleted.
-					</li>
-					<li>This action cannot be undone.</li>
-				</ul>
-				<div>
-					<AlertDialog
-						open={open}
-						onOpenChange={(next) => {
-							setOpen(next);
-							if (!next) reset();
-						}}
-					>
-						<AlertDialogTrigger asChild>
-							<Button variant="destructive">Delete account</Button>
-						</AlertDialogTrigger>
-						<AlertDialogContent>
-							<AlertDialogHeader>
-								<AlertDialogTitle>Delete your account?</AlertDialogTitle>
-								<AlertDialogDescription>
-									{step === "request"
-										? `This will permanently delete your account and every organization you own. We will send a confirmation code to ${email}.`
-										: `Enter the ${expiresInMinutes}-minute code we sent to ${email} to confirm the deletion.`}
-								</AlertDialogDescription>
-							</AlertDialogHeader>
-							<div className="flex flex-col gap-2">
-								{step === "request" && hasPassword && (
-									<>
-										<Label htmlFor="delete-account-password">Password</Label>
-										<Input
-											id="delete-account-password"
-											type="password"
-											autoComplete="current-password"
-											placeholder="Enter your password"
-											value={password}
-											onChange={(e) => setPassword(e.target.value)}
-										/>
-									</>
-								)}
-								{step === "confirm" && (
-									<>
-										<Label htmlFor="delete-account-code">
-											Confirmation code
-										</Label>
-										<Input
-											id="delete-account-code"
-											inputMode="numeric"
-											autoComplete="one-time-code"
-											maxLength={6}
-											placeholder="123456"
-											value={code}
-											onChange={(e) =>
-												setCode(e.target.value.replace(/\D/g, ""))
-											}
-										/>
-										<Button
-											type="button"
-											variant="link"
-											size="sm"
-											className="self-start px-0"
-											disabled={isBusy}
-											onClick={handleRequestCode}
-										>
-											Resend code
-										</Button>
-									</>
-								)}
-							</div>
-							<AlertDialogFooter>
-								<AlertDialogCancel disabled={isBusy}>Cancel</AlertDialogCancel>
-								{step === "request" ? (
-									<Button
-										type="button"
-										variant="destructive"
-										disabled={isBusy || (hasPassword && password.length === 0)}
-										onClick={handleRequestCode}
-									>
-										{requestCode.isPending && (
-											<Loader2 className="size-4 animate-spin" />
-										)}
-										Send confirmation code
-									</Button>
-								) : (
-									<Button
-										type="button"
-										variant="destructive"
-										disabled={isBusy || code.length !== 6}
-										onClick={handleDelete}
-									>
-										{deleteAccount.isPending && (
-											<Loader2 className="size-4 animate-spin" />
-										)}
-										Delete account
-									</Button>
-								)}
-							</AlertDialogFooter>
-						</AlertDialogContent>
-					</AlertDialog>
-				</div>
-			</CardContent>
-		</Card>
-	);
-};
@@ -1,4 +1,6 @@
+import { Activity } from "lucide-react";
 import { useState } from "react";
+import { Button } from "@/components/ui/button";
 import {
 	Dialog,
 	DialogContent,
@@ -13,31 +15,31 @@ import { ToggleDockerCleanup } from "./toggle-docker-cleanup";

 interface Props {
 	serverId: string;
-	children?: React.ReactNode;
+	asButton?: boolean;
 }

-export const ShowServerActions = ({ serverId, children }: Props) => {
+export const ShowServerActions = ({ serverId, asButton = false }: Props) => {
 	const [isOpen, setIsOpen] = useState(false);
 	return (
 		<Dialog open={isOpen} onOpenChange={setIsOpen}>
-			{children ? (
-				<DialogTrigger asChild>{children}</DialogTrigger>
-			) : (
+			{asButton ? (
 				<DialogTrigger asChild>
-					<DropdownMenuItem
-						className="w-full cursor-pointer"
-						onSelect={(e) => {
-							e.preventDefault();
-						}}
-					>
-						View Actions
-					</DropdownMenuItem>
+					<Button variant="outline" size="icon" className="h-9 w-9">
+						<Activity className="h-4 w-4" />
+					</Button>
 				</DialogTrigger>
+			) : (
+				<DropdownMenuItem
+					className="w-full cursor-pointer"
+					onSelect={(e) => {
+						e.preventDefault();
+						setIsOpen(true);
+					}}
+				>
+					View Actions
+				</DropdownMenuItem>
 			)}
-			<DialogContent
-				className="sm:max-w-xl"
-				onCloseAutoFocus={(e) => e.preventDefault()}
-			>
+			<DialogContent className="sm:max-w-xl">
 				<div className="flex flex-col gap-1">
 					<DialogTitle className="text-xl">Web server settings</DialogTitle>
 					<DialogDescription>Reload or clean the web server.</DialogDescription>
@@ -109,13 +109,8 @@ export const DeleteServerModal = ({

 	const handleDeleteServer = async () => {
 		try {
-			const result = await deleteServer({ serverId });
+			await deleteServer({ serverId });
 			toast.success(`Server ${serverName} deleted successfully`);
-			if (result?.vectorAgentRemovalWarning) {
-				toast.error(
-					`Couldn't reach this host to remove the Vector logs and metrics agent; if it was deployed it may still be running: ${result.vectorAgentRemovalWarning}`,
-				);
-			}
 			setOpen(false);
 			utils.server.all.invalidate();
 		} catch (error: any) {
@@ -126,10 +121,7 @@ export const DeleteServerModal = ({
 	return (
 		<Dialog open={open} onOpenChange={setOpen}>
 			<DialogTrigger asChild>{children}</DialogTrigger>
-			<DialogContent
-				className="max-w-lg"
-				onCloseAutoFocus={(e) => e.preventDefault()}
-			>
+			<DialogContent className="max-w-lg">
 				<DialogHeader>
 					<DialogTitle>Delete Server</DialogTitle>
 					<DialogDescription>
@@ -1,5 +1,5 @@
 import { standardSchemaResolver as zodResolver } from "@hookform/resolvers/standard-schema";
-import { PlusIcon } from "lucide-react";
+import { Pencil, PlusIcon } from "lucide-react";
 import Link from "next/link";
 import { useEffect, useState } from "react";
 import { useForm } from "react-hook-form";
@@ -61,10 +61,10 @@ type Schema = z.infer<typeof Schema>;

 interface Props {
 	serverId?: string;
-	children?: React.ReactNode;
+	asButton?: boolean;
 }

-export const HandleServers = ({ serverId, children }: Props) => {
+export const HandleServers = ({ serverId, asButton = false }: Props) => {
 	const utils = api.useUtils();
 	const [isOpen, setIsOpen] = useState(false);
 	const { data: canCreateMoreServers, refetch } =
@@ -141,19 +141,24 @@ export const HandleServers = ({ serverId, children }: Props) => {

 	return (
 		<Dialog open={isOpen} onOpenChange={setIsOpen}>
-			{children ? (
-				<DialogTrigger asChild>{children}</DialogTrigger>
-			) : serverId ? (
-				<DialogTrigger asChild>
+			{serverId ? (
+				asButton ? (
+					<DialogTrigger asChild>
+						<Button variant="outline" size="icon" className="h-9 w-9">
+							<Pencil className="h-4 w-4" />
+						</Button>
+					</DialogTrigger>
+				) : (
 					<DropdownMenuItem
 						className="w-full cursor-pointer "
 						onSelect={(e) => {
 							e.preventDefault();
+							setIsOpen(true);
 						}}
 					>
 						Edit Server
 					</DropdownMenuItem>
-				</DialogTrigger>
+				)
 			) : (
 				<DialogTrigger asChild>
 					<Button className="cursor-pointer space-x-3">
@@ -162,10 +167,7 @@ export const HandleServers = ({ serverId, children }: Props) => {
 					</Button>
 				</DialogTrigger>
 			)}
-			<DialogContent
-				className="sm:max-w-3xl "
-				onCloseAutoFocus={(e) => e.preventDefault()}
-			>
+			<DialogContent className="sm:max-w-3xl ">
 				<DialogHeader>
 					<DialogTitle>{serverId ? "Edit" : "Create"} Server</DialogTitle>
 					<DialogDescription>
@@ -35,10 +35,10 @@ import { ValidateServer } from "./validate-server";

 interface Props {
 	serverId: string;
-	children?: React.ReactNode;
+	asButton?: boolean;
 }

-export const SetupServer = ({ serverId, children }: Props) => {
+export const SetupServer = ({ serverId, asButton = false }: Props) => {
 	const [isOpen, setIsOpen] = useState(false);
 	const { data: server } = api.server.one.useQuery(
 		{
@@ -81,19 +81,24 @@ export const SetupServer = ({ serverId, children }: Props) => {

 	return (
 		<Dialog open={isOpen} onOpenChange={setIsOpen}>
-			{children ? (
-				<DialogTrigger asChild>{children}</DialogTrigger>
-			) : (
+			{asButton ? (
 				<DialogTrigger asChild>
-					<Button className="w-full cursor-pointer " size="sm">
-						Setup Server <Settings className="size-4" />
+					<Button variant="outline" size="icon" className="h-9 w-9">
+						<Settings className="h-4 w-4" />
 					</Button>
 				</DialogTrigger>
+			) : (
+				<Button
+					className="w-full cursor-pointer "
+					size="sm"
+					onClick={() => {
+						setIsOpen(true);
+					}}
+				>
+					Setup Server <Settings className="size-4" />
+				</Button>
 			)}
-			<DialogContent
-				className="sm:max-w-4xl  "
-				onCloseAutoFocus={(e) => e.preventDefault()}
-			>
+			<DialogContent className="sm:max-w-4xl  ">
 				<DialogHeader>
 					<div className="flex flex-col gap-1.5">
 						<DialogTitle className="flex items-center gap-2">
--- a/Show More
+++ b/Show More