Merge pull request #5661 from manozzo/fix/template-card-tags-overflow

fix(templates): cap visible tags so the Create button stays visible

(cherry picked from commit d9fe046396)

[skip ci]

apps/dokploy/__test__/dns/cloudflare.test.ts

@@ -323,9 +323,11 @@ describe("cloudflareClient.upsertRecord", () => {
 		expect(createInit.method).toBe("POST");
 	});
 
-	it("updates the existing record instead of creating a duplicate", async () => {
+	it("updates the existing record when content matches", async () => {
 		mockFetch
-			.mockResolvedValueOnce(cfSuccess([{ id: "existing-1" }]))
+			.mockResolvedValueOnce(
+				cfSuccess([{ id: "existing-1", type: "A", content: "5.6.7.8" }]),
+			)
 			.mockResolvedValueOnce(cfSuccess({ id: "existing-1" }));
 
 		const result = await cloudflareClient.upsertRecord(config, {
@@ -344,6 +346,25 @@ describe("cloudflareClient.upsertRecord", () => {
 		expect(updateInit.method).toBe("PUT");
 	});
 
+	it("creates a new record when content differs from existing", async () => {
+		mockFetch
+			.mockResolvedValueOnce(
+				cfSuccess([{ id: "existing-1", type: "A", content: "1.1.1.1" }]),
+			)
+			.mockResolvedValueOnce(cfSuccess({ id: "new-2" }));
+
+		const result = await cloudflareClient.upsertRecord(config, {
+			zoneId: "zone-1",
+			type: "A",
+			name: "app.example.com",
+			content: "5.6.7.8",
+		});
+
+		expect(result).toEqual({ id: "new-2" });
+		const [, createInit] = mockFetch.mock.calls[1] as [string, RequestInit];
+		expect(createInit.method).toBe("POST");
+	});
+
 	it("defaults ttl to 1 (automatic) when not provided", async () => {
 		mockFetch
 			.mockResolvedValueOnce(cfSuccess([]))

apps/dokploy/__test__/dns/infomaniak.test.ts

@@ -203,11 +203,11 @@ describe("infomaniakClient.upsertRecord", () => {
 		});
 	});
 
-	it("updates the existing record instead of creating a duplicate", async () => {
+	it("updates the existing record when content matches", async () => {
 		mockFetch
 			.mockResolvedValueOnce(
 				ikSuccess([
-					{ id: 7, type: "A", source: "app", target: "1.1.1.1", ttl: 300 },
+					{ id: 7, type: "A", source: "app", target: "1.2.3.4", ttl: 300 },
 				]),
 			)
 			.mockResolvedValueOnce(ikSuccess({ id: 7 }));
@@ -228,6 +228,28 @@ describe("infomaniakClient.upsertRecord", () => {
 		expect(lastBody().ttl).toBe(300);
 	});
 
+	it("creates a new record when content differs from existing", async () => {
+		mockFetch
+			.mockResolvedValueOnce(
+				ikSuccess([
+					{ id: 7, type: "A", source: "app", target: "1.1.1.1", ttl: 300 },
+				]),
+			)
+			.mockResolvedValueOnce(ikSuccess({ id: 50 }));
+
+		const result = await infomaniakClient.upsertRecord(config, {
+			zoneId: "example.com",
+			type: "A",
+			name: "app.example.com",
+			content: "1.2.3.4",
+		});
+
+		expect(result).toEqual({ id: "50" });
+		const [url, init] = lastCall();
+		expect(url).toBe("https://api.infomaniak.com/2/zones/example.com/records");
+		expect(init.method).toBe("POST");
+	});
+
 	it("writes a root dot as the source for an apex record and strips the trailing dot", async () => {
 		mockFetch
 			.mockResolvedValueOnce(ikSuccess([]))
@@ -249,7 +271,7 @@ describe("infomaniakClient.upsertRecord", () => {
 			mockFetch
 				.mockResolvedValueOnce(
 					ikSuccess([
-						{ id: 8, type: "A", source, target: "1.1.1.1", ttl: 3600 },
+						{ id: 8, type: "A", source, target: "1.2.3.4", ttl: 3600 },
 					]),
 				)
 				.mockResolvedValueOnce(ikSuccess({ id: 8 }));
@@ -326,6 +348,58 @@ describe("infomaniakClient.upsertRecord", () => {
 
 		expect(lastBody().target).toBe('"token-value"');
 	});
+
+	it("queries the API with a source and type filter instead of the whole zone", async () => {
+		mockFetch
+			.mockResolvedValueOnce(ikSuccess([]))
+			.mockResolvedValueOnce(ikSuccess({ id: 50 }));
+
+		await infomaniakClient.upsertRecord(config, {
+			zoneId: "example.com",
+			type: "A",
+			name: "app.example.com",
+			content: "1.2.3.4",
+		});
+
+		const [url] = mockFetch.mock.calls[0] as [string];
+		expect(url).toContain("filter%5Bsource%5D=app");
+		expect(url).toContain("filter%5Btypes%5D%5B%5D=A");
+	});
+
+	it("ignores a partial filter hit rather than overwriting a different record", async () => {
+		// filter[source] matches substrings: asking for "auto" also returns
+		// "autoconfig" and "autodiscover". Trusting it would overwrite one of them.
+		mockFetch
+			.mockResolvedValueOnce(
+				ikSuccess([
+					{
+						id: 61,
+						type: "CNAME",
+						source: "autoconfig",
+						target: "a.example.net",
+						ttl: 300,
+					},
+					{
+						id: 62,
+						type: "CNAME",
+						source: "autodiscover",
+						target: "b.example.net",
+						ttl: 300,
+					},
+				]),
+			)
+			.mockResolvedValueOnce(ikSuccess({ id: 63 }));
+
+		const result = await infomaniakClient.upsertRecord(config, {
+			zoneId: "example.com",
+			type: "CNAME",
+			name: "auto.example.com",
+			content: "c.example.net",
+		});
+
+		expect(result).toEqual({ id: "63" });
+		expect(lastCall()[1].method).toBe("POST");
+	});
 });
 
 describe("infomaniakClient.updateRecord", () => {

apps/dokploy/__test__/dns/ovh.test.ts

@@ -261,9 +261,21 @@ describe("ovhClient.upsertRecord", () => {
 		expect(calls[2]?.[1].method).toBe("POST");
 	});
 
-	it("updates the existing record instead of creating a duplicate", async () => {
+	it("updates the existing record when content matches", async () => {
 		const cfg = freshConfig();
-		mockApi(ovhSuccess([4]), ovhSuccess(null), ovhSuccess(null));
+		mockApi(
+			ovhSuccess([4]),
+			ovhSuccess({
+				id: 4,
+				zone: "example.com",
+				fieldType: "A",
+				subDomain: "app",
+				target: "1.2.3.4",
+				ttl: 60,
+			}),
+			ovhSuccess(null),
+			ovhSuccess(null),
+		);
 
 		const result = await ovhClient.upsertRecord(cfg, {
 			zoneId: "example.com",
@@ -274,9 +286,38 @@ describe("ovhClient.upsertRecord", () => {
 
 		expect(result).toEqual({ id: "4" });
 		const calls = apiCalls();
-		expect(calls[1]?.[0]).toContain("/domain/zone/example.com/record/4");
-		expect(calls[1]?.[1].method).toBe("PUT");
-		expect(calls[2]?.[0]).toContain("/refresh");
+		expect(calls[2]?.[0]).toContain("/domain/zone/example.com/record/4");
+		expect(calls[2]?.[1].method).toBe("PUT");
+		expect(calls[3]?.[0]).toContain("/refresh");
+	});
+
+	it("creates a new record when content differs from existing", async () => {
+		const cfg = freshConfig();
+		mockApi(
+			ovhSuccess([4]),
+			ovhSuccess({
+				id: 4,
+				zone: "example.com",
+				fieldType: "A",
+				subDomain: "app",
+				target: "1.1.1.1",
+				ttl: 60,
+			}),
+			ovhSuccess({ id: 10 }),
+			ovhSuccess(null),
+		);
+
+		const result = await ovhClient.upsertRecord(cfg, {
+			zoneId: "example.com",
+			type: "A",
+			name: "app.example.com",
+			content: "5.6.7.8",
+		});
+
+		expect(result).toEqual({ id: "10" });
+		const calls = apiCalls();
+		expect(calls[2]?.[1].method).toBe("POST");
+		expect(calls[3]?.[0]).toContain("/refresh");
 	});
 
 	it("omits the ttl so OVH applies the zone default", async () => {

apps/dokploy/__test__/dns/porkbun.test.ts

@@ -121,9 +121,11 @@ describe("porkbunClient.upsertRecord", () => {
 		expect(lookupUrl).toContain("/dns/retrieveByNameType/example.com/A/");
 	});
 
-	it("edits the existing record instead of creating a duplicate", async () => {
+	it("edits the existing record when content matches", async () => {
 		mockFetch
-			.mockResolvedValueOnce(pbSuccess({ records: [{ id: "existing-1" }] }))
+			.mockResolvedValueOnce(
+				pbSuccess({ records: [{ id: "existing-1", content: "5.6.7.8" }] }),
+			)
 			.mockResolvedValueOnce(pbSuccess({}));
 
 		const result = await porkbunClient.upsertRecord(config, {
@@ -138,6 +140,30 @@ describe("porkbunClient.upsertRecord", () => {
 		expect(editUrl).toContain("/dns/edit/example.com/existing-1");
 	});
 
+	it("creates a new record when content differs from existing", async () => {
+		mockFetch
+			.mockResolvedValueOnce(
+				pbSuccess({ records: [{ id: "existing-1", content: "1.1.1.1" }] }),
+			)
+			.mockResolvedValueOnce(pbSuccess({ id: "new-2" }));
+
+		const result = await porkbunClient.upsertRecord(config, {
+			zoneId: "example.com",
+			type: "A",
+			name: "app.example.com",
+			content: "5.6.7.8",
+		});
+
+		expect(result).toEqual({ id: "new-2" });
+		const [createUrl, createInit] = mockFetch.mock.calls[1] as [
+			string,
+			RequestInit,
+		];
+		expect(createUrl).toContain("/dns/create/example.com");
+		const body = JSON.parse(createInit.body as string);
+		expect(body).toMatchObject({ name: "app", type: "A", content: "5.6.7.8" });
+	});
+
 	it("defaults ttl to 600 when not provided", async () => {
 		mockFetch
 			.mockResolvedValueOnce(pbSuccess({ records: [] }))

apps/dokploy/__test__/env/aws-parameter-store.test.ts

@@ -0,0 +1,195 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+type HasInput = { input: Record<string, unknown> };
+
+const findMany = vi.hoisted(() => vi.fn());
+
+const {
+	send,
+	paginate,
+	SSMClient,
+	GetParametersCommand,
+	DescribeParametersCommand,
+} = vi.hoisted(() => {
+	class FakeCommand {
+		input: Record<string, unknown>;
+		constructor(input: Record<string, unknown>) {
+			this.input = input;
+		}
+	}
+	const send = vi.fn();
+	const paginate = vi.fn();
+	class SSMClient {
+		send(command: unknown) {
+			return send(command);
+		}
+	}
+	return {
+		send,
+		paginate,
+		SSMClient,
+		GetParametersCommand: class extends FakeCommand {},
+		DescribeParametersCommand: class extends FakeCommand {},
+	};
+});
+
+vi.mock("@aws-sdk/client-ssm", () => ({
+	SSMClient,
+	GetParametersCommand,
+	DescribeParametersCommand,
+	paginateDescribeParameters: paginate,
+}));
+
+vi.mock("@dokploy/server/db", () => ({
+	db: {
+		query: {
+			vaultProvider: {
+				findMany: (...args: unknown[]) => findMany(...args),
+			},
+		},
+	},
+}));
+
+import { resolveVaultReferences } from "@dokploy/server/utils/vault";
+import { awsParameterStoreClient } from "@dokploy/server/utils/vault/aws-parameter-store";
+
+const config = {
+	providerType: "aws-parameter-store" as const,
+	region: "eu-central-1",
+	accessKeyId: "AKIA_TEST",
+	secretAccessKey: "secret",
+};
+
+beforeEach(() => {
+	send.mockReset();
+	paginate.mockReset();
+	findMany.mockReset();
+});
+
+describe("awsParameterStoreClient", () => {
+	it("decrypts parameters in batches of ten and preserves selectors", async () => {
+		const refs = [
+			"/prod/database:CURRENT",
+			...Array.from({ length: 10 }, (_, index) => `/prod/secret-${index}`),
+		];
+		send.mockImplementation(async (command: HasInput) => ({
+			Parameters: (command.input.Names as string[]).map((ref) => {
+				if (ref === "/prod/database:CURRENT") {
+					return {
+						Name: "/prod/database",
+						Selector: ":CURRENT",
+						Value: "selected-value",
+					};
+				}
+				return { Name: ref, Value: `value-for-${ref}` };
+			}),
+		}));
+
+		const result = await awsParameterStoreClient.getSecrets(config, refs);
+
+		expect(send).toHaveBeenCalledTimes(2);
+		expect((send.mock.calls[0]?.[0] as HasInput).input).toMatchObject({
+			WithDecryption: true,
+		});
+		expect(
+			((send.mock.calls[0]?.[0] as HasInput).input.Names as string[]).length,
+		).toBe(10);
+		expect(
+			((send.mock.calls[1]?.[0] as HasInput).input.Names as string[]).length,
+		).toBe(1);
+		expect(result["/prod/database:CURRENT"]).toBe("selected-value");
+		expect(result["/prod/secret-9"]).toBe("value-for-/prod/secret-9");
+	});
+
+	it("reports a missing parameter without exposing other values", async () => {
+		send.mockResolvedValue({ Parameters: [], InvalidParameters: ["/missing"] });
+
+		await expect(
+			awsParameterStoreClient.getSecrets(config, ["/missing"]),
+		).rejects.toThrow('AWS Parameter Store: parameter "/missing" not found');
+	});
+
+	it("tests the connection within the configured hierarchy", async () => {
+		send.mockResolvedValue({ Parameters: [] });
+
+		await awsParameterStoreClient.testConnection({
+			...config,
+			parameterPath: "/production/my-app/",
+		});
+
+		expect(send).toHaveBeenCalledTimes(1);
+		expect((send.mock.calls[0]?.[0] as HasInput).input).toEqual({
+			ParameterFilters: [
+				{
+					Key: "Path",
+					Option: "Recursive",
+					Values: ["/production/my-app"],
+				},
+			],
+			MaxResults: 1,
+		});
+	});
+
+	it("explains the discovery permission when connection testing is denied", async () => {
+		const error = new Error("not authorized");
+		error.name = "AccessDeniedException";
+		send.mockRejectedValue(error);
+
+		await expect(
+			awsParameterStoreClient.testConnection(config),
+		).rejects.toThrow("ssm:DescribeParameters");
+	});
+
+	it("lists parameter names across pages within the configured hierarchy", async () => {
+		paginate.mockReturnValue(
+			(async function* () {
+				yield { Parameters: [{ Name: "/prod/db" }] };
+				yield { Parameters: [{ Name: "/prod/api" }] };
+			})(),
+		);
+
+		const names = await awsParameterStoreClient.listSecretNames?.({
+			...config,
+			parameterPath: " /production/my-app/ ",
+		});
+
+		expect(names).toEqual(["/prod/db", "/prod/api"]);
+		expect(paginate).toHaveBeenCalledWith(
+			expect.objectContaining({ pageSize: 50 }),
+			{
+				ParameterFilters: [
+					{
+						Key: "Path",
+						Option: "Recursive",
+						Values: ["/production/my-app"],
+					},
+				],
+			},
+		);
+	});
+
+	it("resolves a vault reference through the registered provider", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "ssm-prod",
+				providerType: "aws-parameter-store",
+				config,
+				assignments: [{ projectId: "project-1", environmentIds: [] }],
+			},
+		]);
+		send.mockResolvedValue({
+			Parameters: [{ Name: "/prod/database-password", Value: "resolved" }],
+		});
+
+		const result = await resolveVaultReferences(
+			"DB_PASSWORD=${{vault.ssm-prod./prod/database-password}}",
+			{
+				organizationId: "organization-1",
+				projectId: "project-1",
+				environmentId: "environment-1",
+			},
+		);
+
+		expect(result).toBe("DB_PASSWORD=resolved");
+	});
+});

apps/dokploy/__test__/env/vault.test.ts

@@ -20,6 +20,7 @@ import {
 import { azureClient } from "@dokploy/server/utils/vault/azure";
 import { dopplerClient } from "@dokploy/server/utils/vault/doppler";
 import { hashicorpClient } from "@dokploy/server/utils/vault/hashicorp";
+import { infisicalClient } from "@dokploy/server/utils/vault/infisical";
 import { phaseClient } from "@dokploy/server/utils/vault/phase";
 import { scalewayClient } from "@dokploy/server/utils/vault/scaleway";
 
@@ -431,6 +432,152 @@ describe("azure client", () => {
 	});
 });
 
+describe("infisical client", () => {
+	const config = {
+		providerType: "infisical" as const,
+		siteUrl: "https://app.infisical.com",
+		clientId: "client-1",
+		clientSecret: "client-secret",
+		projectId: "workspace-1",
+		environmentSlug: "prod",
+		secretPath: "/frontend",
+	};
+
+	const loginResponse = () => jsonResponse({ accessToken: "token-1" });
+	const list = (secrets: Record<string, string>) =>
+		jsonResponse({
+			secrets: Object.entries(secrets).map(([secretKey, secretValue]) => ({
+				secretKey,
+				secretValue,
+			})),
+		});
+	const listPathOf = (callIndex: number) => {
+		const [url] = mockFetch.mock.calls[callIndex] as [string];
+		return new URL(url).searchParams.get("secretPath");
+	};
+
+	it("asks the list endpoint to expand secret references", async () => {
+		mockFetch
+			.mockResolvedValueOnce(loginResponse())
+			.mockResolvedValueOnce(list({ DB_URL: "postgres://real" }));
+
+		const result = await infisicalClient.getSecrets(config, ["DB_URL"]);
+
+		expect(result).toEqual({ DB_URL: "postgres://real" });
+		const [listUrl] = mockFetch.mock.calls[1] as [string];
+		const params = new URL(listUrl).searchParams;
+		expect(params.get("expandSecretReferences")).toBe("true");
+		expect(params.get("workspaceId")).toBe("workspace-1");
+		expect(params.get("environment")).toBe("prod");
+		expect(params.get("secretPath")).toBe("/frontend");
+	});
+
+	it("throws a clear error for a missing secret", async () => {
+		mockFetch
+			.mockResolvedValueOnce(loginResponse())
+			.mockResolvedValueOnce(jsonResponse({ secrets: [] }));
+
+		await expect(
+			infisicalClient.getSecrets(config, ["ABSENT"]),
+		).rejects.toThrow('secret "ABSENT" not found in environment "prod"');
+	});
+
+	it("propagates authentication failures with the status code", async () => {
+		mockFetch.mockResolvedValueOnce(jsonResponse({}, false, 401));
+
+		await expect(
+			infisicalClient.getSecrets(config, ["DB_URL"]),
+		).rejects.toThrow("authentication failed (status 401)");
+	});
+
+	it("resolves a relative <path>:<KEY> ref against the provider path", async () => {
+		mockFetch
+			.mockResolvedValueOnce(loginResponse())
+			.mockResolvedValueOnce(list({ SENTRY_DSN: "https://key@sentry.io/1" }));
+
+		const result = await infisicalClient.getSecrets(config, [
+			"shared/sentry:SENTRY_DSN",
+		]);
+
+		expect(result).toEqual({
+			"shared/sentry:SENTRY_DSN": "https://key@sentry.io/1",
+		});
+		expect(listPathOf(1)).toBe("/frontend/shared/sentry");
+	});
+
+	it("treats a leading slash as an absolute path", async () => {
+		mockFetch
+			.mockResolvedValueOnce(loginResponse())
+			.mockResolvedValueOnce(list({ SENTRY_DSN: "https://key@sentry.io/1" }));
+
+		await infisicalClient.getSecrets(config, ["/external/sentry:SENTRY_DSN"]);
+
+		expect(listPathOf(1)).toBe("/external/sentry");
+	});
+
+	it("keeps the root path clean when the provider sits at /", async () => {
+		mockFetch
+			.mockResolvedValueOnce(loginResponse())
+			.mockResolvedValueOnce(list({ KEY: "value" }));
+
+		await infisicalClient.getSecrets({ ...config, secretPath: "/" }, [
+			"external/sentry:KEY",
+		]);
+
+		expect(listPathOf(1)).toBe("/external/sentry");
+	});
+
+	it("logs in once and fetches each path once", async () => {
+		const byPath: Record<string, Record<string, string>> = {
+			"/frontend": { A: "a", B: "b" },
+			"/frontend/other": { C: "c" },
+		};
+		mockFetch.mockImplementation(async (url: string) => {
+			if (url.includes("/auth/universal-auth/login")) return loginResponse();
+			const path = new URL(url).searchParams.get("secretPath") as string;
+			return list(byPath[path] ?? {});
+		});
+
+		const result = await infisicalClient.getSecrets(config, [
+			"A",
+			"B",
+			"other:C",
+		]);
+
+		expect(result).toEqual({ A: "a", B: "b", "other:C": "c" });
+
+		const urls = mockFetch.mock.calls.map(([url]) => url as string);
+		expect(urls.filter((u) => u.includes("/login"))).toHaveLength(1);
+		expect(
+			urls
+				.filter((u) => u.includes("/secrets/raw?"))
+				.map((u) => new URL(u).searchParams.get("secretPath"))
+				.sort(),
+		).toEqual(["/frontend", "/frontend/other"]);
+	});
+
+	it("names the path when a secret is missing from an explicit one", async () => {
+		mockFetch
+			.mockResolvedValueOnce(loginResponse())
+			.mockResolvedValueOnce(list({}));
+
+		await expect(
+			infisicalClient.getSecrets(config, ["external/sentry:ABSENT"]),
+		).rejects.toThrow(
+			'secret "ABSENT" not found at "/frontend/external/sentry"',
+		);
+	});
+
+	it("rejects a ref with an empty path or key", async () => {
+		await expect(infisicalClient.getSecrets(config, [":KEY"])).rejects.toThrow(
+			"expected format <path>:<KEY>",
+		);
+		await expect(
+			infisicalClient.getSecrets(config, ["external/sentry:"]),
+		).rejects.toThrow("expected format <path>:<KEY>");
+	});
+});
+
 describe("doppler client", () => {
 	it("propagates auth errors with the status code", async () => {
 		mockFetch.mockResolvedValue(jsonResponse({}, false, 401));

apps/dokploy/__test__/traefik/server/update-server-config.test.ts

@@ -60,7 +60,7 @@ const baseSettings: WebServerSettings = {
 		docsUrl: null,
 		errorPageTitle: null,
 		errorPageDescription: null,
-		metaTitle: null,
+		ogImageUrl: null,
 		footerText: null,
 	},
 	cleanupCacheApplications: false,

apps/dokploy/components/dashboard/application/build/show.tsx

@@ -31,6 +31,45 @@ import { api } from "@/utils/api";
 
 // Railpack versions from https://github.com/railwayapp/railpack/releases
 export const RAILPACK_VERSIONS = [
+	"0.39.0",
+	"0.38.0",
+	"0.37.1",
+	"0.37.0",
+	"0.36.4",
+	"0.36.3",
+	"0.36.2",
+	"0.36.1",
+	"0.36.0",
+	"0.35.0",
+	"0.34.0",
+	"0.33.0",
+	"0.32.0",
+	"0.31.2",
+	"0.31.1",
+	"0.31.0",
+	"0.30.1",
+	"0.30.0",
+	"0.29.0",
+	"0.28.0",
+	"0.27.2",
+	"0.27.1",
+	"0.27.0",
+	"0.26.1",
+	"0.26.0",
+	"0.25.0",
+	"0.24.0",
+	"0.23.0",
+	"0.22.2",
+	"0.22.1",
+	"0.22.0",
+	"0.21.0",
+	"0.20.0",
+	"0.19.0",
+	"0.18.0",
+	"0.17.2",
+	"0.17.1",
+	"0.17.0",
+	"0.16.0",
 	"0.15.4",
 	"0.15.3",
 	"0.15.2",
@@ -45,12 +84,22 @@ export const RAILPACK_VERSIONS = [
 	"0.9.1",
 	"0.9.0",
 	"0.8.0",
+	"0.7.2",
+	"0.7.1",
 	"0.7.0",
+	"0.6.1",
 	"0.6.0",
+	"0.5.1",
 	"0.5.0",
 	"0.4.0",
 	"0.3.0",
+	"0.2.3",
 	"0.2.2",
+	"0.2.1",
+	"0.2.0",
+	"0.1.2",
+	"0.1.1",
+	"0.1.0",
 ] as const;
 
 export enum BuildType {

apps/dokploy/components/dashboard/application/domains/handle-domain.tsx

@@ -156,7 +156,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 			domainId,
 		},
 		{
-			enabled: !!domainId,
+			enabled: isOpen && !!domainId,
 		},
 	);
 
@@ -167,7 +167,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 						applicationId: id,
 					},
 					{
-						enabled: !!id,
+						enabled: isOpen && !!id,
 					},
 				)
 			: api.compose.one.useQuery(
@@ -175,7 +175,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 						composeId: id,
 					},
 					{
-						enabled: !!id,
+						enabled: isOpen && !!id,
 					},
 				);
 
@@ -187,9 +187,14 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 		api.domain.generateDomain.useMutation();
 
 	const { data: canGenerateTraefikMeDomains } =
-		api.domain.canGenerateTraefikMeDomains.useQuery({
-			serverId: application?.serverId || "",
-		});
+		api.domain.canGenerateTraefikMeDomains.useQuery(
+			{
+				serverId: application?.serverId || "",
+			},
+			{
+				enabled: isOpen,
+			},
+		);
 
 	const {
 		data: services,
@@ -204,7 +209,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 		{
 			retry: false,
 			refetchOnWindowFocus: false,
-			enabled: type === "compose" && !!id,
+			enabled: isOpen && type === "compose" && !!id,
 		},
 	);
 

apps/dokploy/components/dashboard/billing/trial-banner.tsx

@@ -0,0 +1,47 @@
+import { Rocket } from "lucide-react";
+import { useRouter } from "next/router";
+import { Button } from "@/components/ui/button";
+import { api } from "@/utils/api";
+
+export const TrialBanner = () => {
+	const router = useRouter();
+	const { data: billingStatus } = api.stripe.getBillingStatus.useQuery();
+	const { mutateAsync: createCustomerPortalSession, isPending } =
+		api.stripe.createCustomerPortalSession.useMutation();
+
+	const handleAddPaymentMethod = async () => {
+		const session = await createCustomerPortalSession().catch(() => null);
+		if (session?.url) {
+			window.open(session.url);
+			return;
+		}
+		router.push("/dashboard/settings/billing");
+	};
+
+	if (!billingStatus?.isOnTrial || billingStatus.hasPaymentMethod) {
+		return null;
+	}
+
+	const daysRemaining = billingStatus.trialDaysRemaining ?? 0;
+	const daysLabel = `${daysRemaining} day${daysRemaining === 1 ? "" : "s"}`;
+
+	return (
+		<div className="sticky top-0 z-20 mx-4 mt-4 flex flex-wrap items-center justify-center gap-x-3 gap-y-2 rounded-lg border border-primary/20 bg-primary/10 px-4 py-2 text-sm">
+			<span className="flex items-center gap-2">
+				<Rocket className="h-4 w-4 text-primary shrink-0" />
+				{daysRemaining > 0
+					? `You have ${daysLabel} left in your free trial. Add a payment method to keep your servers.`
+					: "Your free trial ends today. Add a payment method to keep your servers."}
+			</span>
+			<Button
+				size="sm"
+				variant="default"
+				className="h-7"
+				isLoading={isPending}
+				onClick={handleAddPaymentMethod}
+			>
+				Add payment method
+			</Button>
+		</div>
+	);
+};

apps/dokploy/components/dashboard/onboarding/onboarding-wizard.tsx

@@ -278,8 +278,9 @@ export const OnboardingWizard = ({ onClose }: Props) => {
 						<DialogTitle>Skip onboarding?</DialogTitle>
 						<DialogDescription>
 							If this is your first time using Dokploy, we recommend going
-							through these steps — it only takes a couple of minutes and gives
-							you a feel for how projects, servers and deployments fit together.
+							through these steps – it only takes a couple of minutes and gives
+							you a feel for how projects, servers, and deployments fit
+							together.
 						</DialogDescription>
 					</DialogHeader>
 					<DialogFooter>

apps/dokploy/components/dashboard/onboarding/steps/plan-step.tsx

@@ -15,13 +15,50 @@ const stripePromise = loadStripe(
 	process.env.NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY!,
 );
 
+type Tier = "hobby" | "startup";
+
+const PLANS: {
+	tier: Tier;
+	name: string;
+	description: string;
+	price: number;
+	features: string[];
+	recommended?: boolean;
+}[] = [
+	{
+		tier: "hobby",
+		name: "Hobby",
+		description: "For individual developers",
+		price: calculatePriceHobby(1, false),
+		features: [
+			"Setup 1 server",
+			"Unlimited apps & databases",
+			"2 environments",
+			"Community support",
+		],
+	},
+	{
+		tier: "startup",
+		name: "Startup",
+		description: "For small to mid-size teams",
+		price: calculatePriceStartup(STARTUP_SERVERS_INCLUDED, false),
+		recommended: true,
+		features: [
+			`Setup up to ${STARTUP_SERVERS_INCLUDED} servers`,
+			"Unlimited users & environments",
+			"Basic RBAC + 2FA",
+			"Email & chat support",
+		],
+	},
+];
+
 interface Props {
 	onNext: () => void;
 }
 
 export const PlanStep = ({ onNext }: Props) => {
-	const [loadingTier, setLoadingTier] = useState<
-		"hobby" | "startup" | "trial" | null
+	const [loading, setLoading] = useState<
+		`${"trial" | "checkout"}:${Tier}` | null
 	>(null);
 	const { data } = api.stripe.getProducts.useQuery();
 	const { mutateAsync: createCheckoutSession } =
@@ -30,12 +67,12 @@ export const PlanStep = ({ onNext }: Props) => {
 		api.stripe.startFreeTrial.useMutation();
 	const utils = api.useUtils();
 
-	const handleCheckout = async (tier: "hobby" | "startup") => {
+	const handleCheckout = async (tier: Tier) => {
 		if (!data) return;
 		const productId =
 			tier === "hobby" ? data.hobbyProductId : data.startupProductId;
 		if (!productId) return;
-		setLoadingTier(tier);
+		setLoading(`checkout:${tier}`);
 		try {
 			const stripe = await stripePromise;
 			const session = await createCheckoutSession({
@@ -47,23 +84,23 @@ export const PlanStep = ({ onNext }: Props) => {
 			await stripe?.redirectToCheckout({ sessionId: session.sessionId });
 		} catch {
 			toast.error("Error starting checkout");
-			setLoadingTier(null);
+			setLoading(null);
 		}
 	};
 
-	const handleTrial = async () => {
-		setLoadingTier("trial");
+	const handleTrial = async (tier: Tier) => {
+		setLoading(`trial:${tier}`);
 		try {
-			await startFreeTrial();
+			await startFreeTrial({ tier });
 			await utils.project.onboardingStatus.invalidate();
-			toast.success("Your 14-day trial has started");
+			toast.success("Your 7-day trial has started");
 			onNext();
 		} catch (error) {
 			toast.error(
 				error instanceof Error ? error.message : "Error starting trial",
 			);
 		} finally {
-			setLoadingTier(null);
+			setLoading(null);
 		}
 	};
 
@@ -79,134 +116,72 @@ export const PlanStep = ({ onNext }: Props) => {
 					Start free, upgrade when ready.
 				</h1>
 				<p className="text-muted-foreground text-lg max-w-md leading-relaxed">
-					No credit card for the trial — add one only if you decide to stay.
+					Try any plan free for 7 days. No credit card required — add one only
+					if you decide to stay.
 				</p>
 			</div>
 
-			<div className="flex flex-col rounded-2xl bg-zinc-950 dark:bg-white text-white dark:text-zinc-950 overflow-hidden">
-				<div className="flex flex-col sm:flex-row sm:items-start justify-between gap-6 p-7">
-					<div>
-						<span className="inline-flex items-center rounded-full bg-white text-zinc-950 dark:bg-zinc-950 dark:text-white font-mono text-[10px] font-semibold uppercase tracking-[0.15em] px-2.5 py-1">
-							Recommended
-						</span>
-						<p className={`${displayFont.className} text-2xl mt-3`}>
-							14-day free trial
-						</p>
-						<p className="text-sm text-zinc-400 dark:text-zinc-600 mt-1 max-w-xs">
-							No card required — cancel anytime.
-						</p>
-						<ul className="flex flex-col gap-1.5 mt-4">
-							{[
-								"1 server included",
-								"Unlimited apps & databases",
-								"Community support",
-							].map((f) => (
-								<li
-									key={f}
-									className="flex items-center gap-2 text-sm text-zinc-300 dark:text-zinc-700"
-								>
-									<CheckIcon className="size-3.5 text-zinc-500 shrink-0" />
-									{f}
-								</li>
-							))}
-						</ul>
-					</div>
-					<Button
-						size="lg"
-						className="bg-white text-zinc-950 hover:bg-zinc-200 dark:bg-zinc-950 dark:text-white dark:hover:bg-zinc-800 w-fit shrink-0 px-6"
-						isLoading={loadingTier === "trial"}
-						disabled={loadingTier !== null}
-						onClick={handleTrial}
-					>
-						Start trial
-						<ArrowRightIcon className="size-4" />
-					</Button>
-				</div>
-			</div>
-
 			<div className="grid grid-cols-1 sm:grid-cols-2 gap-px bg-border rounded-2xl overflow-hidden border">
-				<div className="flex flex-col justify-between gap-6 bg-background p-7">
-					<div>
-						<p className="font-medium">Hobby</p>
-						<p className="text-sm text-muted-foreground mt-1">
-							For individual developers
-						</p>
-						<p className="text-3xl font-semibold mt-4 tabular-nums">
-							${calculatePriceHobby(1, false).toFixed(2)}
-							<span className="text-sm font-normal text-muted-foreground">
-								{" "}
-								/mo
-							</span>
-						</p>
-						<ul className="flex flex-col gap-1.5 mt-4">
-							{[
-								"1 server included",
-								"Unlimited apps & databases",
-								"2 environments",
-								"Community support",
-							].map((f) => (
-								<li
-									key={f}
-									className="flex items-center gap-2 text-sm text-muted-foreground"
+				{PLANS.map((plan) => {
+					const productId =
+						plan.tier === "hobby"
+							? data?.hobbyProductId
+							: data?.startupProductId;
+					return (
+						<div
+							key={plan.tier}
+							className="flex flex-col justify-between gap-6 bg-background p-7"
+						>
+							<div>
+								{plan.recommended && (
+									<span className="inline-flex items-center rounded-full bg-primary text-primary-foreground font-mono text-[10px] font-semibold uppercase tracking-[0.15em] px-2.5 py-1 mb-3">
+										Recommended
+									</span>
+								)}
+								<p className="font-medium">{plan.name}</p>
+								<p className="text-sm text-muted-foreground mt-1">
+									{plan.description}
+								</p>
+								<p className="text-3xl font-semibold mt-4 tabular-nums">
+									${plan.price.toFixed(2)}
+									<span className="text-sm font-normal text-muted-foreground">
+										{" "}
+										/mo
+									</span>
+								</p>
+								<ul className="flex flex-col gap-1.5 mt-4">
+									{plan.features.map((f) => (
+										<li
+											key={f}
+											className="flex items-center gap-2 text-sm text-muted-foreground"
+										>
+											<CheckIcon className="size-3.5 shrink-0" />
+											{f}
+										</li>
+									))}
+								</ul>
+							</div>
+							<div className="flex flex-col gap-2">
+								<Button
+									isLoading={loading === `trial:${plan.tier}`}
+									disabled={loading !== null}
+									onClick={() => handleTrial(plan.tier)}
 								>
-									<CheckIcon className="size-3.5 shrink-0" />
-									{f}
-								</li>
-							))}
-						</ul>
-					</div>
-					<Button
-						variant="outline"
-						isLoading={loadingTier === "hobby"}
-						disabled={loadingTier !== null || !data?.hobbyProductId}
-						onClick={() => handleCheckout("hobby")}
-					>
-						Subscribe
-					</Button>
-				</div>
-
-				<div className="flex flex-col justify-between gap-6 bg-background p-7">
-					<div>
-						<p className="font-medium">Startup</p>
-						<p className="text-sm text-muted-foreground mt-1">
-							For small to mid-size teams
-						</p>
-						<p className="text-3xl font-semibold mt-4 tabular-nums">
-							$
-							{calculatePriceStartup(STARTUP_SERVERS_INCLUDED, false).toFixed(
-								2,
-							)}
-							<span className="text-sm font-normal text-muted-foreground">
-								{" "}
-								/mo
-							</span>
-						</p>
-						<ul className="flex flex-col gap-1.5 mt-4">
-							{[
-								`${STARTUP_SERVERS_INCLUDED} servers included`,
-								"Unlimited users & environments",
-								"Basic RBAC + 2FA",
-								"Email & chat support",
-							].map((f) => (
-								<li
-									key={f}
-									className="flex items-center gap-2 text-sm text-muted-foreground"
+									Start 7-day free trial
+									<ArrowRightIcon className="size-4" />
+								</Button>
+								<Button
+									variant="outline"
+									isLoading={loading === `checkout:${plan.tier}`}
+									disabled={loading !== null || !productId}
+									onClick={() => handleCheckout(plan.tier)}
 								>
-									<CheckIcon className="size-3.5 shrink-0" />
-									{f}
-								</li>
-							))}
-						</ul>
-					</div>
-					<Button
-						variant="outline"
-						isLoading={loadingTier === "startup"}
-						disabled={loadingTier !== null || !data?.startupProductId}
-						onClick={() => handleCheckout("startup")}
-					>
-						Subscribe
-					</Button>
-				</div>
+									Subscribe now
+								</Button>
+							</div>
+						</div>
+					);
+				})}
 			</div>
 		</div>
 	);

apps/dokploy/components/dashboard/onboarding/steps/project-step.tsx

@@ -65,7 +65,7 @@ export const ProjectStep = ({ onNext, plainTitle }: Props) => {
 				</span>
 				<h1 className={titleClassName}>Create your first project.</h1>
 				<p className="text-muted-foreground text-lg max-w-md leading-relaxed">
-					Projects group your apps, databases and environments together.
+					Projects group your apps, databases, and environments together.
 				</p>
 			</div>
 

apps/dokploy/components/dashboard/onboarding/steps/server-step.tsx

@@ -1,6 +1,12 @@
 import { standardSchemaResolver as zodResolver } from "@hookform/resolvers/standard-schema";
 import copy from "copy-to-clipboard";
-import { CheckCircle2, CopyIcon, Loader2, XCircle } from "lucide-react";
+import {
+	CheckCircle2,
+	CopyIcon,
+	InfoIcon,
+	Loader2,
+	XCircle,
+} from "lucide-react";
 import { useEffect, useRef, useState } from "react";
 import { useForm } from "react-hook-form";
 import { toast } from "sonner";
@@ -200,9 +206,19 @@ export const ServerStep = ({ onNext, plainTitle }: Props) => {
 				</span>
 				<h1 className={titleClassName}>Connect a server.</h1>
 				<p className="text-muted-foreground text-lg max-w-md leading-relaxed">
-					Dokploy deploys to servers you own — buy one from any VPS provider
+					Dokploy deploys to servers you own. Buy one from any VPS provider
 					(Hetzner, DigitalOcean, Hostinger...) and paste its IP below.
 				</p>
+				<div className="flex items-start gap-2.5 rounded-lg border p-3 max-w-md">
+					<InfoIcon className="size-4 text-muted-foreground shrink-0 mt-0.5" />
+					<div className="flex flex-col gap-0.5">
+						<span className="text-sm font-medium">Requirements</span>
+						<span className="text-sm text-muted-foreground">
+							To ensure a smooth experience with Dokploy, your server should
+							have at least 1GB of RAM and 30GB of disk space.
+						</span>
+					</div>
+				</div>
 			</div>
 
 			{!createdServerId ? (
@@ -287,7 +303,7 @@ export const ServerStep = ({ onNext, plainTitle }: Props) => {
 						{isSettingUp ? (
 							<div className="flex items-center justify-center gap-3 py-4 text-sm text-muted-foreground">
 								<Loader2 className="size-4 animate-spin shrink-0" />
-								Setting up your server — installing Docker and dependencies...
+								Setting up your server – installing Docker and dependencies…
 							</div>
 						) : isValidating && !validation ? (
 							<div className="flex items-center justify-center gap-2 py-4 text-sm text-muted-foreground">
@@ -311,7 +327,7 @@ export const ServerStep = ({ onNext, plainTitle }: Props) => {
 					</div>
 					{!isReady && !isSettingUp && (
 						<AlertBlock type="info">
-							Setup usually takes a minute after the server boots — this checks
+							Setup runs after the server boots and this page checks for it
 							automatically. You can retry setup, or use "Skip for now" above to
 							continue and come back to this later.
 						</AlertBlock>

apps/dokploy/components/dashboard/onboarding/steps/welcome-step.tsx

@@ -39,8 +39,8 @@ export const WelcomeStep = ({ onNext }: Props) => {
 					Let's get your first app <em className="not-italic">live</em>.
 				</h1>
 				<p className="text-muted-foreground text-lg max-w-md leading-relaxed">
-					A few steps — pick a plan, connect a server, ship something. You'll
-					have a working URL by the end.
+					It just takes a few steps: pick a plan, connect a server, ship
+					something. You'll have a working URL by the end.
 				</p>
 			</div>
 

apps/dokploy/components/dashboard/project/add-template.tsx

@@ -435,7 +435,7 @@ export const AddTemplate = ({ environmentId, baseUrl }: Props) => {
 												{viewMode === "detailed" &&
 													template?.tags?.length > 0 && (
 														<div className="flex flex-wrap justify-center gap-1.5">
-															{template?.tags?.map((tag) => (
+															{template.tags.slice(0, 6).map((tag) => (
 																<Badge
 																	key={tag}
 																	variant="green"
@@ -444,6 +444,15 @@ export const AddTemplate = ({ environmentId, baseUrl }: Props) => {
 																	{tag}
 																</Badge>
 															))}
+															{template.tags.length > 6 && (
+																<Badge
+																	variant="green"
+																	className="text-[10px] px-2 py-0"
+																	title={template.tags.slice(6).join(", ")}
+																>
+																	+{template.tags.length - 6}
+																</Badge>
+															)}
 														</div>
 													)}
 											</div>

apps/dokploy/components/dashboard/project/advanced-environment-selector.tsx

@@ -77,6 +77,7 @@ export const AdvancedEnvironmentSelector = ({
 	const createEnvironment = api.environment.create.useMutation();
 	const updateEnvironment = api.environment.update.useMutation();
 	const deleteEnvironment = api.environment.remove.useMutation();
+	const duplicateEnvironment = api.environment.duplicate.useMutation();
 
 	// Refetch project data
 	const utils = api.useUtils();
@@ -158,6 +159,26 @@ export const AdvancedEnvironmentSelector = ({
 		}
 	};
 
+	const handleDuplicateEnvironment = async (environment: Environment) => {
+		try {
+			const result = await duplicateEnvironment.mutateAsync({
+				environmentId: environment.environmentId,
+				name: `${environment.name}-copy`,
+				description: environment.description || undefined,
+			});
+
+			toast.success("Environment duplicated successfully");
+			utils.project.one.invalidate({ projectId });
+
+			// Navigate to the new duplicated environment
+			router.push(
+				`/dashboard/project/${projectId}/environment/${result.environmentId}`,
+			);
+		} catch (error) {
+			toast.error("Failed to duplicate environment");
+		}
+	};
+
 	const openEditDialog = (environment: Environment) => {
 		setSelectedEnvironment(environment);
 		setName(environment.name);

apps/dokploy/components/dashboard/settings/billing/show-billing.tsx

@@ -105,23 +105,59 @@ export const ShowBilling = () => {
 		api.stripe.upgradeSubscription.useMutation();
 	const { mutateAsync: updateInvoiceNotifications } =
 		api.stripe.updateInvoiceNotifications.useMutation();
-	const { mutateAsync: startFreeTrial, isPending: isStartingTrial } =
+	const { mutateAsync: startFreeTrial } =
 		api.stripe.startFreeTrial.useMutation();
 	const utils = api.useUtils();
+	const [trialTier, setTrialTier] = useState<"hobby" | "startup" | null>(null);
+	const [switchingTrial, setSwitchingTrial] = useState(false);
 
-	const handleStartTrial = async () => {
+	const handleSwitchTrialPlan = async (tier: "hobby" | "startup") => {
+		const planName = tier === "startup" ? "Startup" : "Hobby";
+
+		const switchPlan = async () => {
+			await upgradeSubscription({
+				tier,
+				serverQuantity: tier === "startup" ? STARTUP_SERVERS_INCLUDED : 1,
+				isAnnual: false,
+			});
+			await new Promise((resolve) => setTimeout(resolve, 3000));
+			await Promise.all([
+				utils.stripe.getBillingStatus.invalidate(),
+				utils.stripe.getProducts.invalidate(),
+				utils.user.get.invalidate(),
+				utils.server.count.invalidate(),
+			]);
+		};
+
+		setSwitchingTrial(true);
+		await toast
+			.promise(switchPlan(), {
+				loading: `Switching to ${planName}...`,
+				success: `Your trial is now on the ${planName} plan`,
+				error: (error) =>
+					error instanceof Error ? error.message : "Error switching plan",
+			})
+			.unwrap()
+			.catch(() => undefined);
+		setSwitchingTrial(false);
+	};
+
+	const handleStartTrial = async (tier: "hobby" | "startup") => {
+		setTrialTier(tier);
 		try {
-			await startFreeTrial();
+			await startFreeTrial({ tier });
 			await Promise.all([
 				utils.stripe.getBillingStatus.invalidate(),
 				utils.stripe.getProducts.invalidate(),
 				utils.user.get.invalidate(),
 			]);
-			toast.success("Your 14-day trial has started");
+			toast.success("Your 7-day trial has started");
 		} catch (error) {
 			toast.error(
 				error instanceof Error ? error.message : "Error starting trial",
 			);
+		} finally {
+			setTrialTier(null);
 		}
 	};
 
@@ -170,12 +206,23 @@ export const ShowBilling = () => {
 
 	const useNewPricing = data?.hobbyProductId && data?.startupProductId;
 	const products = data?.products.filter((product) => {
-		// @ts-ignore
+		// @ts-expect-error
 		const interval = product?.default_price?.recurring?.interval;
 		return isAnnual ? interval === "year" : interval === "month";
 	});
 
 	const isEnterpriseCloud = admin?.user.isEnterpriseCloud ?? false;
+	const canStartTrial =
+		!isEnterpriseCloud &&
+		!!billingStatus &&
+		!billingStatus.plan &&
+		!billingStatus.isOnTrial &&
+		!billingStatus.hasUsedTrial;
+	/** Checkout would create a second subscription alongside a running trial. */
+	const canSubscribe =
+		!isEnterpriseCloud &&
+		(data?.subscriptions?.length ?? 0) === 0 &&
+		!billingStatus?.isOnTrial;
 	const maxServers = admin?.user.serversQuantity ?? 1;
 	const percentage = ((servers ?? 0) / maxServers) * 100;
 	const safePercentage = Math.min(percentage, 100);
@@ -296,67 +343,72 @@ export const ShowBilling = () => {
 																billingStatus.trialEndsAt
 																	? ` · ends ${new Date(billingStatus.trialEndsAt).toLocaleDateString()}`
 																	: ""
+															}${
+																billingStatus.hasPaymentMethod
+																	? " · billing starts automatically"
+																	: " · add a card to keep your servers"
 															}`
 														: "You're subscribed and billed automatically."}
 												</span>
 											</div>
 										</div>
-										{billingStatus.isOnTrial &&
-											admin?.user.stripeCustomerId && (
+										{admin?.user.stripeCustomerId && (
+											<div className="flex flex-wrap items-center gap-2">
+												{billingStatus.isOnTrial &&
+													useNewPricing &&
+													billingStatus.plan && (
+														<Button
+															size="sm"
+															variant="outline"
+															isLoading={switchingTrial}
+															onClick={() =>
+																handleSwitchTrialPlan(
+																	billingStatus.plan === "startup"
+																		? "hobby"
+																		: "startup",
+																)
+															}
+														>
+															{billingStatus.plan === "startup"
+																? "Switch to Hobby"
+																: "Switch to Startup"}
+														</Button>
+													)}
 												<Button
 													size="sm"
-													variant="outline"
+													variant={
+														billingStatus.isOnTrial &&
+														!billingStatus.hasPaymentMethod
+															? "default"
+															: "secondary"
+													}
 													onClick={async () => {
 														const session = await createCustomerPortalSession();
 														window.open(session.url);
 													}}
 												>
-													Add payment method
+													{billingStatus.isOnTrial &&
+													!billingStatus.hasPaymentMethod
+														? "Add payment method"
+														: "Manage Subscription"}
 												</Button>
-											)}
-									</div>
-								)}
-							{!isEnterpriseCloud &&
-								billingStatus &&
-								!billingStatus.plan &&
-								!billingStatus.isOnTrial &&
-								!billingStatus.hasUsedTrial && (
-									<div className="flex flex-wrap items-center justify-between gap-4 rounded-xl border border-primary/30 bg-primary/5 p-4 max-w-2xl">
-										<div className="flex items-center gap-3">
-											<Clock className="h-5 w-5 text-primary shrink-0" />
-											<div className="flex flex-col gap-1.5">
-												<span className="text-sm font-medium">
-													14-day free trial
-												</span>
-												<span className="text-sm text-muted-foreground">
-													No credit card required — cancel anytime.
-												</span>
-												<ul className="flex flex-col gap-1 mt-1">
-													{[
-														"1 server included",
-														"Unlimited apps & databases",
-														"Community support",
-													].map((feature) => (
-														<li
-															key={feature}
-															className="flex items-center gap-2 text-sm text-muted-foreground"
-														>
-															<CheckIcon className="size-3.5 shrink-0" />
-															{feature}
-														</li>
-													))}
-												</ul>
 											</div>
-										</div>
-										<Button
-											size="sm"
-											isLoading={isStartingTrial}
-											onClick={handleStartTrial}
-										>
-											Start trial
-										</Button>
+										)}
 									</div>
 								)}
+							{canStartTrial && (
+								<div className="flex items-center gap-3 rounded-xl border border-primary/30 bg-primary/5 p-4 max-w-2xl">
+									<Clock className="h-5 w-5 text-primary shrink-0" />
+									<div className="flex flex-col">
+										<span className="text-sm font-medium">
+											7-day free trial on any plan
+										</span>
+										<span className="text-sm text-muted-foreground">
+											No credit card required — pick Hobby or Startup below.
+										</span>
+									</div>
+								</div>
+							)}
 							{(admin?.user.stripeSubscriptionId || isEnterpriseCloud) && (
 								<div className="space-y-2 flex flex-col">
 									<h3 className="text-lg font-medium">Servers Plan</h3>
@@ -917,7 +969,7 @@ export const ShowBilling = () => {
 													"Unlimited Deployments",
 													"Unlimited Databases",
 													"Unlimited Applications",
-													"1 Server Included",
+													"Setup 1 Server",
 													"1 Organization",
 													"1 User",
 													"2 Environments",
@@ -933,68 +985,71 @@ export const ShowBilling = () => {
 												))}
 											</ul>
 											<div className="mt-6 flex flex-col gap-3">
-												<div className="flex items-center gap-2">
-													<span className="text-sm text-muted-foreground">
-														Servers:
-													</span>
-													<Button
-														disabled={hobbyServerQuantity <= 1}
-														variant="outline"
-														size="icon"
-														onClick={() =>
-															setHobbyServerQuantity((q) => Math.max(1, q - 1))
-														}
-													>
-														<MinusIcon className="h-4 w-4" />
-													</Button>
-													<NumberInput
-														value={hobbyServerQuantity}
-														onChange={(e) =>
-															setHobbyServerQuantity(
-																Math.max(
-																	1,
-																	Number(
-																		(e.target as HTMLInputElement).value,
-																	) || 1,
-																),
-															)
-														}
-														className="text-center"
-													/>
-													<Button
-														variant="outline"
-														size="icon"
-														onClick={() => setHobbyServerQuantity((q) => q + 1)}
-													>
-														<PlusIcon className="h-4 w-4" />
-													</Button>
-												</div>
-												<div className="flex flex-col gap-2 w-full">
-													{admin?.user.stripeCustomerId && (
+												{canSubscribe && (
+													<div className="flex items-center gap-2">
+														<span className="text-sm text-muted-foreground">
+															Servers:
+														</span>
 														<Button
-															variant="secondary"
-															className="w-full"
-															onClick={async () => {
-																const session =
-																	await createCustomerPortalSession();
-																window.open(session.url);
-															}}
+															disabled={hobbyServerQuantity <= 1}
+															variant="outline"
+															size="icon"
+															onClick={() =>
+																setHobbyServerQuantity((q) =>
+																	Math.max(1, q - 1),
+																)
+															}
 														>
-															Manage Subscription
+															<MinusIcon className="h-4 w-4" />
+														</Button>
+														<NumberInput
+															value={hobbyServerQuantity}
+															onChange={(e) =>
+																setHobbyServerQuantity(
+																	Math.max(
+																		1,
+																		Number(
+																			(e.target as HTMLInputElement).value,
+																		) || 1,
+																	),
+																)
+															}
+															className="text-center"
+														/>
+														<Button
+															variant="outline"
+															size="icon"
+															onClick={() =>
+																setHobbyServerQuantity((q) => q + 1)
+															}
+														>
+															<PlusIcon className="h-4 w-4" />
+														</Button>
+													</div>
+												)}
+												<div className="flex flex-col gap-2 w-full">
+													{canStartTrial && (
+														<Button
+															className="w-full"
+															isLoading={trialTier === "hobby"}
+															disabled={trialTier !== null}
+															onClick={() => handleStartTrial("hobby")}
+														>
+															Start 7-day free trial
+														</Button>
+													)}
+													{canSubscribe && (
+														<Button
+															className="w-full"
+															variant={canStartTrial ? "outline" : "default"}
+															onClick={() =>
+																handleCheckout("hobby", data!.hobbyProductId!)
+															}
+															disabled={hobbyServerQuantity < 1}
+														>
+															Get Started
 														</Button>
 													)}
-													{!isEnterpriseCloud &&
-														(data?.subscriptions?.length ?? 0) === 0 && (
-															<Button
-																className="w-full"
-																onClick={() =>
-																	handleCheckout("hobby", data!.hobbyProductId!)
-																}
-																disabled={hobbyServerQuantity < 1}
-															>
-																Get Started
-															</Button>
-														)}
 												</div>
 											</div>
 										</section>
@@ -1049,7 +1104,7 @@ export const ShowBilling = () => {
 													All the features of Hobby, plus…
 												</li>
 												{[
-													"3 Servers Included",
+													"Setup up to 3 Servers",
 													"3 Organizations",
 													"Unlimited Users",
 													"Unlimited Environments",
@@ -1067,85 +1122,83 @@ export const ShowBilling = () => {
 												))}
 											</ul>
 											<div className="mt-6 flex flex-col gap-3">
-												<div className="flex flex-col gap-2">
-													<span className="text-sm font-medium text-foreground">
-														Servers (min. {STARTUP_SERVERS_INCLUDED} included)
-													</span>
-													<div className="flex items-center gap-2">
-														<Button
-															disabled={
-																startupServerQuantity <=
-																STARTUP_SERVERS_INCLUDED
-															}
-															variant="outline"
-															size="icon"
-															className="h-8 w-8"
-															onClick={() =>
-																setStartupServerQuantity((q) =>
-																	Math.max(STARTUP_SERVERS_INCLUDED, q - 1),
-																)
-															}
-														>
-															<MinusIcon className="h-4 w-4" />
-														</Button>
-														<NumberInput
-															value={startupServerQuantity}
-															onChange={(e) =>
-																setStartupServerQuantity(
-																	Math.max(
-																		STARTUP_SERVERS_INCLUDED,
-																		Number(
-																			(e.target as HTMLInputElement).value,
-																		) || STARTUP_SERVERS_INCLUDED,
-																	),
-																)
-															}
-															className="h-8 text-center"
-														/>
-														<Button
-															variant="outline"
-															size="icon"
-															className="h-8 w-8"
-															onClick={() =>
-																setStartupServerQuantity((q) => q + 1)
-															}
-														>
-															<PlusIcon className="h-4 w-4" />
-														</Button>
-													</div>
-												</div>
-												<div className="flex flex-col gap-2 w-full">
-													{admin?.user.stripeCustomerId && (
-														<Button
-															variant="secondary"
-															className="w-full"
-															onClick={async () => {
-																const session =
-																	await createCustomerPortalSession();
-																window.open(session.url);
-															}}
-														>
-															Manage Subscription
-														</Button>
-													)}
-													{!isEnterpriseCloud &&
-														(data?.subscriptions?.length ?? 0) === 0 && (
+												{canSubscribe && (
+													<div className="flex flex-col gap-2">
+														<span className="text-sm font-medium text-foreground">
+															Servers (min. {STARTUP_SERVERS_INCLUDED} included)
+														</span>
+														<div className="flex items-center gap-2">
 															<Button
-																className="w-full"
-																onClick={() =>
-																	handleCheckout(
-																		"startup",
-																		data!.startupProductId!,
-																	)
-																}
 																disabled={
-																	startupServerQuantity <
+																	startupServerQuantity <=
 																	STARTUP_SERVERS_INCLUDED
 																}
+																variant="outline"
+																size="icon"
+																className="h-8 w-8"
+																onClick={() =>
+																	setStartupServerQuantity((q) =>
+																		Math.max(STARTUP_SERVERS_INCLUDED, q - 1),
+																	)
+																}
 															>
-																Get Started
+																<MinusIcon className="h-4 w-4" />
 															</Button>
-														)}
+															<NumberInput
+																value={startupServerQuantity}
+																onChange={(e) =>
+																	setStartupServerQuantity(
+																		Math.max(
+																			STARTUP_SERVERS_INCLUDED,
+																			Number(
+																				(e.target as HTMLInputElement).value,
+																			) || STARTUP_SERVERS_INCLUDED,
+																		),
+																	)
+																}
+																className="h-8 text-center"
+															/>
+															<Button
+																variant="outline"
+																size="icon"
+																className="h-8 w-8"
+																onClick={() =>
+																	setStartupServerQuantity((q) => q + 1)
+																}
+															>
+																<PlusIcon className="h-4 w-4" />
+															</Button>
+														</div>
+													</div>
+												)}
+												<div className="flex flex-col gap-2 w-full">
+													{canStartTrial && (
+														<Button
+															className="w-full"
+															isLoading={trialTier === "startup"}
+															disabled={trialTier !== null}
+															onClick={() => handleStartTrial("startup")}
+														>
+															Start 7-day free trial
+														</Button>
+													)}
+													{canSubscribe && (
+														<Button
+															className="w-full"
+															variant={canStartTrial ? "outline" : "default"}
+															onClick={() =>
+																handleCheckout(
+																	"startup",
+																	data!.startupProductId!,
+																)
+															}
+															disabled={
+																startupServerQuantity < STARTUP_SERVERS_INCLUDED
+															}
+														>
+															Get Started
+														</Button>
+													)}
 												</div>
 											</div>
 										</section>
@@ -1337,31 +1390,17 @@ export const ShowBilling = () => {
 															</Button>
 														</div>
 														<div className="flex flex-col gap-2 mt-4 w-full">
-															{admin?.user.stripeCustomerId && (
+															{canSubscribe && (
 																<Button
-																	variant="secondary"
 																	className="w-full"
 																	onClick={async () => {
-																		const session =
-																			await createCustomerPortalSession();
-																		window.open(session.url);
+																		handleCheckout("legacy", product.id);
 																	}}
+																	disabled={hobbyServerQuantity < 1}
 																>
-																	Manage Subscription
+																	Subscribe
 																</Button>
 															)}
-															{!isEnterpriseCloud &&
-																(data?.subscriptions?.length ?? 0) === 0 && (
-																	<Button
-																		className="w-full"
-																		onClick={async () => {
-																			handleCheckout("legacy", product.id);
-																		}}
-																		disabled={hobbyServerQuantity < 1}
-																	>
-																		Subscribe
-																	</Button>
-																)}
 														</div>
 													</div>
 												</section>

apps/dokploy/components/dashboard/settings/vault/handle-vault-provider.tsx

@@ -40,6 +40,7 @@ const providerLabels = {
 	hashicorp: "HashiCorp Vault / OpenBao",
 	infisical: "Infisical",
 	aws: "AWS Secrets Manager",
+	"aws-parameter-store": "AWS Parameter Store",
 	doppler: "Doppler",
 	azure: "Azure Key Vault",
 	scaleway: "Scaleway Secret Manager",
@@ -61,6 +62,7 @@ const VaultProviderSchema = z
 			"hashicorp",
 			"infisical",
 			"aws",
+			"aws-parameter-store",
 			"doppler",
 			"azure",
 			"scaleway",
@@ -79,6 +81,7 @@ const VaultProviderSchema = z
 		region: z.string(),
 		accessKeyId: z.string(),
 		secretAccessKey: z.string(),
+		parameterPath: z.string(),
 		serviceToken: z.string(),
 		awsEndpoint: z.string(),
 		vaultUri: z.string(),
@@ -136,7 +139,8 @@ const VaultProviderSchema = z
 			});
 		}
 		if (
-			data.providerType === "aws" &&
+			(data.providerType === "aws" ||
+				data.providerType === "aws-parameter-store") &&
 			data.awsEndpoint &&
 			!isValidUrl(data.awsEndpoint)
 		) {
@@ -146,6 +150,17 @@ const VaultProviderSchema = z
 				path: ["awsEndpoint"],
 			});
 		}
+		if (
+			data.providerType === "aws-parameter-store" &&
+			data.parameterPath &&
+			!data.parameterPath.trim().startsWith("/")
+		) {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: "Parameter discovery path must start with /",
+				path: ["parameterPath"],
+			});
+		}
 		if (
 			data.providerType === "scaleway" &&
 			data.scalewayApiUrl &&
@@ -200,6 +215,11 @@ const VaultProviderSchema = z
 				["accessKeyId", "Access Key ID is required"],
 				["secretAccessKey", "Secret Access Key is required"],
 			],
+			"aws-parameter-store": [
+				["region", "Region is required"],
+				["accessKeyId", "Access Key ID is required"],
+				["secretAccessKey", "Secret Access Key is required"],
+			],
 			doppler: [["serviceToken", "Service Token is required"]],
 			azure: [
 				["vaultUri", "Vault URI is required"],
@@ -265,6 +285,7 @@ const defaultValues: VaultProviderForm = {
 	region: "",
 	accessKeyId: "",
 	secretAccessKey: "",
+	parameterPath: "",
 	serviceToken: "",
 	awsEndpoint: "",
 	vaultUri: "",
@@ -313,6 +334,15 @@ const buildConfig = (data: VaultProviderForm) => {
 				secretAccessKey: data.secretAccessKey,
 				endpoint: data.awsEndpoint || undefined,
 			};
+		case "aws-parameter-store":
+			return {
+				providerType: "aws-parameter-store" as const,
+				region: data.region,
+				accessKeyId: data.accessKeyId,
+				secretAccessKey: data.secretAccessKey,
+				endpoint: data.awsEndpoint || undefined,
+				parameterPath: data.parameterPath.trim() || undefined,
+			};
 		case "doppler":
 			return {
 				providerType: "doppler" as const,
@@ -443,12 +473,16 @@ export const HandleVaultProvider = ({ vaultProviderId }: Props) => {
 					environmentSlug: provider.config.environmentSlug,
 					secretPath: provider.config.secretPath,
 				}),
-				...(provider.config.providerType === "aws" && {
+				...((provider.config.providerType === "aws" ||
+					provider.config.providerType === "aws-parameter-store") && {
 					region: provider.config.region,
 					accessKeyId: provider.config.accessKeyId,
 					secretAccessKey: provider.config.secretAccessKey,
 					awsEndpoint: provider.config.endpoint ?? "",
 				}),
+				...(provider.config.providerType === "aws-parameter-store" && {
+					parameterPath: provider.config.parameterPath ?? "",
+				}),
 				...(provider.config.providerType === "doppler" && {
 					serviceToken: provider.config.serviceToken,
 					dopplerProject: provider.config.project ?? "",
@@ -757,7 +791,8 @@ export const HandleVaultProvider = ({ vaultProviderId }: Props) => {
 							</>
 						)}
 
-						{providerType === "aws" && (
+						{(providerType === "aws" ||
+							providerType === "aws-parameter-store") && (
 							<>
 								<FormField
 									control={form.control}
@@ -815,12 +850,44 @@ export const HandleVaultProvider = ({ vaultProviderId }: Props) => {
 										</FormItem>
 									)}
 								/>
-								<FormDescription>
-									Reference format:{" "}
-									<code>{"${{vault.<name>.secret-name}}"}</code> or{" "}
-									<code>{"${{vault.<name>.secret-name:field}}"}</code> for JSON
-									secrets
-								</FormDescription>
+								{providerType === "aws-parameter-store" && (
+									<FormField
+										control={form.control}
+										name="parameterPath"
+										render={({ field }) => (
+											<FormItem>
+												<FormLabel>Discovery path (optional)</FormLabel>
+												<FormControl>
+													<Input placeholder="/production/my-app" {...field} />
+												</FormControl>
+												<FormDescription>
+													Limits parameter browsing and autocomplete to this
+													hierarchy. IAM permissions remain the security
+													boundary.
+												</FormDescription>
+												<FormMessage />
+											</FormItem>
+										)}
+									/>
+								)}
+								{providerType === "aws" ? (
+									<FormDescription>
+										Reference format:{" "}
+										<code>{"${{vault.<name>.secret-name}}"}</code> or{" "}
+										<code>{"${{vault.<name>.secret-name:field}}"}</code> for
+										JSON secrets
+									</FormDescription>
+								) : (
+									<FormDescription>
+										Reference format:{" "}
+										<code>{"${{vault.<name>./path/to/parameter}}"}</code>.
+										SecureString parameters are decrypted automatically.
+										Resolution requires <code>ssm:GetParameters</code>.
+										Discovery requires <code>ssm:DescribeParameters</code>.
+										Customer-managed KMS keys also require{" "}
+										<code>kms:Decrypt</code>.
+									</FormDescription>
+								)}
 							</>
 						)}
 

apps/dokploy/components/dashboard/settings/vault/show-vault-providers.tsx

@@ -18,6 +18,7 @@ const providerLabels: Record<string, string> = {
 	hashicorp: "HashiCorp Vault",
 	infisical: "Infisical",
 	aws: "AWS Secrets Manager",
+	"aws-parameter-store": "AWS Parameter Store",
 	doppler: "Doppler",
 	azure: "Azure Key Vault",
 	scaleway: "Scaleway Secret Manager",

apps/dokploy/components/dashboard/settings/web-server/update-server.tsx

@@ -7,6 +7,7 @@ import {
 	Server,
 	Sparkles,
 	Stars,
+	X,
 } from "lucide-react";
 import Link from "next/link";
 import { useState } from "react";
@@ -14,6 +15,7 @@ import { toast } from "sonner";
 import { Button } from "@/components/ui/button";
 import {
 	Dialog,
+	DialogClose,
 	DialogContent,
 	DialogTitle,
 	DialogTrigger,
@@ -126,13 +128,13 @@ export const UpdateServer = ({
 					</TooltipProvider>
 				)}
 			</DialogTrigger>
-			<DialogContent className="max-w-lg">
-				<div className="flex items-center justify-between mb-8">
-					<DialogTitle className="text-2xl font-semibold">
+			<DialogContent className="max-w-lg" showCloseButton={false}>
+				<div className="flex items-center gap-2 mb-8">
+					<DialogTitle className="text-2xl font-semibold mr-auto">
 						Web Server Update
 					</DialogTitle>
 					{dokployVersion && (
-						<div className="flex items-center gap-1.5 rounded-full px-3 py-1 mr-2 bg-muted">
+						<div className="flex items-center gap-1.5 rounded-full px-3 py-1 bg-muted">
 							<Server className="h-4 w-4 text-muted-foreground" />
 							<span className="text-sm text-muted-foreground">
 								{dokployVersion}{" "}
@@ -141,6 +143,12 @@ export const UpdateServer = ({
 							</span>
 						</div>
 					)}
+					<DialogClose asChild>
+						<Button variant="ghost" size="icon-sm" className="shrink-0">
+							<X />
+							<span className="sr-only">Close</span>
+						</Button>
+					</DialogClose>
 				</div>
 
 				{/* Initial state */}

apps/dokploy/components/icons/vault-provider-icons.tsx

@@ -608,6 +608,7 @@ export const vaultProviderIcons = {
 	hashicorp: HashicorpVaultIcon,
 	infisical: InfisicalIcon,
 	aws: AwsIcon,
+	"aws-parameter-store": AwsIcon,
 	doppler: DopplerIcon,
 	azure: AzureIcon,
 	scaleway: ScalewayIcon,

apps/dokploy/components/layouts/dashboard-layout.tsx

@@ -4,7 +4,7 @@ import { useEffect } from "react";
 import { api } from "@/utils/api";
 import { useWhitelabeling } from "@/utils/hooks/use-whitelabeling";
 import { ImpersonationBar } from "../dashboard/impersonation/impersonation-bar";
-import { HubSpotWidget } from "../shared/HubSpotWidget";
+import { useHubSpotChat } from "../shared/analytics";
 import Page from "./side";
 
 interface Props {
@@ -26,6 +26,7 @@ export const DashboardLayout = ({ children, metaName }: Props) => {
 	});
 
 	const isChatEnabled = isCloud === true && currentPlan === "startup";
+	useHubSpotChat(isChatEnabled);
 
 	const { data: onboardingStatus } = api.project.onboardingStatus.useQuery();
 	const shouldRedirectToOnboarding =
@@ -52,12 +53,6 @@ export const DashboardLayout = ({ children, metaName }: Props) => {
 				</Head>
 			)}
 			<Page>{children}</Page>
-			{isChatEnabled && (
-				<>
-					<HubSpotWidget />
-				</>
-			)}
-
 			{haveRootAccess === true && <ImpersonationBar />}
 		</>
 	);

apps/dokploy/components/layouts/side.tsx

@@ -101,6 +101,7 @@ import { authClient } from "@/lib/auth-client";
 import { cn } from "@/lib/utils";
 import type { AppRouter } from "@/server/api/root";
 import { api } from "@/utils/api";
+import { TrialBanner } from "../dashboard/billing/trial-banner";
 import { AddOrganization } from "../dashboard/organization/handle-organization";
 import { DialogAction } from "../shared/dialog-action";
 import { Logo } from "../shared/logo";
@@ -1229,6 +1230,7 @@ export default function Page({ children }: Props) {
 				<SidebarRail />
 			</Sidebar>
 			<SidebarInset>
+				{isCloud === true && <TrialBanner />}
 				{!includesProjects && (
 					<header className="flex h-16 shrink-0 items-center gap-2 transition-[width,height] ease-linear group-has-data-[collapsible=icon]/sidebar-wrapper:h-12">
 						<div className="flex items-center justify-between w-full px-4">

apps/dokploy/components/proprietary/sso/register-oidc-dialog.tsx

@@ -83,6 +83,11 @@ const azureMapping: ClaimMapping = {
 	image: "",
 };
 
+// id: "sub",
+// email: "preferred_username",
+// emailVerified: "email_verified",
+// name: "name",
+
 const genericMapping: ClaimMapping = {
 	id: "sub",
 	email: "email",
@@ -228,10 +233,9 @@ export function RegisterOidcDialog({
 			mapping: {
 				id: oidc?.mapping?.id ?? baseMapping.id,
 				email: oidc?.mapping?.email ?? baseMapping.email,
-				emailVerified:
-					oidc?.mapping?.emailVerified ?? baseMapping.emailVerified,
+				emailVerified: oidc?.mapping?.emailVerified ?? "",
 				name: oidc?.mapping?.name ?? baseMapping.name,
-				image: oidc?.mapping?.image ?? baseMapping.image,
+				image: oidc?.mapping?.image ?? "",
 			},
 		});
 	}, [data, open, form]);

apps/dokploy/components/proprietary/whitelabeling/whitelabeling-settings.tsx

@@ -47,8 +47,8 @@ const formSchema = z.object({
 	docsUrl: safeUrlField,
 	errorPageTitle: z.string(),
 	errorPageDescription: z.string(),
-	metaTitle: z.string(),
 	footerText: z.string(),
+	ogImageUrl: safeUrlField,
 });
 
 type FormSchema = z.infer<typeof formSchema>;
@@ -193,8 +193,8 @@ export function WhitelabelingSettings() {
 			docsUrl: "",
 			errorPageTitle: "",
 			errorPageDescription: "",
-			metaTitle: "",
 			footerText: "",
+			ogImageUrl: "",
 		},
 		resolver: zodResolver(formSchema),
 	});
@@ -212,8 +212,8 @@ export function WhitelabelingSettings() {
 				docsUrl: data.docsUrl ?? "",
 				errorPageTitle: data.errorPageTitle ?? "",
 				errorPageDescription: data.errorPageDescription ?? "",
-				metaTitle: data.metaTitle ?? "",
 				footerText: data.footerText ?? "",
+				ogImageUrl: data.ogImageUrl ?? "",
 			});
 		}
 	}, [data, form]);
@@ -242,8 +242,8 @@ export function WhitelabelingSettings() {
 				docsUrl: values.docsUrl || null,
 				errorPageTitle: values.errorPageTitle || null,
 				errorPageDescription: values.errorPageDescription || null,
-				metaTitle: values.metaTitle || null,
 				footerText: values.footerText || null,
+				ogImageUrl: values.ogImageUrl || null,
 			},
 		})
 			.then(async () => {
@@ -388,6 +388,27 @@ export function WhitelabelingSettings() {
 									</FormItem>
 								)}
 							/>
+
+							<FormField
+								control={form.control}
+								name="ogImageUrl"
+								render={({ field }) => (
+									<FormItem>
+										<FormLabel>OG Image URL</FormLabel>
+										<FormControl>
+											<Input
+												placeholder="https://example.com/og.png"
+												{...field}
+											/>
+										</FormControl>
+										<FormDescription>
+											Open Graph image used for link previews on social media
+											and messaging platforms. Recommended size: 1200x630px.
+										</FormDescription>
+										<FormMessage />
+									</FormItem>
+								)}
+							/>
 						</CardContent>
 					</Card>
 
@@ -441,32 +462,15 @@ export function WhitelabelingSettings() {
 						</CardContent>
 					</Card>
 
-					{/* Metadata & Links Section */}
+					{/* Links Section */}
 					<Card className="bg-transparent">
 						<CardHeader>
-							<CardTitle>Metadata & Links</CardTitle>
+							<CardTitle>Links</CardTitle>
 							<CardDescription>
-								Customize the page title, footer text, and sidebar links.
+								Customize the footer text and sidebar links.
 							</CardDescription>
 						</CardHeader>
 						<CardContent className="flex flex-col gap-4">
-							<FormField
-								control={form.control}
-								name="metaTitle"
-								render={({ field }) => (
-									<FormItem>
-										<FormLabel>Page Title</FormLabel>
-										<FormControl>
-											<Input placeholder="Dokploy" {...field} />
-										</FormControl>
-										<FormDescription>
-											Browser tab title. Defaults to "Dokploy" if empty.
-										</FormDescription>
-										<FormMessage />
-									</FormItem>
-								)}
-							/>
-
 							<FormField
 								control={form.control}
 								name="footerText"

apps/dokploy/components/shared/HubSpotWidget.tsx

@@ -1,14 +0,0 @@
-import Script from "next/script";
-
-export const HubSpotWidget = () => {
-	return (
-		<Script
-			id="hs-script-loader"
-			type="text/javascript"
-			src="//js-eu1.hs-scripts.com/147033433.js"
-			strategy="lazyOnload"
-			async
-			defer
-		/>
-	);
-};

apps/dokploy/components/shared/analytics.tsx

@@ -92,5 +92,11 @@ export const useHubSpotChat = (enabled: boolean) => {
 				loadWidget,
 			];
 		}
+		return () => {
+			window.hsConversationsOnReady = window.hsConversationsOnReady?.filter(
+				(callback) => callback !== loadWidget,
+			);
+			window.HubSpotConversations?.widget.remove();
+		};
 	}, [enabled]);
 };

apps/dokploy/drizzle/0193_chemical_the_liberteens.sql

@@ -0,0 +1 @@
+ALTER TYPE "public"."VaultProviderType" ADD VALUE 'aws-parameter-store' BEFORE 'doppler';

apps/dokploy/drizzle/0194_acoustic_prima.sql

@@ -0,0 +1 @@
+ALTER TABLE "sso_provider" ADD COLUMN "domain_verified" boolean DEFAULT true NOT NULL;

apps/dokploy/drizzle/0195_classy_whirlwind.sql

@@ -0,0 +1 @@
+ALTER TABLE "webServerSettings" ALTER COLUMN "whitelabelingConfig" SET DEFAULT '{"appName":null,"appDescription":null,"logoUrl":null,"faviconUrl":null,"customCss":null,"loginLogoUrl":null,"supportUrl":null,"docsUrl":null,"errorPageTitle":null,"errorPageDescription":null,"footerText":null,"ogImageUrl":null}'::jsonb;

apps/dokploy/drizzle/meta/_journal.json

@@ -1352,6 +1352,27 @@
       "when": 1788600069255,
       "tag": "0192_light_lake",
       "breakpoints": true
+    },
+    {
+      "idx": 193,
+      "version": "7",
+      "when": 1788802431830,
+      "tag": "0193_chemical_the_liberteens",
+      "breakpoints": true
+    },
+    {
+      "idx": 194,
+      "version": "7",
+      "when": 1788858506799,
+      "tag": "0194_acoustic_prima",
+      "breakpoints": true
+    },
+    {
+      "idx": 195,
+      "version": "7",
+      "when": 1788867370653,
+      "tag": "0195_classy_whirlwind",
+      "breakpoints": true
     }
   ]
 }

apps/dokploy/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "dokploy",
-	"version": "v0.30.5",
+	"version": "v0.30.8",
 	"private": true,
 	"license": "Apache-2.0",
 	"type": "module",
@@ -50,6 +50,7 @@
 		"@ai-sdk/openai-compatible": "^2.0.30",
 		"@aws-sdk/client-route-53": "^3.1108.0",
 		"@aws-sdk/client-secrets-manager": "^3.1108.0",
+		"@aws-sdk/client-ssm": "3.1108.0",
 		"@better-auth/api-key": "1.6.23",
 		"@better-auth/passkey": "1.6.23",
 		"@better-auth/scim": "1.6.23",

apps/dokploy/pages/_document.tsx

@@ -9,17 +9,31 @@ import NextDocument, {
 } from "next/document";
 
 interface WhitelabelingDocumentProps {
-	metaTitle: string | null;
+	appName: string | null;
+	appDescription: string | null;
+	ogImageUrl: string | null;
 	faviconHref: string | null;
 	customCss: string | null;
+	baseUrl: string;
 }
 
 export default function Document({
-	metaTitle,
+	appName,
+	appDescription,
+	ogImageUrl,
 	faviconHref,
 	customCss,
+	baseUrl,
 }: WhitelabelingDocumentProps) {
-	const title = metaTitle || "Dokploy";
+	const title = appName || "Dokploy";
+	const description =
+		appDescription || "The Open Source alternative to Netlify, Vercel, Heroku.";
+
+	let ogImage = ogImageUrl || "/og.png";
+	if (ogImage.startsWith("/")) {
+		ogImage = `${baseUrl}${ogImage}`;
+	}
+
 	return (
 		<Html lang="en" className="font-sans">
 			<Head>
@@ -27,6 +41,9 @@ export default function Document({
 				    paint (and for social scrapers), avoiding a flash of / fallback to
 				    the default Dokploy branding. */}
 				<title>{title}</title>
+				<meta property="og:title" content={title} />
+				<meta property="og:description" content={description} />
+				<meta property="og:image" content={ogImage} />
 				<link rel="icon" href={faviconHref || "/icon.svg"} />
 				{customCss && (
 					<style
@@ -48,7 +65,9 @@ const SETTINGS_CACHE_TTL = 60 * 1000; // 1 minute
 declare global {
 	var __SETTINGS_CACHE: {
 		data: {
-			metaTitle: string | null;
+			appName: string | null;
+			appDescription: string | null;
+			ogImageUrl: string | null;
 			faviconHref: string | null;
 			customCss: string | null;
 		};
@@ -61,10 +80,16 @@ Document.getInitialProps = async (
 ): Promise<DocumentInitialProps & WhitelabelingDocumentProps> => {
 	const initialProps = await NextDocument.getInitialProps(ctx);
 
-	let metaTitle: string | null = null;
+	let appName: string | null = null;
+	let appDescription: string | null = null;
+	let ogImageUrl: string | null = null;
 	let faviconHref: string | null = null;
 	let customCss: string | null = null;
 
+	const host = ctx.req?.headers?.host || "localhost:3000";
+	const protocol = ctx.req?.headers?.["x-forwarded-proto"] || "http";
+	const baseUrl = `${protocol}://${host}`;
+
 	if (
 		globalThis.__SETTINGS_CACHE &&
 		globalThis.__SETTINGS_CACHE.expiresAt > Date.now() &&
@@ -73,13 +98,16 @@ Document.getInitialProps = async (
 		return {
 			...initialProps,
 			...globalThis.__SETTINGS_CACHE.data,
+			baseUrl,
 		};
 	}
 
 	try {
 		const config = await getPublicWhitelabelingConfig();
 		if (config) {
-			metaTitle = config.metaTitle;
+			appName = config.appName;
+			appDescription = config.appDescription;
+			ogImageUrl = config.ogImageUrl;
 			// Remove any </style> tags to prevent XSS breakout
 			customCss = config.customCss
 				? config.customCss.replace(/<\/\s*style[^>]*>/gi, "")
@@ -92,7 +120,9 @@ Document.getInitialProps = async (
 
 	globalThis.__SETTINGS_CACHE = {
 		data: {
-			metaTitle,
+			appName,
+			appDescription,
+			ogImageUrl,
 			faviconHref,
 			customCss,
 		},
@@ -101,8 +131,11 @@ Document.getInitialProps = async (
 
 	return {
 		...initialProps,
-		metaTitle,
+		appName,
+		appDescription,
+		ogImageUrl,
 		faviconHref,
 		customCss,
+		baseUrl,
 	};
 };

apps/dokploy/pages/api/stripe/webhook.ts

@@ -9,6 +9,7 @@ import {
 	sendInvoiceEmail,
 	sendPaymentFailedEmail,
 } from "@/server/utils/stripe-notifications";
+import { sendTrialExpiringEmail } from "@/server/utils/trial-notifications";
 
 const endpointSecret = process.env.STRIPE_WEBHOOK_SECRET!;
 
@@ -72,6 +73,7 @@ export default async function handler(
 		"invoice.payment_failed",
 		"customer.deleted",
 		"checkout.session.completed",
+		"customer.subscription.trial_will_end",
 	];
 
 	if (!webhooksAllowed.includes(event.type)) {
@@ -110,6 +112,12 @@ export default async function handler(
 			await updateServersBasedOnQuantity(admin.id, newServersQuantity);
 			break;
 		}
+		case "customer.subscription.trial_will_end": {
+			const trialingSubscription = event.data.object as Stripe.Subscription;
+
+			await sendTrialExpiringEmail(stripe, trialingSubscription, event.created);
+			break;
+		}
 		case "customer.subscription.created": {
 			const newSubscription = event.data.object as Stripe.Subscription;
 
@@ -176,7 +184,10 @@ export default async function handler(
 				break;
 			}
 
-			if (newSubscription.status === "active") {
+			if (
+				newSubscription.status === "active" ||
+				newSubscription.status === "trialing"
+			) {
 				const serversQuantity = getSubscriptionServersQuantity(
 					newSubscription?.items?.data ?? [],
 				);
@@ -209,9 +220,12 @@ export default async function handler(
 		case "invoice.payment_succeeded": {
 			const newInvoice = event.data.object as Stripe.Invoice;
 
-			const subscription = await stripe.subscriptions.retrieve(
-				newInvoice.subscription as string,
-			);
+			const subscriptionId = getInvoiceSubscriptionId(newInvoice);
+			if (!subscriptionId) {
+				break;
+			}
+
+			const subscription = await stripe.subscriptions.retrieve(subscriptionId);
 
 			if (subscription.status !== "active") {
 				console.log(
@@ -220,6 +234,14 @@ export default async function handler(
 				break;
 			}
 
+			const admin = await findUserByStripeCustomerId(
+				subscription.customer as string,
+			);
+
+			if (!admin) {
+				return res.status(400).send("Webhook Error: Admin not found");
+			}
+
 			const serversQuantity = getSubscriptionServersQuantity(
 				subscription?.items?.data ?? [],
 			);
@@ -233,18 +255,10 @@ export default async function handler(
 					),
 				);
 
-			const admin = await findUserByStripeCustomerId(
-				subscription.customer as string,
-			);
-
-			if (!admin) {
-				return res.status(400).send("Webhook Error: Admin not found");
-			}
 			if (admin.isEnterpriseCloud) {
 				break;
 			}
-			const newServersQuantity = admin.serversQuantity;
-			await updateServersBasedOnQuantity(admin.id, newServersQuantity);
+			await updateServersBasedOnQuantity(admin.id, serversQuantity);
 
 			if (admin.sendInvoiceNotifications) {
 				await sendInvoiceEmail(newInvoice, admin);
@@ -255,9 +269,12 @@ export default async function handler(
 		case "invoice.payment_failed": {
 			const newInvoice = event.data.object as Stripe.Invoice;
 
-			const subscription = await stripe.subscriptions.retrieve(
-				newInvoice.subscription as string,
-			);
+			const subscriptionId = getInvoiceSubscriptionId(newInvoice);
+			if (!subscriptionId) {
+				break;
+			}
+
+			const subscription = await stripe.subscriptions.retrieve(subscriptionId);
 			if (subscription.status !== "active") {
 				const admin = await findUserByStripeCustomerId(
 					newInvoice.customer as string,
@@ -351,6 +368,12 @@ const findUserByStripeCustomerId = async (stripeCustomerId: string) => {
 	return userResult;
 };
 
+const getInvoiceSubscriptionId = (invoice: Stripe.Invoice): string | null => {
+	const subscription = invoice.subscription;
+	if (typeof subscription === "string") return subscription;
+	return subscription?.id ?? null;
+};
+
 const activateServer = async (serverId: string) => {
 	await db
 		.update(server)

apps/dokploy/server/api/routers/proprietary/whitelabeling.ts

@@ -85,7 +85,7 @@ export const whitelabelingRouter = createTRPCRouter({
 				docsUrl: null,
 				errorPageTitle: null,
 				errorPageDescription: null,
-				metaTitle: null,
+				ogImageUrl: null,
 				footerText: null,
 			},
 		});

apps/dokploy/server/api/routers/stripe.ts

@@ -12,7 +12,7 @@ import {
 	getCurrentPlan as getCurrentPlanForOrganization,
 	getStripeClient,
 	TRIAL_DURATION_DAYS,
-	TRIAL_SERVER_LIMIT,
+	TRIAL_SERVER_LIMITS,
 } from "@/server/utils/billing";
 import {
 	type BillingTier,
@@ -45,72 +45,82 @@ export const stripeRouter = createTRPCRouter({
 		return getBillingStatus(ctx.user.ownerId);
 	}),
 
-	startFreeTrial: adminProcedure.mutation(async ({ ctx }) => {
-		if (!IS_CLOUD) {
-			throw new TRPCError({
-				code: "BAD_REQUEST",
-				message: "This feature is only available in Dokploy Cloud",
-			});
-		}
-
-		if (!HOBBY_PRICE_MONTHLY_ID) {
-			throw new TRPCError({
-				code: "INTERNAL_SERVER_ERROR",
-				message: "Trials are not configured",
-			});
-		}
-
-		const owner = await findUserById(ctx.user.ownerId);
-		const billingStatus = await getBillingStatus(owner.id);
-
-		if (billingStatus.hasActiveAccess) {
-			throw new TRPCError({
-				code: "BAD_REQUEST",
-				message: "You already have an active plan or trial",
-			});
-		}
-
-		if (billingStatus.hasUsedTrial) {
-			throw new TRPCError({
-				code: "BAD_REQUEST",
-				message: "You have already used your free trial",
-			});
-		}
-
-		const stripe = getStripeClient();
-
-		let stripeCustomerId = owner.stripeCustomerId;
-		if (stripeCustomerId) {
-			const customer = await stripe.customers.retrieve(stripeCustomerId);
-			if (customer.deleted) {
-				stripeCustomerId = null;
+	startFreeTrial: adminProcedure
+		.input(z.object({ tier: z.enum(["hobby", "startup"]) }))
+		.mutation(async ({ ctx, input }) => {
+			if (!IS_CLOUD) {
+				throw new TRPCError({
+					code: "BAD_REQUEST",
+					message: "This feature is only available in Dokploy Cloud",
+				});
 			}
-		}
-		if (!stripeCustomerId) {
-			const customer = await stripe.customers.create({ email: owner.email });
-			stripeCustomerId = customer.id;
-		}
 
-		const subscription = await stripe.subscriptions.create({
-			customer: stripeCustomerId,
-			items: [{ price: HOBBY_PRICE_MONTHLY_ID, quantity: 1 }],
-			trial_period_days: TRIAL_DURATION_DAYS,
-			trial_settings: { end_behavior: { missing_payment_method: "cancel" } },
-			metadata: { source: "onboarding_trial", adminId: owner.id },
-		});
+			const trialPriceId =
+				input.tier === "startup"
+					? STARTUP_BASE_PRICE_MONTHLY_ID
+					: HOBBY_PRICE_MONTHLY_ID;
+			if (!trialPriceId) {
+				throw new TRPCError({
+					code: "INTERNAL_SERVER_ERROR",
+					message: "Trials are not configured",
+				});
+			}
 
-		await updateUser(owner.id, {
-			stripeCustomerId,
-			stripeSubscriptionId: subscription.id,
-			serversQuantity: TRIAL_SERVER_LIMIT,
-		});
+			const owner = await findUserById(ctx.user.ownerId);
+			const billingStatus = await getBillingStatus(owner.id);
 
-		return {
-			trialEndsAt: subscription.trial_end
-				? new Date(subscription.trial_end * 1000)
-				: null,
-		};
-	}),
+			if (billingStatus.hasActiveAccess) {
+				throw new TRPCError({
+					code: "BAD_REQUEST",
+					message: "You already have an active plan or trial",
+				});
+			}
+
+			if (billingStatus.hasUsedTrial) {
+				throw new TRPCError({
+					code: "BAD_REQUEST",
+					message: "You have already used your free trial",
+				});
+			}
+
+			const stripe = getStripeClient();
+
+			let stripeCustomerId = owner.stripeCustomerId;
+			if (stripeCustomerId) {
+				const customer = await stripe.customers.retrieve(stripeCustomerId);
+				if (customer.deleted) {
+					stripeCustomerId = null;
+				}
+			}
+			if (!stripeCustomerId) {
+				const customer = await stripe.customers.create({ email: owner.email });
+				stripeCustomerId = customer.id;
+			}
+
+			const subscription = await stripe.subscriptions.create({
+				customer: stripeCustomerId,
+				items: [{ price: trialPriceId, quantity: 1 }],
+				trial_period_days: TRIAL_DURATION_DAYS,
+				trial_settings: { end_behavior: { missing_payment_method: "cancel" } },
+				metadata: {
+					source: "onboarding_trial",
+					adminId: owner.id,
+					tier: input.tier,
+				},
+			});
+
+			await updateUser(owner.id, {
+				stripeCustomerId,
+				stripeSubscriptionId: subscription.id,
+				serversQuantity: TRIAL_SERVER_LIMITS[input.tier],
+			});
+
+			return {
+				trialEndsAt: subscription.trial_end
+					? new Date(subscription.trial_end * 1000)
+					: null,
+			};
+		}),
 
 	getProducts: adminProcedure.query(async ({ ctx }) => {
 		const user = await findUserById(ctx.user.ownerId);
@@ -343,9 +353,15 @@ export const stripeRouter = createTRPCRouter({
 				});
 			}
 
+			const isTrialing = subscription.status === "trialing";
+			// Trials are capped at the plan's included servers; paid plans can scale.
+			const serverQuantity = isTrialing
+				? TRIAL_SERVER_LIMITS[input.tier]
+				: input.serverQuantity;
+
 			const newItems = getStripeItems(
 				input.tier as BillingTier,
-				input.serverQuantity,
+				serverQuantity,
 				input.isAnnual,
 			);
 			const currentItems = subscription.items.data;
@@ -371,7 +387,7 @@ export const stripeRouter = createTRPCRouter({
 
 			await stripe.subscriptions.update(owner.stripeSubscriptionId, {
 				items: updateItems,
-				proration_behavior: "create_prorations",
+				proration_behavior: isTrialing ? "none" : "create_prorations",
 			});
 
 			return { ok: true };

apps/dokploy/server/utils/billing.ts

@@ -16,7 +16,7 @@ export const getStripeClient = () =>
 		apiVersion: "2024-09-30.acacia",
 	});
 
-const planFromPriceIds = (priceIds: string[]): BillingPlan | null => {
+export const planFromPriceIds = (priceIds: string[]): BillingPlan | null => {
 	if (
 		priceIds.some(
 			(id) =>
@@ -77,8 +77,12 @@ export const getCurrentPlan = async (
 	return getCurrentPlanForUser(ownerId);
 };
 
-export const TRIAL_DURATION_DAYS = 14;
-export const TRIAL_SERVER_LIMIT = 1;
+export const TRIAL_DURATION_DAYS = 7;
+export type TrialTier = "hobby" | "startup";
+export const TRIAL_SERVER_LIMITS: Record<TrialTier, number> = {
+	hobby: 1,
+	startup: 3,
+};
 
 export interface BillingStatus {
 	plan: BillingPlan | null;
@@ -87,6 +91,7 @@ export interface BillingStatus {
 	trialDaysRemaining: number | null;
 	hasUsedTrial: boolean;
 	hasActiveAccess: boolean;
+	hasPaymentMethod: boolean;
 }
 
 export const getBillingStatus = async (
@@ -100,6 +105,7 @@ export const getBillingStatus = async (
 			trialDaysRemaining: null,
 			hasUsedTrial: false,
 			hasActiveAccess: true,
+			hasPaymentMethod: true,
 		};
 	}
 
@@ -112,6 +118,7 @@ export const getBillingStatus = async (
 			trialDaysRemaining: null,
 			hasUsedTrial: false,
 			hasActiveAccess: false,
+			hasPaymentMethod: false,
 		};
 	}
 
@@ -119,7 +126,7 @@ export const getBillingStatus = async (
 	const subscriptions = await stripe.subscriptions.list({
 		customer: owner.stripeCustomerId,
 		status: "all",
-		expand: ["data.items.data.price"],
+		expand: ["data.items.data.price", "data.customer"],
 	});
 
 	const relevantSubs = subscriptions.data.filter(
@@ -133,6 +140,12 @@ export const getBillingStatus = async (
 	const trialingSub = subscriptions.data.find(
 		(sub) => sub.status === "trialing",
 	);
+
+	const currentSub = trialingSub ?? relevantSubs[0];
+	const customer = currentSub?.customer as Stripe.Customer | undefined;
+	const hasPaymentMethod =
+		!!currentSub?.default_payment_method ||
+		!!customer?.invoice_settings?.default_payment_method;
 	const trialEndsAt = trialingSub?.trial_end
 		? new Date(trialingSub.trial_end * 1000)
 		: null;
@@ -148,6 +161,7 @@ export const getBillingStatus = async (
 		isOnTrial: !!trialingSub,
 		trialEndsAt,
 		trialDaysRemaining,
+		hasPaymentMethod,
 		hasUsedTrial: subscriptions.data.length > 0,
 		hasActiveAccess: plan !== null || !!trialingSub,
 	};

apps/dokploy/server/utils/trial-notifications.ts

@@ -0,0 +1,78 @@
+import { db } from "@dokploy/server/db";
+import TrialExpiringEmail from "@dokploy/server/emails/emails/trial-expiring";
+import { sendEmail } from "@dokploy/server/verification/send-verification-email";
+import { render } from "@react-email/components";
+import { format } from "date-fns";
+import { eq } from "drizzle-orm";
+import type Stripe from "stripe";
+import { user } from "@/server/db/schema";
+import { planFromPriceIds } from "@/server/utils/billing";
+import { WEBSITE_URL } from "@/server/utils/stripe";
+
+const PLAN_LABELS: Record<string, string> = {
+	hobby: "Hobby",
+	startup: "Startup",
+	legacy: "Legacy",
+};
+
+const customerIdOf = (subscription: Stripe.Subscription) =>
+	typeof subscription.customer === "string"
+		? subscription.customer
+		: subscription.customer.id;
+
+const hasPaymentMethod = async (
+	stripe: Stripe,
+	subscription: Stripe.Subscription,
+) => {
+	if (subscription.default_payment_method) return true;
+
+	const customer = await stripe.customers.retrieve(customerIdOf(subscription));
+	if (customer.deleted) return true;
+	return !!customer.invoice_settings?.default_payment_method;
+};
+
+export const sendTrialExpiringEmail = async (
+	stripe: Stripe,
+	subscription: Stripe.Subscription,
+	// Stripe retries a failing webhook for days, so the countdown is measured
+	// from when Stripe emitted the event rather than from the current time.
+	notifiedAtSeconds: number,
+) => {
+	if (!subscription.trial_end) return false;
+	if (await hasPaymentMethod(stripe, subscription)) return false;
+
+	const owner = await db.query.user.findFirst({
+		where: eq(user.stripeCustomerId, customerIdOf(subscription)),
+	});
+	if (!owner || owner.isEnterpriseCloud) return false;
+
+	const trialEndsAt = new Date(subscription.trial_end * 1000);
+	const daysRemaining = Math.max(
+		1,
+		Math.ceil((subscription.trial_end - notifiedAtSeconds) / (60 * 60 * 24)),
+	);
+	const plan = planFromPriceIds(
+		subscription.items.data.map((item) => (item.price as Stripe.Price).id),
+	);
+
+	const htmlContent = await render(
+		TrialExpiringEmail({
+			userName: owner.firstName || "User",
+			planName: plan ? (PLAN_LABELS[plan] ?? plan) : "Trial",
+			daysRemaining,
+			endsOn: format(trialEndsAt, "MMM dd, yyyy"),
+			billingUrl: `${WEBSITE_URL}/dashboard/settings/billing`,
+		}),
+	);
+
+	await sendEmail({
+		email: owner.email,
+		subject:
+			daysRemaining === 1
+				? "Your Dokploy trial ends tomorrow"
+				: `Your Dokploy trial ends in ${daysRemaining} days`,
+		text: htmlContent,
+	});
+
+	return true;
+};

packages/server/auth-schema2.ts

@@ -135,6 +135,7 @@ export const ssoProvider = pgTable("sso_provider", {
 	providerId: text("provider_id").notNull().unique(),
 	organizationId: text("organization_id"),
 	domain: text("domain").notNull(),
+	domainVerified: boolean("domain_verified"),
 });
 
 export const twoFactor = pgTable(
@@ -156,6 +157,29 @@ export const twoFactor = pgTable(
 	],
 );
 
+export const passkey = pgTable(
+	"passkey",
+	{
+		id: text("id").primaryKey(),
+		name: text("name"),
+		publicKey: text("public_key").notNull(),
+		userId: text("user_id")
+			.notNull()
+			.references(() => user.id, { onDelete: "cascade" }),
+		credentialID: text("credential_id").notNull(),
+		counter: integer("counter").notNull(),
+		deviceType: text("device_type").notNull(),
+		backedUp: boolean("backed_up").notNull(),
+		transports: text("transports"),
+		createdAt: timestamp("created_at"),
+		aaguid: text("aaguid"),
+	},
+	(table) => [
+		index("passkey_userId_idx").on(table.userId),
+		index("passkey_credentialID_idx").on(table.credentialID),
+	],
+);
+
 export const organization = pgTable(
 	"organization",
 	{
@@ -242,6 +266,7 @@ export const userRelations = relations(user, ({ many }) => ({
 	accounts: many(account),
 	ssoProviders: many(ssoProvider),
 	twoFactors: many(twoFactor),
+	passkeys: many(passkey),
 	members: many(member),
 	invitations: many(invitation),
 }));
@@ -274,6 +299,13 @@ export const twoFactorRelations = relations(twoFactor, ({ one }) => ({
 	}),
 }));
 
+export const passkeyRelations = relations(passkey, ({ one }) => ({
+	user: one(user, {
+		fields: [passkey.userId],
+		references: [user.id],
+	}),
+}));
+
 export const organizationRelations = relations(organization, ({ many }) => ({
 	organizationRoles: many(organizationRole),
 	members: many(member),

packages/server/package.json

@@ -39,6 +39,7 @@
     "@ai-sdk/openai-compatible": "^2.0.30",
     "@aws-sdk/client-route-53": "^3.1108.0",
     "@aws-sdk/client-secrets-manager": "^3.1108.0",
+    "@aws-sdk/client-ssm": "3.1108.0",
     "@better-auth/api-key": "1.6.23",
     "@better-auth/passkey": "1.6.23",
     "@better-auth/scim": "1.6.23",

packages/server/src/db/schema/sso.ts

@@ -1,5 +1,5 @@
 import { relations } from "drizzle-orm";
-import { pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { boolean, pgTable, text, timestamp } from "drizzle-orm/pg-core";
 import { z } from "zod";
 import { organization } from "./account";
 import { user } from "./user";
@@ -15,6 +15,7 @@ export const ssoProvider = pgTable("sso_provider", {
 		onDelete: "cascade",
 	}),
 	domain: text("domain").notNull(),
+	domainVerified: boolean("domain_verified").notNull().default(true),
 	createdAt: timestamp("created_at").notNull().defaultNow(),
 });
 

packages/server/src/db/schema/vault-provider.ts

@@ -8,6 +8,7 @@ export const vaultProviderType = pgEnum("VaultProviderType", [
 	"hashicorp",
 	"infisical",
 	"aws",
+	"aws-parameter-store",
 	"doppler",
 	"azure",
 	"scaleway",
@@ -40,6 +41,21 @@ export const awsVaultConfigSchema = z.object({
 	endpoint: z.string().url().optional(),
 });
 
+export const awsParameterStoreVaultConfigSchema = z.object({
+	providerType: z.literal("aws-parameter-store"),
+	region: z.string().min(1),
+	accessKeyId: z.string().min(1),
+	secretAccessKey: z.string().min(1),
+	endpoint: z.string().url().optional(),
+	parameterPath: z
+		.string()
+		.trim()
+		.refine((path) => path === "" || path.startsWith("/"), {
+			message: "Parameter discovery path must start with /",
+		})
+		.optional(),
+});
+
 export const dopplerVaultConfigSchema = z.object({
 	providerType: z.literal("doppler"),
 	serviceToken: z.string().min(1),
@@ -76,6 +92,7 @@ export const vaultProviderConfigSchema = z.discriminatedUnion("providerType", [
 	hashicorpVaultConfigSchema,
 	infisicalVaultConfigSchema,
 	awsVaultConfigSchema,
+	awsParameterStoreVaultConfigSchema,
 	dopplerVaultConfigSchema,
 	azureVaultConfigSchema,
 	scalewayVaultConfigSchema,

packages/server/src/db/schema/web-server-settings.ts

@@ -86,8 +86,8 @@ export const webServerSettings = pgTable("webServerSettings", {
 			docsUrl: string | null;
 			errorPageTitle: string | null;
 			errorPageDescription: string | null;
-			metaTitle: string | null;
 			footerText: string | null;
+			ogImageUrl: string | null;
 		}>()
 		.default({
 			appName: null,
@@ -100,8 +100,8 @@ export const webServerSettings = pgTable("webServerSettings", {
 			docsUrl: null,
 			errorPageTitle: null,
 			errorPageDescription: null,
-			metaTitle: null,
 			footerText: null,
+			ogImageUrl: null,
 		}),
 	// Deployment Configuration (self-hosted only)
 	remoteServersOnly: boolean("remoteServersOnly").notNull().default(false),
@@ -223,8 +223,8 @@ export const whitelabelingConfigSchema = z.object({
 	docsUrl: safeUrl,
 	errorPageTitle: z.string().nullable(),
 	errorPageDescription: z.string().nullable(),
-	metaTitle: z.string().nullable(),
 	footerText: z.string().nullable(),
+	ogImageUrl: safeUrl,
 });
 
 export const apiUpdateWhitelabeling = z.object({

packages/server/src/emails/emails/trial-expiring.tsx

@@ -0,0 +1,141 @@
+import {
+	Body,
+	Button,
+	Column,
+	Container,
+	Head,
+	Heading,
+	Hr,
+	Html,
+	Img,
+	Link,
+	Preview,
+	Row,
+	Section,
+	Tailwind,
+	Text,
+} from "@react-email/components";
+import { emailTailwindConfig } from "../tailwind-config";
+
+export type TemplateProps = {
+	userName: string;
+	planName: string;
+	daysRemaining: number;
+	endsOn: string;
+	billingUrl: string;
+};
+
+export const TrialExpiringEmail = ({
+	userName = "User",
+	planName = "Hobby",
+	daysRemaining = 3,
+	endsOn = "2024-01-01",
+	billingUrl = "https://app.dokploy.com/dashboard/settings/billing",
+}: TemplateProps) => {
+	const dayLabel = daysRemaining === 1 ? "day" : "days";
+	const previewText =
+		daysRemaining === 1
+			? "Your Dokploy trial ends tomorrow"
+			: `Your Dokploy trial ends in ${daysRemaining} ${dayLabel}`;
+
+	return (
+		<Html>
+			<Head />
+			<Preview>{previewText}</Preview>
+			<Tailwind config={emailTailwindConfig}>
+				<Body className="bg-[#f4f4f5] my-auto mx-auto font-sans">
+					<Container className="my-[40px] mx-auto max-w-[520px]">
+						<Section className="bg-[#09090b] rounded-t-xl px-[40px] py-[32px] text-center">
+							<Img
+								src="https://raw.githubusercontent.com/Dokploy/website/refs/heads/main/apps/docs/public/logo-dokploy-blackpng.png"
+								width="190"
+								height="120"
+								alt="Dokploy"
+								className="my-0 mx-auto"
+							/>
+						</Section>
+
+						<Section className="bg-white px-[40px] py-[32px]">
+							<Heading className="text-[#09090b] text-[22px] font-semibold m-0 mb-[8px]">
+								{daysRemaining === 1
+									? "Your trial ends tomorrow"
+									: `Your trial ends in ${daysRemaining} ${dayLabel}`}
+							</Heading>
+							<Text className="text-[#71717a] text-[14px] leading-[22px] m-0 mb-[24px]">
+								Hello {userName}, add a payment method to keep your servers and
+								applications running once the trial ends.
+							</Text>
+
+							<Section className="border border-solid border-[#e4e4e7] rounded-lg overflow-hidden mb-[24px]">
+								<Row className="bg-[#fafafa]">
+									<Column className="px-[20px] py-[14px] w-[50%]">
+										<Text className="text-[#71717a] text-[12px] font-medium uppercase tracking-wider m-0">
+											Plan
+										</Text>
+										<Text className="text-[#09090b] text-[14px] font-semibold m-0 mt-[4px]">
+											{planName}
+										</Text>
+									</Column>
+									<Column className="px-[20px] py-[14px] w-[50%]">
+										<Text className="text-[#71717a] text-[12px] font-medium uppercase tracking-wider m-0">
+											Trial ends
+										</Text>
+										<Text className="text-[#09090b] text-[14px] font-semibold m-0 mt-[4px]">
+											{endsOn}
+										</Text>
+									</Column>
+								</Row>
+							</Section>
+
+							<Section className="bg-[#fefce8] border border-solid border-[#fef08a] rounded-lg px-[20px] py-[16px] mb-[24px]">
+								<Text className="text-[#854d0e] text-[13px] leading-[20px] m-0">
+									Without a payment method your subscription is cancelled when
+									the trial ends and your servers are deactivated.
+								</Text>
+							</Section>
+
+							<Section className="text-center mb-[24px]">
+								<Button
+									href={billingUrl}
+									className="bg-[#09090b] rounded-lg text-white text-[14px] font-semibold no-underline text-center px-[24px] py-[12px]"
+								>
+									Add Payment Method
+								</Button>
+							</Section>
+
+							<Hr className="border-[#e4e4e7] my-[24px]" />
+
+							<Text className="text-[#a1a1aa] text-[12px] leading-[18px] m-0">
+								You are billed only when the trial ends. You can cancel at any
+								time before then.
+							</Text>
+						</Section>
+
+						<Section className="bg-[#fafafa] rounded-b-xl px-[40px] py-[24px] text-center border-t border-solid border-[#e4e4e7]">
+							<Text className="text-[#a1a1aa] text-[12px] leading-[18px] m-0">
+								This is an automated email from{" "}
+								<Link
+									href="https://dokploy.com"
+									className="text-[#71717a] underline"
+								>
+									Dokploy Cloud
+								</Link>
+								. If you have any questions about your billing, please contact
+								our{" "}
+								<Link
+									href="https://discord.gg/2tBnJ3jDJc"
+									className="text-[#71717a] underline"
+								>
+									support team
+								</Link>
+								.
+							</Text>
+						</Section>
+					</Container>
+				</Body>
+			</Tailwind>
+		</Html>
+	);
+};
+
+export default TrialExpiringEmail;

packages/server/src/lib/auth-cli.ts

@@ -32,7 +32,12 @@ export const auth = betterAuth({
 	},
 	plugins: [
 		apiKey({ enableMetadata: true, references: "user" }),
-		sso(),
+		sso({
+			trustEmailVerified: true,
+			domainVerification: {
+				enabled: true,
+			},
+		}),
 		twoFactor(),
 		passkey(),
 		organization({

packages/server/src/services/proprietary/whitelabeling.ts

@@ -10,7 +10,7 @@ export interface PublicWhitelabelingConfig {
 	loginLogoUrl: string | null;
 	faviconUrl: string | null;
 	customCss: string | null;
-	metaTitle: string | null;
+	ogImageUrl: string | null;
 	errorPageTitle: string | null;
 	errorPageDescription: string | null;
 	footerText: string | null;
@@ -50,7 +50,7 @@ export const getPublicWhitelabelingConfig =
 			loginLogoUrl: config.loginLogoUrl,
 			faviconUrl: config.faviconUrl,
 			customCss: config.customCss,
-			metaTitle: config.metaTitle,
+			ogImageUrl: config.ogImageUrl,
 			errorPageTitle: config.errorPageTitle,
 			errorPageDescription: config.errorPageDescription,
 			footerText: config.footerText,

packages/server/src/services/server-health.ts

@@ -118,7 +118,9 @@ diskTotal=$(df -B1 / 2>/dev/null | awk 'NR==2{print $2}'); [ -z "$diskTotal" ] &
 diskUsed=$(df -B1 / 2>/dev/null | awk 'NR==2{print $3}'); [ -z "$diskUsed" ] && diskUsed=0
 
 networkCount=$(docker network ls -q 2>/dev/null | wc -l | tr -d ' ')
-daemonConfigB64=$(cat /etc/docker/daemon.json 2>/dev/null | base64 2>/dev/null | tr -d '\\n')
+# /etc/docker/daemon.json isn't mounted into the dokploy container (only docker.sock is), so read
+# the effective config over the socket instead of the file.
+daemonConfigB64=$(docker info --format '{{json .DefaultAddressPools}}' 2>/dev/null | base64 2>/dev/null | tr -d '\\n')
 
 daemonLogsToEpoch=$(date +%s 2>/dev/null); [ -z "$daemonLogsToEpoch" ] && daemonLogsToEpoch=0
 daemonLogsFromEpoch=$((daemonLogsToEpoch - ${sinceHours} * 3600))
@@ -319,11 +321,11 @@ export const getServerHealth = async (
 		.filter(Boolean);
 
 	let addressPools: unknown = null;
-	const daemonConfigText = b64Decode(parsed.daemonConfigBase64);
+	const daemonConfigText = b64Decode(parsed.daemonConfigBase64).trim();
 	if (daemonConfigText) {
 		try {
-			addressPools =
-				JSON.parse(daemonConfigText)?.["default-address-pools"] ?? null;
+			// `docker info` already returns the pools array (or `null`) directly, unlike daemon.json.
+			addressPools = JSON.parse(daemonConfigText) ?? null;
 		} catch {
 			addressPools = null;
 		}

packages/server/src/services/vault-provider.ts

@@ -20,6 +20,7 @@ const SENSITIVE_FIELDS: Record<VaultProviderConfig["providerType"], string[]> =
 		hashicorp: ["token"],
 		infisical: ["clientSecret"],
 		aws: ["secretAccessKey"],
+		"aws-parameter-store": ["secretAccessKey"],
 		doppler: ["serviceToken"],
 		azure: ["clientSecret"],
 		scaleway: ["secretKey"],

packages/server/src/utils/dns/cloudflare.ts

@@ -168,12 +168,34 @@ export const cloudflareClient: DnsClient<CloudflareConfig> = {
 			ttl: record.ttl ?? 1,
 		};
 
-		const existing = await cfFetch<{ id: string }[]>(
+		const existing = await cfFetch<
+			{
+				id: string;
+				type: string;
+				content: string;
+				priority?: number;
+				data?: Record<string, unknown>;
+			}[]
+		>(
 			config,
 			`/zones/${record.zoneId}/dns_records?type=${record.type}&name=${encodeURIComponent(record.name)}`,
 		);
 
-		const existingRecord = existing[0];
+		const built = buildValue(record);
+
+		const existingRecord = existing.find((r) => {
+			if (built.data) {
+				return Object.entries(built.data).every(
+					([k, v]) => r.data && r.data[k] === v,
+				);
+			}
+			const normalizedRecord = {
+				type: record.type,
+				content: built.content ?? record.content.trim(),
+				priority: built.priority,
+			};
+			return inlinePriority(r) === inlinePriority(normalizedRecord);
+		});
 		if (existingRecord) {
 			const updated = await cfFetch<{ id: string }>(
 				config,

packages/server/src/utils/dns/infomaniak.ts

@@ -148,6 +148,34 @@ const listZoneRecords = async (config: InfomaniakConfig, zoneId: string) =>
 		`/2/zones/${encodeURIComponent(zoneId)}/records?with=records_description`,
 	);
 
+// The API filters server-side, which avoids pulling a whole zone just to find
+// one record. The match is still checked here: filter[source] is documented with
+// a bare subdomain example, so nothing guarantees it compares exactly the way
+// toSource writes the apex, and a filter that silently over-matches would
+// otherwise turn an update into a duplicate.
+const findRecord = async (
+	config: InfomaniakConfig,
+	zoneId: string,
+	type: string,
+	source: string,
+	expectedContent: string,
+) => {
+	const query = new URLSearchParams({
+		"filter[source]": source,
+		"filter[types][]": type,
+	});
+	const candidates = await ikFetch<InfomaniakRecord[]>(
+		config,
+		`/2/zones/${encodeURIComponent(zoneId)}/records?${query}`,
+	);
+	return candidates.find(
+		(candidate) =>
+			candidate.type === type &&
+			normalizeSource(candidate.source) === source &&
+			unquoteTarget(candidate.target) === expectedContent,
+	);
+};
+
 export const infomaniakClient: DnsClient<InfomaniakConfig> = {
 	async listZones(config) {
 		const domains = await listDomainProducts(config);
@@ -171,11 +199,15 @@ export const infomaniakClient: DnsClient<InfomaniakConfig> = {
 
 	async upsertRecord(config, record) {
 		const source = toSource(record.name, record.zoneId);
-		const existing = await listZoneRecords(config, record.zoneId);
-		const match = existing.find(
-			(candidate) =>
-				candidate.type === record.type &&
-				normalizeSource(candidate.source) === source,
+		const expectedContent = unquoteTarget(
+			quoteTarget(record.type, record.content),
+		);
+		const match = await findRecord(
+			config,
+			record.zoneId,
+			record.type,
+			source,
+			expectedContent,
 		);
 
 		const body = JSON.stringify(recordPayload(record, record.zoneId));

packages/server/src/utils/dns/ovh.ts

@@ -285,7 +285,18 @@ export const ovhClient: DnsClient<OvhConfig> = {
 			)}&subDomain=${encodeURIComponent(subDomain)}`,
 		);
 
-		const existingId = existing[0];
+		let existingId: number | undefined;
+		for (const id of existing) {
+			const candidate = await ovhFetch<OvhRecord>(
+				config,
+				`/domain/zone/${zone}/record/${id}`,
+			);
+			if (candidate.target === record.content) {
+				existingId = id;
+				break;
+			}
+		}
+
 		if (existingId !== undefined) {
 			await ovhFetch(config, `/domain/zone/${zone}/record/${existingId}`, {
 				method: "PUT",

packages/server/src/utils/dns/porkbun.ts

@@ -56,6 +56,26 @@ interface PorkbunRecord {
 	notes: string;
 }
 
+const inlinePriority = (record: {
+	type: string;
+	content: string;
+	prio?: string | null;
+}) =>
+	(record.type === "MX" || record.type === "SRV") && record.prio != null
+		? `${record.prio} ${record.content}`
+		: record.content;
+
+const buildValue = (record: { type: string; content: string }) => {
+	const value = record.content.trim();
+	if (record.type === "MX" || record.type === "SRV") {
+		const match = /^(\d+)\s+(\S.*)$/.exec(value);
+		if (match) {
+			return { content: match[2] as string, prio: match[1] as string };
+		}
+	}
+	return { content: value };
+};
+
 export const porkbunClient: DnsClient<PorkbunConfig> = {
 	async listZones(config) {
 		const result = await pbFetch<{ domains: { domain: string }[] }>(
@@ -77,7 +97,7 @@ export const porkbunClient: DnsClient<PorkbunConfig> = {
 			id: record.id,
 			type: record.type,
 			name: record.name,
-			content: record.content,
+			content: inlinePriority(record),
 			ttl: Number(record.ttl),
 		}));
 	},
@@ -89,14 +109,24 @@ export const porkbunClient: DnsClient<PorkbunConfig> = {
 			`/dns/retrieveByNameType/${record.zoneId}/${record.type}/${subdomain}`,
 		);
 
+		const built = buildValue(record);
 		const payload = {
 			name: subdomain,
 			type: record.type,
-			content: record.content,
+			content: built.content,
+			...(built.prio ? { prio: built.prio } : {}),
 			ttl: record.ttl ?? 600,
 		};
 
-		const existingRecord = existing.records[0];
+		const expectedContent = inlinePriority({
+			type: record.type,
+			content: built.content,
+			prio: built.prio,
+		});
+
+		const existingRecord = existing.records.find(
+			(r) => inlinePriority(r) === expectedContent,
+		);
 		if (existingRecord) {
 			await pbFetch(
 				config,
@@ -115,10 +145,12 @@ export const porkbunClient: DnsClient<PorkbunConfig> = {
 	},
 
 	async updateRecord(config, zoneId, recordId, record) {
+		const built = buildValue(record);
 		await pbFetch(config, `/dns/edit/${zoneId}/${recordId}`, {
 			name: toSubdomain(record.name, zoneId),
 			type: record.type,
-			content: record.content,
+			content: built.content,
+			...(built.prio ? { prio: built.prio } : {}),
 			ttl: record.ttl ?? 600,
 		});
 		return { id: recordId };

packages/server/src/utils/vault/aws-parameter-store.ts

@@ -0,0 +1,155 @@
+import {
+	DescribeParametersCommand,
+	GetParametersCommand,
+	paginateDescribeParameters,
+	SSMClient,
+} from "@aws-sdk/client-ssm";
+import type { awsParameterStoreVaultConfigSchema } from "@dokploy/server/db/schema";
+import type { z } from "zod";
+import type { VaultClient } from "./types";
+
+type AwsParameterStoreConfig = z.infer<
+	typeof awsParameterStoreVaultConfigSchema
+>;
+
+const MAX_PARAMETERS_PER_REQUEST = 10;
+
+const normalizeParameterPath = (path: string | undefined) => {
+	const trimmed = path?.trim();
+	if (!trimmed) {
+		return undefined;
+	}
+	if (trimmed === "/") {
+		return trimmed;
+	}
+	return trimmed.replace(/\/+$/, "");
+};
+
+const describeParametersInput = (config: AwsParameterStoreConfig) => {
+	const parameterPath = normalizeParameterPath(config.parameterPath);
+	return parameterPath
+		? {
+				ParameterFilters: [
+					{
+						Key: "Path",
+						Option: "Recursive",
+						Values: [parameterPath],
+					},
+				],
+			}
+		: {};
+};
+
+const isAccessDeniedError = (error: unknown) =>
+	error instanceof Error &&
+	(error.name === "AccessDeniedException" || error.name === "AccessDenied");
+
+const createClient = (config: AwsParameterStoreConfig) =>
+	new SSMClient({
+		region: config.region,
+		credentials: {
+			accessKeyId: config.accessKeyId,
+			secretAccessKey: config.secretAccessKey,
+		},
+		...(config.endpoint && { endpoint: config.endpoint }),
+	});
+
+const findRequestedRef = (
+	refs: string[],
+	parameter: { Name?: string; ARN?: string; Selector?: string },
+) => {
+	const bases = [parameter.Name, parameter.ARN].filter(
+		(value): value is string => Boolean(value),
+	);
+	if (!parameter.Selector) {
+		return refs.find((ref) => bases.includes(ref));
+	}
+
+	const selector = parameter.Name
+		? parameter.Selector.replace(`${parameter.Name}:`, "").replace(/^:/, "")
+		: parameter.Selector.replace(/^:/, "");
+	return refs.find((ref) =>
+		bases.some((base) => ref === `${base}:${selector}`),
+	);
+};
+
+export const awsParameterStoreClient: VaultClient<AwsParameterStoreConfig> = {
+	async getSecrets(config, refs) {
+		const client = createClient(config);
+		const uniqueRefs = [...new Set(refs)];
+		const result: Record<string, string> = {};
+
+		for (
+			let index = 0;
+			index < uniqueRefs.length;
+			index += MAX_PARAMETERS_PER_REQUEST
+		) {
+			const batch = uniqueRefs.slice(index, index + MAX_PARAMETERS_PER_REQUEST);
+			const response = await client.send(
+				new GetParametersCommand({
+					Names: batch,
+					WithDecryption: true,
+				}),
+			);
+
+			for (const parameter of response.Parameters ?? []) {
+				const ref = findRequestedRef(batch, parameter);
+				if (!ref) {
+					continue;
+				}
+				if (parameter.Value === undefined) {
+					throw new Error(
+						`AWS Parameter Store: parameter "${ref}" has no value`,
+					);
+				}
+				result[ref] = parameter.Value;
+			}
+		}
+
+		for (const ref of uniqueRefs) {
+			if (result[ref] === undefined) {
+				throw new Error(`AWS Parameter Store: parameter "${ref}" not found`);
+			}
+		}
+
+		return result;
+	},
+
+	async testConnection(config) {
+		const client = createClient(config);
+		try {
+			await client.send(
+				new DescribeParametersCommand({
+					...describeParametersInput(config),
+					MaxResults: 1,
+				}),
+			);
+		} catch (error) {
+			if (isAccessDeniedError(error)) {
+				throw new Error(
+					"AWS Parameter Store: credentials were accepted, but connection testing and parameter discovery require ssm:DescribeParameters. Manual references can still work when ssm:GetParameters is allowed.",
+				);
+			}
+			throw error;
+		}
+	},
+
+	async listSecretNames(config) {
+		const client = createClient(config);
+		const names: string[] = [];
+		for await (const page of paginateDescribeParameters(
+			{ client, pageSize: 50 },
+			describeParametersInput(config),
+		)) {
+			for (const parameter of page.Parameters ?? []) {
+				if (parameter.Name) {
+					names.push(parameter.Name);
+				}
+				if (names.length >= 500) {
+					return names;
+				}
+			}
+		}
+		return names;
+	},
+};

packages/server/src/utils/vault/infisical.ts

@@ -32,12 +32,53 @@ const login = async (config: InfisicalConfig) => {
 	return body.accessToken;
 };
 
-const fetchSecrets = async (config: InfisicalConfig) => {
-	const accessToken = await login(config);
+// A reference may address a folder: `<path>:<KEY>`, mirroring the HashiCorp
+// client in this directory. Without a colon the whole ref is the secret name
+// and the provider's own `secretPath` is used, which is the previous
+// behaviour. Dots cannot serve as the separator here because Infisical allows
+// them inside secret names, so `a.b.C` is genuinely ambiguous.
+const parseRef = (ref: string) => {
+	const separatorIndex = ref.lastIndexOf(":");
+	if (separatorIndex === -1) {
+		return { path: null, key: ref };
+	}
+	const path = ref.slice(0, separatorIndex);
+	const key = ref.slice(separatorIndex + 1);
+	if (!path || !key) {
+		throw new Error(
+			`Invalid Infisical reference "${ref}": expected format <path>:<KEY> (e.g. external/sentry:SENTRY_DSN)`,
+		);
+	}
+	return { path, key };
+};
+
+const resolveSecretPath = (config: InfisicalConfig, refPath: string | null) => {
+	if (!refPath) {
+		return config.secretPath;
+	}
+	if (refPath.startsWith("/")) {
+		return refPath;
+	}
+	const base = config.secretPath.replace(/\/+$/, "");
+	return `${base}/${refPath}`;
+};
+
+// One login serves every path a batch of refs touches.
+const readPath = async (
+	config: InfisicalConfig,
+	accessToken: string,
+	secretPath: string,
+) => {
 	const params = new URLSearchParams({
 		workspaceId: config.projectId,
 		environment: config.environmentSlug,
-		secretPath: config.secretPath,
+		secretPath,
+		// Infisical's list endpoint leaves secret references (`${env.folder.KEY}`)
+		// unexpanded unless asked, so without this a referencing secret arrives as
+		// the literal `${...}` string, lands in the generated .env and the deploy
+		// still reports success. Single secrets read via /raw/{name} expand by
+		// default, which makes the difference easy to miss in the UI.
+		expandSecretReferences: "true",
 	});
 	const response = await vaultFetch(
 		`${baseUrl(config)}/api/v3/secrets/raw?${params.toString()}`,
@@ -46,7 +87,7 @@ const fetchSecrets = async (config: InfisicalConfig) => {
 
 	if (!response.ok) {
 		throw new Error(
-			`Infisical: failed to fetch secrets (status ${response.status})`,
+			`Infisical: failed to fetch secrets at "${secretPath}" (status ${response.status})`,
 		);
 	}
 
@@ -61,18 +102,41 @@ const fetchSecrets = async (config: InfisicalConfig) => {
 	return secrets;
 };
 
+const fetchSecrets = async (
+	config: InfisicalConfig,
+	secretPath = config.secretPath,
+) => readPath(config, await login(config), secretPath);
+
 export const infisicalClient: VaultClient<InfisicalConfig> = {
 	async getSecrets(config, refs) {
-		const secrets = await fetchSecrets(config);
-		const result: Record<string, string> = {};
+		const byPath = new Map<string, string[]>();
 		for (const ref of refs) {
-			if (secrets[ref] === undefined) {
-				throw new Error(
-					`Infisical: secret "${ref}" not found in environment "${config.environmentSlug}"`,
-				);
-			}
-			result[ref] = secrets[ref];
+			const { path } = parseRef(ref);
+			const secretPath = resolveSecretPath(config, path);
+			byPath.set(secretPath, [...(byPath.get(secretPath) ?? []), ref]);
 		}
+
+		const accessToken = await login(config);
+		const result: Record<string, string> = {};
+		await Promise.all(
+			[...byPath.entries()].map(async ([secretPath, pathRefs]) => {
+				const secrets = await readPath(config, accessToken, secretPath);
+				for (const ref of pathRefs) {
+					const { path, key } = parseRef(ref);
+					if (secrets[key] === undefined) {
+						// The path is only worth naming when the ref asked for one;
+						// for a bare ref the wording stays as it was, so existing
+						// error messages don't change for anyone.
+						throw new Error(
+							path
+								? `Infisical: secret "${key}" not found at "${secretPath}" in environment "${config.environmentSlug}"`
+								: `Infisical: secret "${key}" not found in environment "${config.environmentSlug}"`,
+						);
+					}
+					result[ref] = secrets[key];
+				}
+			}),
+		);
 		return result;
 	},
 

pnpm-lock.yaml

@@ -121,6 +121,9 @@ importers:
       '@aws-sdk/client-secrets-manager':
         specifier: ^3.1108.0
         version: 3.1108.0
+      '@aws-sdk/client-ssm':
+        specifier: 3.1108.0
+        version: 3.1108.0
       '@better-auth/api-key':
         specifier: 1.6.23
         version: 1.6.23(@better-auth/core@1.6.23(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.0)(better-call@1.3.7(zod@4.3.6))(jose@6.1.3)(kysely@0.29.3)(nanostores@1.1.1))(@better-auth/utils@0.4.2)(better-auth@1.6.23(22e2e61d74361da37f96c4dc24795f27))(better-call@1.3.7(zod@4.3.6))
@@ -597,6 +600,9 @@ importers:
       '@aws-sdk/client-secrets-manager':
         specifier: ^3.1108.0
         version: 3.1108.0
+      '@aws-sdk/client-ssm':
+        specifier: 3.1108.0
+        version: 3.1108.0
       '@better-auth/api-key':
         specifier: 1.6.23
         version: 1.6.23(@better-auth/core@1.6.23(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.0)(better-call@1.3.7(zod@4.3.6))(jose@6.1.3)(kysely@0.29.3)(nanostores@1.1.1))(@better-auth/utils@0.4.2)(better-auth@1.6.23(2ed6fd84380fde286153435e0641a0ef))(better-call@1.3.7(zod@4.3.6))
@@ -894,6 +900,10 @@ packages:
     resolution: {integrity: sha512-pZtoHWD+WorgM9xK1ikNcKLbtEMIS6wFtELuCX5AOo9v3ZajV8wOEmXz/7JnBHbsLmyBnyv3NCf7whyV++joiw==}
     engines: {node: '>=20.0.0'}
 
+  '@aws-sdk/client-ssm@3.1108.0':
+    resolution: {integrity: sha512-9bKhMapsv17V2lrC/HtjhfqH72EZOWhdJKod8JkITHALLwdCKgsnnOZ1JPWB1bCMx0hWMW5OtQKdyHjGobE4NQ==}
+    engines: {node: '>=20.0.0'}
+
   '@aws-sdk/core@3.977.7':
     resolution: {integrity: sha512-I88Iov89NVmjSmJLKSv7Cn9M2J+a2942OkA8nZCbz+sl4ZeY4zEOcoLOrbt1GRfQ8zEQKnjAJdXixA3J/p1fDQ==}
     engines: {node: '>=20.0.0'}
@@ -9309,6 +9319,17 @@ snapshots:
       '@smithy/types': 4.17.0
       tslib: 2.8.1
 
+  '@aws-sdk/client-ssm@3.1108.0':
+    dependencies:
+      '@aws-sdk/core': 3.977.7
+      '@aws-sdk/credential-provider-node': 3.972.79
+      '@aws-sdk/types': 3.974.3
+      '@smithy/core': 3.32.0
+      '@smithy/fetch-http-handler': 5.7.0
+      '@smithy/node-http-handler': 4.10.0
+      '@smithy/types': 4.17.0
+      tslib: 2.8.1
+
   '@aws-sdk/core@3.977.7':
     dependencies:
       '@aws-sdk/types': 3.974.3