Merge branch 'canary' into cucumber-sp/canary

packages/server/src/constants/index.ts

@@ -2,8 +2,25 @@ import path from "node:path";
 import Docker from "dockerode";
 
 export const IS_CLOUD = process.env.IS_CLOUD === "true";
+export const DOKPLOY_DOCKER_API_VERSION =
+	process.env.DOKPLOY_DOCKER_API_VERSION;
+export const DOKPLOY_DOCKER_HOST = process.env.DOKPLOY_DOCKER_HOST;
+export const DOKPLOY_DOCKER_PORT = process.env.DOKPLOY_DOCKER_PORT
+	? Number(process.env.DOKPLOY_DOCKER_PORT)
+	: undefined;
+
 export const CLEANUP_CRON_JOB = "50 23 * * *";
-export const docker = new Docker();
+export const docker = new Docker({
+	...(DOKPLOY_DOCKER_API_VERSION && {
+		version: DOKPLOY_DOCKER_API_VERSION,
+	}),
+	...(DOKPLOY_DOCKER_HOST && {
+		host: DOKPLOY_DOCKER_HOST,
+	}),
+	...(DOKPLOY_DOCKER_PORT && {
+		port: DOKPLOY_DOCKER_PORT,
+	}),
+});
 
 // When not set, use the legacy default so 2FA remains working for users who
 // enabled it before BETTER_AUTH_SECRET was introduced .
@@ -32,5 +49,6 @@ export const paths = (isServer = false) => {
 		SCHEDULES_PATH: `${BASE_PATH}/schedules`,
 		VOLUME_BACKUPS_PATH: `${BASE_PATH}/volume-backups`,
 		VOLUME_BACKUP_LOCK_PATH: `${BASE_PATH}/volume-backup-lock`,
+		PATCH_REPOS_PATH: `${BASE_PATH}/patch-repos`,
 	};
 };

packages/server/src/db/index.ts

@@ -1,24 +1,40 @@
+import { and, eq } from "drizzle-orm";
 import { drizzle, type PostgresJsDatabase } from "drizzle-orm/postgres-js";
 import postgres from "postgres";
 import { dbUrl } from "./constants";
 import * as schema from "./schema";
 
-declare global {
-	var db: PostgresJsDatabase<typeof schema> | undefined;
-}
+export { and, eq };
+export * from "./schema";
+
+type Database = PostgresJsDatabase<typeof schema>;
+
+/**
+ * Evita problemas de redeclaración global en monorepos.
+ * No usamos `declare global`.
+ */
+const globalForDb = globalThis as unknown as {
+	db?: Database;
+};
+
+let dbConnection: Database;
 
-export let db: PostgresJsDatabase<typeof schema>;
 if (process.env.NODE_ENV === "production") {
-	db = drizzle(postgres(dbUrl), {
+	// En producción no usamos global cache
+	dbConnection = drizzle(postgres(dbUrl), {
 		schema,
 	});
 } else {
-	if (!global.db)
-		global.db = drizzle(postgres(dbUrl), {
+	// En desarrollo reutilizamos conexión para evitar múltiples conexiones
+	if (!globalForDb.db) {
+		globalForDb.db = drizzle(postgres(dbUrl), {
 			schema,
 		});
+	}
 
-	db = global.db;
+	dbConnection = globalForDb.db;
 }
 
+export const db: Database = dbConnection;
+
 export { dbUrl };

packages/server/src/db/schema/account.ts

@@ -1,6 +1,7 @@
 import { relations, sql } from "drizzle-orm";
 import {
 	boolean,
+	index,
 	integer,
 	pgTable,
 	text,
@@ -69,6 +70,36 @@ export const organization = pgTable("organization", {
 		.references(() => user.id, { onDelete: "cascade" }),
 });
 
+export const organizationRole = pgTable(
+	"organization_role",
+	{
+		id: text("id")
+			.primaryKey()
+			.$defaultFn(() => nanoid()),
+		organizationId: text("organization_id")
+			.notNull()
+			.references(() => organization.id, { onDelete: "cascade" }),
+		role: text("role").notNull(),
+		permission: text("permission").notNull(),
+		createdAt: timestamp("created_at").defaultNow().notNull(),
+		updatedAt: timestamp("updated_at").$onUpdate(() => new Date()),
+	},
+	(table) => [
+		index("organizationRole_organizationId_idx").on(table.organizationId),
+		index("organizationRole_role_idx").on(table.role),
+	],
+);
+
+export const organizationRoleRelations = relations(
+	organizationRole,
+	({ one }) => ({
+		organization: one(organization, {
+			fields: [organizationRole.organizationId],
+			references: [organization.id],
+		}),
+	}),
+);
+
 export const organizationRelations = relations(
 	organization,
 	({ one, many }) => ({
@@ -80,6 +111,7 @@ export const organizationRelations = relations(
 		projects: many(projects),
 		members: many(member),
 		ssoProviders: many(ssoProvider),
+		roles: many(organizationRole),
 	}),
 );
 
@@ -93,7 +125,9 @@ export const member = pgTable("member", {
 	userId: text("user_id")
 		.notNull()
 		.references(() => user.id, { onDelete: "cascade" }),
-	role: text("role").notNull().$type<"owner" | "member" | "admin">(),
+	role: text("role")
+		.notNull()
+		.$type<"owner" | "member" | "admin" | (string & {})>(),
 	createdAt: timestamp("created_at").notNull(),
 	teamId: text("team_id"),
 	isDefault: boolean("is_default").notNull().default(false),
@@ -148,7 +182,7 @@ export const invitation = pgTable("invitation", {
 		.notNull()
 		.references(() => organization.id, { onDelete: "cascade" }),
 	email: text("email").notNull(),
-	role: text("role").$type<"owner" | "member" | "admin">(),
+	role: text("role").$type<"owner" | "member" | "admin" | (string & {})>(),
 	status: text("status").notNull(),
 	expiresAt: timestamp("expires_at").notNull(),
 	inviterId: text("inviter_id")
@@ -180,7 +214,8 @@ export const apikey = pgTable("apikey", {
 	start: text("start"),
 	prefix: text("prefix"),
 	key: text("key").notNull(),
-	userId: text("user_id")
+	configId: text("config_id").default("default").notNull(),
+	referenceId: text("reference_id")
 		.notNull()
 		.references(() => user.id, { onDelete: "cascade" }),
 	refillInterval: integer("refill_interval"),
@@ -202,7 +237,7 @@ export const apikey = pgTable("apikey", {
 
 export const apikeyRelations = relations(apikey, ({ one }) => ({
 	user: one(user, {
-		fields: [apikey.userId],
+		fields: [apikey.referenceId],
 		references: [user.id],
 	}),
 }));

packages/server/src/db/schema/application.ts

@@ -19,6 +19,7 @@ import { gitea } from "./gitea";
 import { github } from "./github";
 import { gitlab } from "./gitlab";
 import { mounts } from "./mount";
+import { patch } from "./patch";
 import { ports } from "./port";
 import { previewDeployments } from "./preview-deployments";
 import { redirects } from "./redirects";
@@ -158,7 +159,7 @@ export const applications = pgTable("application", {
 		},
 	),
 	enableSubmodules: boolean("enableSubmodules").notNull().default(false),
-	dockerfile: text("dockerfile"),
+	dockerfile: text("dockerfile").default("Dockerfile"),
 	dockerContextPath: text("dockerContextPath"),
 	dockerBuildStage: text("dockerBuildStage"),
 	// Drop
@@ -286,6 +287,7 @@ export const applicationsRelations = relations(
 			references: [registry.registryId],
 			relationName: "applicationRollbackRegistry",
 		}),
+		patches: many(patch),
 	}),
 );
 
@@ -329,6 +331,7 @@ const createSchema = createInsertSchema(applications, {
 	sourceType: z
 		.enum(["github", "docker", "git", "gitlab", "bitbucket", "gitea", "drop"])
 		.optional(),
+	triggerType: z.enum(["push", "tag"]).optional(),
 	applicationStatus: z.enum(["idle", "running", "done", "error"]),
 	buildType: z.enum([
 		"dockerfile",
@@ -362,12 +365,13 @@ const createSchema = createInsertSchema(applications, {
 	previewPath: z.string().optional(),
 	previewCertificateType: z.enum(["letsencrypt", "none", "custom"]).optional(),
 	previewRequireCollaboratorPermissions: z.boolean().optional(),
-	watchPaths: z.array(z.string()).optional(),
+	watchPaths: z.array(z.string()).optional().optional(),
 	previewLabels: z.array(z.string()).optional(),
 	cleanCache: z.boolean().optional(),
 	stopGracePeriodSwarm: z.bigint().nullable(),
 	endpointSpecSwarm: EndpointSpecSwarmSchema.nullable(),
 	ulimitsSwarm: UlimitsSwarmSchema.nullable(),
+	enableSubmodules: z.boolean().optional(),
 });
 
 export const apiCreateApplication = createSchema.pick({
@@ -378,11 +382,9 @@ export const apiCreateApplication = createSchema.pick({
 	serverId: true,
 });
 
-export const apiFindOneApplication = createSchema
-	.pick({
-		applicationId: true,
-	})
-	.required();
+export const apiFindOneApplication = z.object({
+	applicationId: z.string().min(1),
+});
 
 export const apiDeployApplication = createSchema
 	.pick({
@@ -432,13 +434,13 @@ export const apiSaveGithubProvider = createSchema
 		owner: true,
 		buildPath: true,
 		githubId: true,
-		watchPaths: true,
-		enableSubmodules: true,
 	})
 	.required()
 	.extend({
 		triggerType: z.enum(["push", "tag"]).default("push"),
-	});
+	})
+	.required()
+	.merge(createSchema.pick({ enableSubmodules: true, watchPaths: true }));
 
 export const apiSaveGitlabProvider = createSchema
 	.pick({
@@ -450,10 +452,9 @@ export const apiSaveGitlabProvider = createSchema
 		gitlabId: true,
 		gitlabProjectId: true,
 		gitlabPathNamespace: true,
-		watchPaths: true,
-		enableSubmodules: true,
 	})
-	.required();
+	.required()
+	.merge(createSchema.pick({ enableSubmodules: true, watchPaths: true }));
 
 export const apiSaveBitbucketProvider = createSchema
 	.pick({
@@ -464,10 +465,9 @@ export const apiSaveBitbucketProvider = createSchema
 		bitbucketRepositorySlug: true,
 		bitbucketId: true,
 		applicationId: true,
-		watchPaths: true,
-		enableSubmodules: true,
 	})
-	.required();
+	.required()
+	.merge(createSchema.pick({ enableSubmodules: true, watchPaths: true }));
 
 export const apiSaveGiteaProvider = createSchema
 	.pick({
@@ -477,10 +477,9 @@ export const apiSaveGiteaProvider = createSchema
 		giteaOwner: true,
 		giteaRepository: true,
 		giteaId: true,
-		watchPaths: true,
-		enableSubmodules: true,
 	})
-	.required();
+	.required()
+	.merge(createSchema.pick({ enableSubmodules: true, watchPaths: true }));
 
 export const apiSaveDockerProvider = createSchema
 	.pick({
@@ -505,6 +504,7 @@ export const apiSaveGitProvider = createSchema
 	.merge(
 		createSchema.pick({
 			customGitSSHKeyId: true,
+			enableSubmodules: true,
 		}),
 	);
 
@@ -518,11 +518,9 @@ export const apiSaveEnvironmentVariables = createSchema
 	})
 	.required();
 
-export const apiFindMonitoringStats = createSchema
-	.pick({
-		appName: true,
-	})
-	.required();
+export const apiFindMonitoringStats = z.object({
+	appName: z.string().min(1),
+});
 
 export const apiUpdateApplication = createSchema
 	.partial()

packages/server/src/db/schema/audit-log.ts

@@ -0,0 +1,94 @@
+import { relations } from "drizzle-orm";
+import { index, pgTable, text, timestamp } from "drizzle-orm/pg-core";
+import { nanoid } from "nanoid";
+import { organization } from "./account";
+import { user } from "./user";
+
+export const auditLog = pgTable(
+	"audit_log",
+	{
+		id: text("id")
+			.primaryKey()
+			.$defaultFn(() => nanoid()),
+		organizationId: text("organization_id").references(() => organization.id, {
+			onDelete: "set null",
+		}),
+		userId: text("user_id").references(() => user.id, { onDelete: "set null" }),
+		userEmail: text("user_email").notNull(),
+		userRole: text("user_role").notNull(),
+		action: text("action").notNull(),
+		resourceType: text("resource_type").notNull(),
+		resourceId: text("resource_id"),
+		resourceName: text("resource_name"),
+		metadata: text("metadata"),
+		createdAt: timestamp("created_at").defaultNow().notNull(),
+	},
+	(t) => ({
+		orgIdx: index("auditLog_organizationId_idx").on(t.organizationId),
+		userIdx: index("auditLog_userId_idx").on(t.userId),
+		createdAtIdx: index("auditLog_createdAt_idx").on(t.createdAt),
+	}),
+);
+
+export const auditLogRelations = relations(auditLog, ({ one }) => ({
+	organization: one(organization, {
+		fields: [auditLog.organizationId],
+		references: [organization.id],
+	}),
+	user: one(user, {
+		fields: [auditLog.userId],
+		references: [user.id],
+	}),
+}));
+
+export type AuditLog = typeof auditLog.$inferSelect;
+export type NewAuditLog = typeof auditLog.$inferInsert;
+
+export type AuditAction =
+	| "create"
+	| "update"
+	| "delete"
+	| "deploy"
+	| "cancel"
+	| "redeploy"
+	| "login"
+	| "logout"
+	| "restore"
+	| "run"
+	| "start"
+	| "stop"
+	| "reload"
+	| "rebuild"
+	| "move";
+
+export type AuditResourceType =
+	| "project"
+	| "service"
+	| "environment"
+	| "deployment"
+	| "user"
+	| "customRole"
+	| "domain"
+	| "certificate"
+	| "registry"
+	| "server"
+	| "sshKey"
+	| "gitProvider"
+	| "destination"
+	| "notification"
+	| "settings"
+	| "session"
+	| "port"
+	| "redirect"
+	| "security"
+	| "schedule"
+	| "backup"
+	| "volumeBackup"
+	| "docker"
+	| "swarm"
+	| "previewDeployment"
+	| "organization"
+	| "cluster"
+	| "mount"
+	| "application"
+	| "compose";

packages/server/src/db/schema/backups.ts

@@ -165,11 +165,9 @@ export const apiCreateBackup = createSchema.pick({
 	metadata: true,
 });
 
-export const apiFindOneBackup = createSchema
-	.pick({
-		backupId: true,
-	})
-	.required();
+export const apiFindOneBackup = z.object({
+	backupId: z.string().min(1),
+});
 
 export const apiRemoveBackup = createSchema
 	.pick({

packages/server/src/db/schema/compose.ts

@@ -12,6 +12,7 @@ import { gitea } from "./gitea";
 import { github } from "./github";
 import { gitlab } from "./gitlab";
 import { mounts } from "./mount";
+import { patch } from "./patch";
 import { schedules } from "./schedule";
 import { server } from "./server";
 import { applicationStatus, triggerType } from "./shared";
@@ -143,6 +144,7 @@ export const composeRelations = relations(compose, ({ one, many }) => ({
 	}),
 	backups: many(backups),
 	schedules: many(schedules),
+	patches: many(patch),
 }));
 
 const createSchema = createInsertSchema(compose, {
@@ -162,6 +164,11 @@ const createSchema = createInsertSchema(compose, {
 	composePath: z.string().min(1),
 	composeType: z.enum(["docker-compose", "stack"]).optional(),
 	watchPaths: z.array(z.string()).optional(),
+	sourceType: z
+		.enum(["git", "github", "gitlab", "bitbucket", "gitea", "raw"])
+		.optional(),
+	triggerType: z.enum(["push", "tag"]).optional(),
+	composeStatus: z.enum(["idle", "running", "done", "error"]).optional(),
 });
 
 export const apiCreateCompose = createSchema.pick({

packages/server/src/db/schema/deployment.ts

@@ -126,7 +126,6 @@ const schema = createInsertSchema(deployments, {
 	previewDeploymentId: z.string(),
 	buildServerId: z.string(),
 });
-
 export const apiCreateDeployment = schema
 	.pick({
 		title: true,
@@ -210,44 +209,27 @@ export const apiCreateDeploymentVolumeBackup = schema
 		volumeBackupId: z.string().min(1),
 	});
 
-export const apiFindAllByApplication = schema
-	.pick({
-		applicationId: true,
-	})
-	.extend({
-		applicationId: z.string().min(1),
-	})
-	.required();
+export const apiFindAllByApplication = z.object({
+	applicationId: z.string().min(1),
+});
 
-export const apiFindAllByCompose = schema
-	.pick({
-		composeId: true,
-	})
-	.extend({
-		composeId: z.string().min(1),
-	})
-	.required();
+export const apiFindAllByCompose = z.object({
+	composeId: z.string().min(1),
+});
 
-export const apiFindAllByServer = schema
-	.pick({
-		serverId: true,
-	})
-	.extend({
-		serverId: z.string().min(1),
-	})
-	.required();
+export const apiFindAllByServer = z.object({
+	serverId: z.string().min(1),
+});
 
-export const apiFindAllByType = z
-	.object({
-		id: z.string().min(1),
-		type: z.enum([
-			"application",
-			"compose",
-			"server",
-			"schedule",
-			"previewDeployment",
-			"backup",
-			"volumeBackup",
-		]),
-	})
-	.required();
+export const apiFindAllByType = z.object({
+	id: z.string().min(1),
+	type: z.enum([
+		"application",
+		"compose",
+		"server",
+		"schedule",
+		"previewDeployment",
+		"backup",
+		"volumeBackup",
+	]),
+});

packages/server/src/db/schema/destination.ts

@@ -61,11 +61,9 @@ export const apiCreateDestination = createSchema
 		serverId: z.string().optional(),
 	});
 
-export const apiFindOneDestination = createSchema
-	.pick({
-		destinationId: true,
-	})
-	.required();
+export const apiFindOneDestination = z.object({
+	destinationId: z.string().min(1),
+});
 
 export const apiRemoveDestination = createSchema
 	.pick({

packages/server/src/db/schema/domain.ts

@@ -70,7 +70,11 @@ export const domainsRelations = relations(domains, ({ one }) => ({
 	}),
 }));
 
-const createSchema = createInsertSchema(domains, domain._def.schema.shape);
+const createSchema = createInsertSchema(domains, {
+	...domain.shape,
+	// Override pgEnum so Zod 4 infers only string literals, not numeric enum index
+	domainType: z.enum(["compose", "application", "preview"]).optional(),
+});
 
 export const apiCreateDomain = createSchema.pick({
 	host: true,
@@ -88,11 +92,9 @@ export const apiCreateDomain = createSchema.pick({
 	stripPath: true,
 });
 
-export const apiFindDomain = createSchema
-	.pick({
-		domainId: true,
-	})
-	.required();
+export const apiFindDomain = z.object({
+	domainId: z.string().min(1),
+});
 
 export const apiFindDomainByApplication = createSchema.pick({
 	applicationId: true,

packages/server/src/db/schema/environment.ts

@@ -1,6 +1,5 @@
 import { relations } from "drizzle-orm";
 import { boolean, pgTable, text } from "drizzle-orm/pg-core";
-import { createInsertSchema } from "drizzle-zod";
 import { nanoid } from "nanoid";
 import { z } from "zod";
 import { applications } from "./application";
@@ -46,46 +45,30 @@ export const environmentRelations = relations(
 	}),
 );
 
-const createSchema = createInsertSchema(environments, {
+export const apiCreateEnvironment = z.object({
+	name: z.string().min(1),
+	description: z.string().optional(),
+	projectId: z.string().min(1),
+});
+
+export const apiFindOneEnvironment = z.object({
+	environmentId: z.string().min(1),
+});
+
+export const apiRemoveEnvironment = z.object({
+	environmentId: z.string().min(1),
+});
+
+export const apiUpdateEnvironment = z.object({
+	environmentId: z.string().min(1),
+	name: z.string().min(1).optional(),
+	description: z.string().optional(),
+	projectId: z.string().optional(),
+	env: z.string().optional(),
+});
+
+export const apiDuplicateEnvironment = z.object({
 	environmentId: z.string().min(1),
 	name: z.string().min(1),
 	description: z.string().optional(),
 });
-
-export const apiCreateEnvironment = createSchema.pick({
-	name: true,
-	description: true,
-	projectId: true,
-});
-
-export const apiFindOneEnvironment = createSchema
-	.pick({
-		environmentId: true,
-	})
-	.required();
-
-export const apiRemoveEnvironment = createSchema
-	.pick({
-		environmentId: true,
-	})
-	.required();
-
-export const apiUpdateEnvironment = createSchema
-	.partial()
-	.extend({
-		environmentId: z.string().min(1),
-	})
-	.omit({
-		isDefault: true,
-	});
-
-export const apiDuplicateEnvironment = createSchema
-	.pick({
-		environmentId: true,
-		name: true,
-		description: true,
-	})
-	.required({
-		environmentId: true,
-		name: true,
-	});

packages/server/src/db/schema/git-provider.ts

@@ -1,6 +1,5 @@
 import { relations } from "drizzle-orm";
 import { pgEnum, pgTable, text } from "drizzle-orm/pg-core";
-import { createInsertSchema } from "drizzle-zod";
 import { nanoid } from "nanoid";
 import { z } from "zod";
 import { organization } from "./account";
@@ -62,10 +61,6 @@ export const gitProviderRelations = relations(gitProvider, ({ one }) => ({
 	}),
 }));
 
-const createSchema = createInsertSchema(gitProvider);
-
-export const apiRemoveGitProvider = createSchema
-	.extend({
-		gitProviderId: z.string().min(1),
-	})
-	.pick({ gitProviderId: true });
+export const apiRemoveGitProvider = z.object({
+	gitProviderId: z.string().min(1),
+});

packages/server/src/db/schema/github.ts

@@ -1,6 +1,5 @@
 import { relations } from "drizzle-orm";
 import { integer, pgTable, text } from "drizzle-orm/pg-core";
-import { createInsertSchema } from "drizzle-zod";
 import { nanoid } from "nanoid";
 import { z } from "zod";
 import { gitProvider } from "./git-provider";
@@ -29,8 +28,7 @@ export const githubProviderRelations = relations(github, ({ one }) => ({
 	}),
 }));
 
-const createSchema = createInsertSchema(github);
-export const apiCreateGithub = createSchema.extend({
+export const apiCreateGithub = z.object({
 	githubAppName: z.string().optional(),
 	githubAppId: z.number().optional(),
 	githubClientId: z.string().optional(),
@@ -48,13 +46,11 @@ export const apiFindGithubBranches = z.object({
 	githubId: z.string().optional(),
 });
 
-export const apiFindOneGithub = createSchema
-	.extend({
-		githubId: z.string().min(1),
-	})
-	.pick({ githubId: true });
+export const apiFindOneGithub = z.object({
+	githubId: z.string().min(1),
+});
 
-export const apiUpdateGithub = createSchema.extend({
+export const apiUpdateGithub = z.object({
 	githubId: z.string().min(1),
 	name: z.string().min(1),
 	gitProviderId: z.string().min(1),

packages/server/src/db/schema/gitlab.ts

@@ -1,6 +1,5 @@
 import { relations } from "drizzle-orm";
 import { integer, pgTable, text } from "drizzle-orm/pg-core";
-import { createInsertSchema } from "drizzle-zod";
 import { nanoid } from "nanoid";
 import { z } from "zod";
 import { gitProvider } from "./git-provider";
@@ -31,9 +30,7 @@ export const gitlabProviderRelations = relations(gitlab, ({ one }) => ({
 	}),
 }));
 
-const createSchema = createInsertSchema(gitlab);
-
-export const apiCreateGitlab = createSchema.extend({
+export const apiCreateGitlab = z.object({
 	applicationId: z.string().optional(),
 	secret: z.string().optional(),
 	groupName: z.string().optional(),
@@ -45,17 +42,14 @@ export const apiCreateGitlab = createSchema.extend({
 	gitlabInternalUrl: z.string().optional().nullable(),
 });
 
-export const apiFindOneGitlab = createSchema
-	.extend({
-		gitlabId: z.string().min(1),
-	})
-	.pick({ gitlabId: true });
+export const apiFindOneGitlab = z.object({
+	gitlabId: z.string().min(1),
+});
 
-export const apiGitlabTestConnection = createSchema
-	.extend({
-		groupName: z.string().optional(),
-	})
-	.pick({ gitlabId: true, groupName: true });
+export const apiGitlabTestConnection = z.object({
+	gitlabId: z.string().min(1),
+	groupName: z.string().optional(),
+});
 
 export const apiFindGitlabBranches = z.object({
 	id: z.number().optional(),
@@ -64,7 +58,7 @@ export const apiFindGitlabBranches = z.object({
 	gitlabId: z.string().optional(),
 });
 
-export const apiUpdateGitlab = createSchema.extend({
+export const apiUpdateGitlab = z.object({
 	applicationId: z.string().optional(),
 	secret: z.string().optional(),
 	groupName: z.string().optional(),
@@ -72,5 +66,6 @@ export const apiUpdateGitlab = createSchema.extend({
 	name: z.string().min(1),
 	gitlabId: z.string().min(1),
 	gitlabUrl: z.string().min(1),
+	gitProviderId: z.string().min(1),
 	gitlabInternalUrl: z.string().optional().nullable(),
 });

packages/server/src/db/schema/index.ts

@@ -1,5 +1,6 @@
 export * from "./account";
 export * from "./ai";
+export * from "./audit-log";
 export * from "./application";
 export * from "./backups";
 export * from "./bitbucket";
@@ -18,6 +19,7 @@ export * from "./mongo";
 export * from "./mount";
 export * from "./mysql";
 export * from "./notification";
+export * from "./patch";
 export * from "./port";
 export * from "./postgres";
 export * from "./preview-deployments";

packages/server/src/db/schema/mariadb.ts

@@ -160,11 +160,9 @@ export const apiCreateMariaDB = createSchema.pick({
 	serverId: true,
 });
 
-export const apiFindOneMariaDB = createSchema
-	.pick({
-		mariadbId: true,
-	})
-	.required();
+export const apiFindOneMariaDB = z.object({
+	mariadbId: z.string().min(1),
+});
 
 export const apiChangeMariaDBStatus = createSchema
 	.pick({
@@ -204,6 +202,7 @@ export const apiUpdateMariaDB = createSchema
 	.partial()
 	.extend({
 		mariadbId: z.string().min(1),
+		dockerImage: z.string().optional(),
 	})
 	.omit({ serverId: true });
 

packages/server/src/db/schema/mongo.ts

@@ -156,11 +156,9 @@ export const apiCreateMongo = createSchema.pick({
 	replicaSets: true,
 });
 
-export const apiFindOneMongo = createSchema
-	.pick({
-		mongoId: true,
-	})
-	.required();
+export const apiFindOneMongo = z.object({
+	mongoId: z.string().min(1),
+});
 
 export const apiChangeMongoStatus = createSchema
 	.pick({
@@ -193,6 +191,7 @@ export const apiUpdateMongo = createSchema
 	.partial()
 	.extend({
 		mongoId: z.string().min(1),
+		dockerImage: z.string().optional(),
 	})
 	.omit({ serverId: true });
 

packages/server/src/db/schema/mount.ts

@@ -99,17 +99,15 @@ const createSchema = createInsertSchema(mounts, {
 	mountPath: z.string().min(1),
 	mountId: z.string().optional(),
 	filePath: z.string().optional(),
-	serviceType: z
-		.enum([
-			"application",
-			"postgres",
-			"mysql",
-			"mariadb",
-			"mongo",
-			"redis",
-			"compose",
-		])
-		.default("application"),
+	serviceType: z.enum([
+		"application",
+		"postgres",
+		"mysql",
+		"mariadb",
+		"mongo",
+		"redis",
+		"compose",
+	]),
 });
 
 export type ServiceType = NonNullable<
@@ -130,11 +128,9 @@ export const apiCreateMount = createSchema
 		serviceId: z.string().min(1),
 	});
 
-export const apiFindOneMount = createSchema
-	.pick({
-		mountId: true,
-	})
-	.required();
+export const apiFindOneMount = z.object({
+	mountId: z.string().min(1),
+});
 
 export const apiRemoveMount = createSchema
 	.pick({
@@ -148,12 +144,20 @@ export const apiRemoveMount = createSchema
 export const apiFindMountByApplicationId = createSchema
 	.extend({
 		serviceId: z.string().min(1),
+		serviceType: z.enum([
+			"application",
+			"postgres",
+			"mysql",
+			"mariadb",
+			"mongo",
+			"redis",
+			"compose",
+		]),
 	})
 	.pick({
 		serviceId: true,
 		serviceType: true,
-	})
-	.required();
+	});
 
 export const apiUpdateMount = createSchema.partial().extend({
 	mountId: z.string().min(1),

packages/server/src/db/schema/mysql.ts

@@ -157,11 +157,9 @@ export const apiCreateMySql = createSchema.pick({
 	serverId: true,
 });
 
-export const apiFindOneMySql = createSchema
-	.pick({
-		mysqlId: true,
-	})
-	.required();
+export const apiFindOneMySql = z.object({
+	mysqlId: z.string().min(1),
+});
 
 export const apiChangeMySqlStatus = createSchema
 	.pick({
@@ -201,6 +199,7 @@ export const apiUpdateMySql = createSchema
 	.partial()
 	.extend({
 		mysqlId: z.string().min(1),
+		dockerImage: z.string().optional(),
 	})
 	.omit({ serverId: true });
 

packages/server/src/db/schema/notification.ts

@@ -23,6 +23,7 @@ export const notificationType = pgEnum("notificationType", [
 	"pushover",
 	"custom",
 	"lark",
+	"teams",
 ]);
 
 export const notifications = pgTable("notification", {
@@ -72,6 +73,9 @@ export const notifications = pgTable("notification", {
 	pushoverId: text("pushoverId").references(() => pushover.pushoverId, {
 		onDelete: "cascade",
 	}),
+	teamsId: text("teamsId").references(() => teams.teamsId, {
+		onDelete: "cascade",
+	}),
 	organizationId: text("organizationId")
 		.notNull()
 		.references(() => organization.id, { onDelete: "cascade" }),
@@ -179,6 +183,14 @@ export const pushover = pgTable("pushover", {
 	expire: integer("expire"),
 });
 
+export const teams = pgTable("teams", {
+	teamsId: text("teamsId")
+		.notNull()
+		.primaryKey()
+		.$defaultFn(() => nanoid()),
+	webhookUrl: text("webhookUrl").notNull(),
+});
+
 export const notificationsRelations = relations(notifications, ({ one }) => ({
 	slack: one(slack, {
 		fields: [notifications.slackId],
@@ -220,6 +232,10 @@ export const notificationsRelations = relations(notifications, ({ one }) => ({
 		fields: [notifications.pushoverId],
 		references: [pushover.pushoverId],
 	}),
+	teams: one(teams, {
+		fields: [notifications.teamsId],
+		references: [teams.teamsId],
+	}),
 	organization: one(organization, {
 		fields: [notifications.organizationId],
 		references: [organization.id],
@@ -448,11 +464,9 @@ export const apiTestNtfyConnection = apiCreateNtfy.pick({
 	priority: true,
 });
 
-export const apiFindOneNotification = notificationsSchema
-	.pick({
-		notificationId: true,
-	})
-	.required();
+export const apiFindOneNotification = z.object({
+	notificationId: z.string().min(1),
+});
 
 export const apiCreateCustom = notificationsSchema
 	.pick({
@@ -467,7 +481,7 @@ export const apiCreateCustom = notificationsSchema
 	})
 	.extend({
 		endpoint: z.string().min(1),
-		headers: z.record(z.string()).optional(),
+		headers: z.record(z.string(), z.string()).optional(),
 	});
 
 export const apiUpdateCustom = apiCreateCustom.partial().extend({
@@ -478,7 +492,7 @@ export const apiUpdateCustom = apiCreateCustom.partial().extend({
 
 export const apiTestCustomConnection = z.object({
 	endpoint: z.string().min(1),
-	headers: z.record(z.string()).optional(),
+	headers: z.record(z.string(), z.string()).optional(),
 });
 
 export const apiCreateLark = notificationsSchema
@@ -507,6 +521,32 @@ export const apiTestLarkConnection = apiCreateLark.pick({
 	webhookUrl: true,
 });
 
+export const apiCreateTeams = notificationsSchema
+	.pick({
+		appBuildError: true,
+		databaseBackup: true,
+		volumeBackup: true,
+		dokployRestart: true,
+		name: true,
+		appDeploy: true,
+		dockerCleanup: true,
+		serverThreshold: true,
+	})
+	.extend({
+		webhookUrl: z.string().min(1),
+	})
+	.required();
+
+export const apiUpdateTeams = apiCreateTeams.partial().extend({
+	notificationId: z.string().min(1),
+	teamsId: z.string().min(1),
+	organizationId: z.string().optional(),
+});
+
+export const apiTestTeamsConnection = apiCreateTeams.pick({
+	webhookUrl: true,
+});
+
 export const apiCreatePushover = notificationsSchema
 	.pick({
 		appBuildError: true,

packages/server/src/db/schema/patch.ts

@@ -0,0 +1,100 @@
+import { relations } from "drizzle-orm";
+import { boolean, pgEnum, pgTable, text, unique } from "drizzle-orm/pg-core";
+import { createInsertSchema } from "drizzle-zod";
+import { nanoid } from "nanoid";
+import { z } from "zod";
+import { applications } from "./application";
+import { compose } from "./compose";
+
+export const patchType = pgEnum("patchType", ["create", "update", "delete"]);
+
+export const patch = pgTable(
+	"patch",
+	{
+		patchId: text("patchId")
+			.notNull()
+			.primaryKey()
+			.$defaultFn(() => nanoid()),
+		type: patchType("type").notNull().default("update"),
+		filePath: text("filePath").notNull(),
+		enabled: boolean("enabled").notNull().default(true),
+		content: text("content").notNull(),
+		createdAt: text("createdAt")
+			.notNull()
+			.$defaultFn(() => new Date().toISOString()),
+		updatedAt: text("updatedAt").$defaultFn(() => new Date().toISOString()),
+		// Relations - one of these must be set
+		applicationId: text("applicationId").references(
+			() => applications.applicationId,
+			{ onDelete: "cascade" },
+		),
+		composeId: text("composeId").references(() => compose.composeId, {
+			onDelete: "cascade",
+		}),
+	},
+	(table) => [
+		// Unique constraint: one patch per file per application/compose
+		unique("patch_filepath_application_unique").on(
+			table.filePath,
+			table.applicationId,
+		),
+		unique("patch_filepath_compose_unique").on(table.filePath, table.composeId),
+	],
+);
+
+export const patchRelations = relations(patch, ({ one }) => ({
+	application: one(applications, {
+		fields: [patch.applicationId],
+		references: [applications.applicationId],
+	}),
+	compose: one(compose, {
+		fields: [patch.composeId],
+		references: [compose.composeId],
+	}),
+}));
+
+const createSchema = createInsertSchema(patch, {
+	filePath: z.string().min(1),
+	content: z.string(),
+	type: z.enum(["create", "update", "delete"]).optional(),
+	enabled: z.boolean().optional(),
+	applicationId: z.string().optional(),
+	composeId: z.string().optional(),
+});
+
+export const apiCreatePatch = createSchema.pick({
+	filePath: true,
+	content: true,
+	type: true,
+	enabled: true,
+	applicationId: true,
+	composeId: true,
+});
+
+export const apiFindPatch = z.object({
+	patchId: z.string().min(1),
+});
+
+export const apiFindPatchesByApplicationId = z.object({
+	applicationId: z.string().min(1),
+});
+
+export const apiFindPatchesByComposeId = z.object({
+	composeId: z.string().min(1),
+});
+
+export const apiUpdatePatch = createSchema
+	.partial()
+	.extend({
+		patchId: z.string().min(1),
+	})
+	.omit({ applicationId: true, composeId: true });
+
+export const apiDeletePatch = z.object({
+	patchId: z.string().min(1),
+});
+
+export const apiTogglePatchEnabled = z.object({
+	patchId: z.string().min(1),
+	enabled: z.boolean(),
+});

packages/server/src/db/schema/port.ts

@@ -49,11 +49,9 @@ export const apiCreatePort = createSchema
 	})
 	.required();
 
-export const apiFindOnePort = createSchema
-	.pick({
-		portId: true,
-	})
-	.required();
+export const apiFindOnePort = z.object({
+	portId: z.string().min(1),
+});
 
 export const apiUpdatePort = createSchema
 	.pick({

packages/server/src/db/schema/postgres.ts

@@ -150,11 +150,9 @@ export const apiCreatePostgres = createSchema.pick({
 	serverId: true,
 });
 
-export const apiFindOnePostgres = createSchema
-	.pick({
-		postgresId: true,
-	})
-	.required();
+export const apiFindOnePostgres = z.object({
+	postgresId: z.string().min(1),
+});
 
 export const apiChangePostgresStatus = createSchema
 	.pick({
@@ -194,6 +192,7 @@ export const apiUpdatePostgres = createSchema
 	.partial()
 	.extend({
 		postgresId: z.string().min(1),
+		dockerImage: z.string().optional(),
 	})
 	.omit({ serverId: true });
 

packages/server/src/db/schema/preview-deployments.ts

@@ -58,17 +58,12 @@ export const createSchema = createInsertSchema(previewDeployments, {
 	applicationId: z.string(),
 });
 
-export const apiCreatePreviewDeployment = createSchema
-	.pick({
-		applicationId: true,
-		domainId: true,
-		branch: true,
-		pullRequestId: true,
-		pullRequestNumber: true,
-		pullRequestURL: true,
-		pullRequestTitle: true,
-	})
-	.extend({
-		applicationId: z.string().min(1),
-		// deploymentId: z.string().min(1),
-	});
+export const apiCreatePreviewDeployment = z.object({
+	applicationId: z.string().min(1),
+	domainId: z.string().optional(),
+	branch: z.string().min(1),
+	pullRequestId: z.string().min(1),
+	pullRequestNumber: z.string().min(1),
+	pullRequestURL: z.string().min(1),
+	pullRequestTitle: z.string().min(1),
+});

packages/server/src/db/schema/project.ts

@@ -45,12 +45,9 @@ export const apiCreateProject = createSchema.pick({
 	env: true,
 });
 
-export const apiFindOneProject = createSchema
-	.pick({
-		projectId: true,
-	})
-	.required();
-
+export const apiFindOneProject = z.object({
+	projectId: z.string().min(1),
+});
 export const apiRemoveProject = createSchema
 	.pick({
 		projectId: true,

packages/server/src/db/schema/redirects.ts

@@ -35,11 +35,9 @@ const createSchema = createInsertSchema(redirects, {
 	permanent: z.boolean().optional(),
 });
 
-export const apiFindOneRedirect = createSchema
-	.pick({
-		redirectId: true,
-	})
-	.required();
+export const apiFindOneRedirect = z.object({
+	redirectId: z.string().min(1),
+});
 
 export const apiCreateRedirect = createSchema
 	.pick({

packages/server/src/db/schema/redis.ts

@@ -136,11 +136,9 @@ export const apiCreateRedis = createSchema.pick({
 	serverId: true,
 });
 
-export const apiFindOneRedis = createSchema
-	.pick({
-		redisId: true,
-	})
-	.required();
+export const apiFindOneRedis = z.object({
+	redisId: z.string().min(1),
+});
 
 export const apiChangeRedisStatus = createSchema
 	.pick({
@@ -180,6 +178,7 @@ export const apiUpdateRedis = createSchema
 	.partial()
 	.extend({
 		redisId: z.string().min(1),
+		dockerImage: z.string().optional(),
 	})
 	.omit({ serverId: true });
 

packages/server/src/db/schema/registry.ts

@@ -94,11 +94,9 @@ export const apiRemoveRegistry = createSchema
 	})
 	.required();
 
-export const apiFindOneRegistry = createSchema
-	.pick({
-		registryId: true,
-	})
-	.required();
+export const apiFindOneRegistry = z.object({
+	registryId: z.string().min(1),
+});
 
 export const apiUpdateRegistry = createSchema.partial().extend({
 	registryId: z.string().min(1),

packages/server/src/db/schema/security.ts

@@ -38,11 +38,9 @@ const createSchema = createInsertSchema(security, {
 	password: z.string().min(1),
 });
 
-export const apiFindOneSecurity = createSchema
-	.pick({
-		securityId: true,
-	})
-	.required();
+export const apiFindOneSecurity = z.object({
+	securityId: z.string().min(1),
+});
 
 export const apiCreateSecurity = createSchema
 	.pick({

packages/server/src/db/schema/server.ts

@@ -133,6 +133,7 @@ const createSchema = createInsertSchema(server, {
 	serverId: z.string().min(1),
 	name: z.string().min(1),
 	description: z.string().optional(),
+	serverType: z.enum(["deploy", "build"]).optional(),
 });
 
 export const apiCreateServer = createSchema
@@ -147,11 +148,9 @@ export const apiCreateServer = createSchema
 	})
 	.required();
 
-export const apiFindOneServer = createSchema
-	.pick({
-		serverId: true,
-	})
-	.required();
+export const apiFindOneServer = z.object({
+	serverId: z.string().min(1),
+});
 
 export const apiRemoveServer = createSchema
 	.pick({

packages/server/src/db/schema/session.ts

@@ -2,7 +2,7 @@ import { pgTable, text, timestamp } from "drizzle-orm/pg-core";
 import { user } from "./user";
 
 // OLD TABLE
-export const session = pgTable("session_temp", {
+export const session = pgTable("session", {
 	id: text("id").primaryKey(),
 	expiresAt: timestamp("expires_at").notNull(),
 	token: text("token").notNull().unique(),

packages/server/src/db/schema/shared.ts

@@ -175,12 +175,12 @@ export const NetworkSwarmSchema = z.array(
 		.object({
 			Target: z.string().optional(),
 			Aliases: z.array(z.string()).optional(),
-			DriverOpts: z.record(z.string()).optional(),
+			DriverOpts: z.record(z.string(), z.string()).optional(),
 		})
 		.strict(),
 );
 
-export const LabelsSwarmSchema = z.record(z.string());
+export const LabelsSwarmSchema = z.record(z.string(), z.string());
 
 export const EndpointPortConfigSwarmSchema = z
 	.object({

packages/server/src/db/schema/ssh-key.ts

@@ -2,6 +2,7 @@ import { relations } from "drizzle-orm";
 import { pgTable, text } from "drizzle-orm/pg-core";
 import { createInsertSchema } from "drizzle-zod";
 import { nanoid } from "nanoid";
+import { z } from "zod";
 import { sshKeyCreate, sshKeyType } from "../validations";
 import { organization } from "./account";
 import { applications } from "./application";
@@ -52,11 +53,9 @@ export const apiCreateSshKey = createSchema
 	})
 	.merge(sshKeyCreate.pick({ privateKey: true }));
 
-export const apiFindOneSshKey = createSchema
-	.pick({
-		sshKeyId: true,
-	})
-	.required();
+export const apiFindOneSshKey = z.object({
+	sshKeyId: z.string().min(1),
+});
 
 export const apiGenerateSSHKey = sshKeyType;
 

packages/server/src/db/schema/web-server-settings.ts

@@ -66,6 +66,36 @@ export const webServerSettings = pgTable("webServerSettings", {
 				},
 			},
 		}),
+	// Whitelabeling Configuration (Enterprise / Proprietary)
+	whitelabelingConfig: jsonb("whitelabelingConfig")
+		.$type<{
+			appName: string | null;
+			appDescription: string | null;
+			logoUrl: string | null;
+			faviconUrl: string | null;
+			customCss: string | null;
+			loginLogoUrl: string | null;
+			supportUrl: string | null;
+			docsUrl: string | null;
+			errorPageTitle: string | null;
+			errorPageDescription: string | null;
+			metaTitle: string | null;
+			footerText: string | null;
+		}>()
+		.default({
+			appName: null,
+			appDescription: null,
+			logoUrl: null,
+			faviconUrl: null,
+			customCss: null,
+			loginLogoUrl: null,
+			supportUrl: null,
+			docsUrl: null,
+			errorPageTitle: null,
+			errorPageDescription: null,
+			metaTitle: null,
+			footerText: null,
+		}),
 	// Cache Cleanup Configuration
 	cleanupCacheApplications: boolean("cleanupCacheApplications")
 		.notNull()
@@ -154,6 +184,33 @@ export const apiUpdateDockerCleanup = z.object({
 	serverId: z.string().optional(),
 });
 
+// Whitelabeling validation schemas
+const safeUrl = z
+	.string()
+	.refine((url) => /^https?:\/\//i.test(url), {
+		message: "Only http:// and https:// URLs are allowed",
+	})
+	.nullable();
+
+export const whitelabelingConfigSchema = z.object({
+	appName: z.string().nullable(),
+	appDescription: z.string().nullable(),
+	logoUrl: safeUrl,
+	faviconUrl: safeUrl,
+	customCss: z.string().nullable(),
+	loginLogoUrl: safeUrl,
+	supportUrl: safeUrl,
+	docsUrl: safeUrl,
+	errorPageTitle: z.string().nullable(),
+	errorPageDescription: z.string().nullable(),
+	metaTitle: z.string().nullable(),
+	footerText: z.string().nullable(),
+});
+
+export const apiUpdateWhitelabeling = z.object({
+	whitelabelingConfig: whitelabelingConfigSchema,
+});
+
 export const apiUpdateWebServerMonitoring = z.object({
 	metricsConfig: z
 		.object({

packages/server/src/index.ts

@@ -27,10 +27,13 @@ export * from "./services/mongo";
 export * from "./services/mount";
 export * from "./services/mysql";
 export * from "./services/notification";
+export * from "./services/patch";
+export * from "./services/patch-repo";
 export * from "./services/port";
 export * from "./services/postgres";
 export * from "./services/preview-deployment";
 export * from "./services/project";
+export * from "./services/proprietary/license-key";
 export * from "./services/proprietary/sso";
 export * from "./services/redirect";
 export * from "./services/redis";

packages/server/src/lib/access-control.ts

@@ -0,0 +1,190 @@
+import { createAccessControl } from "better-auth/plugins/access";
+
+/**
+ * Dokploy Access Control Statements
+ *
+ * Defines all resources and their possible actions across the platform.
+ * The first 5 (organization, member, invitation, team, ac) are better-auth defaults
+ * used internally by the organization plugin.
+ * The rest are Dokploy-specific resources.
+ *
+ * Enterprise-only resources (only assignable via custom roles):
+ * deployment, envVars, server, registry, certificate, backup, domain, logs, monitoring
+ */
+export const statements = {
+	// better-auth organization plugin defaults
+	organization: ["update", "delete"],
+	member: ["read", "create", "update", "delete"],
+	invitation: ["create", "cancel"],
+	team: ["create", "update", "delete"],
+	ac: ["create", "read", "update", "delete"],
+
+	// Dokploy core resources (free tier)
+	project: ["create", "delete"],
+	service: ["create", "read", "delete"],
+	environment: ["create", "read", "delete"],
+	docker: ["read"],
+	sshKeys: ["read", "create", "delete"],
+	gitProviders: ["read", "create", "delete"],
+	traefikFiles: ["read", "write"],
+	api: ["read"],
+
+	// Enterprise-only resources (custom roles only)
+	volume: ["read", "create", "delete"],
+	deployment: ["read", "create", "cancel"],
+	envVars: ["read", "write"],
+	projectEnvVars: ["read", "write"],
+	environmentEnvVars: ["read", "write"],
+	server: ["read", "create", "delete"],
+	registry: ["read", "create", "delete"],
+	certificate: ["read", "create", "delete"],
+	backup: ["read", "create", "update", "delete", "restore"],
+	volumeBackup: ["read", "create", "update", "delete", "restore"],
+	schedule: ["read", "create", "update", "delete"],
+	domain: ["read", "create", "delete"],
+	destination: ["read", "create", "delete"],
+	notification: ["read", "create", "update", "delete"],
+	logs: ["read"],
+	monitoring: ["read"],
+	auditLog: ["read"],
+} as const;
+
+/**
+ * Enterprise-only resources. For static roles (owner/admin/member),
+ * permission checks on these resources are bypassed — they only apply
+ * when using custom roles with an enterprise license.
+ */
+export const enterpriseOnlyResources = new Set<string>([
+	"volume",
+	"deployment",
+	"envVars",
+	"projectEnvVars",
+	"environmentEnvVars",
+	"server",
+	"registry",
+	"certificate",
+	"backup",
+	"volumeBackup",
+	"schedule",
+	"domain",
+	"destination",
+	"notification",
+	"logs",
+	"monitoring",
+	"auditLog",
+]);
+
+export const ac = createAccessControl(statements);
+
+/**
+ * Owner role — full access to everything
+ */
+export const ownerRole = ac.newRole({
+	organization: ["update", "delete"],
+	member: ["read", "create", "update", "delete"],
+	invitation: ["create", "cancel"],
+	team: ["create", "update", "delete"],
+	ac: ["create", "read", "update", "delete"],
+	project: ["create", "delete"],
+	service: ["create", "read", "delete"],
+	environment: ["create", "read", "delete"],
+	docker: ["read"],
+	sshKeys: ["read", "create", "delete"],
+	gitProviders: ["read", "create", "delete"],
+	traefikFiles: ["read", "write"],
+	api: ["read"],
+	volume: ["read", "create", "delete"],
+	deployment: ["read", "create", "cancel"],
+	envVars: ["read", "write"],
+	projectEnvVars: ["read", "write"],
+	environmentEnvVars: ["read", "write"],
+	server: ["read", "create", "delete"],
+	registry: ["read", "create", "delete"],
+	certificate: ["read", "create", "delete"],
+	backup: ["read", "create", "update", "delete", "restore"],
+	volumeBackup: ["read", "create", "update", "delete", "restore"],
+	schedule: ["read", "create", "update", "delete"],
+	domain: ["read", "create", "delete"],
+	destination: ["read", "create", "delete"],
+	notification: ["read", "create", "update", "delete"],
+	logs: ["read"],
+	monitoring: ["read"],
+	auditLog: ["read"],
+});
+
+/**
+ * Admin role — same as owner but cannot delete the organization
+ */
+export const adminRole = ac.newRole({
+	organization: ["update"],
+	member: ["read", "create", "update", "delete"],
+	invitation: ["create", "cancel"],
+	team: ["create", "update", "delete"],
+	ac: ["create", "read", "update", "delete"],
+	project: ["create", "delete"],
+	service: ["create", "read", "delete"],
+	environment: ["create", "read", "delete"],
+	docker: ["read"],
+	sshKeys: ["read", "create", "delete"],
+	gitProviders: ["read", "create", "delete"],
+	traefikFiles: ["read", "write"],
+	api: ["read"],
+	volume: ["read", "create", "delete"],
+	deployment: ["read", "create", "cancel"],
+	envVars: ["read", "write"],
+	projectEnvVars: ["read", "write"],
+	environmentEnvVars: ["read", "write"],
+	server: ["read", "create", "delete"],
+	registry: ["read", "create", "delete"],
+	certificate: ["read", "create", "delete"],
+	backup: ["read", "create", "update", "delete", "restore"],
+	volumeBackup: ["read", "create", "update", "delete", "restore"],
+	schedule: ["read", "create", "update", "delete"],
+	domain: ["read", "create", "delete"],
+	destination: ["read", "create", "delete"],
+	notification: ["read", "create", "update", "delete"],
+	logs: ["read"],
+	monitoring: ["read"],
+	auditLog: ["read"],
+});
+
+/**
+ * Member role (free tier) — read-only base permissions.
+ * Members can read projects/services/environments they have access to,
+ * but cannot create, delete, or access admin resources.
+ * Enterprise resources are not available to the base member role.
+ */
+export const memberRole = ac.newRole({
+	organization: [],
+	member: [],
+	invitation: [],
+	team: [],
+	ac: ["read"],
+	project: [],
+	service: ["read"],
+	environment: ["read"],
+	docker: [],
+	sshKeys: [],
+	gitProviders: [],
+	traefikFiles: [],
+	api: [],
+	// Service-level enterprise resources — member can do everything within services they have access to
+	volume: ["read", "create", "delete"],
+	deployment: ["read", "create", "cancel"],
+	envVars: ["read", "write"],
+	projectEnvVars: ["read", "write"],
+	environmentEnvVars: ["read", "write"],
+	backup: ["read", "create", "update", "delete", "restore"],
+	volumeBackup: ["read", "create", "update", "delete", "restore"],
+	schedule: ["read", "create", "update", "delete"],
+	domain: ["read", "create", "delete"],
+	logs: ["read"],
+	monitoring: ["read"],
+	// Org-level enterprise resources — member cannot manage these
+	server: [],
+	registry: [],
+	certificate: [],
+	destination: [],
+	notification: [],
+	auditLog: [],
+});

packages/server/src/lib/auth.ts

@@ -1,15 +1,21 @@
 import type { IncomingMessage } from "node:http";
+import { apiKey } from "@better-auth/api-key";
 import { sso } from "@better-auth/sso";
 import * as bcrypt from "bcrypt";
 import { betterAuth } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
 import { APIError } from "better-auth/api";
-import { admin, apiKey, organization, twoFactor } from "better-auth/plugins";
+import { admin, organization, twoFactor } from "better-auth/plugins";
 import { and, desc, eq } from "drizzle-orm";
 import { BETTER_AUTH_SECRET, IS_CLOUD } from "../constants";
 import { db } from "../db";
 import * as schema from "../db/schema";
-import { getTrustedOrigins, getUserByToken } from "../services/admin";
+import {
+	getTrustedOrigins,
+	getTrustedProviders,
+	getUserByToken,
+} from "../services/admin";
+import { createAuditLog } from "../services/proprietary/audit-log";
 import {
 	getWebServerSettings,
 	updateWebServerSettings,
@@ -17,8 +23,7 @@ import {
 import { getHubSpotUTK, submitToHubSpot } from "../utils/tracking/hubspot";
 import { sendEmail } from "../verification/send-verification-email";
 import { getPublicIpWithFallback } from "../wss/utils";
-
-const trustedProviders = process.env?.TRUSTED_PROVIDERS?.split(",") || [];
+import { ac, adminRole, memberRole, ownerRole } from "./access-control";
 
 const { handler, api } = betterAuth({
 	database: drizzleAdapter(db, {
@@ -49,7 +54,10 @@ const { handler, api } = betterAuth({
 	account: {
 		accountLinking: {
 			enabled: true,
-			trustedProviders: ["github", "google", ...(trustedProviders || [])],
+			async trustedProviders() {
+				const fromDb = await getTrustedProviders();
+				return ["github", "google", ...fromDb];
+			},
 			allowDifferentEmails: true,
 		},
 	},
@@ -68,25 +76,32 @@ const { handler, api } = betterAuth({
 		disabled: process.env.NODE_ENV === "production",
 	},
 	async trustedOrigins() {
-		const trustedOrigins = await getTrustedOrigins();
-		if (IS_CLOUD) {
-			return trustedOrigins;
-		}
-		const settings = await getWebServerSettings();
-		if (!settings) {
+		try {
+			if (IS_CLOUD) {
+				return await getTrustedOrigins();
+			}
+			const [trustedOrigins, settings] = await Promise.all([
+				getTrustedOrigins(),
+				getWebServerSettings(),
+			]);
+			if (!settings) return [];
+			const devOrigins =
+				process.env.NODE_ENV === "development"
+					? [
+							"http://localhost:3000",
+							"https://absolutely-handy-falcon.ngrok-free.app",
+						]
+					: [];
+			return [
+				...(settings?.serverIp ? [`http://${settings?.serverIp}:3000`] : []),
+				...(settings?.host ? [`https://${settings?.host}`] : []),
+				...devOrigins,
+				...trustedOrigins,
+			];
+		} catch (error) {
+			console.error("Failed to resolve trusted origins:", error);
 			return [];
 		}
-		return [
-			...(settings?.serverIp ? [`http://${settings?.serverIp}:3000`] : []),
-			...(settings?.host ? [`https://${settings?.host}`] : []),
-			...(process.env.NODE_ENV === "development"
-				? [
-						"http://localhost:3000",
-						"https://absolutely-handy-falcon.ngrok-free.app",
-					]
-				: []),
-			...trustedOrigins,
-		];
 	},
 	emailVerification: {
 		sendOnSignUp: true,
@@ -106,7 +121,7 @@ const { handler, api } = betterAuth({
 	emailAndPassword: {
 		enabled: true,
 		autoSignIn: !IS_CLOUD,
-		requireEmailVerification: IS_CLOUD,
+		requireEmailVerification: IS_CLOUD && process.env.NODE_ENV === "production",
 		password: {
 			async hash(password) {
 				return bcrypt.hashSync(password, 10);
@@ -262,6 +277,52 @@ const { handler, api } = betterAuth({
 						},
 					};
 				},
+				after: async (session) => {
+					const orgId = (
+						session as typeof session & { activeOrganizationId?: string }
+					).activeOrganizationId;
+					if (!orgId) return;
+					const memberRecord = await db.query.member.findFirst({
+						where: and(
+							eq(schema.member.userId, session.userId),
+							eq(schema.member.organizationId, orgId),
+						),
+						with: { user: true },
+					});
+					if (!memberRecord) return;
+					await createAuditLog({
+						organizationId: orgId,
+						userId: session.userId,
+						userEmail: memberRecord.user.email,
+						userRole: memberRecord.role,
+						action: "login",
+						resourceType: "session",
+					});
+				},
+			},
+			delete: {
+				after: async (session) => {
+					const orgId = (
+						session as typeof session & { activeOrganizationId?: string }
+					).activeOrganizationId;
+					if (!orgId) return;
+					const memberRecord = await db.query.member.findFirst({
+						where: and(
+							eq(schema.member.userId, session.userId),
+							eq(schema.member.organizationId, orgId),
+						),
+						with: { user: true },
+					});
+					if (!memberRecord) return;
+					await createAuditLog({
+						organizationId: orgId,
+						userId: session.userId,
+						userEmail: memberRecord.user.email,
+						userRole: memberRecord.role,
+						action: "logout",
+						resourceType: "session",
+					});
+				},
 			},
 		},
 	},
@@ -311,10 +372,21 @@ const { handler, api } = betterAuth({
 	plugins: [
 		apiKey({
 			enableMetadata: true,
+			references: "user",
 		}),
 		sso(),
 		twoFactor(),
 		organization({
+			ac,
+			roles: {
+				owner: ownerRole,
+				admin: adminRole,
+				member: memberRole,
+			},
+			dynamicAccessControl: {
+				enabled: true,
+				maximumRolesPerOrganization: 10,
+			},
 			async sendInvitationEmail(data, _request) {
 				if (IS_CLOUD) {
 					const host =
@@ -343,13 +415,16 @@ const { handler, api } = betterAuth({
 	],
 });
 
-export const auth = {
+const _auth = {
 	handler,
 	createApiKey: api.createApiKey,
 	registerSSOProvider: api.registerSSOProvider,
 	updateSSOProvider: api.updateSSOProvider,
 };
 
+export type AuthType = typeof _auth;
+export const auth: AuthType = _auth;
+
 export const validateRequest = async (request: IncomingMessage) => {
 	const apiKey = request.headers["x-api-key"] as string;
 	if (apiKey) {
@@ -361,7 +436,7 @@ export const validateRequest = async (request: IncomingMessage) => {
 			});
 
 			if (error) {
-				throw new Error(error.message || "Error verifying API key");
+				throw new Error(error.message?.toString() || "Error verifying API key");
 			}
 			if (!valid || !key) {
 				return {
@@ -460,11 +535,16 @@ export const validateRequest = async (request: IncomingMessage) => {
 		const member = await db.query.member.findFirst({
 			where: and(
 				eq(schema.member.userId, session.user.id),
-				eq(
-					schema.member.organizationId,
-					session.session.activeOrganizationId || "",
-				),
+				...(session.session.activeOrganizationId
+					? [
+							eq(
+								schema.member.organizationId,
+								session.session.activeOrganizationId || "",
+							),
+						]
+					: []),
 			),
+			orderBy: [desc(schema.member.isDefault), desc(schema.member.createdAt)],
 			with: {
 				organization: true,
 				user: true,
@@ -476,6 +556,7 @@ export const validateRequest = async (request: IncomingMessage) => {
 			member?.user.enableEnterpriseFeatures || false;
 		session.user.isValidEnterpriseLicense =
 			member?.user.isValidEnterpriseLicense || false;
+		session.session.activeOrganizationId = member?.organization.id || "";
 		if (member) {
 			session.user.ownerId = member.organization.ownerId;
 		} else {

packages/server/src/services/admin.ts

@@ -117,21 +117,50 @@ export const getDokployUrl = async () => {
 	return `http://${settings?.serverIp}:${process.env.PORT}`;
 };
 
-export const getTrustedOrigins = async () => {
-	const members = await db.query.member.findMany({
-		where: eq(member.role, "owner"),
-		with: {
-			user: true,
-		},
-	});
+const TRUSTED_ORIGINS_CACHE_TTL_MS = 30 * 60_000;
+let trustedOriginsCache: { data: string[]; expiresAt: number } | null = null;
 
-	if (members.length === 0) {
-		return [];
+export const getTrustedOrigins = async () => {
+	const runQuery = async () => {
+		const rows = await db
+			.select({ trustedOrigins: user.trustedOrigins })
+			.from(member)
+			.innerJoin(user, eq(member.userId, user.id))
+			.where(eq(member.role, "owner"));
+		return Array.from(new Set(rows.flatMap((r) => r.trustedOrigins ?? [])));
+	};
+
+	if (IS_CLOUD) {
+		const now = Date.now();
+		if (trustedOriginsCache && now < trustedOriginsCache.expiresAt) {
+			return trustedOriginsCache.data;
+		}
+		try {
+			const trustedOrigins = await runQuery();
+			trustedOriginsCache = {
+				data: trustedOrigins,
+				expiresAt: now + TRUSTED_ORIGINS_CACHE_TTL_MS,
+			};
+			return trustedOrigins;
+		} catch (error) {
+			console.error("Failed to fetch trusted origins:", error);
+			return trustedOriginsCache?.data ?? [];
+		}
 	}
 
-	const trustedOrigins = members.flatMap(
-		(member) => member.user.trustedOrigins || [],
-	);
-
-	return Array.from(new Set(trustedOrigins));
+	try {
+		return await runQuery();
+	} catch (error) {
+		console.error("Failed to fetch trusted origins:", error);
+		return [];
+	}
+};
+
+export const getTrustedProviders = async () => {
+	try {
+		const providers = await db.query.ssoProvider.findMany();
+		return providers.map((provider) => provider.providerId);
+	} catch (error) {
+		return [];
+	}
 };

packages/server/src/services/ai.ts

@@ -2,13 +2,31 @@ import { db } from "@dokploy/server/db";
 import { ai } from "@dokploy/server/db/schema";
 import { selectAIProvider } from "@dokploy/server/utils/ai/select-ai-provider";
 import { TRPCError } from "@trpc/server";
-import { generateObject } from "ai";
+import { generateText, Output } from "ai";
 import { desc, eq } from "drizzle-orm";
 import { z } from "zod";
 import { IS_CLOUD } from "../constants";
 import { findServerById } from "./server";
 import { getWebServerSettings } from "./web-server-settings";
 
+interface SuggestionItem {
+	id: string;
+	name: string;
+	shortDescription: string;
+	description: string;
+}
+
+interface SuggestionsOutput {
+	suggestions: SuggestionItem[];
+}
+
+interface DockerOutput {
+	dockerCompose: string;
+	envVariables: Array<{ name: string; value: string }>;
+	domains: Array<{ host: string; port: number; serviceName: string }>;
+	configFiles?: Array<{ content: string; filePath: string }>;
+}
+
 export const getAiSettingsByOrganizationId = async (organizationId: string) => {
 	const aiSettings = await db.query.ai.findMany({
 		where: eq(ai.organizationId, organizationId),
@@ -60,7 +78,7 @@ interface Props {
 }
 
 export const suggestVariants = async ({
-	organizationId,
+	organizationId: _organizationId,
 	aiId,
 	input,
 	serverId,
@@ -90,173 +108,177 @@ export const suggestVariants = async ({
 			ip = "127.0.0.1";
 		}
 
-		const { object } = await generateObject({
-			model,
-			output: "object",
-			schema: z.object({
-				suggestions: z.array(
-					z.object({
-						id: z.string(),
-						name: z.string(),
-						shortDescription: z.string(),
-						description: z.string(),
-					}),
-				),
-			}),
-			prompt: `
-        Act as advanced DevOps engineer and analyze the user's request to determine the appropriate suggestions (up to 3 items).
-        
-        CRITICAL - Read the user's request carefully and follow the appropriate strategy:
-        
-        Strategy A - If the user specifies a PARTICULAR APPLICATION/SERVICE (e.g., "deploy Chatwoot", "install sendingtk/chatwoot:develop", "setup Bitwarden"):
-        - Generate different deployment VARIANTS of that SAME application
-        - Each variant should be a different configuration (minimal, full stack, with different databases, development vs production, etc.)
-        - Example: For "Chatwoot" → "Chatwoot with PostgreSQL", "Chatwoot Development", "Chatwoot Full Stack"
-        - The name MUST include the specific application name the user mentioned
-        
-        Strategy B - If the user describes a GENERAL NEED or USE CASE (e.g., "personal blog", "project management tool", "chat application"):
-        - Suggest different open source projects that fulfill that need
-        - Each suggestion should be a different tool/platform that solves the same problem
-        - Example: For "personal blog" → "WordPress", "Ghost", "Hugo with Nginx"
-        - The name should be the actual project name
-        
-        Return your response as a JSON object with the following structure:
-        {
-          "suggestions": [
-            {
-              "id": "project-or-variant-slug",
-              "name": "Project Name or Variant Name",
-              "shortDescription": "Brief one-line description",
-              "description": "Detailed description"
-            }
-          ]
-        }
-        
-        Important rules for the response:
-        1. Use slug format for the id field (lowercase, hyphenated)
-        2. Determine which strategy to use based on whether the user specified a particular application or described a general need
-        3. For Strategy A (specific app): The name must include the app name and describe the variant configuration
-        4. For Strategy B (general need): The name should be the actual project/tool name that fulfills the need
-        5. The description field should ONLY contain a plain text description of the project or variant, its features, and use cases
-        6. Do NOT include any code snippets, configuration examples, or installation instructions in the description
-        7. The shortDescription should be a single-line summary focusing on key technologies or differentiators
-        8. All suggestions should be installable in docker and have docker compose support
-        9. Provide variety in your suggestions - different complexity levels, tech stacks, or approaches
-        
-        User wants to create a new project with the following details:
-        
-        ${input}
-      `,
+		const suggestionsSchema = z.object({
+			suggestions: z.array(
+				z.object({
+					id: z.string(),
+					name: z.string(),
+					shortDescription: z.string(),
+					description: z.string(),
+				}),
+			),
 		});
+		const suggestionsResult = await generateText({
+			model,
+			// @ts-ignore - Zod + AI SDK Output.object() causes excessively deep instantiation
+			output: Output.object({ schema: suggestionsSchema }),
+			prompt: `
+		    Act as advanced DevOps engineer and analyze the user's request to determine the appropriate suggestions (up to 3 items).
+
+		    CRITICAL - Read the user's request carefully and follow the appropriate strategy:
+
+		    Strategy A - If the user specifies a PARTICULAR APPLICATION/SERVICE (e.g., "deploy Chatwoot", "install sendingtk/chatwoot:develop", "setup Bitwarden"):
+		    - Generate different deployment VARIANTS of that SAME application
+		    - Each variant should be a different configuration (minimal, full stack, with different databases, development vs production, etc.)
+		    - Example: For "Chatwoot" → "Chatwoot with PostgreSQL", "Chatwoot Development", "Chatwoot Full Stack"
+		    - The name MUST include the specific application name the user mentioned
+
+		    Strategy B - If the user describes a GENERAL NEED or USE CASE (e.g., "personal blog", "project management tool", "chat application"):
+		    - Suggest different open source projects that fulfill that need
+		    - Each suggestion should be a different tool/platform that solves the same problem
+		    - Example: For "personal blog" → "WordPress", "Ghost", "Hugo with Nginx"
+		    - The name should be the actual project name
+
+		    Return your response as a JSON object with the following structure:
+		    {
+		      "suggestions": [
+		        {
+		          "id": "project-or-variant-slug",
+		          "name": "Project Name or Variant Name",
+		          "shortDescription": "Brief one-line description",
+		          "description": "Detailed description"
+		        }
+		      ]
+		    }
+
+		    Important rules for the response:
+		    1. Use slug format for the id field (lowercase, hyphenated)
+		    2. Determine which strategy to use based on whether the user specified a particular application or described a general need
+		    3. For Strategy A (specific app): The name must include the app name and describe the variant configuration
+		    4. For Strategy B (general need): The name should be the actual project/tool name that fulfills the need
+		    5. The description field should ONLY contain a plain text description of the project or variant, its features, and use cases
+		    6. Do NOT include any code snippets, configuration examples, or installation instructions in the description
+		    7. The shortDescription should be a single-line summary focusing on key technologies or differentiators
+		    8. All suggestions should be installable in docker and have docker compose support
+		    9. Provide variety in your suggestions - different complexity levels, tech stacks, or approaches
+
+		    User wants to create a new project with the following details:
+
+		    ${input}
+		  `,
+		});
+		const object = suggestionsResult.output as SuggestionsOutput | undefined;
 
 		if (object?.suggestions?.length) {
+			const dockerSchema = z.object({
+				dockerCompose: z.string(),
+				envVariables: z.array(
+					z.object({
+						name: z.string(),
+						value: z.string(),
+					}),
+				),
+				domains: z.array(
+					z.object({
+						host: z.string(),
+						port: z.number(),
+						serviceName: z.string(),
+					}),
+				),
+				configFiles: z
+					.array(
+						z.object({
+							content: z.string(),
+							filePath: z.string(),
+						}),
+					)
+					.optional(),
+			});
 			const result = [];
 			for (const suggestion of object.suggestions) {
 				try {
-					const { object: docker } = await generateObject({
+					const dockerResult = await generateText({
 						model,
-						output: "object",
-						schema: z.object({
-							dockerCompose: z.string(),
-							envVariables: z.array(
-								z.object({
-									name: z.string(),
-									value: z.string(),
-								}),
-							),
-							domains: z.array(
-								z.object({
-									host: z.string(),
-									port: z.number(),
-									serviceName: z.string(),
-								}),
-							),
-							configFiles: z
-								.array(
-									z.object({
-										content: z.string(),
-										filePath: z.string(),
-									}),
-								)
-								.optional(),
-						}),
+						// @ts-ignore - Zod + AI SDK Output.object() causes excessively deep instantiation
+						output: Output.object({ schema: dockerSchema }),
 						prompt: `
-              Act as advanced DevOps engineer and generate docker compose with environment variables and domain configurations needed to install the following project.
-              
-              Return your response as a JSON object with this structure:
-              {
-                "dockerCompose": "yaml string here",
-                "envVariables": [{"name": "VAR_NAME", "value": "example_value"}],
-                "domains": [{"host": "domain.com", "port": 3000, "serviceName": "service"}],
-                "configFiles": [{"content": "file content", "filePath": "path/to/file"}]
-              }
-              
-              Note: configFiles is optional - only include it if configuration files are absolutely required.
-              
-              Follow these rules:
+		          Act as advanced DevOps engineer and generate docker compose with environment variables and domain configurations needed to install the following project.
 
-              Docker Compose Rules:
-              1. Use placeholder like \${VARIABLE_NAME-default} for generated variables in the docker-compose.yml
-              2. Use complex values for passwords/secrets variables
-              3. Don't set container_name field in services
-              4. Don't set version field in the docker compose
-              5. Don't set ports like 'ports: 3000:3000', use 'ports: "3000"' instead
-              6. If a service depends on a database or other service, INCLUDE that service in the docker-compose
-              7. Make sure all required services are defined in the docker-compose
+		          Return your response as a JSON object with this structure:
+		          {
+		            "dockerCompose": "yaml string here",
+		            "envVariables": [{"name": "VAR_NAME", "value": "example_value"}],
+		            "domains": [{"host": "domain.com", "port": 3000, "serviceName": "service"}],
+		            "configFiles": [{"content": "file content", "filePath": "path/to/file"}]
+		          }
 
-              Docker Image Rules (CRITICAL):
-              1. ALWAYS use 'image:' field, NEVER use 'build:' field
-              2. NEVER use 'build: .' or any build directive - we don't have local Dockerfiles
-              3. Use images from Docker Hub or other public registries (e.g., docker.io, ghcr.io, quay.io)
-              4. For dependencies (databases, redis, etc.), use official images (e.g., postgres:16, redis:7, etc.)
-              5. Always specify image tags - avoid using 'latest' tag, use specific versions when possible
-              6. Examples of correct image usage:
-                 - image: sendingtk/chatwoot:develop
-                 - image: postgres:16-alpine
-                 - image: redis:7-alpine
-                 - image: chatwoot/chatwoot:latest
-              7. Examples of INCORRECT usage (DO NOT USE):
-                 - build: .
-                 - build: ./app
-                 - build:
-                     context: .
-                     dockerfile: Dockerfile
+		          Note: configFiles is optional - only include it if configuration files are absolutely required.
 
-			  Volume Mounting and Configuration Rules:
-              1. DO NOT create configuration files unless the service CANNOT work without them
-              2. Most services can work with just environment variables - USE THEM FIRST
-              3. Ask yourself: "Can this be configured with an environment variable instead?"
-              4. If and ONLY IF a config file is absolutely required:
-                 - Keep it minimal with only critical settings
-                 - Use "../files/" prefix for all mounts
-                 - Format: "../files/folder:/container/path"
-              5. DO NOT add configuration files for:
-                 - Default configurations that work out of the box
-                 - Settings that can be handled by environment variables
-                 - Proxy or routing configurations (these are handled elsewhere)
+		          Follow these rules:
 
-			  Environment Variables Rules:
-              1. For the envVariables array, provide ACTUAL example values, not placeholders
-              2. Use realistic example values (e.g., "admin@example.com" for emails, "mypassword123" for passwords)
-			  3. DO NOT use \${VARIABLE_NAME-default} syntax in the envVariables values
-              4. ONLY include environment variables that are actually used in the docker-compose
-              5. Every environment variable referenced in the docker-compose MUST have a corresponding entry in envVariables
-              6. Do not include environment variables for services that don't exist in the docker-compose
-                     
-              For each service that needs to be exposed to the internet:
-              1. Define a domain configuration with:
-                - host: the domain name for the service in format: {service-name}-{random-3-chars-hex}-${ip ? ip.replaceAll(".", "-") : ""}.traefik.me
-                - port: the internal port the service runs on
-                - serviceName: the name of the service in the docker-compose
-              2. Make sure the service is properly configured to work with the specified port
-              
-              User's original request: ${input}
-              
-              Project details:
-              ${suggestion?.description}
-            `,
+		          Docker Compose Rules:
+		          1. Use placeholder like \${VARIABLE_NAME-default} for generated variables in the docker-compose.yml
+		          2. Use complex values for passwords/secrets variables
+		          3. Don't set container_name field in services
+		          4. Don't set version field in the docker compose
+		          5. Don't set ports like 'ports: 3000:3000', use 'ports: "3000"' instead
+		          6. If a service depends on a database or other service, INCLUDE that service in the docker-compose
+		          7. Make sure all required services are defined in the docker-compose
+
+		          Docker Image Rules (CRITICAL):
+		          1. ALWAYS use 'image:' field, NEVER use 'build:' field
+		          2. NEVER use 'build: .' or any build directive - we don't have local Dockerfiles
+		          3. Use images from Docker Hub or other public registries (e.g., docker.io, ghcr.io, quay.io)
+		          4. For dependencies (databases, redis, etc.), use official images (e.g., postgres:16, redis:7, etc.)
+		          5. Always specify image tags - avoid using 'latest' tag, use specific versions when possible
+		          6. Examples of correct image usage:
+		             - image: sendingtk/chatwoot:develop
+		             - image: postgres:16-alpine
+		             - image: redis:7-alpine
+		             - image: chatwoot/chatwoot:latest
+		          7. Examples of INCORRECT usage (DO NOT USE):
+		             - build: .
+		             - build: ./app
+		             - build:
+		                 context: .
+		                 dockerfile: Dockerfile
+
+				  Volume Mounting and Configuration Rules:
+		          1. DO NOT create configuration files unless the service CANNOT work without them
+		          2. Most services can work with just environment variables - USE THEM FIRST
+		          3. Ask yourself: "Can this be configured with an environment variable instead?"
+		          4. If and ONLY IF a config file is absolutely required:
+		             - Keep it minimal with only critical settings
+		             - Use "../files/" prefix for all mounts
+		             - Format: "../files/folder:/container/path"
+		          5. DO NOT add configuration files for:
+		             - Default configurations that work out of the box
+		             - Settings that can be handled by environment variables
+		             - Proxy or routing configurations (these are handled elsewhere)
+
+				  Environment Variables Rules:
+		          1. For the envVariables array, provide ACTUAL example values, not placeholders
+		          2. Use realistic example values (e.g., "admin@example.com" for emails, "mypassword123" for passwords)
+				  3. DO NOT use \${VARIABLE_NAME-default} syntax in the envVariables values
+		          4. ONLY include environment variables that are actually used in the docker-compose
+		          5. Every environment variable referenced in the docker-compose MUST have a corresponding entry in envVariables
+		          6. Do not include environment variables for services that don't exist in the docker-compose
+
+		          For each service that needs to be exposed to the internet:
+		          1. Define a domain configuration with:
+		            - host: the domain name for the service in format: {service-name}-{random-3-chars-hex}-${ip ? ip.replaceAll(".", "-") : ""}.traefik.me
+		            - port: the internal port the service runs on
+		            - serviceName: the name of the service in the docker-compose
+		          2. Make sure the service is properly configured to work with the specified port
+
+		          User's original request: ${input}
+
+		          Project details:
+		          ${suggestion?.description}
+		        `,
 					});
-					if (!!docker && !!docker.dockerCompose) {
+					const docker = dockerResult.output as DockerOutput | undefined;
+					if (docker?.dockerCompose) {
 						result.push({
 							...suggestion,
 							...docker,

packages/server/src/services/application.ts

@@ -29,6 +29,7 @@ import { cloneGitlabRepository } from "@dokploy/server/utils/providers/gitlab";
 import { createTraefikConfig } from "@dokploy/server/utils/traefik/application";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 import { encodeBase64 } from "../utils/docker/utils";
 import { getDokployUrl } from "./admin";
 import {
@@ -44,6 +45,7 @@ import {
 	issueCommentExists,
 	updateIssueComment,
 } from "./github";
+import { generateApplyPatchesCommand } from "./patch";
 import {
 	findPreviewDeploymentById,
 	updatePreviewDeployment,
@@ -52,7 +54,7 @@ import { validUniqueServerAppName } from "./project";
 export type Application = typeof applications.$inferSelect;
 
 export const createApplication = async (
-	input: typeof apiCreateApplication._type,
+	input: z.infer<typeof apiCreateApplication>,
 ) => {
 	const appName = buildAppName("app", input.appName);
 
@@ -202,6 +204,14 @@ export const deployApplication = async ({
 			command += await buildRemoteDocker(application);
 		}
 
+		if (application.sourceType !== "docker") {
+			command += await generateApplyPatchesCommand({
+				id: application.applicationId,
+				type: "application",
+				serverId,
+			});
+		}
+
 		command += await getBuildCommand(application);
 
 		const commandWithLog = `(${command}) >> ${deployment.logPath} 2>&1`;

packages/server/src/services/backup.ts

@@ -2,17 +2,16 @@ import { db } from "@dokploy/server/db";
 import { type apiCreateBackup, backups } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 
 export type Backup = typeof backups.$inferSelect;
 
 export type BackupSchedule = Awaited<ReturnType<typeof findBackupById>>;
 export type BackupScheduleList = Awaited<ReturnType<typeof findBackupsByDbId>>;
-export const createBackup = async (input: typeof apiCreateBackup._type) => {
+export const createBackup = async (input: z.infer<typeof apiCreateBackup>) => {
 	const newBackup = await db
 		.insert(backups)
-		.values({
-			...input,
-		})
+		.values({ ...input } as typeof backups.$inferInsert)
 		.returning()
 		.then((value) => value[0]);
 

packages/server/src/services/bitbucket.ts

@@ -7,11 +7,12 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 
 export type Bitbucket = typeof bitbucket.$inferSelect;
 
 export const createBitbucket = async (
-	input: typeof apiCreateBitbucket._type,
+	input: z.infer<typeof apiCreateBitbucket>,
 	organizationId: string,
 	userId: string,
 ) => {
@@ -65,7 +66,7 @@ export const findBitbucketById = async (bitbucketId: string) => {
 
 export const updateBitbucket = async (
 	bitbucketId: string,
-	input: typeof apiUpdateBitbucket._type,
+	input: z.infer<typeof apiUpdateBitbucket>,
 ) => {
 	return await db.transaction(async (tx) => {
 		// First get the current bitbucket provider to get gitProviderId

packages/server/src/services/compose.ts

@@ -33,6 +33,7 @@ import { cloneGitlabRepository } from "@dokploy/server/utils/providers/gitlab";
 import { getCreateComposeFileCommand } from "@dokploy/server/utils/providers/raw";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 import { encodeBase64 } from "../utils/docker/utils";
 import { getDokployUrl } from "./admin";
 import {
@@ -40,11 +41,14 @@ import {
 	updateDeployment,
 	updateDeploymentStatus,
 } from "./deployment";
+import { generateApplyPatchesCommand } from "./patch";
 import { validUniqueServerAppName } from "./project";
 
 export type Compose = typeof compose.$inferSelect;
 
-export const createCompose = async (input: typeof apiCreateCompose._type) => {
+export const createCompose = async (
+	input: z.infer<typeof apiCreateCompose>,
+) => {
 	const appName = buildAppName("compose", input.appName);
 
 	const valid = await validUniqueServerAppName(appName);
@@ -247,8 +251,15 @@ export const deployCompose = async ({
 		} else {
 			await execAsync(commandWithLog);
 		}
-
 		command = "set -e;";
+		if (compose.sourceType !== "raw") {
+			command += await generateApplyPatchesCommand({
+				id: compose.composeId,
+				type: "compose",
+				serverId: compose.serverId,
+			});
+		}
+
 		command += await getBuildComposeCommand(entity);
 		commandWithLog = `(${command}) >> ${deployment.logPath} 2>&1`;
 		if (compose.serverId) {

packages/server/src/services/deployment.ts

@@ -10,13 +10,21 @@ import {
 	type apiCreateDeploymentSchedule,
 	type apiCreateDeploymentServer,
 	type apiCreateDeploymentVolumeBackup,
+	applications,
+	compose,
 	deployments,
+	environments,
+	projects,
 } from "@dokploy/server/db/schema";
 import { removeDirectoryIfExistsContent } from "@dokploy/server/utils/filesystem/directory";
-import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
+import {
+	execAsync,
+	execAsyncRemote,
+} from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { format } from "date-fns";
-import { desc, eq } from "drizzle-orm";
+import { desc, eq, and, inArray, or, sql } from "drizzle-orm";
+import type { z } from "zod";
 import {
 	type Application,
 	findApplicationById,
@@ -34,6 +42,41 @@ import { findScheduleById } from "./schedule";
 import { findServerById, type Server } from "./server";
 import { findVolumeBackupById } from "./volume-backups";
 
+export type ServicePath = { href: string | null; label: string };
+
+export async function resolveServicePath(
+	orgId: string,
+	data: Record<string, unknown>,
+): Promise<ServicePath> {
+	try {
+		const applicationId = data?.applicationId as string | undefined;
+		const composeId = data?.composeId as string | undefined;
+		if (applicationId) {
+			const app = await findApplicationById(applicationId);
+			if (app.environment.project.organizationId !== orgId) {
+				return { href: null, label: "Application" };
+			}
+			return {
+				href: `/dashboard/project/${app.environment.project.projectId}/environment/${app.environment.environmentId}/services/application/${app.applicationId}`,
+				label: "Application",
+			};
+		}
+		if (composeId) {
+			const comp = await findComposeById(composeId);
+			if (comp.environment.project.organizationId !== orgId) {
+				return { href: null, label: "Compose" };
+			}
+			return {
+				href: `/dashboard/project/${comp.environment.project.projectId}/environment/${comp.environment.environmentId}/services/compose/${comp.composeId}`,
+				label: "Compose",
+			};
+		}
+	} catch {
+		// not found or unauthorized
+	}
+	return { href: null, label: "—" };
+}
+
 export type Deployment = typeof deployments.$inferSelect;
 
 export const findDeploymentById = async (deploymentId: string) => {
@@ -69,17 +112,17 @@ export const findDeploymentByApplicationId = async (applicationId: string) => {
 
 export const createDeployment = async (
 	deployment: Omit<
-		typeof apiCreateDeployment._type,
+		z.infer<typeof apiCreateDeployment>,
 		"deploymentId" | "createdAt" | "status" | "logPath"
 	>,
 ) => {
 	const application = await findApplicationById(deployment.applicationId);
+	await removeLastTenDeployments(
+		deployment.applicationId,
+		"application",
+		application.serverId,
+	);
 	try {
-		await removeLastTenDeployments(
-			deployment.applicationId,
-			"application",
-			application.serverId,
-		);
 		const serverId = application.buildServerId || application.serverId;
 
 		const { LOGS_PATH } = paths(!!serverId);
@@ -150,20 +193,19 @@ export const createDeployment = async (
 
 export const createDeploymentPreview = async (
 	deployment: Omit<
-		typeof apiCreateDeploymentPreview._type,
+		z.infer<typeof apiCreateDeploymentPreview>,
 		"deploymentId" | "createdAt" | "status" | "logPath"
 	>,
 ) => {
 	const previewDeployment = await findPreviewDeploymentById(
 		deployment.previewDeploymentId,
 	);
+	await removeLastTenDeployments(
+		deployment.previewDeploymentId,
+		"previewDeployment",
+		previewDeployment?.application?.serverId,
+	);
 	try {
-		await removeLastTenDeployments(
-			deployment.previewDeploymentId,
-			"previewDeployment",
-			previewDeployment?.application?.serverId,
-		);
-
 		const appName = `${previewDeployment.appName}`;
 		const { LOGS_PATH } = paths(!!previewDeployment?.application?.serverId);
 		const formattedDateTime = format(new Date(), "yyyy-MM-dd:HH:mm:ss");
@@ -233,17 +275,17 @@ export const createDeploymentPreview = async (
 
 export const createDeploymentCompose = async (
 	deployment: Omit<
-		typeof apiCreateDeploymentCompose._type,
+		z.infer<typeof apiCreateDeploymentCompose>,
 		"deploymentId" | "createdAt" | "status" | "logPath"
 	>,
 ) => {
 	const compose = await findComposeById(deployment.composeId);
+	await removeLastTenDeployments(
+		deployment.composeId,
+		"compose",
+		compose.serverId,
+	);
 	try {
-		await removeLastTenDeployments(
-			deployment.composeId,
-			"compose",
-			compose.serverId,
-		);
 		const { LOGS_PATH } = paths(!!compose.serverId);
 		const formattedDateTime = format(new Date(), "yyyy-MM-dd:HH:mm:ss");
 		const fileName = `${compose.appName}-${formattedDateTime}.log`;
@@ -310,7 +352,7 @@ echo "Initializing deployment\n" >> ${logFilePath};
 
 export const createDeploymentBackup = async (
 	deployment: Omit<
-		typeof apiCreateDeploymentBackup._type,
+		z.infer<typeof apiCreateDeploymentBackup>,
 		"deploymentId" | "createdAt" | "status" | "logPath"
 	>,
 ) => {
@@ -326,8 +368,8 @@ export const createDeploymentBackup = async (
 	} else if (backup.backupType === "compose") {
 		serverId = backup.compose?.serverId;
 	}
+	await removeLastTenDeployments(deployment.backupId, "backup", serverId);
 	try {
-		await removeLastTenDeployments(deployment.backupId, "backup", serverId);
 		const { LOGS_PATH } = paths(!!serverId);
 		const formattedDateTime = format(new Date(), "yyyy-MM-dd:HH:mm:ss");
 		const fileName = `${backup.appName}-${formattedDateTime}.log`;
@@ -390,18 +432,18 @@ echo "Initializing backup\n" >> ${logFilePath};
 
 export const createDeploymentSchedule = async (
 	deployment: Omit<
-		typeof apiCreateDeploymentSchedule._type,
+		z.infer<typeof apiCreateDeploymentSchedule>,
 		"deploymentId" | "createdAt" | "status" | "logPath"
 	>,
 ) => {
 	const schedule = await findScheduleById(deployment.scheduleId);
 
+	const serverId =
+		schedule.application?.serverId ||
+		schedule.compose?.serverId ||
+		schedule.server?.serverId;
+	await removeLastTenDeployments(deployment.scheduleId, "schedule", serverId);
 	try {
-		const serverId =
-			schedule.application?.serverId ||
-			schedule.compose?.serverId ||
-			schedule.server?.serverId;
-		await removeLastTenDeployments(deployment.scheduleId, "schedule", serverId);
 		const { SCHEDULES_PATH } = paths(!!serverId);
 		const formattedDateTime = format(new Date(), "yyyy-MM-dd:HH:mm:ss");
 		const fileName = `${schedule.appName}-${formattedDateTime}.log`;
@@ -466,20 +508,20 @@ export const createDeploymentSchedule = async (
 
 export const createDeploymentVolumeBackup = async (
 	deployment: Omit<
-		typeof apiCreateDeploymentVolumeBackup._type,
+		z.infer<typeof apiCreateDeploymentVolumeBackup>,
 		"deploymentId" | "createdAt" | "status" | "logPath"
 	>,
 ) => {
 	const volumeBackup = await findVolumeBackupById(deployment.volumeBackupId);
 
+	const serverId =
+		volumeBackup.application?.serverId || volumeBackup.compose?.serverId;
+	await removeLastTenDeployments(
+		deployment.volumeBackupId,
+		"volumeBackup",
+		serverId,
+	);
 	try {
-		const serverId =
-			volumeBackup.application?.serverId || volumeBackup.compose?.serverId;
-		await removeLastTenDeployments(
-			deployment.volumeBackupId,
-			"volumeBackup",
-			serverId,
-		);
 		const { VOLUME_BACKUPS_PATH } = paths(!!serverId);
 		const formattedDateTime = format(new Date(), "yyyy-MM-dd:HH:mm:ss");
 		const fileName = `${volumeBackup.appName}-${formattedDateTime}.log`;
@@ -554,11 +596,27 @@ export const removeDeployment = async (deploymentId: string) => {
 		const deployment = await db
 			.delete(deployments)
 			.where(eq(deployments.deploymentId, deploymentId))
-			.returning();
-		return deployment[0];
+			.returning()
+			.then((result) => result[0]);
+
+		if (!deployment) {
+			return null;
+		}
+
+		const logPath = path.join(deployment.logPath);
+		if (logPath && logPath !== ".") {
+			const command = `rm -f ${logPath};`;
+			if (deployment.serverId) {
+				await execAsyncRemote(deployment.serverId, command);
+			} else {
+				await execAsync(command);
+			}
+		}
+
+		return deployment;
 	} catch (error) {
 		const message =
-			error instanceof Error ? error.message : "Error creating the deployment";
+			error instanceof Error ? error.message : "Error removing the deployment";
 		throw new TRPCError({
 			code: "BAD_REQUEST",
 			message,
@@ -626,34 +684,49 @@ const removeLastTenDeployments = async (
 		if (serverId) {
 			let command = "";
 			for (const oldDeployment of deploymentsToDelete) {
-				const logPath = path.join(oldDeployment.logPath);
-				if (oldDeployment.rollbackId) {
-					await removeRollbackById(oldDeployment.rollbackId);
-				}
+				try {
+					const logPath = path.join(oldDeployment.logPath);
+					if (oldDeployment.rollbackId) {
+						await removeRollbackById(oldDeployment.rollbackId);
+					}
 
-				if (logPath !== ".") {
-					command += `
-					rm -rf ${logPath};
-					`;
+					if (logPath && logPath !== ".") {
+						command += `rm -rf ${logPath};`;
+					}
+					await removeDeployment(oldDeployment.deploymentId);
+				} catch (err) {
+					console.error(
+						`Failed to remove deployment ${oldDeployment.deploymentId} during cleanup:`,
+						err,
+					);
 				}
-				await removeDeployment(oldDeployment.deploymentId);
 			}
 
-			await execAsyncRemote(serverId, command);
+			if (command) {
+				await execAsyncRemote(serverId, command);
+			}
 		} else {
 			for (const oldDeployment of deploymentsToDelete) {
-				if (oldDeployment.rollbackId) {
-					await removeRollbackById(oldDeployment.rollbackId);
+				try {
+					if (oldDeployment.rollbackId) {
+						await removeRollbackById(oldDeployment.rollbackId);
+					}
+					const logPath = path.join(oldDeployment.logPath);
+					if (
+						logPath &&
+						logPath !== "." &&
+						existsSync(logPath) &&
+						!oldDeployment.errorMessage
+					) {
+						await fsPromises.unlink(logPath);
+					}
+					await removeDeployment(oldDeployment.deploymentId);
+				} catch (err) {
+					console.error(
+						`Failed to remove deployment ${oldDeployment.deploymentId} during cleanup:`,
+						err,
+					);
 				}
-				const logPath = path.join(oldDeployment.logPath);
-				if (
-					existsSync(logPath) &&
-					!oldDeployment.errorMessage &&
-					logPath !== "."
-				) {
-					await fsPromises.unlink(logPath);
-				}
-				await removeDeployment(oldDeployment.deploymentId);
 			}
 		}
 	}
@@ -717,6 +790,135 @@ export const findAllDeploymentsByComposeId = async (composeId: string) => {
 	return deploymentsList;
 };
 
+const centralizedDeploymentsWith = {
+	application: {
+		columns: { applicationId: true, name: true, appName: true },
+		with: {
+			environment: {
+				columns: { environmentId: true, name: true },
+				with: {
+					project: {
+						columns: { projectId: true, name: true },
+					},
+				},
+			},
+			server: {
+				columns: { serverId: true, name: true, serverType: true },
+			},
+			buildServer: {
+				columns: { serverId: true, name: true, serverType: true },
+			},
+		},
+	},
+	compose: {
+		columns: { composeId: true, name: true, appName: true },
+		with: {
+			environment: {
+				columns: { environmentId: true, name: true },
+				with: {
+					project: {
+						columns: { projectId: true, name: true },
+					},
+				},
+			},
+			server: {
+				columns: { serverId: true, name: true, serverType: true },
+			},
+		},
+	},
+	server: {
+		columns: { serverId: true, name: true, serverType: true },
+	},
+	buildServer: {
+		columns: { serverId: true, name: true, serverType: true },
+	},
+} as const;
+
+async function getApplicationIdsInOrg(
+	orgId: string,
+	accessedServices: string[] | null,
+): Promise<string[]> {
+	const rows = await db
+		.select({ applicationId: applications.applicationId })
+		.from(applications)
+		.innerJoin(
+			environments,
+			eq(applications.environmentId, environments.environmentId),
+		)
+		.innerJoin(projects, eq(environments.projectId, projects.projectId))
+		.where(
+			accessedServices !== null
+				? and(
+						eq(projects.organizationId, orgId),
+						inArray(applications.applicationId, accessedServices),
+					)
+				: eq(projects.organizationId, orgId),
+		);
+	return rows.map((r) => r.applicationId);
+}
+
+async function getComposeIdsInOrg(
+	orgId: string,
+	accessedServices: string[] | null,
+): Promise<string[]> {
+	const rows = await db
+		.select({ composeId: compose.composeId })
+		.from(compose)
+		.innerJoin(
+			environments,
+			eq(compose.environmentId, environments.environmentId),
+		)
+		.innerJoin(projects, eq(environments.projectId, projects.projectId))
+		.where(
+			accessedServices !== null
+				? and(
+						eq(projects.organizationId, orgId),
+						inArray(compose.composeId, accessedServices),
+					)
+				: eq(projects.organizationId, orgId),
+		);
+	return rows.map((r) => r.composeId);
+}
+
+/**
+ * All deployments for applications and compose in the org.
+ * Pass accessedServices for members (only those services), null for owner/admin.
+ */
+export const findAllDeploymentsCentralized = async (
+	orgId: string,
+	accessedServices: string[] | null,
+) => {
+	if (accessedServices !== null && accessedServices.length === 0) {
+		return [];
+	}
+
+	const [appIds, compIds] = await Promise.all([
+		getApplicationIdsInOrg(orgId, accessedServices),
+		getComposeIdsInOrg(orgId, accessedServices),
+	]);
+
+	if (appIds.length === 0 && compIds.length === 0) {
+		return [];
+	}
+
+	const conditions = [
+		...(appIds.length > 0 ? [inArray(deployments.applicationId, appIds)] : []),
+		...(compIds.length > 0 ? [inArray(deployments.composeId, compIds)] : []),
+	];
+	const whereClause =
+		conditions.length === 0
+			? sql`1 = 0`
+			: conditions.length === 1
+				? conditions[0]
+				: or(...conditions);
+
+	return db.query.deployments.findMany({
+		where: whereClause,
+		orderBy: desc(deployments.createdAt),
+		with: centralizedDeploymentsWith,
+	});
+};
+
 export const updateDeployment = async (
 	deploymentId: string,
 	deploymentData: Partial<Deployment>,
@@ -753,7 +955,7 @@ export const updateDeploymentStatus = async (
 
 export const createServerDeployment = async (
 	deployment: Omit<
-		typeof apiCreateDeploymentServer._type,
+		z.infer<typeof apiCreateDeploymentServer>,
 		"deploymentId" | "createdAt" | "status" | "logPath"
 	>,
 ) => {
@@ -831,3 +1033,19 @@ export const findAllDeploymentsByServerId = async (serverId: string) => {
 	});
 	return deploymentsList;
 };
+
+export const clearOldDeployments = async (
+	appName: string,
+	serverId: string | null,
+) => {
+	const { LOGS_PATH } = paths(!!serverId);
+	const folder = path.join(LOGS_PATH, appName);
+	const command = `
+		rm -rf ${folder};
+	`;
+	if (serverId) {
+		await execAsyncRemote(serverId, command);
+	} else {
+		await execAsync(command);
+	}
+};

packages/server/src/services/destination.ts

@@ -5,11 +5,12 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { and, eq } from "drizzle-orm";
+import type { z } from "zod";
 
 export type Destination = typeof destinations.$inferSelect;
 
 export const createDestintation = async (
-	input: typeof apiCreateDestination._type,
+	input: z.infer<typeof apiCreateDestination>,
 	organizationId: string,
 ) => {
 	const newDestination = await db

packages/server/src/services/domain.ts

@@ -6,6 +6,7 @@ import { generateRandomDomain } from "@dokploy/server/templates";
 import { manageDomain } from "@dokploy/server/utils/traefik/domain";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 import { type apiCreateDomain, domains } from "../db/schema";
 import { findApplicationById } from "./application";
 import { detectCDNProvider } from "./cdn";
@@ -13,14 +14,14 @@ import { findServerById } from "./server";
 
 export type Domain = typeof domains.$inferSelect;
 
-export const createDomain = async (input: typeof apiCreateDomain._type) => {
+export const createDomain = async (input: z.infer<typeof apiCreateDomain>) => {
 	const result = await db.transaction(async (tx) => {
 		const domain = await tx
 			.insert(domains)
 			.values({
 				...input,
 				host: input.host?.trim(),
-			})
+			} as typeof domains.$inferInsert)
 			.returning()
 			.then((response) => response[0]);
 
@@ -44,7 +45,7 @@ export const createDomain = async (input: typeof apiCreateDomain._type) => {
 
 export const generateTraefikMeDomain = async (
 	appName: string,
-	userId: string,
+	_userId: string,
 	serverId?: string,
 ) => {
 	if (serverId) {

packages/server/src/services/environment.ts

@@ -6,11 +6,12 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { asc, eq } from "drizzle-orm";
+import type { z } from "zod";
 
 export type Environment = typeof environments.$inferSelect;
 
 export const createEnvironment = async (
-	input: typeof apiCreateEnvironment._type,
+	input: z.infer<typeof apiCreateEnvironment>,
 ) => {
 	const newEnvironment = await db
 		.insert(environments)
@@ -33,42 +34,139 @@ export const createEnvironment = async (
 export const findEnvironmentById = async (environmentId: string) => {
 	const environment = await db.query.environments.findFirst({
 		where: eq(environments.environmentId, environmentId),
+		columns: {
+			name: true,
+			description: true,
+			environmentId: true,
+			isDefault: true,
+			projectId: true,
+			env: true,
+		},
 		with: {
 			applications: {
 				with: {
-					deployments: true,
-					server: true,
+					server: {
+						columns: {
+							name: true,
+							serverId: true,
+						},
+					},
+				},
+				columns: {
+					name: true,
+					applicationId: true,
+					createdAt: true,
+					applicationStatus: true,
+					description: true,
+					serverId: true,
 				},
 			},
 			mariadb: {
 				with: {
-					server: true,
+					server: {
+						columns: {
+							name: true,
+							serverId: true,
+						},
+					},
+				},
+				columns: {
+					mariadbId: true,
+					name: true,
+					createdAt: true,
+					applicationStatus: true,
+					description: true,
+					serverId: true,
 				},
 			},
 			mongo: {
 				with: {
-					server: true,
+					server: {
+						columns: {
+							name: true,
+							serverId: true,
+						},
+					},
+				},
+				columns: {
+					mongoId: true,
+					name: true,
+					createdAt: true,
+					applicationStatus: true,
+					description: true,
+					serverId: true,
 				},
 			},
 			mysql: {
 				with: {
-					server: true,
+					server: {
+						columns: {
+							name: true,
+							serverId: true,
+						},
+					},
+				},
+				columns: {
+					mysqlId: true,
+					name: true,
+					createdAt: true,
+					applicationStatus: true,
+					description: true,
+					serverId: true,
 				},
 			},
 			postgres: {
 				with: {
-					server: true,
+					server: {
+						columns: {
+							name: true,
+							serverId: true,
+						},
+					},
+				},
+				columns: {
+					postgresId: true,
+					name: true,
+					description: true,
+					createdAt: true,
+					applicationStatus: true,
+					serverId: true,
 				},
 			},
 			redis: {
 				with: {
-					server: true,
+					server: {
+						columns: {
+							name: true,
+							serverId: true,
+						},
+					},
+				},
+				columns: {
+					redisId: true,
+					name: true,
+					createdAt: true,
+					applicationStatus: true,
+					description: true,
+					serverId: true,
 				},
 			},
 			compose: {
 				with: {
-					deployments: true,
-					server: true,
+					server: {
+						columns: {
+							name: true,
+							serverId: true,
+						},
+					},
+				},
+				columns: {
+					composeId: true,
+					name: true,
+					createdAt: true,
+					composeStatus: true,
+					description: true,
+					serverId: true,
 				},
 			},
 			project: true,
@@ -97,10 +195,30 @@ export const findEnvironmentsByProjectId = async (projectId: string) => {
 			compose: true,
 			project: true,
 		},
+		columns: {
+			name: true,
+			description: true,
+			environmentId: true,
+			isDefault: true,
+		},
 	});
 	return projectEnvironments;
 };
 
+const environmentHasServices = (
+	env: Awaited<ReturnType<typeof findEnvironmentById>>,
+) => {
+	return (
+		(env.applications?.length ?? 0) > 0 ||
+		(env.compose?.length ?? 0) > 0 ||
+		(env.mariadb?.length ?? 0) > 0 ||
+		(env.mongo?.length ?? 0) > 0 ||
+		(env.mysql?.length ?? 0) > 0 ||
+		(env.postgres?.length ?? 0) > 0 ||
+		(env.redis?.length ?? 0) > 0
+	);
+};
+
 export const deleteEnvironment = async (environmentId: string) => {
 	const currentEnvironment = await findEnvironmentById(environmentId);
 	if (currentEnvironment.isDefault) {
@@ -109,6 +227,13 @@ export const deleteEnvironment = async (environmentId: string) => {
 			message: "You cannot delete the default environment",
 		});
 	}
+	if (environmentHasServices(currentEnvironment)) {
+		throw new TRPCError({
+			code: "BAD_REQUEST",
+			message:
+				"Cannot delete environment: it has active services. Delete all services first.",
+		});
+	}
 	const deletedEnvironment = await db
 		.delete(environments)
 		.where(eq(environments.environmentId, environmentId))
@@ -135,7 +260,7 @@ export const updateEnvironmentById = async (
 };
 
 export const duplicateEnvironment = async (
-	input: typeof apiDuplicateEnvironment._type,
+	input: z.infer<typeof apiDuplicateEnvironment>,
 ) => {
 	// Find the original environment
 	const originalEnvironment = await findEnvironmentById(input.environmentId);
@@ -147,6 +272,7 @@ export const duplicateEnvironment = async (
 			name: input.name,
 			description: input.description || originalEnvironment.description,
 			projectId: originalEnvironment.projectId,
+			env: originalEnvironment.env,
 		})
 		.returning()
 		.then((value) => value[0]);

packages/server/src/services/gitea.ts

@@ -6,11 +6,12 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 
 export type Gitea = typeof gitea.$inferSelect;
 
 export const createGitea = async (
-	input: typeof apiCreateGitea._type,
+	input: z.infer<typeof apiCreateGitea>,
 	organizationId: string,
 	userId: string,
 ) => {

packages/server/src/services/github.ts

@@ -6,12 +6,13 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 import { authGithub } from "../utils/providers/github";
 import { updatePreviewDeployment } from "./preview-deployment";
 
 export type Github = typeof github.$inferSelect;
 export const createGithub = async (
-	input: typeof apiCreateGithub._type,
+	input: z.infer<typeof apiCreateGithub>,
 	organizationId: string,
 	userId: string,
 ) => {

packages/server/src/services/gitlab.ts

@@ -6,11 +6,12 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 
 export type Gitlab = typeof gitlab.$inferSelect;
 
 export const createGitlab = async (
-	input: typeof apiCreateGitlab._type,
+	input: z.infer<typeof apiCreateGitlab>,
 	organizationId: string,
 	userId: string,
 ) => {

packages/server/src/services/mariadb.ts

@@ -11,11 +11,14 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
+import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
 
 export type Mariadb = typeof mariadb.$inferSelect;
 
-export const createMariadb = async (input: typeof apiCreateMariaDB._type) => {
+export const createMariadb = async (
+	input: z.infer<typeof apiCreateMariaDB>,
+) => {
 	const appName = buildAppName("mariadb", input.appName);
 
 	const valid = await validUniqueServerAppName(appName);

packages/server/src/services/mongo.ts

@@ -12,11 +12,12 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
+import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
 
 export type Mongo = typeof mongo.$inferSelect;
 
-export const createMongo = async (input: typeof apiCreateMongo._type) => {
+export const createMongo = async (input: z.infer<typeof apiCreateMongo>) => {
 	const appName = buildAppName("mongo", input.appName);
 
 	const valid = await validUniqueServerAppName(appName);

packages/server/src/services/mount.ts

@@ -18,10 +18,11 @@ import {
 } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, type SQL, sql } from "drizzle-orm";
+import type { z } from "zod";
 
 export type Mount = typeof mounts.$inferSelect;
 
-export const createMount = async (input: typeof apiCreateMount._type) => {
+export const createMount = async (input: z.infer<typeof apiCreateMount>) => {
 	try {
 		const { serviceId, ...rest } = input;
 		const value = await db
@@ -262,6 +263,9 @@ export const findMountsByApplicationId = async (
 		case "redis":
 			sqlChunks.push(eq(mounts.redisId, serviceId));
 			break;
+		case "compose":
+			sqlChunks.push(eq(mounts.composeId, serviceId));
+			break;
 		default:
 			throw new Error(`Unknown service type: ${serviceType}`);
 	}

packages/server/src/services/mysql.ts

@@ -11,11 +11,12 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
+import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
 
 export type MySql = typeof mysql.$inferSelect;
 
-export const createMysql = async (input: typeof apiCreateMySql._type) => {
+export const createMysql = async (input: z.infer<typeof apiCreateMySql>) => {
 	const appName = buildAppName("mysql", input.appName);
 
 	const valid = await validUniqueServerAppName(appName);

packages/server/src/services/notification.ts

@@ -9,6 +9,7 @@ import {
 	type apiCreatePushover,
 	type apiCreateResend,
 	type apiCreateSlack,
+	type apiCreateTeams,
 	type apiCreateTelegram,
 	type apiUpdateCustom,
 	type apiUpdateDiscord,
@@ -19,6 +20,7 @@ import {
 	type apiUpdatePushover,
 	type apiUpdateResend,
 	type apiUpdateSlack,
+	type apiUpdateTeams,
 	type apiUpdateTelegram,
 	custom,
 	discord,
@@ -30,15 +32,17 @@ import {
 	pushover,
 	resend,
 	slack,
+	teams,
 	telegram,
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 
 export type Notification = typeof notifications.$inferSelect;
 
 export const createSlackNotification = async (
-	input: typeof apiCreateSlack._type,
+	input: z.infer<typeof apiCreateSlack>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -88,7 +92,7 @@ export const createSlackNotification = async (
 };
 
 export const updateSlackNotification = async (
-	input: typeof apiUpdateSlack._type,
+	input: z.infer<typeof apiUpdateSlack>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -130,7 +134,7 @@ export const updateSlackNotification = async (
 };
 
 export const createTelegramNotification = async (
-	input: typeof apiCreateTelegram._type,
+	input: z.infer<typeof apiCreateTelegram>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -181,7 +185,7 @@ export const createTelegramNotification = async (
 };
 
 export const updateTelegramNotification = async (
-	input: typeof apiUpdateTelegram._type,
+	input: z.infer<typeof apiUpdateTelegram>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -224,7 +228,7 @@ export const updateTelegramNotification = async (
 };
 
 export const createDiscordNotification = async (
-	input: typeof apiCreateDiscord._type,
+	input: z.infer<typeof apiCreateDiscord>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -274,7 +278,7 @@ export const createDiscordNotification = async (
 };
 
 export const updateDiscordNotification = async (
-	input: typeof apiUpdateDiscord._type,
+	input: z.infer<typeof apiUpdateDiscord>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -316,7 +320,7 @@ export const updateDiscordNotification = async (
 };
 
 export const createEmailNotification = async (
-	input: typeof apiCreateEmail._type,
+	input: z.infer<typeof apiCreateEmail>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -370,7 +374,7 @@ export const createEmailNotification = async (
 };
 
 export const updateEmailNotification = async (
-	input: typeof apiUpdateEmail._type,
+	input: z.infer<typeof apiUpdateEmail>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -416,7 +420,7 @@ export const updateEmailNotification = async (
 };
 
 export const createResendNotification = async (
-	input: typeof apiCreateResend._type,
+	input: z.infer<typeof apiCreateResend>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -467,7 +471,7 @@ export const createResendNotification = async (
 };
 
 export const updateResendNotification = async (
-	input: typeof apiUpdateResend._type,
+	input: z.infer<typeof apiUpdateResend>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -510,7 +514,7 @@ export const updateResendNotification = async (
 };
 
 export const createGotifyNotification = async (
-	input: typeof apiCreateGotify._type,
+	input: z.infer<typeof apiCreateGotify>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -561,7 +565,7 @@ export const createGotifyNotification = async (
 };
 
 export const updateGotifyNotification = async (
-	input: typeof apiUpdateGotify._type,
+	input: z.infer<typeof apiUpdateGotify>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -602,7 +606,7 @@ export const updateGotifyNotification = async (
 };
 
 export const createNtfyNotification = async (
-	input: typeof apiCreateNtfy._type,
+	input: z.infer<typeof apiCreateNtfy>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -653,7 +657,7 @@ export const createNtfyNotification = async (
 };
 
 export const updateNtfyNotification = async (
-	input: typeof apiUpdateNtfy._type,
+	input: z.infer<typeof apiUpdateNtfy>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -694,7 +698,7 @@ export const updateNtfyNotification = async (
 };
 
 export const createCustomNotification = async (
-	input: typeof apiCreateCustom._type,
+	input: z.infer<typeof apiCreateCustom>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -743,7 +747,7 @@ export const createCustomNotification = async (
 };
 
 export const updateCustomNotification = async (
-	input: typeof apiUpdateCustom._type,
+	input: z.infer<typeof apiUpdateCustom>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -796,6 +800,7 @@ export const findNotificationById = async (notificationId: string) => {
 			custom: true,
 			lark: true,
 			pushover: true,
+			teams: true,
 		},
 	});
 	if (!notification) {
@@ -817,7 +822,7 @@ export const removeNotificationById = async (notificationId: string) => {
 };
 
 export const createLarkNotification = async (
-	input: typeof apiCreateLark._type,
+	input: z.infer<typeof apiCreateLark>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -865,7 +870,7 @@ export const createLarkNotification = async (
 };
 
 export const updateLarkNotification = async (
-	input: typeof apiUpdateLark._type,
+	input: z.infer<typeof apiUpdateLark>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -905,6 +910,96 @@ export const updateLarkNotification = async (
 	});
 };
 
+export const createTeamsNotification = async (
+	input: z.infer<typeof apiCreateTeams>,
+	organizationId: string,
+) => {
+	await db.transaction(async (tx) => {
+		const newTeams = await tx
+			.insert(teams)
+			.values({
+				webhookUrl: input.webhookUrl,
+			})
+			.returning()
+			.then((value) => value[0]);
+
+		if (!newTeams) {
+			throw new TRPCError({
+				code: "BAD_REQUEST",
+				message: "Error input: Inserting teams",
+			});
+		}
+
+		const newDestination = await tx
+			.insert(notifications)
+			.values({
+				teamsId: newTeams.teamsId,
+				name: input.name,
+				appDeploy: input.appDeploy,
+				appBuildError: input.appBuildError,
+				databaseBackup: input.databaseBackup,
+				volumeBackup: input.volumeBackup,
+				dokployRestart: input.dokployRestart,
+				dockerCleanup: input.dockerCleanup,
+				notificationType: "teams",
+				organizationId: organizationId,
+				serverThreshold: input.serverThreshold,
+			})
+			.returning()
+			.then((value) => value[0]);
+
+		if (!newDestination) {
+			throw new TRPCError({
+				code: "BAD_REQUEST",
+				message: "Error input: Inserting notification",
+			});
+		}
+
+		return newDestination;
+	});
+};
+
+export const updateTeamsNotification = async (
+	input: z.infer<typeof apiUpdateTeams>,
+) => {
+	await db.transaction(async (tx) => {
+		const newDestination = await tx
+			.update(notifications)
+			.set({
+				name: input.name,
+				appDeploy: input.appDeploy,
+				appBuildError: input.appBuildError,
+				databaseBackup: input.databaseBackup,
+				volumeBackup: input.volumeBackup,
+				dokployRestart: input.dokployRestart,
+				dockerCleanup: input.dockerCleanup,
+				organizationId: input.organizationId,
+				serverThreshold: input.serverThreshold,
+			})
+			.where(eq(notifications.notificationId, input.notificationId))
+			.returning()
+			.then((value) => value[0]);
+
+		if (!newDestination) {
+			throw new TRPCError({
+				code: "BAD_REQUEST",
+				message: "Error Updating notification",
+			});
+		}
+
+		await tx
+			.update(teams)
+			.set({
+				webhookUrl: input.webhookUrl,
+			})
+			.where(eq(teams.teamsId, input.teamsId))
+			.returning()
+			.then((value) => value[0]);
+
+		return newDestination;
+	});
+};
+
 export const updateNotificationById = async (
 	notificationId: string,
 	notificationData: Partial<Notification>,
@@ -921,7 +1016,7 @@ export const updateNotificationById = async (
 };
 
 export const createPushoverNotification = async (
-	input: typeof apiCreatePushover._type,
+	input: z.infer<typeof apiCreatePushover>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -974,7 +1069,7 @@ export const createPushoverNotification = async (
 };
 
 export const updatePushoverNotification = async (
-	input: typeof apiUpdatePushover._type,
+	input: z.infer<typeof apiUpdatePushover>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx

packages/server/src/services/patch-repo.ts

@@ -0,0 +1,197 @@
+import { join } from "node:path";
+import { paths } from "@dokploy/server/constants";
+import { TRPCError } from "@trpc/server";
+import { execAsync, execAsyncRemote } from "../utils/process/execAsync";
+import { cloneBitbucketRepository } from "../utils/providers/bitbucket";
+import { cloneGitRepository } from "../utils/providers/git";
+import { cloneGiteaRepository } from "../utils/providers/gitea";
+import { cloneGithubRepository } from "../utils/providers/github";
+import { cloneGitlabRepository } from "../utils/providers/gitlab";
+import { findApplicationById } from "./application";
+import { findComposeById } from "./compose";
+
+interface PatchRepoConfig {
+	type: "application" | "compose";
+	id: string;
+}
+
+/**
+ * Ensure patch repo exists and is up-to-date
+ * Returns path to the repo
+ */
+export const ensurePatchRepo = async ({
+	type,
+	id,
+}: PatchRepoConfig): Promise<string> => {
+	let serverId: string | null = null;
+
+	if (type === "application") {
+		const application = await findApplicationById(id);
+		serverId = application.buildServerId || application.serverId;
+	} else {
+		const compose = await findComposeById(id);
+		serverId = compose.serverId;
+	}
+
+	const application =
+		type === "application"
+			? await findApplicationById(id)
+			: await findComposeById(id);
+
+	const { PATCH_REPOS_PATH } = paths(!!serverId);
+	const repoPath = join(PATCH_REPOS_PATH, type, application.appName);
+
+	const applicationEntity = {
+		...application,
+		type,
+		serverId: serverId,
+		outputPathOverride: repoPath,
+	};
+
+	let command = "set -e;";
+	if (application.sourceType === "github") {
+		command += await cloneGithubRepository(applicationEntity);
+	} else if (application.sourceType === "gitlab") {
+		command += await cloneGitlabRepository(applicationEntity);
+	} else if (application.sourceType === "gitea") {
+		command += await cloneGiteaRepository(applicationEntity);
+	} else if (application.sourceType === "bitbucket") {
+		command += await cloneBitbucketRepository(applicationEntity);
+	} else if (application.sourceType === "git") {
+		command += await cloneGitRepository(applicationEntity);
+	}
+
+	if (serverId) {
+		await execAsyncRemote(serverId, command);
+	} else {
+		await execAsync(command);
+	}
+
+	return repoPath;
+};
+
+interface DirectoryEntry {
+	name: string;
+	path: string;
+	type: "file" | "directory";
+	children?: DirectoryEntry[];
+}
+
+/**
+ * Read directory tree of the patch repo
+ */
+export const readPatchRepoDirectory = async (
+	repoPath: string,
+	serverId?: string | null,
+): Promise<DirectoryEntry[]> => {
+	// Use git ls-tree to get tracked files only
+	const command = `cd "${repoPath}" && git ls-tree -r --name-only HEAD`;
+
+	let stdout: string;
+	try {
+		if (serverId) {
+			const result = await execAsyncRemote(serverId, command);
+			stdout = result.stdout;
+		} else {
+			const result = await execAsync(command);
+			stdout = result.stdout;
+		}
+	} catch (error) {
+		throw new TRPCError({
+			code: "INTERNAL_SERVER_ERROR",
+			message: `Failed to read repository: ${error}`,
+		});
+	}
+
+	const files = stdout.trim().split("\n").filter(Boolean);
+
+	// Build tree structure
+	const root: DirectoryEntry[] = [];
+	const dirMap = new Map<string, DirectoryEntry>();
+
+	for (const filePath of files) {
+		const parts = filePath.split("/");
+		let currentPath = "";
+
+		for (let i = 0; i < parts.length; i++) {
+			const part = parts[i];
+			if (!part) continue;
+
+			const isFile = i === parts.length - 1;
+			const parentPath = currentPath;
+			currentPath = currentPath ? `${currentPath}/${part}` : part;
+
+			if (!dirMap.has(currentPath)) {
+				const entry: DirectoryEntry = {
+					name: part,
+					path: currentPath,
+					type: isFile ? "file" : "directory",
+					children: isFile ? undefined : [],
+				};
+
+				dirMap.set(currentPath, entry);
+
+				if (parentPath) {
+					const parent = dirMap.get(parentPath);
+					parent?.children?.push(entry);
+				} else {
+					root.push(entry);
+				}
+			}
+		}
+	}
+
+	return root;
+};
+
+export const readPatchRepoFile = async (
+	id: string,
+	type: "application" | "compose",
+	filePath: string,
+) => {
+	let serverId: string | null = null;
+
+	if (type === "application") {
+		const application = await findApplicationById(id);
+		serverId = application.buildServerId || application.serverId;
+	} else {
+		const compose = await findComposeById(id);
+		serverId = compose.serverId;
+	}
+	const { PATCH_REPOS_PATH } = paths(!!serverId);
+
+	const application =
+		type === "application"
+			? await findApplicationById(id)
+			: await findComposeById(id);
+
+	const repoPath = join(PATCH_REPOS_PATH, type, application.appName);
+	const fullPath = join(repoPath, filePath);
+
+	const command = `cat "${fullPath}"`;
+
+	if (serverId) {
+		const result = await execAsyncRemote(serverId, command);
+		return result.stdout;
+	}
+
+	const result = await execAsync(command);
+	return result.stdout;
+};
+
+/**
+ * Clean all patch repos
+ */
+export const cleanPatchRepos = async (
+	serverId?: string | null,
+): Promise<void> => {
+	const { PATCH_REPOS_PATH } = paths(!!serverId);
+
+	const command = `rm -rf "${PATCH_REPOS_PATH}"/* 2>/dev/null || true`;
+
+	if (serverId) {
+		await execAsyncRemote(serverId, command);
+	} else {
+		await execAsync(command);
+	}
+};

packages/server/src/services/patch.ts

@@ -0,0 +1,176 @@
+import { join } from "node:path";
+import { paths } from "@dokploy/server/constants";
+import { db } from "@dokploy/server/db";
+import { type apiCreatePatch, patch } from "@dokploy/server/db/schema";
+import { TRPCError } from "@trpc/server";
+import { and, eq } from "drizzle-orm";
+import type { z } from "zod";
+import { encodeBase64 } from "../utils/docker/utils";
+import { findApplicationById } from "./application";
+import { findComposeById } from "./compose";
+
+export type Patch = typeof patch.$inferSelect;
+
+export const createPatch = async (input: z.infer<typeof apiCreatePatch>) => {
+	if (!input.applicationId && !input.composeId) {
+		throw new TRPCError({
+			code: "BAD_REQUEST",
+			message: "Either applicationId or composeId must be provided",
+		});
+	}
+
+	const newPatch = await db
+		.insert(patch)
+		.values({
+			...input,
+			content: input.content,
+			enabled: true,
+		})
+		.returning()
+		.then((value) => value[0]);
+
+	if (!newPatch) {
+		throw new TRPCError({
+			code: "BAD_REQUEST",
+			message: "Error creating the patch",
+		});
+	}
+
+	return newPatch;
+};
+
+export const findPatchById = async (patchId: string) => {
+	const result = await db.query.patch.findFirst({
+		where: eq(patch.patchId, patchId),
+	});
+
+	if (!result) {
+		throw new TRPCError({
+			code: "NOT_FOUND",
+			message: "Patch not found",
+		});
+	}
+
+	return result;
+};
+
+export const findPatchesByEntityId = async (
+	id: string,
+	type: "application" | "compose",
+) => {
+	return await db.query.patch.findMany({
+		where: eq(
+			type === "application" ? patch.applicationId : patch.composeId,
+			id,
+		),
+		orderBy: (patch, { asc }) => [asc(patch.filePath)],
+	});
+};
+
+export const findPatchByFilePath = async (
+	filePath: string,
+	id: string,
+	type: "application" | "compose",
+) => {
+	return await db.query.patch.findFirst({
+		where: and(
+			eq(patch.filePath, filePath),
+			eq(type === "application" ? patch.applicationId : patch.composeId, id),
+		),
+	});
+};
+
+export const updatePatch = async (patchId: string, data: Partial<Patch>) => {
+	const result = await db
+		.update(patch)
+		.set({
+			...data,
+			...(data.content && {
+				content: data.content.endsWith("\n")
+					? data.content
+					: `${data.content}\n`,
+			}),
+			updatedAt: new Date().toISOString(),
+		})
+		.where(eq(patch.patchId, patchId))
+		.returning();
+
+	return result[0];
+};
+
+export const deletePatch = async (patchId: string) => {
+	const result = await db
+		.delete(patch)
+		.where(eq(patch.patchId, patchId))
+		.returning();
+
+	return result[0];
+};
+
+export const markPatchForDeletion = async (
+	filePath: string,
+	entityId: string,
+	entityType: "application" | "compose",
+) => {
+	const existing = await findPatchByFilePath(filePath, entityId, entityType);
+
+	if (existing) {
+		return await updatePatch(existing.patchId, { type: "delete", content: "" });
+	}
+
+	return await createPatch({
+		filePath,
+		content: "",
+		type: "delete",
+		applicationId: entityType === "application" ? entityId : undefined,
+		composeId: entityType === "compose" ? entityId : undefined,
+	});
+};
+
+interface ApplyPatchesOptions {
+	id: string;
+	type: "application" | "compose";
+	serverId: string | null;
+}
+
+export const generateApplyPatchesCommand = async ({
+	id,
+	type,
+	serverId,
+}: ApplyPatchesOptions) => {
+	const entity =
+		type === "application"
+			? await findApplicationById(id)
+			: await findComposeById(id);
+	const { COMPOSE_PATH, APPLICATIONS_PATH } = paths(!!serverId);
+	const basePath = type === "compose" ? COMPOSE_PATH : APPLICATIONS_PATH;
+	const codePath = join(basePath, entity.appName, "code");
+
+	const resultPatches = await findPatchesByEntityId(id, type);
+	const patches = resultPatches.filter((p) => p.enabled);
+
+	if (patches.length === 0) {
+		return "";
+	}
+
+	let command = `echo "Applying ${patches.length} patch(es)...";`;
+
+	for (const p of patches) {
+		const filePath = join(codePath, p.filePath);
+
+		if (p.type === "delete") {
+			command += `
+			rm -f "${filePath}";
+			`;
+		} else {
+			command += `
+file="${filePath}"
+dir="$(dirname "$file")"
+mkdir -p "$dir"
+echo "${encodeBase64(p.content)}" | base64 -d > "$file"
+`;
+		}
+	}
+
+	return command;
+};

packages/server/src/services/permission.ts

@@ -0,0 +1,431 @@
+import { db } from "@dokploy/server/db";
+import { member, organizationRole } from "@dokploy/server/db/schema";
+import { hasValidLicense } from "@dokploy/server/services/proprietary/license-key";
+import { TRPCError } from "@trpc/server";
+import { and, eq } from "drizzle-orm";
+import {
+	ac,
+	adminRole,
+	enterpriseOnlyResources,
+	memberRole,
+	ownerRole,
+	statements,
+} from "../lib/access-control";
+
+type Statements = typeof statements;
+type Resource = keyof Statements;
+type Action<R extends Resource> = Statements[R][number];
+type Permissions = {
+	[R in Resource]?: Action<R>[];
+};
+
+export type PermissionCtx = {
+	user: { id: string };
+	session: { activeOrganizationId: string };
+};
+
+export type ResolvedPermissions = {
+	[R in Resource]: {
+		[A in Statements[R][number]]: boolean;
+	};
+};
+
+const staticRoles: Record<string, ReturnType<typeof ac.newRole>> = {
+	owner: ownerRole,
+	admin: adminRole,
+	member: memberRole,
+};
+
+const resolveRole = async (
+	roleName: string,
+	organizationId: string,
+): Promise<ReturnType<typeof ac.newRole> | null> => {
+	if (staticRoles[roleName]) {
+		return staticRoles[roleName];
+	}
+
+	const licensed = await hasValidLicense(organizationId);
+	if (!licensed) {
+		return null;
+	}
+
+	const customRoles = await db.query.organizationRole.findMany({
+		where: and(
+			eq(organizationRole.organizationId, organizationId),
+			eq(organizationRole.role, roleName),
+		),
+	});
+
+	if (customRoles.length === 0) {
+		return null;
+	}
+
+	const merged: Record<string, string[]> = {};
+	for (const entry of customRoles) {
+		const parsed = JSON.parse(entry.permission) as Record<string, string[]>;
+		for (const [resource, actions] of Object.entries(parsed)) {
+			merged[resource] = [
+				...new Set([...(merged[resource] ?? []), ...actions]),
+			];
+		}
+	}
+
+	return ac.newRole(merged as any);
+};
+
+export const checkPermission = async (
+	ctx: PermissionCtx,
+	permissions: Permissions,
+) => {
+	const { id: userId } = ctx.user;
+	const { activeOrganizationId: organizationId } = ctx.session;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+	const isStaticRole = memberRecord.role in staticRoles;
+
+	if (isStaticRole) {
+		const allEnterprise = Object.keys(permissions).every((r) =>
+			enterpriseOnlyResources.has(r),
+		);
+		if (allEnterprise) return;
+	}
+
+	const role = await resolveRole(memberRecord.role, organizationId);
+
+	if (!role) {
+		throw new TRPCError({
+			code: "UNAUTHORIZED",
+			message: "Invalid role",
+		});
+	}
+
+	const result = role.authorize(permissions);
+	if (result.success) {
+		return;
+	}
+
+	if (memberRecord.role === "member") {
+		const overrides = getLegacyOverrides(memberRecord);
+		const allGranted = Object.entries(permissions).every(
+			([resource, actions]) =>
+				(actions as string[]).every(
+					(action) =>
+						!!(overrides[resource] as Record<string, boolean> | undefined)?.[
+							action
+						],
+				),
+		);
+		if (allGranted) {
+			return;
+		}
+	}
+
+	throw new TRPCError({
+		code: "UNAUTHORIZED",
+		message: result.error || "Permission denied",
+	});
+};
+
+export const hasPermission = async (
+	ctx: PermissionCtx,
+	permissions: Permissions,
+): Promise<boolean> => {
+	try {
+		await checkPermission(ctx, permissions);
+		return true;
+	} catch {
+		return false;
+	}
+};
+
+const getLegacyOverrides = (
+	memberRecord: Awaited<ReturnType<typeof findMemberByUserId>>,
+): Partial<Record<string, Record<string, boolean>>> => {
+	return {
+		project: {
+			create: !!memberRecord.canCreateProjects,
+			delete: !!memberRecord.canDeleteProjects,
+		},
+		service: {
+			create: !!memberRecord.canCreateServices,
+			delete: !!memberRecord.canDeleteServices,
+		},
+		environment: {
+			create: !!memberRecord.canCreateEnvironments,
+			delete: !!memberRecord.canDeleteEnvironments,
+		},
+		traefikFiles: {
+			read: !!memberRecord.canAccessToTraefikFiles,
+		},
+		docker: {
+			read: !!memberRecord.canAccessToDocker,
+		},
+		api: {
+			read: !!memberRecord.canAccessToAPI,
+		},
+		sshKeys: {
+			read: !!memberRecord.canAccessToSSHKeys,
+		},
+		gitProviders: {
+			read: !!memberRecord.canAccessToGitProviders,
+		},
+	};
+};
+
+export const resolvePermissions = async (
+	ctx: PermissionCtx,
+): Promise<ResolvedPermissions> => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+	const role = await resolveRole(memberRecord.role, organizationId);
+
+	const legacyOverrides =
+		memberRecord.role === "member" ? getLegacyOverrides(memberRecord) : {};
+
+	const isPrivilegedRole =
+		memberRecord.role === "owner" || memberRecord.role === "admin";
+	const result = {} as ResolvedPermissions;
+
+	for (const [resource, actions] of Object.entries(statements)) {
+		const resourcePerms = {} as Record<string, boolean>;
+		for (const action of actions) {
+			if (isPrivilegedRole && enterpriseOnlyResources.has(resource)) {
+				resourcePerms[action] = true;
+				continue;
+			}
+			if (!role) {
+				resourcePerms[action] = false;
+				continue;
+			}
+			const check = role.authorize({ [resource]: [action] });
+			resourcePerms[action] =
+				check.success ||
+				!!(legacyOverrides[resource] as Record<string, boolean> | undefined)?.[
+					action
+				];
+		}
+		(result as any)[resource] = resourcePerms;
+	}
+
+	return result;
+};
+
+export const checkProjectAccess = async (
+	ctx: PermissionCtx,
+	action: "create" | "delete",
+	projectId?: string,
+) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+
+	await checkPermission(ctx, { project: [action] });
+
+	if (
+		action !== "create" &&
+		projectId &&
+		memberRecord.role !== "owner" &&
+		memberRecord.role !== "admin"
+	) {
+		if (!memberRecord.accessedProjects.includes(projectId)) {
+			throw new TRPCError({
+				code: "UNAUTHORIZED",
+				message: "You don't have access to this project",
+			});
+		}
+	}
+};
+
+export const checkServicePermissionAndAccess = async (
+	ctx: PermissionCtx,
+	serviceId: string,
+	permissions: Permissions,
+) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+	await checkPermission(ctx, permissions);
+	if (memberRecord.role !== "owner" && memberRecord.role !== "admin") {
+		if (!memberRecord.accessedServices.includes(serviceId)) {
+			throw new TRPCError({
+				code: "UNAUTHORIZED",
+				message: "You don't have access to this service",
+			});
+		}
+	}
+};
+
+export const checkServiceAccess = async (
+	ctx: PermissionCtx,
+	serviceId: string,
+	action: "create" | "read" | "delete" = "read",
+) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+
+	await checkPermission(ctx, { service: [action] });
+
+	if (memberRecord.role !== "owner" && memberRecord.role !== "admin") {
+		if (action === "create") {
+			if (!memberRecord.accessedProjects.includes(serviceId)) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "You don't have access to this project",
+				});
+			}
+		} else {
+			if (!memberRecord.accessedServices.includes(serviceId)) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "You don't have access to this service",
+				});
+			}
+		}
+	}
+};
+
+export const checkEnvironmentAccess = async (
+	ctx: PermissionCtx,
+	environmentId: string,
+	action: "read" | "create" | "delete" = "read",
+) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+
+	await checkPermission(ctx, { environment: [action] });
+
+	if (
+		action !== "create" &&
+		memberRecord.role !== "owner" &&
+		memberRecord.role !== "admin"
+	) {
+		if (!memberRecord.accessedEnvironments.includes(environmentId)) {
+			throw new TRPCError({
+				code: "UNAUTHORIZED",
+				message: "You don't have access to this environment",
+			});
+		}
+	}
+};
+
+export const checkEnvironmentCreationPermission = async (
+	ctx: PermissionCtx,
+	projectId: string,
+) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+
+	await checkPermission(ctx, { environment: ["create"] });
+
+	if (memberRecord.role !== "owner" && memberRecord.role !== "admin") {
+		if (!memberRecord.accessedProjects.includes(projectId)) {
+			throw new TRPCError({
+				code: "UNAUTHORIZED",
+				message: "You don't have access to this project",
+			});
+		}
+	}
+};
+
+export const checkEnvironmentDeletionPermission = async (
+	ctx: PermissionCtx,
+	projectId: string,
+) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+
+	await checkPermission(ctx, { environment: ["delete"] });
+
+	if (memberRecord.role !== "owner" && memberRecord.role !== "admin") {
+		if (!memberRecord.accessedProjects.includes(projectId)) {
+			throw new TRPCError({
+				code: "UNAUTHORIZED",
+				message: "You don't have access to this project",
+			});
+		}
+	}
+};
+
+export const addNewProject = async (ctx: PermissionCtx, projectId: string) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+	await db
+		.update(member)
+		.set({
+			accessedProjects: [...memberRecord.accessedProjects, projectId],
+		})
+		.where(
+			and(
+				eq(member.id, memberRecord.id),
+				eq(member.organizationId, organizationId),
+			),
+		);
+};
+
+export const addNewEnvironment = async (
+	ctx: PermissionCtx,
+	environmentId: string,
+) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+	await db
+		.update(member)
+		.set({
+			accessedEnvironments: [
+				...memberRecord.accessedEnvironments,
+				environmentId,
+			],
+		})
+		.where(
+			and(
+				eq(member.id, memberRecord.id),
+				eq(member.organizationId, organizationId),
+			),
+		);
+};
+
+export const addNewService = async (ctx: PermissionCtx, serviceId: string) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+	await db
+		.update(member)
+		.set({
+			accessedServices: [...memberRecord.accessedServices, serviceId],
+		})
+		.where(
+			and(
+				eq(member.id, memberRecord.id),
+				eq(member.organizationId, organizationId),
+			),
+		);
+};
+
+export const findMemberByUserId = async (
+	userId: string,
+	organizationId: string,
+) => {
+	const result = await db.query.member.findFirst({
+		where: and(
+			eq(member.userId, userId),
+			eq(member.organizationId, organizationId),
+		),
+		with: {
+			user: true,
+		},
+	});
+
+	if (!result) {
+		throw new TRPCError({
+			code: "UNAUTHORIZED",
+			message: "Permission denied",
+		});
+	}
+	return result;
+};

packages/server/src/services/port.ts

@@ -2,10 +2,11 @@ import { db } from "@dokploy/server/db";
 import { type apiCreatePort, ports } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 
 export type Port = typeof ports.$inferSelect;
 
-export const createPort = async (input: typeof apiCreatePort._type) => {
+export const createPort = async (input: z.infer<typeof apiCreatePort>) => {
 	const newPort = await db
 		.insert(ports)
 		.values({

packages/server/src/services/postgres.ts

@@ -11,6 +11,7 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
+import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
 
 export function getMountPath(dockerImage: string): string {
@@ -28,7 +29,9 @@ export function getMountPath(dockerImage: string): string {
 
 export type Postgres = typeof postgres.$inferSelect;
 
-export const createPostgres = async (input: typeof apiCreatePostgres._type) => {
+export const createPostgres = async (
+	input: z.infer<typeof apiCreatePostgres>,
+) => {
 	const appName = buildAppName("postgres", input.appName);
 
 	const valid = await validUniqueServerAppName(appName);

packages/server/src/services/preview-deployment.ts

@@ -7,6 +7,7 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { and, desc, eq } from "drizzle-orm";
+import type { z } from "zod";
 import { generatePassword } from "../templates";
 import { removeService } from "../utils/docker/utils";
 import { removeDirectoryCode } from "../utils/filesystem/directory";
@@ -130,7 +131,7 @@ export const findPreviewDeploymentsByApplicationId = async (
 };
 
 export const createPreviewDeployment = async (
-	schema: typeof apiCreatePreviewDeployment._type,
+	schema: z.infer<typeof apiCreatePreviewDeployment>,
 ) => {
 	const application = await findApplicationById(schema.applicationId);
 	const appName = `preview-${application.appName}-${generatePassword(6)}`;
@@ -235,7 +236,7 @@ const generateWildcardDomain = async (
 	baseDomain: string,
 	appName: string,
 	serverIp: string,
-	userId: string,
+	_userId: string,
 ): Promise<string> => {
 	if (!baseDomain.startsWith("*.")) {
 		throw new Error('The base domain must start with "*."');

packages/server/src/services/project.ts

@@ -11,12 +11,13 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 import { createProductionEnvironment } from "./environment";
 
 export type Project = typeof projects.$inferSelect;
 
 export const createProject = async (
-	input: typeof apiCreateProject._type,
+	input: z.infer<typeof apiCreateProject>,
 	organizationId: string,
 ) => {
 	const newProject = await db

packages/server/src/services/proprietary/audit-log.ts

@@ -0,0 +1,95 @@
+import { db } from "@dokploy/server/db";
+import { auditLog } from "@dokploy/server/db/schema";
+import type { AuditAction, AuditResourceType } from "@dokploy/server/db/schema";
+import { hasValidLicense } from "@dokploy/server/services/proprietary/license-key";
+import { and, desc, eq, gte, ilike, lte } from "drizzle-orm";
+
+export type { AuditAction, AuditResourceType };
+
+export interface CreateAuditLogInput {
+	organizationId: string;
+	userId: string;
+	userEmail: string;
+	userRole: string;
+	action: AuditAction;
+	resourceType: AuditResourceType;
+	resourceId?: string;
+	resourceName?: string;
+	metadata?: Record<string, unknown>;
+}
+
+/**
+ * Creates an audit log entry. Fire-and-forget safe — errors are swallowed
+ * so a logging failure never breaks the main operation.
+ */
+export const createAuditLog = async (input: CreateAuditLogInput) => {
+	try {
+		const licensed = await hasValidLicense(input.organizationId);
+		if (!licensed) return;
+
+		await db.insert(auditLog).values({
+			organizationId: input.organizationId,
+			userId: input.userId,
+			userEmail: input.userEmail,
+			userRole: input.userRole,
+			action: input.action,
+			resourceType: input.resourceType,
+			resourceId: input.resourceId,
+			resourceName: input.resourceName,
+			metadata: input.metadata ? JSON.stringify(input.metadata) : undefined,
+		});
+	} catch (err) {
+		console.error("[audit-log] Failed to create audit log entry:", err);
+	}
+};
+
+export interface GetAuditLogsInput {
+	organizationId: string;
+	userId?: string;
+	userEmail?: string;
+	resourceName?: string;
+	action?: AuditAction;
+	resourceType?: AuditResourceType;
+	from?: Date;
+	to?: Date;
+	limit?: number;
+	offset?: number;
+}
+
+export const getAuditLogs = async (input: GetAuditLogsInput) => {
+	const {
+		organizationId,
+		userId,
+		userEmail,
+		resourceName,
+		action,
+		resourceType,
+		from,
+		to,
+		limit = 50,
+		offset = 0,
+	} = input;
+
+	const conditions = [eq(auditLog.organizationId, organizationId)];
+
+	if (userId) conditions.push(eq(auditLog.userId, userId));
+	if (userEmail) conditions.push(ilike(auditLog.userEmail, `%${userEmail}%`));
+	if (resourceName)
+		conditions.push(ilike(auditLog.resourceName, `%${resourceName}%`));
+	if (action) conditions.push(eq(auditLog.action, action));
+	if (resourceType) conditions.push(eq(auditLog.resourceType, resourceType));
+	if (from) conditions.push(gte(auditLog.createdAt, from));
+	if (to) conditions.push(lte(auditLog.createdAt, to));
+
+	const [logs, total] = await Promise.all([
+		db.query.auditLog.findMany({
+			where: and(...conditions),
+			orderBy: [desc(auditLog.createdAt)],
+			limit,
+			offset,
+		}),
+		db.$count(auditLog, and(...conditions)),
+	]);
+
+	return { logs, total };
+};

packages/server/src/services/proprietary/license-key.ts

@@ -0,0 +1,24 @@
+import { db } from "@dokploy/server/db";
+import { user } from "@dokploy/server/db/schema";
+import { eq } from "drizzle-orm";
+import { getOrganizationOwnerId } from "./sso";
+
+export const hasValidLicense = async (organizationId: string) => {
+	const ownerId = await getOrganizationOwnerId(organizationId);
+
+	if (!ownerId) {
+		return false;
+	}
+
+	const currentUser = await db.query.user.findFirst({
+		where: eq(user.id, ownerId),
+		columns: {
+			enableEnterpriseFeatures: true,
+			isValidEnterpriseLicense: true,
+		},
+	});
+	return !!(
+		currentUser?.enableEnterpriseFeatures &&
+		currentUser?.isValidEnterpriseLicense
+	);
+};

packages/server/src/services/proprietary/sso.ts

@@ -1,4 +1,6 @@
 import { db } from "@dokploy/server/db";
+import { organization } from "@dokploy/server/db/schema";
+import { eq } from "drizzle-orm";
 
 export const getSSOProviders = async () => {
 	const providers = await db.query.ssoProvider.findMany({
@@ -33,3 +35,12 @@ export const normalizeTrustedOrigin = (value: string): string => {
 	// e.g. "https://example.com/" -> "https://example.com"
 	return value.trim().replace(/\/+$/, "");
 };
+
+export const getOrganizationOwnerId = async (organizationId: string) => {
+	const org = await db.query.organization.findFirst({
+		where: eq(organization.id, organizationId),
+		columns: { ownerId: true },
+	});
+	if (!org) return null;
+	return org.ownerId;
+};

packages/server/src/services/redis.ts

@@ -10,12 +10,13 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
 
 export type Redis = typeof redis.$inferSelect;
 
 // https://github.com/drizzle-team/drizzle-orm/discussions/1483#discussioncomment-7523881
-export const createRedis = async (input: typeof apiCreateRedis._type) => {
+export const createRedis = async (input: z.infer<typeof apiCreateRedis>) => {
 	const appName = buildAppName("redis", input.appName);
 
 	const valid = await validUniqueServerAppName(appName);

packages/server/src/services/registry.ts

@@ -6,6 +6,7 @@ import {
 } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 import { IS_CLOUD } from "../constants";
 
 export type Registry = typeof registry.$inferSelect;
@@ -15,7 +16,7 @@ function shEscape(s: string | undefined): string {
 	return `'${s.replace(/'/g, `'\\''`)}'`;
 }
 
-function safeDockerLoginCommand(
+export function safeDockerLoginCommand(
 	registry: string | undefined,
 	user: string | undefined,
 	pass: string | undefined,
@@ -27,7 +28,7 @@ function safeDockerLoginCommand(
 }
 
 export const createRegistry = async (
-	input: typeof apiCreateRegistry._type,
+	input: z.infer<typeof apiCreateRegistry>,
 	organizationId: string,
 ) => {
 	return await db.transaction(async (tx) => {

packages/server/src/services/rollbacks.ts

@@ -23,7 +23,7 @@ import { findDeploymentById } from "./deployment";
 import type { Mount } from "./mount";
 import type { Port } from "./port";
 import type { Project } from "./project";
-import type { Registry } from "./registry";
+import { type Registry, safeDockerLoginCommand } from "./registry";
 
 export const createRollback = async (
 	input: z.infer<typeof createRollbackSchema>,
@@ -111,7 +111,7 @@ const deleteRollbackImage = async (image: string, serverId?: string | null) => {
 	const command = `docker image rm ${image} --force`;
 
 	if (serverId) {
-		await execAsyncRemote(command, serverId);
+		await execAsyncRemote(serverId, command);
 	} else {
 		await execAsync(command);
 	}
@@ -171,6 +171,23 @@ export const rollback = async (rollbackId: string) => {
 	);
 };
 
+const dockerLoginForRegistry = async (
+	registry: Registry,
+	serverId?: string | null,
+) => {
+	const loginCommand = safeDockerLoginCommand(
+		registry.registryUrl,
+		registry.username,
+		registry.password,
+	);
+
+	if (serverId) {
+		await execAsyncRemote(serverId, loginCommand);
+	} else {
+		await execAsync(loginCommand);
+	}
+};
+
 const rollbackApplication = async (
 	appName: string,
 	image: string,
@@ -188,6 +205,14 @@ const rollbackApplication = async (
 		throw new Error("Full context is required for rollback");
 	}
 
+	// Ensure Docker daemon is authenticated with the rollback registry
+	// before updating the swarm service. The authconfig in CreateServiceOptions
+	// alone is not sufficient — Docker Swarm also relies on the daemon's
+	// cached credentials (~/.docker/config.json) to distribute auth to nodes.
+	if (fullContext.rollbackRegistry) {
+		await dockerLoginForRegistry(fullContext.rollbackRegistry, serverId);
+	}
+
 	const docker = await getRemoteDocker(serverId);
 
 	// Use the same configuration as mechanizeDockerContainer

packages/server/src/services/schedule.ts

@@ -18,7 +18,10 @@ export const createSchedule = async (
 	input: z.infer<typeof createScheduleSchema>,
 ) => {
 	const { scheduleId, ...rest } = input;
-	const [newSchedule] = await db.insert(schedules).values(rest).returning();
+	const [newSchedule] = await db
+		.insert(schedules)
+		.values(rest as typeof schedules.$inferInsert)
+		.returning();
 
 	if (
 		newSchedule &&
@@ -120,7 +123,7 @@ export const updateSchedule = async (
 	const { scheduleId, ...rest } = input;
 	const [updatedSchedule] = await db
 		.update(schedules)
-		.set(rest)
+		.set(rest as Partial<typeof schedules.$inferInsert>)
 		.where(eq(schedules.scheduleId, scheduleId))
 		.returning();
 

packages/server/src/services/security.ts

@@ -50,7 +50,8 @@ export const createSecurity = async (
 	} catch (error) {
 		throw new TRPCError({
 			code: "BAD_REQUEST",
-			message: "Error creating this security",
+			message:
+				error instanceof Error ? error.message : "Error creating this security",
 			cause: error,
 		});
 	}
@@ -90,15 +91,35 @@ export const updateSecurityById = async (
 	data: Partial<Security>,
 ) => {
 	try {
-		const response = await db
-			.update(security)
-			.set({
-				...data,
-			})
-			.where(eq(security.securityId, securityId))
-			.returning();
+		await db.transaction(async (tx) => {
+			const securityResponse = await findSecurityById(securityId);
 
-		return response[0];
+			const application = await findApplicationById(
+				securityResponse.applicationId,
+			);
+
+			await removeSecurityMiddleware(application, securityResponse);
+
+			const response = await tx
+				.update(security)
+				.set({
+					...data,
+				})
+				.where(eq(security.securityId, securityId))
+				.returning()
+				.then((res) => res[0]);
+
+			if (!response) {
+				throw new TRPCError({
+					code: "NOT_FOUND",
+					message: "Security not found",
+				});
+			}
+
+			await createSecurityMiddleware(application, response);
+
+			return response;
+		});
 	} catch (error) {
 		const message =
 			error instanceof Error ? error.message : "Error updating this security";

packages/server/src/services/server.ts

@@ -6,11 +6,12 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 
 export type Server = typeof server.$inferSelect;
 
 export const createServer = async (
-	input: typeof apiCreateServer._type,
+	input: z.infer<typeof apiCreateServer>,
 	organizationId: string,
 ) => {
 	const newServer = await db
@@ -19,7 +20,7 @@ export const createServer = async (
 			...input,
 			organizationId: organizationId,
 			createdAt: new Date().toISOString(),
-		})
+		} as typeof server.$inferInsert)
 		.returning()
 		.then((value) => value[0]);
 

packages/server/src/services/settings.ts

@@ -413,17 +413,38 @@ export const checkPortInUse = async (
 	serverId?: string,
 ): Promise<{ isInUse: boolean; conflictingContainer?: string }> => {
 	try {
-		const command = `docker ps -a --format '{{.Names}}' | grep -v '^dokploy-traefik$' | while read name; do docker port "$name" 2>/dev/null | grep -q ':${port}' && echo "$name" && break; done || true`;
-		const { stdout } = serverId
-			? await execAsyncRemote(serverId, command)
-			: await execAsync(command);
+		// Check if port is in use by a Docker container
+		const dockerCommand = `docker ps -a --format '{{.Names}}' | grep -v '^dokploy-traefik$' | while read name; do docker port "$name" 2>/dev/null | grep -q ':${port}' && echo "$name" && break; done || true`;
+		const { stdout: dockerOut } = serverId
+			? await execAsyncRemote(serverId, dockerCommand)
+			: await execAsync(dockerCommand);
 
-		const container = stdout.trim();
+		const container = dockerOut.trim();
 
-		return {
-			isInUse: !!container,
-			conflictingContainer: container || undefined,
-		};
+		if (container) {
+			return {
+				isInUse: true,
+				conflictingContainer: `container "${container}"`,
+			};
+		}
+
+		// Check if port is in use by a host-level service (non-Docker)
+		// Dokploy runs inside a container, so we spawn an ephemeral container
+		// with --net=host to share the host's network stack and use nc -z to
+		// check if something is listening on the port
+		const hostCommand = `docker run --rm --net=host busybox sh -c 'nc -z 0.0.0.0 ${port} 2>/dev/null && echo in_use || echo free'`;
+		const { stdout: hostOut } = serverId
+			? await execAsyncRemote(serverId, hostCommand)
+			: await execAsync(hostCommand);
+
+		if (hostOut.includes("in_use")) {
+			return {
+				isInUse: true,
+				conflictingContainer: "a host-level service",
+			};
+		}
+
+		return { isInUse: false };
 	} catch (error) {
 		console.error("Error checking port availability:", error);
 		return { isInUse: false };

packages/server/src/services/ssh-key.ts

@@ -8,8 +8,9 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 
-export const createSshKey = async (input: typeof apiCreateSshKey._type) => {
+export const createSshKey = async (input: z.infer<typeof apiCreateSshKey>) => {
 	await db.transaction(async (tx) => {
 		const sshKey = await tx
 			.insert(sshKeys)
@@ -29,7 +30,7 @@ export const createSshKey = async (input: typeof apiCreateSshKey._type) => {
 };
 
 export const removeSSHKeyById = async (
-	sshKeyId: (typeof apiRemoveSshKey._type)["sshKeyId"],
+	sshKeyId: z.infer<typeof apiRemoveSshKey>["sshKeyId"],
 ) => {
 	const result = await db
 		.delete(sshKeys)
@@ -42,7 +43,7 @@ export const removeSSHKeyById = async (
 export const updateSSHKeyById = async ({
 	sshKeyId,
 	...input
-}: typeof apiUpdateSshKey._type) => {
+}: z.infer<typeof apiUpdateSshKey>) => {
 	const result = await db
 		.update(sshKeys)
 		.set(input)
@@ -53,7 +54,7 @@ export const updateSSHKeyById = async ({
 };
 
 export const findSSHKeyById = async (
-	sshKeyId: (typeof apiFindOneSshKey._type)["sshKeyId"],
+	sshKeyId: z.infer<typeof apiFindOneSshKey>["sshKeyId"],
 ) => {
 	const sshKey = await db.query.sshKeys.findFirst({
 		where: eq(sshKeys.sshKeyId, sshKeyId),

packages/server/src/services/user.ts

@@ -432,7 +432,7 @@ export const createApiKey = async (
 		refillInterval?: number;
 	},
 ) => {
-	const apiKey = await auth.createApiKey({
+	const result = await auth.createApiKey({
 		body: {
 			name: input.name,
 			expiresIn: input.expiresIn,
@@ -450,10 +450,9 @@ export const createApiKey = async (
 	if (input.metadata) {
 		await db
 			.update(apikey)
-			.set({
-				metadata: JSON.stringify(input.metadata),
-			})
-			.where(eq(apikey.id, apiKey.id));
+			.set({ metadata: JSON.stringify(input.metadata) })
+			.where(eq(apikey.id, result.id));
 	}
-	return apiKey;
+
+	return result;
 };

packages/server/src/services/volume-backups.ts

@@ -94,7 +94,7 @@ export const createVolumeBackup = async (
 ) => {
 	const newVolumeBackup = await db
 		.insert(volumeBackups)
-		.values(volumeBackup)
+		.values(volumeBackup as typeof volumeBackups.$inferInsert)
 		.returning()
 		.then((e) => e[0]);
 
@@ -113,7 +113,7 @@ export const updateVolumeBackup = async (
 ) => {
 	return await db
 		.update(volumeBackups)
-		.set(volumeBackup)
+		.set(volumeBackup as Partial<typeof volumeBackups.$inferInsert>)
 		.where(eq(volumeBackups.volumeBackupId, volumeBackupId))
 		.returning()
 		.then((e) => e[0]);

packages/server/src/setup/server-setup.ts

@@ -281,17 +281,43 @@ const installRequirements = async (
 			.on("error", (err) => {
 				client.end();
 				if (err.level === "client-authentication") {
-					onData?.(
-						`Authentication failed: Invalid SSH private key. ❌ Error: ${err.message} ${err.level}`,
-					);
+					const technicalDetail = `Error: ${err.message} ${err.level}`;
+					const friendlyMessage = [
+						"",
+						"❌ Couldn't connect to your server — the SSH key was not accepted.",
+						"",
+						"This usually means the key doesn't match what's on the server, or the key format is invalid.",
+						"",
+						`Technical details: ${technicalDetail}`,
+						"",
+						"💡 Hints:",
+						"  • Check that the SSH key you added in Dokploy is the same one installed on the server (e.g. in ~/.ssh/authorized_keys).",
+						"  • Try generating a new SSH key in Dokploy and add only the public key to the server, then try again.",
+						"  • Make sure to follow the instructions on the Setup Server Button on the SSH Keys tab",
+					].join("\n");
+					onData?.(friendlyMessage);
 					reject(
 						new Error(
-							`Authentication failed: Invalid SSH private key. ❌ Error: ${err.message} ${err.level}`,
+							`Authentication failed: Invalid SSH private key. ${technicalDetail}`,
 						),
 					);
 				} else {
-					onData?.(`SSH connection error: ${err.message} ${err.level}`);
-					reject(new Error(`SSH connection error: ${err.message}`));
+					const technicalDetail = `${err.message} ${err.level ?? ""}`.trim();
+					const friendlyMessage = [
+						"",
+						"❌ Couldn't connect to your server.",
+						"",
+						"The connection failed before setup could run. Common causes: wrong IP or port, firewall blocking access, or the server is offline.",
+						"",
+						`Technical details: ${technicalDetail}`,
+						"",
+						"💡 Hints:",
+						"  • Check that the server IP address and SSH port are correct and the server is powered on.",
+						"  • If the server is in a private network, ensure Dokploy can reach it (VPN, firewall rules, or correct security groups).",
+						"  • Make sure the SSH port (usually 22) is open and the SSH service is running on the server.",
+					].join("\n");
+					onData?.(friendlyMessage);
+					reject(new Error(`SSH connection error: ${technicalDetail}`));
 				}
 			})
 			.connect({

packages/server/src/utils/access-log/handler.ts

@@ -1,3 +1,5 @@
+import fs from "node:fs";
+import path from "node:path";
 import { paths } from "@dokploy/server/constants";
 import {
 	getWebServerSettings,
@@ -12,8 +14,6 @@ export const startLogCleanup = async (
 	cronExpression = "0 0 * * *",
 ): Promise<boolean> => {
 	try {
-		const { DYNAMIC_TRAEFIK_PATH } = paths();
-
 		const existingJob = scheduledJobs[LOG_CLEANUP_JOB_NAME];
 		if (existingJob) {
 			existingJob.cancel();
@@ -21,10 +21,17 @@ export const startLogCleanup = async (
 
 		scheduleJob(LOG_CLEANUP_JOB_NAME, cronExpression, async () => {
 			try {
-				await execAsync(
-					`tail -n 1000 ${DYNAMIC_TRAEFIK_PATH}/access.log > ${DYNAMIC_TRAEFIK_PATH}/access.log.tmp && mv ${DYNAMIC_TRAEFIK_PATH}/access.log.tmp ${DYNAMIC_TRAEFIK_PATH}/access.log`,
-				);
+				const { DYNAMIC_TRAEFIK_PATH } = paths();
+				const accessLogPath = path.join(DYNAMIC_TRAEFIK_PATH, "access.log");
 
+				if (!fs.existsSync(accessLogPath)) {
+					console.error("Access log file does not exist");
+					return;
+				}
+
+				await execAsync(
+					`tail -n 1000 ${accessLogPath} > ${accessLogPath}.tmp && mv ${accessLogPath}.tmp ${accessLogPath}`,
+				);
 				await execAsync("docker exec dokploy-traefik kill -USR1 1");
 			} catch (error) {
 				console.error("Error during log cleanup:", error);

packages/server/src/utils/ai/select-ai-provider.ts

@@ -30,6 +30,18 @@ export function selectAIProvider(config: { apiUrl: string; apiKey: string }) {
 				baseURL: config.apiUrl,
 			});
 		case "azure":
+			// Azure OpenAI-compatible endpoints already include /v1 in the path.
+			// Using createAzure with such URLs causes a doubled /v1//v1/ suffix.
+			if (config.apiUrl.includes("/v1")) {
+				return createOpenAICompatible({
+					name: "azure",
+					baseURL: config.apiUrl,
+					headers: {
+						"api-key": config.apiKey,
+						Authorization: `Bearer ${config.apiKey}`,
+					},
+				});
+			}
 			return createAzure({
 				apiKey: config.apiKey,
 				baseURL: config.apiUrl,

packages/server/src/utils/backups/compose.ts

@@ -14,13 +14,14 @@ export const runComposeBackup = async (
 	compose: Compose,
 	backup: BackupSchedule,
 ) => {
-	const { environmentId, name } = compose;
+	const { environmentId, name, appName } = compose;
 	const environment = await findEnvironmentById(environmentId);
 	const project = await findProjectById(environment.projectId);
-	const { prefix, databaseType } = backup;
+	const { prefix, databaseType, serviceName } = backup;
 	const destination = backup.destination;
 	const backupFileName = `${new Date().toISOString()}.sql.gz`;
-	const bucketDestination = `${normalizeS3Path(prefix)}${backupFileName}`;
+	const s3AppName = serviceName ? `${appName}_${serviceName}` : appName;
+	const bucketDestination = `${s3AppName}/${normalizeS3Path(prefix)}${backupFileName}`;
 	const deployment = await createDeploymentBackup({
 		backupId: backup.backupId,
 		title: "Compose Backup",

packages/server/src/utils/backups/index.ts

@@ -1,4 +1,3 @@
-import path from "node:path";
 import { CLEANUP_CRON_JOB } from "@dokploy/server/constants";
 import { member } from "@dokploy/server/db/schema";
 import type { BackupSchedule } from "@dokploy/server/services/backup";
@@ -11,7 +10,7 @@ import { startLogCleanup } from "../access-log/handler";
 import { cleanupAll } from "../docker/utils";
 import { sendDockerCleanupNotifications } from "../notifications/docker-cleanup";
 import { execAsync, execAsyncRemote } from "../process/execAsync";
-import { getS3Credentials, scheduleBackup } from "./utils";
+import { getS3Credentials, normalizeS3Path, scheduleBackup } from "./utils";
 
 export const initCronJobs = async () => {
 	console.log("Setting up cron jobs....");
@@ -30,15 +29,19 @@ export const initCronJobs = async () => {
 	const webServerSettings = await getWebServerSettings();
 
 	if (webServerSettings?.enableDockerCleanup) {
-		scheduleJob("docker-cleanup", CLEANUP_CRON_JOB, async () => {
-			console.log(
-				`Docker Cleanup ${new Date().toLocaleString()}]  Running docker cleanup`,
-			);
+		try {
+			scheduleJob("docker-cleanup", CLEANUP_CRON_JOB, async () => {
+				console.log(
+					`Docker Cleanup ${new Date().toLocaleString()}]  Running docker cleanup`,
+				);
 
-			await cleanupAll();
+				await cleanupAll();
 
-			await sendDockerCleanupNotifications(admin.user.id);
-		});
+				await sendDockerCleanupNotifications(admin.user.id);
+			});
+		} catch (error) {
+			console.error("[Backup] Docker Cleanup Error", error);
+		}
 	}
 
 	const servers = await getAllServers();
@@ -46,18 +49,22 @@ export const initCronJobs = async () => {
 	for (const server of servers) {
 		const { serverId, enableDockerCleanup, name } = server;
 		if (enableDockerCleanup) {
-			scheduleJob(serverId, CLEANUP_CRON_JOB, async () => {
-				console.log(
-					`SERVER-BACKUP[${new Date().toLocaleString()}] Running Cleanup ${name}`,
-				);
+			try {
+				scheduleJob(serverId, CLEANUP_CRON_JOB, async () => {
+					console.log(
+						`SERVER-BACKUP[${new Date().toLocaleString()}] Running Cleanup ${name}`,
+					);
 
-				await cleanupAll(serverId);
+					await cleanupAll(serverId);
 
-				await sendDockerCleanupNotifications(
-					admin.user.id,
-					`Docker cleanup for Server ${name} (${serverId})`,
-				);
-			});
+					await sendDockerCleanupNotifications(
+						admin.user.id,
+						`Docker cleanup for Server ${name} (${serverId})`,
+					);
+				});
+			} catch (error) {
+				console.error(`[Backup] ${error}`);
+			}
 		}
 	}
 
@@ -87,14 +94,32 @@ export const initCronJobs = async () => {
 	}
 
 	if (webServerSettings?.logCleanupCron) {
-		console.log(
-			"Starting log requests cleanup",
-			webServerSettings.logCleanupCron,
-		);
-		await startLogCleanup(webServerSettings.logCleanupCron);
+		try {
+			console.log(
+				"Starting log requests cleanup",
+				webServerSettings.logCleanupCron,
+			);
+			await startLogCleanup(webServerSettings.logCleanupCron);
+		} catch (error) {
+			console.error("[Backup] Log Cleanup Error", error);
+		}
 	}
 };
 
+const getServiceAppName = (backup: BackupSchedule): string => {
+	if (backup.compose?.appName) {
+		return backup.serviceName
+			? `${backup.compose.appName}_${backup.serviceName}`
+			: backup.compose.appName;
+	}
+	const serviceAppName =
+		backup.postgres?.appName ||
+		backup.mysql?.appName ||
+		backup.mariadb?.appName ||
+		backup.mongo?.appName;
+	return serviceAppName || backup.appName;
+};
+
 export const keepLatestNBackups = async (
 	backup: BackupSchedule,
 	serverId?: string | null,
@@ -105,18 +130,16 @@ export const keepLatestNBackups = async (
 
 	try {
 		const rcloneFlags = getS3Credentials(backup.destination);
-		const backupFilesPath = path.join(
-			`:s3:${backup.destination.bucket}`,
-			backup.prefix,
-		);
+		const appName = getServiceAppName(backup);
+		const backupFilesPath = `:s3:${backup.destination.bucket}/${appName}/${normalizeS3Path(backup.prefix)}`;
 
 		// --include "*.sql.gz" or "*.zip" ensures nothing else other than the dokploy backup files are touched by rclone
 		const rcloneList = `rclone lsf ${rcloneFlags.join(" ")} --include "*${backup.databaseType === "web-server" ? ".zip" : ".sql.gz"}" ${backupFilesPath}`;
 		// when we pipe the above command with this one, we only get the list of files we want to delete
 		const sortAndPickUnwantedBackups = `sort -r | tail -n +$((${backup.keepLatestCount}+1)) | xargs -I{}`;
 		// this command deletes the files
-		// to test the deletion before actually deleting we can add --dry-run before ${backupFilesPath}/{}
-		const rcloneDelete = `rclone delete ${rcloneFlags.join(" ")} ${backupFilesPath}/{}`;
+		// to test the deletion before actually deleting we can add --dry-run before ${backupFilesPath}{}
+		const rcloneDelete = `rclone delete ${rcloneFlags.join(" ")} ${backupFilesPath}{}`;
 
 		const rcloneCommand = `${rcloneList} | ${sortAndPickUnwantedBackups} ${rcloneDelete}`;
 

packages/server/src/utils/backups/mariadb.ts

@@ -14,13 +14,13 @@ export const runMariadbBackup = async (
 	mariadb: Mariadb,
 	backup: BackupSchedule,
 ) => {
-	const { environmentId, name } = mariadb;
+	const { environmentId, name, appName } = mariadb;
 	const environment = await findEnvironmentById(environmentId);
 	const project = await findProjectById(environment.projectId);
 	const { prefix } = backup;
 	const destination = backup.destination;
 	const backupFileName = `${new Date().toISOString()}.sql.gz`;
-	const bucketDestination = `${normalizeS3Path(prefix)}${backupFileName}`;
+	const bucketDestination = `${appName}/${normalizeS3Path(prefix)}${backupFileName}`;
 	const deployment = await createDeploymentBackup({
 		backupId: backup.backupId,
 		title: "MariaDB Backup",

packages/server/src/utils/backups/mongo.ts

@@ -11,13 +11,13 @@ import { execAsync, execAsyncRemote } from "../process/execAsync";
 import { getBackupCommand, getS3Credentials, normalizeS3Path } from "./utils";
 
 export const runMongoBackup = async (mongo: Mongo, backup: BackupSchedule) => {
-	const { environmentId, name } = mongo;
+	const { environmentId, name, appName } = mongo;
 	const environment = await findEnvironmentById(environmentId);
 	const project = await findProjectById(environment.projectId);
 	const { prefix } = backup;
 	const destination = backup.destination;
 	const backupFileName = `${new Date().toISOString()}.sql.gz`;
-	const bucketDestination = `${normalizeS3Path(prefix)}${backupFileName}`;
+	const bucketDestination = `${appName}/${normalizeS3Path(prefix)}${backupFileName}`;
 	const deployment = await createDeploymentBackup({
 		backupId: backup.backupId,
 		title: "MongoDB Backup",

packages/server/src/utils/backups/mysql.ts

@@ -11,13 +11,13 @@ import { execAsync, execAsyncRemote } from "../process/execAsync";
 import { getBackupCommand, getS3Credentials, normalizeS3Path } from "./utils";
 
 export const runMySqlBackup = async (mysql: MySql, backup: BackupSchedule) => {
-	const { environmentId, name } = mysql;
+	const { environmentId, name, appName } = mysql;
 	const environment = await findEnvironmentById(environmentId);
 	const project = await findProjectById(environment.projectId);
 	const { prefix } = backup;
 	const destination = backup.destination;
 	const backupFileName = `${new Date().toISOString()}.sql.gz`;
-	const bucketDestination = `${normalizeS3Path(prefix)}${backupFileName}`;
+	const bucketDestination = `${appName}/${normalizeS3Path(prefix)}${backupFileName}`;
 	const deployment = await createDeploymentBackup({
 		backupId: backup.backupId,
 		title: "MySQL Backup",

packages/server/src/utils/backups/postgres.ts

@@ -14,7 +14,7 @@ export const runPostgresBackup = async (
 	postgres: Postgres,
 	backup: BackupSchedule,
 ) => {
-	const { name, environmentId } = postgres;
+	const { name, environmentId, appName } = postgres;
 	const environment = await findEnvironmentById(environmentId);
 	const project = await findProjectById(environment.projectId);
 
@@ -26,7 +26,7 @@ export const runPostgresBackup = async (
 	const { prefix } = backup;
 	const destination = backup.destination;
 	const backupFileName = `${new Date().toISOString()}.sql.gz`;
-	const bucketDestination = `${normalizeS3Path(prefix)}${backupFileName}`;
+	const bucketDestination = `${appName}/${normalizeS3Path(prefix)}${backupFileName}`;
 	try {
 		const rcloneFlags = getS3Credentials(destination);
 		const rcloneDestination = `:s3:${destination.bucket}/${bucketDestination}`;

packages/server/src/utils/backups/web-server.ts

@@ -31,7 +31,7 @@ export const runWebServerBackup = async (backup: BackupSchedule) => {
 		const { BASE_PATH } = paths();
 		const tempDir = await mkdtemp(join(tmpdir(), "dokploy-backup-"));
 		const backupFileName = `webserver-backup-${timestamp}.zip`;
-		const s3Path = `:s3:${destination.bucket}/${normalizeS3Path(backup.prefix)}${backupFileName}`;
+		const s3Path = `:s3:${destination.bucket}/${backup.appName}/${normalizeS3Path(backup.prefix)}${backupFileName}`;
 
 		try {
 			await execAsync(`mkdir -p ${tempDir}/filesystem`);
@@ -67,7 +67,7 @@ export const runWebServerBackup = async (backup: BackupSchedule) => {
 			await execAsync(cleanupCommand);
 
 			await execAsync(
-				`rsync -a --ignore-errors ${BASE_PATH}/ ${tempDir}/filesystem/`,
+				`rsync -a --ignore-errors --no-specials --no-devices --exclude='volume-backups/' ${BASE_PATH}/ ${tempDir}/filesystem/`,
 			);
 
 			writeStream.write("Copied filesystem to temp directory\n");

packages/server/src/utils/builders/compose.ts

@@ -53,7 +53,7 @@ Compose Type: ${composeType} ✅`;
 	
 		cd "${projectPath}";
 
-		${compose.isolatedDeployment ? `docker network inspect ${compose.appName} >/dev/null 2>&1 || docker network create --attachable ${compose.appName}` : ""}
+		${compose.isolatedDeployment ? `docker network inspect ${compose.appName} >/dev/null 2>&1 || docker network create ${compose.composeType === "stack" ? "--driver overlay" : ""} --attachable ${compose.appName}` : ""}
 		env -i PATH="$PATH" ${exportEnvCommand} docker ${command.split(" ").join(" ")} 2>&1 || { echo "Error: ❌ Docker command failed"; exit 1; }
 		${compose.isolatedDeployment ? `docker network connect ${compose.appName} $(docker ps --filter "name=dokploy-traefik" -q) >/dev/null 2>&1` : ""}
 	
@@ -88,7 +88,7 @@ export const createCommand = (compose: ComposeNested) => {
 	let command = "";
 
 	if (composeType === "docker-compose") {
-		command = `compose -p ${appName} -f ${path} up -d --build --pull always --remove-orphans`;
+		command = `compose -p ${appName} -f ${path} up -d --build --remove-orphans`;
 	} else if (composeType === "stack") {
 		command = `stack deploy -c ${path} ${appName} --prune --with-registry-auth`;
 	}

packages/server/src/utils/builders/drop.ts

@@ -3,6 +3,7 @@ import path, { join } from "node:path";
 import { paths } from "@dokploy/server/constants";
 import type { Application } from "@dokploy/server/services/application";
 import { findServerById } from "@dokploy/server/services/server";
+import { readValidDirectory } from "@dokploy/server/wss/utils";
 import AdmZip from "adm-zip";
 import { Client, type SFTPWrapper } from "ssh2";
 import {
@@ -16,10 +17,13 @@ export const unzipDrop = async (zipFile: File, application: Application) => {
 
 	try {
 		const { appName } = application;
-		const { APPLICATIONS_PATH } = paths(!!application.serverId);
+		// Use buildServerId if set, otherwise fall back to serverId
+		// This ensures the code is extracted to the server where the build will run
+		const targetServerId = application.buildServerId || application.serverId;
+		const { APPLICATIONS_PATH } = paths(!!targetServerId);
 		const outputPath = join(APPLICATIONS_PATH, appName, "code");
-		if (application.serverId) {
-			await recreateDirectoryRemote(outputPath, application.serverId);
+		if (targetServerId) {
+			await recreateDirectoryRemote(outputPath, targetServerId);
 		} else {
 			await recreateDirectory(outputPath);
 		}
@@ -45,8 +49,8 @@ export const unzipDrop = async (zipFile: File, application: Application) => {
 			? rootEntries[0]?.entryName.split("/")[0]
 			: "";
 
-		if (application.serverId) {
-			sftp = await getSFTPConnection(application.serverId);
+		if (targetServerId) {
+			sftp = await getSFTPConnection(targetServerId);
 		}
 		for (const entry of zipEntries) {
 			let filePath = entry.entryName;
@@ -62,16 +66,24 @@ export const unzipDrop = async (zipFile: File, application: Application) => {
 			if (!filePath) continue;
 
 			const fullPath = path.join(outputPath, filePath).replace(/\\/g, "/");
+			if (!readValidDirectory(fullPath, application.serverId)) {
+				throw new Error(
+					`Path traversal detected: resolved path escapes output directory: ${filePath}`,
+				);
+			}
 
-			if (application.serverId) {
+			if (isDangerousNode(entry)) {
+				throw new Error(
+					`Dangerous node entries are not allowed: ${entry.entryName}`,
+				);
+			}
+
+			if (targetServerId) {
 				if (!entry.isDirectory) {
 					if (sftp === null) throw new Error("No SFTP connection available");
 					try {
 						const dirPath = path.dirname(fullPath);
-						await execAsyncRemote(
-							application.serverId,
-							`mkdir -p "${dirPath}"`,
-						);
+						await execAsyncRemote(targetServerId, `mkdir -p "${dirPath}"`);
 						await uploadFileToServer(sftp, entry.getData(), fullPath);
 					} catch (err) {
 						console.error(`Error uploading file ${fullPath}:`, err);
@@ -132,3 +144,14 @@ const uploadFileToServer = (
 		});
 	});
 };
+
+function isDangerousNode(entry: AdmZip.IZipEntry) {
+	const type = (entry.header.attr >> 16) & 0o170000;
+
+	return (
+		type === 0o120000 || // symlink
+		type === 0o060000 || // block device
+		type === 0o020000 || // char device
+		type === 0o010000 // fifo/pipe
+	);
+}

packages/server/src/utils/builders/index.ts

@@ -182,7 +182,11 @@ export const mechanizeDockerContainer = async (
 		});
 	} catch (error) {
 		console.log(error);
-		await docker.createService(settings);
+		if (authConfig) {
+			await docker.createService(authConfig, settings);
+		} else {
+			await docker.createService(settings);
+		}
 	}
 };
 

packages/server/src/utils/crons/enterprise.ts

@@ -5,9 +5,9 @@ import { db } from "../../db/index";
 import { user as userSchema } from "../../db/schema/user";
 
 export const LICENSE_KEY_URL =
-	process.env.NODE_ENV === "development"
-		? "http://localhost:4002"
-		: "https://licenses-api.dokploy.com";
+	// process.env.NODE_ENV === "development"
+	// 	? "http://localhost:4002"
+	"https://licenses-api.dokploy.com";
 
 export const initEnterpriseBackupCronJobs = async () => {
 	scheduleJob("enterprise-check", "0 0 */3 * *", async () => {

packages/server/src/utils/docker/compose.ts

@@ -18,7 +18,9 @@ export const randomizeComposeFile = async (
 ) => {
 	const compose = await findComposeById(composeId);
 	const composeFile = compose.composeFile;
-	const composeData = parse(composeFile) as ComposeSpecification;
+	const composeData = parse(composeFile, {
+		maxAliasCount: 10000,
+	}) as ComposeSpecification;
 
 	const randomSuffix = suffix || generateRandomHash();
 

packages/server/src/utils/docker/domain.ts

@@ -63,7 +63,9 @@ export const loadDockerCompose = async (
 
 	if (existsSync(path)) {
 		const yamlStr = readFileSync(path, "utf8");
-		const parsedConfig = parse(yamlStr) as ComposeSpecification;
+		const parsedConfig = parse(yamlStr, {
+			maxAliasCount: 10000,
+		}) as ComposeSpecification;
 		return parsedConfig;
 	}
 	return null;
@@ -86,7 +88,9 @@ export const loadDockerComposeRemote = async (
 			return null;
 		}
 		if (!stdout) return null;
-		const parsedConfig = parse(stdout) as ComposeSpecification;
+		const parsedConfig = parse(stdout, {
+			maxAliasCount: 10000,
+		}) as ComposeSpecification;
 		return parsedConfig;
 	} catch {
 		return null;
@@ -106,10 +110,6 @@ export const writeDomainsToCompose = async (
 	compose: Compose,
 	domains: Domain[],
 ) => {
-	if (!domains.length) {
-		return "";
-	}
-
 	try {
 		const composeConverted = await addDomainToCompose(compose, domains);
 		const path = getComposePath(compose);
@@ -145,7 +145,7 @@ export const addDomainToCompose = async (
 		result = await loadDockerCompose(compose);
 	}
 
-	if (!result || domains.length === 0) {
+	if (!result) {
 		return null;
 	}
 

packages/server/src/utils/docker/utils.ts

@@ -741,3 +741,177 @@ export const getComposeContainer = async (
 		throw error;
 	}
 };
+
+type ServiceHealthStatus = {
+	status: "healthy" | "unhealthy";
+	message?: string;
+};
+
+const checkSwarmServiceRunning = async (
+	serviceName: string,
+): Promise<ServiceHealthStatus> => {
+	try {
+		const service = docker.getService(serviceName);
+		const info = await service.inspect();
+		const replicas = info.Spec?.Mode?.Replicated?.Replicas ?? 0;
+		if (replicas === 0) {
+			return {
+				status: "unhealthy",
+				message: "Service has 0 replicas configured",
+			};
+		}
+
+		// Check that at least one task is actually running
+		const tasks = await docker.listTasks({
+			filters: JSON.stringify({
+				service: [serviceName],
+				"desired-state": ["running"],
+			}),
+		});
+
+		const runningTask = tasks.find((t) => t.Status?.State === "running");
+
+		if (!runningTask) {
+			const latestTask = tasks[0];
+			const taskState = latestTask?.Status?.State ?? "unknown";
+			return {
+				status: "unhealthy",
+				message: `No running tasks (current state: ${taskState})`,
+			};
+		}
+
+		return { status: "healthy" };
+	} catch (error) {
+		return {
+			status: "unhealthy",
+			message: error instanceof Error ? error.message : "Service not found",
+		};
+	}
+};
+
+const getSwarmServiceContainerId = async (
+	serviceName: string,
+): Promise<string | null> => {
+	try {
+		const tasks = await docker.listTasks({
+			filters: JSON.stringify({
+				service: [serviceName],
+				"desired-state": ["running"],
+			}),
+		});
+
+		const runningTask = tasks.find((t) => t.Status?.State === "running");
+
+		return runningTask?.Status?.ContainerStatus?.ContainerID ?? null;
+	} catch {
+		return null;
+	}
+};
+
+export const checkPostgresHealth = async (): Promise<ServiceHealthStatus> => {
+	const serviceCheck = await checkSwarmServiceRunning("dokploy-postgres");
+	if (serviceCheck.status === "unhealthy") {
+		return serviceCheck;
+	}
+
+	// Verify PostgreSQL actually accepts connections
+	const containerId = await getSwarmServiceContainerId("dokploy-postgres");
+	if (!containerId) {
+		return { status: "unhealthy", message: "Could not find running container" };
+	}
+
+	try {
+		const exec = await docker.getContainer(containerId).exec({
+			Cmd: ["pg_isready", "-U", "dokploy"],
+			AttachStdout: true,
+			AttachStderr: true,
+		});
+		const stream = await exec.start({});
+
+		const output = await new Promise<string>((resolve) => {
+			let data = "";
+			stream.on("data", (chunk: Buffer) => {
+				data += chunk.toString();
+			});
+			stream.on("end", () => resolve(data));
+		});
+
+		const inspectResult = await exec.inspect();
+		if (inspectResult.ExitCode !== 0) {
+			return {
+				status: "unhealthy",
+				message: `PostgreSQL not ready: ${output.trim()}`,
+			};
+		}
+
+		return { status: "healthy" };
+	} catch (error) {
+		return {
+			status: "unhealthy",
+			message:
+				error instanceof Error ? error.message : "Failed to check PostgreSQL",
+		};
+	}
+};
+
+export const checkRedisHealth = async (): Promise<ServiceHealthStatus> => {
+	const serviceCheck = await checkSwarmServiceRunning("dokploy-redis");
+	if (serviceCheck.status === "unhealthy") {
+		return serviceCheck;
+	}
+
+	// Verify Redis actually responds to PING
+	const containerId = await getSwarmServiceContainerId("dokploy-redis");
+	if (!containerId) {
+		return { status: "unhealthy", message: "Could not find running container" };
+	}
+
+	try {
+		const exec = await docker.getContainer(containerId).exec({
+			Cmd: ["redis-cli", "ping"],
+			AttachStdout: true,
+			AttachStderr: true,
+		});
+		const stream = await exec.start({});
+
+		const output = await new Promise<string>((resolve) => {
+			let data = "";
+			stream.on("data", (chunk: Buffer) => {
+				data += chunk.toString();
+			});
+			stream.on("end", () => resolve(data));
+		});
+
+		if (!output.includes("PONG")) {
+			return {
+				status: "unhealthy",
+				message: `Redis did not respond with PONG: ${output.trim()}`,
+			};
+		}
+
+		return { status: "healthy" };
+	} catch (error) {
+		return {
+			status: "unhealthy",
+			message: error instanceof Error ? error.message : "Failed to check Redis",
+		};
+	}
+};
+
+export const checkTraefikHealth = async (): Promise<ServiceHealthStatus> => {
+	// Traefik can run as a standalone container or a swarm service
+	try {
+		const container = docker.getContainer("dokploy-traefik");
+		const info = await container.inspect();
+		if (!info.State.Running) {
+			return {
+				status: "unhealthy",
+				message: "Container is not running",
+			};
+		}
+		return { status: "healthy" };
+	} catch {
+		// Not a standalone container, check as swarm service
+		return checkSwarmServiceRunning("dokploy-traefik");
+	}
+};

packages/server/src/utils/filesystem/directory.ts

@@ -127,7 +127,7 @@ export const getBuildAppDirectory = (application: Application) => {
 			appName,
 			"code",
 			buildPath ?? "",
-			dockerfile || "",
+			dockerfile || "Dockerfile",
 		);
 	}
 

packages/server/src/utils/notifications/build-error.ts

@@ -14,6 +14,7 @@ import {
 	sendPushoverNotification,
 	sendResendNotification,
 	sendSlackNotification,
+	sendTeamsNotification,
 	sendTelegramNotification,
 } from "./utils";
 
@@ -52,6 +53,7 @@ export const sendBuildErrorNotifications = async ({
 			custom: true,
 			lark: true,
 			pushover: true,
+			teams: true,
 		},
 	});
 
@@ -67,6 +69,7 @@ export const sendBuildErrorNotifications = async ({
 			custom,
 			lark,
 			pushover,
+			teams,
 		} = notification;
 		try {
 			if (email || resend) {
@@ -382,6 +385,26 @@ export const sendBuildErrorNotifications = async ({
 					`Project: ${projectName}\nApplication: ${applicationName}\nType: ${applicationType}\nDate: ${date.toLocaleString()}\nError: ${errorMessage}`,
 				);
 			}
+
+			if (teams) {
+				const limitCharacter = 800;
+				const truncatedErrorMessage = errorMessage.substring(0, limitCharacter);
+				await sendTeamsNotification(teams, {
+					title: "⚠️ Build Failed",
+					facts: [
+						{ name: "Project", value: projectName },
+						{ name: "Application", value: applicationName },
+						{ name: "Type", value: applicationType },
+						{ name: "Date", value: format(date, "PP pp") },
+						{ name: "Error Message", value: truncatedErrorMessage },
+					],
+					potentialAction: {
+						type: "Action.OpenUrl",
+						title: "View Build Details",
+						url: buildLink,
+					},
+				});
+			}
 		} catch (error) {
 			console.log(error);
 		}

packages/server/src/utils/notifications/build-success.ts

@@ -15,6 +15,7 @@ import {
 	sendPushoverNotification,
 	sendResendNotification,
 	sendSlackNotification,
+	sendTeamsNotification,
 	sendTelegramNotification,
 } from "./utils";
 
@@ -55,6 +56,7 @@ export const sendBuildSuccessNotifications = async ({
 			custom: true,
 			lark: true,
 			pushover: true,
+			teams: true,
 		},
 	});
 
@@ -70,6 +72,7 @@ export const sendBuildSuccessNotifications = async ({
 			custom,
 			lark,
 			pushover,
+			teams,
 		} = notification;
 		try {
 			if (email || resend) {
@@ -396,6 +399,24 @@ export const sendBuildSuccessNotifications = async ({
 					`Project: ${projectName}\nApplication: ${applicationName}\nEnvironment: ${environmentName}\nType: ${applicationType}\nDate: ${date.toLocaleString()}`,
 				);
 			}
+
+			if (teams) {
+				await sendTeamsNotification(teams, {
+					title: "✅ Build Success",
+					facts: [
+						{ name: "Project", value: projectName },
+						{ name: "Application", value: applicationName },
+						{ name: "Environment", value: environmentName },
+						{ name: "Type", value: applicationType },
+						{ name: "Date", value: format(date, "PP pp") },
+					],
+					potentialAction: {
+						type: "Action.OpenUrl",
+						title: "View Build Details",
+						url: buildLink,
+					},
+				});
+			}
 		} catch (error) {
 			console.log(error);
 		}

packages/server/src/utils/notifications/database-backup.ts

@@ -14,6 +14,7 @@ import {
 	sendPushoverNotification,
 	sendResendNotification,
 	sendSlackNotification,
+	sendTeamsNotification,
 	sendTelegramNotification,
 } from "./utils";
 
@@ -52,6 +53,7 @@ export const sendDatabaseBackupNotifications = async ({
 			custom: true,
 			lark: true,
 			pushover: true,
+			teams: true,
 		},
 	});
 
@@ -67,6 +69,7 @@ export const sendDatabaseBackupNotifications = async ({
 			custom,
 			lark,
 			pushover,
+			teams,
 		} = notification;
 		try {
 			if (email || resend) {
@@ -150,7 +153,7 @@ export const sendDatabaseBackupNotifications = async ({
 							? [
 									{
 										name: decorate("`⚠️`", "Error Message"),
-										value: `\`\`\`${errorMessage}\`\`\``,
+										value: `\`\`\`${errorMessage.length > 1010 ? `${errorMessage.substring(0, 1010)}...` : errorMessage}\`\`\``,
 									},
 								]
 							: []),
@@ -410,6 +413,30 @@ export const sendDatabaseBackupNotifications = async ({
 					`Project: ${projectName}\nApplication: ${applicationName}\nDatabase: ${databaseType}\nDatabase Name: ${databaseName}\nDate: ${date.toLocaleString()}${type === "error" && errorMessage ? `\nError: ${errorMessage}` : ""}`,
 				);
 			}
+
+			if (teams) {
+				const facts = [
+					{ name: "Project", value: projectName },
+					{ name: "Application", value: applicationName },
+					{ name: "Database Type", value: databaseType },
+					{ name: "Database Name", value: databaseName },
+					{ name: "Date", value: format(date, "PP pp") },
+					{
+						name: "Status",
+						value: type === "success" ? "Successful" : "Failed",
+					},
+				];
+				if (type === "error" && errorMessage) {
+					facts.push({ name: "Error", value: errorMessage.substring(0, 500) });
+				}
+				await sendTeamsNotification(teams, {
+					title:
+						type === "success"
+							? "✅ Database Backup Successful"
+							: "❌ Database Backup Failed",
+					facts,
+				});
+			}
 		} catch (error) {
 			console.log(error);
 		}

packages/server/src/utils/notifications/docker-cleanup.ts

@@ -14,6 +14,7 @@ import {
 	sendPushoverNotification,
 	sendResendNotification,
 	sendSlackNotification,
+	sendTeamsNotification,
 	sendTelegramNotification,
 } from "./utils";
 
@@ -39,6 +40,7 @@ export const sendDockerCleanupNotifications = async (
 			custom: true,
 			lark: true,
 			pushover: true,
+			teams: true,
 		},
 	});
 
@@ -54,6 +56,7 @@ export const sendDockerCleanupNotifications = async (
 			custom,
 			lark,
 			pushover,
+			teams,
 		} = notification;
 		try {
 			if (email || resend) {
@@ -262,6 +265,16 @@ export const sendDockerCleanupNotifications = async (
 					`Date: ${date.toLocaleString()}\nMessage: ${message}`,
 				);
 			}
+
+			if (teams) {
+				await sendTeamsNotification(teams, {
+					title: "✅ Docker Cleanup",
+					facts: [
+						{ name: "Date", value: format(date, "PP pp") },
+						{ name: "Message", value: message },
+					],
+				});
+			}
 		} catch (error) {
 			console.log(error);
 		}

packages/server/src/utils/notifications/dokploy-restart.ts

@@ -14,245 +14,262 @@ import {
 	sendPushoverNotification,
 	sendResendNotification,
 	sendSlackNotification,
+	sendTeamsNotification,
 	sendTelegramNotification,
 } from "./utils";
 
 export const sendDokployRestartNotifications = async () => {
-	const date = new Date();
-	const unixDate = ~~(Number(date) / 1000);
-	const notificationList = await db.query.notifications.findMany({
-		where: eq(notifications.dokployRestart, true),
-		with: {
-			email: true,
-			discord: true,
-			telegram: true,
-			slack: true,
-			resend: true,
-			gotify: true,
-			ntfy: true,
-			custom: true,
-			lark: true,
-			pushover: true,
-		},
-	});
+	try {
+		const date = new Date();
+		const unixDate = ~~(Number(date) / 1000);
+		const notificationList = await db.query.notifications.findMany({
+			where: eq(notifications.dokployRestart, true),
+			with: {
+				email: true,
+				discord: true,
+				telegram: true,
+				slack: true,
+				resend: true,
+				gotify: true,
+				ntfy: true,
+				custom: true,
+				lark: true,
+				pushover: true,
+				teams: true,
+			},
+		});
 
-	for (const notification of notificationList) {
-		const {
-			email,
-			resend,
-			discord,
-			telegram,
-			slack,
-			gotify,
-			ntfy,
-			custom,
-			lark,
-			pushover,
-		} = notification;
+		for (const notification of notificationList) {
+			const {
+				email,
+				resend,
+				discord,
+				telegram,
+				slack,
+				gotify,
+				ntfy,
+				custom,
+				lark,
+				pushover,
+				teams,
+			} = notification;
 
-		try {
-			if (email || resend) {
-				const template = await renderAsync(
-					DokployRestartEmail({ date: date.toLocaleString() }),
-				).catch();
+			try {
+				if (email || resend) {
+					const template = await renderAsync(
+						DokployRestartEmail({ date: date.toLocaleString() }),
+					).catch();
 
-				if (email) {
-					await sendEmailNotification(
-						email,
-						"Dokploy Server Restarted",
-						template,
-					);
+					if (email) {
+						await sendEmailNotification(
+							email,
+							"Dokploy Server Restarted",
+							template,
+						);
+					}
+
+					if (resend) {
+						await sendResendNotification(
+							resend,
+							"Dokploy Server Restarted",
+							template,
+						);
+					}
 				}
 
-				if (resend) {
-					await sendResendNotification(
-						resend,
-						"Dokploy Server Restarted",
-						template,
-					);
-				}
-			}
+				if (discord) {
+					const decorate = (decoration: string, text: string) =>
+						`${discord.decoration ? decoration : ""} ${text}`.trim();
 
-			if (discord) {
-				const decorate = (decoration: string, text: string) =>
-					`${discord.decoration ? decoration : ""} ${text}`.trim();
-
-				await sendDiscordNotification(discord, {
-					title: decorate(">", "`✅` Dokploy Server Restarted"),
-					color: 0x57f287,
-					fields: [
-						{
-							name: decorate("`📅`", "Date"),
-							value: `<t:${unixDate}:D>`,
-							inline: true,
-						},
-						{
-							name: decorate("`⌚`", "Time"),
-							value: `<t:${unixDate}:t>`,
-							inline: true,
-						},
-						{
-							name: decorate("`❓`", "Type"),
-							value: "Successful",
-							inline: true,
-						},
-					],
-					timestamp: date.toISOString(),
-					footer: {
-						text: "Dokploy Restart Notification",
-					},
-				});
-			}
-
-			if (gotify) {
-				const decorate = (decoration: string, text: string) =>
-					`${gotify.decoration ? decoration : ""} ${text}\n`;
-				await sendGotifyNotification(
-					gotify,
-					decorate("✅", "Dokploy Server Restarted"),
-					`${decorate("🕒", `Date: ${date.toLocaleString()}`)}`,
-				);
-			}
-
-			if (ntfy) {
-				await sendNtfyNotification(
-					ntfy,
-					"Dokploy Server Restarted",
-					"white_check_mark",
-					"",
-					`🕒Date: ${date.toLocaleString()}`,
-				);
-			}
-
-			if (telegram) {
-				await sendTelegramNotification(
-					telegram,
-					`<b>✅ Dokploy Server Restarted</b>\n\n<b>Date:</b> ${format(
-						date,
-						"PP",
-					)}\n<b>Time:</b> ${format(date, "pp")}`,
-				);
-			}
-
-			if (slack) {
-				const { channel } = slack;
-				await sendSlackNotification(slack, {
-					channel: channel,
-					attachments: [
-						{
-							color: "#00FF00",
-							pretext: ":white_check_mark: *Dokploy Server Restarted*",
-							fields: [
-								{
-									title: "Time",
-									value: date.toLocaleString(),
-									short: true,
-								},
-							],
-						},
-					],
-				});
-			}
-
-			if (custom) {
-				try {
-					await sendCustomNotification(custom, {
-						title: "Dokploy Server Restarted",
-						message: "Dokploy server has been restarted successfully",
+					await sendDiscordNotification(discord, {
+						title: decorate(">", "`✅` Dokploy Server Restarted"),
+						color: 0x57f287,
+						fields: [
+							{
+								name: decorate("`📅`", "Date"),
+								value: `<t:${unixDate}:D>`,
+								inline: true,
+							},
+							{
+								name: decorate("`⌚`", "Time"),
+								value: `<t:${unixDate}:t>`,
+								inline: true,
+							},
+							{
+								name: decorate("`❓`", "Type"),
+								value: "Successful",
+								inline: true,
+							},
+						],
 						timestamp: date.toISOString(),
-						date: date.toLocaleString(),
-						status: "success",
-						type: "dokploy-restart",
+						footer: {
+							text: "Dokploy Restart Notification",
+						},
 					});
-				} catch (error) {
-					console.log(error);
 				}
-			}
 
-			if (lark) {
-				await sendLarkNotification(lark, {
-					msg_type: "interactive",
-					card: {
-						schema: "2.0",
-						config: {
-							update_multi: true,
-							style: {
-								text_size: {
-									normal_v2: {
-										default: "normal",
-										pc: "normal",
-										mobile: "heading",
+				if (gotify) {
+					const decorate = (decoration: string, text: string) =>
+						`${gotify.decoration ? decoration : ""} ${text}\n`;
+					await sendGotifyNotification(
+						gotify,
+						decorate("✅", "Dokploy Server Restarted"),
+						`${decorate("🕒", `Date: ${date.toLocaleString()}`)}`,
+					);
+				}
+
+				if (ntfy) {
+					await sendNtfyNotification(
+						ntfy,
+						"Dokploy Server Restarted",
+						"white_check_mark",
+						"",
+						`🕒Date: ${date.toLocaleString()}`,
+					);
+				}
+
+				if (telegram) {
+					await sendTelegramNotification(
+						telegram,
+						`<b>✅ Dokploy Server Restarted</b>\n\n<b>Date:</b> ${format(
+							date,
+							"PP",
+						)}\n<b>Time:</b> ${format(date, "pp")}`,
+					);
+				}
+
+				if (slack) {
+					const { channel } = slack;
+					await sendSlackNotification(slack, {
+						channel: channel,
+						attachments: [
+							{
+								color: "#00FF00",
+								pretext: ":white_check_mark: *Dokploy Server Restarted*",
+								fields: [
+									{
+										title: "Time",
+										value: date.toLocaleString(),
+										short: true,
+									},
+								],
+							},
+						],
+					});
+				}
+
+				if (custom) {
+					try {
+						await sendCustomNotification(custom, {
+							title: "Dokploy Server Restarted",
+							message: "Dokploy server has been restarted successfully",
+							timestamp: date.toISOString(),
+							date: date.toLocaleString(),
+							status: "success",
+							type: "dokploy-restart",
+						});
+					} catch (error) {
+						console.log(error);
+					}
+				}
+
+				if (lark) {
+					await sendLarkNotification(lark, {
+						msg_type: "interactive",
+						card: {
+							schema: "2.0",
+							config: {
+								update_multi: true,
+								style: {
+									text_size: {
+										normal_v2: {
+											default: "normal",
+											pc: "normal",
+											mobile: "heading",
+										},
 									},
 								},
 							},
-						},
-						header: {
-							title: {
-								tag: "plain_text",
-								content: "✅ Dokploy Server Restarted",
-							},
-							subtitle: {
-								tag: "plain_text",
-								content: "",
-							},
-							template: "green",
-							padding: "12px 12px 12px 12px",
-						},
-						body: {
-							direction: "vertical",
-							padding: "12px 12px 12px 12px",
-							elements: [
-								{
-									tag: "column_set",
-									columns: [
-										{
-											tag: "column",
-											width: "weighted",
-											elements: [
-												{
-													tag: "markdown",
-													content: "**Status:**\nSuccessful",
-													text_align: "left",
-													text_size: "normal_v2",
-												},
-											],
-											vertical_align: "top",
-											weight: 1,
-										},
-										{
-											tag: "column",
-											width: "weighted",
-											elements: [
-												{
-													tag: "markdown",
-													content: `**Restart Time:**\n${format(
-														date,
-														"PP pp",
-													)}`,
-													text_align: "left",
-													text_size: "normal_v2",
-												},
-											],
-											vertical_align: "top",
-											weight: 1,
-										},
-									],
+							header: {
+								title: {
+									tag: "plain_text",
+									content: "✅ Dokploy Server Restarted",
 								},
-							],
+								subtitle: {
+									tag: "plain_text",
+									content: "",
+								},
+								template: "green",
+								padding: "12px 12px 12px 12px",
+							},
+							body: {
+								direction: "vertical",
+								padding: "12px 12px 12px 12px",
+								elements: [
+									{
+										tag: "column_set",
+										columns: [
+											{
+												tag: "column",
+												width: "weighted",
+												elements: [
+													{
+														tag: "markdown",
+														content: "**Status:**\nSuccessful",
+														text_align: "left",
+														text_size: "normal_v2",
+													},
+												],
+												vertical_align: "top",
+												weight: 1,
+											},
+											{
+												tag: "column",
+												width: "weighted",
+												elements: [
+													{
+														tag: "markdown",
+														content: `**Restart Time:**\n${format(
+															date,
+															"PP pp",
+														)}`,
+														text_align: "left",
+														text_size: "normal_v2",
+													},
+												],
+												vertical_align: "top",
+												weight: 1,
+											},
+										],
+									},
+								],
+							},
 						},
-					},
-				});
-			}
+					});
+				}
 
-			if (pushover) {
-				await sendPushoverNotification(
-					pushover,
-					"Dokploy Server Restarted",
-					`Date: ${date.toLocaleString()}`,
-				);
+				if (pushover) {
+					await sendPushoverNotification(
+						pushover,
+						"Dokploy Server Restarted",
+						`Date: ${date.toLocaleString()}`,
+					);
+				}
+
+				if (teams) {
+					await sendTeamsNotification(teams, {
+						title: "✅ Dokploy Server Restarted",
+						facts: [
+							{ name: "Status", value: "Successful" },
+							{ name: "Restart Time", value: format(date, "PP pp") },
+						],
+					});
+				}
+			} catch (error) {
+				console.log(error);
 			}
-		} catch (error) {
-			console.log(error);
 		}
+	} catch (error) {
+		console.error("[Dokploy] Restart notifications failed:", error);
 	}
 };

packages/server/src/utils/notifications/server-threshold.ts

@@ -7,6 +7,7 @@ import {
 	sendLarkNotification,
 	sendPushoverNotification,
 	sendSlackNotification,
+	sendTeamsNotification,
 	sendTelegramNotification,
 } from "./utils";
 
@@ -40,6 +41,7 @@ export const sendServerThresholdNotifications = async (
 			custom: true,
 			lark: true,
 			pushover: true,
+			teams: true,
 		},
 	});
 
@@ -47,7 +49,8 @@ export const sendServerThresholdNotifications = async (
 	const typeColor = 0xff0000; // Rojo para indicar alerta
 
 	for (const notification of notificationList) {
-		const { discord, telegram, slack, custom, lark, pushover } = notification;
+		const { discord, telegram, slack, custom, lark, pushover, teams } =
+			notification;
 
 		if (discord) {
 			const decorate = (decoration: string, text: string) =>
@@ -276,5 +279,19 @@ export const sendServerThresholdNotifications = async (
 				`Server: ${payload.ServerName}\nType: ${payload.Type}\nCurrent: ${payload.Value.toFixed(2)}%\nThreshold: ${payload.Threshold.toFixed(2)}%\nMessage: ${payload.Message}\nTime: ${date.toLocaleString()}`,
 			);
 		}
+
+		if (teams) {
+			await sendTeamsNotification(teams, {
+				title: `⚠️ Server ${payload.Type} Alert`,
+				facts: [
+					{ name: "Server Name", value: payload.ServerName },
+					{ name: "Type", value: payload.Type },
+					{ name: "Current Value", value: `${payload.Value.toFixed(2)}%` },
+					{ name: "Threshold", value: `${payload.Threshold.toFixed(2)}%` },
+					{ name: "Time", value: date.toLocaleString() },
+					{ name: "Message", value: payload.Message },
+				],
+			});
+		}
 	}
 };

packages/server/src/utils/notifications/utils.ts

@@ -8,6 +8,7 @@ import type {
 	pushover,
 	resend,
 	slack,
+	teams,
 	telegram,
 } from "@dokploy/server/db/schema";
 import nodemailer from "nodemailer";
@@ -253,6 +254,84 @@ export const sendLarkNotification = async (
 	}
 };
 
+export interface TeamsAdaptiveCardMessage {
+	title: string;
+	themeColor?: string;
+	facts?: { name: string; value: string }[];
+	potentialAction?: { type: "Action.OpenUrl"; title: string; url: string };
+}
+
+export const sendTeamsNotification = async (
+	connection: typeof teams.$inferInsert,
+	message: TeamsAdaptiveCardMessage,
+) => {
+	try {
+		const bodyElements: Record<string, unknown>[] = [
+			{
+				type: "TextBlock",
+				text: message.title,
+				size: "Medium",
+				weight: "Bolder",
+				wrap: true,
+			},
+		];
+
+		if (message.facts && message.facts.length > 0) {
+			bodyElements.push({
+				type: "FactSet",
+				facts: message.facts.map((f) => ({
+					title: f.name,
+					value: f.value,
+				})),
+			});
+		}
+
+		const cardContent: Record<string, unknown> = {
+			type: "AdaptiveCard",
+			$schema: "http://adaptivecards.io/schemas/adaptive-card.json",
+			version: "1.4",
+			body: bodyElements,
+		};
+
+		if (message.potentialAction) {
+			cardContent.actions = [
+				{
+					type: "Action.OpenUrl",
+					title: message.potentialAction.title,
+					url: message.potentialAction.url,
+				},
+			];
+		}
+
+		const payload = {
+			type: "message",
+			attachments: [
+				{
+					contentType: "application/vnd.microsoft.card.adaptive",
+					content: cardContent,
+				},
+			],
+		};
+
+		const response = await fetch(connection.webhookUrl, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify(payload),
+		});
+
+		if (!response.ok) {
+			throw new Error(
+				`Failed to send Teams notification: ${response.statusText}`,
+			);
+		}
+	} catch (err) {
+		console.log(err);
+		throw new Error(
+			`Failed to send Teams notification ${err instanceof Error ? err.message : "Unknown error"}`,
+		);
+	}
+};
+
 export const sendPushoverNotification = async (
 	connection: typeof pushover.$inferInsert,
 	title: string,