refactor: update Vite application structure and dependencies

- Removed the `index.html` file as part of the transition to a new routing system. - Updated `package.json` scripts to streamline development commands using `concurrently`. - Enhanced dependency management by adding new packages and updating existing ones in `package.json`. - Introduced a new server function for branding and session management, improving API interactions. - Refactored routing to utilize TanStack Start, ensuring better integration with the existing Dokploy architecture. - Improved static file handling and server response management in the custom Node.js server. - Updated README to reflect changes in architecture and development processes.
Merge branch 'canary' into feat/vite-tanstack-router
2026-10-17 22:25:32 +00:00 · 2026-08-11 01:15:43 -06:00 · 2026-08-10 23:38:20 -06:00 · 2026-08-10 23:38:04 -06:00
570 changed files with 21515 additions and 188443 deletions
@@ -1,22 +0,0 @@
-{
-	"worktree": {
-		"baseRef": "fresh"
-	},
-	"hooks": {
-		"PostToolUse": [
-			{
-				"matcher": "EnterWorktree",
-				"hooks": [
-					{
-						"type": "command",
-						"command": "\"$CLAUDE_PROJECT_DIR/scripts/install-worktree-deps.sh\""
-					},
-					{
-						"type": "command",
-						"command": "\"$CLAUDE_PROJECT_DIR/scripts/assign-worktree-port.sh\""
-					}
-				]
-			}
-		]
-	}
-}
@@ -1,55 +0,0 @@
---
-name: fix-issue
-description: Implement a GitHub issue with reproduction and verification
-allowed-tools: Bash, Edit, Write, Read, Glob, Grep, mcp__playwright__*, mcp__dokploy__*
---
-
-The issue number is passed as $1.
-
-## Instance
-
-No instance is running yet — start your own, isolated to this worktree:
-
-1. Check `apps/dokploy/.env` for `PORT` (assigned per-worktree already).
-2. If nothing is listening on that port, start it: `pnpm dokploy:dev` in the
-   background, then poll `curl -s -o /dev/null -w '%{http_code}' http://localhost:$PORT`
-   until it answers (usually ~10-15s).
-3. Use `http://localhost:$PORT` as the base URL for Playwright navigation.
-
-Note: `mcp__dokploy__*` resolves its URL from
-`$DOKPLOY_BASE_URL` once, at session startup — it cannot pick up a port
-discovered mid-session. If those tools are unavailable or point at the wrong
-instance, fall back to `curl`/`gh api` for API-level checks, or ask the user
-to relaunch with `DOKPLOY_BASE_URL` exported first.
-
-## Tools
-
- `mcp__dokploy__*` — the Dokploy API of the running instance. Use it to set up
-  state (create a project, an app, an env var) and to verify backend behavior.
-  Search for the tool you need; they are not all loaded upfront.
- `mcp__playwright__*` — the browser at $DOKPLOY_BASE_URL. Use it for anything
-  a user would see or click.
-
-Pick by where the bug lives, not by convenience:
-
- Bug in the UI (rendering, forms, navigation, state) → reproduce in Playwright.
-  The API returning correct data proves nothing here.
- Bug in the API, deploy logic, or data → reproduce with the Dokploy MCP.
-  A green screenshot proves nothing here.
- Unclear → do both.
-
-Use the MCP to reach the state you need quickly, then verify in the UI. Do not
-click through ten screens to create a project the API can create in one call.
-
-## Steps
-
-1. Run `gh issue view $1` and read the full issue, including comments.
-2. Reproduce the bug with the appropriate tool. If you cannot reproduce it,
-   comment on the issue explaining what you tried and STOP.
-   Do not implement anything.
-3. Implement the fix. Keep the change minimal and scoped to the issue.
-4. Run `pnpm test`, then re-run the same reproduction from step 2.
-5. Only if both pass: commit and run `gh pr create`. The PR description must
-   include the before/after reproduction steps and reference the issue.
-
-Never skip step 2. A fix you cannot reproduce and then verify is not a fix.
@@ -2,4 +2,8 @@ node_modules
 .git
 .gitignore
 *.md
-dist
+dist
+**/.next
+**/dist
+**/dist-server
+**/.env
@@ -14,34 +14,34 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Get version from package.json
-        run: echo "VERSION=$(jq -r .version ./apps/dokploy/package.json)" >> "$GITHUB_ENV"
+        run: echo "VERSION=$(jq -r .version ./apps/dokploy/package.json)" >> $GITHUB_ENV

      - name: Get latest GitHub tag
        run: |
          LATEST_TAG=$(git ls-remote --tags origin | awk -F'/' '{print $3}' | sort -V | tail -n1)
-          echo "LATEST_TAG=$LATEST_TAG" >> "$GITHUB_ENV"
-          echo "$LATEST_TAG"
+          echo "LATEST_TAG=$LATEST_TAG" >> $GITHUB_ENV
+          echo $LATEST_TAG
      - name: Compare versions
        run: |
-          if [ "$VERSION" != "$LATEST_TAG" ]; then
+          if [ "${{ env.VERSION }}" != "${{ env.LATEST_TAG }}" ]; then
            VERSION_CHANGED="true"
          else
            VERSION_CHANGED="false"
          fi
-          echo "VERSION_CHANGED=$VERSION_CHANGED" >> "$GITHUB_ENV"
+          echo "VERSION_CHANGED=$VERSION_CHANGED" >> $GITHUB_ENV
          echo "Comparing versions:"
-          echo "Current version: $VERSION"
-          echo "Latest tag: $LATEST_TAG"
+          echo "Current version: ${{ env.VERSION }}"
+          echo "Latest tag: ${{ env.LATEST_TAG }}"
          echo "Version changed: $VERSION_CHANGED"
      - name: Check if a PR already exists
        run: |
          PR_EXISTS=$(gh pr list --state open --base main --head canary --json number --jq '. | length')
-          echo "PR_EXISTS=$PR_EXISTS" >> "$GITHUB_ENV"
+          echo "PR_EXISTS=$PR_EXISTS" >> $GITHUB_ENV
        env:
          GH_TOKEN: ${{ secrets.GH_PAT }}

@@ -56,12 +56,12 @@ jobs:
          git push origin canary

          gh pr create \
-            --title "🚀 Release $VERSION" \
-            --body "
-            This PR promotes changes from \`canary\` to \`main\` for version $VERSION.
+            --title "🚀 Release ${{ env.VERSION }}" \
+            --body '
+            This PR promotes changes from `canary` to `main` for version ${{ env.VERSION }}.

            ### 🔍 Changes Include:
-            - Version bump to $VERSION
+            - Version bump to ${{ env.VERSION }}
            - All changes from canary branch

            ### ✅ Pre-merge Checklist:
@@ -69,7 +69,7 @@ jobs:
            - [ ] Documentation updated
            - [ ] Docker images built and tested

-            > 🤖 This PR was automatically generated by [GitHub Actions](https://github.com/actions)" \
+            > 🤖 This PR was automatically generated by [GitHub Actions](https://github.com/actions)' \
            --base main \
            --head canary \
            --label "release" --label "automated pr" || true \
@@ -5,38 +5,33 @@ on:
    branches: [main, canary]
  workflow_dispatch:

-permissions:
-  contents: read
-
 jobs:
  build-and-push-cloud-image:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v3

      - name: Set tag and version
        id: meta-cloud
        run: |
          VERSION=$(jq -r .version apps/dokploy/package.json)
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
-            echo "tags=siumauricio/cloud:latest,siumauricio/cloud:${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            echo "tags=siumauricio/cloud:latest,siumauricio/cloud:${VERSION}" >> $GITHUB_OUTPUT
          else
-            echo "tags=siumauricio/cloud:canary" >> "$GITHUB_OUTPUT"
+            echo "tags=siumauricio/cloud:canary" >> $GITHUB_OUTPUT
          fi

      - name: Log in to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v4
        with:
          context: .
          file: ./Dockerfile.cloud
@@ -53,28 +48,26 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v3

      - name: Set tag and version
        id: meta-schedule
        run: |
          VERSION=$(jq -r .version apps/dokploy/package.json)
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
-            echo "tags=siumauricio/schedule:latest,siumauricio/schedule:${VERSION}" >> "$GITHUB_OUTPUT"
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            echo "tags=siumauricio/schedule:latest,siumauricio/schedule:${VERSION}" >> $GITHUB_OUTPUT
          else
-            echo "tags=siumauricio/schedule:canary" >> "$GITHUB_OUTPUT"
+            echo "tags=siumauricio/schedule:canary" >> $GITHUB_OUTPUT
          fi

      - name: Log in to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v4
        with:
          context: .
          file: ./Dockerfile.schedule
@@ -87,28 +80,26 @@ jobs:

    steps:
      - name: Checkout repository
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v3

      - name: Set tag and version
        id: meta-server
        run: |
          VERSION=$(jq -r .version apps/dokploy/package.json)
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
-            echo "tags=siumauricio/server:latest,siumauricio/server:${VERSION}" >> "$GITHUB_OUTPUT"
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
+            echo "tags=siumauricio/server:latest,siumauricio/server:${VERSION}" >> $GITHUB_OUTPUT
          else
-            echo "tags=siumauricio/server:canary" >> "$GITHUB_OUTPUT"
+            echo "tags=siumauricio/server:canary" >> $GITHUB_OUTPUT
          fi

      - name: Log in to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v4
        with:
          context: .
          file: ./Dockerfile.server
@@ -8,23 +8,18 @@ on:
 env:
  IMAGE_NAME: dokploy/dokploy

-permissions:
-  contents: read
-
 jobs:
  docker-amd:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -32,15 +27,15 @@ jobs:
      - name: Set tag and version
        id: meta
        run: |
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
            TAG="latest"
            VERSION=$(node -p "require('./apps/dokploy/package.json').version")
-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
            TAG="canary"
          else
            TAG="feature"
          fi
-          echo "tags=${IMAGE_NAME}:${TAG}-amd64" >> "$GITHUB_OUTPUT"
+          echo "tags=${IMAGE_NAME}:${TAG}-amd64" >> $GITHUB_OUTPUT

      - name: Prepare env file
        run: |
@@ -48,7 +43,7 @@ jobs:
          cp apps/dokploy/.env.production.example apps/dokploy/.env.production

      - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/amd64
@@ -58,15 +53,13 @@ jobs:
    runs-on: ubuntu-24.04-arm
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -75,15 +68,15 @@ jobs:
        id: meta
        run: |
          VERSION=$(node -p "require('./apps/dokploy/package.json').version")
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
            TAG="latest"
            VERSION=$(node -p "require('./apps/dokploy/package.json').version")
-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
            TAG="canary"
          else
            TAG="feature"
          fi
-          echo "tags=${IMAGE_NAME}:${TAG}-arm64" >> "$GITHUB_OUTPUT"
+          echo "tags=${IMAGE_NAME}:${TAG}-arm64" >> $GITHUB_OUTPUT

      - name: Prepare env file
        run: |
@@ -91,7 +84,7 @@ jobs:
          cp apps/dokploy/.env.production.example apps/dokploy/.env.production

      - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
        with:
          context: .
          platforms: linux/arm64
@@ -103,22 +96,20 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Create and push manifests
        run: |
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
            VERSION=$(node -p "require('./apps/dokploy/package.json').version")
            TAG="latest"

@@ -130,7 +121,7 @@ jobs:
              ${IMAGE_NAME}:${TAG}-amd64 \
              ${IMAGE_NAME}:${TAG}-arm64

-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
            TAG="canary"
            docker buildx imagetools create -t ${IMAGE_NAME}:${TAG} \
              ${IMAGE_NAME}:${TAG}-amd64 \
@@ -147,37 +138,32 @@ jobs:
    needs: [combine-manifests]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
-    permissions:
-      contents: write
    outputs:
      version: ${{ steps.get_version.outputs.version }}
      npm_version: ${{ steps.get_version.outputs.npm_version }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
        with:
          fetch-depth: 0
-          persist-credentials: false

      - name: Get version
        id: get_version
        run: |
          VERSION=$(node -p "require('./apps/dokploy/package.json').version")
-          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
-          echo "npm_version=${VERSION#v}" >> "$GITHUB_OUTPUT"
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "npm_version=${VERSION#v}" >> $GITHUB_OUTPUT

      - name: Fetch install.sh
-        env:
-          RELEASE_VERSION: ${{ steps.get_version.outputs.version }}
        run: |
          curl -fsSL https://raw.githubusercontent.com/Dokploy/website/main/apps/website/public/install.sh -o install.sh
          head -1 install.sh | grep -q '^#!' || { echo "Downloaded install.sh is not a shell script"; exit 1; }
          grep -q 'DOKPLOY_VERSION' install.sh || { echo "install.sh no longer supports DOKPLOY_VERSION pinning"; exit 1; }
-          { head -1 install.sh; echo "DOKPLOY_VERSION=\"\${DOKPLOY_VERSION:-${RELEASE_VERSION}}\""; tail -n +2 install.sh; } > install-pinned.sh
+          { head -1 install.sh; echo "DOKPLOY_VERSION=\"\${DOKPLOY_VERSION:-${{ steps.get_version.outputs.version }}}\""; tail -n +2 install.sh; } > install-pinned.sh
          mv install-pinned.sh install.sh

      - name: Create Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@v2
        with:
          tag_name: ${{ steps.get_version.outputs.version }}
          target_commitish: ${{ github.sha }}
@@ -193,19 +179,15 @@ jobs:
    needs: [generate-release]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
-    env:
-      NPM_VERSION: ${{ needs.generate-release.outputs.npm_version }}
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4

-      - uses: pnpm/action-setup@v6
+      - uses: pnpm/action-setup@v4
        with:
          version: 10.22.0

-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v4
        with:
          node-version: 24.4.0
          cache: pnpm
@@ -220,63 +202,63 @@ jobs:
          git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/mcp.git /tmp/mcp-repo
          cd /tmp/mcp-repo

-          jq --arg v "$NPM_VERSION" '.version = $v' package.json > package.json.tmp
+          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
          mv package.json.tmp package.json

-          cp $GITHUB_WORKSPACE/openapi.json src/generated/openapi.json
+          cp ${{ github.workspace }}/openapi.json src/generated/openapi.json
          pnpm install
          pnpm run generate

          git config user.name "Dokploy Bot"
          git config user.email "bot@dokploy.com"
          git add -A
-          git commit -m "chore: bump version to $NPM_VERSION" \
-            -m "Source: $GITHUB_REPOSITORY@$GITHUB_SHA" \
+          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
+            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
            --allow-empty
          git push

-          echo "✅ MCP repo synced to version $NPM_VERSION"
+          echo "✅ MCP repo synced to version ${{ needs.generate-release.outputs.npm_version }}"

      - name: Sync version to CLI repository
        run: |
          git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/cli.git /tmp/cli-repo
          cd /tmp/cli-repo

-          jq --arg v "$NPM_VERSION" '.version = $v' package.json > package.json.tmp
+          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
          mv package.json.tmp package.json

-          cp $GITHUB_WORKSPACE/openapi.json ./openapi.json
+          cp ${{ github.workspace }}/openapi.json ./openapi.json
          pnpm install
          pnpm run generate

          git config user.name "Dokploy Bot"
          git config user.email "bot@dokploy.com"
          git add -A
-          git commit -m "chore: bump version to $NPM_VERSION" \
-            -m "Source: $GITHUB_REPOSITORY@$GITHUB_SHA" \
+          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
+            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
            --allow-empty
          git push

-          echo "✅ CLI repo synced to version $NPM_VERSION"
+          echo "✅ CLI repo synced to version ${{ needs.generate-release.outputs.npm_version }}"

      - name: Sync version to SDK repository
        run: |
          git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/sdk.git /tmp/sdk-repo
          cd /tmp/sdk-repo

-          jq --arg v "$NPM_VERSION" '.version = $v' package.json > package.json.tmp
+          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
          mv package.json.tmp package.json

-          cp $GITHUB_WORKSPACE/openapi.json ./openapi.json
+          cp ${{ github.workspace }}/openapi.json ./openapi.json
          pnpm install
          pnpm run generate

          git config user.name "Dokploy Bot"
          git config user.email "bot@dokploy.com"
          git add -A
-          git commit -m "chore: bump version to $NPM_VERSION" \
-            -m "Source: $GITHUB_REPOSITORY@$GITHUB_SHA" \
+          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
+            -m "Source: ${{ github.repository }}@${{ github.sha }}" \
            --allow-empty
          git push

-          echo "✅ SDK repo synced to version $NPM_VERSION"
+          echo "✅ SDK repo synced to version ${{ needs.generate-release.outputs.npm_version }}"
@@ -6,22 +6,17 @@ on:
  pull_request:
    branches: [canary]

-permissions:
-  contents: read
-
 jobs:
  format:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4

      - name: Setup biomeJs
-        uses: biomejs/setup-biome@v2
+        uses: biomejs/setup-biome@v2  

      - name: Run Biome formatter
        run:  biome format --write

-      - uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a # v1.3.4
+      - uses: autofix-ci/action@635ffb0c9798bd160680f18fd73371e355b85f27 # v1.3.2
@@ -16,19 +16,17 @@ jobs:
      contents: write
    steps:
      - name: Checkout main
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
        with:
          ref: main
          fetch-depth: 0
          token: ${{ secrets.HOTFIX_PUSH_TOKEN }}

      - name: Cherry-pick fix to main
-        env:
-          MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
        run: |
          git config user.name "Dokploy Bot"
          git config user.email "bot@dokploy.com"
-          SHA="$MERGE_SHA"
+          SHA="${{ github.event.pull_request.merge_commit_sha }}"
          if [ "$(git rev-list --parents -n1 "$SHA" | wc -w)" -gt 2 ]; then
            git cherry-pick -x -m 1 "$SHA"
          else
@@ -36,16 +34,3 @@ jobs:
          fi
          git commit --amend -m "$(git log -1 --format=%B)" -m "[skip ci]"
          git push origin main
-
-      - name: Sync cherry-pick back into canary
-        run: |
-          git config user.name "Dokploy Bot"
-          git config user.email "bot@dokploy.com"
-          git fetch origin canary main
-          git checkout -B canary origin/canary
-          if ! git merge origin/main -m "chore: sync hotfix from main into canary [skip ci]"; then
-            git merge --abort
-            echo "::error::Could not auto-sync the hotfix into canary (real conflict, not just history divergence). Merge main into canary manually to avoid a conflict on the next release PR."
-            exit 1
-          fi
-          git push origin canary
@@ -7,16 +7,12 @@ concurrency:
  group: hotfix-to-main
  cancel-in-progress: false

-# Push to main goes through HOTFIX_PUSH_TOKEN, not the workflow token.
-permissions:
-  contents: read
-
 jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout main
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
        with:
          ref: main
          token: ${{ secrets.HOTFIX_PUSH_TOKEN }}
@@ -7,23 +7,18 @@ on:
 env:
  IMAGE_NAME: dokploy/monitoring

-permissions:
-  contents: read
-
 jobs:
  docker-amd:
    runs-on: ubuntu-22.04
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -31,17 +26,17 @@ jobs:
      - name: Set tag
        id: meta
        run: |
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
            TAG="latest"
-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
            TAG="canary"
          else
            TAG="feature"
          fi
-          echo "tags=${IMAGE_NAME}:${TAG}-amd64" >> "$GITHUB_OUTPUT"
+          echo "tags=${IMAGE_NAME}:${TAG}-amd64" >> $GITHUB_OUTPUT

      - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile.monitoring
@@ -52,15 +47,13 @@ jobs:
    runs-on: ubuntu-24.04-arm
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -68,17 +61,17 @@ jobs:
      - name: Set
        id: meta
        run: |
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
            TAG="latest"
-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
            TAG="canary"
          else
            TAG="feature"
          fi
-          echo "tags=${IMAGE_NAME}:${TAG}-arm64" >> "$GITHUB_OUTPUT"
+          echo "tags=${IMAGE_NAME}:${TAG}-arm64" >> $GITHUB_OUTPUT

      - name: Build and push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v5
        with:
          context: .
          file: ./Dockerfile.monitoring
@@ -91,29 +84,27 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
+        uses: actions/checkout@v4

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v3

      - name: Login to Docker Hub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Create and push manifests
        run: |
-          if [ "$GITHUB_REF" = "refs/heads/main" ]; then
+          if [ "${{ github.ref }}" = "refs/heads/main" ]; then
            TAG="latest"

            docker buildx imagetools create -t ${IMAGE_NAME}:${TAG} \
              ${IMAGE_NAME}:${TAG}-amd64 \
              ${IMAGE_NAME}:${TAG}-arm64

-          elif [ "$GITHUB_REF" = "refs/heads/canary" ]; then
+          elif [ "${{ github.ref }}" = "refs/heads/canary" ]; then
            TAG="canary"
            docker buildx imagetools create -t ${IMAGE_NAME}:${TAG} \
              ${IMAGE_NAME}:${TAG}-amd64 \
@@ -14,11 +14,9 @@ jobs:
      matrix:
        job: [build, test, typecheck]
    steps:
-      - uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@v4
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
        with:
          node-version: 24.4.0
          cache: "pnpm"
@@ -12,20 +12,17 @@ on:

  workflow_dispatch:

-permissions:
-  contents: read
-
 jobs:
  generate-and-commit:
    name: Generate OpenAPI and commit to Dokploy repo
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Dokploy repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
        with:
-          persist-credentials: false
-      - uses: pnpm/action-setup@v6
-      - uses: actions/setup-node@v7
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - uses: pnpm/action-setup@v4
+      - uses: actions/setup-node@v4
        with:
          node-version: 24.4.0
          cache: "pnpm"
@@ -1,442 +0,0 @@
-# Upgrade Integration Test
-#
-# Tests that Dokploy can upgrade from version A to version B while keeping
-# user projects (Postgres, MongoDB, two web apps, one static site) alive.
-#
-# Generates upgrade pairs: each stable tag in [floor_version, target_version)
-# is paired with target_version. If target_version is empty, the highest tag
-# available on Docker Hub is used as the target.
-#
-# Only triggered manually to avoid burning Actions minutes.
-
-name: Upgrade Integration Test
-
-on:
-  workflow_dispatch:
-    inputs:
-      floor_version:
-        description: 'Oldest version tag to include in pairs (e.g. v0.29.4)'
-        required: false
-        default: 'v0.29.4'
-      target_version:
-        description: 'Target version to upgrade to (version B). Leave empty to use the highest available.'
-        required: false
-        default: ''
-
-env:
-  DOKPLOY_IMAGE:   dokploy/dokploy
-  DOKPLOY_SERVICE: dokploy
-  DOKPLOY_PORT:    3000
-
-permissions:
-  contents: read
-
-# ──────────────────────────────────────────────────────────────────────────────
-jobs:
-
-  # ── 1. Build the matrix ─────────────────────────────────────────────────────
-  build-matrix:
-    name: Build upgrade pair matrix
-    runs-on: ubuntu-latest
-    outputs:
-      pairs: ${{ steps.pairs.outputs.pairs }}
-
-    steps:
-      - name: Generate pairs
-        id: pairs
-        env:
-          FLOOR:  ${{ inputs.floor_version }}
-          TARGET: ${{ inputs.target_version }}
-        run: |
-          set -euo pipefail
-
-          # semver "a >= b" comparison helper (vX.Y.Z, strips leading v)
-          ge() {
-            [ "$(printf '%s\n%s\n' "${1#v}" "${2#v}" | sort -V | tail -n1)" = "${1#v}" ]
-          }
-
-          # Fetch all semver tags from Docker Hub (dokploy/dokploy)
-          ALL_TAGS=$(curl -fsSL \
-            "https://hub.docker.com/v2/repositories/dokploy/dokploy/tags?page_size=100" | \
-            jq -r '.results[].name' | \
-            grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | \
-            sort -V)
-
-          echo "All tags found:"
-          echo "$ALL_TAGS"
-
-          # Target version (version B): explicit input, else highest available.
-          if [ -n "$TARGET" ]; then
-            TO="$TARGET"
-            echo "Using user-supplied target version: $TO"
-          else
-            TO=$(echo "$ALL_TAGS" | tail -n1)
-            echo "No target supplied; using highest available: $TO"
-          fi
-
-          # Floor semver components
-          FLOOR_CLEAN="${FLOOR#v}"
-          IFS='.' read -r F_MAJ F_MIN F_PAT <<< "$FLOOR_CLEAN"
-
-          # Each tag in [FLOOR, TO) → TO
-          PAIRS='[]'
-          while read -r TAG; do
-            [ -z "$TAG" ] && continue
-            # skip tags above-or-equal to the target (incl. the target itself)
-            ge "$TAG" "$TO" && continue
-            TAG_CLEAN="${TAG#v}"
-            IFS='.' read -r T_MAJ T_MIN T_PAT <<< "$TAG_CLEAN"
-            if [ "$T_MAJ" -gt "$F_MAJ" ] || \
-               { [ "$T_MAJ" -eq "$F_MAJ" ] && [ "$T_MIN" -gt "$F_MIN" ]; } || \
-               { [ "$T_MAJ" -eq "$F_MAJ" ] && [ "$T_MIN" -eq "$F_MIN" ] && [ "$T_PAT" -ge "$F_PAT" ]; }; then
-              PAIRS=$(echo "$PAIRS" | jq -c \
-                --arg f "$TAG" --arg t "$TO" \
-                '. + [{"from":$f,"to":$t}]')
-            fi
-          done <<< "$ALL_TAGS"
-
-          COUNT=$(echo "$PAIRS" | jq 'length')
-          echo "Total pairs: $COUNT"
-          echo "$PAIRS" | jq -r '.[] | "  \(.from) → \(.to)"'
-
-          echo "pairs=$PAIRS" >> "$GITHUB_OUTPUT"
-
-
-  # ── 2. Run one upgrade test per pair ────────────────────────────────────────
-  upgrade-test:
-    name: "${{ matrix.pair.from }} → ${{ matrix.pair.to }}"
-    needs: build-matrix
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        pair: ${{ fromJSON(needs.build-matrix.outputs.pairs) }}
-
-    steps:
-
-      # ── Environment setup ──────────────────────────────────────────────────
-      - name: Free disk space
-        run: |
-          sudo rm -rf \
-            /usr/share/dotnet /opt/ghc /usr/local/share/boost \
-            "$AGENT_TOOLSDIRECTORY" /usr/local/lib/android \
-            /usr/local/share/chromium /opt/hostedtoolcache
-          docker system prune -af --volumes
-          df -h
-
-      # ── Install Dokploy directly at VERSION A ──────────────────────────────
-      # install.sh:
-      #   • requires root (run via sudo bash)
-      #   • respects DOKPLOY_VERSION → installs that tag directly
-      #     (so we don't need a separate "downgrade" step that would risk
-      #     running B's migrations on A's expected schema)
-      #   • respects ADVERTISE_ADDR → skip the external IP lookup
-      #   • initializes Docker Swarm + dokploy-network itself
-      - name: Install Dokploy at VERSION A (${{ matrix.pair.from }})
-        run: |
-          curl -fsSL https://dokploy.com/install.sh -o /tmp/install.sh
-          chmod +x /tmp/install.sh
-          sudo -E env \
-            DOKPLOY_VERSION="${{ matrix.pair.from }}" \
-            ADVERTISE_ADDR="127.0.0.1" \
-            bash /tmp/install.sh
-
-      - name: Wait for dokploy service to converge on ${{ matrix.pair.from }}
-        run: |
-          echo "Waiting for 'dokploy' Swarm service to reach 1/1..."
-          timeout 240 bash -c '
-            until docker service ls --filter name=dokploy \
-                    --format "{{.Name}} {{.Replicas}}" \
-                  | grep "^dokploy " | grep -q " 1/1"; do
-              sleep 4
-            done
-          '
-          docker service ls
-          echo "✅ Service running on ${{ matrix.pair.from }}"
-
-      - name: Wait for Dokploy API to accept requests
-        run: |
-          timeout 180 bash -c '
-            until curl -sf -o /dev/null \
-                       "http://localhost:${{ env.DOKPLOY_PORT }}"; do
-              sleep 3
-            done
-          '
-          echo "✅ Dokploy API is up"
-
-      # ── Bootstrap admin user ───────────────────────────────────────────────
-      - name: Register first admin user
-        id: auth
-        run: |
-          COOKIE_JAR="$RUNNER_TEMP/dokploy-cookies.txt"
-          : > "$COOKIE_JAR"
-          chmod 600 "$COOKIE_JAR"
-          echo "cookie_jar=$COOKIE_JAR" >> "$GITHUB_OUTPUT"
-
-          # better-auth: sign-up/email (allowed only before any owner exists)
-          set -x
-          curl -sS -i -X POST \
-            "http://localhost:${{ env.DOKPLOY_PORT }}/api/auth/sign-up/email" \
-            -H "Content-Type: application/json" \
-            -c "$COOKIE_JAR" -b "$COOKIE_JAR" \
-            -d '{"name":"CI Admin","email":"ci@dokploy.test","password":"CiTest1234!"}' \
-            | tee /tmp/signup.out
-          set +x
-
-          # Verify we got a session cookie
-          if ! grep -qE '(better-auth|auth)\.session' "$COOKIE_JAR"; then
-            echo "⚠️  No session cookie matched expected name; jar contents:"
-            cat "$COOKIE_JAR"
-          fi
-
-      # ── Create test resources ──────────────────────────────────────────────
-      - name: Create project, databases and applications
-        id: create
-        env:
-          BASE:   "http://localhost:${{ env.DOKPLOY_PORT }}"
-          COOKIE: ${{ steps.auth.outputs.cookie_jar }}
-        run: |
-          set -euo pipefail
-
-          # --- tRPC POST helper ---
-          trpc_mut() {
-            curl -sf -X POST "$BASE/api/trpc/$1" \
-              -H "Content-Type: application/json" \
-              -b "$COOKIE" -c "$COOKIE" \
-              -d "{\"json\":$2}"
-          }
-
-          # --- Project ---
-          PROJECT=$(trpc_mut project.create \
-            '{"name":"ci-upgrade-test","description":"CI upgrade integration test"}')
-          echo "project.create → $PROJECT"
-
-          # project.create in v0.29+ returns nested {project:{projectId}, environment:{environmentId}}
-          PROJECT_ID=$(echo "$PROJECT" | jq -r \
-            '.result.data.json.project.projectId // .result.data.json.projectId // empty')
-          ENV_ID=$(echo "$PROJECT" | jq -r \
-            '.result.data.json.environment.environmentId // empty')
-
-          if [ -z "$PROJECT_ID" ] || [ "$PROJECT_ID" = "null" ]; then
-            echo "❌ Could not extract projectId from project.create response:"
-            echo "$PROJECT" | jq .
-            exit 1
-          fi
-          if [ -z "$ENV_ID" ] || [ "$ENV_ID" = "null" ]; then
-            echo "❌ Could not extract environmentId — this version may not support environments."
-            echo "   project.create response: $PROJECT"
-            exit 1
-          fi
-
-          echo "project_id=$PROJECT_ID" >> "$GITHUB_OUTPUT"
-          echo "env_id=$ENV_ID"         >> "$GITHUB_OUTPUT"
-          echo "Detected PROJECT_ID=$PROJECT_ID  ENV_ID=$ENV_ID"
-
-          # --- PostgreSQL 15 ---
-          PG=$(trpc_mut postgres.create \
-            "{\"name\":\"ci-pg\",\"appName\":\"ci-pg-db\",\
-              \"databaseName\":\"cidb\",\"databaseUser\":\"ciuser\",\
-              \"databasePassword\":\"CiPg1pass\",\
-              \"dockerImage\":\"postgres:15\",\"environmentId\":\"$ENV_ID\"}")
-          echo "postgres.create → $PG"
-          PG_ID=$(echo "$PG" | jq -r '.result.data.json.postgresId')
-          # deploy (not start) — deploy creates the Swarm service; start only
-          # scales an already-deployed service and 500s on a fresh resource.
-          trpc_mut postgres.deploy "{\"postgresId\":\"$PG_ID\"}" > /dev/null
-          echo "pg_id=$PG_ID" >> "$GITHUB_OUTPUT"
-
-          # --- MongoDB 7.0 ---
-          MG=$(trpc_mut mongo.create \
-            "{\"name\":\"ci-mongo\",\"appName\":\"ci-mongo-db\",\
-              \"databaseName\":\"cidb\",\"databaseUser\":\"ciuser\",\
-              \"databasePassword\":\"CiMg1pass\",\
-              \"dockerImage\":\"mongo:7.0\",\"environmentId\":\"$ENV_ID\"}")
-          echo "mongo.create → $MG"
-          MG_ID=$(echo "$MG" | jq -r '.result.data.json.mongoId')
-          trpc_mut mongo.deploy "{\"mongoId\":\"$MG_ID\"}" > /dev/null
-          echo "mg_id=$MG_ID" >> "$GITHUB_OUTPUT"
-
-          # --- Docker-image application helper ---
-          make_app() {
-            local DISP_NAME=$1 APP_NAME=$2 IMAGE=$3
-            APP=$(trpc_mut application.create \
-              "{\"name\":\"$DISP_NAME\",\"appName\":\"$APP_NAME\",\"environmentId\":\"$ENV_ID\"}")
-            APP_ID=$(echo "$APP" | jq -r '.result.data.json.applicationId')
-            trpc_mut application.saveDockerProvider \
-              "{\"applicationId\":\"$APP_ID\",\"dockerImage\":\"$IMAGE\",\
-                \"username\":\"\",\"password\":\"\",\"registryUrl\":\"\"}" \
-              > /dev/null
-            trpc_mut application.deploy "{\"applicationId\":\"$APP_ID\"}" \
-              > /dev/null
-            echo "$APP_ID"
-          }
-
-          # Static site (nginx)
-          APP_STATIC=$(make_app "ci-static" "ci-static-app" "nginx:alpine")
-          echo "app_static_id=$APP_STATIC" >> "$GITHUB_OUTPUT"
-
-          # Node.js hello-world (echo server image — small, no args needed)
-          APP_NODE=$(make_app "ci-node" "ci-node-app" "ealen/echo-server:latest")
-          echo "app_node_id=$APP_NODE" >> "$GITHUB_OUTPUT"
-
-          # Go HTTP server (traefik/whoami is a tiny Go binary, port 80)
-          APP_GO=$(make_app "ci-go" "ci-go-app" "traefik/whoami:latest")
-          echo "app_go_id=$APP_GO" >> "$GITHUB_OUTPUT"
-
-          echo "✅ All resources created"
-
-      # ── Pre-upgrade health check ───────────────────────────────────────────
-      - name: Wait for all services → 'done' (pre-upgrade)
-        env:
-          BASE:          "http://localhost:${{ env.DOKPLOY_PORT }}"
-          COOKIE:        ${{ steps.auth.outputs.cookie_jar }}
-          PG_ID:         ${{ steps.create.outputs.pg_id }}
-          MG_ID:         ${{ steps.create.outputs.mg_id }}
-          APP_STATIC_ID: ${{ steps.create.outputs.app_static_id }}
-          APP_NODE_ID:   ${{ steps.create.outputs.app_node_id }}
-          APP_GO_ID:     ${{ steps.create.outputs.app_go_id }}
-        run: |
-          wait_done() {
-            local NAME=$1 ENDPOINT=$2 ID_KEY=$3 ID=$4 STATUS_KEY=$5
-            echo "Waiting for $NAME to reach 'done'..."
-            timeout 360 bash -c "
-              until [ \"\$(curl -sf -G '$BASE/api/trpc/$ENDPOINT' \
-                        --data-urlencode 'input={\"json\":{\"$ID_KEY\":\"$ID\"}}' \
-                        -b '$COOKIE' | \
-                        jq -r '.result.data.json.$STATUS_KEY // \"unknown\"')\" \
-                      = 'done' ]; do
-                sleep 5
-              done
-            "
-            echo "✅ $NAME is done"
-          }
-
-          wait_done postgres  postgres.one    postgresId    "$PG_ID"         applicationStatus
-          wait_done mongo     mongo.one       mongoId       "$MG_ID"         applicationStatus
-          wait_done static    application.one applicationId "$APP_STATIC_ID" applicationStatus
-          wait_done node-app  application.one applicationId "$APP_NODE_ID"   applicationStatus
-          wait_done go-app    application.one applicationId "$APP_GO_ID"     applicationStatus
-
-      - name: Assert Docker Swarm services healthy (pre-upgrade)
-        run: |
-          echo "=== docker service ls ==="
-          docker service ls
-
-          FAIL=$(docker service ls --format '{{.Name}} {{.Replicas}}' | \
-            grep -E '^ci-' | grep -v ' 1/1' || true)
-          if [ -n "$FAIL" ]; then
-            echo "❌ User services not healthy before upgrade:"
-            echo "$FAIL"
-            exit 1
-          fi
-          echo "✅ All user services healthy before upgrade"
-
-      # ── Upgrade ────────────────────────────────────────────────────────────
-      - name: Upgrade Dokploy to VERSION B (${{ matrix.pair.to }})
-        run: |
-          docker service update \
-            --image "${{ env.DOKPLOY_IMAGE }}:${{ matrix.pair.to }}" \
-            --force \
-            "${{ env.DOKPLOY_SERVICE }}"
-
-          echo "Waiting for service to converge on ${{ matrix.pair.to }}..."
-          timeout 240 bash -c '
-            until ! docker service inspect dokploy \
-                    --format "{{.UpdateStatus.State}}" 2>/dev/null \
-                  | grep -q "^updating$"; do
-              sleep 4
-            done
-            until docker service ls --filter name=dokploy \
-                    --format "{{.Name}} {{.Replicas}}" \
-                  | grep "^dokploy " | grep -q " 1/1"; do
-              sleep 4
-            done
-          '
-          echo "✅ Service running on ${{ matrix.pair.to }}"
-
-      - name: Wait for Dokploy API to respond post-upgrade
-        run: |
-          timeout 180 bash -c '
-            until curl -sf -o /dev/null \
-                       "http://localhost:${{ env.DOKPLOY_PORT }}"; do
-              sleep 3
-            done
-          '
-          echo "✅ Dokploy API is up after upgrade"
-
-      # ── Post-upgrade health check ──────────────────────────────────────────
-      - name: Verify all services still healthy (post-upgrade)
-        env:
-          BASE:          "http://localhost:${{ env.DOKPLOY_PORT }}"
-          COOKIE:        ${{ steps.auth.outputs.cookie_jar }}
-          PG_ID:         ${{ steps.create.outputs.pg_id }}
-          MG_ID:         ${{ steps.create.outputs.mg_id }}
-          APP_STATIC_ID: ${{ steps.create.outputs.app_static_id }}
-          APP_NODE_ID:   ${{ steps.create.outputs.app_node_id }}
-          APP_GO_ID:     ${{ steps.create.outputs.app_go_id }}
-        run: |
-          check_status() {
-            local NAME=$1 ENDPOINT=$2 ID_KEY=$3 ID=$4 STATUS_KEY=$5
-            STATUS=$(curl -sf -G "$BASE/api/trpc/$ENDPOINT" \
-              --data-urlencode "input={\"json\":{\"$ID_KEY\":\"$ID\"}}" \
-              -b "$COOKIE" | \
-              jq -r ".result.data.json.$STATUS_KEY // \"unknown\"")
-            if [ "$STATUS" != "done" ]; then
-              echo "❌ $NAME status after upgrade: $STATUS"
-              return 1
-            fi
-            echo "✅ $NAME: $STATUS"
-          }
-
-          check_status postgres  postgres.one    postgresId    "$PG_ID"         applicationStatus
-          check_status mongo     mongo.one       mongoId       "$MG_ID"         applicationStatus
-          check_status static    application.one applicationId "$APP_STATIC_ID" applicationStatus
-          check_status node-app  application.one applicationId "$APP_NODE_ID"   applicationStatus
-          check_status go-app    application.one applicationId "$APP_GO_ID"     applicationStatus
-
-          echo "=== docker service ls (post-upgrade) ==="
-          docker service ls
-
-          FAIL=$(docker service ls --format '{{.Name}} {{.Replicas}}' | \
-            grep -E '^ci-' | grep -v ' 1/1' || true)
-          if [ -n "$FAIL" ]; then
-            echo "❌ User services not healthy after upgrade:"
-            echo "$FAIL"
-            exit 1
-          fi
-          echo "✅ All services healthy after upgrade to ${{ matrix.pair.to }}"
-
-      # ── Diagnostics on failure ─────────────────────────────────────────────
-      - name: Dump state on failure
-        if: failure()
-        run: |
-          echo "=== docker service ls ===" && docker service ls || true
-          echo "=== dokploy service tasks ===" && \
-            docker service ps "${{ env.DOKPLOY_SERVICE }}" --no-trunc || true
-          echo "=== dokploy logs (last 200) ===" && \
-            docker service logs "${{ env.DOKPLOY_SERVICE }}" --tail 200 2>&1 || true
-          echo "=== install.sh tail ===" && \
-            tail -100 /tmp/install.sh 2>&1 || true
-          echo "=== signup response ===" && \
-            cat /tmp/signup.out 2>&1 || true
-          echo "=== disk usage ===" && df -h
-
-      # ── Job summary ────────────────────────────────────────────────────────
-      - name: Write job summary
-        if: always()
-        env:
-          JOB_STATUS: ${{ job.status }}
-        run: |
-          STATUS="$JOB_STATUS"
-          ICON="✅"; [ "$STATUS" != "success" ] && ICON="❌"
-          cat >> "$GITHUB_STEP_SUMMARY" <<EOF
-          ## ${ICON} ${{ matrix.pair.from }} → ${{ matrix.pair.to }}: ${STATUS^^}
-
-          | Service | Image |
-          |---------|-------|
-          | ci-pg-db | postgres:15 |
-          | ci-mongo-db | mongo:7.0 |
-          | ci-static-app | nginx:alpine (static site) |
-          | ci-node-app | ealen/echo-server (Node.js hello-world) |
-          | ci-go-app | traefik/whoami (Go HTTP server) |
-          EOF
@@ -46,4 +46,8 @@ yarn-error.log*
 .db

 .playwright-*
-.credentials
+.credentials
+dist/
+dist-server/
+.tanstack
+.env.*
@@ -1,2 +0,0 @@
-.env
-.env.local
@@ -1,6 +0,0 @@
-## Code style
- Don't write comments that restate what the code already says.
- Comment only the "why" when something isn't obvious: workarounds,
-  counterintuitive decisions, constraints from an external API.
- No section-divider comments like `// --- Helpers ---`.
- Don't leave comments describing the change you just made.
@@ -120,20 +120,12 @@ pnpm run docker:push

 ## Password Reset

-In the case you lost your password, you can reset the owner's password using the following command
+In the case you lost your password, you can reset it using the following command

 ```bash
-pnpm --filter=dokploy run reset-password
+pnpm run reset-password
 ```

-To reset the password of a specific user instead, pass their email as an argument
-
-```bash
-pnpm --filter=dokploy run reset-password user@example.com
-```
-
-Both commands print the new randomly generated password to the console.
-
 If you want to test the webhooks on development mode using localtunnel, make sure to install [`localtunnel`](https://localtunnel.app/)

 ```bash
@@ -31,7 +31,7 @@ WORKDIR /app
 # Set production
 ENV NODE_ENV=production

-RUN apt-get update && apt-get install -y tini curl unzip zip apache2-utils iproute2 rsync git-lfs && git lfs install && rm -rf /var/lib/apt/lists/*
+RUN apt-get update && apt-get install -y curl unzip zip apache2-utils iproute2 rsync git-lfs && git lfs install && rm -rf /var/lib/apt/lists/*

 # Copy only the necessary files
 COPY --from=build /prod/dokploy/.next ./.next
@@ -69,8 +69,5 @@ EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=5 \
  CMD curl -fs http://localhost:3000/api/trpc/settings.health || exit 1

-# tini reaps HEALTHCHECK child processes that Node (as PID 1) leaves defunct.
-ENTRYPOINT ["/usr/bin/tini", "--"]
-
 # Ejecutar node directamente: pnpm como wrapper queda residente (~100MB RSS)
  CMD ["sh", "-c", "node -r dotenv/config dist/wait-for-postgres.mjs && node -r dotenv/config dist/migration.mjs && exec node -r dotenv/config dist/server.mjs"]
@@ -0,0 +1,54 @@
+# syntax=docker/dockerfile:1
+FROM node:24.4.0-slim AS base
+ENV PNPM_HOME="/pnpm"
+ENV PATH="$PNPM_HOME:$PATH"
+RUN corepack enable
+RUN corepack prepare pnpm@10.22.0 --activate
+
+FROM base AS build
+COPY . /usr/src/app
+WORKDIR /usr/src/app
+
+RUN apt-get update && apt-get install -y python3 make g++ git pkg-config libsecret-1-dev && rm -rf /var/lib/apt/lists/*
+
+RUN --mount=type=cache,id=pnpm,target=/pnpm/store pnpm install --no-frozen-lockfile
+
+ENV NODE_ENV=production
+RUN pnpm --filter=dokploy-vite build
+RUN pnpm --filter=dokploy-vite build:server
+
+RUN pnpm --filter=dokploy-vite --prod deploy --legacy /prod/vite
+
+# Drop auto-installed optional peers that are never used at runtime
+# (better-auth peers next/prisma adapters; drizzle peers pglite/sqlite; prisma pulls effect/sharp)
+RUN cd /prod/vite/node_modules && rm -rf \
+	.pnpm/next@* .pnpm/@next+swc* \
+	.pnpm/prisma@* .pnpm/@prisma+* \
+	.pnpm/effect@* .pnpm/@electric-sql+* \
+	.pnpm/better-sqlite3@* \
+	.pnpm/sharp@* .pnpm/@img+* \
+	.pnpm/typescript@* \
+	next prisma typescript better-sqlite3 sharp
+
+FROM base AS runtime
+WORKDIR /app
+ENV NODE_ENV=production
+
+RUN apt-get update && apt-get install -y curl && rm -rf /var/lib/apt/lists/*
+
+# For a full production replacement of the official image, add the same
+# tooling block as ./Dockerfile (docker cli, nixpacks, railpack, pack, rclone)
+# — required for builds/deployments, not for serving the panel.
+
+COPY --from=build /prod/vite/node_modules ./node_modules
+COPY --from=build /prod/vite/package.json ./package.json
+COPY --from=build /usr/src/app/apps/vite/dist ./dist
+COPY --from=build /usr/src/app/apps/vite/dist-server ./dist-server
+COPY --from=build /usr/src/app/apps/dokploy/drizzle ./drizzle
+
+EXPOSE 3000
+
+HEALTHCHECK --interval=30s --timeout=5s --start-period=30s --retries=5 \
+	CMD curl -fs http://localhost:3000/api/health || exit 1
+
+CMD ["sh", "-c", "node dist-server/wait-for-postgres.mjs && node dist-server/migration.mjs && exec node dist-server/server.mjs"]
@@ -26,7 +26,6 @@ Dokploy includes multiple features to make your life easier.
 - **Templates**: Deploy open-source templates (Plausible, Pocketbase, Calcom, etc.) with a single click.
 - **Traefik Integration**: Automatically integrates with Traefik for routing and load balancing.
 - **Real-time Monitoring**: Monitor CPU, memory, storage, and network usage for every resource.
- **Logs & Metrics**: Ship container logs and host/container metrics to Grafana (Loki, Prometheus/Mimir), Datadog, New Relic, InfluxDB, VictoriaMetrics, Better Stack, Elasticsearch/OpenSearch, Splunk, or AWS CloudWatch, tagged by project/environment/application.
 - **Docker Management**: Easily deploy and manage Docker containers.
 - **CLI/API**: Manage your applications and databases using the command line or through the API.
 - **Notifications**: Get notified when your deployments succeed or fail (via Slack, Discord, Telegram, Email, etc.).
@@ -6,13 +6,3 @@ npm run dev
 ```
 open http://localhost:3000
 ```
-
-## Inngest
-
-This service uses Inngest to queue deployments. Run the local dev server in a separate terminal:
-
-```
-npm run dev:inngest
-```
-
-It syncs with the app at `http://localhost:4000/api/inngest` and serves its dashboard at `http://localhost:8288`.
@@ -4,18 +4,17 @@
 	"type": "module",
 	"scripts": {
 		"dev": "PORT=4000 tsx watch src/index.ts",
-		"dev:inngest": "npx --yes inngest-cli@1.9.0 dev -u http://localhost:4000/api/inngest --no-discovery",
 		"build": "rimraf dist && tsc --project tsconfig.json",
 		"start": "node dist/index.js",
 		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
-		"inngest": "3.54.0",
+		"inngest": "3.40.1",
 		"@dokploy/server": "workspace:*",
-		"@hono/node-server": "^1.19.15",
+		"@hono/node-server": "^1.14.3",
 		"@hono/zod-validator": "0.7.6",
 		"dotenv": "^16.4.5",
-		"hono": "^4.13.5",
+		"hono": "^4.11.7",
 		"pino": "9.4.0",
 		"pino-pretty": "11.2.2",
 		"react": "19.2.7",
@@ -29,7 +28,7 @@
 		"@types/react-dom": "^19.2.0",
 		"rimraf": "6.1.3",
 		"tsx": "^4.22.4",
-		"typescript": "^7.0.2"
+		"typescript": "^5.8.3"
 	},
 	"packageManager": "pnpm@10.22.0",
 	"engines": {
@@ -2,12 +2,13 @@
 	"compilerOptions": {
 		"target": "ESNext",
 		"module": "ESNext",
-		"moduleResolution": "bundler",
+		"moduleResolution": "Node",
 		"strict": true,
 		"skipLibCheck": true,
 		"outDir": "dist",
-		"rootDir": "./src",
 		"jsx": "react-jsx",
+		"jsxImportSource": "hono/jsx",
+		"baseUrl": ".",
 		"paths": {
 			"@/*": ["./*"],
 			"@dokploy/server/*": ["../../packages/server/src/*"]
@@ -1,23 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { z } from "zod";
-
-const revokeSessionSchema = z.object({
-	sessionId: z.string(),
-});
-
-describe("revokeSession input validation", () => {
-	it("accepts a valid session id", () => {
-		const result = revokeSessionSchema.safeParse({ sessionId: "abc123" });
-		expect(result.success).toBe(true);
-	});
-
-	it("rejects missing sessionId", () => {
-		const result = revokeSessionSchema.safeParse({});
-		expect(result.success).toBe(false);
-	});
-
-	it("rejects non-string sessionId", () => {
-		const result = revokeSessionSchema.safeParse({ sessionId: 123 });
-		expect(result.success).toBe(false);
-	});
-});
@@ -1,156 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockUpdateApplication = vi.hoisted(() => vi.fn());
-
-vi.mock("@dokploy/server/services/permission", () => {
-	return {
-		checkServicePermissionAndAccess: vi.fn(async () => undefined),
-	};
-});
-
-vi.mock("@dokploy/server/index", () => ({
-	IS_CLOUD: true,
-	hasValidLicense: vi.fn(async () => false),
-	updateApplication: mockUpdateApplication,
-	findApplicationById: vi.fn(async () => ({
-		applicationId: "app-1",
-		appName: "example-app",
-	})),
-}));
-
-vi.mock("@dokploy/server/lib/auth", () => ({
-	validateRequest: vi.fn(),
-}));
-
-vi.mock("@/server/api/utils/audit", () => ({
-	audit: vi.fn(async () => undefined),
-}));
-
-const { applicationRouter } = await import("@/server/api/routers/application");
-
-const caller = applicationRouter.createCaller({
-	session: { activeOrganizationId: "org-1" },
-	user: { id: "user-1", email: "user@example.com", role: "owner" },
-} as Parameters<typeof applicationRouter.createCaller>[0]);
-
-const providerChanges = [
-	{
-		name: "GitHub",
-		sourceType: "github",
-		save: () =>
-			caller.saveGithubProvider({
-				applicationId: "app-1",
-				repository: "example-repo",
-				owner: "example-owner",
-				branch: "main",
-				buildPath: "/",
-				githubId: "provider-1",
-				watchPaths: ["src/**"],
-				triggerType: "push",
-				enableSubmodules: false,
-			}),
-	},
-	{
-		name: "GitLab",
-		sourceType: "gitlab",
-		save: () =>
-			caller.saveGitlabProvider({
-				applicationId: "app-1",
-				gitlabRepository: "example-repo",
-				gitlabOwner: "example-owner",
-				gitlabBranch: "main",
-				gitlabBuildPath: "/",
-				gitlabId: "provider-1",
-				gitlabProjectId: 1,
-				gitlabPathNamespace: "example-owner/example-repo",
-			}),
-	},
-	{
-		name: "Bitbucket",
-		sourceType: "bitbucket",
-		save: () =>
-			caller.saveBitbucketProvider({
-				applicationId: "app-1",
-				bitbucketRepository: "example-repo",
-				bitbucketRepositorySlug: "example-repo",
-				bitbucketOwner: "example-owner",
-				bitbucketBranch: "main",
-				bitbucketBuildPath: "/",
-				bitbucketId: "provider-1",
-			}),
-	},
-	{
-		name: "Gitea",
-		sourceType: "gitea",
-		save: () =>
-			caller.saveGiteaProvider({
-				applicationId: "app-1",
-				giteaRepository: "example-repo",
-				giteaOwner: "example-owner",
-				giteaBranch: "main",
-				giteaBuildPath: "/",
-				giteaId: "provider-1",
-			}),
-	},
-	{
-		name: "Docker",
-		sourceType: "docker",
-		save: () =>
-			caller.saveDockerProvider({
-				applicationId: "app-1",
-				dockerImage: "nginx:alpine",
-				username: "",
-				password: "",
-				registryUrl: "",
-			}),
-	},
-	{
-		name: "custom Git",
-		sourceType: "git",
-		save: () =>
-			caller.saveGitProvider({
-				applicationId: "app-1",
-				customGitUrl: "https://example.com/repo.git",
-				customGitBranch: "main",
-				customGitBuildPath: "/",
-				customGitSSHKeyId: "key-1",
-				watchPaths: ["src/**"],
-				enableSubmodules: false,
-			}),
-	},
-	{
-		name: "disconnect Git provider",
-		sourceType: "github",
-		save: () => caller.disconnectGitProvider({ applicationId: "app-1" }),
-	},
-];
-
-describe("saving an application provider", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-	});
-
-	it.each(providerChanges)(
-		"keeps the status when $name settings change",
-		async ({ save, sourceType }) => {
-			for (const status of ["done", "running"]) {
-				mockUpdateApplication.mockClear();
-				let savedStatus = status;
-				mockUpdateApplication.mockImplementation(async (_id, update) => {
-					if (update.applicationStatus !== undefined) {
-						savedStatus = update.applicationStatus;
-					}
-				});
-
-				await save();
-
-				expect(savedStatus).toBe(status);
-				expect(mockUpdateApplication).toHaveBeenCalledTimes(1);
-				expect(mockUpdateApplication).toHaveBeenCalledWith(
-					"app-1",
-					expect.objectContaining({ sourceType }),
-				);
-			}
-		},
-	);
-});
@@ -1,6 +1,4 @@
-import type { Destination } from "@dokploy/server/services/destination";
 import { redactRcloneCredentials } from "@dokploy/server/utils/backups/redact";
-import { getS3Credentials } from "@dokploy/server/utils/backups/utils";
 import { describe, expect, it } from "vitest";

 describe("redactRcloneCredentials (#4621)", () => {
@@ -50,48 +48,3 @@ describe("redactRcloneCredentials (#4621)", () => {
 		expect(redacted).toContain("[REDACTED]");
 	});
 });
-
-describe("redactRcloneCredentials with getS3Credentials output (#5519)", () => {
-	const buildCommand = (accessKey: string, secretAccessKey: string) =>
-		`rclone rcat ${getS3Credentials({
-			accessKey,
-			secretAccessKey,
-			region: "us-west-001",
-			endpoint: "https://s3.us-west-001.backblazeb2.com",
-			provider: "Other",
-		} as Destination).join(" ")} :s3:bucket/file.gz`;
-
-	it.each([
-		[
-			"plain alphanumeric",
-			"001aaaabbbbccccdd0000000001",
-			"K001FAKEfakeFAKEfake",
-		],
-		[
-			"containing slashes",
-			"AKIAIOSFODNN7EXAMPLE",
-			"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
-		],
-		["containing spaces", "key with space", "secret with space"],
-		["containing quotes", "it's-a-key", `say "hi" it's`],
-		["containing shell metacharacters", "key$HOME", "sec;ret`id`&|\\x"],
-	])("redacts credentials %s", (_, accessKey, secretAccessKey) => {
-		const redacted = redactRcloneCredentials(
-			buildCommand(accessKey, secretAccessKey),
-		);
-		expect(redacted).toContain(
-			'--s3-access-key-id="[REDACTED]" --s3-secret-access-key="[REDACTED]" --s3-region=us-west-001',
-		);
-		expect(redacted).not.toContain(accessKey);
-		expect(redacted).not.toContain(secretAccessKey);
-		expect(redacted).toContain(":s3:bucket/file.gz");
-	});
-
-	it("redacts credentials embedded in an error string", () => {
-		const errorStr = `Error: Command failed: ${buildCommand("MYKEY", "MY/SECRET")}`;
-		const redacted = redactRcloneCredentials(errorStr);
-		expect(redacted).not.toContain("MYKEY");
-		expect(redacted).not.toContain("MY/SECRET");
-		expect(redacted).toContain("[REDACTED]");
-	});
-});
@@ -1,82 +0,0 @@
-import { spawnSync } from "node:child_process";
-import { createRestartSafeBackupCommand } from "@dokploy/server/utils/volume-backups/backup";
-import { describe, expect, it } from "vitest";
-
-const runCommand = (command: string) =>
-	spawnSync("bash", ["-c", command], {
-		encoding: "utf8",
-	});
-
-const outputLines = (stdout: string) =>
-	stdout
-		.trim()
-		.split("\n")
-		.filter((line) => line.length > 0);
-
-describe("createRestartSafeBackupCommand", () => {
-	it("restarts the service and preserves the backup error status", () => {
-		const result = runCommand(
-			createRestartSafeBackupCommand({
-				stopCommand: 'echo "stop"',
-				backupCommand: 'echo "backup"; exit 23',
-				startCommand: 'echo "start"',
-				uploadCommand: 'echo "upload"',
-			}),
-		);
-
-		expect(result.status).toBe(23);
-		expect(outputLines(result.stdout)).toEqual(["stop", "backup", "start"]);
-	});
-
-	it("preserves the backup error status when the restart also fails", () => {
-		const result = runCommand(
-			createRestartSafeBackupCommand({
-				stopCommand: 'echo "stop"',
-				backupCommand: 'echo "backup"; exit 23',
-				startCommand: 'echo "start"; exit 17',
-				uploadCommand: 'echo "upload"',
-			}),
-		);
-
-		expect(result.status).toBe(23);
-		expect(outputLines(result.stdout)).toEqual([
-			"stop",
-			"backup",
-			"start",
-			"Service restart also failed with exit code 17",
-		]);
-	});
-
-	it("returns the restart error status when the backup succeeds", () => {
-		const result = runCommand(
-			createRestartSafeBackupCommand({
-				stopCommand: 'echo "stop"',
-				backupCommand: 'echo "backup"',
-				startCommand: 'echo "start"; exit 17',
-				uploadCommand: 'echo "upload"',
-			}),
-		);
-
-		expect(result.status).toBe(17);
-		expect(outputLines(result.stdout)).toEqual(["stop", "backup", "start"]);
-	});
-
-	it("uploads only after a successful backup and service restart", () => {
-		const result = runCommand(
-			createRestartSafeBackupCommand({
-				stopCommand: 'echo "stop"',
-				backupCommand: 'echo "backup"',
-				startCommand: 'echo "start"',
-				uploadCommand: 'echo "upload"',
-			}),
-		);
-
-		expect(result.status).toBe(0);
-		expect(outputLines(result.stdout)).toEqual([
-			"stop",
-			"backup",
-			"start",
-			"upload",
-		]);
-	});
-});
@@ -1,14 +0,0 @@
-import { describe, it, expect } from "vitest";
-
-describe("Remote Server Action Tooltips", () => {
-	it("should close the tooltip when the dialog trigger is clicked", () => {
-		// Note: The UI layer in this project is not currently tested with DOM simulation tools
-		// like React Testing Library or JSDOM.
-		//
-		// The structural fix implemented (passing TooltipTrigger asChild -> DialogTrigger asChild)
-		// inherently guarantees that Radix UI's composeEventHandlers properly propagates the
-		// onPointerDown event to dismiss the tooltip simultaneously as the dialog opens.
-
-		expect(true).toBe(true);
-	});
-});
@@ -1,123 +0,0 @@
-import { createCommand } from "@dokploy/server/utils/builders/compose";
-import { describe, expect, it } from "vitest";
-
-const base = {
-	composeType: "docker-compose" as const,
-	appName: "compose-app",
-	sourceType: "github" as const,
-	command: "",
-};
-
-describe("compose createCommand --project-directory", () => {
-	it("pins --project-directory to the code dir when composePath is nested", () => {
-		const cmd = createCommand(
-			{ ...base, composePath: "./deploy/docker-compose.yml" } as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).toContain(
-			"--project-directory /etc/dokploy/compose/compose-app/code",
-		);
-		expect(cmd).toContain("-f ./deploy/docker-compose.yml");
-	});
-
-	it("omits --project-directory when no projectPath is passed", () => {
-		const cmd = createCommand({
-			...base,
-			composePath: "./deploy/docker-compose.yml",
-		} as any);
-
-		expect(cmd).not.toContain("--project-directory");
-	});
-
-	it("does not add --project-directory to stack deploy (unsupported flag)", () => {
-		const cmd = createCommand(
-			{
-				...base,
-				composeType: "stack",
-				composePath: "./deploy/docker-compose.yml",
-			} as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).not.toContain("--project-directory");
-		expect(cmd.startsWith("stack deploy")).toBe(true);
-	});
-
-	it("keeps raw sourceType resolving from the code dir (root docker-compose.yml)", () => {
-		const cmd = createCommand(
-			{ ...base, sourceType: "raw", composePath: "docker-compose.yml" } as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).toContain(
-			"--project-directory /etc/dokploy/compose/compose-app/code",
-		);
-		expect(cmd).toContain("-f docker-compose.yml");
-	});
-
-	it("resolves build.context against the compose file's own directory when there are no mounts", () => {
-		const cmd = createCommand({
-			...base,
-			composePath: "./backend/docker-compose.yml",
-		} as any);
-
-		expect(cmd).not.toContain("--project-directory");
-		expect(cmd).toContain("-f ./backend/docker-compose.yml");
-	});
-});
-
-describe("compose createCommand --env-file", () => {
-	it("points --env-file at the generated .env next to a nested compose file", () => {
-		const cmd = createCommand(
-			{
-				...base,
-				composePath: "./deploy/docker-compose.yml",
-				createEnvFile: true,
-			} as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).toContain("--env-file deploy/.env");
-		expect(cmd).toContain(
-			"--project-directory /etc/dokploy/compose/compose-app/code",
-		);
-	});
-
-	it("omits --env-file when createEnvFile is disabled", () => {
-		const cmd = createCommand(
-			{ ...base, composePath: "./deploy/docker-compose.yml" } as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).not.toContain("--env-file");
-	});
-
-	it("uses the code-root .env for raw sourceType", () => {
-		const cmd = createCommand(
-			{
-				...base,
-				sourceType: "raw",
-				composePath: "docker-compose.yml",
-				createEnvFile: true,
-			} as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).toContain("--env-file .env");
-	});
-
-	it("does not add --env-file to stack deploy (unsupported flag)", () => {
-		const cmd = createCommand(
-			{
-				...base,
-				composeType: "stack",
-				composePath: "./deploy/docker-compose.yml",
-				createEnvFile: true,
-			} as any,
-			"/etc/dokploy/compose/compose-app/code",
-		);
-
-		expect(cmd).not.toContain("--env-file");
-	});
-});
@@ -1,44 +0,0 @@
-import { createCommand } from "@dokploy/server/utils/builders/compose";
-import { describe, expect, it } from "vitest";
-
-const base = {
-	composeType: "docker-compose" as const,
-	appName: "compose-app",
-	sourceType: "github" as const,
-	composePath: "./docker-compose.yml",
-	command: "",
-};
-
-describe("compose createCommand --pull always", () => {
-	it("adds --pull always when pullImages is enabled", () => {
-		const cmd = createCommand({ ...base, pullImages: true } as any);
-
-		expect(cmd).toContain("up -d --build --remove-orphans --pull always");
-	});
-
-	it("omits --pull when pullImages is disabled", () => {
-		const cmd = createCommand({ ...base, pullImages: false } as any);
-
-		expect(cmd).not.toContain("--pull");
-	});
-
-	it("does not add --pull to stack deploy", () => {
-		const cmd = createCommand({
-			...base,
-			composeType: "stack",
-			pullImages: true,
-		} as any);
-
-		expect(cmd).not.toContain("--pull");
-	});
-
-	it("leaves a custom command untouched", () => {
-		const cmd = createCommand({
-			...base,
-			command: "compose -p compose-app up -d",
-			pullImages: true,
-		} as any);
-
-		expect(cmd).toBe("compose -p compose-app up -d");
-	});
-});
@@ -33,7 +33,6 @@ const makeDomain = (serviceName: string) =>
 		https: false,
 		uniqueConfigKey: 1,
 		port: 3000,
-		enabled: true,
 	}) as any;

 // If the returned shell fragment is safe, parse() yields only string tokens.
@@ -1,306 +0,0 @@
-import type { Compose } from "@dokploy/server/services/compose";
-import type { Domain } from "@dokploy/server/services/domain";
-import { addDomainToCompose } from "@dokploy/server/utils/docker/domain";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// With sourceType "raw", addDomainToCompose parses compose.composeFile
-// directly instead of reading from disk, so baseCompose exposes it as a
-// getter that always reflects the current composeYaml for each test case.
-const baseComposeYaml = `
-services:
-  frigate:
-    image: frigate
-`;
-let composeYaml = baseComposeYaml;
-
-const baseCompose = {
-	appName: "test-app",
-	composeType: "docker-compose",
-	composePath: "docker-compose.yml",
-	sourceType: "raw",
-	serverId: null,
-	isolatedDeployment: false,
-	randomize: false,
-	suffix: "",
-	get composeFile() {
-		return composeYaml;
-	},
-} as unknown as Compose;
-
-const baseDomain: Domain = {
-	host: "frigate.example.com",
-	port: 8971,
-	customEntrypoint: null,
-	https: false,
-	uniqueConfigKey: 1,
-	customCertResolver: null,
-	certificateType: "none",
-	applicationId: "",
-	composeId: "compose-id",
-	domainType: "compose",
-	serviceName: "frigate",
-	domainId: "domain-id",
-	path: "/",
-	createdAt: "",
-	previewDeploymentId: "",
-	internalPath: "/",
-	stripPath: false,
-	middlewares: null,
-	forwardAuthEnabled: false,
-	enabled: true,
-};
-
-const serviceLabels = (
-	result: Awaited<ReturnType<typeof addDomainToCompose>>,
-) => (result?.services?.frigate?.labels as string[] | undefined) ?? [];
-
-describe("addDomainToCompose enabled filtering", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-		composeYaml = baseComposeYaml;
-	});
-
-	it("generates traefik labels for an enabled domain", async () => {
-		const result = await addDomainToCompose(baseCompose, [
-			{ ...baseDomain, enabled: true },
-		]);
-
-		const labels = serviceLabels(result);
-		expect(labels).toContain("traefik.enable=true");
-		expect(labels.some((l) => l.includes("Host(`frigate.example.com`)"))).toBe(
-			true,
-		);
-	});
-
-	it("skips a disabled domain entirely (no traefik labels)", async () => {
-		const result = await addDomainToCompose(baseCompose, [
-			{ ...baseDomain, enabled: false },
-		]);
-
-		const labels = serviceLabels(result);
-		expect(labels).not.toContain("traefik.enable=true");
-		expect(labels.some((l) => l.includes("Host(`frigate.example.com`)"))).toBe(
-			false,
-		);
-	});
-
-	it.each([
-		[
-			"docker-compose",
-			`services:
-  frigate:
-    image: frigate
-    labels:
-      - traefik.enable=true
-      - traefik.http.routers.test-app-1-web.rule=Host(\`frigate.example.com\`)
-      - traefik.http.services.test-app-1-web.loadbalancer.server.port=8971
-      - traefik.http.middlewares.stripprefix-test-app-1.stripprefix.prefixes=/api
-      - custom.label=preserved
-`,
-		],
-		[
-			"stack",
-			`services:
-  frigate:
-    image: frigate
-    deploy:
-      labels:
-        - traefik.enable=true
-        - traefik.http.routers.test-app-1-web.rule=Host(\`frigate.example.com\`)
-        - traefik.http.services.test-app-1-web.loadbalancer.server.port=8971
-        - traefik.http.middlewares.stripprefix-test-app-1.stripprefix.prefixes=/api
-        - custom.label=preserved
-`,
-		],
-	] as const)(
-		"removes stale labels for a disabled domain from %s rebuilds",
-		async (composeType, staleComposeYaml) => {
-			composeYaml = staleComposeYaml;
-
-			const result = await addDomainToCompose({ ...baseCompose, composeType }, [
-				{ ...baseDomain, enabled: false },
-			]);
-
-			const service = result?.services?.frigate;
-			const labels =
-				composeType === "docker-compose"
-					? service?.labels
-					: service?.deploy?.labels;
-			expect(labels).toContain("custom.label=preserved");
-			expect(
-				(labels as string[]).some((label) => label.includes("test-app-1")),
-			).toBe(false);
-		},
-	);
-
-	it.each([
-		[
-			"docker-compose",
-			`services:
-  legacy:
-    image: frigate
-    labels:
-      - traefik.http.routers.test-app-1-web.rule=Host(\`frigate.example.com\`)
-      - traefik.http.services.test-app-1-web.loadbalancer.server.port=8971
-      - custom.label=preserved
-  frigate:
-    image: frigate
-`,
-		],
-		[
-			"stack",
-			`services:
-  legacy:
-    image: frigate
-    deploy:
-      labels:
-        - traefik.http.routers.test-app-1-web.rule=Host(\`frigate.example.com\`)
-        - traefik.http.services.test-app-1-web.loadbalancer.server.port=8971
-        - custom.label=preserved
-  frigate:
-    image: frigate
-`,
-		],
-	] as const)(
-		"removes stale labels from the previous %s service after reassignment",
-		async (composeType, staleComposeYaml) => {
-			composeYaml = staleComposeYaml;
-
-			const result = await addDomainToCompose({ ...baseCompose, composeType }, [
-				{ ...baseDomain, serviceName: "frigate", enabled: false },
-			]);
-
-			const previousService = result?.services?.legacy;
-			const labels =
-				composeType === "docker-compose"
-					? previousService?.labels
-					: previousService?.deploy?.labels;
-			expect(labels).toContain("custom.label=preserved");
-			expect(
-				(labels as string[]).some((label) => label.includes("test-app-1")),
-			).toBe(false);
-		},
-	);
-
-	it.each([
-		[
-			"docker-compose",
-			`services:
-  frigate:
-    image: frigate
-    labels:
-      traefik.enable: "true"
-      traefik.http.routers.test-app-1-web.rule: Host(\`frigate.example.com\`)
-      traefik.http.services.test-app-1-web.loadbalancer.server.port: 8971
-      traefik.http.middlewares.stripprefix-test-app-1.stripprefix.prefixes: /api
-      custom.label: preserved
-`,
-		],
-		[
-			"stack",
-			`services:
-  frigate:
-    image: frigate
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.test-app-1-web.rule: Host(\`frigate.example.com\`)
-        traefik.http.services.test-app-1-web.loadbalancer.server.port: 8971
-        traefik.http.middlewares.stripprefix-test-app-1.stripprefix.prefixes: /api
-        custom.label: preserved
-`,
-		],
-	] as const)(
-		"removes stale mapping labels for a disabled domain from %s rebuilds",
-		async (composeType, staleComposeYaml) => {
-			composeYaml = staleComposeYaml;
-
-			const result = await addDomainToCompose({ ...baseCompose, composeType }, [
-				{ ...baseDomain, enabled: false },
-			]);
-
-			const service = result?.services?.frigate;
-			const labels =
-				composeType === "docker-compose"
-					? service?.labels
-					: service?.deploy?.labels;
-			expect(labels).toMatchObject({ "custom.label": "preserved" });
-			expect(
-				Object.keys(labels ?? {}).some((label) => label.includes("test-app-1")),
-			).toBe(false);
-		},
-	);
-
-	it.each([
-		[
-			"docker-compose",
-			`services:
-  frigate:
-    image: frigate
-    labels:
-      traefik.enable: "true"
-      traefik.http.routers.test-app-1-web.rule: Host(\`old.example.com\`)
-      traefik.http.services.test-app-1-web.loadbalancer.server.port: 8971
-      custom.label: preserved
-`,
-			"traefik.docker.network",
-		],
-		[
-			"stack",
-			`services:
-  frigate:
-    image: frigate
-    deploy:
-      labels:
-        traefik.enable: "true"
-        traefik.http.routers.test-app-1-web.rule: Host(\`old.example.com\`)
-        traefik.http.services.test-app-1-web.loadbalancer.server.port: 8971
-        custom.label: preserved
-`,
-			"traefik.swarm.network",
-		],
-	] as const)(
-		"regenerates routing in mapping labels for an enabled domain in %s",
-		async (composeType, mappingComposeYaml, networkLabel) => {
-			composeYaml = mappingComposeYaml;
-
-			const result = await addDomainToCompose({ ...baseCompose, composeType }, [
-				{ ...baseDomain, enabled: true },
-			]);
-
-			const service = result?.services?.frigate;
-			const labels =
-				composeType === "docker-compose"
-					? service?.labels
-					: service?.deploy?.labels;
-			expect(labels).toMatchObject({
-				"custom.label": "preserved",
-				"traefik.enable": "true",
-				[networkLabel]: "dokploy-network",
-				"traefik.http.routers.test-app-1-web.rule":
-					"Host(`frigate.example.com`)",
-				"traefik.http.services.test-app-1-web.loadbalancer.server.port": "8971",
-			});
-		},
-	);
-
-	it("emits labels only for the enabled domain when both are present", async () => {
-		const result = await addDomainToCompose(baseCompose, [
-			{ ...baseDomain, host: "enabled.example.com", enabled: true },
-			{
-				...baseDomain,
-				host: "disabled.example.com",
-				uniqueConfigKey: 2,
-				enabled: false,
-			},
-		]);
-
-		const labels = serviceLabels(result);
-		expect(labels.some((l) => l.includes("Host(`enabled.example.com`)"))).toBe(
-			true,
-		);
-		expect(labels.some((l) => l.includes("Host(`disabled.example.com`)"))).toBe(
-			false,
-		);
-	});
-});
@@ -35,7 +35,6 @@ describe("Host rule format regression tests", () => {
 		customEntrypoint: null,
 		middlewares: null,
 		forwardAuthEnabled: false,
-		enabled: true,
 	};

 	describe("Host rule format validation", () => {
@@ -24,7 +24,6 @@ describe("createDomainLabels", () => {
 		stripPath: false,
 		middlewares: null,
 		forwardAuthEnabled: false,
-		enabled: true,
 	};

 	it("should create basic labels for web entrypoint", async () => {
@@ -1,133 +0,0 @@
-import { addDomainToCompose } from "@dokploy/server/utils/docker/domain";
-import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
-import { describe, expect, it, vi } from "vitest";
-
-vi.mock("@dokploy/server/utils/process/execAsync", async (importOriginal) => ({
-	...(await importOriginal<
-		typeof import("@dokploy/server/utils/process/execAsync")
-	>()),
-	execAsyncRemote: vi.fn(),
-}));
-
-describe("raw remote compose conversion (#4794)", () => {
-	it("uses the saved raw source and preserves supported mount syntax", async () => {
-		vi.mocked(execAsyncRemote).mockResolvedValue({
-			stdout: "services:\n  test:\n    image: alpine:latest\n",
-			stderr: "",
-		});
-
-		const compose = {
-			appName: "raw-stack",
-			composeFile: `
-services:
-  test:
-    image: alpine:latest
-    volumes:
-      - type: tmpfs
-        target: /scratch
-      - type: volume
-        source: test-data
-        target: /data
-    tmpfs:
-      - /cache
-volumes:
-  test-data:
-`,
-			composeId: "compose-1",
-			name: "raw-stack",
-			composePath: "./docker-compose.yml",
-			composeType: "stack",
-			environment: {
-				environmentId: "env-1",
-				name: "production",
-				projectId: "project-1",
-				project: { name: "shop", organizationId: "org-1" },
-			},
-			isolatedDeployment: false,
-			isolatedDeploymentsVolume: false,
-			randomize: false,
-			serverId: "remote-server",
-			sourceType: "raw",
-			suffix: "",
-		} as unknown as Parameters<typeof addDomainToCompose>[0];
-
-		const converted = await addDomainToCompose(compose, []);
-
-		expect(converted?.services?.test?.volumes).toEqual([
-			{ type: "tmpfs", target: "/scratch" },
-			{
-				type: "volume",
-				source: "test-data",
-				target: "/data",
-			},
-		]);
-		expect(converted?.services?.test?.tmpfs).toEqual(["/cache"]);
-		expect(converted?.services?.test?.labels).toEqual(
-			expect.arrayContaining([
-				"dokploy.organization.id=org-1",
-				"dokploy.project=shop",
-				"dokploy.service=test",
-			]),
-		);
-		expect(converted?.services?.test?.deploy?.labels).toEqual(
-			expect.arrayContaining(["dokploy.organization.id=org-1"]),
-		);
-		expect(execAsyncRemote).not.toHaveBeenCalled();
-	});
-
-	it("escapes `$` in the Dokploy label values so compose keeps them literal", async () => {
-		const compose = {
-			appName: "dollar-stack",
-			composeFile: `
-services:
-  mapped:
-    image: alpine:latest
-    labels:
-      custom: keep
-    deploy:
-      labels:
-        custom: keep
-  listed:
-    image: alpine:latest
-    labels:
-      - custom=keep
-`,
-			composeId: "compose-1",
-			name: "app $DB_PASSWORD",
-			composePath: "./docker-compose.yml",
-			composeType: "stack",
-			environment: {
-				environmentId: "env-1",
-				name: "env ${HOME}",
-				projectId: "project-1",
-				project: { name: "Budget $100", organizationId: "org-1" },
-			},
-			isolatedDeployment: false,
-			isolatedDeploymentsVolume: false,
-			randomize: false,
-			serverId: null,
-			sourceType: "raw",
-			suffix: "",
-		} as unknown as Parameters<typeof addDomainToCompose>[0];
-
-		const converted = await addDomainToCompose(compose, []);
-		const escaped = {
-			"dokploy.project": "Budget $$100",
-			"dokploy.environment": "env $${HOME}",
-			"dokploy.application": "app $$DB_PASSWORD",
-		};
-
-		const mapped = converted?.services?.mapped;
-		expect(mapped?.labels).toMatchObject({ custom: "keep", ...escaped });
-		expect(mapped?.deploy?.labels).toMatchObject({
-			custom: "keep",
-			...escaped,
-		});
-		const listed = converted?.services?.listed;
-		const asList = Object.entries(escaped).map(([k, v]) => `${k}=${v}`);
-		expect(listed?.labels).toEqual(
-			expect.arrayContaining(["custom=keep", ...asList]),
-		);
-		expect(listed?.deploy?.labels).toEqual(expect.arrayContaining(asList));
-	});
-});
@@ -32,9 +32,6 @@ const cases: Record<string, string> = {
 	APOSTROPHE: "it's a test",
 	UNICODE: "héllo wörld 日本語 🚀",
 	MULTILINE_PEM: "-----BEGIN KEY-----\nabc123\n-----END KEY-----",
-	APP_URL: "https://example.com",
-	ASSET_URL: "https://example.com",
-	DB_HOST: "localhost",
 };

 // How each value must be typed in the UI so the (unchanged) dotenv input
@@ -49,21 +46,9 @@ const inputEncoding: Record<string, string> = {
 	APOSTROPHE: "it's a test",
 	UNICODE: "héllo wörld 日本語 🚀",
 	MULTILINE_PEM: '"-----BEGIN KEY-----\nabc123\n-----END KEY-----"',
-	APP_URL: "https://example.com",
-	ASSET_URL: '"${APP_URL}"',
-	DB_HOST: '"${UNDEFINED_HOST:-localhost}"',
 };

-const hasDocker = () => {
-	try {
-		execFileSync("docker", ["info"], { stdio: "ignore" });
-		return true;
-	} catch {
-		return false;
-	}
-};
-
-describe.skipIf(!hasDocker())("getCreateEnvFileCommand", () => {
+describe("getCreateEnvFileCommand", () => {
 	it("writes special environment values that Docker Compose reads back literally", () => {
 		mkdirSync(codePath, { recursive: true });

@@ -1,113 +0,0 @@
-import type { Compose, ComposeSpecification } from "@dokploy/server";
-import {
-	addAppNameToPreventCollision,
-	addSuffixToAllProperties,
-} from "@dokploy/server";
-import { addDomainToCompose } from "@dokploy/server/utils/docker/domain";
-import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
-import { expect, test, vi } from "vitest";
-import { stringify } from "yaml";
-import composeSpec from "../../../components/shared/compose-spec.json";
-
-vi.mock("@dokploy/server/utils/process/execAsync", async (importOriginal) => ({
-	...(await importOriginal<
-		typeof import("@dokploy/server/utils/process/execAsync")
-	>()),
-	execAsyncRemote: vi.fn(),
-}));
-
-const modelCompose = {
-	services: {
-		app: {
-			image: "my-chat-app",
-			models: ["llm"],
-		},
-		worker: {
-			image: "my-worker",
-			models: {
-				llm: {
-					endpoint_var: "LLM_URL",
-					model_var: "LLM_MODEL",
-				},
-			},
-		},
-	},
-	models: {
-		llm: {
-			model: "ai/smollm2",
-			context_size: 2048,
-			runtime_flags: ["--verbose"],
-		},
-	},
-} satisfies ComposeSpecification;
-
-test("bundled compose schema declares models", () => {
-	expect(composeSpec.properties).toHaveProperty("models");
-	expect(composeSpec.definitions.model.required).toEqual(["model"]);
-	expect(composeSpec.definitions.service.properties).toHaveProperty("models");
-});
-
-test("suffixing does not rename model identifiers or drop model config", () => {
-	const updated = addSuffixToAllProperties(
-		structuredClone(modelCompose),
-		"testhash",
-	);
-
-	expect(updated.models?.llm?.model).toBe("ai/smollm2");
-	expect(updated.models?.llm?.context_size).toBe(2048);
-	expect(updated.models?.llm?.runtime_flags).toEqual(["--verbose"]);
-	expect(updated.services?.["app-testhash"]?.models).toEqual(["llm"]);
-	expect(updated.services?.["worker-testhash"]?.models).toEqual({
-		llm: {
-			endpoint_var: "LLM_URL",
-			model_var: "LLM_MODEL",
-		},
-	});
-	expect(updated.services).not.toHaveProperty("app");
-	expect(updated.models).not.toHaveProperty("llm-testhash");
-});
-
-test("isolated deployment preserves model identifiers", () => {
-	const updated = addAppNameToPreventCollision(
-		structuredClone(modelCompose),
-		"chat-app",
-		false,
-	);
-
-	expect(updated.models?.llm?.model).toBe("ai/smollm2");
-	expect(updated.services?.app?.models).toEqual(["llm"]);
-	expect(updated.services?.worker?.models).toEqual({
-		llm: {
-			endpoint_var: "LLM_URL",
-			model_var: "LLM_MODEL",
-		},
-	});
-});
-
-test("raw remote compose conversion preserves models", async () => {
-	const converted = await addDomainToCompose(
-		{
-			appName: "chat-app",
-			composeFile: stringify(modelCompose, { lineWidth: 1000 }),
-			composePath: "./docker-compose.yml",
-			composeType: "docker-compose",
-			isolatedDeployment: false,
-			isolatedDeploymentsVolume: false,
-			randomize: false,
-			serverId: "remote-server",
-			sourceType: "raw",
-			suffix: "",
-		} as unknown as Compose,
-		[],
-	);
-
-	expect(execAsyncRemote).not.toHaveBeenCalled();
-	expect(converted?.models?.llm?.model).toBe("ai/smollm2");
-	expect(converted?.services?.app?.models).toEqual(["llm"]);
-	expect(converted?.services?.worker?.models).toEqual({
-		llm: {
-			endpoint_var: "LLM_URL",
-			model_var: "LLM_MODEL",
-		},
-	});
-});
@@ -1,66 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockUpdateCompose = vi.hoisted(() => vi.fn());
-
-vi.mock("@dokploy/server/services/permission", () => ({
-	checkServicePermissionAndAccess: vi.fn(async () => undefined),
-}));
-
-vi.mock("@dokploy/server", () => ({
-	IS_CLOUD: true,
-	findComposeById: vi.fn(async () => ({
-		composeId: "compose-1",
-		name: "example-compose",
-	})),
-	updateCompose: mockUpdateCompose,
-}));
-
-vi.mock("@dokploy/server/lib/auth", () => ({
-	validateRequest: vi.fn(),
-}));
-
-vi.mock("@/server/api/utils/audit", () => ({
-	audit: vi.fn(async () => undefined),
-}));
-
-vi.mock("@/server/queues/queueSetup", () => ({
-	cleanQueuesByCompose: vi.fn(),
-	killDockerBuild: vi.fn(),
-	myQueue: {
-		add: vi.fn(),
-	},
-}));
-
-const { composeRouter } = await import("@/server/api/routers/compose");
-
-const caller = composeRouter.createCaller({
-	session: { activeOrganizationId: "org-1" },
-	user: { id: "user-1", email: "user@example.com", role: "owner" },
-} as Parameters<typeof composeRouter.createCaller>[0]);
-
-describe("saving a compose provider", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-	});
-
-	it.each(["done", "running"])(
-		"keeps the %s status when disconnecting a Git provider",
-		async (status) => {
-			let savedStatus = status;
-			mockUpdateCompose.mockImplementation(async (_id, update) => {
-				if (update.composeStatus !== undefined) {
-					savedStatus = update.composeStatus;
-				}
-			});
-
-			await caller.disconnectGitProvider({ composeId: "compose-1" });
-
-			expect(savedStatus).toBe(status);
-			expect(mockUpdateCompose).toHaveBeenCalledTimes(1);
-			expect(mockUpdateCompose).toHaveBeenCalledWith(
-				"compose-1",
-				expect.objectContaining({ sourceType: "github" }),
-			);
-		},
-	);
-});
@@ -12,8 +12,6 @@ const mocks = vi.hoisted(() => ({
 	queueAdd: vi.fn(),
 	verify: vi.fn(),
 	shouldDeploy: vi.fn(),
-	createPreviewDeployment: vi.fn(),
-	findPreviewDeploymentByApplicationId: vi.fn(),
 }));

 vi.mock("drizzle-orm", () => ({
@@ -66,11 +64,10 @@ vi.mock("@dokploy/server", () => ({
 	IS_CLOUD: false,
 	shouldDeploy: mocks.shouldDeploy,
 	checkUserRepositoryPermissions: vi.fn(),
-	createPreviewDeployment: mocks.createPreviewDeployment,
+	createPreviewDeployment: vi.fn(),
 	createSecurityBlockedComment: vi.fn(),
 	findGithubById: vi.fn(),
-	findPreviewDeploymentByApplicationId:
-		mocks.findPreviewDeploymentByApplicationId,
+	findPreviewDeploymentByApplicationId: vi.fn(),
 	findPreviewDeploymentsByPullRequestId: vi.fn(),
 	getBitbucketHeaders: vi.fn(() => ({})),
 	removePreviewDeployment: vi.fn(),
@@ -324,157 +321,3 @@ describe("GitHub app webhook auto-deploy", () => {
 		expect(res.json).toHaveBeenCalledWith({ message: "No apps to deploy" });
 	});
 });
-
-describe("GitHub app webhook preview deployments", () => {
-	const createApplication = (
-		overrides: Record<string, unknown> = {},
-	): Record<string, unknown> => ({
-		applicationId: "application-id",
-		name: "my-app",
-		serverId: null,
-		previewLabels: [],
-		previewLimit: 3,
-		previewDeployments: [],
-		previewRequireCollaboratorPermissions: false,
-		...overrides,
-	});
-
-	const createPreviewDeployments = (total: number) =>
-		Array.from({ length: total }, (_, index) => ({
-			previewDeploymentId: `existing-preview-${index}`,
-		}));
-
-	const createPullRequestRequest = (action: string) =>
-		({
-			headers: {
-				"x-hub-signature-256": "sha256=test-signature",
-				"x-github-event": "pull_request",
-			},
-			body: {
-				installation: {
-					id: 12345,
-				},
-				action,
-				pull_request: {
-					id: 987,
-					number: 42,
-					title: "feat: add preview",
-					html_url: "https://github.com/agentHits/dokploy/pull/42",
-					labels: [],
-					user: {
-						login: "agentHits",
-					},
-					head: {
-						ref: "feature",
-						sha: "abc123",
-					},
-					base: {
-						ref: "main",
-					},
-				},
-				repository: {
-					name: "dokploy",
-					owner: {
-						login: "agentHits",
-					},
-				},
-			},
-		}) as unknown as NextApiRequest;
-
-	beforeEach(() => {
-		vi.clearAllMocks();
-		mocks.githubFindFirst.mockResolvedValue({
-			githubId: "github-provider-id",
-			githubInstallationId: 12345,
-			githubWebhookSecret: "webhook-secret",
-		});
-		mocks.verify.mockResolvedValue(true);
-		mocks.queueAdd.mockResolvedValue({ id: "job-id" });
-		mocks.createPreviewDeployment.mockResolvedValue({
-			previewDeploymentId: "new-preview-id",
-		});
-		mocks.findPreviewDeploymentByApplicationId.mockResolvedValue(undefined);
-	});
-
-	it("redeploys an existing preview even when the limit is reached", async () => {
-		mocks.applicationsFindMany.mockResolvedValue([
-			createApplication({
-				previewLimit: 2,
-				previewDeployments: createPreviewDeployments(3),
-			}),
-		]);
-		mocks.findPreviewDeploymentByApplicationId.mockResolvedValue({
-			previewDeploymentId: "existing-preview-0",
-		});
-		const res = createResponse();
-
-		await handler(createPullRequestRequest("synchronize"), res);
-
-		expect(mocks.createPreviewDeployment).not.toHaveBeenCalled();
-		expect(mocks.queueAdd).toHaveBeenCalledWith(
-			"deployments",
-			expect.objectContaining({
-				applicationId: "application-id",
-				applicationType: "application-preview",
-				previewDeploymentId: "existing-preview-0",
-				type: "deploy",
-			}),
-			expect.objectContaining({
-				removeOnComplete: true,
-				removeOnFail: true,
-			}),
-		);
-		expect(res.status).toHaveBeenCalledWith(200);
-	});
-
-	it("does not create a new preview once the limit is reached", async () => {
-		mocks.applicationsFindMany.mockResolvedValue([
-			createApplication({
-				previewLimit: 2,
-				previewDeployments: createPreviewDeployments(2),
-			}),
-		]);
-		const res = createResponse();
-
-		await handler(createPullRequestRequest("opened"), res);
-
-		expect(mocks.createPreviewDeployment).not.toHaveBeenCalled();
-		expect(mocks.queueAdd).not.toHaveBeenCalled();
-		expect(res.status).toHaveBeenCalledWith(200);
-	});
-
-	it("falls back to the default limit when none is configured", async () => {
-		mocks.applicationsFindMany.mockResolvedValue([
-			createApplication({
-				previewLimit: null,
-				previewDeployments: createPreviewDeployments(2),
-			}),
-		]);
-		const res = createResponse();
-
-		await handler(createPullRequestRequest("opened"), res);
-
-		expect(mocks.createPreviewDeployment).toHaveBeenCalledWith(
-			expect.objectContaining({
-				applicationId: "application-id",
-				branch: "feature",
-				pullRequestId: 987,
-				pullRequestNumber: 42,
-			}),
-		);
-		expect(mocks.queueAdd).toHaveBeenCalledWith(
-			"deployments",
-			expect.objectContaining({
-				applicationId: "application-id",
-				applicationType: "application-preview",
-				previewDeploymentId: "new-preview-id",
-				type: "deploy",
-			}),
-			expect.objectContaining({
-				removeOnComplete: true,
-				removeOnFail: true,
-			}),
-		);
-		expect(res.status).toHaveBeenCalledWith(200);
-	});
-});
@@ -50,15 +50,6 @@ describe("getRailpackCommand", () => {
 		expect(command).toContain("--build-arg cache-key=");
 	});

-	it("installs Railpack through sudo for non-root users", () => {
-		const command = getRailpackCommand(createApplication());
-
-		expect(command).toContain(
-			'$SUDO_CMD bash -c "$(curl -fsSL https://railpack.com/install.sh)"',
-		);
-		expect(command).toContain("sudo -n true 2>/dev/null");
-	});
-
 	it("changes secrets-hash when an environment value changes", () => {
 		const firstCommand = getRailpackCommand(
 			createApplication({
@@ -16,30 +16,6 @@ describe("shouldDeploy", () => {
 		expect(shouldDeploy(["src/**"], ["docs/readme.md"])).toBe(false);
 	});

-	it("should apply multiple negated watch paths as one pattern set", () => {
-		const watchPaths = ["!CHANGELOG.md", "!VERSION", "!tests/**"];
-
-		expect(shouldDeploy(watchPaths, ["CHANGELOG.md"])).toBe(false);
-		expect(shouldDeploy(watchPaths, ["VERSION"])).toBe(false);
-		expect(shouldDeploy(watchPaths, ["tests/unit/example.test.ts"])).toBe(
-			false,
-		);
-	});
-
-	it("should deploy when a changed file remains after exclusions", () => {
-		const watchPaths = ["!CHANGELOG.md", "!VERSION", "!tests/**"];
-
-		expect(shouldDeploy(watchPaths, ["VERSION", "src/index.ts"])).toBe(true);
-	});
-
-	it("should combine positive and negated watch paths", () => {
-		const watchPaths = ["src/**", "!src/**/*.test.ts"];
-
-		expect(shouldDeploy(watchPaths, ["src/index.ts"])).toBe(true);
-		expect(shouldDeploy(watchPaths, ["src/index.test.ts"])).toBe(false);
-		expect(shouldDeploy(watchPaths, ["docs/readme.md"])).toBe(false);
-	});
-
 	it("should not throw when modified files contain non-string values", () => {
 		expect(() =>
 			shouldDeploy(["src/**"], ["src/index.ts", undefined, null] as any),
@@ -1,453 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockFetch = vi.fn();
-global.fetch = mockFetch as typeof fetch;
-
-import { cloudflareClient } from "@dokploy/server/utils/dns/cloudflare";
-
-const jsonResponse = (body: unknown, ok = true, status = 200) =>
-	({
-		ok,
-		status,
-		json: async () => body,
-	}) as Response;
-
-const cfSuccess = (result: unknown) =>
-	jsonResponse({ success: true, errors: [], result });
-
-const cfError = (message: string, status = 400) =>
-	jsonResponse(
-		{ success: false, errors: [{ code: 1, message }] },
-		false,
-		status,
-	);
-
-const config = { providerType: "cloudflare" as const, apiToken: "cf-token" };
-
-beforeEach(() => {
-	mockFetch.mockReset();
-});
-
-describe("cloudflareClient.listZones", () => {
-	it("returns a single page of zones", async () => {
-		mockFetch.mockResolvedValue(cfSuccess([{ id: "z1", name: "example.com" }]));
-
-		const zones = await cloudflareClient.listZones(config);
-
-		expect(zones).toEqual([{ id: "z1", name: "example.com" }]);
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-		const [url] = mockFetch.mock.calls[0] as [string];
-		expect(url).toContain("/zones?per_page=50&page=1");
-	});
-
-	it("paginates until a short page is returned", async () => {
-		const page = (count: number) =>
-			cfSuccess(
-				Array.from({ length: count }, (_, i) => ({
-					id: `z${i}`,
-					name: `zone${i}.com`,
-				})),
-			);
-		mockFetch.mockResolvedValueOnce(page(50)).mockResolvedValueOnce(page(3));
-
-		const zones = await cloudflareClient.listZones(config);
-
-		expect(zones).toHaveLength(53);
-		expect(mockFetch).toHaveBeenCalledTimes(2);
-		expect(mockFetch.mock.calls[1]?.[0]).toContain("page=2");
-	});
-});
-
-describe("cloudflareClient.listRecords", () => {
-	it("lists records for a zone", async () => {
-		mockFetch.mockResolvedValue(
-			cfSuccess([
-				{
-					id: "r1",
-					type: "A",
-					name: "app.example.com",
-					content: "1.2.3.4",
-					ttl: 1,
-				},
-			]),
-		);
-
-		const records = await cloudflareClient.listRecords(config, "zone-1");
-
-		expect(records).toEqual([
-			{
-				id: "r1",
-				type: "A",
-				name: "app.example.com",
-				content: "1.2.3.4",
-				ttl: 1,
-			},
-		]);
-		expect(mockFetch.mock.calls[0]?.[0]).toContain("/zones/zone-1/dns_records");
-	});
-});
-
-describe("cloudflareClient MX priority", () => {
-	it("inlines the priority into the content when listing", async () => {
-		mockFetch.mockResolvedValue(
-			cfSuccess([
-				{
-					id: "mx-1",
-					type: "MX",
-					name: "example.com",
-					content: "mail.example.com",
-					ttl: 300,
-					priority: 20,
-				},
-			]),
-		);
-
-		const records = await cloudflareClient.listRecords(config, "zone-1");
-
-		expect(records[0]?.content).toBe("20 mail.example.com");
-	});
-
-	it("splits the priority back out when writing", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "mx-1" }));
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "MX",
-			name: "example.com",
-			content: "20 mail.example.com",
-		});
-
-		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect(JSON.parse(init.body as string)).toMatchObject({
-			content: "mail.example.com",
-			priority: 20,
-		});
-	});
-
-	it("falls back to priority 10 when the content has no leading number", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "mx-1" }));
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "MX",
-			name: "example.com",
-			content: "mail.example.com",
-		});
-
-		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect(JSON.parse(init.body as string)).toMatchObject({
-			content: "mail.example.com",
-			priority: 10,
-		});
-	});
-
-	it("leaves non-MX content untouched", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "txt-1" }));
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "TXT",
-			name: "example.com",
-			content: "10 not-a-priority",
-		});
-
-		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
-		const body = JSON.parse(init.body as string);
-		expect(body.content).toBe("10 not-a-priority");
-		expect(body.priority).toBeUndefined();
-	});
-});
-
-describe("cloudflareClient structured records", () => {
-	const stubCreate = () =>
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "rec-1" }));
-
-	it("sends SRV values as structured data", async () => {
-		stubCreate();
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "SRV",
-			name: "_sip._tcp.example.com",
-			content: "1 10 5269 talk.example.com",
-		});
-
-		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
-		const body = JSON.parse(init.body as string);
-		expect(body.data).toEqual({
-			priority: 1,
-			weight: 10,
-			port: 5269,
-			target: "talk.example.com",
-		});
-		expect(body.content).toBeUndefined();
-	});
-
-	it("sends CAA values as structured data and drops the quotes", async () => {
-		stubCreate();
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "CAA",
-			name: "example.com",
-			content: '0 issue "letsencrypt.org"',
-		});
-
-		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
-		const body = JSON.parse(init.body as string);
-		expect(body.data).toEqual({
-			flags: 0,
-			tag: "issue",
-			value: "letsencrypt.org",
-		});
-		expect(body.content).toBeUndefined();
-	});
-
-	it("rejects an SRV value that is missing a part", async () => {
-		await expect(
-			cloudflareClient.upsertRecord(config, {
-				zoneId: "zone-1",
-				type: "SRV",
-				name: "_sip._tcp.example.com",
-				content: "1 10 5269",
-			}),
-		).rejects.toThrow(/SRV value/);
-	});
-
-	it("rejects a CAA value that has no tag", async () => {
-		await expect(
-			cloudflareClient.upsertRecord(config, {
-				zoneId: "zone-1",
-				type: "CAA",
-				name: "example.com",
-				content: "0",
-			}),
-		).rejects.toThrow(/CAA value/);
-	});
-});
-
-describe("cloudflareClient proxy status", () => {
-	it("sends the proxy status for proxiable types", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "a-1" }));
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-			proxied: true,
-		});
-
-		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect(JSON.parse(init.body as string).proxied).toBe(true);
-	});
-
-	it("omits the proxy status for types Cloudflare cannot proxy", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "txt-1" }));
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "TXT",
-			name: "example.com",
-			content: "hello",
-			proxied: true,
-		});
-
-		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect(JSON.parse(init.body as string).proxied).toBeUndefined();
-	});
-
-	it("leaves the proxy status untouched when the caller does not set it", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "a-1" }));
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		const [, init] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect("proxied" in JSON.parse(init.body as string)).toBe(false);
-	});
-
-	it("returns the proxy status when listing records", async () => {
-		mockFetch.mockResolvedValue(
-			cfSuccess([
-				{
-					id: "a-1",
-					type: "A",
-					name: "app.example.com",
-					content: "1.2.3.4",
-					ttl: 1,
-					proxied: true,
-				},
-			]),
-		);
-
-		const records = await cloudflareClient.listRecords(config, "zone-1");
-
-		expect(records[0]?.proxied).toBe(true);
-	});
-});
-
-describe("cloudflareClient.upsertRecord", () => {
-	it("creates a record when none exists for the name/type", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "new-1" }));
-
-		const result = await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "new-1" });
-		const [, createInit] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect(createInit.method).toBe("POST");
-	});
-
-	it("updates the existing record when content matches", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				cfSuccess([{ id: "existing-1", type: "A", content: "5.6.7.8" }]),
-			)
-			.mockResolvedValueOnce(cfSuccess({ id: "existing-1" }));
-
-		const result = await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "A",
-			name: "app.example.com",
-			content: "5.6.7.8",
-		});
-
-		expect(result).toEqual({ id: "existing-1" });
-		const [updateUrl, updateInit] = mockFetch.mock.calls[1] as [
-			string,
-			RequestInit,
-		];
-		expect(updateUrl).toContain("/dns_records/existing-1");
-		expect(updateInit.method).toBe("PUT");
-	});
-
-	it("creates a new record when content differs from existing", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				cfSuccess([{ id: "existing-1", type: "A", content: "1.1.1.1" }]),
-			)
-			.mockResolvedValueOnce(cfSuccess({ id: "new-2" }));
-
-		const result = await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "A",
-			name: "app.example.com",
-			content: "5.6.7.8",
-		});
-
-		expect(result).toEqual({ id: "new-2" });
-		const [, createInit] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect(createInit.method).toBe("POST");
-	});
-
-	it("defaults ttl to 1 (automatic) when not provided", async () => {
-		mockFetch
-			.mockResolvedValueOnce(cfSuccess([]))
-			.mockResolvedValueOnce(cfSuccess({ id: "new-1" }));
-
-		await cloudflareClient.upsertRecord(config, {
-			zoneId: "zone-1",
-			type: "CNAME",
-			name: "www.example.com",
-			content: "example.com",
-		});
-
-		const [, createInit] = mockFetch.mock.calls[1] as [string, RequestInit];
-		const body = JSON.parse(createInit.body as string);
-		expect(body.ttl).toBe(1);
-	});
-});
-
-describe("cloudflareClient.updateRecord", () => {
-	it("PUTs directly to the given record id", async () => {
-		mockFetch.mockResolvedValue(cfSuccess({ id: "r1" }));
-
-		const result = await cloudflareClient.updateRecord(config, "zone-1", "r1", {
-			type: "A",
-			name: "app.example.com",
-			content: "9.9.9.9",
-			ttl: 300,
-		});
-
-		expect(result).toEqual({ id: "r1" });
-		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect(url).toContain("/zones/zone-1/dns_records/r1");
-		expect(init.method).toBe("PUT");
-		expect(JSON.parse(init.body as string)).toEqual({
-			type: "A",
-			name: "app.example.com",
-			content: "9.9.9.9",
-			ttl: 300,
-		});
-	});
-});
-
-describe("cloudflareClient.deleteRecord", () => {
-	it("DELETEs the given record id", async () => {
-		mockFetch.mockResolvedValue(cfSuccess({}));
-
-		await cloudflareClient.deleteRecord(config, "zone-1", "r1");
-
-		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect(url).toContain("/zones/zone-1/dns_records/r1");
-		expect(init.method).toBe("DELETE");
-	});
-});
-
-describe("cloudflareClient.testConnection", () => {
-	it("succeeds when the token can list zones", async () => {
-		mockFetch.mockResolvedValue(cfSuccess([]));
-		await expect(
-			cloudflareClient.testConnection(config),
-		).resolves.toBeUndefined();
-	});
-
-	it("surfaces Cloudflare's error message on an invalid token", async () => {
-		mockFetch.mockResolvedValue(cfError("Invalid API Token"));
-
-		await expect(cloudflareClient.testConnection(config)).rejects.toThrow(
-			"Invalid API Token",
-		);
-	});
-});
-
-describe("cloudflareClient auth header", () => {
-	it("trims whitespace pasted into the token", async () => {
-		mockFetch.mockResolvedValue(cfSuccess([]));
-
-		await cloudflareClient.testConnection({
-			providerType: "cloudflare",
-			apiToken: "  cf-token\n",
-		});
-
-		const [, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect((init.headers as Record<string, string>).Authorization).toBe(
-			"Bearer cf-token",
-		);
-	});
-});
@@ -1,116 +0,0 @@
-import { describe, expect, it, vi } from "vitest";
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: { dnsProvider: { findFirst: vi.fn(), findMany: vi.fn() } },
-		insert: vi.fn(),
-		update: vi.fn(),
-		delete: vi.fn(),
-	},
-}));
-
-import {
-	DNS_SECRET_MASK,
-	maskDnsProviderConfig,
-	mergeDnsProviderConfig,
-} from "@dokploy/server/services/dns-provider";
-
-describe("maskDnsProviderConfig", () => {
-	it("masks the apiToken for a cloudflare config", () => {
-		const masked = maskDnsProviderConfig({
-			providerType: "cloudflare",
-			apiToken: "real-token",
-		});
-
-		expect(masked).toEqual({
-			providerType: "cloudflare",
-			apiToken: DNS_SECRET_MASK,
-		});
-	});
-
-	it("masks only the secretAccessKey for a route53 config, keeping accessKeyId visible", () => {
-		const masked = maskDnsProviderConfig({
-			providerType: "route53",
-			accessKeyId: "AKIA_VISIBLE",
-			secretAccessKey: "shh",
-		});
-
-		expect(masked).toEqual({
-			providerType: "route53",
-			accessKeyId: "AKIA_VISIBLE",
-			secretAccessKey: DNS_SECRET_MASK,
-		});
-	});
-
-	it("leaves an empty sensitive field untouched instead of masking a blank value", () => {
-		const masked = maskDnsProviderConfig({
-			providerType: "cloudflare",
-			apiToken: "",
-		});
-
-		expect(masked).toEqual({ providerType: "cloudflare", apiToken: "" });
-	});
-});
-
-describe("mergeDnsProviderConfig", () => {
-	it("restores the real secret when the incoming config still has the mask placeholder", () => {
-		const existing = {
-			providerType: "cloudflare" as const,
-			apiToken: "real-token",
-		};
-		const incoming = {
-			providerType: "cloudflare" as const,
-			apiToken: DNS_SECRET_MASK,
-		};
-
-		expect(mergeDnsProviderConfig(incoming, existing)).toEqual(existing);
-	});
-
-	it("keeps a freshly entered secret instead of the stored one", () => {
-		const existing = {
-			providerType: "cloudflare" as const,
-			apiToken: "old-token",
-		};
-		const incoming = {
-			providerType: "cloudflare" as const,
-			apiToken: "new-token",
-		};
-
-		expect(mergeDnsProviderConfig(incoming, existing)).toEqual(incoming);
-	});
-
-	it("throws when switching provider type while the field is still masked", () => {
-		const existing = {
-			providerType: "cloudflare" as const,
-			apiToken: "real-token",
-		};
-		const incoming = {
-			providerType: "route53" as const,
-			accessKeyId: "AKIA",
-			secretAccessKey: DNS_SECRET_MASK,
-		};
-
-		expect(() => mergeDnsProviderConfig(incoming, existing)).toThrow(
-			"Credentials must be re-entered",
-		);
-	});
-
-	it("does not require re-entry for fields that are not sensitive", () => {
-		const existing = {
-			providerType: "route53" as const,
-			accessKeyId: "AKIA_OLD",
-			secretAccessKey: "old-secret",
-		};
-		const incoming = {
-			providerType: "route53" as const,
-			accessKeyId: "AKIA_NEW",
-			secretAccessKey: DNS_SECRET_MASK,
-		};
-
-		expect(mergeDnsProviderConfig(incoming, existing)).toEqual({
-			providerType: "route53",
-			accessKeyId: "AKIA_NEW",
-			secretAccessKey: "old-secret",
-		});
-	});
-});
@@ -1,486 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockFetch = vi.fn();
-global.fetch = mockFetch as typeof fetch;
-
-import { infomaniakClient } from "@dokploy/server/utils/dns/infomaniak";
-
-const jsonResponse = (body: unknown, ok = true, status = 200) =>
-	({
-		ok,
-		status,
-		json: async () => body,
-	}) as Response;
-
-const ikSuccess = (data: unknown) => jsonResponse({ result: "success", data });
-
-const ikPage = (data: unknown, page: number, pages: number) =>
-	jsonResponse({ result: "success", data, page, pages });
-
-const ikError = (description: string, status = 400) =>
-	jsonResponse(
-		{ result: "error", error: { code: "not_authorized", description } },
-		false,
-		status,
-	);
-
-const config = {
-	providerType: "infomaniak" as const,
-	apiToken: "ik_test_token",
-};
-
-const lastCall = () =>
-	mockFetch.mock.calls.at(-1) as [string, RequestInit & { method?: string }];
-
-const lastBody = () => JSON.parse(lastCall()[1].body as string);
-
-beforeEach(() => {
-	mockFetch.mockReset();
-});
-
-describe("infomaniakClient.listZones", () => {
-	it("exposes each domain product as a zone keyed by its name", async () => {
-		mockFetch.mockResolvedValue(
-			ikPage(
-				[
-					{ id: 1, customer_name: "example.com" },
-					{ id: 2, customer_name: "example.ch" },
-				],
-				1,
-				1,
-			),
-		);
-
-		const zones = await infomaniakClient.listZones(config);
-
-		expect(zones).toEqual([
-			{ id: "example.com", name: "example.com" },
-			{ id: "example.ch", name: "example.ch" },
-		]);
-		const [url, init] = lastCall();
-		// The documented endpoint is the plural one; the singular is legacy and
-		// returns no pagination metadata at all.
-		expect(url).toContain("/1/products?service_name=domain");
-		expect(url).toContain("page=1");
-		expect(init.headers).toMatchObject({
-			Authorization: "Bearer ik_test_token",
-		});
-	});
-
-	it("walks every page so accounts with many domains keep all their zones", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikPage([{ id: 1, customer_name: "a.com" }], 1, 3))
-			.mockResolvedValueOnce(ikPage([{ id: 2, customer_name: "b.com" }], 2, 3))
-			.mockResolvedValueOnce(ikPage([{ id: 3, customer_name: "c.com" }], 3, 3));
-
-		const zones = await infomaniakClient.listZones(config);
-
-		expect(zones.map((zone) => zone.name)).toEqual(["a.com", "b.com", "c.com"]);
-		expect(mockFetch).toHaveBeenCalledTimes(3);
-		expect((mockFetch.mock.calls[2] as [string])[0]).toContain("page=3");
-	});
-
-	it("stops after a single page when the response has no pagination", async () => {
-		mockFetch.mockResolvedValue(ikSuccess([{ id: 1, customer_name: "a.com" }]));
-
-		const zones = await infomaniakClient.listZones(config);
-
-		expect(zones).toEqual([{ id: "a.com", name: "a.com" }]);
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-	});
-
-	it("propagates the API error description", async () => {
-		mockFetch.mockResolvedValue(ikError("Authorization required", 401));
-
-		await expect(infomaniakClient.listZones(config)).rejects.toThrow(
-			"Authorization required",
-		);
-	});
-});
-
-describe("infomaniakClient.listRecords", () => {
-	it("rebuilds the fqdn from the relative source", async () => {
-		mockFetch.mockResolvedValue(
-			ikSuccess([
-				{ id: 10, type: "A", source: "app", target: "1.2.3.4", ttl: 300 },
-				{ id: 11, type: "A", source: "", target: "5.6.7.8", ttl: 600 },
-			]),
-		);
-
-		const records = await infomaniakClient.listRecords(config, "example.com");
-
-		expect(records).toEqual([
-			{
-				id: "10",
-				type: "A",
-				name: "app.example.com",
-				content: "1.2.3.4",
-				ttl: 300,
-			},
-			{
-				id: "11",
-				type: "A",
-				name: "example.com",
-				content: "5.6.7.8",
-				ttl: 600,
-			},
-		]);
-		expect(lastCall()[0]).toBe(
-			"https://api.infomaniak.com/2/zones/example.com/records?with=records_description",
-		);
-	});
-
-	it.each([".", "", "@"])("treats a %s source as the apex", async (source) => {
-		mockFetch.mockResolvedValue(
-			ikSuccess([{ id: 12, type: "A", source, target: "1.2.3.4", ttl: 300 }]),
-		);
-
-		const records = await infomaniakClient.listRecords(config, "example.com");
-
-		expect(records[0]?.name).toBe("example.com");
-	});
-
-	it("unquotes TXT targets", async () => {
-		mockFetch.mockResolvedValue(
-			ikSuccess([
-				{
-					id: 13,
-					type: "TXT",
-					source: "_acme-challenge",
-					target: '"token-value"',
-					ttl: 300,
-				},
-			]),
-		);
-
-		const records = await infomaniakClient.listRecords(config, "example.com");
-
-		expect(records[0]?.content).toBe("token-value");
-	});
-
-	it("leaves a CAA target untouched", async () => {
-		mockFetch.mockResolvedValue(
-			ikSuccess([
-				{
-					id: 14,
-					type: "CAA",
-					source: "",
-					target: '0 issue "letsencrypt.org"',
-					ttl: 300,
-				},
-			]),
-		);
-
-		const records = await infomaniakClient.listRecords(config, "example.com");
-
-		expect(records[0]?.content).toBe('0 issue "letsencrypt.org"');
-	});
-});
-
-describe("infomaniakClient.upsertRecord", () => {
-	it("creates the record when no matching source and type exists", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikSuccess([]))
-			.mockResolvedValueOnce(ikSuccess({ id: 42 }));
-
-		const result = await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-			ttl: 600,
-		});
-
-		expect(result).toEqual({ id: "42" });
-		const [url, init] = lastCall();
-		expect(url).toBe("https://api.infomaniak.com/2/zones/example.com/records");
-		expect(init.method).toBe("POST");
-		expect(lastBody()).toEqual({
-			type: "A",
-			source: "app",
-			target: "1.2.3.4",
-			ttl: 600,
-		});
-	});
-
-	it("updates the existing record when content matches", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				ikSuccess([
-					{ id: 7, type: "A", source: "app", target: "1.2.3.4", ttl: 300 },
-				]),
-			)
-			.mockResolvedValueOnce(ikSuccess({ id: 7 }));
-
-		const result = await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "7" });
-		const [url, init] = lastCall();
-		expect(url).toBe(
-			"https://api.infomaniak.com/2/zones/example.com/records/7",
-		);
-		expect(init.method).toBe("PUT");
-		expect(lastBody().ttl).toBe(300);
-	});
-
-	it("creates a new record when content differs from existing", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				ikSuccess([
-					{ id: 7, type: "A", source: "app", target: "1.1.1.1", ttl: 300 },
-				]),
-			)
-			.mockResolvedValueOnce(ikSuccess({ id: 50 }));
-
-		const result = await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "50" });
-		const [url, init] = lastCall();
-		expect(url).toBe("https://api.infomaniak.com/2/zones/example.com/records");
-		expect(init.method).toBe("POST");
-	});
-
-	it("writes a root dot as the source for an apex record and strips the trailing dot", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikSuccess([]))
-			.mockResolvedValueOnce(ikSuccess({ id: 43 }));
-
-		await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "example.com.",
-			content: "1.2.3.4",
-		});
-
-		expect(lastBody().source).toBe(".");
-	});
-
-	it.each([".", "", "@"])(
-		"matches an existing apex record stored with a %s source",
-		async (source) => {
-			mockFetch
-				.mockResolvedValueOnce(
-					ikSuccess([
-						{ id: 8, type: "A", source, target: "1.2.3.4", ttl: 3600 },
-					]),
-				)
-				.mockResolvedValueOnce(ikSuccess({ id: 8 }));
-
-			const result = await infomaniakClient.upsertRecord(config, {
-				zoneId: "example.com",
-				type: "A",
-				name: "example.com",
-				content: "1.2.3.4",
-			});
-
-			expect(result).toEqual({ id: "8" });
-			expect(lastCall()[1].method).toBe("PUT");
-		},
-	);
-
-	it("matches the existing apex record instead of creating a duplicate", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				ikSuccess([
-					{
-						id: 8,
-						type: "TXT",
-						source: ".",
-						target: '"v=spf1 -all"',
-						ttl: 3600,
-					},
-				]),
-			)
-			.mockResolvedValueOnce(ikSuccess({ id: 8 }));
-
-		const result = await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "TXT",
-			name: "example.com",
-			content: "v=spf1 -all",
-		});
-
-		expect(result).toEqual({ id: "8" });
-		const [url, init] = lastCall();
-		expect(init.method).toBe("PUT");
-		expect(url).toBe(
-			"https://api.infomaniak.com/2/zones/example.com/records/8",
-		);
-		expect(lastBody().target).toBe('"v=spf1 -all"');
-	});
-
-	it("quotes a TXT target on write", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikSuccess([]))
-			.mockResolvedValueOnce(ikSuccess({ id: 44 }));
-
-		await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "TXT",
-			name: "_acme-challenge.example.com",
-			content: "token-value",
-		});
-
-		expect(lastBody().target).toBe('"token-value"');
-	});
-
-	it("does not double-quote a TXT target that is already quoted", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikSuccess([]))
-			.mockResolvedValueOnce(ikSuccess({ id: 45 }));
-
-		await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "TXT",
-			name: "_acme-challenge.example.com",
-			content: '"token-value"',
-		});
-
-		expect(lastBody().target).toBe('"token-value"');
-	});
-
-	it("queries the API with a source and type filter instead of the whole zone", async () => {
-		mockFetch
-			.mockResolvedValueOnce(ikSuccess([]))
-			.mockResolvedValueOnce(ikSuccess({ id: 50 }));
-
-		await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		const [url] = mockFetch.mock.calls[0] as [string];
-		expect(url).toContain("filter%5Bsource%5D=app");
-		expect(url).toContain("filter%5Btypes%5D%5B%5D=A");
-	});
-
-	it("ignores a partial filter hit rather than overwriting a different record", async () => {
-		// filter[source] matches substrings: asking for "auto" also returns
-		// "autoconfig" and "autodiscover". Trusting it would overwrite one of them.
-		mockFetch
-			.mockResolvedValueOnce(
-				ikSuccess([
-					{
-						id: 61,
-						type: "CNAME",
-						source: "autoconfig",
-						target: "a.example.net",
-						ttl: 300,
-					},
-					{
-						id: 62,
-						type: "CNAME",
-						source: "autodiscover",
-						target: "b.example.net",
-						ttl: 300,
-					},
-				]),
-			)
-			.mockResolvedValueOnce(ikSuccess({ id: 63 }));
-
-		const result = await infomaniakClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "CNAME",
-			name: "auto.example.com",
-			content: "c.example.net",
-		});
-
-		expect(result).toEqual({ id: "63" });
-		expect(lastCall()[1].method).toBe("POST");
-	});
-});
-
-describe("infomaniakClient.updateRecord", () => {
-	it("updates the record and keeps its id", async () => {
-		mockFetch.mockResolvedValue(ikSuccess({ id: 7 }));
-
-		const result = await infomaniakClient.updateRecord(
-			config,
-			"example.com",
-			"7",
-			{
-				type: "CNAME",
-				name: "www.example.com",
-				content: "example.com",
-				ttl: 900,
-			},
-		);
-
-		expect(result).toEqual({ id: "7" });
-		const [url, init] = lastCall();
-		expect(url).toBe(
-			"https://api.infomaniak.com/2/zones/example.com/records/7",
-		);
-		expect(init.method).toBe("PUT");
-		expect(lastBody()).toEqual({
-			type: "CNAME",
-			source: "www",
-			target: "example.com",
-			ttl: 900,
-		});
-	});
-
-	it("falls back to the default ttl when none is provided", async () => {
-		mockFetch.mockResolvedValue(ikSuccess({ id: 7 }));
-
-		await infomaniakClient.updateRecord(config, "example.com", "7", {
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(lastBody().ttl).toBe(300);
-	});
-});
-
-describe("infomaniakClient.deleteRecord", () => {
-	it("deletes the record", async () => {
-		mockFetch.mockResolvedValue(ikSuccess(null));
-
-		await infomaniakClient.deleteRecord(config, "example.com", "7");
-
-		const [url, init] = lastCall();
-		expect(url).toBe(
-			"https://api.infomaniak.com/2/zones/example.com/records/7",
-		);
-		expect(init.method).toBe("DELETE");
-	});
-
-	it("propagates a delete failure", async () => {
-		mockFetch.mockResolvedValue(ikError("Record not found", 404));
-
-		await expect(
-			infomaniakClient.deleteRecord(config, "example.com", "7"),
-		).rejects.toThrow("Record not found");
-	});
-});
-
-describe("infomaniakClient.testConnection", () => {
-	it("resolves when the domain listing succeeds", async () => {
-		mockFetch.mockResolvedValue(ikSuccess([]));
-
-		await expect(
-			infomaniakClient.testConnection(config),
-		).resolves.toBeUndefined();
-	});
-
-	it("rejects on an invalid token", async () => {
-		mockFetch.mockResolvedValue(ikError("Authorization required", 401));
-
-		await expect(infomaniakClient.testConnection(config)).rejects.toThrow(
-			"Infomaniak: request to /1/products?service_name=domain&per_page=1 failed: Authorization required",
-		);
-	});
-});
@@ -1,642 +0,0 @@
-import { createHash } from "node:crypto";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockFetch = vi.fn();
-global.fetch = mockFetch as typeof fetch;
-
-import { ovhClient } from "@dokploy/server/utils/dns/ovh";
-
-const textResponse = (body: string, ok = true, status = 200) =>
-	({
-		ok,
-		status,
-		text: async () => body,
-	}) as Response;
-
-const ovhSuccess = (data: unknown) =>
-	textResponse(data === undefined ? "" : JSON.stringify(data));
-
-const ovhError = (message: string, status = 403) =>
-	textResponse(JSON.stringify({ message }), false, status);
-
-const SERVER_TIME = 1788268225;
-
-const config = {
-	providerType: "ovh" as const,
-	endpoint: "ovh-eu" as const,
-	applicationKey: "app-key",
-	applicationSecret: "app-secret",
-	consumerKey: "consumer-key",
-};
-
-// Each test uses a distinct endpoint so the module-level clock-skew cache, which
-// is keyed by base url, never leaks a measurement between them.
-let endpointCursor = 0;
-const endpoints = [
-	"ovh-eu",
-	"ovh-ca",
-	"ovh-us",
-	"kimsufi-eu",
-	"kimsufi-ca",
-	"soyoustart-eu",
-	"soyoustart-ca",
-] as const;
-const baseUrls: Record<(typeof endpoints)[number], string> = {
-	"ovh-eu": "https://eu.api.ovh.com/1.0",
-	"ovh-ca": "https://ca.api.ovh.com/1.0",
-	"ovh-us": "https://api.us.ovhcloud.com/1.0",
-	"kimsufi-eu": "https://eu.api.kimsufi.com/1.0",
-	"kimsufi-ca": "https://ca.api.kimsufi.com/1.0",
-	"soyoustart-eu": "https://eu.api.soyoustart.com/1.0",
-	"soyoustart-ca": "https://ca.api.soyoustart.com/1.0",
-};
-
-/** A config on a not-yet-used endpoint, so the first call always fetches /auth/time. */
-const freshConfig = () => {
-	const endpoint = endpoints[
-		endpointCursor % endpoints.length
-	] as (typeof endpoints)[number];
-	endpointCursor += 1;
-	return { ...config, endpoint, baseUrl: baseUrls[endpoint] };
-};
-
-/** Replies to /auth/time, then to each queued API response in order. */
-const mockApi = (...responses: Response[]) => {
-	let call = 0;
-	mockFetch.mockImplementation((url: string) => {
-		if (url.endsWith("/auth/time")) {
-			return Promise.resolve(textResponse(String(SERVER_TIME)));
-		}
-		const response = responses[call];
-		call += 1;
-		return Promise.resolve(response ?? ovhSuccess(null));
-	});
-};
-
-const apiCalls = () =>
-	mockFetch.mock.calls.filter(
-		([url]) => !(url as string).endsWith("/auth/time"),
-	) as [string, RequestInit][];
-
-beforeEach(() => {
-	mockFetch.mockReset();
-});
-
-describe("ovhClient request signing", () => {
-	it("signs the request with the API server clock, not the local one", async () => {
-		const { baseUrl, ...cfg } = freshConfig();
-		mockApi(ovhSuccess(["example.com"]));
-		vi.spyOn(Date, "now").mockReturnValue((SERVER_TIME - 120) * 1000);
-
-		await ovhClient.listZones(cfg);
-
-		const [url, init] = apiCalls()[0] as [string, RequestInit];
-		const headers = init.headers as Record<string, string>;
-		expect(url).toBe(`${baseUrl}/domain/zone`);
-		expect(headers["X-Ovh-Timestamp"]).toBe(String(SERVER_TIME));
-		expect(headers["X-Ovh-Application"]).toBe("app-key");
-		expect(headers["X-Ovh-Consumer"]).toBe("consumer-key");
-
-		const expected = createHash("sha1")
-			.update(
-				["app-secret", "consumer-key", "GET", url, "", SERVER_TIME].join("+"),
-			)
-			.digest("hex");
-		expect(headers["X-Ovh-Signature"]).toBe(`$1$${expected}`);
-
-		vi.restoreAllMocks();
-	});
-
-	it("signs a request body when one is sent", async () => {
-		const { baseUrl, ...cfg } = freshConfig();
-		mockApi(ovhSuccess([]), ovhSuccess({ id: 5 }), ovhSuccess(null));
-		vi.spyOn(Date, "now").mockReturnValue(SERVER_TIME * 1000);
-
-		await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		const [url, init] = apiCalls()[1] as [string, RequestInit];
-		const headers = init.headers as Record<string, string>;
-		const body = init.body as string;
-		expect(body).not.toBe("");
-		const expected = createHash("sha1")
-			.update(
-				["app-secret", "consumer-key", "POST", url, body, SERVER_TIME].join(
-					"+",
-				),
-			)
-			.digest("hex");
-		expect(headers["X-Ovh-Signature"]).toBe(`$1$${expected}`);
-
-		vi.restoreAllMocks();
-	});
-});
-
-describe("ovhClient.listZones", () => {
-	it("maps each zone name to a zone", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess(["example.com", "example.fr"]));
-
-		const zones = await ovhClient.listZones(cfg);
-
-		expect(zones).toEqual([
-			{ id: "example.com", name: "example.com" },
-			{ id: "example.fr", name: "example.fr" },
-		]);
-	});
-
-	it("names the missing root right when OVH refuses the zone listing", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhError("This call has not been granted", 403));
-
-		// A `GET /domain/zone/*` rule does not cover the bare `GET /domain/zone`,
-		// so the raw OVH message would send users looking in the wrong place.
-		await expect(ovhClient.listZones(cfg)).rejects.toThrow(
-			/missing the `GET \/domain\/zone` right/,
-		);
-	});
-
-	it("propagates the API error message", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhError("Invalid signature", 403));
-
-		await expect(ovhClient.listZones(cfg)).rejects.toThrow("Invalid signature");
-	});
-
-	it("returns only the configured zone without listing every zone", async () => {
-		const cfg = { ...freshConfig(), zone: "example.com" };
-		mockApi();
-
-		const zones = await ovhClient.listZones(cfg);
-
-		expect(zones).toEqual([{ id: "example.com", name: "example.com" }]);
-		expect(apiCalls()).toHaveLength(0);
-	});
-});
-
-describe("ovhClient.listRecords", () => {
-	it("resolves each id into a full record", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess([1, 2]),
-			ovhSuccess({
-				id: 1,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.2.3.4",
-				ttl: 600,
-			}),
-			ovhSuccess({
-				id: 2,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: null,
-				target: "5.6.7.8",
-				ttl: null,
-			}),
-		);
-
-		const records = await ovhClient.listRecords(cfg, "example.com");
-
-		expect(records).toEqual([
-			{
-				id: "1",
-				type: "A",
-				name: "app.example.com",
-				content: "1.2.3.4",
-				ttl: 600,
-			},
-			{
-				id: "2",
-				type: "A",
-				name: "example.com",
-				content: "5.6.7.8",
-				ttl: 0,
-			},
-		]);
-	});
-
-	it("keeps the records in the order of the returned ids", async () => {
-		const cfg = freshConfig();
-		const record = (id: number, subDomain: string) => ({
-			id,
-			zone: "example.com",
-			fieldType: "A",
-			subDomain,
-			target: `10.0.0.${id}`,
-			ttl: 60,
-		});
-		mockApi(
-			ovhSuccess([1, 2, 3, 4, 5]),
-			...[1, 2, 3, 4, 5].map((id) => ovhSuccess(record(id, `host${id}`))),
-		);
-
-		const records = await ovhClient.listRecords(cfg, "example.com");
-
-		expect(records.map((r) => r.id)).toEqual(["1", "2", "3", "4", "5"]);
-	});
-});
-
-describe("ovhClient.upsertRecord", () => {
-	it("creates the record then refreshes the zone", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess([]), ovhSuccess({ id: 9 }), ovhSuccess(null));
-
-		const result = await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-			ttl: 600,
-		});
-
-		expect(result).toEqual({ id: "9" });
-		const calls = apiCalls();
-		expect(calls[0]?.[0]).toContain(
-			"/domain/zone/example.com/record?fieldType=A&subDomain=app",
-		);
-		expect(calls[1]?.[1].method).toBe("POST");
-		expect(JSON.parse(calls[1]?.[1].body as string)).toEqual({
-			fieldType: "A",
-			subDomain: "app",
-			target: "1.2.3.4",
-			ttl: 600,
-		});
-		expect(calls[2]?.[0]).toContain("/domain/zone/example.com/refresh");
-		expect(calls[2]?.[1].method).toBe("POST");
-	});
-
-	it("updates the existing record when content matches", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess([4]),
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.2.3.4",
-				ttl: 60,
-			}),
-			ovhSuccess(null),
-			ovhSuccess(null),
-		);
-
-		const result = await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "4" });
-		const calls = apiCalls();
-		expect(calls[2]?.[0]).toContain("/domain/zone/example.com/record/4");
-		expect(calls[2]?.[1].method).toBe("PUT");
-		expect(calls[3]?.[0]).toContain("/refresh");
-	});
-
-	it("creates a new record when content differs from existing", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess([4]),
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess({ id: 10 }),
-			ovhSuccess(null),
-		);
-
-		const result = await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "5.6.7.8",
-		});
-
-		expect(result).toEqual({ id: "10" });
-		const calls = apiCalls();
-		expect(calls[2]?.[1].method).toBe("POST");
-		expect(calls[3]?.[0]).toContain("/refresh");
-	});
-
-	it("omits the ttl so OVH applies the zone default", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess([]), ovhSuccess({ id: 9 }), ovhSuccess(null));
-
-		await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(JSON.parse(apiCalls()[1]?.[1].body as string)).not.toHaveProperty(
-			"ttl",
-		);
-	});
-
-	it("writes an empty subDomain for the apex and strips the trailing dot", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess([]), ovhSuccess({ id: 9 }), ovhSuccess(null));
-
-		await ovhClient.upsertRecord(cfg, {
-			zoneId: "example.com",
-			type: "A",
-			name: "example.com.",
-			content: "1.2.3.4",
-		});
-
-		expect(apiCalls()[0]?.[0]).toContain("subDomain=");
-		expect(JSON.parse(apiCalls()[1]?.[1].body as string).subDomain).toBe("");
-	});
-});
-
-describe("ovhClient.updateRecord", () => {
-	it("updates in place when the type is unchanged", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess(null),
-			ovhSuccess(null),
-		);
-
-		const result = await ovhClient.updateRecord(cfg, "example.com", "4", {
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-			ttl: 300,
-		});
-
-		expect(result).toEqual({ id: "4" });
-		const calls = apiCalls();
-		expect(calls[1]?.[1].method).toBe("PUT");
-		expect(JSON.parse(calls[1]?.[1].body as string)).toEqual({
-			subDomain: "app",
-			target: "1.2.3.4",
-			ttl: 300,
-		});
-		expect(calls[2]?.[0]).toContain("/refresh");
-	});
-
-	it("replaces the record when the type changes, since PUT carries no fieldType", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess(null),
-			ovhSuccess({ id: 11 }),
-			ovhSuccess(null),
-		);
-
-		const result = await ovhClient.updateRecord(cfg, "example.com", "4", {
-			type: "CNAME",
-			name: "app.example.com",
-			content: "example.com",
-		});
-
-		expect(result).toEqual({ id: "11" });
-		const calls = apiCalls();
-		expect(calls[1]?.[1].method).toBe("DELETE");
-		expect(calls[2]?.[1].method).toBe("POST");
-		expect(JSON.parse(calls[2]?.[1].body as string).fieldType).toBe("CNAME");
-		expect(calls[3]?.[0]).toContain("/refresh");
-	});
-
-	it("restores the original record when the replacement fails", async () => {
-		const cfg = freshConfig();
-		const original = {
-			id: 4,
-			zone: "example.com",
-			fieldType: "A",
-			subDomain: "app",
-			target: "1.1.1.1",
-			ttl: 60,
-		};
-		mockApi(
-			ovhSuccess(original),
-			ovhSuccess(null),
-			ovhError("Invalid target", 400),
-			ovhSuccess({ id: 12 }),
-			ovhSuccess(null),
-		);
-
-		await expect(
-			ovhClient.updateRecord(cfg, "example.com", "4", {
-				type: "CNAME",
-				name: "app.example.com",
-				content: "not a valid target",
-			}),
-		).rejects.toThrow("Invalid target");
-
-		const calls = apiCalls();
-		expect(calls[1]?.[1].method).toBe("DELETE");
-		expect(calls[2]?.[1].method).toBe("POST");
-		// The original record is put back with its own type, target and ttl.
-		expect(JSON.parse(calls[3]?.[1].body as string)).toEqual({
-			fieldType: "A",
-			subDomain: "app",
-			target: "1.1.1.1",
-			ttl: 60,
-		});
-		expect(calls[4]?.[0]).toContain("/refresh");
-	});
-
-	it("reports the lost record when the restore also fails", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess(null),
-			ovhError("Invalid target", 400),
-			ovhError("Service unavailable", 503),
-		);
-
-		await expect(
-			ovhClient.updateRecord(cfg, "example.com", "4", {
-				type: "CNAME",
-				name: "app.example.com",
-				content: "not a valid target",
-			}),
-		).rejects.toThrow(
-			/Recreate it manually: A app\.example\.com -> 1\.1\.1\.1/,
-		);
-	});
-
-	it("says the change was applied when only the zone refresh fails", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess(null),
-			ovhSuccess({ id: 11 }),
-			ovhError("Service unavailable", 503),
-		);
-
-		// The replacement succeeded, so the record exists at the provider — only
-		// publishing failed. Rolling back would destroy correct state.
-		await expect(
-			ovhClient.updateRecord(cfg, "example.com", "4", {
-				type: "CNAME",
-				name: "app.example.com",
-				content: "example.com",
-			}),
-		).rejects.toThrow(/was applied, but refreshing zone "example\.com" failed/);
-	});
-
-	it("does not tell the user to recreate a record that was restored but not published", async () => {
-		const cfg = freshConfig();
-		mockApi(
-			ovhSuccess({
-				id: 4,
-				zone: "example.com",
-				fieldType: "A",
-				subDomain: "app",
-				target: "1.1.1.1",
-				ttl: 60,
-			}),
-			ovhSuccess(null), // DELETE de l'ancien
-			ovhError("Invalid target", 400), // POST de remplacement -> échec
-			ovhSuccess({ id: 12 }), // POST de restauration -> succès
-			ovhError("Service unavailable", 503), // refresh -> échec
-		);
-
-		const attempt = ovhClient.updateRecord(cfg, "example.com", "4", {
-			type: "CNAME",
-			name: "app.example.com",
-			content: "not a valid target",
-		});
-
-		// L'enregistrement existe de nouveau chez OVH : le recréer le dupliquerait.
-		await expect(attempt).rejects.toThrow(/was restored, but refreshing zone/);
-		await expect(attempt).rejects.not.toThrow(/Recreate it manually/);
-	});
-});
-
-describe("ovhClient.deleteRecord", () => {
-	it("deletes the record then refreshes the zone", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess(null), ovhSuccess(null));
-
-		await ovhClient.deleteRecord(cfg, "example.com", "4");
-
-		const calls = apiCalls();
-		expect(calls[0]?.[0]).toContain("/domain/zone/example.com/record/4");
-		expect(calls[0]?.[1].method).toBe("DELETE");
-		expect(calls[1]?.[0]).toContain("/domain/zone/example.com/refresh");
-	});
-
-	it("does not refresh the zone when the delete fails", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhError("This object does not exist", 404));
-
-		await expect(
-			ovhClient.deleteRecord(cfg, "example.com", "4"),
-		).rejects.toThrow("This object does not exist");
-		expect(apiCalls()).toHaveLength(1);
-	});
-});
-
-describe("ovhClient.testConnection", () => {
-	it("resolves when the zone listing succeeds", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhSuccess([]));
-
-		await expect(ovhClient.testConnection(cfg)).resolves.toBeUndefined();
-	});
-
-	it("rejects on invalid credentials", async () => {
-		const cfg = freshConfig();
-		mockApi(ovhError("Invalid signature", 403));
-
-		await expect(ovhClient.testConnection(cfg)).rejects.toThrow(
-			"Invalid signature",
-		);
-	});
-
-	it("checks the configured zone instead of listing all zones", async () => {
-		const cfg = { ...freshConfig(), zone: "example.com" };
-		mockApi(ovhSuccess({ name: "example.com" }));
-
-		await expect(ovhClient.testConnection(cfg)).resolves.toBeUndefined();
-
-		const calls = apiCalls();
-		expect(calls).toHaveLength(1);
-		expect(calls[0]?.[0]).toBe(`${cfg.baseUrl}/domain/zone/example.com`);
-	});
-});
-
-describe("ovhClient with a configured zone", () => {
-	const record = {
-		type: "A" as const,
-		name: "app.other.org",
-		content: "1.2.3.4",
-	};
-
-	it("refuses record operations on any other zone without calling OVH", async () => {
-		const cfg = { ...freshConfig(), zone: "example.com" };
-		mockApi();
-
-		const message = /restricted to the zone "example.com"/;
-		await expect(ovhClient.listRecords(cfg, "other.org")).rejects.toThrow(
-			message,
-		);
-		await expect(
-			ovhClient.upsertRecord(cfg, { ...record, zoneId: "other.org" }),
-		).rejects.toThrow(message);
-		await expect(
-			ovhClient.updateRecord(cfg, "other.org", "1", record),
-		).rejects.toThrow(message);
-		await expect(ovhClient.deleteRecord(cfg, "other.org", "1")).rejects.toThrow(
-			message,
-		);
-		expect(apiCalls()).toHaveLength(0);
-	});
-
-	it("still allows operations on the configured zone", async () => {
-		const cfg = { ...freshConfig(), zone: "example.com" };
-		mockApi(ovhSuccess(null), ovhSuccess(null));
-
-		await expect(
-			ovhClient.deleteRecord(cfg, "example.com", "1"),
-		).resolves.toBeUndefined();
-		expect(apiCalls()[0]?.[0]).toBe(
-			`${cfg.baseUrl}/domain/zone/example.com/record/1`,
-		);
-	});
-});
@@ -1,237 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockFetch = vi.fn();
-global.fetch = mockFetch as typeof fetch;
-
-import { porkbunClient } from "@dokploy/server/utils/dns/porkbun";
-
-const jsonResponse = (body: unknown, ok = true, status = 200) =>
-	({
-		ok,
-		status,
-		json: async () => body,
-	}) as Response;
-
-const pbSuccess = (result: Record<string, unknown> = {}) =>
-	jsonResponse({ status: "SUCCESS", ...result });
-
-const pbError = (message: string, status = 400) =>
-	jsonResponse({ status: "ERROR", message }, false, status);
-
-const config = {
-	providerType: "porkbun" as const,
-	apiKey: "pk1_test",
-	secretApiKey: "sk1_test",
-};
-
-beforeEach(() => {
-	mockFetch.mockReset();
-});
-
-describe("porkbunClient.listZones", () => {
-	it("lists all domains as zones", async () => {
-		mockFetch.mockResolvedValue(
-			pbSuccess({ domains: [{ domain: "example.com" }] }),
-		);
-
-		const zones = await porkbunClient.listZones(config);
-
-		expect(zones).toEqual([{ id: "example.com", name: "example.com" }]);
-		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect(url).toContain("/domain/listAll");
-		const body = JSON.parse(init.body as string);
-		expect(body).toMatchObject({
-			apikey: "pk1_test",
-			secretapikey: "sk1_test",
-		});
-	});
-});
-
-describe("porkbunClient.listRecords", () => {
-	it("lists records for a domain", async () => {
-		mockFetch.mockResolvedValue(
-			pbSuccess({
-				records: [
-					{
-						id: "1",
-						type: "A",
-						name: "app.example.com",
-						content: "1.2.3.4",
-						ttl: "600",
-						prio: "0",
-						notes: "",
-					},
-				],
-			}),
-		);
-
-		const records = await porkbunClient.listRecords(config, "example.com");
-
-		expect(records).toEqual([
-			{
-				id: "1",
-				type: "A",
-				name: "app.example.com",
-				content: "1.2.3.4",
-				ttl: 600,
-			},
-		]);
-		expect(mockFetch.mock.calls[0]?.[0]).toContain("/dns/retrieve/example.com");
-	});
-});
-
-describe("porkbunClient.upsertRecord", () => {
-	it("creates a record when none exists for the name/type", async () => {
-		mockFetch
-			.mockResolvedValueOnce(pbSuccess({ records: [] }))
-			.mockResolvedValueOnce(pbSuccess({ id: "new-1" }));
-
-		const result = await porkbunClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "new-1" });
-		const [lookupUrl] = mockFetch.mock.calls[0] as [string];
-		expect(lookupUrl).toContain("/dns/retrieveByNameType/example.com/A/app");
-		const [createUrl, createInit] = mockFetch.mock.calls[1] as [
-			string,
-			RequestInit,
-		];
-		expect(createUrl).toContain("/dns/create/example.com");
-		const body = JSON.parse(createInit.body as string);
-		expect(body).toMatchObject({ name: "app", type: "A", content: "1.2.3.4" });
-	});
-
-	it("resolves the apex domain to an empty subdomain", async () => {
-		mockFetch
-			.mockResolvedValueOnce(pbSuccess({ records: [] }))
-			.mockResolvedValueOnce(pbSuccess({ id: "new-2" }));
-
-		await porkbunClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "example.com",
-			content: "1.2.3.4",
-		});
-
-		const [lookupUrl] = mockFetch.mock.calls[0] as [string];
-		expect(lookupUrl).toContain("/dns/retrieveByNameType/example.com/A/");
-	});
-
-	it("edits the existing record when content matches", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				pbSuccess({ records: [{ id: "existing-1", content: "5.6.7.8" }] }),
-			)
-			.mockResolvedValueOnce(pbSuccess({}));
-
-		const result = await porkbunClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "5.6.7.8",
-		});
-
-		expect(result).toEqual({ id: "existing-1" });
-		const [editUrl] = mockFetch.mock.calls[1] as [string, RequestInit];
-		expect(editUrl).toContain("/dns/edit/example.com/existing-1");
-	});
-
-	it("creates a new record when content differs from existing", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				pbSuccess({ records: [{ id: "existing-1", content: "1.1.1.1" }] }),
-			)
-			.mockResolvedValueOnce(pbSuccess({ id: "new-2" }));
-
-		const result = await porkbunClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "A",
-			name: "app.example.com",
-			content: "5.6.7.8",
-		});
-
-		expect(result).toEqual({ id: "new-2" });
-		const [createUrl, createInit] = mockFetch.mock.calls[1] as [
-			string,
-			RequestInit,
-		];
-		expect(createUrl).toContain("/dns/create/example.com");
-		const body = JSON.parse(createInit.body as string);
-		expect(body).toMatchObject({ name: "app", type: "A", content: "5.6.7.8" });
-	});
-
-	it("defaults ttl to 600 when not provided", async () => {
-		mockFetch
-			.mockResolvedValueOnce(pbSuccess({ records: [] }))
-			.mockResolvedValueOnce(pbSuccess({ id: "new-1" }));
-
-		await porkbunClient.upsertRecord(config, {
-			zoneId: "example.com",
-			type: "CNAME",
-			name: "www.example.com",
-			content: "example.com",
-		});
-
-		const [, createInit] = mockFetch.mock.calls[1] as [string, RequestInit];
-		const body = JSON.parse(createInit.body as string);
-		expect(body.ttl).toBe(600);
-	});
-});
-
-describe("porkbunClient.updateRecord", () => {
-	it("edits the given record id", async () => {
-		mockFetch.mockResolvedValue(pbSuccess({}));
-
-		const result = await porkbunClient.updateRecord(
-			config,
-			"example.com",
-			"1",
-			{
-				type: "A",
-				name: "app.example.com",
-				content: "9.9.9.9",
-				ttl: 300,
-			},
-		);
-
-		expect(result).toEqual({ id: "1" });
-		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect(url).toContain("/dns/edit/example.com/1");
-		expect(JSON.parse(init.body as string)).toMatchObject({
-			name: "app",
-			type: "A",
-			content: "9.9.9.9",
-			ttl: 300,
-		});
-	});
-});
-
-describe("porkbunClient.deleteRecord", () => {
-	it("posts to the delete endpoint for the given record id", async () => {
-		mockFetch.mockResolvedValue(pbSuccess({}));
-
-		await porkbunClient.deleteRecord(config, "example.com", "1");
-
-		const [url] = mockFetch.mock.calls[0] as [string];
-		expect(url).toContain("/dns/delete/example.com/1");
-	});
-});
-
-describe("porkbunClient.testConnection", () => {
-	it("succeeds when the credentials can ping the API", async () => {
-		mockFetch.mockResolvedValue(pbSuccess({}));
-		await expect(porkbunClient.testConnection(config)).resolves.toBeUndefined();
-	});
-
-	it("surfaces Porkbun's error message on invalid credentials", async () => {
-		mockFetch.mockResolvedValue(pbError("Invalid API key."));
-
-		await expect(porkbunClient.testConnection(config)).rejects.toThrow(
-			"Invalid API key.",
-		);
-	});
-});
@@ -1,451 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-type HasInput = { input: any };
-
-const {
-	send,
-	Route53Client,
-	ListHostedZonesCommand,
-	ListResourceRecordSetsCommand,
-	ChangeResourceRecordSetsCommand,
-} = vi.hoisted(() => {
-	class FakeCommand {
-		input: any;
-		constructor(input: any) {
-			this.input = input;
-		}
-	}
-	const send = vi.fn();
-	class Route53Client {
-		send(command: unknown) {
-			return send(command);
-		}
-	}
-	return {
-		send,
-		Route53Client,
-		ListHostedZonesCommand: class extends FakeCommand {},
-		ListResourceRecordSetsCommand: class extends FakeCommand {},
-		ChangeResourceRecordSetsCommand: class extends FakeCommand {},
-	};
-});
-
-vi.mock("@aws-sdk/client-route-53", () => ({
-	Route53Client,
-	ListHostedZonesCommand,
-	ListResourceRecordSetsCommand,
-	ChangeResourceRecordSetsCommand,
-}));
-
-import { route53Client } from "@dokploy/server/utils/dns/route53";
-
-const config = {
-	providerType: "route53" as const,
-	accessKeyId: "AKIA_TEST",
-	secretAccessKey: "secret",
-};
-
-beforeEach(() => {
-	send.mockReset();
-});
-
-describe("route53Client.listZones", () => {
-	it("strips the hostedzone prefix and the trailing dot", async () => {
-		send.mockResolvedValueOnce({
-			HostedZones: [{ Id: "/hostedzone/Z123", Name: "example.com." }],
-			IsTruncated: false,
-		});
-
-		const zones = await route53Client.listZones(config);
-
-		expect(zones).toEqual([{ id: "Z123", name: "example.com" }]);
-	});
-
-	it("follows the marker until IsTruncated is false", async () => {
-		send
-			.mockResolvedValueOnce({
-				HostedZones: [{ Id: "/hostedzone/Z1", Name: "a.com." }],
-				IsTruncated: true,
-				NextMarker: "marker-1",
-			})
-			.mockResolvedValueOnce({
-				HostedZones: [{ Id: "/hostedzone/Z2", Name: "b.com." }],
-				IsTruncated: false,
-			});
-
-		const zones = await route53Client.listZones(config);
-
-		expect(zones).toEqual([
-			{ id: "Z1", name: "a.com" },
-			{ id: "Z2", name: "b.com" },
-		]);
-		expect(send).toHaveBeenCalledTimes(2);
-		expect((send.mock.calls[1]?.[0] as HasInput).input.Marker).toBe("marker-1");
-	});
-});
-
-describe("route53Client.listRecords", () => {
-	it("builds a type:name id and strips the trailing dot from the name", async () => {
-		send.mockResolvedValueOnce({
-			ResourceRecordSets: [
-				{
-					Name: "app.example.com.",
-					Type: "A",
-					TTL: 300,
-					ResourceRecords: [{ Value: "1.2.3.4" }],
-				},
-			],
-			IsTruncated: false,
-		});
-
-		const records = await route53Client.listRecords(config, "Z123");
-
-		expect(records).toEqual([
-			{
-				id: "A:app.example.com",
-				type: "A",
-				name: "app.example.com",
-				content: "1.2.3.4",
-				ttl: 300,
-			},
-		]);
-	});
-
-	it("decodes octal escapes such as \\052 for wildcard names", async () => {
-		send.mockResolvedValueOnce({
-			ResourceRecordSets: [
-				{
-					Name: "\\052.example.com.",
-					Type: "A",
-					TTL: 300,
-					ResourceRecords: [{ Value: "1.2.3.4" }],
-				},
-			],
-			IsTruncated: false,
-		});
-
-		const records = await route53Client.listRecords(config, "Z123");
-
-		expect(records[0]).toMatchObject({
-			id: "A:*.example.com",
-			name: "*.example.com",
-		});
-	});
-
-	it("keeps escaped dots so they stay distinct from label separators", async () => {
-		send.mockResolvedValueOnce({
-			ResourceRecordSets: [
-				{
-					Name: "a\\056b.example.com.",
-					Type: "A",
-					TTL: 300,
-					ResourceRecords: [{ Value: "1.2.3.4" }],
-				},
-				{
-					Name: "a.b.example.com.",
-					Type: "A",
-					TTL: 300,
-					ResourceRecords: [{ Value: "5.6.7.8" }],
-				},
-			],
-			IsTruncated: false,
-		});
-
-		const records = await route53Client.listRecords(config, "Z123");
-
-		expect(records.map((r) => r.id)).toEqual([
-			"A:a\\056b.example.com",
-			"A:a.b.example.com",
-		]);
-	});
-
-	it("skips record sets with no ResourceRecords (e.g. alias targets)", async () => {
-		send.mockResolvedValueOnce({
-			ResourceRecordSets: [
-				{ Name: "alias.example.com.", Type: "A", ResourceRecords: [] },
-			],
-			IsTruncated: false,
-		});
-
-		const records = await route53Client.listRecords(config, "Z123");
-
-		expect(records).toEqual([]);
-	});
-
-	it("joins multiple values for the same record", async () => {
-		send.mockResolvedValueOnce({
-			ResourceRecordSets: [
-				{
-					Name: "example.com.",
-					Type: "NS",
-					TTL: 172800,
-					ResourceRecords: [
-						{ Value: "ns1.example.com" },
-						{ Value: "ns2.example.com" },
-					],
-				},
-			],
-			IsTruncated: false,
-		});
-
-		const records = await route53Client.listRecords(config, "Z123");
-
-		expect(records[0]?.content).toBe("ns1.example.com\nns2.example.com");
-	});
-});
-
-describe("route53Client.upsertRecord", () => {
-	it("sends a single UPSERT change when nothing exists yet", async () => {
-		send
-			.mockResolvedValueOnce({ ResourceRecordSets: [] })
-			.mockResolvedValueOnce({});
-
-		const result = await route53Client.upsertRecord(config, {
-			zoneId: "Z123",
-			type: "A",
-			name: "app.example.com",
-			content: "1.2.3.4",
-		});
-
-		expect(result).toEqual({ id: "A:app.example.com" });
-		const command = send.mock.calls[1]?.[0] as HasInput;
-		expect(command.input.HostedZoneId).toBe("Z123");
-		expect(command.input.ChangeBatch.Changes).toEqual([
-			{
-				Action: "UPSERT",
-				ResourceRecordSet: {
-					Name: "app.example.com.",
-					Type: "A",
-					TTL: 300,
-					ResourceRecords: [{ Value: "1.2.3.4" }],
-				},
-			},
-		]);
-	});
-
-	it("keeps the values already in the record set", async () => {
-		send
-			.mockResolvedValueOnce({
-				ResourceRecordSets: [
-					{
-						Name: "app.example.com.",
-						Type: "A",
-						TTL: 300,
-						ResourceRecords: [{ Value: "1.1.1.1" }, { Value: "2.2.2.2" }],
-					},
-				],
-			})
-			.mockResolvedValueOnce({});
-
-		await route53Client.upsertRecord(config, {
-			zoneId: "Z123",
-			type: "A",
-			name: "app.example.com",
-			content: "3.3.3.3",
-		});
-
-		const command = send.mock.calls[1]?.[0] as HasInput;
-		expect(
-			command.input.ChangeBatch.Changes[0].ResourceRecordSet.ResourceRecords,
-		).toEqual([
-			{ Value: "1.1.1.1" },
-			{ Value: "2.2.2.2" },
-			{ Value: "3.3.3.3" },
-		]);
-	});
-
-	it("does not duplicate a value that is already in the record set", async () => {
-		send
-			.mockResolvedValueOnce({
-				ResourceRecordSets: [
-					{
-						Name: "app.example.com.",
-						Type: "A",
-						TTL: 300,
-						ResourceRecords: [{ Value: "1.1.1.1" }],
-					},
-				],
-			})
-			.mockResolvedValueOnce({});
-
-		await route53Client.upsertRecord(config, {
-			zoneId: "Z123",
-			type: "A",
-			name: "app.example.com",
-			content: "1.1.1.1",
-		});
-
-		const command = send.mock.calls[1]?.[0] as HasInput;
-		expect(
-			command.input.ChangeBatch.Changes[0].ResourceRecordSet.ResourceRecords,
-		).toEqual([{ Value: "1.1.1.1" }]);
-	});
-
-	it("wraps unquoted TXT values in double quotes", async () => {
-		send
-			.mockResolvedValueOnce({ ResourceRecordSets: [] })
-			.mockResolvedValueOnce({});
-
-		await route53Client.upsertRecord(config, {
-			zoneId: "Z123",
-			type: "TXT",
-			name: "example.com",
-			content: 'v=spf1 ~all\n"already quoted"',
-		});
-
-		const command = send.mock.calls[1]?.[0] as HasInput;
-		expect(
-			command.input.ChangeBatch.Changes[0].ResourceRecordSet.ResourceRecords,
-		).toEqual([{ Value: '"v=spf1 ~all"' }, { Value: '"already quoted"' }]);
-	});
-});
-
-describe("route53Client.updateRecord", () => {
-	it("only UPSERTs when the name/type identity did not change", async () => {
-		send.mockResolvedValueOnce({});
-
-		await route53Client.updateRecord(config, "Z123", "A:app.example.com", {
-			type: "A",
-			name: "app.example.com",
-			content: "9.9.9.9",
-		});
-
-		expect(send).toHaveBeenCalledTimes(1);
-		const command = send.mock.calls[0]?.[0] as HasInput;
-		expect(command.input.ChangeBatch.Changes).toHaveLength(1);
-		expect(command.input.ChangeBatch.Changes[0].Action).toBe("UPSERT");
-	});
-
-	it("deletes the old record set and creates the new one on rename", async () => {
-		const existingSet = {
-			Name: "old.example.com.",
-			Type: "A",
-			TTL: 300,
-			ResourceRecords: [{ Value: "1.1.1.1" }],
-		};
-		send
-			.mockResolvedValueOnce({ ResourceRecordSets: [existingSet] }) // findExactRecordSet lookup
-			.mockResolvedValueOnce({}); // ChangeResourceRecordSets
-
-		await route53Client.updateRecord(config, "Z123", "A:old.example.com", {
-			type: "A",
-			name: "new.example.com",
-			content: "1.1.1.1",
-		});
-
-		const changeCommand = send.mock.calls[1]?.[0] as HasInput;
-		expect(changeCommand.input.ChangeBatch.Changes).toEqual([
-			{ Action: "DELETE", ResourceRecordSet: existingSet },
-			{
-				Action: "UPSERT",
-				ResourceRecordSet: {
-					Name: "new.example.com.",
-					Type: "A",
-					TTL: 300,
-					ResourceRecords: [{ Value: "1.1.1.1" }],
-				},
-			},
-		]);
-	});
-
-	it("keeps every line of a multi-value record set", async () => {
-		send.mockResolvedValueOnce({});
-
-		await route53Client.updateRecord(config, "Z123", "NS:example.com", {
-			type: "NS",
-			name: "example.com",
-			content: "ns1.example.com\nns2.example.com\n\n  ns3.example.com  ",
-		});
-
-		const command = send.mock.calls[0]?.[0] as HasInput;
-		expect(
-			command.input.ChangeBatch.Changes[0].ResourceRecordSet.ResourceRecords,
-		).toEqual([
-			{ Value: "ns1.example.com" },
-			{ Value: "ns2.example.com" },
-			{ Value: "ns3.example.com" },
-		]);
-	});
-
-	it("skips the DELETE when the old record no longer exists", async () => {
-		send
-			.mockResolvedValueOnce({ ResourceRecordSets: [] })
-			.mockResolvedValueOnce({});
-
-		await route53Client.updateRecord(config, "Z123", "A:gone.example.com", {
-			type: "A",
-			name: "new.example.com",
-			content: "1.1.1.1",
-		});
-
-		const changeCommand = send.mock.calls[1]?.[0] as HasInput;
-		expect(changeCommand.input.ChangeBatch.Changes).toHaveLength(1);
-		expect(changeCommand.input.ChangeBatch.Changes[0].Action).toBe("UPSERT");
-	});
-});
-
-describe("route53Client.deleteRecord", () => {
-	it("deletes the record set found by name/type", async () => {
-		const existingSet = {
-			Name: "app.example.com.",
-			Type: "A",
-			TTL: 300,
-			ResourceRecords: [{ Value: "1.2.3.4" }],
-		};
-		send.mockResolvedValueOnce({ ResourceRecordSets: [existingSet] });
-		send.mockResolvedValueOnce({});
-
-		await route53Client.deleteRecord(config, "Z123", "A:app.example.com");
-
-		const changeCommand = send.mock.calls[1]?.[0] as HasInput;
-		expect(changeCommand.input.ChangeBatch.Changes).toEqual([
-			{ Action: "DELETE", ResourceRecordSet: existingSet },
-		]);
-	});
-
-	it("finds a wildcard record set that Route53 returns escaped", async () => {
-		const existingSet = {
-			Name: "\\052.example.com.",
-			Type: "A",
-			TTL: 300,
-			ResourceRecords: [{ Value: "1.2.3.4" }],
-		};
-		send.mockResolvedValueOnce({ ResourceRecordSets: [existingSet] });
-		send.mockResolvedValueOnce({});
-
-		await route53Client.deleteRecord(config, "Z123", "A:*.example.com");
-
-		const changeCommand = send.mock.calls[1]?.[0] as HasInput;
-		expect(changeCommand.input.ChangeBatch.Changes).toEqual([
-			{ Action: "DELETE", ResourceRecordSet: existingSet },
-		]);
-	});
-
-	it("throws when the record no longer exists", async () => {
-		send.mockResolvedValueOnce({ ResourceRecordSets: [] });
-
-		await expect(
-			route53Client.deleteRecord(config, "Z123", "A:gone.example.com"),
-		).rejects.toThrow("not found");
-	});
-
-	it("throws for a malformed record id", async () => {
-		await expect(
-			route53Client.deleteRecord(config, "Z123", "not-a-valid-id"),
-		).rejects.toThrow("Invalid Route53 record id");
-	});
-});
-
-describe("route53Client.testConnection", () => {
-	it("resolves when ListHostedZones succeeds", async () => {
-		send.mockResolvedValueOnce({ HostedZones: [] });
-		await expect(route53Client.testConnection(config)).resolves.toBeUndefined();
-	});
-
-	it("propagates SDK errors", async () => {
-		send.mockRejectedValueOnce(new Error("InvalidClientTokenId"));
-		await expect(route53Client.testConnection(config)).rejects.toThrow(
-			"InvalidClientTokenId",
-		);
-	});
-});
@@ -1,149 +0,0 @@
-import os from "node:os";
-import {
-	getServerIpCandidates,
-	validateDomain,
-} from "@dokploy/server/services/domain";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	execAsyncRemote: vi.fn(),
-	findServerById: vi.fn(),
-	getPublicIpWithFallback: vi.fn(),
-	getWebServerSettings: vi.fn(),
-	resolve4: vi.fn(),
-	resolve6: vi.fn(),
-}));
-
-vi.mock("node:dns", () => ({
-	default: {
-		resolve4: mocks.resolve4,
-		resolve6: mocks.resolve6,
-	},
-}));
-
-vi.mock("@dokploy/server/utils/process/execAsync", () => ({
-	execAsyncRemote: mocks.execAsyncRemote,
-}));
-
-vi.mock("@dokploy/server/services/server", () => ({
-	findServerById: mocks.findServerById,
-}));
-
-vi.mock("@dokploy/server/services/web-server-settings", () => ({
-	getWebServerSettings: mocks.getWebServerSettings,
-}));
-
-vi.mock("@dokploy/server/wss/utils", () => ({
-	getPublicIpWithFallback: mocks.getPublicIpWithFallback,
-}));
-
-describe("getServerIpCandidates", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-	});
-
-	afterEach(() => {
-		vi.restoreAllMocks();
-		vi.useRealTimers();
-	});
-
-	it("includes every address reported by a multi-homed remote server", async () => {
-		mocks.findServerById.mockResolvedValue({
-			ipAddress: "10.0.0.10",
-		});
-		mocks.execAsyncRemote.mockResolvedValue({
-			stdout: ["10.0.0.10", "192.0.2.10", "2001:db8::10"].join("\n"),
-			stderr: "",
-		});
-
-		await expect(getServerIpCandidates("server-id")).resolves.toEqual([
-			"10.0.0.10",
-			"192.0.2.10",
-			"2001:db8::10",
-		]);
-		expect(mocks.execAsyncRemote).toHaveBeenCalledWith(
-			"server-id",
-			expect.stringContaining("ip -o addr show scope global"),
-		);
-	});
-
-	it("includes every address assigned to the local Dokploy host", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			serverIp: "10.0.0.10",
-		});
-		mocks.getPublicIpWithFallback.mockResolvedValue("2001:db8::10");
-		vi.spyOn(os, "networkInterfaces").mockReturnValue({
-			eth0: [
-				{
-					address: "192.0.2.10",
-					netmask: "255.255.255.0",
-					family: "IPv4",
-					mac: "00:00:00:00:00:00",
-					internal: false,
-					cidr: "192.0.2.10/24",
-				},
-			],
-		});
-
-		await expect(getServerIpCandidates()).resolves.toEqual([
-			"10.0.0.10",
-			"192.0.2.10",
-			"2001:db8::10",
-		]);
-	});
-
-	it("retains remote interface addresses when public IP detection times out", async () => {
-		vi.useFakeTimers();
-		mocks.findServerById.mockResolvedValue({
-			ipAddress: "10.0.0.10",
-		});
-		mocks.execAsyncRemote.mockImplementation(
-			(_serverId: string, command: string) => {
-				if (command.includes("curl")) {
-					return new Promise(() => undefined);
-				}
-				return Promise.resolve({
-					stdout: "192.0.2.10\n",
-					stderr: "",
-				});
-			},
-		);
-
-		const candidatesPromise = getServerIpCandidates("server-id");
-		await vi.advanceTimersByTimeAsync(7000);
-
-		await expect(candidatesPromise).resolves.toEqual([
-			"10.0.0.10",
-			"192.0.2.10",
-		]);
-	});
-});
-
-describe("validateDomain", () => {
-	afterEach(() => {
-		vi.clearAllMocks();
-	});
-
-	it("validates an IPv6-only domain against an IPv6 server address", async () => {
-		const noIpv4 = Object.assign(new Error("queryA ENODATA example.com"), {
-			code: "ENODATA",
-		});
-		mocks.resolve4.mockImplementation(
-			(_domain: string, callback: (error: Error | null) => void) =>
-				callback(noIpv4),
-		);
-		mocks.resolve6.mockImplementation(
-			(
-				_domain: string,
-				callback: (error: Error | null, addresses?: string[]) => void,
-			) => callback(null, ["2001:db8::10"]),
-		);
-
-		await expect(
-			validateDomain("example.com", ["2001:db8::10"]),
-		).resolves.toMatchObject({
-			isValid: true,
-			resolvedIp: "2001:db8::10",
-		});
-	});
-});
@@ -1,195 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-type HasInput = { input: Record<string, unknown> };
-
-const findMany = vi.hoisted(() => vi.fn());
-
-const {
-	send,
-	paginate,
-	SSMClient,
-	GetParametersCommand,
-	DescribeParametersCommand,
-} = vi.hoisted(() => {
-	class FakeCommand {
-		input: Record<string, unknown>;
-		constructor(input: Record<string, unknown>) {
-			this.input = input;
-		}
-	}
-	const send = vi.fn();
-	const paginate = vi.fn();
-	class SSMClient {
-		send(command: unknown) {
-			return send(command);
-		}
-	}
-	return {
-		send,
-		paginate,
-		SSMClient,
-		GetParametersCommand: class extends FakeCommand {},
-		DescribeParametersCommand: class extends FakeCommand {},
-	};
-});
-
-vi.mock("@aws-sdk/client-ssm", () => ({
-	SSMClient,
-	GetParametersCommand,
-	DescribeParametersCommand,
-	paginateDescribeParameters: paginate,
-}));
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: {
-			vaultProvider: {
-				findMany: (...args: unknown[]) => findMany(...args),
-			},
-		},
-	},
-}));
-
-import { resolveVaultReferences } from "@dokploy/server/utils/vault";
-import { awsParameterStoreClient } from "@dokploy/server/utils/vault/aws-parameter-store";
-
-const config = {
-	providerType: "aws-parameter-store" as const,
-	region: "eu-central-1",
-	accessKeyId: "AKIA_TEST",
-	secretAccessKey: "secret",
-};
-
-beforeEach(() => {
-	send.mockReset();
-	paginate.mockReset();
-	findMany.mockReset();
-});
-
-describe("awsParameterStoreClient", () => {
-	it("decrypts parameters in batches of ten and preserves selectors", async () => {
-		const refs = [
-			"/prod/database:CURRENT",
-			...Array.from({ length: 10 }, (_, index) => `/prod/secret-${index}`),
-		];
-		send.mockImplementation(async (command: HasInput) => ({
-			Parameters: (command.input.Names as string[]).map((ref) => {
-				if (ref === "/prod/database:CURRENT") {
-					return {
-						Name: "/prod/database",
-						Selector: ":CURRENT",
-						Value: "selected-value",
-					};
-				}
-				return { Name: ref, Value: `value-for-${ref}` };
-			}),
-		}));
-
-		const result = await awsParameterStoreClient.getSecrets(config, refs);
-
-		expect(send).toHaveBeenCalledTimes(2);
-		expect((send.mock.calls[0]?.[0] as HasInput).input).toMatchObject({
-			WithDecryption: true,
-		});
-		expect(
-			((send.mock.calls[0]?.[0] as HasInput).input.Names as string[]).length,
-		).toBe(10);
-		expect(
-			((send.mock.calls[1]?.[0] as HasInput).input.Names as string[]).length,
-		).toBe(1);
-		expect(result["/prod/database:CURRENT"]).toBe("selected-value");
-		expect(result["/prod/secret-9"]).toBe("value-for-/prod/secret-9");
-	});
-
-	it("reports a missing parameter without exposing other values", async () => {
-		send.mockResolvedValue({ Parameters: [], InvalidParameters: ["/missing"] });
-
-		await expect(
-			awsParameterStoreClient.getSecrets(config, ["/missing"]),
-		).rejects.toThrow('AWS Parameter Store: parameter "/missing" not found');
-	});
-
-	it("tests the connection within the configured hierarchy", async () => {
-		send.mockResolvedValue({ Parameters: [] });
-
-		await awsParameterStoreClient.testConnection({
-			...config,
-			parameterPath: "/production/my-app/",
-		});
-
-		expect(send).toHaveBeenCalledTimes(1);
-		expect((send.mock.calls[0]?.[0] as HasInput).input).toEqual({
-			ParameterFilters: [
-				{
-					Key: "Path",
-					Option: "Recursive",
-					Values: ["/production/my-app"],
-				},
-			],
-			MaxResults: 1,
-		});
-	});
-
-	it("explains the discovery permission when connection testing is denied", async () => {
-		const error = new Error("not authorized");
-		error.name = "AccessDeniedException";
-		send.mockRejectedValue(error);
-
-		await expect(
-			awsParameterStoreClient.testConnection(config),
-		).rejects.toThrow("ssm:DescribeParameters");
-	});
-
-	it("lists parameter names across pages within the configured hierarchy", async () => {
-		paginate.mockReturnValue(
-			(async function* () {
-				yield { Parameters: [{ Name: "/prod/db" }] };
-				yield { Parameters: [{ Name: "/prod/api" }] };
-			})(),
-		);
-
-		const names = await awsParameterStoreClient.listSecretNames?.({
-			...config,
-			parameterPath: " /production/my-app/ ",
-		});
-
-		expect(names).toEqual(["/prod/db", "/prod/api"]);
-		expect(paginate).toHaveBeenCalledWith(
-			expect.objectContaining({ pageSize: 50 }),
-			{
-				ParameterFilters: [
-					{
-						Key: "Path",
-						Option: "Recursive",
-						Values: ["/production/my-app"],
-					},
-				],
-			},
-		);
-	});
-
-	it("resolves a vault reference through the registered provider", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "ssm-prod",
-				providerType: "aws-parameter-store",
-				config,
-				assignments: [{ projectId: "project-1", environmentIds: [] }],
-			},
-		]);
-		send.mockResolvedValue({
-			Parameters: [{ Name: "/prod/database-password", Value: "resolved" }],
-		});
-
-		const result = await resolveVaultReferences(
-			"DB_PASSWORD=${{vault.ssm-prod./prod/database-password}}",
-			{
-				organizationId: "organization-1",
-				projectId: "project-1",
-				environmentId: "environment-1",
-			},
-		);
-
-		expect(result).toBe("DB_PASSWORD=resolved");
-	});
-});
@@ -20,9 +20,6 @@ import {
 import { azureClient } from "@dokploy/server/utils/vault/azure";
 import { dopplerClient } from "@dokploy/server/utils/vault/doppler";
 import { hashicorpClient } from "@dokploy/server/utils/vault/hashicorp";
-import { infisicalClient } from "@dokploy/server/utils/vault/infisical";
-import { phaseClient } from "@dokploy/server/utils/vault/phase";
-import { scalewayClient } from "@dokploy/server/utils/vault/scaleway";

 const mockFetch = vi.fn();
 global.fetch = mockFetch as typeof fetch;
@@ -432,223 +429,6 @@ describe("azure client", () => {
 	});
 });

-describe("infisical client", () => {
-	const config = {
-		providerType: "infisical" as const,
-		siteUrl: "https://app.infisical.com",
-		clientId: "client-1",
-		clientSecret: "client-secret",
-		projectId: "workspace-1",
-		environmentSlug: "prod",
-		secretPath: "/frontend",
-	};
-
-	const loginResponse = () => jsonResponse({ accessToken: "token-1" });
-	const list = (secrets: Record<string, string>) =>
-		jsonResponse({
-			secrets: Object.entries(secrets).map(([secretKey, secretValue]) => ({
-				secretKey,
-				secretValue,
-			})),
-		});
-	const listPathOf = (callIndex: number) => {
-		const [url] = mockFetch.mock.calls[callIndex] as [string];
-		return new URL(url).searchParams.get("secretPath");
-	};
-
-	it("asks the list endpoint to expand secret references", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(list({ DB_URL: "postgres://real" }));
-
-		const result = await infisicalClient.getSecrets(config, ["DB_URL"]);
-
-		expect(result).toEqual({ DB_URL: "postgres://real" });
-		const [listUrl] = mockFetch.mock.calls[1] as [string];
-		const params = new URL(listUrl).searchParams;
-		expect(params.get("expandSecretReferences")).toBe("true");
-		expect(params.get("workspaceId")).toBe("workspace-1");
-		expect(params.get("environment")).toBe("prod");
-		expect(params.get("secretPath")).toBe("/frontend");
-	});
-
-	it("asks for imported secrets and merges them", async () => {
-		mockFetch.mockResolvedValueOnce(loginResponse()).mockResolvedValueOnce(
-			jsonResponse({
-				secrets: [],
-				imports: [
-					{
-						secretPath: "/shared",
-						secrets: [
-							{ secretKey: "DB_URL", secretValue: "postgres://imported" },
-						],
-					},
-				],
-			}),
-		);
-
-		const result = await infisicalClient.getSecrets(config, ["DB_URL"]);
-
-		expect(result).toEqual({ DB_URL: "postgres://imported" });
-		const [listUrl] = mockFetch.mock.calls[1] as [string];
-		// snake_case on purpose: `includeImports` is silently ignored and the
-		// response comes back with an empty `imports` array.
-		expect(new URL(listUrl).searchParams.get("include_imports")).toBe("true");
-	});
-
-	it("lets the later import win when two define the same key", async () => {
-		mockFetch.mockResolvedValueOnce(loginResponse()).mockResolvedValueOnce(
-			jsonResponse({
-				secrets: [],
-				imports: [
-					{
-						secretPath: "/base",
-						secrets: [{ secretKey: "DB_URL", secretValue: "postgres://base" }],
-					},
-					{
-						secretPath: "/override",
-						secrets: [
-							{ secretKey: "DB_URL", secretValue: "postgres://override" },
-						],
-					},
-				],
-			}),
-		);
-
-		const result = await infisicalClient.getSecrets(config, ["DB_URL"]);
-
-		// Infisical documents this order: "If two imports carry a secret with the
-		// same name, the value from the bottom-most import wins." The response
-		// lists imports in that order, so assigning them in sequence matches it.
-		expect(result).toEqual({ DB_URL: "postgres://override" });
-	});
-
-	it("lets a folder's own secret win over an imported one of the same name", async () => {
-		mockFetch.mockResolvedValueOnce(loginResponse()).mockResolvedValueOnce(
-			jsonResponse({
-				secrets: [{ secretKey: "DB_URL", secretValue: "postgres://local" }],
-				imports: [
-					{
-						secretPath: "/shared",
-						secrets: [
-							{ secretKey: "DB_URL", secretValue: "postgres://imported" },
-						],
-					},
-				],
-			}),
-		);
-
-		const result = await infisicalClient.getSecrets(config, ["DB_URL"]);
-
-		expect(result).toEqual({ DB_URL: "postgres://local" });
-	});
-
-	it("throws a clear error for a missing secret", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(jsonResponse({ secrets: [] }));
-
-		await expect(
-			infisicalClient.getSecrets(config, ["ABSENT"]),
-		).rejects.toThrow('secret "ABSENT" not found in environment "prod"');
-	});
-
-	it("propagates authentication failures with the status code", async () => {
-		mockFetch.mockResolvedValueOnce(jsonResponse({}, false, 401));
-
-		await expect(
-			infisicalClient.getSecrets(config, ["DB_URL"]),
-		).rejects.toThrow("authentication failed (status 401)");
-	});
-
-	it("resolves a relative <path>:<KEY> ref against the provider path", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(list({ SENTRY_DSN: "https://key@sentry.io/1" }));
-
-		const result = await infisicalClient.getSecrets(config, [
-			"shared/sentry:SENTRY_DSN",
-		]);
-
-		expect(result).toEqual({
-			"shared/sentry:SENTRY_DSN": "https://key@sentry.io/1",
-		});
-		expect(listPathOf(1)).toBe("/frontend/shared/sentry");
-	});
-
-	it("treats a leading slash as an absolute path", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(list({ SENTRY_DSN: "https://key@sentry.io/1" }));
-
-		await infisicalClient.getSecrets(config, ["/external/sentry:SENTRY_DSN"]);
-
-		expect(listPathOf(1)).toBe("/external/sentry");
-	});
-
-	it("keeps the root path clean when the provider sits at /", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(list({ KEY: "value" }));
-
-		await infisicalClient.getSecrets({ ...config, secretPath: "/" }, [
-			"external/sentry:KEY",
-		]);
-
-		expect(listPathOf(1)).toBe("/external/sentry");
-	});
-
-	it("logs in once and fetches each path once", async () => {
-		const byPath: Record<string, Record<string, string>> = {
-			"/frontend": { A: "a", B: "b" },
-			"/frontend/other": { C: "c" },
-		};
-		mockFetch.mockImplementation(async (url: string) => {
-			if (url.includes("/auth/universal-auth/login")) return loginResponse();
-			const path = new URL(url).searchParams.get("secretPath") as string;
-			return list(byPath[path] ?? {});
-		});
-
-		const result = await infisicalClient.getSecrets(config, [
-			"A",
-			"B",
-			"other:C",
-		]);
-
-		expect(result).toEqual({ A: "a", B: "b", "other:C": "c" });
-
-		const urls = mockFetch.mock.calls.map(([url]) => url as string);
-		expect(urls.filter((u) => u.includes("/login"))).toHaveLength(1);
-		expect(
-			urls
-				.filter((u) => u.includes("/secrets/raw?"))
-				.map((u) => new URL(u).searchParams.get("secretPath"))
-				.sort(),
-		).toEqual(["/frontend", "/frontend/other"]);
-	});
-
-	it("names the path when a secret is missing from an explicit one", async () => {
-		mockFetch
-			.mockResolvedValueOnce(loginResponse())
-			.mockResolvedValueOnce(list({}));
-
-		await expect(
-			infisicalClient.getSecrets(config, ["external/sentry:ABSENT"]),
-		).rejects.toThrow(
-			'secret "ABSENT" not found at "/frontend/external/sentry"',
-		);
-	});
-
-	it("rejects a ref with an empty path or key", async () => {
-		await expect(infisicalClient.getSecrets(config, [":KEY"])).rejects.toThrow(
-			"expected format <path>:<KEY>",
-		);
-		await expect(
-			infisicalClient.getSecrets(config, ["external/sentry:"]),
-		).rejects.toThrow("expected format <path>:<KEY>");
-	});
-});
-
 describe("doppler client", () => {
 	it("propagates auth errors with the status code", async () => {
 		mockFetch.mockResolvedValue(jsonResponse({}, false, 401));
@@ -660,304 +440,3 @@ describe("doppler client", () => {
 		).rejects.toThrow("status 401");
 	});
 });
-
-describe("scaleway client", () => {
-	const config = {
-		providerType: "scaleway" as const,
-		region: "fr-par",
-		projectId: "project-1",
-		secretKey: "scw-secret-key",
-		apiUrl: "https://api.scaleway.com",
-	};
-
-	const accessResponse = (value: string) =>
-		jsonResponse({
-			secret_id: "secret-1",
-			revision: 1,
-			data: Buffer.from(value).toString("base64"),
-		});
-
-	it("reads a secret by name from the root path and decodes the payload", async () => {
-		mockFetch.mockResolvedValue(accessResponse("postgres://real"));
-
-		const result = await scalewayClient.getSecrets(config, ["db-url"]);
-
-		expect(result).toEqual({ "db-url": "postgres://real" });
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect(url).toBe(
-			"https://api.scaleway.com/secret-manager/v1beta1/regions/fr-par/secrets-by-path/versions/latest_enabled/access?project_id=project-1&secret_name=db-url&secret_path=%2F",
-		);
-		expect((init.headers as Record<string, string>)["X-Auth-Token"]).toBe(
-			"scw-secret-key",
-		);
-	});
-
-	it("sends the folder of a path-qualified ref as secret_path", async () => {
-		mockFetch.mockResolvedValue(accessResponse("value"));
-
-		await scalewayClient.getSecrets(config, ["prod/db/password"]);
-
-		expect(mockFetch.mock.calls[0]?.[0]).toContain(
-			"secret_name=password&secret_path=%2Fprod%2Fdb",
-		);
-	});
-
-	it("extracts a field from a JSON secret and fetches the secret once", async () => {
-		mockFetch.mockResolvedValue(
-			accessResponse(JSON.stringify({ user: "admin", port: 5432 })),
-		);
-
-		const result = await scalewayClient.getSecrets(config, [
-			"db-creds:user",
-			"db-creds:port",
-		]);
-
-		expect(result).toEqual({
-			"db-creds:user": "admin",
-			"db-creds:port": "5432",
-		});
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-	});
-
-	it("throws when the secret is not JSON but a field is requested", async () => {
-		mockFetch.mockResolvedValue(accessResponse("plain-value"));
-
-		await expect(
-			scalewayClient.getSecrets(config, ["db-creds:user"]),
-		).rejects.toThrow("is not JSON");
-	});
-
-	it("throws when the requested field is missing", async () => {
-		mockFetch.mockResolvedValue(accessResponse(JSON.stringify({ user: "a" })));
-
-		await expect(
-			scalewayClient.getSecrets(config, ["db-creds:password"]),
-		).rejects.toThrow('field "password" not found');
-	});
-
-	it("throws a clear error for a missing secret", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse({ message: "not found" }, false, 404),
-		);
-
-		await expect(scalewayClient.getSecrets(config, ["nope"])).rejects.toThrow(
-			'secret "nope" not found in path "/"',
-		);
-	});
-
-	it("reports authentication failures with the API message", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse({ message: "denied authentication" }, false, 403),
-		);
-
-		await expect(scalewayClient.getSecrets(config, ["db-url"])).rejects.toThrow(
-			"authentication failed (status 403: denied authentication)",
-		);
-	});
-
-	it("throws when the secret has no enabled version", async () => {
-		mockFetch.mockResolvedValue(jsonResponse({ secret_id: "secret-1" }));
-
-		await expect(scalewayClient.getSecrets(config, ["db-url"])).rejects.toThrow(
-			"has no enabled version",
-		);
-	});
-
-	it("rejects a ref without a secret name", async () => {
-		await expect(scalewayClient.getSecrets(config, ["prod/"])).rejects.toThrow(
-			"expected format <name> or <folder>/<name>[:field]",
-		);
-	});
-
-	it("tests the connection against the secrets listing", async () => {
-		mockFetch.mockResolvedValue(jsonResponse({ secrets: [], total_count: 0 }));
-
-		await scalewayClient.testConnection(config);
-
-		expect(mockFetch.mock.calls[0]?.[0]).toBe(
-			"https://api.scaleway.com/secret-manager/v1beta1/regions/fr-par/secrets?project_id=project-1&page_size=1",
-		);
-	});
-
-	it("lists secret names with their folder prefix", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse({
-				secrets: [
-					{ id: "1", name: "db-url", path: "/" },
-					{ id: "2", name: "password", path: "/prod/db" },
-				],
-				total_count: 2,
-			}),
-		);
-
-		const names = await scalewayClient.listSecretNames?.(config);
-
-		expect(names).toEqual(["db-url", "prod/db/password"]);
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-	});
-
-	it("follows pagination until a short page is returned", async () => {
-		const page = (start: number, size: number) =>
-			jsonResponse({
-				secrets: Array.from({ length: size }, (_, index) => ({
-					id: String(start + index),
-					name: `secret-${start + index}`,
-					path: "/",
-				})),
-			});
-		mockFetch.mockImplementation(async (url: string) =>
-			url.includes("page=2") ? page(101, 2) : page(1, 100),
-		);
-
-		const names = await scalewayClient.listSecretNames?.(config);
-
-		expect(names).toHaveLength(102);
-		expect(mockFetch).toHaveBeenCalledTimes(2);
-	});
-
-	it("resolves env refs end to end through a scaleway provider", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "scw-prod",
-				providerType: "scaleway",
-				config,
-				assignments: assignedEverywhere,
-			},
-		]);
-		mockFetch.mockResolvedValue(accessResponse("s3cret"));
-
-		const result = await resolveVaultReferences(
-			"DB_PASSWORD=${{vault.scw-prod.prod/db-password}}",
-			scope,
-		);
-
-		expect(result).toBe("DB_PASSWORD=s3cret");
-	});
-});
-
-describe("phase client", () => {
-	const config = {
-		providerType: "phase" as const,
-		token: "phase-rest-token",
-		appId: "app-123",
-		env: "Production",
-		path: "/",
-		apiUrl: "https://api.phase.dev",
-	};
-
-	it("fetches secrets by key and sends ServiceAccount auth", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse([
-				{ key: "DB_URL", value: "postgres://real", path: "/" },
-				{ key: "API_KEY", value: "key-123", path: "/" },
-			]),
-		);
-
-		const result = await phaseClient.getSecrets(config, ["DB_URL", "API_KEY"]);
-
-		expect(result).toEqual({ DB_URL: "postgres://real", API_KEY: "key-123" });
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-		const [url, init] = mockFetch.mock.calls[0] as [string, RequestInit];
-		expect(url).toBe(
-			"https://api.phase.dev/v1/secrets/?app_id=app-123&env=Production&path=%2F",
-		);
-		expect((init.headers as Record<string, string>).Authorization).toBe(
-			"Bearer ServiceAccount phase-rest-token",
-		);
-	});
-
-	it("throws when a requested secret is missing", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse([{ key: "DB_URL", value: "postgres://real", path: "/" }]),
-		);
-
-		await expect(phaseClient.getSecrets(config, ["MISSING"])).rejects.toThrow(
-			'secret "MISSING" not found in environment "Production"',
-		);
-	});
-
-	it("reports authentication failures with the status code", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse({ error: "unauthorized" }, false, 401),
-		);
-
-		await expect(phaseClient.getSecrets(config, ["DB_URL"])).rejects.toThrow(
-			"authentication failed (status 401: unauthorized)",
-		);
-	});
-
-	it("rejects apps without SSE enabled during testConnection", async () => {
-		mockFetch.mockResolvedValueOnce(
-			jsonResponse({
-				id: "app-123",
-				name: "My App",
-				sseEnabled: false,
-			}),
-		);
-
-		await expect(phaseClient.testConnection(config)).rejects.toThrow(
-			"enable Server-side Encryption (SSE)",
-		);
-		expect(mockFetch).toHaveBeenCalledTimes(1);
-		expect(mockFetch.mock.calls[0]?.[0]).toBe(
-			"https://api.phase.dev/v1/apps/app-123/",
-		);
-	});
-
-	it("tests connection against the app then secrets listing", async () => {
-		mockFetch
-			.mockResolvedValueOnce(
-				jsonResponse({
-					id: "app-123",
-					name: "My App",
-					sseEnabled: true,
-				}),
-			)
-			.mockResolvedValueOnce(jsonResponse([]));
-
-		await phaseClient.testConnection(config);
-
-		expect(mockFetch).toHaveBeenCalledTimes(2);
-		expect(mockFetch.mock.calls[0]?.[0]).toBe(
-			"https://api.phase.dev/v1/apps/app-123/",
-		);
-		expect(mockFetch.mock.calls[1]?.[0]).toBe(
-			"https://api.phase.dev/v1/secrets/?app_id=app-123&env=Production&path=%2F",
-		);
-	});
-
-	it("lists secret names from the configured path", async () => {
-		mockFetch.mockResolvedValue(
-			jsonResponse([
-				{ key: "DB_URL", value: "x", path: "/" },
-				{ key: "API_KEY", value: "y", path: "/" },
-			]),
-		);
-
-		const names = await phaseClient.listSecretNames?.(config);
-
-		expect(names).toEqual(["DB_URL", "API_KEY"]);
-	});
-
-	it("resolves env refs end to end through a phase provider", async () => {
-		findMany.mockResolvedValue([
-			{
-				name: "phase-prod",
-				providerType: "phase",
-				config,
-				assignments: assignedEverywhere,
-			},
-		]);
-		mockFetch.mockResolvedValue(
-			jsonResponse([{ key: "DB_PASSWORD", value: "s3cret", path: "/" }]),
-		);
-
-		const result = await resolveVaultReferences(
-			"DB_PASSWORD=${{vault.phase-prod.DB_PASSWORD}}",
-			scope,
-		);
-
-		expect(result).toBe("DB_PASSWORD=s3cret");
-	});
-});
@@ -1,99 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const store = vi.hoisted(() => ({
-	provider: {} as Record<string, unknown>,
-}));
-
-vi.mock("@dokploy/server/services/gitlab", () => ({
-	findGitlabById: vi.fn(async () => ({ ...store.provider })),
-	updateGitlab: vi.fn(async (_id: string, values: Record<string, unknown>) => {
-		store.provider = { ...store.provider, ...values };
-	}),
-}));
-
-const { refreshGitlabToken } = await import(
-	"@dokploy/server/utils/providers/gitlab"
-);
-
-const GITLAB_ID = "gitlab-1";
-
-// Behaves like GitLab: a refresh returns a new pair and invalidates the refresh token it used
-const createGitlab = () => {
-	let validRefreshToken = "refresh-1";
-	let issued = 1;
-	let failNext = false;
-
-	const fetch = vi.fn(async (_url: string, init: RequestInit) => {
-		const body = new URLSearchParams(init.body as string);
-		// Keeps the request open, so concurrent callers overlap as two deployments do
-		await new Promise((resolve) => setTimeout(resolve, 20));
-
-		if (failNext) {
-			failNext = false;
-			return new Response(null, {
-				status: 500,
-				statusText: "Internal Server Error",
-			});
-		}
-
-		if (body.get("refresh_token") !== validRefreshToken) {
-			return new Response(null, { status: 400, statusText: "Bad Request" });
-		}
-
-		issued++;
-		validRefreshToken = `refresh-${issued}`;
-		return Response.json({
-			access_token: `access-${issued}`,
-			refresh_token: validRefreshToken,
-			expires_in: 7200,
-		});
-	});
-
-	return {
-		fetch,
-		failNextRequest: () => {
-			failNext = true;
-		},
-	};
-};
-
-describe("refreshGitlabToken", () => {
-	let gitlab: ReturnType<typeof createGitlab>;
-
-	beforeEach(() => {
-		store.provider = {
-			gitlabId: GITLAB_ID,
-			gitlabUrl: "https://gitlab.example.com",
-			gitlabInternalUrl: null,
-			applicationId: "app-id",
-			secret: "app-secret",
-			accessToken: "access-1",
-			refreshToken: "refresh-1",
-			expiresAt: 0,
-		};
-		gitlab = createGitlab();
-		vi.stubGlobal("fetch", gitlab.fetch);
-	});
-
-	it("sends one refresh request when two callers find the token expired at the same time", async () => {
-		await Promise.all([
-			refreshGitlabToken(GITLAB_ID),
-			refreshGitlabToken(GITLAB_ID),
-		]);
-
-		expect(gitlab.fetch).toHaveBeenCalledTimes(1);
-		expect(store.provider.refreshToken).toBe("refresh-2");
-	});
-
-	it("refreshes again after a failed refresh", async () => {
-		gitlab.failNextRequest();
-
-		await expect(refreshGitlabToken(GITLAB_ID)).rejects.toThrow(
-			"Failed to refresh token: Internal Server Error",
-		);
-		await refreshGitlabToken(GITLAB_ID);
-
-		expect(gitlab.fetch).toHaveBeenCalledTimes(2);
-		expect(store.provider.refreshToken).toBe("refresh-2");
-	});
-});
@@ -1,46 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { isHttpsRequest, secureSetCookie } from "@/lib/secure-cookies";
-
-describe("isHttpsRequest", () => {
-	it("returns true when X-Forwarded-Proto is https", () => {
-		expect(isHttpsRequest("https")).toBe(true);
-	});
-
-	it("returns false for http or a missing header", () => {
-		expect(isHttpsRequest("http")).toBe(false);
-		expect(isHttpsRequest(undefined)).toBe(false);
-	});
-
-	it("uses the left-most value of a proxy chain", () => {
-		expect(isHttpsRequest("https, http")).toBe(true);
-		expect(isHttpsRequest("http, https")).toBe(false);
-	});
-
-	it("handles an array header value and is case-insensitive", () => {
-		expect(isHttpsRequest(["HTTPS", "http"])).toBe(true);
-	});
-});
-
-describe("secureSetCookie", () => {
-	it("adds Secure to a cookie that lacks it", () => {
-		expect(
-			secureSetCookie("better-auth.session_token=abc; Path=/; HttpOnly"),
-		).toBe("better-auth.session_token=abc; Path=/; HttpOnly; Secure");
-	});
-
-	it("does not duplicate Secure when already present", () => {
-		const cookie = "better-auth.session_token=abc; Path=/; Secure; HttpOnly";
-		expect(secureSetCookie(cookie)).toBe(cookie);
-	});
-
-	it("applies to every cookie in an array", () => {
-		expect(secureSetCookie(["a=1; Path=/", "b=2; Path=/; Secure"])).toEqual([
-			"a=1; Path=/; Secure",
-			"b=2; Path=/; Secure",
-		]);
-	});
-
-	it("passes a numeric header value through untouched", () => {
-		expect(secureSetCookie(123)).toBe(123);
-	});
-});
@@ -1,66 +0,0 @@
-import { apiCreateLibsql } from "@dokploy/server/db/schema";
-import { APP_NAME_MESSAGE } from "@dokploy/server/db/schema/utils";
-import { describe, expect, it } from "vitest";
-
-describe("apiCreateLibsql appName", () => {
-	const validBase = {
-		name: "My libSQL",
-		dockerImage: "ghcr.io/tursodatabase/libsql-server:v0.24.32",
-		environmentId: "env-1",
-		description: null,
-		databaseUser: "admin",
-		databasePassword: "secretPassword1",
-		sqldNode: "primary" as const,
-		sqldPrimaryUrl: null,
-		enableNamespaces: false,
-		serverId: null,
-	};
-
-	it.each([
-		["a space", "my libsql"],
-		["an at sign", "repro@lib"],
-		["a slash", "team/libsql"],
-		["a colon", "libsql:1"],
-	])("refuses an appName with %s", (_, appName) => {
-		const result = apiCreateLibsql.safeParse({ ...validBase, appName });
-		expect(result.success).toBe(false);
-		if (!result.success) {
-			const appNameIssues = result.error.issues.filter(
-				(issue) => issue.path[0] === "appName",
-			);
-			expect(appNameIssues.map((issue) => issue.message)).toEqual([
-				APP_NAME_MESSAGE,
-			]);
-		}
-	});
-
-	it("accepts an appName of letters, numbers, dots, underscores and hyphens", () => {
-		const result = apiCreateLibsql.safeParse({
-			...validBase,
-			appName: "my-libsql.db_1",
-		});
-		expect(result.success).toBe(true);
-	});
-
-	it("refuses an appName longer than 63 characters", () => {
-		const result = apiCreateLibsql.safeParse({
-			...validBase,
-			appName: "a".repeat(64),
-		});
-		expect(result.success).toBe(false);
-		if (!result.success) {
-			const appNameIssues = result.error.issues.filter(
-				(issue) => issue.path[0] === "appName",
-			);
-			expect(appNameIssues.map((issue) => issue.code)).toEqual(["too_big"]);
-		}
-	});
-
-	it("accepts an appName of 63 characters", () => {
-		const result = apiCreateLibsql.safeParse({
-			...validBase,
-			appName: "a".repeat(63),
-		});
-		expect(result.success).toBe(true);
-	});
-});
@@ -1,56 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	findOwnedOrganizations: vi.fn(),
-	transaction: vi.fn(),
-	removeVectorAgents: vi.fn(),
-	calls: [] as string[],
-}));
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: { organization: { findMany: mocks.findOwnedOrganizations } },
-		transaction: mocks.transaction,
-	},
-}));
-vi.mock("@dokploy/server/services/organization", () => ({
-	removeVectorAgents: mocks.removeVectorAgents,
-}));
-
-const { deleteUserAccountData } = await import(
-	"@dokploy/server/services/account-deletion"
-);
-
-beforeEach(() => {
-	mocks.calls.length = 0;
-	mocks.findOwnedOrganizations.mockReset();
-	mocks.removeVectorAgents
-		.mockReset()
-		.mockImplementation(async (id: string) => mocks.calls.push(`agents:${id}`));
-	mocks.transaction.mockReset().mockImplementation(async () => {
-		mocks.calls.push("delete");
-		return { email: "a@b.c", organizationsDeleted: 2 };
-	});
-});
-
-describe("deleteUserAccountData", () => {
-	it("removes the Vector agents of every owned organization before deleting the user", async () => {
-		mocks.findOwnedOrganizations.mockResolvedValue([
-			{ id: "org-a" },
-			{ id: "org-b" },
-		]);
-
-		await deleteUserAccountData("user-1");
-
-		expect(mocks.calls).toEqual(["agents:org-a", "agents:org-b", "delete"]);
-	});
-
-	it("deletes the user without touching agents when it owns no organization", async () => {
-		mocks.findOwnedOrganizations.mockResolvedValue([]);
-
-		await deleteUserAccountData("user-1");
-
-		expect(mocks.removeVectorAgents).not.toHaveBeenCalled();
-		expect(mocks.calls).toEqual(["delete"]);
-	});
-});
@@ -1,542 +0,0 @@
-import {
-	getTelemetryProviderAdapter,
-	telemetryProviderAdapters,
-} from "@dokploy/server/services/logs-and-metrics/providers/registry";
-import type { TelemetryProviderRuntimeConfig } from "@dokploy/server/services/logs-and-metrics/types";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-const aws = vi.hoisted(() => ({
-	describeLogGroups: vi.fn(),
-	putMetricData: vi.fn(),
-}));
-
-vi.mock("node:dns/promises", () => ({
-	lookup: async () => [{ address: "93.184.216.34" }],
-}));
-vi.mock("@aws-sdk/client-cloudwatch-logs", () => ({
-	CloudWatchLogsClient: class {
-		send = aws.describeLogGroups;
-	},
-	DescribeLogGroupsCommand: class {
-		constructor(public input: unknown) {}
-	},
-}));
-vi.mock("@aws-sdk/client-cloudwatch", () => ({
-	CloudWatchClient: class {
-		send = aws.putMetricData;
-	},
-	PutMetricDataCommand: class {
-		constructor(public input: unknown) {}
-	},
-}));
-
-const baseConfig: TelemetryProviderRuntimeConfig = {
-	telemetryProviderId: "provider-1",
-	name: "test",
-	signals: ["metrics"],
-	endpoint: null,
-	apiKey: null,
-	apiSecret: null,
-	extraConfig: null,
-};
-
-const originalFetch = global.fetch;
-const fetchMock = vi.fn();
-
-const respond = (status: number, body: unknown = "") =>
-	new Response(
-		status === 204
-			? null
-			: typeof body === "string"
-				? body
-				: JSON.stringify(body),
-		{ status },
-	);
-
-beforeEach(() => {
-	fetchMock.mockReset();
-	aws.describeLogGroups.mockReset();
-	aws.putMetricData.mockReset();
-	global.fetch = fetchMock as unknown as typeof fetch;
-});
-
-afterEach(() => {
-	global.fetch = originalFetch;
-});
-
-const calledUrls = () => fetchMock.mock.calls.map((call) => String(call[0]));
-
-describe("registry", () => {
-	it("resolves the nine provider types, each with a non-empty valid signal list", () => {
-		const types = [
-			"loki",
-			"prometheus_remote_write",
-			"new_relic",
-			"influxdb",
-			"datadog",
-			"aws_cloudwatch",
-			"splunk_hec",
-			"elasticsearch",
-			"betterstack",
-		] as const;
-		expect(Object.keys(telemetryProviderAdapters).sort()).toEqual(
-			[...types].sort(),
-		);
-		for (const type of types) {
-			const adapter = getTelemetryProviderAdapter(type);
-			expect(adapter.type).toBe(type);
-			expect(adapter.signals.length).toBeGreaterThan(0);
-			expect(
-				adapter.signals.every((s) => s === "logs" || s === "metrics"),
-			).toBe(true);
-		}
-		expect(telemetryProviderAdapters.loki.signals).toEqual(["logs"]);
-		expect(telemetryProviderAdapters.prometheus_remote_write.signals).toEqual([
-			"metrics",
-		]);
-		expect(telemetryProviderAdapters.datadog.signals).toEqual([
-			"logs",
-			"metrics",
-		]);
-	});
-});
-
-describe("prometheusRemoteWriteAdapter", () => {
-	const adapter = telemetryProviderAdapters.prometheus_remote_write;
-	const endpoint = "http://prom.example.com:9090/api/v1/write";
-
-	it("builds a sink without auth, with the healthcheck disabled", () => {
-		const sink = adapter.toVectorSink(
-			{ ...baseConfig, endpoint },
-			"sink_1",
-			"dokploy_metrics_scope",
-			"metrics",
-		);
-		expect(sink).toMatchObject({
-			type: "prometheus_remote_write",
-			inputs: ["dokploy_metrics_scope"],
-			endpoint,
-			healthcheck: { enabled: false },
-		});
-		expect(sink.auth).toBeUndefined();
-		expect(sink.tenant_id).toBeUndefined();
-	});
-
-	it("uses basic auth with a username, bearer with a token alone, and sets tenant_id", () => {
-		const basic = adapter.toVectorSink(
-			{
-				...baseConfig,
-				endpoint,
-				apiKey: "pw",
-				extraConfig: { username: "12345", tenantId: "team-a" },
-			},
-			"sink_1",
-			"scope",
-			"metrics",
-		);
-		expect(basic.auth).toEqual({
-			strategy: "basic",
-			user: "12345",
-			password: "pw",
-		});
-		expect(basic.tenant_id).toBe("team-a");
-
-		const bearer = adapter.toVectorSink(
-			{ ...baseConfig, endpoint, apiKey: "tok" },
-			"sink_1",
-			"scope",
-			"metrics",
-		);
-		expect(bearer.auth).toEqual({ strategy: "bearer", token: "tok" });
-	});
-
-	it("rejects an endpoint that is not an http(s) URL", () => {
-		expect(() =>
-			adapter.validateConfig?.({ ...baseConfig, endpoint: "not a url" }),
-		).toThrow(/valid http\(s\) URL/);
-		expect(() =>
-			adapter.validateConfig?.({ ...baseConfig, endpoint: "ftp://x" }),
-		).toThrow(/valid http\(s\) URL/);
-	});
-
-	it("treats 2xx and 400 as success and gives distinct errors for 401 and 404", async () => {
-		fetchMock.mockResolvedValueOnce(respond(204));
-		await expect(
-			adapter.testConnection?.({ ...baseConfig, endpoint }),
-		).resolves.toBeUndefined();
-
-		fetchMock.mockResolvedValueOnce(respond(400));
-		await expect(
-			adapter.testConnection?.({ ...baseConfig, endpoint }),
-		).resolves.toBeUndefined();
-
-		fetchMock.mockResolvedValueOnce(respond(401));
-		await expect(
-			adapter.testConnection?.({ ...baseConfig, endpoint, apiKey: "bad" }),
-		).rejects.toThrow(/rejected the credentials \(status 401\)/);
-
-		fetchMock.mockResolvedValueOnce(respond(404));
-		await expect(
-			adapter.testConnection?.({ ...baseConfig, endpoint }),
-		).rejects.toThrow(/not found at this URL \(status 404\)/);
-	});
-
-	it("sends the auth header and the tenant header on the test request", async () => {
-		fetchMock.mockResolvedValueOnce(respond(204));
-		await adapter.testConnection?.({
-			...baseConfig,
-			endpoint,
-			apiKey: "tok",
-			extraConfig: { tenantId: "team-a" },
-		});
-		const init = fetchMock.mock.calls[0]?.[1] as RequestInit;
-		expect(init.method).toBe("POST");
-		expect(init.headers).toMatchObject({
-			Authorization: "Bearer tok",
-			"X-Scope-OrgID": "team-a",
-		});
-	});
-});
-
-describe("newRelicAdapter", () => {
-	const adapter = telemetryProviderAdapters.new_relic;
-	const config = {
-		...baseConfig,
-		apiKey: "license",
-		extraConfig: { accountId: "123" },
-	};
-
-	it("defaults to the us region and accepts eu", () => {
-		expect(adapter.toVectorSink(config, "s", "scope", "metrics")).toMatchObject(
-			{
-				type: "new_relic",
-				api: "metrics",
-				license_key: "license",
-				account_id: "123",
-				region: "us",
-			},
-		);
-		expect(
-			adapter.toVectorSink(
-				{ ...config, extraConfig: { accountId: "123", region: "EU" } },
-				"s",
-				"scope",
-				"metrics",
-			).region,
-		).toBe("eu");
-	});
-
-	it("rejects an unknown region", () => {
-		expect(() =>
-			adapter.validateConfig?.({
-				...config,
-				extraConfig: { accountId: "123", region: "jp" },
-			}),
-		).toThrow(/"us" or "eu"/);
-	});
-
-	it("posts a gauge to the regional metric API: 202 passes, 403 is an invalid key", async () => {
-		fetchMock.mockResolvedValueOnce(respond(202));
-		await expect(
-			adapter.testConnection?.({
-				...config,
-				extraConfig: { accountId: "123", region: "eu" },
-			}),
-		).resolves.toBeUndefined();
-		expect(calledUrls()[0]).toBe(
-			"https://metric-api.eu.newrelic.com/metric/v1",
-		);
-
-		fetchMock.mockResolvedValueOnce(respond(403));
-		await expect(adapter.testConnection?.(config)).rejects.toThrow(
-			/rejected the license key/,
-		);
-		expect(calledUrls()[1]).toBe("https://metric-api.newrelic.com/metric/v1");
-	});
-});
-
-describe("influxdbAdapter", () => {
-	const adapter = telemetryProviderAdapters.influxdb;
-	const config = {
-		...baseConfig,
-		endpoint: "http://influx.example.com:8086",
-		apiKey: "token",
-		extraConfig: { org: "dokploy", bucket: "metrics" },
-	};
-
-	it("builds an influxdb_metrics v2 sink", () => {
-		expect(adapter.toVectorSink(config, "s", "scope", "metrics")).toEqual({
-			type: "influxdb_metrics",
-			inputs: ["scope"],
-			endpoint: "http://influx.example.com:8086",
-			org: "dokploy",
-			bucket: "metrics",
-			token: "token",
-			default_namespace: "dokploy",
-			version: "2",
-			buffer: { type: "disk", max_size: 268_435_488, when_full: "block" },
-		});
-	});
-
-	it("writes a test point: 204 passes, 401 and 404 give distinct errors", async () => {
-		fetchMock.mockResolvedValueOnce(respond(204));
-		await expect(adapter.testConnection?.(config)).resolves.toBeUndefined();
-		expect(calledUrls()[0]).toBe(
-			"http://influx.example.com:8086/api/v2/write?org=dokploy&bucket=metrics&precision=s",
-		);
-
-		fetchMock.mockResolvedValueOnce(respond(401));
-		await expect(adapter.testConnection?.(config)).rejects.toThrow(
-			/rejected the token/,
-		);
-
-		fetchMock.mockResolvedValueOnce(respond(404));
-		await expect(adapter.testConnection?.(config)).rejects.toThrow(
-			/organization or bucket not found/,
-		);
-	});
-});
-
-describe("datadogAdapter with metrics", () => {
-	const adapter = telemetryProviderAdapters.datadog;
-	const config = {
-		...baseConfig,
-		signals: ["logs", "metrics"] as const,
-		apiKey: "dd",
-	};
-
-	it("ships metrics through datadog_metrics without a transform", () => {
-		expect(
-			adapter.toVectorTransform?.(config as never, "t", "scope", "metrics"),
-		).toBeNull();
-		expect(
-			adapter.toVectorSink(config as never, "s", "scope", "metrics"),
-		).toMatchObject({
-			type: "datadog_metrics",
-			inputs: ["scope"],
-			default_api_key: "dd",
-			site: "datadoghq.com",
-		});
-	});
-
-	it("keeps the logs sink and ddtags transform unchanged", () => {
-		expect(
-			adapter.toVectorTransform?.(config as never, "t", "scope", "logs"),
-		).toMatchObject({ type: "remap", inputs: ["scope"] });
-		expect(adapter.toVectorSink(config as never, "s", "t", "logs").type).toBe(
-			"datadog_logs",
-		);
-	});
-});
-
-describe("betterStackAdapter with metrics", () => {
-	const adapter = telemetryProviderAdapters.betterstack;
-	const config = {
-		...baseConfig,
-		endpoint: "in.logs.betterstack.com",
-		apiKey: "token",
-	};
-
-	it("posts metrics to /metrics without a transform", () => {
-		expect(
-			adapter.toVectorTransform?.(config, "t", "scope", "metrics"),
-		).toBeNull();
-		expect(adapter.toVectorSink(config, "s", "scope", "metrics")).toMatchObject(
-			{
-				type: "http",
-				uri: "https://in.logs.betterstack.com/metrics",
-				auth: { strategy: "bearer", token: "token" },
-			},
-		);
-		expect(adapter.toVectorSink(config, "s", "scope", "logs").uri).toBe(
-			"https://in.logs.betterstack.com/",
-		);
-	});
-
-	it("tests each selected signal: two requests for logs and metrics, one for logs only", async () => {
-		fetchMock.mockResolvedValue(respond(202));
-		await adapter.testConnection?.({ ...config, signals: ["logs", "metrics"] });
-		expect(calledUrls()).toEqual([
-			"https://in.logs.betterstack.com/",
-			"https://in.logs.betterstack.com/metrics",
-		]);
-
-		fetchMock.mockClear();
-		await adapter.testConnection?.({ ...config, signals: ["logs"] });
-		expect(calledUrls()).toEqual(["https://in.logs.betterstack.com/"]);
-	});
-});
-
-describe("awsCloudwatchAdapter with metrics", () => {
-	const adapter = telemetryProviderAdapters.aws_cloudwatch;
-	const config = {
-		...baseConfig,
-		apiKey: "AKIA",
-		apiSecret: "secret",
-		extraConfig: {
-			region: "us-east-1",
-			logGroup: "/dokploy/logs",
-			metricsNamespace: "Dokploy",
-		},
-	};
-
-	it("scopes the log fields to logs and the namespace to metrics", () => {
-		const bySignal = Object.fromEntries(
-			adapter.credentialFields.map((f) => [f.key, f.signal]),
-		);
-		expect(bySignal).toMatchObject({
-			logGroup: "logs",
-			logStream: "logs",
-			metricsNamespace: "metrics",
-		});
-		expect(bySignal.region).toBeUndefined();
-	});
-
-	it("rejects a namespace starting with AWS/ only when metrics are selected", () => {
-		const bad = {
-			...config,
-			extraConfig: { ...config.extraConfig, metricsNamespace: "AWS/Foo" },
-		};
-		expect(() => adapter.validateConfig?.(bad)).toThrow(
-			/cannot start with AWS\//,
-		);
-		expect(() =>
-			adapter.validateConfig?.({ ...bad, signals: ["logs"] }),
-		).not.toThrow();
-	});
-
-	it("filters metrics to the allowlist and sets the namespace in the transform", () => {
-		const transform = adapter.toVectorTransform?.(
-			config,
-			"t",
-			"scope",
-			"metrics",
-		);
-		expect(transform).toMatchObject({
-			type: "remap",
-			inputs: ["scope"],
-			drop_on_abort: true,
-		});
-		expect(transform?.source).toContain(
-			'if !includes(["cpu_seconds_total","memory_used_bytes","memory_total_bytes","filesystem_used_bytes","filesystem_total_bytes","network_receive_bytes_total","network_transmit_bytes_total","load1","load5","load15","container_cpu_usage_seconds_total","container_memory_usage_bytes","container_network_receive_bytes_total","container_network_transmit_bytes_total"], .name) { abort }',
-		);
-		expect(transform?.source).toContain('.namespace = "Dokploy"');
-		expect(adapter.toVectorSink(config, "s", "t", "metrics")).toMatchObject({
-			type: "aws_cloudwatch_metrics",
-			inputs: ["t"],
-			default_namespace: "Dokploy",
-			region: "us-east-1",
-			auth: { access_key_id: "AKIA", secret_access_key: "secret" },
-		});
-	});
-
-	it("tests metrics with PutMetricData only, and translates AccessDenied", async () => {
-		aws.putMetricData.mockResolvedValue({});
-		await adapter.testConnection?.({ ...config, signals: ["metrics"] });
-		expect(aws.putMetricData).toHaveBeenCalledTimes(1);
-		expect(aws.describeLogGroups).not.toHaveBeenCalled();
-		expect(aws.putMetricData.mock.calls[0]?.[0]).toMatchObject({
-			input: { Namespace: "Dokploy" },
-		});
-
-		aws.putMetricData.mockRejectedValue(
-			Object.assign(new Error("denied"), { name: "AccessDenied" }),
-		);
-		await expect(
-			adapter.testConnection?.({ ...config, signals: ["metrics"] }),
-		).rejects.toThrow(/needs cloudwatch:PutMetricData/);
-	});
-
-	it("tests logs with DescribeLogGroups only", async () => {
-		aws.describeLogGroups.mockResolvedValue({});
-		await adapter.testConnection?.({ ...config, signals: ["logs"] });
-		expect(aws.describeLogGroups).toHaveBeenCalledTimes(1);
-		expect(aws.putMetricData).not.toHaveBeenCalled();
-	});
-});
-
-describe("splunkAdapter with metrics", () => {
-	const adapter = telemetryProviderAdapters.splunk_hec;
-	const config = {
-		...baseConfig,
-		endpoint: "https://splunk.example.com:8088",
-		apiKey: "hec",
-		extraConfig: { metricsIndex: "dokploy_metrics" },
-	};
-
-	it("requires the metrics index only for metrics", () => {
-		const field = adapter.credentialFields.find(
-			(f) => f.key === "metricsIndex",
-		);
-		expect(field).toMatchObject({ required: true, signal: "metrics" });
-		expect(
-			adapter.credentialFields.find((f) => f.key === "index")?.signal,
-		).toBe("logs");
-	});
-
-	it("builds a splunk_hec_metrics sink", () => {
-		expect(adapter.toVectorSink(config, "s", "scope", "metrics")).toMatchObject(
-			{
-				type: "splunk_hec_metrics",
-				endpoint: "https://splunk.example.com:8088",
-				default_token: "hec",
-				index: "dokploy_metrics",
-				source: "dokploy",
-				sourcetype: "dokploy:metrics",
-			},
-		);
-	});
-
-	it("writes a test metric and translates HEC code 7", async () => {
-		fetchMock.mockResolvedValueOnce(respond(200, { text: "Success", code: 0 }));
-		await expect(adapter.testConnection?.(config)).resolves.toBeUndefined();
-		expect(calledUrls()).toEqual([
-			"https://splunk.example.com:8088/services/collector",
-		]);
-
-		fetchMock.mockResolvedValueOnce(
-			respond(400, { text: "Incorrect index", code: 7 }),
-		);
-		await expect(adapter.testConnection?.(config)).rejects.toThrow(
-			/can't write to the metrics index "dokploy_metrics"/,
-		);
-	});
-
-	it("only checks the health endpoint for logs", async () => {
-		fetchMock.mockResolvedValueOnce(respond(200));
-		await adapter.testConnection?.({ ...config, signals: ["logs"] });
-		expect(calledUrls()).toEqual([
-			"https://splunk.example.com:8088/services/collector/health",
-		]);
-	});
-});
-
-describe("elasticsearchAdapter with metrics", () => {
-	const adapter = telemetryProviderAdapters.elasticsearch;
-	const config = { ...baseConfig, endpoint: "https://es.example.com:9200" };
-
-	it("uses the daily default metrics index when none is set, and the custom one otherwise", () => {
-		expect(
-			adapter.toVectorTransform?.(config, "t", "scope", "metrics"),
-		).toBeNull();
-		expect(adapter.toVectorSink(config, "s", "scope", "metrics")).toMatchObject(
-			{
-				type: "elasticsearch",
-				api_version: "v8",
-				bulk: { index: "dokploy-metrics-%Y.%m.%d" },
-			},
-		);
-		expect(
-			adapter.toVectorSink(
-				{ ...config, extraConfig: { metricsIndex: "metrics-custom" } },
-				"s",
-				"scope",
-				"metrics",
-			).bulk,
-		).toEqual({ index: "metrics-custom" });
-	});
-
-	it("keeps the logs sink without a bulk index unless one is set", () => {
-		expect(adapter.toVectorSink(config, "s", "t", "logs").bulk).toBeUndefined();
-	});
-});
@@ -1,85 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	findServersByOrganizationForVectorAgent: vi.fn(),
-	getWebServerSettings: vi.fn(),
-	releaseWebServerAgent: vi.fn(),
-	removeVectorAgent: vi.fn(),
-	deleteWhere: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/constants", () => ({ IS_CLOUD: false }));
-vi.mock("@dokploy/server/db", () => ({
-	db: { delete: () => ({ where: mocks.deleteWhere }) },
-}));
-vi.mock("@dokploy/server/services/server", () => ({
-	findServersByOrganizationForVectorAgent:
-		mocks.findServersByOrganizationForVectorAgent,
-}));
-vi.mock("@dokploy/server/services/web-server-settings", () => ({
-	getWebServerSettings: mocks.getWebServerSettings,
-	releaseWebServerAgent: mocks.releaseWebServerAgent,
-}));
-vi.mock("@dokploy/server/setup/vector-setup", () => ({
-	removeVectorAgent: mocks.removeVectorAgent,
-	withVectorTargetLock: (_: string | undefined, fn: () => Promise<unknown>) =>
-		fn(),
-}));
-
-const { deleteOrganization } = await import(
-	"@dokploy/server/services/organization"
-);
-
-beforeEach(() => {
-	for (const mock of Object.values(mocks)) mock.mockReset();
-	mocks.findServersByOrganizationForVectorAgent.mockResolvedValue([]);
-	mocks.deleteWhere.mockResolvedValue({ count: 1 });
-	vi.spyOn(console, "error").mockImplementation(() => {});
-});
-
-describe("deleteOrganization", () => {
-	it("attempts cleanup on every server, even with an empty selection, and swallows errors", async () => {
-		mocks.findServersByOrganizationForVectorAgent.mockResolvedValue([
-			{ serverId: "server-1", telemetryProviderIds: ["lp-1"] },
-			{ serverId: "server-2", telemetryProviderIds: ["lp-1"] },
-			{ serverId: "server-3", telemetryProviderIds: [] },
-		]);
-		mocks.removeVectorAgent.mockImplementation(async (serverId?: string) => {
-			if (serverId === "server-1") throw new Error("ssh down");
-		});
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: null,
-		});
-
-		await deleteOrganization("org-a");
-
-		expect(mocks.removeVectorAgent).toHaveBeenCalledWith("server-1");
-		expect(mocks.removeVectorAgent).toHaveBeenCalledWith("server-2");
-		expect(mocks.removeVectorAgent).toHaveBeenCalledWith("server-3");
-		expect(mocks.deleteWhere).toHaveBeenCalled();
-	});
-
-	it("leaves the local agent alone when another organization owns it", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-b",
-		});
-
-		await deleteOrganization("org-a");
-
-		expect(mocks.removeVectorAgent).not.toHaveBeenCalled();
-		expect(mocks.releaseWebServerAgent).not.toHaveBeenCalled();
-	});
-
-	it("releases the local agent even when removing it fails", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-		});
-		mocks.removeVectorAgent.mockRejectedValue(new Error("docker down"));
-
-		await deleteOrganization("org-a");
-
-		expect(mocks.removeVectorAgent).toHaveBeenCalledWith();
-		expect(mocks.releaseWebServerAgent).toHaveBeenCalledWith("org-a");
-		expect(mocks.deleteWhere).toHaveBeenCalled();
-	});
-});
@@ -1,220 +0,0 @@
-import { createServer, type Server } from "node:http";
-import type { AddressInfo } from "node:net";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	lookup: vi.fn(),
-}));
-
-vi.mock("node:dns", () => ({
-	lookup: mocks.lookup,
-}));
-
-const loadModule = async (isCloud: boolean) => {
-	vi.resetModules();
-	vi.doMock("@dokploy/server/constants", () => ({ IS_CLOUD: isCloud }));
-	return await import(
-		"@dokploy/server/services/logs-and-metrics/provider-fetch"
-	);
-};
-
-const loadFetch = async (isCloud: boolean) =>
-	(await loadModule(isCloud)).providerFetch;
-
-const resolvesTo = (...addresses: string[]) =>
-	mocks.lookup.mockImplementation(
-		(_host: string, _options: unknown, callback: Function) =>
-			callback(
-				null,
-				addresses.map((address) => ({
-					address,
-					family: address.includes(":") ? 6 : 4,
-				})),
-			),
-	);
-
-describe("providerFetch — blocked endpoint guard", () => {
-	const originalFetch = global.fetch;
-
-	beforeEach(() => {
-		mocks.lookup.mockReset();
-		global.fetch = vi.fn().mockResolvedValue(new Response("ok"));
-	});
-
-	afterEach(() => {
-		global.fetch = originalFetch;
-	});
-
-	it("rejects a literal AWS/GCP/Azure metadata IP without ever calling fetch", async () => {
-		const providerFetch = await loadFetch(false);
-		await expect(
-			providerFetch("http://169.254.169.254/latest/meta-data/"),
-		).rejects.toThrow(/metadata/i);
-		expect(global.fetch).not.toHaveBeenCalled();
-		expect(mocks.lookup).not.toHaveBeenCalled();
-	});
-
-	it("rejects the metadata IP written as an IPv4-mapped IPv6 address", async () => {
-		const providerFetch = await loadFetch(false);
-		for (const address of ["[::ffff:169.254.169.254]", "[::ffff:a9fe:a9fe]"]) {
-			await expect(
-				providerFetch(`http://${address}/latest/meta-data/`),
-				`expected ${address} to be rejected`,
-			).rejects.toThrow(/metadata/i);
-		}
-		expect(global.fetch).not.toHaveBeenCalled();
-	});
-
-	it("rejects the AWS ECS metadata IPv6 address", async () => {
-		const providerFetch = await loadFetch(false);
-		await expect(
-			providerFetch("http://[fd00:ec2::254]/v2/credentials"),
-		).rejects.toThrow(/metadata/i);
-		expect(global.fetch).not.toHaveBeenCalled();
-	});
-
-	it("rejects every fe80::/10 link-local address, not just literal fe80: ones", async () => {
-		const providerFetch = await loadFetch(false);
-		for (const address of [
-			"[fe80::1]",
-			"[fe90::1]",
-			"[fea0::1]",
-			"[febf::1]",
-		]) {
-			await expect(
-				providerFetch(`http://${address}/`),
-				`expected ${address} to be rejected`,
-			).rejects.toThrow(/metadata/i);
-		}
-		expect(global.fetch).not.toHaveBeenCalled();
-	});
-
-	it("does not block a hostname just because it starts like a link-local prefix", async () => {
-		const providerFetch = await loadFetch(false);
-
-		await providerFetch("https://feature-logs.example.com/ready");
-		expect(global.fetch).toHaveBeenCalledTimes(1);
-	});
-
-	it("rejects the GCP metadata hostname without needing DNS resolution", async () => {
-		const providerFetch = await loadFetch(false);
-		await expect(
-			providerFetch("http://metadata.google.internal/computeMetadata/v1/"),
-		).rejects.toThrow(/metadata/i);
-		expect(global.fetch).not.toHaveBeenCalled();
-		expect(mocks.lookup).not.toHaveBeenCalled();
-	});
-
-	it("rejects loopback and private-network endpoints in cloud", async () => {
-		const providerFetch = await loadFetch(true);
-
-		for (const url of [
-			"http://10.0.0.5:3100/ready",
-			"http://127.0.0.1:3100/ready",
-			"http://localhost:3100/ready",
-			"http://[::1]:3100/ready",
-			"http://0.0.0.0:3100/ready",
-			"http://100.100.100.200/latest/meta-data/",
-			"http://[::]:3100/ready",
-		]) {
-			await expect(
-				providerFetch(url),
-				`expected ${url} to be rejected`,
-			).rejects.toThrow(/blocked/i);
-		}
-		expect(global.fetch).not.toHaveBeenCalled();
-	});
-
-	it("does not follow redirects", async () => {
-		const providerFetch = await loadFetch(false);
-
-		await providerFetch("https://logs.example.com/ready");
-		expect(global.fetch).toHaveBeenCalledWith(
-			"https://logs.example.com/ready",
-			expect.objectContaining({ redirect: "error" }),
-		);
-	});
-});
-
-describe("providerFetch — address checked at connect time", () => {
-	let server: Server;
-	let port: number;
-	let hostHeader: string | undefined;
-
-	beforeEach(async () => {
-		mocks.lookup.mockReset();
-		hostHeader = undefined;
-		server = createServer((req, res) => {
-			hostHeader = req.headers.host;
-			res.end("ok");
-		});
-		await new Promise<void>((resolve) =>
-			server.listen(0, "127.0.0.1", resolve),
-		);
-		port = (server.address() as AddressInfo).port;
-	});
-
-	afterEach(async () => {
-		await new Promise((resolve) => server.close(resolve));
-	});
-
-	it("rejects a hostname whose lookup returns a metadata address", async () => {
-		const providerFetch = await loadFetch(false);
-		resolvesTo("203.0.113.10", "169.254.169.254");
-
-		await expect(
-			providerFetch("http://attacker-controlled.example.com/"),
-		).rejects.toThrow(/metadata/i);
-		expect(mocks.lookup).toHaveBeenCalledWith(
-			"attacker-controlled.example.com",
-			expect.anything(),
-			expect.any(Function),
-		);
-	});
-
-	it("rejects a hostname resolving to a private address in cloud", async () => {
-		const providerFetch = await loadFetch(true);
-		resolvesTo("127.0.0.1");
-
-		await expect(
-			providerFetch(`http://loki.internal.example.com:${port}/ready`),
-		).rejects.toThrow(/blocked/i);
-		expect(hostHeader).toBeUndefined();
-	});
-
-	it("rejects when DNS resolution fails", async () => {
-		const providerFetch = await loadFetch(false);
-		mocks.lookup.mockImplementation(
-			(_host: string, _options: unknown, callback: Function) =>
-				callback(Object.assign(new Error("ENOTFOUND"), { code: "ENOTFOUND" })),
-		);
-
-		await expect(
-			providerFetch("http://does-not-exist.invalid/"),
-		).rejects.toThrow();
-		expect(hostHeader).toBeUndefined();
-	});
-
-	it("connects to the address it validated, keeping the original Host header (self-hosted private endpoint)", async () => {
-		const providerFetch = await loadFetch(false);
-		resolvesTo("127.0.0.1");
-
-		const response = await providerFetch(
-			`http://loki.internal.example.com:${port}/ready`,
-		);
-		expect(await response.text()).toBe("ok");
-		expect(hostHeader).toBe(`loki.internal.example.com:${port}`);
-	});
-
-	it("passes a public address through in cloud", async () => {
-		const { guardedLookup } = await loadModule(true);
-		resolvesTo("203.0.113.10");
-
-		const result = await new Promise((resolve, reject) =>
-			guardedLookup("api.datadoghq.com", { all: true }, (error, addresses) =>
-				error ? reject(error) : resolve(addresses),
-			),
-		);
-		expect(result).toEqual([{ address: "203.0.113.10", family: 4 }]);
-	});
-});
@@ -1,16 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { providerLabel } from "@/components/dashboard/settings/logs-and-metrics/show-servers";
-
-describe("providerLabel", () => {
-	it("names what the provider sends next to its name", () => {
-		expect(providerLabel({ name: "Loki prod", signals: ["logs"] })).toBe(
-			"Loki prod (logs)",
-		);
-		expect(providerLabel({ name: "Splunk", signals: ["metrics"] })).toBe(
-			"Splunk (metrics)",
-		);
-		expect(
-			providerLabel({ name: "Datadog", signals: ["logs", "metrics"] }),
-		).toBe("Datadog (logs and metrics)");
-	});
-});
@@ -1,101 +0,0 @@
-import type { SQL } from "drizzle-orm";
-import { PgDialect } from "drizzle-orm/pg-core";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	deleted: [] as unknown[],
-	updates: [] as Array<{ table: unknown; values: Record<string, unknown> }>,
-	updatedServers: [] as Array<{ serverId: string }>,
-	updatedLocal: [] as Array<{ id: string }>,
-	queried: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/db", () => {
-	const tx = {
-		delete: () => ({
-			where: () => ({
-				returning: () => Promise.resolve(mocks.deleted),
-			}),
-		}),
-		update: (table: unknown) => ({
-			set: (values: Record<string, unknown>) => ({
-				where: () => ({
-					returning: () => {
-						mocks.updates.push({ table, values });
-						return Promise.resolve(
-							mocks.updates.length === 1
-								? mocks.updatedServers
-								: mocks.updatedLocal,
-						);
-					},
-				}),
-			}),
-		}),
-	};
-	return {
-		db: {
-			transaction: (fn: (tx: unknown) => unknown) => fn(tx),
-			query: {
-				server: { findMany: mocks.queried },
-				webServerSettings: { findFirst: mocks.queried },
-			},
-		},
-	};
-});
-
-const { server, webServerSettings } = await import("@dokploy/server/db/schema");
-const { removeTelemetryProvider } = await import(
-	"@dokploy/server/services/logs-and-metrics/service"
-);
-
-const render = (value: unknown) => new PgDialect().sqlToQuery(value as SQL).sql;
-
-describe("removeTelemetryProvider", () => {
-	beforeEach(() => {
-		mocks.updates = [];
-		mocks.updatedServers = [{ serverId: "server-1" }];
-		mocks.updatedLocal = [{ id: "ws-1" }];
-		mocks.queried.mockReset();
-	});
-
-	it("drops the provider id from the selection of every server and of the local host", async () => {
-		mocks.deleted = [{ telemetryProviderId: "lp-1" }];
-
-		const { provider, targets } = await removeTelemetryProvider("lp-1");
-		expect(provider).toEqual({ telemetryProviderId: "lp-1" });
-		expect(targets).toEqual(["server-1", null]);
-
-		expect(mocks.updates.map((u) => u.table)).toEqual([
-			server,
-			webServerSettings,
-		]);
-		expect(render(mocks.updates[0]?.values.telemetryProviderIds)).toBe(
-			'array_remove("server"."telemetryProviderIds", $1)',
-		);
-		expect(render(mocks.updates[1]?.values.telemetryProviderIds)).toBe(
-			'array_remove("webServerSettings"."telemetryProviderIds", $1)',
-		);
-		expect(render(mocks.updates[1]?.values.vectorAgentOrganizationId)).toBe(
-			'CASE WHEN cardinality(array_remove("webServerSettings"."telemetryProviderIds", $1)) = 0 THEN NULL ELSE "webServerSettings"."vectorAgentOrganizationId" END',
-		);
-	});
-
-	it("reconciles exactly the hosts whose selection the transaction updated", async () => {
-		mocks.deleted = [{ telemetryProviderId: "lp-1" }];
-		mocks.updatedServers = [{ serverId: "server-1" }, { serverId: "server-2" }];
-		mocks.updatedLocal = [];
-
-		const { targets } = await removeTelemetryProvider("lp-1");
-		expect(targets).toEqual(["server-1", "server-2"]);
-		expect(mocks.queried).not.toHaveBeenCalled();
-	});
-
-	it("does not touch assignments when the provider does not exist", async () => {
-		mocks.deleted = [];
-
-		await expect(removeTelemetryProvider("missing")).rejects.toMatchObject({
-			code: "NOT_FOUND",
-		});
-		expect(mocks.updates).toEqual([]);
-	});
-});
@@ -1,392 +0,0 @@
-import {
-	getTelemetryProviderAdapter,
-	telemetryProviderAdapters,
-} from "@dokploy/server/services/logs-and-metrics/providers/registry";
-import type { TelemetryProviderRuntimeConfig } from "@dokploy/server/services/logs-and-metrics/types";
-import { describe, expect, it } from "vitest";
-
-const baseConfig: TelemetryProviderRuntimeConfig = {
-	telemetryProviderId: "provider-1",
-	name: "test",
-	signals: ["logs"],
-	endpoint: null,
-	apiKey: null,
-	apiSecret: null,
-	extraConfig: null,
-};
-
-describe("getTelemetryProviderAdapter", () => {
-	it("returns the registered adapter for each known type", () => {
-		expect(getTelemetryProviderAdapter("loki").type).toBe("loki");
-		expect(getTelemetryProviderAdapter("datadog").type).toBe("datadog");
-		expect(getTelemetryProviderAdapter("betterstack").type).toBe("betterstack");
-		expect(getTelemetryProviderAdapter("elasticsearch").type).toBe(
-			"elasticsearch",
-		);
-		expect(getTelemetryProviderAdapter("splunk_hec").type).toBe("splunk_hec");
-		expect(getTelemetryProviderAdapter("aws_cloudwatch").type).toBe(
-			"aws_cloudwatch",
-		);
-	});
-
-	it("throws an explicit error for an unregistered type", () => {
-		// @ts-expect-error: intentionally an unregistered type
-		expect(() => getTelemetryProviderAdapter("unknown")).toThrow(
-			/No TelemetryProviderAdapter registered/,
-		);
-	});
-});
-
-describe("lokiAdapter.toVectorSink", () => {
-	it("maps endpoint + labels, without tenant_id if not set", () => {
-		const adapter = telemetryProviderAdapters.loki;
-		const sink = adapter.toVectorSink(
-			{ ...baseConfig, endpoint: "https://loki.example.com" },
-			"sink_1",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(sink.type).toBe("loki");
-		expect(sink.inputs).toEqual(["dokploy_scope"]);
-		expect(sink.endpoint).toBe("https://loki.example.com");
-		expect(sink.labels).toMatchObject({
-			dokploy_project: "{{ dokploy_project }}",
-			dokploy_environment: "{{ dokploy_environment }}",
-			dokploy_application: "{{ dokploy_application }}",
-			dokploy_organization: "{{ dokploy_organization }}",
-			dokploy_server: "{{ dokploy_server }}",
-		});
-		expect(sink.tenant_id).toBeUndefined();
-		expect(sink.buffer).toEqual({
-			type: "disk",
-			max_size: 268_435_488,
-			when_full: "block",
-		});
-	});
-
-	it("includes tenant_id when present in extraConfig", () => {
-		const adapter = telemetryProviderAdapters.loki;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				endpoint: "https://loki.example.com",
-				extraConfig: { tenantId: "tenant-a" },
-			},
-			"sink_1",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(sink.tenant_id).toBe("tenant-a");
-	});
-
-	it("has no toVectorTransform — goes directly scope -> sink", () => {
-		expect(telemetryProviderAdapters.loki.toVectorTransform).toBeUndefined();
-	});
-});
-
-describe("datadogAdapter.toVectorSink", () => {
-	it("defaults site to datadoghq.com and sets no `tags` field (datadog_logs has none)", () => {
-		const adapter = telemetryProviderAdapters.datadog;
-		const sink = adapter.toVectorSink(
-			{ ...baseConfig, apiKey: "dd-key" },
-			"sink_2",
-			"transform_2",
-			"logs",
-		);
-		expect(sink.type).toBe("datadog_logs");
-		expect(sink.default_api_key).toBe("dd-key");
-		expect(sink.site).toBe("datadoghq.com");
-		expect(sink.tags).toBeUndefined();
-		expect(sink.inputs).toEqual(["transform_2"]);
-	});
-
-	it("uses extraConfig.site when present", () => {
-		const adapter = telemetryProviderAdapters.datadog;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				apiKey: "dd-key",
-				extraConfig: { site: "datadoghq.eu" },
-			},
-			"sink_2",
-			"transform_2",
-			"logs",
-		);
-		expect(sink.site).toBe("datadoghq.eu");
-	});
-
-	it("strips a pasted scheme/trailing slash from extraConfig.site instead of interpolating it as-is", () => {
-		const adapter = telemetryProviderAdapters.datadog;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				apiKey: "dd-key",
-				extraConfig: { site: "https://datadoghq.eu/" },
-			},
-			"sink_2",
-			"transform_2",
-			"logs",
-		);
-		expect(sink.site).toBe("datadoghq.eu");
-	});
-
-	it("builds .ddtags from the scoping fields in toVectorTransform, since datadog_logs has no `tags` option (vector generate-schema)", () => {
-		const adapter = telemetryProviderAdapters.datadog;
-		expect(adapter.toVectorTransform).toBeDefined();
-		const transform = adapter.toVectorTransform?.(
-			baseConfig,
-			"transform_2",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(transform?.type).toBe("remap");
-		expect(transform?.inputs).toEqual(["dokploy_scope"]);
-		expect(transform?.source).toContain(".ddtags");
-		expect(transform?.source).toContain(
-			'"dokploy_server:" + replace(to_string!(.dokploy_server), ",", "_")',
-		);
-	});
-
-	it("escapes commas in scoping field values before building .ddtags, since ddtags is itself comma delimited", () => {
-		const adapter = telemetryProviderAdapters.datadog;
-		const transform = adapter.toVectorTransform?.(
-			baseConfig,
-			"transform_2",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(transform?.source).toContain(
-			'replace(to_string!(.dokploy_project), ",", "_")',
-		);
-	});
-});
-
-describe("betterStackAdapter", () => {
-	it("toVectorTransform renames timestamp to dt, inputs point to scope transform", () => {
-		const adapter = telemetryProviderAdapters.betterstack;
-		expect(adapter.toVectorTransform).toBeDefined();
-		const transform = adapter.toVectorTransform?.(
-			baseConfig,
-			"transform_1",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(transform).toEqual({
-			type: "remap",
-			inputs: ["dokploy_scope"],
-			source: ".dt = del(.timestamp)",
-		});
-	});
-
-	it("toVectorSink builds a generic http sink with bearer auth, reading from the transform id", () => {
-		const adapter = telemetryProviderAdapters.betterstack;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				endpoint: "https://in.logs.betterstack.com",
-				apiKey: "source-token",
-			},
-			"sink_3",
-			"transform_1",
-			"logs",
-		);
-		expect(sink.type).toBe("http");
-		expect(sink.inputs).toEqual(["transform_1"]);
-		expect(sink.uri).toBe("https://in.logs.betterstack.com/");
-		expect(sink.auth).toEqual({ strategy: "bearer", token: "source-token" });
-		expect(sink.compression).toBe("gzip");
-	});
-});
-
-describe("elasticsearchAdapter", () => {
-	it("has a toVectorTransform that flattens .label to a JSON string", () => {
-		const adapter = telemetryProviderAdapters.elasticsearch;
-		expect(adapter.toVectorTransform).toBeDefined();
-		const transform = adapter.toVectorTransform?.(
-			baseConfig,
-			"transform_4",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(transform?.type).toBe("remap");
-		expect(transform?.inputs).toEqual(["dokploy_scope"]);
-		expect(transform?.source).toContain("encode_json(.label)");
-	});
-
-	it("uses basic auth when a username is set", () => {
-		const adapter = telemetryProviderAdapters.elasticsearch;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				endpoint: "https://es.example.com:9200",
-				apiKey: "secret",
-				extraConfig: { username: "elastic" },
-			},
-			"sink_4",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(sink.type).toBe("elasticsearch");
-		expect(sink.endpoints).toEqual(["https://es.example.com:9200"]);
-		expect(sink.auth).toEqual({
-			strategy: "basic",
-			user: "elastic",
-			password: "secret",
-		});
-		expect(sink.request).toBeUndefined();
-	});
-
-	it("falls back to an ApiKey header when no username is set", () => {
-		const adapter = telemetryProviderAdapters.elasticsearch;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				endpoint: "https://es.example.com:9200",
-				apiKey: "key-123",
-			},
-			"sink_4",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(sink.auth).toBeUndefined();
-		expect(sink.request).toEqual({
-			headers: { Authorization: "ApiKey key-123" },
-		});
-	});
-
-	it("rejects a username set without a password instead of silently shipping unauthenticated", () => {
-		const adapter = telemetryProviderAdapters.elasticsearch;
-		expect(() =>
-			adapter.toVectorSink(
-				{
-					...baseConfig,
-					endpoint: "https://es.example.com:9200",
-					extraConfig: { username: "elastic" },
-				},
-				"sink_4",
-				"dokploy_scope",
-				"logs",
-			),
-		).toThrow(/Password.*required/i);
-	});
-
-	it("includes bulk.index only when extraConfig.index is set", () => {
-		const adapter = telemetryProviderAdapters.elasticsearch;
-		const withoutIndex = adapter.toVectorSink(
-			{ ...baseConfig, endpoint: "https://es.example.com:9200" },
-			"sink_4",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(withoutIndex.bulk).toBeUndefined();
-		const withIndex = adapter.toVectorSink(
-			{
-				...baseConfig,
-				endpoint: "https://es.example.com:9200",
-				extraConfig: { index: "dokploy-%Y.%m.%d" },
-			},
-			"sink_4",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(withIndex.bulk).toEqual({ index: "dokploy-%Y.%m.%d" });
-	});
-});
-
-describe("splunkAdapter", () => {
-	it("has no toVectorTransform — scoping fields ride along as plain JSON fields", () => {
-		expect(
-			telemetryProviderAdapters.splunk_hec.toVectorTransform,
-		).toBeUndefined();
-	});
-
-	it("toVectorSink maps endpoint/token, only sets index/sourcetype when present", () => {
-		const adapter = telemetryProviderAdapters.splunk_hec;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				endpoint: "https://splunk.example.com:8088",
-				apiKey: "hec-token",
-			},
-			"sink_5",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(sink.type).toBe("splunk_hec_logs");
-		expect(sink.endpoint).toBe("https://splunk.example.com:8088");
-		expect(sink.default_token).toBe("hec-token");
-		expect(sink.encoding).toEqual({ codec: "json" });
-		expect(sink.index).toBeUndefined();
-		expect(sink.sourcetype).toBeUndefined();
-
-		const withExtras = adapter.toVectorSink(
-			{
-				...baseConfig,
-				endpoint: "https://splunk.example.com:8088",
-				apiKey: "hec-token",
-				extraConfig: { index: "dokploy", sourcetype: "docker" },
-			},
-			"sink_5",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(withExtras.index).toBe("dokploy");
-		expect(withExtras.sourcetype).toBe("docker");
-	});
-});
-
-describe("awsCloudwatchAdapter", () => {
-	it("has no logs transform — scoping fields ride along as plain JSON fields", () => {
-		expect(
-			telemetryProviderAdapters.aws_cloudwatch.toVectorTransform?.(
-				baseConfig,
-				"transform_1",
-				"dokploy_scope",
-				"logs",
-			),
-		).toBeNull();
-	});
-
-	it("toVectorSink maps access key/secret, region and log group/stream", () => {
-		const adapter = telemetryProviderAdapters.aws_cloudwatch;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				apiKey: "AKIA...",
-				apiSecret: "shh",
-				extraConfig: { region: "us-east-1", logGroup: "/dokploy/logs" },
-			},
-			"sink_6",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(sink.type).toBe("aws_cloudwatch_logs");
-		expect(sink.group_name).toBe("/dokploy/logs");
-		expect(sink.stream_name).toBe("{{ container_name }}");
-		expect(sink.region).toBe("us-east-1");
-		expect(sink.auth).toEqual({
-			access_key_id: "AKIA...",
-			secret_access_key: "shh",
-		});
-	});
-
-	it("uses extraConfig.logStream as the stream template when set", () => {
-		const adapter = telemetryProviderAdapters.aws_cloudwatch;
-		const sink = adapter.toVectorSink(
-			{
-				...baseConfig,
-				apiKey: "AKIA...",
-				apiSecret: "shh",
-				extraConfig: {
-					region: "us-east-1",
-					logGroup: "/dokploy/logs",
-					logStream: "{{ dokploy_application }}",
-				},
-			},
-			"sink_6",
-			"dokploy_scope",
-			"logs",
-		);
-		expect(sink.stream_name).toBe("{{ dokploy_application }}");
-	});
-});
@@ -1,661 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	insertValues: vi.fn(),
-	updateSet: vi.fn(),
-	findFirst: vi.fn(),
-	findMany: vi.fn(),
-	serverFindFirst: vi.fn(),
-	serverFindMany: vi.fn(),
-	webServerFindFirst: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		insert: () => ({
-			values: (v: any) => ({
-				returning: () => Promise.resolve(mocks.insertValues(v)),
-			}),
-		}),
-		update: () => ({
-			set: (v: any) => ({
-				where: () => ({
-					returning: () => Promise.resolve(mocks.updateSet(v)),
-				}),
-			}),
-		}),
-		query: {
-			telemetryProvider: {
-				findFirst: mocks.findFirst,
-				findMany: mocks.findMany,
-			},
-			server: {
-				findFirst: mocks.serverFindFirst,
-				findMany: mocks.serverFindMany,
-			},
-			webServerSettings: { findFirst: mocks.webServerFindFirst },
-		},
-	},
-}));
-
-const {
-	assertProvidersBelongToOrg,
-	assertSignalsSupported,
-	createTelemetryProvider,
-	testTelemetryProviderConnection,
-	updateTelemetryProvider,
-} = await import("@dokploy/server/services/logs-and-metrics/service");
-const { telemetryProviderAdapters } = await import(
-	"@dokploy/server/services/logs-and-metrics/providers/registry"
-);
-
-beforeEach(() => {
-	mocks.serverFindMany.mockResolvedValue([]);
-	mocks.webServerFindFirst.mockResolvedValue(undefined);
-});
-
-describe("updateTelemetryProvider — targets to re-apply", () => {
-	const existing = {
-		telemetryProviderId: "lp-1",
-		name: "loki",
-		providerType: "loki",
-		signals: ["logs"],
-		endpoint: "https://loki.example.com",
-		apiKey: "old",
-		apiSecret: null,
-		extraConfig: null,
-		enabled: true,
-	};
-
-	beforeEach(() => {
-		mocks.findFirst.mockResolvedValue(existing);
-		mocks.updateSet.mockReturnValue([{ ...existing, apiKey: "new" }]);
-		mocks.serverFindMany.mockResolvedValue([{ serverId: "server-1" }]);
-		mocks.webServerFindFirst.mockResolvedValue({ id: "ws-1" });
-	});
-
-	it("returns the servers and the local host that ship with it when a credential changes", async () => {
-		const { targets } = await updateTelemetryProvider("lp-1", {
-			apiKey: "new",
-		});
-		expect(targets).toEqual(["server-1", null]);
-	});
-
-	it("returns the same targets when the provider is disabled", async () => {
-		const { targets } = await updateTelemetryProvider("lp-1", {
-			enabled: false,
-		});
-		expect(targets).toEqual(["server-1", null]);
-	});
-
-	it("returns no targets when only the name changes or a value is re-sent unchanged", async () => {
-		expect(
-			(await updateTelemetryProvider("lp-1", { name: "renamed" })).targets,
-		).toEqual([]);
-		expect(
-			(
-				await updateTelemetryProvider("lp-1", {
-					endpoint: "https://loki.example.com",
-				})
-			).targets,
-		).toEqual([]);
-	});
-});
-
-describe("createTelemetryProvider — required credential fields per adapter", () => {
-	it("rejects a loki provider without endpoint", async () => {
-		await expect(
-			createTelemetryProvider(
-				{ name: "loki-prod", providerType: "loki", signals: ["logs"] } as any,
-				"org-1",
-			),
-		).rejects.toThrow(/endpoint/i);
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-
-	it("rejects a datadog provider without apiKey", async () => {
-		await expect(
-			createTelemetryProvider(
-				{ name: "dd", providerType: "datadog", signals: ["logs"] } as any,
-				"org-1",
-			),
-		).rejects.toThrow();
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-
-	it("rejects a betterstack provider missing either field", async () => {
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "bs",
-					providerType: "betterstack",
-					signals: ["logs"],
-					apiKey: "token-only",
-				} as any,
-				"org-1",
-			),
-		).rejects.toThrow();
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-
-	it("rejects a splunk_hec provider without a HEC token", async () => {
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "splunk",
-					providerType: "splunk_hec",
-					signals: ["logs"],
-					endpoint: "https://splunk.example.com:8088",
-				} as any,
-				"org-1",
-			),
-		).rejects.toThrow(/token/i);
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-
-	it("rejects an aws_cloudwatch provider missing required extraConfig fields (region/log group)", async () => {
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "cw",
-					providerType: "aws_cloudwatch",
-					signals: ["logs"],
-					apiKey: "AKIA...",
-					apiSecret: "shh",
-				} as any,
-				"org-1",
-			),
-		).rejects.toThrow(/region|log group/i);
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-
-	it("rejects a datadog provider whose apiKey only exists inside extraConfig, not the real column", async () => {
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "dd",
-					providerType: "datadog",
-					signals: ["logs"],
-					extraConfig: { apiKey: "sneaky-value" },
-				} as any,
-				"org-1",
-			),
-		).rejects.toThrow(/api key/i);
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-
-	it("rejects an elasticsearch provider with a username but no password (adapter.validateConfig)", async () => {
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "es",
-					providerType: "elasticsearch",
-					signals: ["logs"],
-					endpoint: "https://es.example.com:9200",
-					extraConfig: { username: "elastic" },
-				} as any,
-				"org-1",
-			),
-		).rejects.toThrow(/password.*required/i);
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-
-	it("accepts an aws_cloudwatch provider with region and log group set via extraConfig", async () => {
-		mocks.insertValues.mockReturnValue([
-			{
-				telemetryProviderId: "lp-2",
-				name: "cw",
-				providerType: "aws_cloudwatch",
-				signals: ["logs"],
-			},
-		]);
-		const created = await createTelemetryProvider(
-			{
-				name: "cw",
-				providerType: "aws_cloudwatch",
-				signals: ["logs"],
-				apiKey: "AKIA...",
-				apiSecret: "shh",
-				extraConfig: { region: "us-east-1", logGroup: "/dokploy/logs" },
-			} as any,
-			"org-1",
-		);
-		expect(created.telemetryProviderId).toBe("lp-2");
-	});
-
-	it("accepts a loki provider with endpoint", async () => {
-		mocks.insertValues.mockReturnValue([
-			{ telemetryProviderId: "lp-1", name: "loki-prod", providerType: "loki" },
-		]);
-		const created = await createTelemetryProvider(
-			{
-				name: "loki-prod",
-				providerType: "loki",
-				signals: ["logs"],
-				endpoint: "https://loki.example.com",
-			} as any,
-			"org-1",
-		);
-		expect(created.telemetryProviderId).toBe("lp-1");
-		expect(mocks.insertValues).toHaveBeenCalled();
-	});
-});
-
-describe("updateTelemetryProvider — merges partial update with existing row before validating", () => {
-	it("allows updating just the name without re-sending existing credentials", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "lp-1",
-			name: "old-name",
-			providerType: "loki",
-			signals: ["logs"],
-			endpoint: "https://loki.example.com",
-			apiKey: null,
-			apiSecret: null,
-			extraConfig: null,
-		});
-		mocks.updateSet.mockReturnValue([
-			{ telemetryProviderId: "lp-1", name: "new-name" },
-		]);
-
-		const { provider: updated, targets } = await updateTelemetryProvider(
-			"lp-1",
-			{ name: "new-name" },
-		);
-		expect(updated.name).toBe("new-name");
-		expect(targets).toEqual([]);
-	});
-
-	it("rejects clearing the only required field via update", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "lp-1",
-			name: "loki-prod",
-			providerType: "loki",
-			signals: ["logs"],
-			endpoint: "https://loki.example.com",
-			apiKey: null,
-			apiSecret: null,
-			extraConfig: null,
-		});
-
-		await expect(
-			updateTelemetryProvider("lp-1", { endpoint: null }),
-		).rejects.toThrow(/endpoint/i);
-	});
-
-	it("clears the old provider's credentials when providerType changes, unless new values are given", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "lp-1",
-			name: "dd-prod",
-			providerType: "datadog",
-			signals: ["logs"],
-			endpoint: null,
-			apiKey: "old-datadog-key",
-			apiSecret: null,
-			extraConfig: { site: "datadoghq.com" },
-		});
-		mocks.updateSet.mockReturnValue([{ telemetryProviderId: "lp-1" }]);
-
-		await updateTelemetryProvider("lp-1", {
-			providerType: "loki",
-			signals: ["logs"],
-			endpoint: "https://loki.example.com",
-		});
-
-		expect(mocks.updateSet).toHaveBeenCalledWith(
-			expect.objectContaining({
-				providerType: "loki",
-				signals: ["logs"],
-				endpoint: "https://loki.example.com",
-				apiKey: null,
-				apiSecret: null,
-				extraConfig: null,
-			}),
-		);
-	});
-
-	it("merges a partial extraConfig update instead of replacing it wholesale", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "lp-1",
-			name: "es-prod",
-			providerType: "elasticsearch",
-			signals: ["logs"],
-			endpoint: "https://es.example.com:9200",
-			apiKey: "secret",
-			apiSecret: null,
-			extraConfig: { username: "elastic", index: "custom-index" },
-		});
-		mocks.updateSet.mockReturnValue([{ telemetryProviderId: "lp-1" }]);
-
-		await updateTelemetryProvider("lp-1", {
-			extraConfig: { username: "new-user" },
-		});
-
-		expect(mocks.updateSet).toHaveBeenCalledWith(
-			expect.objectContaining({
-				extraConfig: { username: "new-user", index: "custom-index" },
-			}),
-		);
-	});
-
-	it("clears extraConfig entirely when explicitly set to null, instead of merging", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "lp-1",
-			name: "es-prod",
-			providerType: "elasticsearch",
-			signals: ["logs"],
-			endpoint: "https://es.example.com:9200",
-			apiKey: null,
-			apiSecret: null,
-			extraConfig: { username: "elastic" },
-		});
-		mocks.updateSet.mockReturnValue([{ telemetryProviderId: "lp-1" }]);
-
-		await updateTelemetryProvider("lp-1", { extraConfig: null });
-
-		expect(mocks.updateSet).toHaveBeenCalledWith(
-			expect.objectContaining({ extraConfig: null }),
-		);
-	});
-
-	it("clears an optional credential when it is explicitly set to null", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "lp-1",
-			name: "loki-prod",
-			providerType: "loki",
-			signals: ["logs"],
-			endpoint: "https://loki.example.com",
-			apiKey: "old-token",
-			apiSecret: null,
-			extraConfig: { username: "user" },
-		});
-		mocks.updateSet.mockReturnValue([{ telemetryProviderId: "lp-1" }]);
-
-		await updateTelemetryProvider("lp-1", { apiKey: null });
-
-		expect(mocks.updateSet).toHaveBeenCalledWith(
-			expect.objectContaining({ apiKey: null }),
-		);
-	});
-
-	it("rejects clearing the elasticsearch password while a username stays saved", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "lp-1",
-			name: "es-prod",
-			providerType: "elasticsearch",
-			signals: ["logs"],
-			endpoint: "https://es.example.com:9200",
-			apiKey: "old-password",
-			apiSecret: null,
-			extraConfig: { username: "elastic" },
-		});
-
-		await expect(
-			updateTelemetryProvider("lp-1", { apiKey: null }),
-		).rejects.toThrow(/Password/);
-	});
-
-	it("rejects a providerType change that doesn't satisfy the new type's required fields", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "lp-1",
-			name: "dd-prod",
-			providerType: "datadog",
-			signals: ["logs"],
-			endpoint: null,
-			apiKey: "old-datadog-key",
-			apiSecret: null,
-			extraConfig: null,
-		});
-
-		await expect(
-			updateTelemetryProvider("lp-1", { providerType: "loki" }),
-		).rejects.toThrow(/endpoint/i);
-	});
-});
-
-describe("assertSignalsSupported", () => {
-	it("rejects a repeated signal", () => {
-		expect(() => assertSignalsSupported("loki", ["logs", "logs"])).toThrow(
-			/only be selected once/,
-		);
-	});
-
-	it("rejects a signal the type cannot send", () => {
-		expect(() => assertSignalsSupported("loki", ["metrics"])).toThrow(
-			/Grafana Loki cannot send metrics/,
-		);
-	});
-
-	it("accepts a supported subset", () => {
-		expect(() => assertSignalsSupported("loki", ["logs"])).not.toThrow();
-	});
-});
-
-describe("createTelemetryProvider — signals", () => {
-	it("rejects a provider whose type cannot send the selected signal", async () => {
-		mocks.insertValues.mockClear();
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "loki",
-					providerType: "loki",
-					signals: ["metrics"],
-					endpoint: "https://loki.example.com",
-				} as any,
-				"org-1",
-			),
-		).rejects.toThrow(/cannot send metrics/);
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-});
-
-describe("assertProvidersBelongToOrg", () => {
-	beforeEach(() => {
-		mocks.findMany.mockResolvedValue([
-			{
-				telemetryProviderId: "lp-1",
-				name: "loki",
-				enabled: true,
-				signals: ["logs"],
-			},
-		]);
-	});
-
-	it("accepts a provider of the organization regardless of what it sends", async () => {
-		await expect(
-			assertProvidersBelongToOrg(["lp-1"], "org-1"),
-		).resolves.toBeUndefined();
-	});
-
-	it("rejects an id that is not in the organization", async () => {
-		await expect(
-			assertProvidersBelongToOrg(["lp-9"], "org-1"),
-		).rejects.toMatchObject({ code: "UNAUTHORIZED" });
-	});
-
-	it("rejects a selection where every provider is disabled", async () => {
-		mocks.findMany.mockResolvedValue([
-			{
-				telemetryProviderId: "lp-1",
-				name: "loki",
-				enabled: false,
-				signals: ["logs"],
-			},
-		]);
-		await expect(assertProvidersBelongToOrg(["lp-1"], "org-1")).rejects.toThrow(
-			/at least one enabled provider/,
-		);
-	});
-});
-
-describe("required fields scoped to a signal", () => {
-	beforeEach(() => {
-		mocks.insertValues.mockReset();
-		mocks.insertValues.mockReturnValue([{ telemetryProviderId: "cw-1" }]);
-	});
-
-	it("does not require the log group when only metrics are selected", async () => {
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "cw",
-					providerType: "aws_cloudwatch",
-					signals: ["metrics"],
-					apiKey: "AKIA",
-					apiSecret: "shh",
-					extraConfig: { region: "us-east-1", metricsNamespace: "Dokploy" },
-				} as any,
-				"org-1",
-			),
-		).resolves.toMatchObject({ telemetryProviderId: "cw-1" });
-	});
-
-	it("does not require the metrics namespace when only logs are selected", async () => {
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "cw",
-					providerType: "aws_cloudwatch",
-					signals: ["logs"],
-					apiKey: "AKIA",
-					apiSecret: "shh",
-					extraConfig: { region: "us-east-1", logGroup: "/dokploy/logs" },
-				} as any,
-				"org-1",
-			),
-		).resolves.toMatchObject({ telemetryProviderId: "cw-1" });
-	});
-
-	it("requires the metrics namespace when metrics are selected", async () => {
-		await expect(
-			createTelemetryProvider(
-				{
-					name: "cw",
-					providerType: "aws_cloudwatch",
-					signals: ["logs", "metrics"],
-					apiKey: "AKIA",
-					apiSecret: "shh",
-					extraConfig: { region: "us-east-1", logGroup: "/dokploy/logs" },
-				} as any,
-				"org-1",
-			),
-		).rejects.toThrow(/Metrics namespace/);
-		expect(mocks.insertValues).not.toHaveBeenCalled();
-	});
-});
-
-describe("signals are stored in a fixed order", () => {
-	it("normalizes the order on create", async () => {
-		mocks.insertValues.mockReset();
-		mocks.insertValues.mockReturnValue([{ telemetryProviderId: "dd-1" }]);
-
-		await createTelemetryProvider(
-			{
-				name: "dd",
-				providerType: "datadog",
-				signals: ["metrics", "logs"],
-				apiKey: "dd-key",
-			} as any,
-			"org-1",
-		);
-
-		expect(mocks.insertValues).toHaveBeenCalledWith(
-			expect.objectContaining({ signals: ["logs", "metrics"] }),
-		);
-	});
-
-	it("normalizes the order on update", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "dd-1",
-			name: "dd",
-			providerType: "datadog",
-			signals: ["logs"],
-			endpoint: null,
-			apiKey: "dd-key",
-			apiSecret: null,
-			extraConfig: null,
-		});
-		mocks.updateSet.mockReturnValue([{ telemetryProviderId: "dd-1" }]);
-
-		await updateTelemetryProvider("dd-1", { signals: ["metrics", "logs"] });
-
-		expect(mocks.updateSet).toHaveBeenCalledWith(
-			expect.objectContaining({ signals: ["logs", "metrics"] }),
-		);
-	});
-});
-
-describe("testTelemetryProviderConnection by id", () => {
-	it("tests the saved provider with the signals override from the form", async () => {
-		mocks.findFirst.mockResolvedValue({
-			telemetryProviderId: "bs-1",
-			name: "bs",
-			providerType: "betterstack",
-			signals: ["logs"],
-			endpoint: "in.logs.betterstack.com",
-			apiKey: "token",
-			apiSecret: null,
-			extraConfig: null,
-		});
-		const spy = vi
-			.spyOn(telemetryProviderAdapters.betterstack, "testConnection")
-			.mockResolvedValue(undefined);
-
-		await testTelemetryProviderConnection({
-			telemetryProviderId: "bs-1",
-			signals: ["logs", "metrics"],
-		});
-
-		expect(spy).toHaveBeenCalledWith(
-			expect.objectContaining({
-				apiKey: "token",
-				signals: ["logs", "metrics"],
-			}),
-		);
-		spy.mockRestore();
-	});
-});
-
-describe("updateTelemetryProvider — signals", () => {
-	const existing = {
-		telemetryProviderId: "dd-1",
-		name: "datadog",
-		providerType: "datadog",
-		signals: ["logs", "metrics"],
-		endpoint: null,
-		apiKey: "dd-key",
-		apiSecret: null,
-		extraConfig: null,
-	};
-
-	beforeEach(() => {
-		mocks.updateSet.mockReset();
-		mocks.serverFindFirst.mockReset();
-		mocks.webServerFindFirst.mockReset();
-		mocks.findFirst.mockResolvedValue(existing);
-		mocks.updateSet.mockReturnValue([{ ...existing, signals: ["metrics"] }]);
-	});
-
-	it("allows removing a signal while the provider is assigned and returns its targets to re-apply", async () => {
-		mocks.serverFindMany.mockResolvedValue([{ serverId: "server-1" }]);
-		mocks.webServerFindFirst.mockResolvedValue({ id: "ws-1" });
-
-		await expect(
-			updateTelemetryProvider("dd-1", { signals: ["metrics"] }),
-		).resolves.toMatchObject({
-			provider: { signals: ["metrics"] },
-			targets: ["server-1", null],
-		});
-		expect(mocks.updateSet).toHaveBeenCalledWith(
-			expect.objectContaining({ signals: ["metrics"] }),
-		);
-	});
-
-	it("rejects a type change that cannot send the saved signals", async () => {
-		await expect(
-			updateTelemetryProvider("dd-1", {
-				providerType: "loki",
-				endpoint: "https://loki.example.com",
-			}),
-		).rejects.toThrow(/Grafana Loki cannot send metrics/);
-	});
-});
@@ -1,305 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	setWebServerProviderIds: vi.fn(),
-	setServerProviderIds: vi.fn(),
-	getAccessibleServerIds: vi.fn(),
-	reconcileVectorAgent: vi.fn(),
-	removeVectorAgent: vi.fn(),
-	findServerById: vi.fn(),
-	assertProvidersBelongToOrg: vi.fn(),
-}));
-
-const loadAgent = async (isCloud: boolean) => {
-	vi.resetModules();
-	vi.doMock("@dokploy/server/constants", () => ({ IS_CLOUD: isCloud }));
-	vi.doMock("@dokploy/server/services/server", () => ({
-		findServerById: mocks.findServerById,
-		setServerProviderIds: mocks.setServerProviderIds,
-		getAccessibleServerIds: mocks.getAccessibleServerIds,
-	}));
-	vi.doMock("@dokploy/server/services/web-server-settings", () => ({
-		setWebServerProviderIds: mocks.setWebServerProviderIds,
-	}));
-	const locks = new Map<string, Promise<unknown>>();
-	vi.doMock("@dokploy/server/setup/vector-setup", () => ({
-		LOCAL_SERVER_NAME: "Dokploy Server (local)",
-		reconcileVectorAgent: mocks.reconcileVectorAgent,
-		removeVectorAgent: mocks.removeVectorAgent,
-		withVectorTargetLock: (
-			serverId: string | undefined,
-			fn: () => Promise<unknown>,
-		) => {
-			const key = serverId ?? "local";
-			const current = (locks.get(key) ?? Promise.resolve())
-				.catch(() => {})
-				.then(fn);
-			locks.set(key, current);
-			return current;
-		},
-	}));
-	vi.doMock("@dokploy/server/services/logs-and-metrics/service", () => ({
-		assertProvidersBelongToOrg: mocks.assertProvidersBelongToOrg,
-	}));
-	return await import("@dokploy/server/services/logs-and-metrics/vector-agent");
-};
-
-const sessionA = { userId: "user-a", activeOrganizationId: "org-a" };
-const sessionB = { userId: "user-b", activeOrganizationId: "org-b" };
-
-beforeEach(() => {
-	for (const mock of Object.values(mocks)) mock.mockReset();
-	mocks.getAccessibleServerIds.mockResolvedValue(new Set(["server-1"]));
-	mocks.findServerById.mockImplementation(async (serverId: string) => ({
-		serverId,
-		name: `name-of-${serverId}`,
-		organizationId: "org-a",
-		sshKeyId: "key-1",
-	}));
-	mocks.setWebServerProviderIds.mockResolvedValue({ id: "ws-1" });
-	mocks.setServerProviderIds.mockResolvedValue({ serverId: "server-1" });
-});
-
-describe("applyVectorAgentSelection on the local host", () => {
-	it("rejects the local host in cloud without touching the database", async () => {
-		const { applyVectorAgentSelection } = await loadAgent(true);
-
-		await expect(
-			applyVectorAgentSelection(sessionA, undefined, ["lp-1"]),
-		).rejects.toMatchObject({ code: "BAD_REQUEST" });
-		expect(mocks.setWebServerProviderIds).not.toHaveBeenCalled();
-		expect(mocks.reconcileVectorAgent).not.toHaveBeenCalled();
-	});
-
-	it("rejects with CONFLICT when another organization owns the local agent, without reconciling", async () => {
-		mocks.setWebServerProviderIds.mockResolvedValue(null);
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await expect(
-			applyVectorAgentSelection(sessionB, undefined, ["mp-1"]),
-		).rejects.toMatchObject({ code: "CONFLICT" });
-		expect(mocks.setWebServerProviderIds).toHaveBeenCalledWith("org-b", [
-			"mp-1",
-		]);
-		expect(mocks.reconcileVectorAgent).not.toHaveBeenCalled();
-	});
-
-	it("saves the selection and then reconciles", async () => {
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await applyVectorAgentSelection(sessionA, undefined, ["lp-1"]);
-		expect(mocks.assertProvidersBelongToOrg).toHaveBeenCalledWith(
-			["lp-1"],
-			"org-a",
-		);
-		expect(mocks.setWebServerProviderIds).toHaveBeenCalledWith("org-a", [
-			"lp-1",
-		]);
-		expect(mocks.reconcileVectorAgent).toHaveBeenCalledWith(undefined);
-		expect(
-			mocks.setWebServerProviderIds.mock.invocationCallOrder[0],
-		).toBeLessThan(mocks.reconcileVectorAgent.mock.invocationCallOrder[0] ?? 0);
-	});
-
-	it("removing the agent saves an empty selection without checking providers", async () => {
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await applyVectorAgentSelection(sessionA, undefined, []);
-		expect(mocks.assertProvidersBelongToOrg).not.toHaveBeenCalled();
-		expect(mocks.setWebServerProviderIds).toHaveBeenCalledWith("org-a", []);
-		expect(mocks.reconcileVectorAgent).toHaveBeenCalledWith(undefined);
-	});
-});
-
-describe("applyVectorAgentSelection on a remote server", () => {
-	it("still manages remote servers in cloud", async () => {
-		const { applyVectorAgentSelection } = await loadAgent(true);
-
-		const result = await applyVectorAgentSelection(sessionA, "server-1", []);
-		expect(result).toEqual({ serverName: "name-of-server-1" });
-		expect(mocks.setServerProviderIds).toHaveBeenCalledWith("server-1", []);
-		expect(mocks.reconcileVectorAgent).toHaveBeenCalledWith("server-1");
-	});
-
-	it("rejects a server of another organization", async () => {
-		mocks.findServerById.mockResolvedValue({
-			serverId: "server-1",
-			organizationId: "org-b",
-			sshKeyId: "key-1",
-		});
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await expect(
-			applyVectorAgentSelection(sessionA, "server-1", ["lp-1"]),
-		).rejects.toMatchObject({ code: "UNAUTHORIZED" });
-		expect(mocks.setServerProviderIds).not.toHaveBeenCalled();
-	});
-
-	it("rejects a server without an SSH key before saving anything", async () => {
-		mocks.findServerById.mockResolvedValue({
-			serverId: "server-1",
-			organizationId: "org-a",
-			sshKeyId: null,
-		});
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await expect(
-			applyVectorAgentSelection(sessionA, "server-1", ["lp-1"]),
-		).rejects.toMatchObject({ code: "BAD_REQUEST" });
-		expect(mocks.setServerProviderIds).not.toHaveBeenCalled();
-		expect(mocks.reconcileVectorAgent).not.toHaveBeenCalled();
-	});
-
-	it("rejects a server the member cannot access", async () => {
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await expect(
-			applyVectorAgentSelection(sessionA, "server-2", ["lp-1"]),
-		).rejects.toMatchObject({ code: "UNAUTHORIZED" });
-		expect(mocks.getAccessibleServerIds).toHaveBeenCalledWith(sessionA);
-		expect(mocks.setServerProviderIds).not.toHaveBeenCalled();
-		expect(mocks.reconcileVectorAgent).not.toHaveBeenCalled();
-	});
-
-	it("saves the array and only then reconciles", async () => {
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await applyVectorAgentSelection(sessionA, "server-1", ["mp-1"]);
-		expect(mocks.setServerProviderIds).toHaveBeenCalledWith("server-1", [
-			"mp-1",
-		]);
-		expect(mocks.setServerProviderIds.mock.invocationCallOrder[0]).toBeLessThan(
-			mocks.reconcileVectorAgent.mock.invocationCallOrder[0] ?? 0,
-		);
-	});
-
-	it("keeps the saved selection when the reconcile fails", async () => {
-		mocks.reconcileVectorAgent.mockRejectedValue(
-			new Error("validation failed"),
-		);
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await expect(
-			applyVectorAgentSelection(sessionA, "server-1", ["lp-2"]),
-		).rejects.toThrow("validation failed");
-		expect(mocks.setServerProviderIds).toHaveBeenCalledWith("server-1", [
-			"lp-2",
-		]);
-	});
-
-	it("serializes concurrent selections on the same host so the last reconcile sees the last selection", async () => {
-		const saved: string[][] = [];
-		const seen: string[][] = [];
-		mocks.setServerProviderIds.mockImplementation(
-			async (_serverId: string, ids: string[]) => {
-				saved.push(ids);
-				return { serverId: "server-1" };
-			},
-		);
-		mocks.reconcileVectorAgent.mockImplementation(async () => {
-			seen.push(saved.at(-1) ?? []);
-			await new Promise((resolve) => setTimeout(resolve, 20));
-		});
-		const { applyVectorAgentSelection } = await loadAgent(false);
-
-		await Promise.all([
-			applyVectorAgentSelection(sessionA, "server-1", ["lp-1"]),
-			applyVectorAgentSelection(sessionA, "server-1", ["lp-2"]),
-		]);
-		expect(seen).toEqual([["lp-1"], ["lp-2"]]);
-	});
-});
-
-describe("removeServerVectorAgent", () => {
-	it("removes the agent on server deletion when providers are assigned", async () => {
-		const { removeServerVectorAgent } = await loadAgent(false);
-
-		await expect(
-			removeServerVectorAgent({
-				serverId: "server-1",
-				sshKeyId: "key-1",
-				telemetryProviderIds: ["lp-1"],
-			} as never),
-		).resolves.toBeUndefined();
-		expect(mocks.removeVectorAgent).toHaveBeenCalledWith("server-1");
-	});
-
-	it("attempts cleanup even with an empty selection, since a failed Remove can leave the agent running", async () => {
-		const { removeServerVectorAgent } = await loadAgent(false);
-
-		await expect(
-			removeServerVectorAgent({
-				serverId: "server-1",
-				sshKeyId: "key-1",
-				telemetryProviderIds: [],
-			} as never),
-		).resolves.toBeUndefined();
-		expect(mocks.removeVectorAgent).toHaveBeenCalledWith("server-1");
-	});
-
-	it("skips servers without an SSH key, warning when providers were assigned", async () => {
-		const { removeServerVectorAgent } = await loadAgent(false);
-
-		await expect(
-			removeServerVectorAgent({
-				serverId: "server-1",
-				sshKeyId: null,
-				telemetryProviderIds: [],
-			} as never),
-		).resolves.toBeUndefined();
-		await expect(
-			removeServerVectorAgent({
-				serverId: "server-1",
-				sshKeyId: null,
-				telemetryProviderIds: ["lp-1"],
-			} as never),
-		).resolves.toMatch(/no SSH key/);
-		expect(mocks.removeVectorAgent).not.toHaveBeenCalled();
-	});
-
-	it("returns the failure as a message instead of throwing", async () => {
-		mocks.removeVectorAgent.mockRejectedValue(new Error("docker down"));
-		const { removeServerVectorAgent } = await loadAgent(false);
-
-		await expect(
-			removeServerVectorAgent({
-				serverId: "server-1",
-				sshKeyId: "k",
-				telemetryProviderIds: ["lp-1"],
-			} as never),
-		).resolves.toBe("docker down");
-	});
-});
-
-describe("reconcileVectorTargets", () => {
-	it("re-applies every target under its lock and reports failures as a warning", async () => {
-		mocks.reconcileVectorAgent.mockImplementation(async (serverId?: string) => {
-			if (serverId === "server-2") throw new Error("ssh down");
-		});
-		const { reconcileVectorTargets } = await loadAgent(false);
-
-		const warning = await reconcileVectorTargets([
-			"server-1",
-			"server-2",
-			null,
-		]);
-		expect(mocks.reconcileVectorAgent.mock.calls.map((c) => c[0])).toEqual([
-			"server-1",
-			"server-2",
-			undefined,
-		]);
-		expect(warning).toBe(
-			"The Vector agent could not be re-applied on server-2: ssh down",
-		);
-	});
-
-	it("returns no warning when every target reconciles, and skips the local host in cloud", async () => {
-		const { reconcileVectorTargets } = await loadAgent(true);
-
-		await expect(
-			reconcileVectorTargets(["server-1", null]),
-		).resolves.toBeUndefined();
-		expect(mocks.reconcileVectorAgent).toHaveBeenCalledTimes(1);
-		expect(mocks.reconcileVectorAgent).toHaveBeenCalledWith("server-1");
-	});
-});
@@ -1,375 +0,0 @@
-import { vrlString } from "@dokploy/server/services/logs-and-metrics/types";
-import {
-	buildMetricsScopeTransformSource,
-	buildVectorConfigYaml,
-	collectSecretValues,
-	redactSecrets,
-} from "@dokploy/server/setup/vector-setup";
-import { describe, expect, it } from "vitest";
-import { parse } from "yaml";
-
-const provider = (overrides: Record<string, unknown>) =>
-	({
-		apiKey: null,
-		apiSecret: null,
-		endpoint: null,
-		extraConfig: null,
-		signals: ["logs"],
-		...overrides,
-	}) as any;
-
-const loki = provider({
-	telemetryProviderId: "loki-1",
-	name: "loki",
-	providerType: "loki",
-	endpoint: "https://loki.example.com",
-});
-
-const prom = provider({
-	telemetryProviderId: "prom-1",
-	name: "prom",
-	providerType: "prometheus_remote_write",
-	signals: ["metrics"],
-	endpoint: "http://prom.example.com:9090/api/v1/write",
-});
-
-const datadog = provider({
-	telemetryProviderId: "dd-1",
-	name: "datadog",
-	providerType: "datadog",
-	signals: ["logs", "metrics"],
-	apiKey: "dd-key",
-});
-
-const build = (
-	overrides: Partial<Parameters<typeof buildVectorConfigYaml>[0]>,
-) =>
-	parse(
-		buildVectorConfigYaml({
-			logProviders: [],
-			metricsProviders: [],
-			serverName: "my server",
-			...overrides,
-		}),
-	) as any;
-
-describe("buildVectorConfigYaml — logs", () => {
-	it("generates a source, a dokploy_scope transform and one sink per provider, and nothing for metrics", () => {
-		const config = build({ logProviders: [loki] });
-
-		expect(config.data_dir).toBe("/var/lib/vector");
-		expect(config.sources.docker_logs_source.type).toBe("docker_logs");
-		expect(config.transforms.dokploy_scope.type).toBe("remap");
-		expect(config.transforms.dokploy_scope.inputs).toEqual([
-			"docker_logs_source",
-		]);
-		expect(Object.keys(config.sinks)).toEqual(["sink_loki-1"]);
-		expect(config.sinks["sink_loki-1"].type).toBe("loki");
-		expect(config.sinks["sink_loki-1"].inputs).toEqual(["dokploy_scope"]);
-
-		expect(config.sources.host_metrics_source).toBeUndefined();
-		expect(config.sources.cadvisor_source).toBeUndefined();
-		expect(config.transforms.dokploy_metrics_scope).toBeUndefined();
-	});
-
-	it("chains scope -> transform -> sink for betterstack/datadog, and scope -> sink direct for loki", () => {
-		const config = build({
-			logProviders: [
-				loki,
-				provider({
-					telemetryProviderId: "bs-1",
-					name: "betterstack",
-					providerType: "betterstack",
-					endpoint: "https://in.logs.betterstack.com",
-					apiKey: "token",
-				}),
-				datadog,
-			],
-		});
-
-		expect(config.sinks["sink_loki-1"].inputs).toEqual(["dokploy_scope"]);
-		expect(config.transforms["transform_bs-1"].inputs).toEqual([
-			"dokploy_scope",
-		]);
-		expect(config.sinks["sink_bs-1"].inputs).toEqual(["transform_bs-1"]);
-		expect(config.transforms["transform_dd-1"].inputs).toEqual([
-			"dokploy_scope",
-		]);
-		expect(config.sinks["sink_dd-1"].inputs).toEqual(["transform_dd-1"]);
-	});
-
-	it("tags every log with the server name and reads the Dokploy metadata straight off the container labels, with empty defaults for containers Dokploy did not deploy", () => {
-		const config = build({ logProviders: [loki], serverName: 'srv "quoted"' });
-
-		expect(config.transforms.dokploy_scope.source).toBe(
-			[
-				'.dokploy_server = "srv \\"quoted\\""',
-				'.dokploy_organization = .label."dokploy.organization.id" || ""',
-				'.dokploy_project = .label."dokploy.project" || ""',
-				'.dokploy_project_id = .label."dokploy.project.id" || ""',
-				'.dokploy_environment = .label."dokploy.environment" || ""',
-				'.dokploy_environment_id = .label."dokploy.environment.id" || ""',
-				'.dokploy_application = .label."dokploy.application" || ""',
-				'.dokploy_application_id = .label."dokploy.application.id" || ""',
-				'.dokploy_service = .label."dokploy.service" || ""',
-			].join("\n"),
-		);
-	});
-
-	it("skips a provider whose config an adapter rejects at build time, instead of failing the whole org's config", () => {
-		const config = build({
-			logProviders: [
-				provider({
-					telemetryProviderId: "broken-es",
-					name: "es-broken",
-					providerType: "elasticsearch",
-					endpoint: "https://es.example.com:9200",
-					extraConfig: { username: "elastic" },
-				}),
-				loki,
-			],
-		});
-
-		expect(Object.keys(config.sinks)).toEqual(["sink_loki-1"]);
-	});
-
-	it("only keeps containers of the owning organization on the local host, which is shared by every organization", () => {
-		const config = build({ logProviders: [loki], organizationId: "org-a" });
-
-		expect(config.transforms.dokploy_scope_local_only).toEqual({
-			type: "filter",
-			inputs: ["dokploy_scope"],
-			condition: '.dokploy_organization == "org-a"',
-		});
-		expect(config.sinks["sink_loki-1"].inputs).toEqual([
-			"dokploy_scope_local_only",
-		]);
-	});
-
-	it("does not add the organization filter for the per-server (non-local) path", () => {
-		const config = build({ logProviders: [loki] });
-
-		expect(config.transforms.dokploy_scope_local_only).toBeUndefined();
-	});
-});
-
-describe("buildVectorConfigYaml — metrics", () => {
-	it("with only metrics providers it emits the host and cAdvisor sources and no logs pipeline", () => {
-		const config = build({ metricsProviders: [prom] });
-
-		expect(config.sources.docker_logs_source).toBeUndefined();
-		expect(config.transforms.dokploy_scope).toBeUndefined();
-		expect(config.sources.host_metrics_source).toMatchObject({
-			type: "host_metrics",
-			scrape_interval_secs: 30,
-			collectors: [
-				"cpu",
-				"memory",
-				"disk",
-				"filesystem",
-				"network",
-				"load",
-				"host",
-			],
-		});
-		expect(
-			config.sources.host_metrics_source.filesystem.filesystems.excludes,
-		).toEqual(
-			expect.arrayContaining([
-				"overlay",
-				"tmpfs",
-				"squashfs",
-				"devtmpfs",
-				"nsfs",
-				"proc",
-				"sysfs",
-				"devpts",
-				"cgroup2",
-			]),
-		);
-		expect(config.sources.host_metrics_source.network.devices.excludes).toEqual(
-			["veth*", "br-*", "docker*"],
-		);
-		expect(config.sources.cadvisor_source).toEqual({
-			type: "prometheus_scrape",
-			endpoints: ["http://127.0.0.1:4510/metrics"],
-			scrape_interval_secs: 30,
-			scrape_timeout_secs: 10,
-		});
-		expect(config.transforms.dokploy_metrics_scope).toMatchObject({
-			type: "remap",
-			inputs: ["host_metrics_source", "cadvisor_source"],
-			drop_on_abort: true,
-		});
-		expect(Object.keys(config.sinks)).toEqual(["sink_prom-1_metrics"]);
-		expect(config.sinks["sink_prom-1_metrics"]).toMatchObject({
-			type: "prometheus_remote_write",
-			inputs: ["dokploy_metrics_scope"],
-		});
-		expect(config.transforms.dokploy_metrics_scope_local_only).toBeUndefined();
-	});
-
-	it("on the local host it lets host series through and keeps only the owning organization's containers", () => {
-		const config = build({ metricsProviders: [prom], organizationId: "org-a" });
-
-		expect(config.transforms.dokploy_metrics_scope_local_only).toEqual({
-			type: "filter",
-			inputs: ["dokploy_metrics_scope"],
-			condition:
-				'.namespace == "host" || .tags.dokploy_organization == "org-a"',
-		});
-		expect(config.sinks["sink_prom-1_metrics"].inputs).toEqual([
-			"dokploy_metrics_scope_local_only",
-		]);
-	});
-
-	it("a provider assigned to both signals gets a logs sink and a metrics sink without clashing", () => {
-		const config = build({
-			logProviders: [datadog],
-			metricsProviders: [datadog],
-			organizationId: "org-a",
-		});
-
-		expect(config.sinks["sink_dd-1"]).toMatchObject({
-			type: "datadog_logs",
-			inputs: ["transform_dd-1"],
-		});
-		expect(config.sinks["sink_dd-1_metrics"]).toMatchObject({
-			type: "datadog_metrics",
-			inputs: ["dokploy_metrics_scope_local_only"],
-		});
-		expect(config.transforms["transform_dd-1_metrics"]).toBeUndefined();
-	});
-
-	it("tags every series with the server name, promotes non-empty dokploy labels and drops the cgroup id", () => {
-		const source = buildMetricsScopeTransformSource('srv "quoted"');
-
-		expect(source).toContain('.tags.dokploy_server = "srv \\"quoted\\""');
-		expect(source).toContain(
-			'if .namespace != "host" && !starts_with(string!(.name), "container_") { abort }',
-		);
-		expect(source).toContain(
-			'value = del(.tags.container_label_dokploy_application)\nif is_string(value) && value != "" { .tags.dokploy_application = value }',
-		);
-		expect(source.trim().endsWith("del(.tags.id)")).toBe(true);
-		expect(
-			build({ metricsProviders: [prom] }).transforms.dokploy_metrics_scope
-				.source,
-		).toBe(buildMetricsScopeTransformSource("my server"));
-	});
-});
-
-describe("buildVectorConfigYaml — dollar signs", () => {
-	it("keeps every $ literal because the agent runs without env var interpolation", () => {
-		const yamlStr = buildVectorConfigYaml({
-			logProviders: [
-				provider({
-					telemetryProviderId: "loki-1",
-					name: "loki",
-					providerType: "loki",
-					endpoint: "https://loki.example.com",
-					apiKey: "Pa$5w0rd$HOME",
-					extraConfig: { username: "12345" },
-				}),
-			],
-			metricsProviders: [prom],
-			serverName: "srv $ONE",
-		});
-
-		expect(yamlStr).not.toContain("$$");
-		expect(yamlStr).toContain("srv $ONE");
-		expect(parse(yamlStr).sinks["sink_loki-1"].auth.password).toBe(
-			"Pa$5w0rd$HOME",
-		);
-	});
-});
-
-describe("collectSecretValues / redactSecrets", () => {
-	it("collects endpoint/apiKey/apiSecret across all providers but only the password-type extraConfig fields", () => {
-		const providers = [
-			{
-				providerType: "loki",
-				endpoint: "https://loki.example.com",
-				apiKey: "loki-key",
-				apiSecret: null,
-				extraConfig: { tenantId: "tenant-a", username: "12345" },
-			},
-			{
-				providerType: "datadog",
-				endpoint: null,
-				apiKey: "dd-key",
-				apiSecret: null,
-				extraConfig: { site: "datadoghq.eu" },
-			},
-			{
-				providerType: "aws_cloudwatch",
-				endpoint: null,
-				apiKey: "AKIA",
-				apiSecret: "shh",
-				extraConfig: { region: "us-east-1", metricsNamespace: "Dokploy" },
-			},
-		] as any;
-
-		const values = collectSecretValues(providers);
-		expect(values).toEqual(
-			expect.arrayContaining([
-				"https://loki.example.com",
-				"loki-key",
-				"dd-key",
-				"AKIA",
-				"shh",
-			]),
-		);
-		for (const plain of [
-			"tenant-a",
-			"12345",
-			"datadoghq.eu",
-			"us-east-1",
-			"Dokploy",
-		]) {
-			expect(values).not.toContain(plain);
-		}
-	});
-
-	it("ignores null/empty credentials", () => {
-		const providers = [
-			{
-				providerType: "elasticsearch",
-				endpoint: null,
-				apiKey: null,
-				apiSecret: null,
-				extraConfig: { limit: 10, enabled: true, empty: "" },
-			},
-		] as any;
-		expect(collectSecretValues(providers)).toEqual([]);
-	});
-
-	it("redacts every collected secret, longest first so a short one can't eat part of a longer one", () => {
-		const providers = [
-			{
-				providerType: "loki",
-				endpoint: null,
-				apiKey: "hunter2-long-suffix",
-				apiSecret: "hunter2",
-				extraConfig: null,
-			},
-		] as any;
-		const text =
-			"sink validation error near apiKey=hunter2-long-suffix and hunter2";
-
-		const redacted = redactSecrets(text, collectSecretValues(providers));
-
-		expect(redacted).not.toContain("hunter2");
-		expect(redacted).toBe(
-			"sink validation error near apiKey=[redacted] and [redacted]",
-		);
-	});
-});
-
-describe("vrlString", () => {
-	it("quotes and escapes like JSON but drops the control characters VRL rejects", () => {
-		expect(vrlString('my "server"')).toBe('"my \\"server\\""');
-		expect(vrlString("back\\slash")).toBe('"back\\\\slash"');
-		expect(vrlString("a\u0008b\u000cc\u0000d\u007fe\nf")).toBe('"abcdef"');
-	});
-});
@@ -1,526 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import { parse } from "yaml";
-
-const mocks = vi.hoisted(() => ({
-	findServerById: vi.fn(),
-	getWebServerSettings: vi.fn(),
-	findEnabledTelemetryProvidersByOrganization: vi.fn(),
-	execAsync: vi.fn(),
-	execAsyncRemote: vi.fn(),
-	inspectService: vi.fn(),
-	updateService: vi.fn(),
-	removeService: vi.fn(),
-	createService: vi.fn(),
-	getService: vi.fn(),
-	listContainers: vi.fn(),
-	killContainer: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/db", () => ({ db: {} }));
-vi.mock("@dokploy/server/constants", () => ({
-	IS_CLOUD: false,
-	paths: (isServer: boolean) => ({
-		VECTOR_PATH: isServer ? "/etc/dokploy/vector" : "/local/dokploy/vector",
-	}),
-}));
-vi.mock("@dokploy/server/services/server", () => ({
-	findServerById: mocks.findServerById,
-	findServersByOrganizationForVectorAgent: vi.fn(),
-	getAccessibleServerIds: vi.fn(),
-}));
-vi.mock("@dokploy/server/services/web-server-settings", () => ({
-	getWebServerSettings: mocks.getWebServerSettings,
-}));
-vi.mock(
-	"@dokploy/server/services/logs-and-metrics/service",
-	async (importOriginal) => ({
-		...(await importOriginal<
-			typeof import("@dokploy/server/services/logs-and-metrics/service")
-		>()),
-		findEnabledTelemetryProvidersByOrganization:
-			mocks.findEnabledTelemetryProvidersByOrganization,
-	}),
-);
-vi.mock("@dokploy/server/utils/process/execAsync", () => ({
-	execAsync: mocks.execAsync,
-	execAsyncRemote: mocks.execAsyncRemote,
-}));
-vi.mock("@dokploy/server/utils/servers/remote-docker", () => ({
-	getRemoteDocker: async () => ({
-		getService: mocks.getService,
-		createService: mocks.createService,
-		listContainers: mocks.listContainers,
-		getContainer: () => ({ kill: mocks.killContainer }),
-	}),
-}));
-
-const { reconcileVectorAgent, removeVectorAgent } = await import(
-	"@dokploy/server/setup/vector-setup"
-);
-
-const lokiProvider = {
-	telemetryProviderId: "lp-1",
-	name: "loki",
-	providerType: "loki",
-	signals: ["logs"],
-	endpoint: "https://loki.example.com",
-	apiKey: "sekret-token",
-	apiSecret: null,
-	extraConfig: null,
-	enabled: true,
-	organizationId: "org-a",
-};
-
-const promProvider = {
-	...lokiProvider,
-	telemetryProviderId: "mp-1",
-	name: "prom",
-	providerType: "prometheus_remote_write",
-	signals: ["metrics"],
-	endpoint: "http://prom.example.com:9090/api/v1/write",
-	apiKey: null,
-};
-
-const notFound = () =>
-	Object.assign(new Error("not found"), { statusCode: 404 });
-
-const writtenYaml = (command: string) => {
-	const match = command.match(/echo "([^"]+)" \| base64 -d/);
-	return parse(Buffer.from(match?.[1] ?? "", "base64").toString("utf8"));
-};
-
-const commandsOf = (mock: typeof mocks.execAsync) =>
-	mock.mock.calls.map((call) => String(call[call.length - 1]));
-
-beforeEach(() => {
-	for (const mock of Object.values(mocks)) mock.mockReset();
-	mocks.getService.mockImplementation(() => ({
-		inspect: mocks.inspectService,
-		update: mocks.updateService,
-		remove: mocks.removeService,
-	}));
-	mocks.inspectService.mockRejectedValue(notFound());
-	mocks.removeService.mockRejectedValue(notFound());
-	mocks.execAsync.mockResolvedValue({ stdout: "", stderr: "" });
-	mocks.execAsyncRemote.mockResolvedValue({ stdout: "", stderr: "" });
-	mocks.listContainers.mockResolvedValue([{ Id: "vector-container" }]);
-	mocks.killContainer.mockResolvedValue(undefined);
-});
-
-describe("reconcileVectorAgent", () => {
-	it("writes, validates and applies the YAML and deploys Vector for the saved selection", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-
-		await reconcileVectorAgent();
-
-		const commands = commandsOf(mocks.execAsync);
-		expect(commands).toHaveLength(3);
-		expect(commands[0]).toContain(
-			"/local/dokploy/vector/vector.yaml.candidate.",
-		);
-		expect(commands[1]).toMatch(
-			/timberio\/vector:\d+\.\d+\.\d+-alpine validate --skip-healthchecks/,
-		);
-		expect(commands[2]).toMatch(
-			/^mv \/local\/dokploy\/vector\/vector\.yaml\.candidate\.\S+ \/local\/dokploy\/vector\/vector\.yaml$/,
-		);
-		expect(mocks.execAsyncRemote).not.toHaveBeenCalled();
-
-		const config = writtenYaml(commands[0] ?? "");
-		expect(config.sinks["sink_lp-1"].inputs).toEqual([
-			"dokploy_scope_local_only",
-		]);
-		expect(config.sources.host_metrics_source).toBeUndefined();
-
-		expect(mocks.createService).toHaveBeenCalledTimes(1);
-		expect(mocks.createService.mock.calls[0]?.[0]).toMatchObject({
-			Name: "dokploy-vector",
-		});
-		expect(mocks.getService).toHaveBeenCalledWith("dokploy-cadvisor");
-		expect(mocks.removeService).toHaveBeenCalledTimes(1);
-	});
-
-	it("splits one selection into the logs and metrics pipelines by what each provider sends", async () => {
-		const datadogProvider = {
-			...lokiProvider,
-			telemetryProviderId: "dd-1",
-			name: "datadog",
-			providerType: "datadog",
-			signals: ["logs", "metrics"],
-			endpoint: null,
-			apiKey: "dd-key",
-		};
-		const unselected = { ...lokiProvider, telemetryProviderId: "lp-9" };
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1", "mp-1", "dd-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-			promProvider,
-			datadogProvider,
-			unselected,
-		]);
-
-		await reconcileVectorAgent();
-
-		const config = writtenYaml(commandsOf(mocks.execAsync)[0] ?? "");
-		const sinkIds = Object.keys(config.sinks);
-		expect(sinkIds.some((id) => id.includes("lp-1"))).toBe(true);
-		expect(sinkIds.some((id) => id.includes("mp-1"))).toBe(true);
-		expect(sinkIds.filter((id) => id.includes("dd-1")).length).toBe(2);
-		expect(sinkIds.some((id) => id.includes("lp-9"))).toBe(false);
-		expect(config.sources.docker_logs_source).toBeDefined();
-		expect(config.sources.cadvisor_source).toBeDefined();
-		expect(mocks.createService.mock.calls.map((c) => c[0].Name)).toEqual([
-			"dokploy-vector",
-			"dokploy-cadvisor",
-		]);
-	});
-
-	it("removes cAdvisor but keeps Vector when no selected provider sends metrics", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1", "mp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-
-		await reconcileVectorAgent();
-
-		const config = writtenYaml(commandsOf(mocks.execAsync)[0] ?? "");
-		expect(config.sources.cadvisor_source).toBeUndefined();
-		expect(mocks.createService.mock.calls.map((c) => c[0].Name)).toEqual([
-			"dokploy-vector",
-		]);
-		expect(mocks.getService).toHaveBeenCalledWith("dokploy-cadvisor");
-		expect(mocks.removeService).toHaveBeenCalledTimes(1);
-	});
-
-	it("filters by the organization only on the local host and runs on the server over SSH", async () => {
-		mocks.findServerById.mockResolvedValue({
-			serverId: "server-1",
-			organizationId: "org-a",
-			name: "edge-1",
-			telemetryProviderIds: ["lp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-
-		await reconcileVectorAgent("server-1");
-
-		expect(mocks.execAsync).not.toHaveBeenCalled();
-		expect(
-			mocks.execAsyncRemote.mock.calls.every((c) => c[0] === "server-1"),
-		).toBe(true);
-		const config = writtenYaml(commandsOf(mocks.execAsyncRemote)[0] ?? "");
-		expect(config.transforms.dokploy_scope_local_only).toBeUndefined();
-		expect(config.sinks["sink_lp-1"].inputs).toEqual(["dokploy_scope"]);
-	});
-
-	it("does not apply a config that vector validate rejects, redacts secrets and leaves the selection alone", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-		mocks.execAsync.mockImplementation(async (command: string) => {
-			if (command.includes("validate")) {
-				throw new Error("bad sink: password sekret-token rejected");
-			}
-			return { stdout: "", stderr: "" };
-		});
-
-		await expect(reconcileVectorAgent()).rejects.toThrow(
-			/failed validation, not applying it: bad sink: password \[redacted\] rejected/,
-		);
-
-		const commands = commandsOf(mocks.execAsync);
-		expect(commands.some((c) => c.startsWith("mv "))).toBe(false);
-		expect(commands.some((c) => c.startsWith("rm -f "))).toBe(true);
-		expect(mocks.createService).not.toHaveBeenCalled();
-	});
-
-	it("removes the agent when no enabled provider is left in the selection", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["deleted-or-disabled"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([]);
-
-		await reconcileVectorAgent();
-
-		expect(mocks.getService).toHaveBeenCalledWith("dokploy-cadvisor");
-		expect(mocks.getService).toHaveBeenCalledWith("dokploy-vector");
-		expect(mocks.removeService).toHaveBeenCalledTimes(2);
-		expect(commandsOf(mocks.execAsync)).toEqual([
-			"rm -rf /local/dokploy/vector",
-		]);
-		expect(mocks.createService).not.toHaveBeenCalled();
-	});
-
-	it("removes the agent when the selection is empty, without an owner", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: null,
-			telemetryProviderIds: [],
-		});
-
-		await reconcileVectorAgent();
-
-		expect(
-			mocks.findEnabledTelemetryProvidersByOrganization,
-		).not.toHaveBeenCalled();
-		expect(mocks.removeService).toHaveBeenCalledTimes(2);
-	});
-
-	it("deploys cAdvisor next to Vector when metrics providers are assigned", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["mp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			promProvider,
-		]);
-
-		await reconcileVectorAgent();
-
-		const config = writtenYaml(commandsOf(mocks.execAsync)[0] ?? "");
-		expect(config.sources.docker_logs_source).toBeUndefined();
-		expect(config.sources.cadvisor_source.endpoints).toEqual([
-			"http://127.0.0.1:4510/metrics",
-		]);
-
-		expect(mocks.createService.mock.calls.map((c) => c[0].Name)).toEqual([
-			"dokploy-vector",
-			"dokploy-cadvisor",
-		]);
-		const cadvisor = mocks.createService.mock.calls[1]?.[0];
-		expect(cadvisor.TaskTemplate.ContainerSpec.Image).toMatch(
-			/^ghcr\.io\/google\/cadvisor:v\d+\.\d+\.\d+$/,
-		);
-		expect(cadvisor.TaskTemplate.ContainerSpec.Args).toEqual(
-			expect.arrayContaining([
-				"--listen_ip=127.0.0.1",
-				"--port=4510",
-				"--docker_only=true",
-				"--store_container_labels=false",
-			]),
-		);
-		expect(cadvisor.TaskTemplate.ContainerSpec.HealthCheck).toEqual({
-			Test: ["NONE"],
-		});
-		expect(cadvisor.TaskTemplate.Networks).toEqual([{ Target: "host" }]);
-		expect(mocks.removeService).not.toHaveBeenCalled();
-	});
-
-	it("removes the agent on a remote server when the selection is empty", async () => {
-		mocks.findServerById.mockResolvedValue({
-			serverId: "server-1",
-			sshKeyId: "key-1",
-			organizationId: "org-a",
-			name: "edge-1",
-			telemetryProviderIds: [],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([]);
-
-		await reconcileVectorAgent("server-1");
-
-		expect(
-			mocks.findEnabledTelemetryProvidersByOrganization,
-		).toHaveBeenCalled();
-		expect(mocks.removeService).toHaveBeenCalledTimes(2);
-		expect(mocks.createService).not.toHaveBeenCalled();
-		expect(commandsOf(mocks.execAsyncRemote)).toEqual([
-			"rm -rf /etc/dokploy/vector",
-		]);
-	});
-
-	it("redacts the config and secrets when writing or applying the candidate fails", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-		const echoCommand = async (command: string) => {
-			if (command.includes("base64 -d") || command.startsWith("mv ")) {
-				throw new Error(`Command failed: ${command} (token sekret-token)`);
-			}
-			return { stdout: "", stderr: "" };
-		};
-		mocks.execAsync.mockImplementation(echoCommand);
-
-		const writeError = await reconcileVectorAgent().catch(
-			(e: Error) => e.message,
-		);
-		expect(writeError).toMatch(/^Failed to write the Vector config: /);
-		expect(writeError).not.toContain("sekret-token");
-		expect(writeError).not.toContain(
-			Buffer.from("data_dir").toString("base64").slice(0, 8),
-		);
-		expect(writeError).toContain("[redacted]");
-
-		mocks.execAsync.mockImplementation(async (command: string) => {
-			if (command.startsWith("mv ")) return echoCommand(command);
-			return { stdout: "", stderr: "" };
-		});
-		const applyError = await reconcileVectorAgent().catch(
-			(e: Error) => e.message,
-		);
-		expect(applyError).toMatch(/^Failed to apply the Vector config: /);
-		expect(applyError).not.toContain("sekret-token");
-		expect(mocks.createService).not.toHaveBeenCalled();
-	});
-
-	it("propagates a rejected service update instead of pretending the create succeeded", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-		mocks.inspectService.mockResolvedValue({
-			Version: { Index: "7" },
-			Spec: { TaskTemplate: { ForceUpdate: 2 } },
-		});
-		mocks.updateService.mockRejectedValue(
-			new Error("rpc error: invalid mount"),
-		);
-
-		await expect(reconcileVectorAgent()).rejects.toThrow("invalid mount");
-		expect(mocks.createService).not.toHaveBeenCalled();
-	});
-
-	it("propagates an inspect failure that is not a 404", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-		mocks.inspectService.mockRejectedValue(
-			Object.assign(new Error("daemon unreachable"), { statusCode: 500 }),
-		);
-
-		await expect(reconcileVectorAgent()).rejects.toThrow("daemon unreachable");
-		expect(mocks.createService).not.toHaveBeenCalled();
-	});
-
-	it("does not restart Vector on a config-only redeploy", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-		mocks.inspectService.mockImplementation(async () => ({
-			Version: { Index: "7" },
-			Spec: {
-				TaskTemplate: {
-					ForceUpdate: 2,
-					ContainerSpec: mocks.createService.mock.calls[0]?.[0]
-						? undefined
-						: undefined,
-				},
-			},
-		}));
-
-		await reconcileVectorAgent();
-		expect(mocks.killContainer).toHaveBeenCalledWith({ signal: "SIGHUP" });
-		expect(mocks.listContainers).toHaveBeenCalledWith({
-			filters: JSON.stringify({
-				label: ["com.docker.swarm.service.name=dokploy-vector"],
-			}),
-		});
-		const firstSpec = mocks.updateService.mock.calls[0]?.[0];
-		mocks.inspectService.mockResolvedValue({
-			Version: { Index: "8" },
-			Spec: { TaskTemplate: { ...firstSpec.TaskTemplate, ForceUpdate: 3 } },
-		});
-		mocks.updateService.mockClear();
-
-		await reconcileVectorAgent();
-		expect(mocks.updateService).toHaveBeenCalledWith(
-			expect.objectContaining({
-				version: 8,
-				TaskTemplate: expect.objectContaining({ ForceUpdate: 3 }),
-			}),
-		);
-	});
-
-	it("updates an existing Vector service instead of creating it", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-a",
-			telemetryProviderIds: ["lp-1"],
-		});
-		mocks.findEnabledTelemetryProvidersByOrganization.mockResolvedValue([
-			lokiProvider,
-		]);
-		mocks.inspectService.mockResolvedValue({
-			Version: { Index: "7" },
-			Spec: { TaskTemplate: { ForceUpdate: 2 } },
-		});
-
-		await reconcileVectorAgent();
-
-		expect(mocks.createService).not.toHaveBeenCalled();
-		expect(mocks.updateService).toHaveBeenCalledWith(
-			expect.objectContaining({
-				version: 7,
-				TaskTemplate: expect.objectContaining({ ForceUpdate: 3 }),
-			}),
-		);
-	});
-});
-
-describe("removeVectorAgent", () => {
-	it("removes cAdvisor, then Vector, then the config directory", async () => {
-		await removeVectorAgent();
-
-		expect(mocks.getService.mock.calls.map((c) => c[0])).toEqual([
-			"dokploy-cadvisor",
-			"dokploy-vector",
-		]);
-		expect(commandsOf(mocks.execAsync)).toEqual([
-			"rm -rf /local/dokploy/vector",
-		]);
-	});
-
-	it("keeps going when cAdvisor cannot be removed", async () => {
-		mocks.removeService
-			.mockRejectedValueOnce(new Error("docker hiccup"))
-			.mockRejectedValueOnce(notFound());
-
-		await removeVectorAgent();
-
-		expect(mocks.removeService).toHaveBeenCalledTimes(2);
-		expect(commandsOf(mocks.execAsync)).toEqual([
-			"rm -rf /local/dokploy/vector",
-		]);
-	});
-
-	it("refuses a server without an SSH key before touching cAdvisor or Vector", async () => {
-		mocks.findServerById.mockResolvedValue({
-			serverId: "server-1",
-			sshKeyId: null,
-		});
-
-		await expect(removeVectorAgent("server-1")).rejects.toThrow(/SSH key/);
-		expect(mocks.getService).not.toHaveBeenCalled();
-		expect(mocks.execAsyncRemote).not.toHaveBeenCalled();
-	});
-});
@@ -1,214 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	listTasks: vi.fn(),
-	inspectService: vi.fn(),
-	findServersByOrganizationForVectorAgent: vi.fn(),
-	getAccessibleServerIds: vi.fn(),
-	getWebServerSettings: vi.fn(),
-	findTelemetryProvidersByOrganization: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/db", () => ({ db: {} }));
-vi.mock("@dokploy/server/constants", () => ({
-	IS_CLOUD: false,
-	paths: () => ({ VECTOR_PATH: "/etc/dokploy/vector" }),
-}));
-vi.mock("@dokploy/server/services/server", () => ({
-	findServerById: vi.fn(),
-	findServersByOrganizationForVectorAgent:
-		mocks.findServersByOrganizationForVectorAgent,
-	getAccessibleServerIds: mocks.getAccessibleServerIds,
-}));
-vi.mock("@dokploy/server/services/web-server-settings", () => ({
-	getWebServerSettings: mocks.getWebServerSettings,
-}));
-vi.mock(
-	"@dokploy/server/services/logs-and-metrics/service",
-	async (importOriginal) => ({
-		...(await importOriginal<
-			typeof import("@dokploy/server/services/logs-and-metrics/service")
-		>()),
-		findTelemetryProvidersByOrganization:
-			mocks.findTelemetryProvidersByOrganization,
-	}),
-);
-vi.mock("@dokploy/server/utils/servers/remote-docker", () => ({
-	getRemoteDocker: async () => ({
-		listTasks: mocks.listTasks,
-		getService: () => ({ inspect: mocks.inspectService }),
-	}),
-}));
-
-const { getVectorAgentTargets, withVectorTargetLock } = await import(
-	"@dokploy/server/setup/vector-setup"
-);
-
-const session = { userId: "user-1", activeOrganizationId: "org-1" };
-
-describe("getVectorAgentTargets", () => {
-	beforeEach(() => {
-		for (const mock of Object.values(mocks)) mock.mockReset();
-		mocks.findServersByOrganizationForVectorAgent.mockResolvedValue([]);
-		mocks.inspectService.mockResolvedValue({});
-		mocks.getAccessibleServerIds.mockResolvedValue(new Set());
-		mocks.findTelemetryProvidersByOrganization.mockResolvedValue([
-			{ telemetryProviderId: "lp-1", enabled: true, signals: ["logs"] },
-			{ telemetryProviderId: "mp-1", enabled: true, signals: ["metrics"] },
-			{ telemetryProviderId: "mp-off", enabled: false, signals: ["metrics"] },
-		]);
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-1",
-			telemetryProviderIds: ["lp-1"],
-		});
-	});
-
-	it("requires a running cAdvisor task when the target ships metrics", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-1",
-			telemetryProviderIds: ["mp-1"],
-		});
-		mocks.listTasks.mockImplementation(
-			async ({ filters }: { filters: string }) =>
-				JSON.parse(filters).service[0] === "dokploy-vector"
-					? [{ Status: { State: "running" } }]
-					: [],
-		);
-
-		const [local] = await getVectorAgentTargets(session);
-		expect(local?.status).toBe("not-running");
-		expect(mocks.listTasks).toHaveBeenCalledTimes(2);
-	});
-
-	it("reports running when both Vector and cAdvisor have a running task", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-1",
-			telemetryProviderIds: ["mp-1"],
-		});
-		mocks.listTasks.mockResolvedValue([{ Status: { State: "running" } }]);
-
-		const [local] = await getVectorAgentTargets(session);
-		expect(local?.status).toBe("running");
-	});
-
-	it("does not look at cAdvisor for a logs-only target", async () => {
-		mocks.listTasks.mockResolvedValue([{ Status: { State: "running" } }]);
-
-		await getVectorAgentTargets(session);
-		expect(mocks.listTasks).toHaveBeenCalledTimes(1);
-	});
-
-	it("does not look at cAdvisor when the only metrics provider is disabled", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: "org-1",
-			telemetryProviderIds: ["lp-1", "mp-off"],
-		});
-		mocks.listTasks.mockResolvedValue([{ Status: { State: "running" } }]);
-
-		const [local] = await getVectorAgentTargets(session);
-		expect(local?.status).toBe("running");
-		expect(mocks.listTasks).toHaveBeenCalledTimes(1);
-	});
-
-	it("reports running only when a task of the service is running", async () => {
-		mocks.listTasks.mockResolvedValue([{ Status: { State: "running" } }]);
-
-		const [local] = await getVectorAgentTargets(session);
-		expect(local?.status).toBe("running");
-		expect(mocks.listTasks).toHaveBeenCalledWith({
-			filters: JSON.stringify({
-				service: ["dokploy-vector"],
-				"desired-state": ["running"],
-			}),
-		});
-	});
-
-	it("reports not-running when the service has no running task", async () => {
-		mocks.listTasks.mockResolvedValue([{ Status: { State: "pending" } }]);
-
-		const [local] = await getVectorAgentTargets(session);
-		expect(local?.status).toBe("not-running");
-	});
-
-	it("reports stopped when the service does not exist", async () => {
-		mocks.inspectService.mockRejectedValue(
-			Object.assign(new Error("not found"), { statusCode: 404 }),
-		);
-		mocks.listTasks.mockResolvedValue([]);
-
-		const [local] = await getVectorAgentTargets(session);
-		expect(local?.status).toBe("stopped");
-		expect(mocks.listTasks).not.toHaveBeenCalled();
-	});
-
-	it("reports unknown on any other docker error", async () => {
-		mocks.inspectService.mockRejectedValue(new Error("connect ECONNREFUSED"));
-
-		const [local] = await getVectorAgentTargets(session);
-		expect(local?.status).toBe("unknown");
-	});
-
-	it("reports an empty selection for an unowned local host, even with ids left by a deleted organization", async () => {
-		mocks.getWebServerSettings.mockResolvedValue({
-			vectorAgentOrganizationId: null,
-			telemetryProviderIds: ["lp-from-deleted-org", "mp-from-deleted-org"],
-		});
-		mocks.listTasks.mockResolvedValue([]);
-
-		const [local] = await getVectorAgentTargets(session);
-		expect(local).toMatchObject({
-			serverId: null,
-			telemetryProviderIds: [],
-		});
-	});
-
-	it("hides servers the member cannot access", async () => {
-		mocks.listTasks.mockResolvedValue([]);
-		mocks.findServersByOrganizationForVectorAgent.mockResolvedValue([
-			{
-				serverId: "server-1",
-				name: "one",
-				ipAddress: "1.1.1.1",
-				telemetryProviderIds: [],
-			},
-			{
-				serverId: "server-2",
-				name: "two",
-				ipAddress: "2.2.2.2",
-				telemetryProviderIds: [],
-			},
-		]);
-		mocks.getAccessibleServerIds.mockResolvedValue(new Set(["server-2"]));
-
-		const targets = await getVectorAgentTargets(session);
-		expect(targets.map((t) => t.serverId)).toEqual([null, "server-2"]);
-	});
-});
-
-describe("withVectorTargetLock", () => {
-	it("runs operations on the same target one after another", async () => {
-		const events: string[] = [];
-		let releaseFirst = () => {};
-		const first = withVectorTargetLock("server-1", async () => {
-			events.push("first:start");
-			await new Promise<void>((resolve) => {
-				releaseFirst = resolve;
-			});
-			events.push("first:end");
-			throw new Error("first failed");
-		});
-		const second = withVectorTargetLock("server-1", async () => {
-			events.push("second");
-		});
-		const other = withVectorTargetLock("server-2", async () => {
-			events.push("other");
-		});
-
-		await other;
-		expect(events).toEqual(["first:start", "other"]);
-		releaseFirst();
-		await expect(first).rejects.toThrow("first failed");
-		await second;
-		expect(events).toEqual(["first:start", "other", "first:end", "second"]);
-	});
-});
@@ -1,197 +0,0 @@
-import { execFileSync } from "node:child_process";
-import { mkdtempSync, writeFileSync } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import {
-	buildVectorConfigYaml,
-	VECTOR_IMAGE,
-} from "@dokploy/server/setup/vector-setup";
-import { describe, expect, it } from "vitest";
-
-const dockerAvailable = (() => {
-	try {
-		execFileSync("docker", ["info"], { stdio: "ignore", timeout: 10_000 });
-		return true;
-	} catch {
-		return false;
-	}
-})();
-
-const provider = (overrides: Record<string, unknown>) =>
-	({
-		apiKey: null,
-		apiSecret: null,
-		endpoint: null,
-		extraConfig: null,
-		enabled: true,
-		...overrides,
-	}) as any;
-
-const logsOnly = [
-	provider({
-		telemetryProviderId: "loki1",
-		name: "loki",
-		providerType: "loki",
-		signals: ["logs"],
-		endpoint: "http://loki.example.com:3100",
-		apiKey: "Pa$5w0rd$HOME",
-		extraConfig: { username: "12345" },
-	}),
-];
-
-const metricsOnly = [
-	provider({
-		telemetryProviderId: "prom1",
-		name: "prom",
-		providerType: "prometheus_remote_write",
-		signals: ["metrics"],
-		endpoint: "http://prom.example.com:9090/api/v1/write",
-		apiKey: "token",
-		extraConfig: { tenantId: "team-a" },
-	}),
-	provider({
-		telemetryProviderId: "nr1",
-		name: "new relic",
-		providerType: "new_relic",
-		signals: ["metrics"],
-		apiKey: "license",
-		extraConfig: { accountId: "123", region: "eu" },
-	}),
-	provider({
-		telemetryProviderId: "influx1",
-		name: "influx",
-		providerType: "influxdb",
-		signals: ["metrics"],
-		endpoint: "http://influx.example.com:8086",
-		apiKey: "token",
-		extraConfig: { org: "dokploy", bucket: "metrics" },
-	}),
-];
-
-const both = [
-	provider({
-		telemetryProviderId: "dd1",
-		name: "datadog",
-		providerType: "datadog",
-		signals: ["logs", "metrics"],
-		apiKey: "dd-key",
-	}),
-	provider({
-		telemetryProviderId: "cw1",
-		name: "cloudwatch",
-		providerType: "aws_cloudwatch",
-		signals: ["logs", "metrics"],
-		apiKey: "AKIAFAKE",
-		apiSecret: "secret",
-		extraConfig: {
-			region: "us-east-1",
-			logGroup: "/dokploy/logs",
-			metricsNamespace: "Dokploy",
-		},
-	}),
-	provider({
-		telemetryProviderId: "splunk1",
-		name: "splunk",
-		providerType: "splunk_hec",
-		signals: ["logs", "metrics"],
-		endpoint: "https://splunk.example.com:8088",
-		apiKey: "hec",
-		extraConfig: { index: "main", metricsIndex: "dokploy_metrics" },
-	}),
-	provider({
-		telemetryProviderId: "es1",
-		name: "elastic",
-		providerType: "elasticsearch",
-		signals: ["logs", "metrics"],
-		endpoint: "http://es.example.com:9200",
-		apiKey: "pw",
-		extraConfig: { username: "elastic" },
-	}),
-	provider({
-		telemetryProviderId: "bs1",
-		name: "better stack",
-		providerType: "betterstack",
-		signals: ["logs", "metrics"],
-		endpoint: "in.logs.betterstack.com",
-		apiKey: "token",
-	}),
-];
-
-const cases: Array<[string, Parameters<typeof buildVectorConfigYaml>[0]]> = [
-	[
-		"local logs only",
-		{
-			logProviders: logsOnly,
-			metricsProviders: [],
-			organizationId: "org_a",
-			serverName: "Dokploy Server (local)",
-		},
-	],
-	[
-		"local metrics only",
-		{
-			logProviders: [],
-			metricsProviders: metricsOnly,
-			organizationId: "org_a",
-			serverName: "Dokploy Server (local)",
-		},
-	],
-	[
-		"local every provider on both signals",
-		{
-			logProviders: [...logsOnly, ...both],
-			metricsProviders: [...metricsOnly, ...both],
-			organizationId: "org_a",
-			serverName: 'Dokploy "Server" $HOSTNAME (local)',
-		},
-	],
-	[
-		"remote metrics only",
-		{ logProviders: [], metricsProviders: metricsOnly, serverName: "edge-1" },
-	],
-	[
-		"remote every provider on both signals",
-		{
-			logProviders: [...logsOnly, ...both],
-			metricsProviders: [...metricsOnly, ...both],
-			serverName: "edge-1",
-		},
-	],
-];
-
-describe.skipIf(!dockerAvailable)(
-	"vector validate on generated configs",
-	() => {
-		const dir = mkdtempSync(path.join(os.tmpdir(), "vector-validate-"));
-
-		it.each(cases)(
-			"%s",
-			(name, input) => {
-				const file = path.join(dir, `${name.replace(/\W+/g, "-")}.yaml`);
-				writeFileSync(file, buildVectorConfigYaml(input));
-				const output = execFileSync(
-					"docker",
-					[
-						"run",
-						"--rm",
-						"-v",
-						"/var/run/docker.sock:/var/run/docker.sock:ro",
-						"-v",
-						`${file}:/etc/vector/vector.yaml:ro`,
-						VECTOR_IMAGE,
-						"validate",
-						"--skip-healthchecks",
-						"/etc/vector/vector.yaml",
-					],
-					{
-						encoding: "utf8",
-						stdio: ["ignore", "pipe", "pipe"],
-						timeout: 120_000,
-					},
-				);
-				expect(output).toContain("Validated");
-			},
-			150_000,
-		);
-	},
-);
@@ -1,86 +0,0 @@
-import type { SQL } from "drizzle-orm";
-import { PgDialect } from "drizzle-orm/pg-core";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	findFirst: vi.fn(),
-	updates: [] as Array<{ values: Record<string, unknown>; where: unknown }>,
-	returning: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: { webServerSettings: { findFirst: mocks.findFirst } },
-		update: () => ({
-			set: (values: Record<string, unknown>) => ({
-				where: (where: unknown) => {
-					mocks.updates.push({ values, where });
-					return { returning: () => Promise.resolve(mocks.returning()) };
-				},
-			}),
-		}),
-	},
-}));
-
-const { releaseWebServerAgent, setWebServerProviderIds } = await import(
-	"@dokploy/server/services/web-server-settings"
-);
-
-const render = (value: unknown) => new PgDialect().sqlToQuery(value as SQL).sql;
-
-beforeEach(() => {
-	mocks.updates = [];
-	mocks.findFirst.mockResolvedValue({
-		id: "ws-1",
-		vectorAgentOrganizationId: "org-a",
-	});
-	mocks.returning.mockReturnValue([{ id: "ws-1" }]);
-});
-
-describe("setWebServerProviderIds", () => {
-	it("claims the local agent for the organization when assigning providers", async () => {
-		const row = await setWebServerProviderIds("org-a", ["lp-1", "mp-1"]);
-
-		expect(row).toEqual({ id: "ws-1" });
-		const update = mocks.updates[0];
-		expect(update?.values).toMatchObject({
-			telemetryProviderIds: ["lp-1", "mp-1"],
-			vectorAgentOrganizationId: "org-a",
-		});
-		expect(render(update?.where)).toBe(
-			'("webServerSettings"."id" = $1 and ("webServerSettings"."vectorAgentOrganizationId" is null or "webServerSettings"."vectorAgentOrganizationId" = $2))',
-		);
-	});
-
-	it("releases the owner when the selection is cleared", async () => {
-		await setWebServerProviderIds("org-a", []);
-
-		expect(mocks.updates[0]?.values).toMatchObject({
-			telemetryProviderIds: [],
-			vectorAgentOrganizationId: null,
-		});
-	});
-
-	it("returns null when another organization owns the local agent", async () => {
-		mocks.returning.mockReturnValue([]);
-
-		await expect(
-			setWebServerProviderIds("org-b", ["lp-9"]),
-		).resolves.toBeNull();
-	});
-});
-
-describe("releaseWebServerAgent", () => {
-	it("clears the selection and the owner only for the owning organization", async () => {
-		await releaseWebServerAgent("org-a");
-
-		const update = mocks.updates[0];
-		expect(update?.values).toMatchObject({
-			telemetryProviderIds: [],
-			vectorAgentOrganizationId: null,
-		});
-		expect(render(update?.where)).toBe(
-			'"webServerSettings"."vectorAgentOrganizationId" = $1',
-		);
-	});
-});
@@ -1,41 +0,0 @@
-import { describe, expect, it } from "vitest";
-import { resolveContainerSelection } from "@/components/dashboard/docker/logs/utils";
-
-const containers = [
-	{ containerId: "first-container" },
-	{ containerId: "selected-container" },
-];
-
-describe("resolveContainerSelection", () => {
-	it("selects the first container when no container is selected", () => {
-		expect(resolveContainerSelection(undefined, containers)).toBe(
-			"first-container",
-		);
-	});
-
-	it("preserves a manual selection when refreshed data contains it", () => {
-		const refreshedContainers = containers.map((container) => ({
-			...container,
-		}));
-
-		expect(
-			resolveContainerSelection("selected-container", refreshedContainers),
-		).toBe("selected-container");
-	});
-
-	it("falls back to the first container when the selection disappears", () => {
-		expect(resolveContainerSelection("removed-container", containers)).toBe(
-			"first-container",
-		);
-	});
-
-	it("keeps the current selection while container data is loading", () => {
-		expect(resolveContainerSelection("selected-container", undefined)).toBe(
-			"selected-container",
-		);
-	});
-
-	it("clears the selection when no containers are available", () => {
-		expect(resolveContainerSelection("selected-container", [])).toBeUndefined();
-	});
-});
@@ -1,104 +0,0 @@
-import {
-	getHostSystemStats,
-	isPhysicalDisk,
-} from "@dokploy/server/monitoring/utils";
-import { describe, expect, it, vi } from "vitest";
-
-const GiB = 1024 ** 3;
-const diskStat = (device: string, readGiB: number, writeGiB: number) => ({
-	device,
-	readBytes: { toBytes: () => readGiB * GiB },
-	writeBytes: { toBytes: () => writeGiB * GiB },
-});
-
-vi.mock("node-os-utils", () => ({
-	OSUtils: class {
-		cpu = { usage: async () => ({ success: false }) };
-		memory = { info: async () => ({ success: false }) };
-		network = { overview: async () => ({ success: false }) };
-		disk = {
-			stats: async () => ({
-				success: true,
-				data: [
-					diskStat("nvme0n1", 50, 100),
-					diskStat("nvme0n1p1", 50, 100),
-					diskStat("nvme1n1", 50, 100),
-					diskStat("nvme1n1p1", 50, 100),
-					diskStat("md0", 50, 100),
-					diskStat("md0p1", 50, 100),
-					diskStat("dm-0", 50, 100),
-					diskStat("zram0", 10, 20),
-				],
-			}),
-		};
-	},
-}));
-
-describe("isPhysicalDisk (#5513, #5385)", () => {
-	it.each([
-		"sda",
-		"sdab",
-		"hda",
-		"vda",
-		"xvda",
-		"nvme0n1",
-		"nvme1n1",
-		"mmcblk0",
-	])("counts whole disk %s", (device) => {
-		expect(isPhysicalDisk(device)).toBe(true);
-	});
-
-	it.each([
-		"sda1",
-		"sdab12",
-		"hda1",
-		"vda1",
-		"xvda1",
-		"nvme0n1p1",
-		"nvme1n1p4",
-		"mmcblk0p1",
-	])("skips partition %s", (device) => {
-		expect(isPhysicalDisk(device)).toBe(false);
-	});
-
-	it.each(["md0", "md127", "md0p1", "md_d0p1", "dm-0", "dm-12"])(
-		"skips stacked device %s",
-		(device) => {
-			expect(isPhysicalDisk(device)).toBe(false);
-		},
-	);
-
-	it.each(["loop0", "ram0", "zram0", "sr0", "fd0"])(
-		"skips virtual device %s",
-		(device) => {
-			expect(isPhysicalDisk(device)).toBe(false);
-		},
-	);
-
-	it("counts each write once on an mdadm RAID1 host", () => {
-		const devices = [
-			"nvme0n1",
-			"nvme0n1p1",
-			"nvme0n1p2",
-			"nvme0n1p3",
-			"nvme0n1p4",
-			"nvme1n1",
-			"nvme1n1p1",
-			"nvme1n1p2",
-			"nvme1n1p3",
-			"nvme1n1p4",
-			"md0",
-			"md1",
-			"md2",
-			"md3",
-		];
-		expect(devices.filter(isPhysicalDisk)).toEqual(["nvme0n1", "nvme1n1"]);
-	});
-});
-
-describe("getHostSystemStats Block I/O (#5513, #5385)", () => {
-	it("sums only whole physical disks", async () => {
-		const stats = await getHostSystemStats();
-		expect(stats.BlockIO).toBe("100.00GiB / 200.00GiB");
-	});
-});
@@ -73,20 +73,6 @@ describe("owner and admin bypass enterprise resources", () => {
 		).resolves.toBeUndefined();
 	});

-	it("owner bypasses telemetryProvider.read", async () => {
-		memberToReturn = mockMemberData("owner");
-		await expect(
-			checkPermission(ctx, { telemetryProvider: ["read"] }),
-		).resolves.toBeUndefined();
-	});
-
-	it("admin bypasses telemetryProvider.create", async () => {
-		memberToReturn = mockMemberData("admin");
-		await expect(
-			checkPermission(ctx, { telemetryProvider: ["create"] }),
-		).resolves.toBeUndefined();
-	});
-
 	it("owner bypasses multiple enterprise permissions at once", async () => {
 		memberToReturn = mockMemberData("owner");
 		await expect(
@@ -140,33 +126,12 @@ describe("member is denied org-level enterprise resources (CVE: bypass via stati
 		await expect(checkPermission(ctx, { server: ["read"] })).rejects.toThrow();
 	});

-	it("member is denied server.terminal", async () => {
-		memberToReturn = mockMemberData("member");
-		await expect(
-			checkPermission(ctx, { server: ["terminal"] }),
-		).rejects.toThrow();
-	});
-
 	it("member is denied registry.create", async () => {
 		memberToReturn = mockMemberData("member");
 		await expect(
 			checkPermission(ctx, { registry: ["create"] }),
 		).rejects.toThrow();
 	});
-
-	it("member is denied telemetryProvider.read", async () => {
-		memberToReturn = mockMemberData("member");
-		await expect(
-			checkPermission(ctx, { telemetryProvider: ["read"] }),
-		).rejects.toThrow();
-	});
-
-	it("member is denied telemetryProvider.create", async () => {
-		memberToReturn = mockMemberData("member");
-		await expect(
-			checkPermission(ctx, { telemetryProvider: ["create"] }),
-		).rejects.toThrow();
-	});
 });

 describe("static roles validate free-tier resources", () => {
@@ -18,7 +18,6 @@ const FREE_TIER_RESOURCES = [
 	"gitProviders",
 	"traefikFiles",
 	"api",
-	"telemetryProvider",
 ];

 const ENTERPRISE_RESOURCES = [
@@ -41,8 +40,6 @@ const ENTERPRISE_RESOURCES = [
 	"monitoring",
 	"auditLog",
 	"vaultProvider",
-	"dnsProvider",
-	"ai",
 ];

 describe("enterpriseOnlyResources set", () => {
@@ -105,13 +105,11 @@ describe("enterprise resources for static roles", () => {
 		const perms = await resolvePermissions(ctx);

 		expect(perms.server.read).toBe(false);
-		expect(perms.server.terminal).toBe(false);
 		expect(perms.registry.read).toBe(false);
 		expect(perms.certificate.read).toBe(false);
 		expect(perms.destination.read).toBe(false);
 		expect(perms.notification.read).toBe(false);
 		expect(perms.auditLog.read).toBe(false);
-		expect(perms.telemetryProvider.read).toBe(false);
 	});
 });

@@ -1,105 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mockMemberData = (role: string) => ({
-	id: "member-1",
-	role,
-	userId: "user-1",
-	organizationId: "org-1",
-	accessedProjects: [] as string[],
-	accessedServices: [] as string[],
-	accessedEnvironments: [] as string[],
-	accessedServers: [] as string[],
-	canCreateProjects: false,
-	canDeleteProjects: false,
-	canCreateServices: false,
-	canDeleteServices: false,
-	canCreateEnvironments: false,
-	canDeleteEnvironments: false,
-	canAccessToTraefikFiles: false,
-	canAccessToDocker: false,
-	canAccessToAPI: false,
-	canAccessToSSHKeys: false,
-	canAccessToGitProviders: false,
-	user: { id: "user-1", email: "test@test.com" },
-});
-
-let memberToReturn = mockMemberData("deployer");
-let rolesToReturn: { permission: string }[] = [];
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: {
-			member: {
-				findFirst: vi.fn(() => Promise.resolve(memberToReturn)),
-				findMany: vi.fn(() => Promise.resolve([])),
-			},
-			organizationRole: {
-				findFirst: vi.fn(),
-				findMany: vi.fn(() => Promise.resolve(rolesToReturn)),
-			},
-		},
-	},
-}));
-
-vi.mock("@dokploy/server/services/proprietary/license-key", () => ({
-	hasValidLicense: vi.fn(() => Promise.resolve(true)),
-}));
-
-const { checkPermission, resolvePermissions } = await import(
-	"@dokploy/server/services/permission"
-);
-
-const ctx = {
-	user: { id: "user-1" },
-	session: { activeOrganizationId: "org-1" },
-};
-
-const withPermissions = (permissions: Record<string, string[]>) => {
-	rolesToReturn = [{ permission: JSON.stringify(permissions) }];
-};
-
-beforeEach(() => {
-	vi.clearAllMocks();
-	memberToReturn = mockMemberData("deployer");
-	rolesToReturn = [];
-});
-
-describe("server.terminal on custom roles", () => {
-	it("a role with server.read alone cannot open a terminal", async () => {
-		withPermissions({ server: ["read"] });
-
-		await expect(
-			checkPermission(ctx, { server: ["read"] }),
-		).resolves.toBeUndefined();
-		await expect(
-			checkPermission(ctx, { server: ["terminal"] }),
-		).rejects.toThrow();
-
-		const perms = await resolvePermissions(ctx);
-		expect(perms.server.read).toBe(true);
-		expect(perms.server.terminal).toBe(false);
-	});
-
-	it("a role with server.terminal can open a terminal", async () => {
-		withPermissions({ server: ["read", "terminal"] });
-
-		await expect(
-			checkPermission(ctx, { server: ["terminal"] }),
-		).resolves.toBeUndefined();
-
-		const perms = await resolvePermissions(ctx);
-		expect(perms.server.terminal).toBe(true);
-	});
-
-	it("owner and admin keep terminal access", async () => {
-		for (const role of ["owner", "admin"]) {
-			memberToReturn = mockMemberData(role);
-			await expect(
-				checkPermission(ctx, { server: ["terminal"] }),
-			).resolves.toBeUndefined();
-
-			const perms = await resolvePermissions(ctx);
-			expect(perms.server.terminal).toBe(true);
-		}
-	});
-});
@@ -1,24 +0,0 @@
-import { getSubnetCapacity } from "@dokploy/server/services/server-health";
-import { describe, expect, test } from "vitest";
-
-describe("getSubnetCapacity", () => {
-	test("returns null for missing/invalid input", () => {
-		expect(getSubnetCapacity(undefined)).toBeNull();
-		expect(getSubnetCapacity("")).toBeNull();
-		expect(getSubnetCapacity("10.0.0.0")).toBeNull();
-		expect(getSubnetCapacity("not-a-subnet")).toBeNull();
-		expect(getSubnetCapacity("10.0.0.0/33")).toBeNull();
-		expect(getSubnetCapacity("10.0.0.0/-1")).toBeNull();
-	});
-
-	test("excludes network and broadcast addresses", () => {
-		expect(getSubnetCapacity("10.0.1.0/24")).toBe(254);
-		expect(getSubnetCapacity("10.0.0.0/16")).toBe(65534);
-		expect(getSubnetCapacity("10.99.99.0/30")).toBe(2);
-	});
-
-	test("returns 0 for subnets too small to hold a host", () => {
-		expect(getSubnetCapacity("10.0.0.0/31")).toBe(0);
-		expect(getSubnetCapacity("10.0.0.0/32")).toBe(0);
-	});
-});
@@ -1,113 +0,0 @@
-import {
-	getBackupOverviewIcon,
-	getServiceOverviewIcon,
-} from "@dokploy/server/services/overview";
-import { describe, expect, test } from "vitest";
-
-describe("getServiceOverviewIcon", () => {
-	test("returns a db icon for every known DB engine type", () => {
-		for (const type of [
-			"postgres",
-			"mariadb",
-			"mysql",
-			"mongo",
-			"redis",
-			"libsql",
-		] as const) {
-			expect(getServiceOverviewIcon({ type, icon: null })).toEqual({
-				kind: "db",
-				engine: type,
-			});
-		}
-	});
-
-	test("returns a custom icon for application/compose with a service icon set", () => {
-		expect(
-			getServiceOverviewIcon({
-				type: "application",
-				icon: "data:image/png;base64,x",
-			}),
-		).toEqual({ kind: "custom", url: "data:image/png;base64,x" });
-		expect(
-			getServiceOverviewIcon({
-				type: "compose",
-				icon: "data:image/png;base64,y",
-			}),
-		).toEqual({ kind: "custom", url: "data:image/png;base64,y" });
-	});
-
-	test("falls back to a generic icon for application/compose without a service icon", () => {
-		expect(getServiceOverviewIcon({ type: "application", icon: null })).toEqual(
-			{
-				kind: "generic",
-				type: "application",
-			},
-		);
-		expect(getServiceOverviewIcon({ type: "compose", icon: null })).toEqual({
-			kind: "generic",
-			type: "compose",
-		});
-	});
-});
-
-describe("getBackupOverviewIcon", () => {
-	test("returns a db icon for a database backup with a known databaseType", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: "postgres",
-				serviceType: null,
-				serviceOwnerType: "postgres",
-			}),
-		).toEqual({ kind: "db", engine: "postgres" });
-	});
-
-	test("returns a webServer icon for a web-server database backup", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: "web-server",
-				serviceType: null,
-				serviceOwnerType: "web-server",
-			}),
-		).toEqual({ kind: "webServer" });
-	});
-
-	test("returns a db icon for a compose-type backup dumping a known DB engine", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: "mysql",
-				serviceType: null,
-				serviceOwnerType: "compose",
-			}),
-		).toEqual({ kind: "db", engine: "mysql" });
-	});
-
-	test("returns a db icon for a volume backup of a known DB engine service", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: null,
-				serviceType: "mongo",
-				serviceOwnerType: "mongo",
-			}),
-		).toEqual({ kind: "db", engine: "mongo" });
-	});
-
-	test("returns a generic application icon for a volume backup of an application", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: null,
-				serviceType: "application",
-				serviceOwnerType: "application",
-			}),
-		).toEqual({ kind: "generic", type: "application" });
-	});
-
-	test("returns a generic compose icon for a volume backup of a compose service", () => {
-		expect(
-			getBackupOverviewIcon({
-				databaseType: null,
-				serviceType: "compose",
-				serviceOwnerType: "compose",
-			}),
-		).toEqual({ kind: "generic", type: "compose" });
-	});
-});
@@ -1,79 +0,0 @@
-import type { OverviewDomain } from "@dokploy/server/services/overview";
-import { sortOverviewDomains } from "@dokploy/server/services/overview";
-import { describe, expect, test } from "vitest";
-
-const makeDomain = (overrides: Partial<OverviewDomain>): OverviewDomain => ({
-	domainId: "id",
-	host: "example.com",
-	path: "/",
-	port: 3000,
-	customEntrypoint: null,
-	https: true,
-	certificateType: "letsencrypt",
-	createdAt: "2024-01-01T00:00:00.000Z",
-	enabled: true,
-	domainType: "application",
-	serviceOwnerId: "app",
-	serviceOwnerType: "application",
-	serviceName: "App",
-	projectId: "project",
-	projectName: "Project",
-	environmentId: "environment",
-	environmentName: "Environment",
-	...overrides,
-});
-
-describe("sortOverviewDomains", () => {
-	test("sorts by createdAt asc/desc", () => {
-		const domains = [
-			makeDomain({ domainId: "old", createdAt: "2023-01-01T00:00:00.000Z" }),
-			makeDomain({ domainId: "new", createdAt: "2024-06-01T00:00:00.000Z" }),
-			makeDomain({ domainId: "mid", createdAt: "2023-12-01T00:00:00.000Z" }),
-		];
-
-		expect(
-			sortOverviewDomains(domains, "createdAt-asc").map((d) => d.domainId),
-		).toEqual(["old", "mid", "new"]);
-		expect(
-			sortOverviewDomains(domains, "createdAt-desc").map((d) => d.domainId),
-		).toEqual(["new", "mid", "old"]);
-	});
-
-	test("sorts by port asc/desc, with portless domains always last", () => {
-		const domains = [
-			makeDomain({ domainId: "none", port: null }),
-			makeDomain({ domainId: "low", port: 80 }),
-			makeDomain({ domainId: "high", port: 8080 }),
-		];
-
-		expect(
-			sortOverviewDomains(domains, "port-asc").map((d) => d.domainId),
-		).toEqual(["low", "high", "none"]);
-		expect(
-			sortOverviewDomains(domains, "port-desc").map((d) => d.domainId),
-		).toEqual(["high", "low", "none"]);
-	});
-
-	test("port sort with all domains portless is a no-op", () => {
-		const domains = [
-			makeDomain({ domainId: "a", port: null }),
-			makeDomain({ domainId: "b", port: null }),
-		];
-
-		expect(
-			sortOverviewDomains(domains, "port-desc").map((d) => d.domainId),
-		).toEqual(["a", "b"]);
-	});
-
-	test("does not mutate the input array", () => {
-		const domains = [
-			makeDomain({ domainId: "b", port: 8080 }),
-			makeDomain({ domainId: "a", port: 80 }),
-		];
-		const original = [...domains];
-
-		sortOverviewDomains(domains, "port-asc");
-
-		expect(domains).toEqual(original);
-	});
-});
@@ -1,106 +0,0 @@
-import type { OverviewService } from "@dokploy/server/services/overview";
-import { sortOverviewServices } from "@dokploy/server/services/overview";
-import { describe, expect, test } from "vitest";
-
-const makeService = (overrides: Partial<OverviewService>): OverviewService => ({
-	id: "id",
-	type: "application",
-	name: "name",
-	appName: "app-name",
-	status: "running",
-	createdAt: "2024-01-01T00:00:00.000Z",
-	serverId: null,
-	serverName: null,
-	icon: null,
-	projectId: "project",
-	projectName: "Project",
-	environmentId: "environment",
-	environmentName: "Environment",
-	lastDeployAt: null,
-	...overrides,
-});
-
-describe("sortOverviewServices", () => {
-	test("sorts by name asc/desc", () => {
-		const services = [
-			makeService({ id: "b", name: "Bravo" }),
-			makeService({ id: "a", name: "Alpha" }),
-			makeService({ id: "c", name: "Charlie" }),
-		];
-
-		expect(sortOverviewServices(services, "name-asc").map((s) => s.id)).toEqual(
-			["a", "b", "c"],
-		);
-		expect(
-			sortOverviewServices(services, "name-desc").map((s) => s.id),
-		).toEqual(["c", "b", "a"]);
-	});
-
-	test("sorts by type asc/desc", () => {
-		const services = [
-			makeService({ id: "app", type: "application" }),
-			makeService({ id: "pg", type: "postgres" }),
-			makeService({ id: "comp", type: "compose" }),
-		];
-
-		expect(sortOverviewServices(services, "type-asc").map((s) => s.id)).toEqual(
-			["app", "comp", "pg"],
-		);
-		expect(
-			sortOverviewServices(services, "type-desc").map((s) => s.id),
-		).toEqual(["pg", "comp", "app"]);
-	});
-
-	test("sorts by createdAt asc/desc", () => {
-		const services = [
-			makeService({ id: "old", createdAt: "2023-01-01T00:00:00.000Z" }),
-			makeService({ id: "new", createdAt: "2024-06-01T00:00:00.000Z" }),
-			makeService({ id: "mid", createdAt: "2023-12-01T00:00:00.000Z" }),
-		];
-
-		expect(
-			sortOverviewServices(services, "createdAt-asc").map((s) => s.id),
-		).toEqual(["old", "mid", "new"]);
-		expect(
-			sortOverviewServices(services, "createdAt-desc").map((s) => s.id),
-		).toEqual(["new", "mid", "old"]);
-	});
-
-	test("sorts by lastDeploy asc/desc, with never-deployed services always last", () => {
-		const services = [
-			makeService({ id: "never", lastDeployAt: null }),
-			makeService({ id: "old", lastDeployAt: "2023-01-01T00:00:00.000Z" }),
-			makeService({ id: "new", lastDeployAt: "2024-06-01T00:00:00.000Z" }),
-		];
-
-		expect(
-			sortOverviewServices(services, "lastDeploy-desc").map((s) => s.id),
-		).toEqual(["new", "old", "never"]);
-		expect(
-			sortOverviewServices(services, "lastDeploy-asc").map((s) => s.id),
-		).toEqual(["old", "new", "never"]);
-	});
-
-	test("lastDeploy sort with all services never deployed is a no-op", () => {
-		const services = [
-			makeService({ id: "a", lastDeployAt: null }),
-			makeService({ id: "b", lastDeployAt: null }),
-		];
-
-		expect(
-			sortOverviewServices(services, "lastDeploy-desc").map((s) => s.id),
-		).toEqual(["a", "b"]);
-	});
-
-	test("does not mutate the input array", () => {
-		const services = [
-			makeService({ id: "b", name: "Bravo" }),
-			makeService({ id: "a", name: "Alpha" }),
-		];
-		const original = [...services];
-
-		sortOverviewServices(services, "name-asc");
-
-		expect(services).toEqual(original);
-	});
-});
@@ -1,261 +0,0 @@
-import { execSync } from "node:child_process";
-import { docker } from "@dokploy/server/constants";
-import { setupMonitoring } from "@dokploy/server/setup/monitoring-setup";
-import { afterAll, beforeEach, describe, expect, it, vi } from "vitest";
-
-const REAL_TEST_TIMEOUT = 120000;
-const SERVICE_NAME = "dokploy-monitoring";
-const TEST_IMAGE = "busybox:latest";
-
-// Mock ONLY db-backed lookups and remote I/O. Dockerode stays real and talks to
-// the local daemon, so the legacy-container cleanup is exercised for real.
-vi.mock("@dokploy/server/services/server", () => ({
-	findServerById: vi.fn().mockResolvedValue({
-		serverId: "test-server",
-		serverType: "deploy",
-		sshKeyId: null, // -> getRemoteDocker returns the local docker instance
-		metricsConfig: {
-			server: {
-				type: "Remote",
-				port: 4500,
-				token: "test-token",
-				urlCallback: "http://localhost/callback",
-				cronJob: "0 0 * * *",
-				retentionDays: 2,
-				refreshRate: 60,
-				thresholds: { cpu: 0, memory: 0 },
-			},
-			containers: { refreshRate: 60, services: { include: [], exclude: [] } },
-		},
-	}),
-}));
-
-vi.mock("@dokploy/server/services/settings", () => ({
-	getDokployImageTag: vi.fn(() => "latest"),
-}));
-
-vi.mock("@dokploy/server/utils/docker/utils", () => ({
-	pullImage: vi.fn().mockResolvedValue(undefined),
-	pullRemoteImage: vi.fn().mockResolvedValue(undefined),
-}));
-
-vi.mock("@dokploy/server/utils/process/execAsync", () => ({
-	execAsync: vi.fn().mockResolvedValue({ stdout: "", stderr: "" }),
-	execAsyncRemote: vi.fn().mockResolvedValue({ stdout: "", stderr: "" }),
-}));
-
-const containerExists = async (name: string) => {
-	try {
-		await docker.getContainer(name).inspect();
-		return true;
-	} catch (error: any) {
-		if (error.statusCode === 404) return false;
-		throw error;
-	}
-};
-
-const serviceExists = async (name: string) => {
-	try {
-		await docker.getService(name).inspect();
-		return true;
-	} catch (error: any) {
-		if (error.statusCode === 404) return false;
-		throw error;
-	}
-};
-
-// Swarm keeps converging a service for a bit after it's created (scheduling
-// tasks, resolving endpoints), which bumps Version.Index on its own. Calling
-// setupMonitoring again before that settles races that internal bump, so wait
-// for two consecutive reads to agree before treating the service as stable.
-const waitForServiceConvergence = async (name: string, timeoutMs = 5000) => {
-	const deadline = Date.now() + timeoutMs;
-	let lastIndex: string | null = null;
-	while (Date.now() < deadline) {
-		const inspect = await docker.getService(name).inspect();
-		if (inspect.Version.Index === lastIndex) return;
-		lastIndex = inspect.Version.Index;
-		await new Promise((resolve) => setTimeout(resolve, 50));
-	}
-};
-
-const swarmTaskNames = async () => {
-	const list = await docker.listContainers({ all: true });
-	return list
-		.flatMap((c) => c.Names.map((n) => n.replace(/^\//, "")))
-		.filter((n) => n.startsWith(`${SERVICE_NAME}.`));
-};
-
-const cleanup = async () => {
-	try {
-		await docker.getService(SERVICE_NAME).remove();
-	} catch {}
-	try {
-		await docker.getContainer(SERVICE_NAME).remove({ force: true });
-	} catch {}
-	for (const name of await swarmTaskNames()) {
-		try {
-			await docker.getContainer(name).remove({ force: true });
-		} catch {}
-	}
-};
-
-// Recreates the pre-v0.30.0 standalone agent stuck in a crash loop.
-const createLegacyZombie = async () => {
-	const container = await docker.createContainer({
-		name: SERVICE_NAME,
-		Image: TEST_IMAGE,
-		Cmd: [
-			"sh",
-			"-c",
-			"echo 'Error starting metrics cleanup system: empty spec string'; exit 1",
-		],
-		HostConfig: { RestartPolicy: { Name: "always" }, NetworkMode: "host" },
-	});
-	await container.start();
-};
-
-const pullTestImage = async () => {
-	try {
-		await docker.getImage(TEST_IMAGE).inspect();
-		return;
-	} catch {}
-	await new Promise<void>((resolve, reject) =>
-		docker.pull(TEST_IMAGE, (err: any, stream: any) =>
-			err
-				? reject(err)
-				: docker.modem.followProgress(stream, (e: any) =>
-						e ? reject(e) : resolve(),
-					),
-		),
-	);
-};
-
-// The code under test hardcodes the production name, so this suite cannot
-// namespace its fixtures. Skip rather than wipe a real agent on a Dokploy host.
-const hasRealMonitoring = () => {
-	const query = (cmd: string) => {
-		try {
-			return execSync(cmd, { stdio: ["ignore", "pipe", "ignore"] })
-				.toString()
-				.trim();
-		} catch {
-			return "";
-		}
-	};
-
-	return (
-		query(
-			`docker service ls --filter name=${SERVICE_NAME} --format '{{.Name}}'`,
-		) !== "" ||
-		query(
-			`docker ps -a --filter name=^${SERVICE_NAME}$ --format '{{.Names}}'`,
-		) !== ""
-	);
-};
-
-const hasDocker = () => {
-	try {
-		execSync("docker info", { stdio: "ignore" });
-		return true;
-	} catch {
-		return false;
-	}
-};
-
-describe.skipIf(!hasDocker() || hasRealMonitoring() || !process.env.CI)(
-	"setupMonitoring - legacy container cleanup (real docker)",
-	() => {
-		beforeEach(async () => {
-			await pullTestImage();
-			await cleanup();
-		}, REAL_TEST_TIMEOUT);
-
-		afterAll(async () => {
-			await cleanup();
-		}, REAL_TEST_TIMEOUT);
-
-		it(
-			"removes the legacy standalone container left behind by the swarm migration",
-			async () => {
-				await createLegacyZombie();
-				expect(await containerExists(SERVICE_NAME)).toBe(true);
-
-				await setupMonitoring("test-server");
-
-				expect(await containerExists(SERVICE_NAME)).toBe(false);
-				expect(await serviceExists(SERVICE_NAME)).toBe(true);
-			},
-			REAL_TEST_TIMEOUT,
-		);
-
-		it(
-			"removes the legacy container without touching swarm tasks, which are named dokploy-monitoring.<slot>.<id>",
-			async () => {
-				const taskName = `${SERVICE_NAME}.1.qh3ldvg2h9x0test`;
-				const task = await docker.createContainer({
-					name: taskName,
-					Image: TEST_IMAGE,
-					Cmd: ["sleep", "3600"],
-				});
-				await task.start();
-				await createLegacyZombie();
-
-				await setupMonitoring("test-server");
-
-				expect(await containerExists(SERVICE_NAME)).toBe(false);
-				expect(await containerExists(taskName)).toBe(true);
-				const inspect = await docker.getContainer(taskName).inspect();
-				expect(inspect.State.Running).toBe(true);
-			},
-			REAL_TEST_TIMEOUT,
-		);
-
-		it(
-			"is idempotent when no legacy container exists",
-			async () => {
-				expect(await containerExists(SERVICE_NAME)).toBe(false);
-
-				await expect(setupMonitoring("test-server")).resolves.not.toThrow();
-				await waitForServiceConvergence(SERVICE_NAME);
-				await expect(setupMonitoring("test-server")).resolves.not.toThrow();
-
-				expect(await serviceExists(SERVICE_NAME)).toBe(true);
-			},
-			REAL_TEST_TIMEOUT,
-		);
-
-		it(
-			"deploys the service even when removing the legacy container fails",
-			async () => {
-				const failingDocker = {
-					getContainer: () => ({
-						remove: async () => {
-							const error: any = new Error("device or resource busy");
-							error.statusCode = 500;
-							throw error;
-						},
-					}),
-					getService: docker.getService.bind(docker),
-					createService: docker.createService.bind(docker),
-				};
-
-				const remoteDocker = await import(
-					"@dokploy/server/utils/servers/remote-docker"
-				);
-				const spy = vi
-					.spyOn(remoteDocker, "getRemoteDocker")
-					.mockResolvedValue(failingDocker as any);
-
-				try {
-					await expect(setupMonitoring("test-server")).resolves.not.toThrow();
-					expect(spy).toHaveBeenCalled(); // guards against the spy silently not intercepting
-					expect(await serviceExists(SERVICE_NAME)).toBe(true);
-				} finally {
-					spy.mockRestore();
-				}
-			},
-			REAL_TEST_TIMEOUT,
-		);
-	},
-);
@@ -35,7 +35,6 @@ const baseDomain: Domain = {
 	stripPath: false,
 	middlewares: null,
 	forwardAuthEnabled: false,
-	enabled: true,
 };

 describe("forwardAuthMiddlewareName", () => {
@@ -1,71 +0,0 @@
-import { reconnectServicesToTraefik } from "@dokploy/server/services/settings";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	findMany: vi.fn(),
-	execAsync: vi.fn(),
-	execAsyncRemote: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/db", () => ({
-	db: {
-		query: {
-			compose: {
-				findMany: mocks.findMany,
-			},
-		},
-	},
-}));
-
-vi.mock("@dokploy/server/utils/process/execAsync", () => ({
-	execAsync: mocks.execAsync,
-	execAsyncRemote: mocks.execAsyncRemote,
-}));
-
-describe("reconnectServicesToTraefik", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-		mocks.findMany.mockResolvedValue([]);
-	});
-
-	it("does not execute an empty local command when no isolated deployments exist", async () => {
-		await reconnectServicesToTraefik();
-
-		expect(mocks.execAsync).not.toHaveBeenCalled();
-	});
-
-	it("does not execute an empty remote command when no isolated deployments exist", async () => {
-		await reconnectServicesToTraefik("server-id");
-
-		expect(mocks.execAsyncRemote).not.toHaveBeenCalled();
-	});
-
-	it("reconnects isolated deployments to the local Traefik network", async () => {
-		mocks.findMany.mockResolvedValue([
-			{ appName: "first-compose" },
-			{ appName: "second-compose" },
-		]);
-
-		await reconnectServicesToTraefik();
-
-		expect(mocks.execAsync).toHaveBeenCalledOnce();
-		expect(mocks.execAsync).toHaveBeenCalledWith(
-			'docker network connect first-compose $(docker ps --filter "name=dokploy-traefik" -q) >/dev/null 2>&1\n' +
-				'docker network connect second-compose $(docker ps --filter "name=dokploy-traefik" -q) >/dev/null 2>&1\n',
-		);
-		expect(mocks.execAsyncRemote).not.toHaveBeenCalled();
-	});
-
-	it("reconnects isolated deployments on a remote server", async () => {
-		mocks.findMany.mockResolvedValue([{ appName: "remote-compose" }]);
-
-		await reconnectServicesToTraefik("server-id");
-
-		expect(mocks.execAsyncRemote).toHaveBeenCalledOnce();
-		expect(mocks.execAsyncRemote).toHaveBeenCalledWith(
-			"server-id",
-			'docker network connect remote-compose $(docker ps --filter "name=dokploy-traefik" -q) >/dev/null 2>&1\n',
-		);
-		expect(mocks.execAsync).not.toHaveBeenCalled();
-	});
-});
@@ -25,8 +25,6 @@ const baseSettings: WebServerSettings = {
 	letsEncryptEmail: null,
 	sshPrivateKey: null,
 	enableDockerCleanup: false,
-	telemetryProviderIds: [],
-	vectorAgentOrganizationId: null,
 	buildsConcurrency: 1,
 	logCleanupCron: null,
 	metricsConfig: {
@@ -62,12 +60,8 @@ const baseSettings: WebServerSettings = {
 		docsUrl: null,
 		errorPageTitle: null,
 		errorPageDescription: null,
-		ogImageUrl: null,
+		metaTitle: null,
 		footerText: null,
-		logoLightUrl: null,
-		loginLogoLightUrl: null,
-		faviconLightUrl: null,
-		dualModeBranding: false,
 	},
 	cleanupCacheApplications: false,
 	cleanupCacheOnCompose: false,
@@ -1,119 +0,0 @@
-import path from "node:path";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// apiReadTraefikConfig validates against the real local paths(), which outside
-// production live under the working directory.
-const traefikPath = vi.hoisted(() => `${process.cwd()}/.docker/traefik`);
-
-const mocks = vi.hoisted(() => ({
-	findServerById: vi.fn(),
-	readDirectory: vi.fn(),
-	readConfigInPath: vi.fn(),
-	writeTraefikConfigInPath: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/services/permission", () => ({
-	checkPermission: vi.fn(async () => undefined),
-}));
-
-vi.mock("@dokploy/server", () => ({
-	IS_CLOUD: false,
-	paths: () => ({ MAIN_TRAEFIK_PATH: traefikPath }),
-	...mocks,
-}));
-
-vi.mock("@dokploy/server/lib/auth", () => ({
-	validateRequest: vi.fn(),
-}));
-
-vi.mock("@/server/api/utils/audit", () => ({
-	audit: vi.fn(async () => undefined),
-}));
-
-vi.mock("@/server/queues/queueSetup", () => ({
-	cleanAllDeploymentQueue: vi.fn(),
-}));
-
-vi.mock("@/server/utils/backup", () => ({
-	removeJob: vi.fn(),
-	schedule: vi.fn(),
-}));
-
-const { settingsRouter } = await import("@/server/api/routers/settings");
-
-const caller = settingsRouter.createCaller({
-	session: { activeOrganizationId: "org-a" },
-	user: { id: "user-1", email: "user@example.com", role: "member" },
-} as Parameters<typeof settingsRouter.createCaller>[0]);
-
-const filePath = path.join(traefikPath, "dynamic/app.yml");
-
-describe("traefik file endpoints scope remote servers to the active organization", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-		mocks.findServerById.mockImplementation(async (serverId: string) => ({
-			serverId,
-			organizationId: serverId === "server-a" ? "org-a" : "org-b",
-		}));
-		mocks.readDirectory.mockResolvedValue([]);
-		mocks.readConfigInPath.mockResolvedValue("http: {}");
-	});
-
-	it("rejects listing a server from another organization", async () => {
-		await expect(
-			caller.readDirectories({ serverId: "server-b" }),
-		).rejects.toMatchObject({ code: "UNAUTHORIZED" });
-		expect(mocks.readDirectory).not.toHaveBeenCalled();
-	});
-
-	it("rejects writing to a server from another organization", async () => {
-		await expect(
-			caller.updateTraefikFile({
-				path: filePath,
-				traefikConfig: "http: {}",
-				serverId: "server-b",
-			}),
-		).rejects.toMatchObject({ code: "UNAUTHORIZED" });
-		expect(mocks.writeTraefikConfigInPath).not.toHaveBeenCalled();
-	});
-
-	it("rejects reading from a server from another organization", async () => {
-		await expect(
-			caller.readTraefikFile({ path: filePath, serverId: "server-b" }),
-		).rejects.toMatchObject({ code: "UNAUTHORIZED" });
-		expect(mocks.readConfigInPath).not.toHaveBeenCalled();
-	});
-
-	it("allows servers of the active organization", async () => {
-		await caller.readDirectories({ serverId: "server-a" });
-		await caller.readTraefikFile({ path: filePath, serverId: "server-a" });
-		await caller.updateTraefikFile({
-			path: filePath,
-			traefikConfig: "http: {}",
-			serverId: "server-a",
-		});
-
-		expect(mocks.readDirectory).toHaveBeenCalledWith(traefikPath, "server-a");
-		expect(mocks.readConfigInPath).toHaveBeenCalledWith(filePath, "server-a");
-		expect(mocks.writeTraefikConfigInPath).toHaveBeenCalledWith(
-			filePath,
-			"http: {}",
-			"server-a",
-		);
-	});
-
-	it("does not look up a server when none is given", async () => {
-		await caller.readDirectories({});
-		await caller.updateTraefikFile({
-			path: filePath,
-			traefikConfig: "http: {}",
-		});
-
-		expect(mocks.findServerById).not.toHaveBeenCalled();
-		expect(mocks.writeTraefikConfigInPath).toHaveBeenCalledWith(
-			filePath,
-			"http: {}",
-			undefined,
-		);
-	});
-});
@@ -151,7 +151,6 @@ const baseDomain: Domain = {
 	stripPath: false,
 	middlewares: null,
 	forwardAuthEnabled: false,
-	enabled: true,
 };

 const baseRedirect: Redirect = {
@@ -1,121 +0,0 @@
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { writeAppTraefikConfig } from "@dokploy/server/utils/traefik/application";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-
-const mocks = vi.hoisted(() => ({
-	execAsyncRemote: vi.fn(),
-	writeFileRemote: vi.fn(),
-}));
-
-vi.mock("@dokploy/server/utils/process/execAsync", async (importOriginal) => {
-	const actual =
-		await importOriginal<
-			typeof import("@dokploy/server/utils/process/execAsync")
-		>();
-	return {
-		...actual,
-		execAsyncRemote: mocks.execAsyncRemote,
-		writeFileRemote: mocks.writeFileRemote,
-	};
-});
-
-describe("writeAppTraefikConfig", () => {
-	let cwd: string;
-	let dynamicPath: string;
-
-	beforeEach(() => {
-		cwd = fs.mkdtempSync(path.join(os.tmpdir(), "dokploy-traefik-"));
-		dynamicPath = path.join(cwd, ".docker", "traefik", "dynamic");
-		fs.mkdirSync(dynamicPath, { recursive: true });
-		vi.spyOn(process, "cwd").mockReturnValue(cwd);
-		vi.clearAllMocks();
-	});
-
-	afterEach(() => {
-		vi.restoreAllMocks();
-		fs.rmSync(cwd, { recursive: true, force: true });
-	});
-
-	// Regression test for #5189: Traefik's file provider rejects a standalone
-	// `routers: {}` / `services: {}` map and aborts its watcher for every
-	// dynamic config once it hits one, so an app with no domains must never
-	// get an on-disk config file at all.
-	it("removes the file instead of writing empty routers/services", async () => {
-		const appName = "no-domain-app";
-		const configPath = path.join(dynamicPath, `${appName}.yml`);
-		fs.writeFileSync(configPath, "stale content", "utf8");
-
-		await writeAppTraefikConfig(
-			{ http: { routers: {}, services: {} } },
-			appName,
-		);
-
-		expect(fs.existsSync(configPath)).toBe(false);
-	});
-
-	it("writes the file when routers/services are present", async () => {
-		const appName = "with-domain-app";
-		const configPath = path.join(dynamicPath, `${appName}.yml`);
-
-		await writeAppTraefikConfig(
-			{
-				http: {
-					routers: {
-						[`${appName}-router-1`]: {
-							rule: "Host(`x`)",
-							service: `${appName}-service`,
-						},
-					},
-					services: {},
-				},
-			},
-			appName,
-		);
-
-		expect(fs.existsSync(configPath)).toBe(true);
-	});
-
-	it("removes the remote file instead of writing empty routers/services", async () => {
-		mocks.execAsyncRemote.mockResolvedValue({ stdout: "", stderr: "" });
-
-		await writeAppTraefikConfig(
-			{ http: { routers: {}, services: {} } },
-			"no-domain-app",
-			"server-id",
-		);
-
-		expect(mocks.execAsyncRemote).toHaveBeenCalledOnce();
-		const [, command] = mocks.execAsyncRemote.mock.calls[0] ?? [];
-		expect(command).toMatch(/^rm -f /);
-		expect(command).toContain("no-domain-app.yml");
-	});
-
-	it("writes the remote file when routers/services are present", async () => {
-		mocks.writeFileRemote.mockResolvedValue(undefined);
-
-		await writeAppTraefikConfig(
-			{
-				http: {
-					routers: {
-						"with-domain-app-router-1": {
-							rule: "Host(`x`)",
-							service: "with-domain-app-service",
-						},
-					},
-					services: {},
-				},
-			},
-			"with-domain-app",
-			"server-id",
-		);
-
-		expect(mocks.writeFileRemote).toHaveBeenCalledOnce();
-		const [serverId, remotePath, content] =
-			mocks.writeFileRemote.mock.calls[0] ?? [];
-		expect(serverId).toBe("server-id");
-		expect(remotePath).toContain("with-domain-app.yml");
-		expect(content).toContain("with-domain-app-router-1");
-	});
-});
@@ -1,182 +0,0 @@
-import {
-	checkDeletionCode,
-	generateDeletionCode,
-	serializeDeletionCode,
-} from "@dokploy/server/services/account-deletion";
-import { deleteHubSpotContactByEmail } from "@dokploy/server/utils/tracking/hubspot";
-import Stripe from "stripe";
-import { afterEach, describe, expect, test, vi } from "vitest";
-import { cancelStripeSubscriptions } from "@/server/utils/billing";
-
-const makeStripe = (
-	subscriptions: Array<{ id: string; status: string }>,
-	listError?: Error,
-) => {
-	const stripe = {
-		subscriptions: {
-			list: vi.fn(() =>
-				listError
-					? Promise.reject(listError)
-					: Promise.resolve({ data: subscriptions }),
-			),
-			cancel: vi.fn(() => Promise.resolve({})),
-		},
-	};
-	return stripe as unknown as Stripe & typeof stripe;
-};
-
-describe("cancelStripeSubscriptions", () => {
-	test("cancels every non-terminal subscription without invoicing", async () => {
-		const stripe = makeStripe([
-			{ id: "sub_active", status: "active" },
-			{ id: "sub_trial", status: "trialing" },
-			{ id: "sub_past_due", status: "past_due" },
-			{ id: "sub_canceled", status: "canceled" },
-			{ id: "sub_expired", status: "incomplete_expired" },
-		]);
-
-		const result = await cancelStripeSubscriptions("cus_1", stripe);
-
-		expect(stripe.subscriptions.list).toHaveBeenCalledWith({
-			customer: "cus_1",
-			status: "all",
-			limit: 100,
-		});
-		expect(stripe.subscriptions.cancel).toHaveBeenCalledTimes(3);
-		expect(stripe.subscriptions.cancel).toHaveBeenCalledWith("sub_active", {
-			invoice_now: false,
-			prorate: false,
-		});
-		expect(result).toEqual({
-			cancelledSubscriptions: ["sub_active", "sub_trial", "sub_past_due"],
-		});
-	});
-
-	test("treats a missing customer as having nothing to cancel", async () => {
-		const missing = new Stripe.errors.StripeInvalidRequestError({
-			type: "invalid_request_error",
-			code: "resource_missing",
-			message: "No such customer",
-		});
-		const stripe = makeStripe([], missing);
-
-		const result = await cancelStripeSubscriptions("cus_missing", stripe);
-
-		expect(stripe.subscriptions.cancel).not.toHaveBeenCalled();
-		expect(result).toEqual({ cancelledSubscriptions: [] });
-	});
-
-	test("propagates unexpected Stripe errors", async () => {
-		const failure = new Stripe.errors.StripeAPIError({
-			type: "api_error",
-			message: "boom",
-		});
-		const stripe = makeStripe([], failure);
-
-		await expect(cancelStripeSubscriptions("cus_1", stripe)).rejects.toBe(
-			failure,
-		);
-	});
-});
-
-describe("deleteHubSpotContactByEmail", () => {
-	afterEach(() => {
-		vi.unstubAllGlobals();
-	});
-
-	test("is skipped when no access token is configured", async () => {
-		const fetchMock = vi.fn();
-		vi.stubGlobal("fetch", fetchMock);
-
-		expect(await deleteHubSpotContactByEmail("a@b.com", undefined)).toBe(
-			"skipped",
-		);
-		expect(fetchMock).not.toHaveBeenCalled();
-	});
-
-	test("calls the GDPR delete endpoint with the email as id", async () => {
-		const fetchMock = vi.fn(() =>
-			Promise.resolve(new Response(null, { status: 204 })),
-		);
-		vi.stubGlobal("fetch", fetchMock);
-
-		expect(await deleteHubSpotContactByEmail("a@b.com", "token")).toBe(
-			"deleted",
-		);
-		const [url, init] = fetchMock.mock.calls[0] as unknown as [
-			string,
-			RequestInit,
-		];
-		expect(url).toBe(
-			"https://api.hubapi.com/crm/v3/objects/contacts/gdpr-delete",
-		);
-		expect(init.method).toBe("POST");
-		expect((init.headers as Record<string, string>).Authorization).toBe(
-			"Bearer token",
-		);
-		expect(JSON.parse(init.body as string)).toEqual({
-			idProperty: "email",
-			objectId: "a@b.com",
-		});
-	});
-
-	test("maps 404 to not_found and other errors to failed", async () => {
-		vi.stubGlobal(
-			"fetch",
-			vi.fn(() => Promise.resolve(new Response(null, { status: 404 }))),
-		);
-		expect(await deleteHubSpotContactByEmail("a@b.com", "token")).toBe(
-			"not_found",
-		);
-
-		vi.stubGlobal(
-			"fetch",
-			vi.fn(() => Promise.resolve(new Response("nope", { status: 500 }))),
-		);
-		expect(await deleteHubSpotContactByEmail("a@b.com", "token")).toBe(
-			"failed",
-		);
-	});
-});
-
-describe("account deletion codes", () => {
-	test("generates six-digit numeric codes", () => {
-		for (let i = 0; i < 50; i++) {
-			expect(generateDeletionCode()).toMatch(/^\d{6}$/);
-		}
-	});
-
-	test("accepts the right code, ignoring surrounding whitespace", () => {
-		const value = serializeDeletionCode("482913");
-
-		expect(checkDeletionCode(value, "482913")).toEqual({
-			valid: true,
-			attempts: 0,
-		});
-		expect(checkDeletionCode(value, " 482913 ").valid).toBe(true);
-	});
-
-	test("counts failed attempts without revealing the hash", () => {
-		const value = serializeDeletionCode("482913");
-
-		const first = checkDeletionCode(value, "000000");
-		expect(first.valid).toBe(false);
-		if (first.valid) throw new Error("unreachable");
-		expect(first.attempts).toBe(1);
-		expect(JSON.parse(first.nextValue)).toEqual({
-			...JSON.parse(value),
-			attempts: 1,
-		});
-
-		const second = checkDeletionCode(first.nextValue, "999999");
-		expect(second.valid).toBe(false);
-		if (second.valid) throw new Error("unreachable");
-		expect(second.attempts).toBe(2);
-
-		expect(checkDeletionCode(second.nextValue, "482913")).toEqual({
-			valid: true,
-			attempts: 2,
-		});
-		expect(value).not.toContain("482913");
-	});
-});
@@ -1,60 +0,0 @@
-import { promises as fs } from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { describe, expect, it, vi } from "vitest";
-
-vi.mock("@dokploy/server/services/server", () => ({
-	findServerById: vi.fn(),
-}));
-
-import { pipeBetweenServers } from "@dokploy/server/utils/process/remoteStream";
-
-describe("pipeBetweenServers", () => {
-	it("delivers a short source stream that ends before the target is ready", async () => {
-		const bytes = await pipeBetweenServers({
-			source: { serverId: null, command: "printf 'hello world'" },
-			target: { serverId: null, command: "sleep 0.3; cat > /dev/null" },
-		});
-		expect(bytes).toBe(11);
-	}, 30_000);
-
-	it("pipes data larger than the pipe buffer unchanged", async () => {
-		const dir = await fs.mkdtemp(path.join(os.tmpdir(), "pipe-"));
-		const source = path.join(dir, "src.bin");
-		const target = path.join(dir, "dst.bin");
-		const size = 1024 * 1024;
-		const progress: number[] = [];
-
-		const bytes = await pipeBetweenServers({
-			source: {
-				serverId: null,
-				command: `head -c ${size} /dev/urandom | tee '${source}'`,
-			},
-			target: { serverId: null, command: `cat > '${target}'` },
-			onProgress: (transferred) => progress.push(transferred),
-		});
-
-		expect(bytes).toBe(size);
-		expect(progress.at(-1)).toBe(size);
-		expect(await fs.readFile(target)).toEqual(await fs.readFile(source));
-		await fs.rm(dir, { recursive: true, force: true });
-	}, 30_000);
-
-	it("reports a target failure with its stderr", async () => {
-		await expect(
-			pipeBetweenServers({
-				source: { serverId: null, command: "printf x" },
-				target: { serverId: null, command: "echo boom >&2; exit 3" },
-			}),
-		).rejects.toThrow("target exited with code 3: boom");
-	}, 30_000);
-
-	it("reports a source failure", async () => {
-		await expect(
-			pipeBetweenServers({
-				source: { serverId: null, command: "exit 2" },
-				target: { serverId: null, command: "cat > /dev/null" },
-			}),
-		).rejects.toThrow("source exited with code 2");
-	}, 30_000);
-});
@@ -95,35 +95,10 @@ describe("canAccessTerminalOverWss", () => {
 	});

 	it("gates a remote server terminal on server access", async () => {
-		mockHasPermission.mockResolvedValue(true);
 		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
 		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(true);
 		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-2")).toBe(false);
-		// the remote path must never fall through to the owner/admin local branch
+		// role lookup must not be needed for the remote path
 		expect(mockFindMember).not.toHaveBeenCalled();
 	});
-
-	it("denies a remote server terminal without the server.terminal permission", async () => {
-		// Reaching a server (to deploy on it) must not imply a root shell on it.
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		mockHasPermission.mockResolvedValue(false);
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(false);
-		expect(mockHasPermission).toHaveBeenCalledWith(
-			{ user: { id: USER.id }, session: { activeOrganizationId: "org-1" } },
-			{ server: ["terminal"] },
-		);
-	});
-
-	it("allows a remote server terminal with the server.terminal permission", async () => {
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		mockHasPermission.mockResolvedValue(true);
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(true);
-	});
-
-	it("does not check permissions for a server the caller cannot access", async () => {
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		mockHasPermission.mockResolvedValue(true);
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-2")).toBe(false);
-		expect(mockHasPermission).not.toHaveBeenCalled();
-	});
 });
@@ -1,169 +0,0 @@
-import { EventEmitter } from "node:events";
-import http from "node:http";
-import type { AddressInfo } from "node:net";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import WebSocket from "ws";
-
-class FakeChild extends EventEmitter {
-	stdout = new EventEmitter();
-	stderr = new EventEmitter();
-	killed = false;
-	exitCode: number | null = null;
-	signalCode: NodeJS.Signals | null = null;
-	signals: string[] = [];
-	// Mirrors ChildProcess: `killed` flips as soon as a signal is delivered,
-	// even if the process ignores it and keeps running.
-	ignoreSigterm = false;
-
-	kill(signal: NodeJS.Signals = "SIGTERM") {
-		this.signals.push(signal);
-		this.killed = true;
-		if (signal === "SIGTERM" && this.ignoreSigterm) return true;
-		this.signalCode = signal;
-		this.emit("close", null, signal);
-		return true;
-	}
-}
-
-const children = vi.hoisted(() => [] as FakeChild[]);
-const nextChild = vi.hoisted(() => ({ ignoreSigterm: false }));
-vi.mock("node:child_process", async (importOriginal) => ({
-	...(await importOriginal<typeof import("node:child_process")>()),
-	spawn: vi.fn(() => {
-		const child = new FakeChild();
-		child.ignoreSigterm = nextChild.ignoreSigterm;
-		children.push(child);
-		return child;
-	}),
-}));
-
-const sshClients = vi.hoisted(
-	() => [] as { connect: ReturnType<typeof vi.fn> }[],
-);
-vi.mock("ssh2", () => ({
-	Client: vi.fn(function (this: Record<string, unknown>) {
-		this.on = vi.fn(() => this);
-		this.connect = vi.fn(() => this);
-		this.end = vi.fn();
-		sshClients.push(this as never);
-	}),
-}));
-
-const mockValidateRequest = vi.hoisted(() => vi.fn());
-const mockFindServerById = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server", () => ({
-	IS_CLOUD: false,
-	validateRequest: mockValidateRequest,
-	findServerById: mockFindServerById,
-}));
-vi.mock("@dokploy/server/wss/utils", () => ({
-	readValidDirectory: () => true,
-}));
-
-import { setupDeploymentLogsWebSocketServer } from "@/server/wss/listen-deployment";
-
-const AUTH = {
-	user: { id: "user-1" },
-	session: { activeOrganizationId: "org-1" },
-};
-
-const deferred = <T>() => {
-	let resolve!: (value: T) => void;
-	const promise = new Promise<T>((r) => {
-		resolve = r;
-	});
-	return { promise, resolve };
-};
-
-const flush = () => new Promise((r) => setTimeout(r, 50));
-
-let server: http.Server;
-let url: string;
-
-beforeEach(async () => {
-	children.length = 0;
-	sshClients.length = 0;
-	nextChild.ignoreSigterm = false;
-	vi.clearAllMocks();
-	server = http.createServer();
-	setupDeploymentLogsWebSocketServer(server);
-	await new Promise<void>((r) => server.listen(0, "127.0.0.1", r));
-	const { port } = server.address() as AddressInfo;
-	url = `ws://127.0.0.1:${port}/listen-deployment?logPath=/etc/dokploy/logs/app/deploy.log`;
-});
-
-afterEach(async () => {
-	vi.useRealTimers();
-	await new Promise((r) => server.close(r));
-});
-
-const connect = async (query = "") => {
-	const ws = new WebSocket(`${url}${query}`);
-	await new Promise((r) => ws.once("open", r));
-	return ws;
-};
-
-const closeClient = async (ws: WebSocket) => {
-	ws.close();
-	await new Promise((r) => ws.once("close", r));
-	await flush();
-};
-
-describe("deployment logs websocket (#5518)", () => {
-	it("kills tail when the client disconnects", async () => {
-		mockValidateRequest.mockResolvedValue(AUTH);
-		const ws = await connect();
-		await flush();
-		expect(children).toHaveLength(1);
-
-		await closeClient(ws);
-		expect(children[0]!.signals).toContain("SIGTERM");
-	});
-
-	it("does not spawn tail when the client disconnects during auth", async () => {
-		const auth = deferred<typeof AUTH>();
-		mockValidateRequest.mockReturnValue(auth.promise);
-		const ws = await connect();
-
-		await closeClient(ws);
-		auth.resolve(AUTH);
-		await flush();
-
-		const leaked = children.filter(
-			(c) => c.exitCode === null && c.signalCode === null,
-		);
-		expect(leaked).toHaveLength(0);
-	});
-
-	it("does not open an SSH session when the client disconnects while loading the server", async () => {
-		mockValidateRequest.mockResolvedValue(AUTH);
-		const serverLookup = deferred<unknown>();
-		mockFindServerById.mockReturnValue(serverLookup.promise);
-		const ws = await connect("&serverId=srv-1");
-
-		await closeClient(ws);
-		serverLookup.resolve({
-			organizationId: "org-1",
-			sshKeyId: "key-1",
-			sshKey: { privateKey: "key" },
-			ipAddress: "10.0.0.1",
-			port: 22,
-			username: "root",
-		});
-		await flush();
-
-		const connected = sshClients.filter((c) => c.connect.mock.calls.length > 0);
-		expect(connected).toHaveLength(0);
-	});
-
-	it("force-kills tail with SIGKILL when SIGTERM does not stop it", async () => {
-		nextChild.ignoreSigterm = true;
-		mockValidateRequest.mockResolvedValue(AUTH);
-		const ws = await connect();
-		await flush();
-
-		await closeClient(ws);
-		await new Promise((r) => setTimeout(r, 1100));
-		expect(children[0]!.signals).toEqual(["SIGTERM", "SIGKILL"]);
-	});
-});
@@ -94,32 +94,4 @@ describe("readValidDirectory (path traversal)", () => {
 			),
 		).toBe(true);
 	});
-
-	it("returns true for SvelteKit routes with + prefix and @ symbols", () => {
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/src/routes/+page.svelte`,
-			),
-		).toBe(true);
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/src/routes/+layout.svelte`,
-			),
-		).toBe(true);
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/src/routes/+server.ts`,
-			),
-		).toBe(true);
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/src/routes/+error.svelte`,
-			),
-		).toBe(true);
-		expect(
-			readValidDirectory(
-				`${BASE}/applications/myapp/code/node_modules/@types/node/index.d.ts`,
-			),
-		).toBe(true);
-	});
 });
@@ -187,7 +187,7 @@ export const ShowClusterSettings = ({ id, type }: Props) => {
 												To use a cluster feature, you need to configure at least
 												a registry first. Please, go to{" "}
 												<Link
-													href="/dashboard/docker?tab=swarm&subtab=nodes"
+													href="/dashboard/settings/cluster"
 													className="text-foreground"
 												>
 													Settings
@@ -8,3 +8,4 @@ export { RestartPolicyForm } from "./restart-policy-form";
 export { RollbackConfigForm } from "./rollback-config-form";
 export { StopGracePeriodForm } from "./stop-grace-period-form";
 export { UpdateConfigForm } from "./update-config-form";
+export { filterEmptyValues, hasValues } from "./utils";
@@ -0,0 +1,31 @@
+/**
+ * Filters out undefined, null, and empty string values from form data
+ * Only returns fields that have actual values
+ */
+export const filterEmptyValues = (
+	formData: Record<string, any>,
+): Record<string, any> => {
+	return Object.entries(formData).reduce(
+		(acc, [key, value]) => {
+			// Keep arrays even if empty (they might be intentionally cleared)
+			if (Array.isArray(value)) {
+				if (value.length > 0) {
+					acc[key] = value;
+				}
+			}
+			// For other values, filter out undefined, null, and empty strings
+			else if (value !== undefined && value !== null && value !== "") {
+				acc[key] = value;
+			}
+			return acc;
+		},
+		{} as Record<string, any>,
+	);
+};
+
+/**
+ * Checks if filtered data has any values to save
+ */
+export const hasValues = (data: Record<string, any>): boolean => {
+	return Object.keys(data).length > 0;
+};
@@ -234,7 +234,7 @@ export const HandleRedirect = ({
 									<FormItem>
 										<FormLabel>Replacement</FormLabel>
 										<FormControl>
-											<Input placeholder="http://mydomain/$1" {...field} />
+											<Input placeholder="http://mydomain/$${1}" {...field} />
 										</FormControl>

 										<FormMessage />
@@ -31,45 +31,6 @@ import { api } from "@/utils/api";

 // Railpack versions from https://github.com/railwayapp/railpack/releases
 export const RAILPACK_VERSIONS = [
-	"0.39.0",
-	"0.38.0",
-	"0.37.1",
-	"0.37.0",
-	"0.36.4",
-	"0.36.3",
-	"0.36.2",
-	"0.36.1",
-	"0.36.0",
-	"0.35.0",
-	"0.34.0",
-	"0.33.0",
-	"0.32.0",
-	"0.31.2",
-	"0.31.1",
-	"0.31.0",
-	"0.30.1",
-	"0.30.0",
-	"0.29.0",
-	"0.28.0",
-	"0.27.2",
-	"0.27.1",
-	"0.27.0",
-	"0.26.1",
-	"0.26.0",
-	"0.25.0",
-	"0.24.0",
-	"0.23.0",
-	"0.22.2",
-	"0.22.1",
-	"0.22.0",
-	"0.21.0",
-	"0.20.0",
-	"0.19.0",
-	"0.18.0",
-	"0.17.2",
-	"0.17.1",
-	"0.17.0",
-	"0.16.0",
 	"0.15.4",
 	"0.15.3",
 	"0.15.2",
@@ -84,22 +45,12 @@ export const RAILPACK_VERSIONS = [
 	"0.9.1",
 	"0.9.0",
 	"0.8.0",
-	"0.7.2",
-	"0.7.1",
 	"0.7.0",
-	"0.6.1",
 	"0.6.0",
-	"0.5.1",
 	"0.5.0",
 	"0.4.0",
 	"0.3.0",
-	"0.2.3",
 	"0.2.2",
-	"0.2.1",
-	"0.2.0",
-	"0.1.2",
-	"0.1.1",
-	"0.1.0",
 ] as const;

 export enum BuildType {
@@ -148,7 +148,7 @@ export const ShowDeployment = ({
 					<DialogDescription className="flex items-center gap-2">
 						<span className="flex items-center gap-2">
 							See all the details of this deployment |{" "}
-							<Badge variant="blank" className="text-xs tabular-nums">
+							<Badge variant="blank" className="text-xs">
 								{filteredLogs.length} lines
 							</Badge>
 						</span>
@@ -342,7 +342,7 @@ export const ShowDeployments = ({
 											)}
 											{/* Hash (from description) - shown in compact form */}
 											{deployment.description?.trim() && (
-												<span className="wrap-anywhere text-xs text-muted-foreground font-mono">
+												<span className="text-xs text-muted-foreground font-mono">
 													{deployment.description}
 												</span>
 											)}
@@ -14,7 +14,6 @@ import Link from "next/link";
 import { DialogAction } from "@/components/shared/dialog-action";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
-import { Switch } from "@/components/ui/switch";
 import {
 	Tooltip,
 	TooltipContent,
@@ -36,9 +35,7 @@ interface ColumnsProps {
 	validationStates: ValidationStates;
 	handleValidateDomain: (host: string) => Promise<void>;
 	handleDeleteDomain: (domainId: string) => Promise<void>;
-	handleToggleEnable: (domainId: string) => Promise<void>;
 	isDeleting: boolean;
-	isToggling: boolean;
 	serverIp?: string;
 	canCreateDomain: boolean;
 	canDeleteDomain: boolean;
@@ -50,9 +47,7 @@ export const createColumns = ({
 	validationStates,
 	handleValidateDomain,
 	handleDeleteDomain,
-	handleToggleEnable,
 	isDeleting,
-	isToggling,
 	serverIp,
 	canCreateDomain,
 	canDeleteDomain,
@@ -254,42 +249,6 @@ export const createColumns = ({
 			);
 		},
 	},
-	{
-		id: "status",
-		header: "Status",
-		cell: ({ row }) => {
-			const domain = row.original;
-			if (!canCreateDomain) {
-				return (
-					<Badge variant={domain.enabled ? "outline" : "secondary"}>
-						{domain.enabled ? "Enabled" : "Disabled"}
-					</Badge>
-				);
-			}
-			return (
-				<TooltipProvider>
-					<Tooltip>
-						<TooltipTrigger asChild>
-							<div className="flex items-center">
-								<Switch
-									checked={domain.enabled}
-									onCheckedChange={() => handleToggleEnable(domain.domainId)}
-									disabled={isToggling}
-								/>
-							</div>
-						</TooltipTrigger>
-						<TooltipContent>
-							<p>
-								{domain.enabled
-									? "Domain is active. Toggle to disable routing without deleting it."
-									: "Domain is disabled and not routed. Toggle to enable it again."}
-							</p>
-						</TooltipContent>
-					</Tooltip>
-				</TooltipProvider>
-			);
-		},
-	},
 	{
 		id: "actions",
 		header: "Actions",
@@ -46,7 +46,6 @@ import {
 	TooltipTrigger,
 } from "@/components/ui/tooltip";
 import { api } from "@/utils/api";
-import { COMPOSE_REDEPLOY_TOAST, ComposeRedeployAlert } from "./redeploy-hint";

 export type CacheType = "fetch" | "cache";

@@ -156,7 +155,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 			domainId,
 		},
 		{
-			enabled: isOpen && !!domainId,
+			enabled: !!domainId,
 		},
 	);

@@ -167,7 +166,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 						applicationId: id,
 					},
 					{
-						enabled: isOpen && !!id,
+						enabled: !!id,
 					},
 				)
 			: api.compose.one.useQuery(
@@ -175,7 +174,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 						composeId: id,
 					},
 					{
-						enabled: isOpen && !!id,
+						enabled: !!id,
 					},
 				);

@@ -187,14 +186,9 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 		api.domain.generateDomain.useMutation();

 	const { data: canGenerateTraefikMeDomains } =
-		api.domain.canGenerateTraefikMeDomains.useQuery(
-			{
-				serverId: application?.serverId || "",
-			},
-			{
-				enabled: isOpen,
-			},
-		);
+		api.domain.canGenerateTraefikMeDomains.useQuery({
+			serverId: application?.serverId || "",
+		});

 	const {
 		data: services,
@@ -209,7 +203,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 		{
 			retry: false,
 			refetchOnWindowFocus: false,
-			enabled: isOpen && type === "compose" && !!id,
+			enabled: type === "compose" && !!id,
 		},
 	);

@@ -306,12 +300,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 			customEntrypoint: data.useCustomEntrypoint ? data.customEntrypoint : null,
 		})
 			.then(async () => {
-				toast.success(
-					dictionary.success,
-					data.domainType === "compose"
-						? { description: COMPOSE_REDEPLOY_TOAST }
-						: undefined,
-				);
+				toast.success(dictionary.success);

 				if (data.domainType === "application") {
 					await utils.domain.byApplicationId.invalidate({
@@ -348,7 +337,12 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 				</DialogHeader>
 				{isError && <AlertBlock type="error">{error?.message}</AlertBlock>}

-				{type === "compose" && <ComposeRedeployAlert className="mb-4" />}
+				{type === "compose" && (
+					<AlertBlock type="info" className="mb-4">
+						Whenever you make changes to domains, remember to redeploy your
+						compose to apply the changes.
+					</AlertBlock>
+				)}

 				<Form {...form}>
 					<form
@@ -1,19 +0,0 @@
-import { AlertBlock } from "@/components/shared/alert-block";
-
-/**
- * Domains attached to a compose service are rendered as docker labels and only
- * take effect on the next deployment. These strings keep the "redeploy required"
- * wording consistent across the add/edit dialog, the domains list and the
- * toasts shown after create/update/delete/toggle operations.
- */
-export const COMPOSE_REDEPLOY_HINT =
-	"Whenever you make changes to domains, remember to redeploy your compose to apply the changes.";
-
-export const COMPOSE_REDEPLOY_TOAST =
-	"Redeploy the compose to apply the changes.";
-
-export const ComposeRedeployAlert = ({ className }: { className?: string }) => (
-	<AlertBlock type="info" className={className}>
-		{COMPOSE_REDEPLOY_HINT}
-	</AlertBlock>
-);
@@ -44,7 +44,6 @@ import {
 	DropdownMenuTrigger,
 } from "@/components/ui/dropdown-menu";
 import { Input } from "@/components/ui/input";
-import { Switch } from "@/components/ui/switch";
 import {
 	Table,
 	TableBody,
@@ -59,13 +58,11 @@ import {
 	TooltipProvider,
 	TooltipTrigger,
 } from "@/components/ui/tooltip";
-import { cn } from "@/lib/utils";
 import { api } from "@/utils/api";
 import { createColumns } from "./columns";
 import { DnsHelperModal } from "./dns-helper-modal";
 import { AddDomain } from "./handle-domain";
 import { HandleForwardAuth } from "./handle-forward-auth";
-import { COMPOSE_REDEPLOY_TOAST, ComposeRedeployAlert } from "./redeploy-hint";

 export type ValidationState = {
 	isLoading: boolean;
@@ -149,34 +146,12 @@ export const ShowDomains = ({ id, type }: Props) => {
 		api.domain.validateDomain.useMutation();
 	const { mutateAsync: deleteDomain, isPending: isRemoving } =
 		api.domain.delete.useMutation();
-	const { mutateAsync: toggleEnable, isPending: isToggling } =
-		api.domain.toggleEnable.useMutation();
-
-	const handleToggleEnable = async (domainId: string) => {
-		try {
-			const result = await toggleEnable({ domainId });
-			refetch();
-			toast.success(
-				result.enabled ? "Domain enabled" : "Domain disabled",
-				result.requiresRedeploy
-					? { description: COMPOSE_REDEPLOY_TOAST }
-					: undefined,
-			);
-		} catch {
-			toast.error("Error updating the domain");
-		}
-	};

 	const handleDeleteDomain = async (domainId: string) => {
 		try {
 			await deleteDomain({ domainId });
 			refetch();
-			toast.success(
-				"Domain deleted successfully",
-				type === "compose"
-					? { description: COMPOSE_REDEPLOY_TOAST }
-					: undefined,
-			);
+			toast.success("Domain deleted successfully");
 		} catch {
 			toast.error("Error deleting domain");
 		}
@@ -191,7 +166,8 @@ export const ShowDomains = ({ id, type }: Props) => {
 		try {
 			const result = await validateDomain({
 				domain: host,
-				serverId: application?.serverId ?? undefined,
+				serverIp:
+					application?.server?.ipAddress?.toString() || ip?.toString() || "",
 			});

 			setValidationStates((prev) => ({
@@ -224,9 +200,7 @@ export const ShowDomains = ({ id, type }: Props) => {
 		validationStates,
 		handleValidateDomain,
 		handleDeleteDomain,
-		handleToggleEnable,
 		isDeleting: isRemoving,
-		isToggling,
 		serverIp: application?.server?.ipAddress?.toString() || ip?.toString(),
 		canCreateDomain,
 		canDeleteDomain,
@@ -291,11 +265,6 @@ export const ShowDomains = ({ id, type }: Props) => {
 						)}
 					</div>
 				</CardHeader>
-				{type === "compose" && data && data.length > 0 && (
-					<div className="px-6 pb-4">
-						<ComposeRedeployAlert />
-					</div>
-				)}
 				<CardContent className="flex w-full flex-row gap-4">
 					{isLoadingDomains ? (
 						<div className="flex w-full flex-row gap-4 min-h-[40vh] justify-center items-center">
@@ -444,10 +413,7 @@ export const ShowDomains = ({ id, type }: Props) => {
 								return (
 									<Card
 										key={item.domainId}
-										className={cn(
-											"relative overflow-hidden w-full border transition-all hover:shadow-md bg-transparent h-fit",
-											!item.enabled && "opacity-60",
-										)}
+										className="relative overflow-hidden w-full border transition-all hover:shadow-md bg-transparent h-fit"
 									>
 										<CardContent className="p-6">
 											<div className="flex flex-col gap-4">
@@ -500,7 +466,18 @@ export const ShowDomains = ({ id, type }: Props) => {
 																description="Are you sure you want to delete this domain?"
 																type="destructive"
 																onClick={async () => {
-																	await handleDeleteDomain(item.domainId);
+																	await deleteDomain({
+																		domainId: item.domainId,
+																	})
+																		.then((_data) => {
+																			refetch();
+																			toast.success(
+																				"Domain deleted successfully",
+																			);
+																		})
+																		.catch(() => {
+																			toast.error("Error deleting domain");
+																		});
 																}}
 															>
 																<Button
@@ -515,41 +492,15 @@ export const ShowDomains = ({ id, type }: Props) => {
 														)}
 													</div>
 												</div>
-												<div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-													<div className="w-full break-all">
-														<Link
-															className="flex items-center gap-2 text-base font-medium hover:underline"
-															target="_blank"
-															href={`${item.https ? "https" : "http"}://${item.host}${item.path}`}
-														>
-															{item.host}
-															<ExternalLink className="size-4 min-w-4" />
-														</Link>
-													</div>
-													{canCreateDomain && (
-														<TooltipProvider>
-															<Tooltip>
-																<TooltipTrigger asChild>
-																	<div className="flex items-center shrink-0">
-																		<Switch
-																			checked={item.enabled}
-																			onCheckedChange={() =>
-																				handleToggleEnable(item.domainId)
-																			}
-																			disabled={isToggling}
-																		/>
-																	</div>
-																</TooltipTrigger>
-																<TooltipContent>
-																	<p>
-																		{item.enabled
-																			? "Domain is active. Toggle to disable routing without deleting it."
-																			: "Domain is disabled and not routed. Toggle to enable it again."}
-																	</p>
-																</TooltipContent>
-															</Tooltip>
-														</TooltipProvider>
-													)}
+												<div className="w-full break-all">
+													<Link
+														className="flex items-center gap-2 text-base font-medium hover:underline"
+														target="_blank"
+														href={`${item.https ? "https" : "http"}://${item.host}${item.path}`}
+													>
+														{item.host}
+														<ExternalLink className="size-4 min-w-4" />
+													</Link>
 												</div>

 												{/* Domain Details */}
--- a/Show More
+++ b/Show More