Merge branch 'canary' into invite-user-with-initial-credentials

2026-07-24 07:15:23 +02:00 · 2026-04-04 22:34:31 -06:00
parent 864e2299ee 31fdf69286
commit 87c7305cb2
578 changed files with 227560 additions and 30451 deletions
--- a/packages/server/src/services/admin.ts
+++ b/packages/server/src/services/admin.ts
@@ -117,21 +117,50 @@ export const getDokployUrl = async () => {
 	return `http://${settings?.serverIp}:${process.env.PORT}`;
 };

-export const getTrustedOrigins = async () => {
-	const members = await db.query.member.findMany({
-		where: eq(member.role, "owner"),
-		with: {
-			user: true,
-		},
-	});
+const TRUSTED_ORIGINS_CACHE_TTL_MS = 30 * 60_000;
+let trustedOriginsCache: { data: string[]; expiresAt: number } | null = null;

-	if (members.length === 0) {
-		return [];
+export const getTrustedOrigins = async () => {
+	const runQuery = async () => {
+		const rows = await db
+			.select({ trustedOrigins: user.trustedOrigins })
+			.from(member)
+			.innerJoin(user, eq(member.userId, user.id))
+			.where(eq(member.role, "owner"));
+		return Array.from(new Set(rows.flatMap((r) => r.trustedOrigins ?? [])));
+	};
+
+	if (IS_CLOUD) {
+		const now = Date.now();
+		if (trustedOriginsCache && now < trustedOriginsCache.expiresAt) {
+			return trustedOriginsCache.data;
+		}
+		try {
+			const trustedOrigins = await runQuery();
+			trustedOriginsCache = {
+				data: trustedOrigins,
+				expiresAt: now + TRUSTED_ORIGINS_CACHE_TTL_MS,
+			};
+			return trustedOrigins;
+		} catch (error) {
+			console.error("Failed to fetch trusted origins:", error);
+			return trustedOriginsCache?.data ?? [];
+		}
 	}

-	const trustedOrigins = members.flatMap(
-		(member) => member.user.trustedOrigins || [],
-	);
-
-	return Array.from(new Set(trustedOrigins));
+	try {
+		return await runQuery();
+	} catch (error) {
+		console.error("Failed to fetch trusted origins:", error);
+		return [];
+	}
+};
+
+export const getTrustedProviders = async () => {
+	try {
+		const providers = await db.query.ssoProvider.findMany();
+		return providers.map((provider) => provider.providerId);
+	} catch (error) {
+		return [];
+	}
 };
--- a/packages/server/src/services/application.ts
+++ b/packages/server/src/services/application.ts
@@ -29,6 +29,7 @@ import { cloneGitlabRepository } from "@dokploy/server/utils/providers/gitlab";
 import { createTraefikConfig } from "@dokploy/server/utils/traefik/application";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 import { encodeBase64 } from "../utils/docker/utils";
 import { getDokployUrl } from "./admin";
 import {
@@ -44,6 +45,7 @@ import {
 	issueCommentExists,
 	updateIssueComment,
 } from "./github";
+import { generateApplyPatchesCommand } from "./patch";
 import {
 	findPreviewDeploymentById,
 	updatePreviewDeployment,
@@ -52,7 +54,7 @@ import { validUniqueServerAppName } from "./project";
 export type Application = typeof applications.$inferSelect;

 export const createApplication = async (
-	input: typeof apiCreateApplication._type,
+	input: z.infer<typeof apiCreateApplication>,
 ) => {
 	const appName = buildAppName("app", input.appName);

@@ -202,6 +204,14 @@ export const deployApplication = async ({
 			command += await buildRemoteDocker(application);
 		}

+		if (application.sourceType !== "docker") {
+			command += await generateApplyPatchesCommand({
+				id: application.applicationId,
+				type: "application",
+				serverId,
+			});
+		}
+
 		command += await getBuildCommand(application);

 		const commandWithLog = `(${command}) >> ${deployment.logPath} 2>&1`;
--- a/packages/server/src/services/backup.ts
+++ b/packages/server/src/services/backup.ts
@@ -2,17 +2,16 @@ import { db } from "@dokploy/server/db";
 import { type apiCreateBackup, backups } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";

 export type Backup = typeof backups.$inferSelect;

 export type BackupSchedule = Awaited<ReturnType<typeof findBackupById>>;
 export type BackupScheduleList = Awaited<ReturnType<typeof findBackupsByDbId>>;
-export const createBackup = async (input: typeof apiCreateBackup._type) => {
+export const createBackup = async (input: z.infer<typeof apiCreateBackup>) => {
 	const newBackup = await db
 		.insert(backups)
-		.values({
-			...input,
-		})
+		.values({ ...input } as typeof backups.$inferInsert)
 		.returning()
 		.then((value) => value[0]);

@@ -34,6 +33,7 @@ export const findBackupById = async (backupId: string) => {
 			mysql: true,
 			mariadb: true,
 			mongo: true,
+			libsql: true,
 			destination: true,
 			compose: true,
 		},
@@ -73,7 +73,7 @@ export const removeBackupById = async (backupId: string) => {

 export const findBackupsByDbId = async (
 	id: string,
-	type: "postgres" | "mysql" | "mariadb" | "mongo",
+	type: "postgres" | "mysql" | "mariadb" | "mongo" | "libsql",
 ) => {
 	const result = await db.query.backups.findMany({
 		where: eq(backups[`${type}Id`], id),
@@ -82,6 +82,7 @@ export const findBackupsByDbId = async (
 			mysql: true,
 			mariadb: true,
 			mongo: true,
+			libsql: true,
 			destination: true,
 		},
 	});
--- a/packages/server/src/services/bitbucket.ts
+++ b/packages/server/src/services/bitbucket.ts
@@ -7,11 +7,12 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";

 export type Bitbucket = typeof bitbucket.$inferSelect;

 export const createBitbucket = async (
-	input: typeof apiCreateBitbucket._type,
+	input: z.infer<typeof apiCreateBitbucket>,
 	organizationId: string,
 	userId: string,
 ) => {
@@ -65,7 +66,7 @@ export const findBitbucketById = async (bitbucketId: string) => {

 export const updateBitbucket = async (
 	bitbucketId: string,
-	input: typeof apiUpdateBitbucket._type,
+	input: z.infer<typeof apiUpdateBitbucket>,
 ) => {
 	return await db.transaction(async (tx) => {
 		// First get the current bitbucket provider to get gitProviderId
--- a/packages/server/src/services/certificate.ts
+++ b/packages/server/src/services/certificate.ts
@@ -126,3 +126,36 @@ const createCertificateFiles = async (certificate: Certificate) => {
 		fs.writeFileSync(configFile, yamlConfig);
 	}
 };
+
+export const updateCertificate = async (
+	certificateId: string,
+	updates: {
+		name?: string;
+		certificateData?: string;
+		privateKey?: string;
+	},
+) => {
+	const updated = await db
+		.update(certificates)
+		.set({
+			...updates,
+		})
+		.where(eq(certificates.certificateId, certificateId))
+		.returning();
+
+	if (!updated || updated[0] === undefined) {
+		throw new TRPCError({
+			code: "BAD_REQUEST",
+			message: "Failed to update the certificate",
+		});
+	}
+
+	const cert = updated[0];
+
+	// If cert data or private key changed, rewrite files
+	if (updates.certificateData || updates.privateKey) {
+		await createCertificateFiles(cert);
+	}
+
+	return cert;
+};
--- a/packages/server/src/services/compose.ts
+++ b/packages/server/src/services/compose.ts
@@ -33,6 +33,7 @@ import { cloneGitlabRepository } from "@dokploy/server/utils/providers/gitlab";
 import { getCreateComposeFileCommand } from "@dokploy/server/utils/providers/raw";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 import { encodeBase64 } from "../utils/docker/utils";
 import { getDokployUrl } from "./admin";
 import {
@@ -40,11 +41,14 @@ import {
 	updateDeployment,
 	updateDeploymentStatus,
 } from "./deployment";
+import { generateApplyPatchesCommand } from "./patch";
 import { validUniqueServerAppName } from "./project";

 export type Compose = typeof compose.$inferSelect;

-export const createCompose = async (input: typeof apiCreateCompose._type) => {
+export const createCompose = async (
+	input: z.infer<typeof apiCreateCompose>,
+) => {
 	const appName = buildAppName("compose", input.appName);

 	const valid = await validUniqueServerAppName(appName);
@@ -247,8 +251,15 @@ export const deployCompose = async ({
 		} else {
 			await execAsync(commandWithLog);
 		}
-
 		command = "set -e;";
+		if (compose.sourceType !== "raw") {
+			command += await generateApplyPatchesCommand({
+				id: compose.composeId,
+				type: "compose",
+				serverId: compose.serverId,
+			});
+		}
+
 		command += await getBuildComposeCommand(entity);
 		commandWithLog = `(${command}) >> ${deployment.logPath} 2>&1`;
 		if (compose.serverId) {
--- a/packages/server/src/services/deployment.ts
+++ b/packages/server/src/services/deployment.ts
@@ -10,7 +10,11 @@ import {
 	type apiCreateDeploymentSchedule,
 	type apiCreateDeploymentServer,
 	type apiCreateDeploymentVolumeBackup,
+	applications,
+	compose,
 	deployments,
+	environments,
+	projects,
 } from "@dokploy/server/db/schema";
 import { removeDirectoryIfExistsContent } from "@dokploy/server/utils/filesystem/directory";
 import {
@@ -19,7 +23,8 @@ import {
 } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { format } from "date-fns";
-import { desc, eq } from "drizzle-orm";
+import { and, desc, eq, inArray, or, sql } from "drizzle-orm";
+import type { z } from "zod";
 import {
 	type Application,
 	findApplicationById,
@@ -37,6 +42,41 @@ import { findScheduleById } from "./schedule";
 import { findServerById, type Server } from "./server";
 import { findVolumeBackupById } from "./volume-backups";

+export type ServicePath = { href: string | null; label: string };
+
+export async function resolveServicePath(
+	orgId: string,
+	data: Record<string, unknown>,
+): Promise<ServicePath> {
+	try {
+		const applicationId = data?.applicationId as string | undefined;
+		const composeId = data?.composeId as string | undefined;
+		if (applicationId) {
+			const app = await findApplicationById(applicationId);
+			if (app.environment.project.organizationId !== orgId) {
+				return { href: null, label: "Application" };
+			}
+			return {
+				href: `/dashboard/project/${app.environment.project.projectId}/environment/${app.environment.environmentId}/services/application/${app.applicationId}`,
+				label: "Application",
+			};
+		}
+		if (composeId) {
+			const comp = await findComposeById(composeId);
+			if (comp.environment.project.organizationId !== orgId) {
+				return { href: null, label: "Compose" };
+			}
+			return {
+				href: `/dashboard/project/${comp.environment.project.projectId}/environment/${comp.environment.environmentId}/services/compose/${comp.composeId}`,
+				label: "Compose",
+			};
+		}
+	} catch {
+		// not found or unauthorized
+	}
+	return { href: null, label: "—" };
+}
+
 export type Deployment = typeof deployments.$inferSelect;

 export const findDeploymentById = async (deploymentId: string) => {
@@ -72,17 +112,17 @@ export const findDeploymentByApplicationId = async (applicationId: string) => {

 export const createDeployment = async (
 	deployment: Omit<
-		typeof apiCreateDeployment._type,
+		z.infer<typeof apiCreateDeployment>,
 		"deploymentId" | "createdAt" | "status" | "logPath"
 	>,
 ) => {
 	const application = await findApplicationById(deployment.applicationId);
+	await removeLastTenDeployments(
+		deployment.applicationId,
+		"application",
+		application.serverId,
+	);
 	try {
-		await removeLastTenDeployments(
-			deployment.applicationId,
-			"application",
-			application.serverId,
-		);
 		const serverId = application.buildServerId || application.serverId;

 		const { LOGS_PATH } = paths(!!serverId);
@@ -137,7 +177,7 @@ export const createDeployment = async (
 				status: "error",
 				logPath: "",
 				description: deployment.description || "",
-				errorMessage: `An error have occured: ${error instanceof Error ? error.message : error}`,
+				errorMessage: `An error have occurred: ${error instanceof Error ? error.message : error}`,
 				startedAt: new Date().toISOString(),
 				finishedAt: new Date().toISOString(),
 			})
@@ -153,20 +193,19 @@ export const createDeployment = async (

 export const createDeploymentPreview = async (
 	deployment: Omit<
-		typeof apiCreateDeploymentPreview._type,
+		z.infer<typeof apiCreateDeploymentPreview>,
 		"deploymentId" | "createdAt" | "status" | "logPath"
 	>,
 ) => {
 	const previewDeployment = await findPreviewDeploymentById(
 		deployment.previewDeploymentId,
 	);
+	await removeLastTenDeployments(
+		deployment.previewDeploymentId,
+		"previewDeployment",
+		previewDeployment?.application?.serverId,
+	);
 	try {
-		await removeLastTenDeployments(
-			deployment.previewDeploymentId,
-			"previewDeployment",
-			previewDeployment?.application?.serverId,
-		);
-
 		const appName = `${previewDeployment.appName}`;
 		const { LOGS_PATH } = paths(!!previewDeployment?.application?.serverId);
 		const formattedDateTime = format(new Date(), "yyyy-MM-dd:HH:mm:ss");
@@ -218,7 +257,7 @@ export const createDeploymentPreview = async (
 				status: "error",
 				logPath: "",
 				description: deployment.description || "",
-				errorMessage: `An error have occured: ${error instanceof Error ? error.message : error}`,
+				errorMessage: `An error have occurred: ${error instanceof Error ? error.message : error}`,
 				startedAt: new Date().toISOString(),
 				finishedAt: new Date().toISOString(),
 			})
@@ -236,17 +275,17 @@ export const createDeploymentPreview = async (

 export const createDeploymentCompose = async (
 	deployment: Omit<
-		typeof apiCreateDeploymentCompose._type,
+		z.infer<typeof apiCreateDeploymentCompose>,
 		"deploymentId" | "createdAt" | "status" | "logPath"
 	>,
 ) => {
 	const compose = await findComposeById(deployment.composeId);
+	await removeLastTenDeployments(
+		deployment.composeId,
+		"compose",
+		compose.serverId,
+	);
 	try {
-		await removeLastTenDeployments(
-			deployment.composeId,
-			"compose",
-			compose.serverId,
-		);
 		const { LOGS_PATH } = paths(!!compose.serverId);
 		const formattedDateTime = format(new Date(), "yyyy-MM-dd:HH:mm:ss");
 		const fileName = `${compose.appName}-${formattedDateTime}.log`;
@@ -295,7 +334,7 @@ echo "Initializing deployment\n" >> ${logFilePath};
 				status: "error",
 				logPath: "",
 				description: deployment.description || "",
-				errorMessage: `An error have occured: ${error instanceof Error ? error.message : error}`,
+				errorMessage: `An error have occurred: ${error instanceof Error ? error.message : error}`,
 				startedAt: new Date().toISOString(),
 				finishedAt: new Date().toISOString(),
 			})
@@ -313,7 +352,7 @@ echo "Initializing deployment\n" >> ${logFilePath};

 export const createDeploymentBackup = async (
 	deployment: Omit<
-		typeof apiCreateDeploymentBackup._type,
+		z.infer<typeof apiCreateDeploymentBackup>,
 		"deploymentId" | "createdAt" | "status" | "logPath"
 	>,
 ) => {
@@ -329,8 +368,8 @@ export const createDeploymentBackup = async (
 	} else if (backup.backupType === "compose") {
 		serverId = backup.compose?.serverId;
 	}
+	await removeLastTenDeployments(deployment.backupId, "backup", serverId);
 	try {
-		await removeLastTenDeployments(deployment.backupId, "backup", serverId);
 		const { LOGS_PATH } = paths(!!serverId);
 		const formattedDateTime = format(new Date(), "yyyy-MM-dd:HH:mm:ss");
 		const fileName = `${backup.appName}-${formattedDateTime}.log`;
@@ -379,7 +418,7 @@ echo "Initializing backup\n" >> ${logFilePath};
 				status: "error",
 				logPath: "",
 				description: deployment.description || "",
-				errorMessage: `An error have occured: ${error instanceof Error ? error.message : error}`,
+				errorMessage: `An error have occurred: ${error instanceof Error ? error.message : error}`,
 				startedAt: new Date().toISOString(),
 				finishedAt: new Date().toISOString(),
 			})
@@ -393,18 +432,18 @@ echo "Initializing backup\n" >> ${logFilePath};

 export const createDeploymentSchedule = async (
 	deployment: Omit<
-		typeof apiCreateDeploymentSchedule._type,
+		z.infer<typeof apiCreateDeploymentSchedule>,
 		"deploymentId" | "createdAt" | "status" | "logPath"
 	>,
 ) => {
 	const schedule = await findScheduleById(deployment.scheduleId);

+	const serverId =
+		schedule.application?.serverId ||
+		schedule.compose?.serverId ||
+		schedule.server?.serverId;
+	await removeLastTenDeployments(deployment.scheduleId, "schedule", serverId);
 	try {
-		const serverId =
-			schedule.application?.serverId ||
-			schedule.compose?.serverId ||
-			schedule.server?.serverId;
-		await removeLastTenDeployments(deployment.scheduleId, "schedule", serverId);
 		const { SCHEDULES_PATH } = paths(!!serverId);
 		const formattedDateTime = format(new Date(), "yyyy-MM-dd:HH:mm:ss");
 		const fileName = `${schedule.appName}-${formattedDateTime}.log`;
@@ -454,7 +493,7 @@ export const createDeploymentSchedule = async (
 				status: "error",
 				logPath: "",
 				description: deployment.description || "",
-				errorMessage: `An error have occured: ${error instanceof Error ? error.message : error}`,
+				errorMessage: `An error have occurred: ${error instanceof Error ? error.message : error}`,
 				startedAt: new Date().toISOString(),
 				finishedAt: new Date().toISOString(),
 			})
@@ -469,20 +508,20 @@ export const createDeploymentSchedule = async (

 export const createDeploymentVolumeBackup = async (
 	deployment: Omit<
-		typeof apiCreateDeploymentVolumeBackup._type,
+		z.infer<typeof apiCreateDeploymentVolumeBackup>,
 		"deploymentId" | "createdAt" | "status" | "logPath"
 	>,
 ) => {
 	const volumeBackup = await findVolumeBackupById(deployment.volumeBackupId);

+	const serverId =
+		volumeBackup.application?.serverId || volumeBackup.compose?.serverId;
+	await removeLastTenDeployments(
+		deployment.volumeBackupId,
+		"volumeBackup",
+		serverId,
+	);
 	try {
-		const serverId =
-			volumeBackup.application?.serverId || volumeBackup.compose?.serverId;
-		await removeLastTenDeployments(
-			deployment.volumeBackupId,
-			"volumeBackup",
-			serverId,
-		);
 		const { VOLUME_BACKUPS_PATH } = paths(!!serverId);
 		const formattedDateTime = format(new Date(), "yyyy-MM-dd:HH:mm:ss");
 		const fileName = `${volumeBackup.appName}-${formattedDateTime}.log`;
@@ -539,7 +578,7 @@ export const createDeploymentVolumeBackup = async (
 				status: "error",
 				logPath: "",
 				description: deployment.description || "",
-				errorMessage: `An error have occured: ${error instanceof Error ? error.message : error}`,
+				errorMessage: `An error have occurred: ${error instanceof Error ? error.message : error}`,
 				startedAt: new Date().toISOString(),
 				finishedAt: new Date().toISOString(),
 			})
@@ -561,24 +600,23 @@ export const removeDeployment = async (deploymentId: string) => {
 			.then((result) => result[0]);

 		if (!deployment) {
-			throw new TRPCError({
-				code: "BAD_REQUEST",
-				message: "Deployment not found",
-			});
+			return null;
 		}
-		const command = `
-			rm -f ${deployment.logPath};
-		`;
-		if (deployment.serverId) {
-			await execAsyncRemote(deployment.serverId, command);
-		} else {
-			await execAsync(command);
+
+		const logPath = path.join(deployment.logPath);
+		if (logPath && logPath !== ".") {
+			const command = `rm -f ${logPath};`;
+			if (deployment.serverId) {
+				await execAsyncRemote(deployment.serverId, command);
+			} else {
+				await execAsync(command);
+			}
 		}

 		return deployment;
 	} catch (error) {
 		const message =
-			error instanceof Error ? error.message : "Error creating the deployment";
+			error instanceof Error ? error.message : "Error removing the deployment";
 		throw new TRPCError({
 			code: "BAD_REQUEST",
 			message,
@@ -646,34 +684,49 @@ const removeLastTenDeployments = async (
 		if (serverId) {
 			let command = "";
 			for (const oldDeployment of deploymentsToDelete) {
-				const logPath = path.join(oldDeployment.logPath);
-				if (oldDeployment.rollbackId) {
-					await removeRollbackById(oldDeployment.rollbackId);
-				}
+				try {
+					const logPath = path.join(oldDeployment.logPath);
+					if (oldDeployment.rollbackId) {
+						await removeRollbackById(oldDeployment.rollbackId);
+					}

-				if (logPath !== ".") {
-					command += `
-					rm -rf ${logPath};
-					`;
+					if (logPath && logPath !== ".") {
+						command += `rm -rf ${logPath};`;
+					}
+					await removeDeployment(oldDeployment.deploymentId);
+				} catch (err) {
+					console.error(
+						`Failed to remove deployment ${oldDeployment.deploymentId} during cleanup:`,
+						err,
+					);
 				}
-				await removeDeployment(oldDeployment.deploymentId);
 			}

-			await execAsyncRemote(serverId, command);
+			if (command) {
+				await execAsyncRemote(serverId, command);
+			}
 		} else {
 			for (const oldDeployment of deploymentsToDelete) {
-				if (oldDeployment.rollbackId) {
-					await removeRollbackById(oldDeployment.rollbackId);
+				try {
+					if (oldDeployment.rollbackId) {
+						await removeRollbackById(oldDeployment.rollbackId);
+					}
+					const logPath = path.join(oldDeployment.logPath);
+					if (
+						logPath &&
+						logPath !== "." &&
+						existsSync(logPath) &&
+						!oldDeployment.errorMessage
+					) {
+						await fsPromises.unlink(logPath);
+					}
+					await removeDeployment(oldDeployment.deploymentId);
+				} catch (err) {
+					console.error(
+						`Failed to remove deployment ${oldDeployment.deploymentId} during cleanup:`,
+						err,
+					);
 				}
-				const logPath = path.join(oldDeployment.logPath);
-				if (
-					existsSync(logPath) &&
-					!oldDeployment.errorMessage &&
-					logPath !== "."
-				) {
-					await fsPromises.unlink(logPath);
-				}
-				await removeDeployment(oldDeployment.deploymentId);
 			}
 		}
 	}
@@ -737,6 +790,135 @@ export const findAllDeploymentsByComposeId = async (composeId: string) => {
 	return deploymentsList;
 };

+const centralizedDeploymentsWith = {
+	application: {
+		columns: { applicationId: true, name: true, appName: true },
+		with: {
+			environment: {
+				columns: { environmentId: true, name: true },
+				with: {
+					project: {
+						columns: { projectId: true, name: true },
+					},
+				},
+			},
+			server: {
+				columns: { serverId: true, name: true, serverType: true },
+			},
+			buildServer: {
+				columns: { serverId: true, name: true, serverType: true },
+			},
+		},
+	},
+	compose: {
+		columns: { composeId: true, name: true, appName: true },
+		with: {
+			environment: {
+				columns: { environmentId: true, name: true },
+				with: {
+					project: {
+						columns: { projectId: true, name: true },
+					},
+				},
+			},
+			server: {
+				columns: { serverId: true, name: true, serverType: true },
+			},
+		},
+	},
+	server: {
+		columns: { serverId: true, name: true, serverType: true },
+	},
+	buildServer: {
+		columns: { serverId: true, name: true, serverType: true },
+	},
+} as const;
+
+async function getApplicationIdsInOrg(
+	orgId: string,
+	accessedServices: string[] | null,
+): Promise<string[]> {
+	const rows = await db
+		.select({ applicationId: applications.applicationId })
+		.from(applications)
+		.innerJoin(
+			environments,
+			eq(applications.environmentId, environments.environmentId),
+		)
+		.innerJoin(projects, eq(environments.projectId, projects.projectId))
+		.where(
+			accessedServices !== null
+				? and(
+						eq(projects.organizationId, orgId),
+						inArray(applications.applicationId, accessedServices),
+					)
+				: eq(projects.organizationId, orgId),
+		);
+	return rows.map((r) => r.applicationId);
+}
+
+async function getComposeIdsInOrg(
+	orgId: string,
+	accessedServices: string[] | null,
+): Promise<string[]> {
+	const rows = await db
+		.select({ composeId: compose.composeId })
+		.from(compose)
+		.innerJoin(
+			environments,
+			eq(compose.environmentId, environments.environmentId),
+		)
+		.innerJoin(projects, eq(environments.projectId, projects.projectId))
+		.where(
+			accessedServices !== null
+				? and(
+						eq(projects.organizationId, orgId),
+						inArray(compose.composeId, accessedServices),
+					)
+				: eq(projects.organizationId, orgId),
+		);
+	return rows.map((r) => r.composeId);
+}
+
+/**
+ * All deployments for applications and compose in the org.
+ * Pass accessedServices for members (only those services), null for owner/admin.
+ */
+export const findAllDeploymentsCentralized = async (
+	orgId: string,
+	accessedServices: string[] | null,
+) => {
+	if (accessedServices !== null && accessedServices.length === 0) {
+		return [];
+	}
+
+	const [appIds, compIds] = await Promise.all([
+		getApplicationIdsInOrg(orgId, accessedServices),
+		getComposeIdsInOrg(orgId, accessedServices),
+	]);
+
+	if (appIds.length === 0 && compIds.length === 0) {
+		return [];
+	}
+
+	const conditions = [
+		...(appIds.length > 0 ? [inArray(deployments.applicationId, appIds)] : []),
+		...(compIds.length > 0 ? [inArray(deployments.composeId, compIds)] : []),
+	];
+	const whereClause =
+		conditions.length === 0
+			? sql`1 = 0`
+			: conditions.length === 1
+				? conditions[0]
+				: or(...conditions);
+
+	return db.query.deployments.findMany({
+		where: whereClause,
+		orderBy: desc(deployments.createdAt),
+		with: centralizedDeploymentsWith,
+	});
+};
+
 export const updateDeployment = async (
 	deploymentId: string,
 	deploymentData: Partial<Deployment>,
@@ -773,7 +955,7 @@ export const updateDeploymentStatus = async (

 export const createServerDeployment = async (
 	deployment: Omit<
-		typeof apiCreateDeploymentServer._type,
+		z.infer<typeof apiCreateDeploymentServer>,
 		"deploymentId" | "createdAt" | "status" | "logPath"
 	>,
 ) => {
--- a/packages/server/src/services/destination.ts
+++ b/packages/server/src/services/destination.ts
@@ -5,11 +5,12 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { and, eq } from "drizzle-orm";
+import type { z } from "zod";

 export type Destination = typeof destinations.$inferSelect;

-export const createDestintation = async (
-	input: typeof apiCreateDestination._type,
+export const createDestination = async (
+	input: z.infer<typeof apiCreateDestination>,
 	organizationId: string,
 ) => {
 	const newDestination = await db
--- a/packages/server/src/services/docker.ts
+++ b/packages/server/src/services/docker.ts
@@ -371,6 +371,21 @@ export const containerRestart = async (containerId: string) => {
 	} catch {}
 };

+export const containerRemove = async (
+	containerId: string,
+	serverId?: string,
+) => {
+	const command = `docker rm -f ${containerId}`;
+	const { stderr } = serverId
+		? await execAsyncRemote(serverId, command)
+		: await execAsync(command);
+
+	if (stderr) {
+		console.error(`Error: ${stderr}`);
+		throw new Error(stderr);
+	}
+};
+
 export const getSwarmNodes = async (serverId?: string) => {
 	try {
 		let stdout = "";
@@ -397,7 +412,9 @@ export const getSwarmNodes = async (serverId?: string) => {
 			.split("\n")
 			.map((line) => JSON.parse(line));
 		return nodesArray;
-	} catch {}
+	} catch (error) {
+		console.error("getSwarmNodes error:", error);
+	}
 };

 export const getNodeInfo = async (nodeId: string, serverId?: string) => {
@@ -448,6 +465,10 @@ export const getNodeApplications = async (serverId?: string) => {
 			return;
 		}

+		if (!stdout.trim()) {
+			return [];
+		}
+
 		const appArray = stdout
 			.trim()
 			.split("\n")
@@ -455,13 +476,19 @@ export const getNodeApplications = async (serverId?: string) => {
 			.filter((service) => !service.Name.startsWith("dokploy-"));

 		return appArray;
-	} catch {}
+	} catch (error) {
+		console.error("getNodeApplications error:", error);
+		return [];
+	}
 };

 export const getApplicationInfo = async (
 	appNames: string[],
 	serverId?: string,
 ) => {
+	if (appNames.length === 0) {
+		return [];
+	}
 	try {
 		let stdout = "";
 		let stderr = "";
@@ -482,11 +509,84 @@ export const getApplicationInfo = async (
 			return;
 		}

+		if (!stdout.trim()) {
+			return [];
+		}
+
 		const appArray = stdout
 			.trim()
 			.split("\n")
 			.map((line) => JSON.parse(line));

 		return appArray;
-	} catch {}
+	} catch (error) {
+		console.error("getApplicationInfo error:", error);
+		return [];
+	}
+};
+
+export const getAllContainerStats = async (serverId?: string) => {
+	try {
+		let stdout = "";
+		const command =
+			'docker stats --no-stream --format \'{"BlockIO":"{{.BlockIO}}","CPUPerc":"{{.CPUPerc}}","Container":"{{.Container}}","ID":"{{.ID}}","MemPerc":"{{.MemPerc}}","MemUsage":"{{.MemUsage}}","Name":"{{.Name}}","NetIO":"{{.NetIO}}"}\'';
+
+		if (serverId) {
+			const result = await execAsyncRemote(serverId, command);
+			stdout = result.stdout;
+		} else {
+			const result = await execAsync(command);
+			stdout = result.stdout;
+		}
+
+		if (!stdout.trim()) {
+			return [];
+		}
+
+		const stats = stdout
+			.trim()
+			.split("\n")
+			.map((line) => JSON.parse(line));
+
+		return stats;
+	} catch (error) {
+		console.error("getAllContainerStats error:", error);
+		return [];
+	}
+};
+
+export const uploadFileToContainer = async (
+	containerId: string,
+	fileBuffer: Buffer,
+	fileName: string,
+	destinationPath: string,
+	serverId?: string | null,
+): Promise<void> => {
+	const containerIdRegex = /^[a-zA-Z0-9.\-_]+$/;
+	if (!containerIdRegex.test(containerId)) {
+		throw new Error("Invalid container ID");
+	}
+
+	// Ensure destination path starts with /
+	const normalizedPath = destinationPath.startsWith("/")
+		? destinationPath
+		: `/${destinationPath}`;
+
+	const base64Content = fileBuffer.toString("base64");
+	const tempFileName = `dokploy-upload-${Date.now()}-${fileName.replace(/[^a-zA-Z0-9.-]/g, "_")}`;
+	const tempPath = `/tmp/${tempFileName}`;
+
+	const command = `echo '${base64Content}' | base64 -d > "${tempPath}" && docker cp "${tempPath}" "${containerId}:${normalizedPath}" ; rm -f "${tempPath}"`;
+
+	try {
+		if (serverId) {
+			await execAsyncRemote(serverId, command);
+		} else {
+			await execAsync(command);
+		}
+	} catch (error) {
+		throw new Error(
+			`Failed to upload file to container: ${error instanceof Error ? error.message : String(error)}`,
+		);
+	}
 };
--- a/packages/server/src/services/domain.ts
+++ b/packages/server/src/services/domain.ts
@@ -6,6 +6,7 @@ import { generateRandomDomain } from "@dokploy/server/templates";
 import { manageDomain } from "@dokploy/server/utils/traefik/domain";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 import { type apiCreateDomain, domains } from "../db/schema";
 import { findApplicationById } from "./application";
 import { detectCDNProvider } from "./cdn";
@@ -13,14 +14,14 @@ import { findServerById } from "./server";

 export type Domain = typeof domains.$inferSelect;

-export const createDomain = async (input: typeof apiCreateDomain._type) => {
+export const createDomain = async (input: z.infer<typeof apiCreateDomain>) => {
 	const result = await db.transaction(async (tx) => {
 		const domain = await tx
 			.insert(domains)
 			.values({
 				...input,
 				host: input.host?.trim(),
-			})
+			} as typeof domains.$inferInsert)
 			.returning()
 			.then((response) => response[0]);

@@ -44,7 +45,7 @@ export const createDomain = async (input: typeof apiCreateDomain._type) => {

 export const generateTraefikMeDomain = async (
 	appName: string,
-	userId: string,
+	_userId: string,
 	serverId?: string,
 ) => {
 	if (serverId) {
--- a/packages/server/src/services/environment.ts
+++ b/packages/server/src/services/environment.ts
@@ -6,11 +6,12 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { asc, eq } from "drizzle-orm";
+import type { z } from "zod";

 export type Environment = typeof environments.$inferSelect;

 export const createEnvironment = async (
-	input: typeof apiCreateEnvironment._type,
+	input: z.infer<typeof apiCreateEnvironment>,
 ) => {
 	const newEnvironment = await db
 		.insert(environments)
@@ -33,42 +34,158 @@ export const createEnvironment = async (
 export const findEnvironmentById = async (environmentId: string) => {
 	const environment = await db.query.environments.findFirst({
 		where: eq(environments.environmentId, environmentId),
+		columns: {
+			name: true,
+			description: true,
+			environmentId: true,
+			isDefault: true,
+			projectId: true,
+			env: true,
+		},
 		with: {
 			applications: {
 				with: {
-					deployments: true,
-					server: true,
+					server: {
+						columns: {
+							name: true,
+							serverId: true,
+						},
+					},
+				},
+				columns: {
+					name: true,
+					applicationId: true,
+					createdAt: true,
+					applicationStatus: true,
+					description: true,
+					serverId: true,
+					icon: true,
 				},
 			},
 			mariadb: {
 				with: {
-					server: true,
+					server: {
+						columns: {
+							name: true,
+							serverId: true,
+						},
+					},
+				},
+				columns: {
+					mariadbId: true,
+					name: true,
+					createdAt: true,
+					applicationStatus: true,
+					description: true,
+					serverId: true,
 				},
 			},
 			mongo: {
 				with: {
-					server: true,
+					server: {
+						columns: {
+							name: true,
+							serverId: true,
+						},
+					},
+				},
+				columns: {
+					mongoId: true,
+					name: true,
+					createdAt: true,
+					applicationStatus: true,
+					description: true,
+					serverId: true,
 				},
 			},
 			mysql: {
 				with: {
-					server: true,
+					server: {
+						columns: {
+							name: true,
+							serverId: true,
+						},
+					},
+				},
+				columns: {
+					mysqlId: true,
+					name: true,
+					createdAt: true,
+					applicationStatus: true,
+					description: true,
+					serverId: true,
 				},
 			},
 			postgres: {
 				with: {
-					server: true,
+					server: {
+						columns: {
+							name: true,
+							serverId: true,
+						},
+					},
+				},
+				columns: {
+					postgresId: true,
+					name: true,
+					description: true,
+					createdAt: true,
+					applicationStatus: true,
+					serverId: true,
 				},
 			},
 			redis: {
 				with: {
-					server: true,
+					server: {
+						columns: {
+							name: true,
+							serverId: true,
+						},
+					},
+				},
+				columns: {
+					redisId: true,
+					name: true,
+					createdAt: true,
+					applicationStatus: true,
+					description: true,
+					serverId: true,
 				},
 			},
 			compose: {
 				with: {
-					deployments: true,
-					server: true,
+					server: {
+						columns: {
+							name: true,
+							serverId: true,
+						},
+					},
+				},
+				columns: {
+					composeId: true,
+					name: true,
+					createdAt: true,
+					composeStatus: true,
+					description: true,
+					serverId: true,
+				},
+			},
+			libsql: {
+				with: {
+					server: {
+						columns: {
+							name: true,
+							serverId: true,
+						},
+					},
+				},
+				columns: {
+					libsqlId: true,
+					name: true,
+					createdAt: true,
+					applicationStatus: true,
+					description: true,
+					serverId: true,
 				},
 			},
 			project: true,
@@ -95,8 +212,15 @@ export const findEnvironmentsByProjectId = async (projectId: string) => {
 			postgres: true,
 			redis: true,
 			compose: true,
+			libsql: true,
 			project: true,
 		},
+		columns: {
+			name: true,
+			description: true,
+			environmentId: true,
+			isDefault: true,
+		},
 	});
 	return projectEnvironments;
 };
@@ -107,6 +231,7 @@ const environmentHasServices = (
 	return (
 		(env.applications?.length ?? 0) > 0 ||
 		(env.compose?.length ?? 0) > 0 ||
+		(env.libsql?.length ?? 0) > 0 ||
 		(env.mariadb?.length ?? 0) > 0 ||
 		(env.mongo?.length ?? 0) > 0 ||
 		(env.mysql?.length ?? 0) > 0 ||
@@ -156,7 +281,7 @@ export const updateEnvironmentById = async (
 };

 export const duplicateEnvironment = async (
-	input: typeof apiDuplicateEnvironment._type,
+	input: z.infer<typeof apiDuplicateEnvironment>,
 ) => {
 	// Find the original environment
 	const originalEnvironment = await findEnvironmentById(input.environmentId);
@@ -168,6 +293,7 @@ export const duplicateEnvironment = async (
 			name: input.name,
 			description: input.description || originalEnvironment.description,
 			projectId: originalEnvironment.projectId,
+			env: originalEnvironment.env,
 		})
 		.returning()
 		.then((value) => value[0]);
--- a/packages/server/src/services/git-provider.ts
+++ b/packages/server/src/services/git-provider.ts
@@ -1,7 +1,8 @@
 import { db } from "@dokploy/server/db";
-import { gitProvider } from "@dokploy/server/db/schema";
+import { gitProvider, member } from "@dokploy/server/db/schema";
+import { hasValidLicense } from "@dokploy/server/services/proprietary/license-key";
 import { TRPCError } from "@trpc/server";
-import { eq } from "drizzle-orm";
+import { and, eq } from "drizzle-orm";

 export type GitProvider = typeof gitProvider.$inferSelect;

@@ -41,3 +42,48 @@ export const updateGitProvider = async (
 		.returning()
 		.then((response) => response[0]);
 };
+
+export const getAccessibleGitProviderIds = async (session: {
+	userId: string;
+	activeOrganizationId: string;
+}): Promise<Set<string>> => {
+	const { userId, activeOrganizationId } = session;
+
+	const allOrgProviders = await db.query.gitProvider.findMany({
+		where: eq(gitProvider.organizationId, activeOrganizationId),
+		columns: {
+			gitProviderId: true,
+			userId: true,
+			sharedWithOrganization: true,
+		},
+	});
+
+	const memberRecord = await db.query.member.findFirst({
+		where: and(
+			eq(member.userId, userId),
+			eq(member.organizationId, activeOrganizationId),
+		),
+		columns: { accessedGitProviders: true, role: true },
+	});
+
+	if (memberRecord?.role === "owner" || memberRecord?.role === "admin") {
+		return new Set(allOrgProviders.map((p) => p.gitProviderId));
+	}
+
+	const licensed = await hasValidLicense(activeOrganizationId);
+	const assignedSet = licensed
+		? new Set(memberRecord?.accessedGitProviders ?? [])
+		: new Set<string>();
+
+	const result = new Set<string>();
+	for (const p of allOrgProviders) {
+		if (
+			p.userId === userId ||
+			p.sharedWithOrganization ||
+			assignedSet.has(p.gitProviderId)
+		) {
+			result.add(p.gitProviderId);
+		}
+	}
+	return result;
+};
--- a/packages/server/src/services/gitea.ts
+++ b/packages/server/src/services/gitea.ts
@@ -6,11 +6,12 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";

 export type Gitea = typeof gitea.$inferSelect;

 export const createGitea = async (
-	input: typeof apiCreateGitea._type,
+	input: z.infer<typeof apiCreateGitea>,
 	organizationId: string,
 	userId: string,
 ) => {
--- a/packages/server/src/services/github.ts
+++ b/packages/server/src/services/github.ts
@@ -6,12 +6,13 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 import { authGithub } from "../utils/providers/github";
 import { updatePreviewDeployment } from "./preview-deployment";

 export type Github = typeof github.$inferSelect;
 export const createGithub = async (
-	input: typeof apiCreateGithub._type,
+	input: z.infer<typeof apiCreateGithub>,
 	organizationId: string,
 	userId: string,
 ) => {
--- a/packages/server/src/services/gitlab.ts
+++ b/packages/server/src/services/gitlab.ts
@@ -6,11 +6,12 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";

 export type Gitlab = typeof gitlab.$inferSelect;

 export const createGitlab = async (
-	input: typeof apiCreateGitlab._type,
+	input: z.infer<typeof apiCreateGitlab>,
 	organizationId: string,
 	userId: string,
 ) => {
--- a/packages/server/src/services/libsql.ts
+++ b/packages/server/src/services/libsql.ts
@@ -0,0 +1,162 @@
+import { db } from "@dokploy/server/db";
+import {
+	type apiCreateLibsql,
+	backups,
+	buildAppName,
+	libsql,
+} from "@dokploy/server/db/schema";
+import { generatePassword } from "@dokploy/server/templates";
+import { buildLibsql } from "@dokploy/server/utils/databases/libsql";
+import { pullImage } from "@dokploy/server/utils/docker/utils";
+import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
+import { TRPCError } from "@trpc/server";
+import { eq, getTableColumns } from "drizzle-orm";
+import type { z } from "zod";
+import { validUniqueServerAppName } from "./project";
+
+export type Libsql = typeof libsql.$inferSelect;
+
+export const createLibsql = async (input: z.infer<typeof apiCreateLibsql>) => {
+	const appName = buildAppName("libsql", input.appName);
+
+	const valid = await validUniqueServerAppName(input.appName);
+	if (!valid) {
+		throw new TRPCError({
+			code: "CONFLICT",
+			message: "Service with this 'AppName' already exists",
+		});
+	}
+
+	const newLibsql = await db
+		.insert(libsql)
+		.values({
+			...input,
+			databasePassword: input.databasePassword
+				? input.databasePassword
+				: generatePassword(),
+			appName,
+		})
+		.returning()
+		.then((value) => value[0]);
+
+	if (!newLibsql) {
+		throw new TRPCError({
+			code: "BAD_REQUEST",
+			message: "Error input: Inserting libsql database",
+		});
+	}
+
+	return newLibsql;
+};
+
+// https://github.com/drizzle-team/drizzle-orm/discussions/1483#discussioncomment-7523881
+export const findLibsqlById = async (libsqlId: string) => {
+	const result = await db.query.libsql.findFirst({
+		where: eq(libsql.libsqlId, libsqlId),
+		with: {
+			environment: {
+				with: {
+					project: true,
+				},
+			},
+			mounts: true,
+			server: true,
+			backups: {
+				with: {
+					destination: true,
+					deployments: true,
+				},
+			},
+		},
+	});
+	if (!result) {
+		throw new TRPCError({
+			code: "NOT_FOUND",
+			message: "Libsql not found",
+		});
+	}
+	return result;
+};
+
+export const updateLibsqlById = async (
+	libsqlId: string,
+	libsqlData: Partial<Libsql>,
+) => {
+	const { appName, ...rest } = libsqlData;
+	const result = await db
+		.update(libsql)
+		.set({
+			...rest,
+		})
+		.where(eq(libsql.libsqlId, libsqlId))
+		.returning();
+
+	return result[0];
+};
+
+export const removeLibsqlById = async (libsqlId: string) => {
+	const result = await db
+		.delete(libsql)
+		.where(eq(libsql.libsqlId, libsqlId))
+		.returning();
+
+	return result[0];
+};
+
+export const findLibsqlByBackupId = async (backupId: string) => {
+	const result = await db
+		.select({
+			...getTableColumns(libsql),
+		})
+		.from(libsql)
+		.innerJoin(backups, eq(libsql.libsqlId, backups.libsqlId))
+		.where(eq(backups.backupId, backupId))
+		.limit(1);
+
+	if (!result || !result[0]) {
+		throw new TRPCError({
+			code: "NOT_FOUND",
+			message: "Libsql not found",
+		});
+	}
+	return result[0];
+};
+
+export const deployLibsql = async (
+	libsqlId: string,
+	onData?: (data: any) => void,
+) => {
+	const libsql = await findLibsqlById(libsqlId);
+	try {
+		await updateLibsqlById(libsqlId, {
+			applicationStatus: "running",
+		});
+		onData?.("Starting libsql deployment...");
+		if (libsql.serverId) {
+			await execAsyncRemote(
+				libsql.serverId,
+				`docker pull ${libsql.dockerImage}`,
+				onData,
+			);
+		} else {
+			await pullImage(libsql.dockerImage, onData);
+		}
+
+		await buildLibsql(libsql);
+		await updateLibsqlById(libsqlId, {
+			applicationStatus: "done",
+		});
+		onData?.("Deployment completed successfully!");
+	} catch (error) {
+		onData?.(`Error: ${error}`);
+		await updateLibsqlById(libsqlId, {
+			applicationStatus: "error",
+		});
+
+		throw new TRPCError({
+			code: "INTERNAL_SERVER_ERROR",
+			message: `Error on deploy libsql${error}`,
+		});
+	}
+	return libsql;
+};
--- a/packages/server/src/services/mariadb.ts
+++ b/packages/server/src/services/mariadb.ts
@@ -11,11 +11,14 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
+import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";

 export type Mariadb = typeof mariadb.$inferSelect;

-export const createMariadb = async (input: typeof apiCreateMariaDB._type) => {
+export const createMariadb = async (
+	input: z.infer<typeof apiCreateMariaDB>,
+) => {
 	const appName = buildAppName("mariadb", input.appName);

 	const valid = await validUniqueServerAppName(appName);
--- a/packages/server/src/services/mongo.ts
+++ b/packages/server/src/services/mongo.ts
@@ -12,11 +12,12 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
+import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";

 export type Mongo = typeof mongo.$inferSelect;

-export const createMongo = async (input: typeof apiCreateMongo._type) => {
+export const createMongo = async (input: z.infer<typeof apiCreateMongo>) => {
 	const appName = buildAppName("mongo", input.appName);

 	const valid = await validUniqueServerAppName(appName);
--- a/packages/server/src/services/mount.ts
+++ b/packages/server/src/services/mount.ts
@@ -18,10 +18,11 @@ import {
 } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, type SQL, sql } from "drizzle-orm";
+import type { z } from "zod";

 export type Mount = typeof mounts.$inferSelect;

-export const createMount = async (input: typeof apiCreateMount._type) => {
+export const createMount = async (input: z.infer<typeof apiCreateMount>) => {
 	try {
 		const { serviceId, ...rest } = input;
 		const value = await db
@@ -31,8 +32,11 @@ export const createMount = async (input: typeof apiCreateMount._type) => {
 				...(input.serviceType === "application" && {
 					applicationId: serviceId,
 				}),
-				...(input.serviceType === "postgres" && {
-					postgresId: serviceId,
+				...(input.serviceType === "compose" && {
+					composeId: serviceId,
+				}),
+				...(input.serviceType === "libsql" && {
+					libsqlId: serviceId,
 				}),
 				...(input.serviceType === "mariadb" && {
 					mariadbId: serviceId,
@@ -43,12 +47,12 @@ export const createMount = async (input: typeof apiCreateMount._type) => {
 				...(input.serviceType === "mysql" && {
 					mysqlId: serviceId,
 				}),
+				...(input.serviceType === "postgres" && {
+					postgresId: serviceId,
+				}),
 				...(input.serviceType === "redis" && {
 					redisId: serviceId,
 				}),
-				...(input.serviceType === "compose" && {
-					composeId: serviceId,
-				}),
 			})
 			.returning()
 			.then((value) => value[0]);
@@ -114,7 +118,16 @@ export const findMountById = async (mountId: string) => {
 					},
 				},
 			},
-			postgres: {
+			compose: {
+				with: {
+					environment: {
+						with: {
+							project: true,
+						},
+					},
+				},
+			},
+			libsql: {
 				with: {
 					environment: {
 						with: {
@@ -150,7 +163,7 @@ export const findMountById = async (mountId: string) => {
 					},
 				},
 			},
-			redis: {
+			postgres: {
 				with: {
 					environment: {
 						with: {
@@ -159,7 +172,7 @@ export const findMountById = async (mountId: string) => {
 					},
 				},
 			},
-			compose: {
+			redis: {
 				with: {
 					environment: {
 						with: {
@@ -185,8 +198,11 @@ export const findMountOrganizationId = async (mountId: string) => {
 	if (mount.application) {
 		return mount.application.environment.project.organizationId;
 	}
-	if (mount.postgres) {
-		return mount.postgres.environment.project.organizationId;
+	if (mount.compose) {
+		return mount.compose.environment.project.organizationId;
+	}
+	if (mount.libsql) {
+		return mount.libsql.environment.project.organizationId;
 	}
 	if (mount.mariadb) {
 		return mount.mariadb.environment.project.organizationId;
@@ -197,13 +213,13 @@ export const findMountOrganizationId = async (mountId: string) => {
 	if (mount.mysql) {
 		return mount.mysql.environment.project.organizationId;
 	}
+	if (mount.postgres) {
+		return mount.postgres.environment.project.organizationId;
+	}
 	if (mount.redis) {
 		return mount.redis.environment.project.organizationId;
 	}

-	if (mount.compose) {
-		return mount.compose.environment.project.organizationId;
-	}
 	return null;
 };

@@ -247,8 +263,8 @@ export const findMountsByApplicationId = async (
 		case "application":
 			sqlChunks.push(eq(mounts.applicationId, serviceId));
 			break;
-		case "postgres":
-			sqlChunks.push(eq(mounts.postgresId, serviceId));
+		case "libsql":
+			sqlChunks.push(eq(mounts.libsqlId, serviceId));
 			break;
 		case "mariadb":
 			sqlChunks.push(eq(mounts.mariadbId, serviceId));
@@ -259,9 +275,15 @@ export const findMountsByApplicationId = async (
 		case "mysql":
 			sqlChunks.push(eq(mounts.mysqlId, serviceId));
 			break;
+		case "postgres":
+			sqlChunks.push(eq(mounts.postgresId, serviceId));
+			break;
 		case "redis":
 			sqlChunks.push(eq(mounts.redisId, serviceId));
 			break;
+		case "compose":
+			sqlChunks.push(eq(mounts.composeId, serviceId));
+			break;
 		default:
 			throw new Error(`Unknown service type: ${serviceType}`);
 	}
@@ -358,6 +380,10 @@ export const getBaseFilesPath = async (mountId: string) => {
 		const { COMPOSE_PATH } = paths(!!mount.compose.serverId);
 		appName = mount.compose.appName;
 		absoluteBasePath = path.resolve(COMPOSE_PATH);
+	} else if (mount.serviceType === "libsql" && mount.libsql) {
+		const { APPLICATIONS_PATH } = paths(!!mount.libsql.serverId);
+		absoluteBasePath = path.resolve(APPLICATIONS_PATH);
+		appName = mount.libsql.appName;
 	}
 	directoryPath = path.join(absoluteBasePath, appName, "files");

@@ -387,6 +413,9 @@ export const getServerId = async (mount: MountNested) => {
 	if (mount.serviceType === "compose" && mount?.compose?.serverId) {
 		return mount.compose.serverId;
 	}
+	if (mount.serviceType === "libsql" && mount?.libsql?.serverId) {
+		return mount.libsql.serverId;
+	}

 	return null;
 };
--- a/packages/server/src/services/mysql.ts
+++ b/packages/server/src/services/mysql.ts
@@ -11,11 +11,12 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
+import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";

 export type MySql = typeof mysql.$inferSelect;

-export const createMysql = async (input: typeof apiCreateMySql._type) => {
+export const createMysql = async (input: z.infer<typeof apiCreateMySql>) => {
 	const appName = buildAppName("mysql", input.appName);

 	const valid = await validUniqueServerAppName(appName);
--- a/packages/server/src/services/notification.ts
+++ b/packages/server/src/services/notification.ts
@@ -5,6 +5,7 @@ import {
 	type apiCreateEmail,
 	type apiCreateGotify,
 	type apiCreateLark,
+	type apiCreateMattermost,
 	type apiCreateNtfy,
 	type apiCreatePushover,
 	type apiCreateResend,
@@ -16,6 +17,7 @@ import {
 	type apiUpdateEmail,
 	type apiUpdateGotify,
 	type apiUpdateLark,
+	type apiUpdateMattermost,
 	type apiUpdateNtfy,
 	type apiUpdatePushover,
 	type apiUpdateResend,
@@ -27,6 +29,7 @@ import {
 	email,
 	gotify,
 	lark,
+	mattermost,
 	notifications,
 	ntfy,
 	pushover,
@@ -37,11 +40,12 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";

 export type Notification = typeof notifications.$inferSelect;

 export const createSlackNotification = async (
-	input: typeof apiCreateSlack._type,
+	input: z.infer<typeof apiCreateSlack>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -69,6 +73,7 @@ export const createSlackNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -91,7 +96,7 @@ export const createSlackNotification = async (
 };

 export const updateSlackNotification = async (
-	input: typeof apiUpdateSlack._type,
+	input: z.infer<typeof apiUpdateSlack>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -101,6 +106,7 @@ export const updateSlackNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -133,7 +139,7 @@ export const updateSlackNotification = async (
 };

 export const createTelegramNotification = async (
-	input: typeof apiCreateTelegram._type,
+	input: z.infer<typeof apiCreateTelegram>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -162,6 +168,7 @@ export const createTelegramNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -184,7 +191,7 @@ export const createTelegramNotification = async (
 };

 export const updateTelegramNotification = async (
-	input: typeof apiUpdateTelegram._type,
+	input: z.infer<typeof apiUpdateTelegram>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -194,6 +201,7 @@ export const updateTelegramNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -227,7 +235,7 @@ export const updateTelegramNotification = async (
 };

 export const createDiscordNotification = async (
-	input: typeof apiCreateDiscord._type,
+	input: z.infer<typeof apiCreateDiscord>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -255,6 +263,7 @@ export const createDiscordNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -277,7 +286,7 @@ export const createDiscordNotification = async (
 };

 export const updateDiscordNotification = async (
-	input: typeof apiUpdateDiscord._type,
+	input: z.infer<typeof apiUpdateDiscord>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -287,6 +296,7 @@ export const updateDiscordNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -319,7 +329,7 @@ export const updateDiscordNotification = async (
 };

 export const createEmailNotification = async (
-	input: typeof apiCreateEmail._type,
+	input: z.infer<typeof apiCreateEmail>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -351,6 +361,7 @@ export const createEmailNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -373,7 +384,7 @@ export const createEmailNotification = async (
 };

 export const updateEmailNotification = async (
-	input: typeof apiUpdateEmail._type,
+	input: z.infer<typeof apiUpdateEmail>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -383,6 +394,7 @@ export const updateEmailNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -419,7 +431,7 @@ export const updateEmailNotification = async (
 };

 export const createResendNotification = async (
-	input: typeof apiCreateResend._type,
+	input: z.infer<typeof apiCreateResend>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -448,6 +460,7 @@ export const createResendNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -470,7 +483,7 @@ export const createResendNotification = async (
 };

 export const updateResendNotification = async (
-	input: typeof apiUpdateResend._type,
+	input: z.infer<typeof apiUpdateResend>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -480,6 +493,7 @@ export const updateResendNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -513,7 +527,7 @@ export const updateResendNotification = async (
 };

 export const createGotifyNotification = async (
-	input: typeof apiCreateGotify._type,
+	input: z.infer<typeof apiCreateGotify>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -543,6 +557,7 @@ export const createGotifyNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -564,7 +579,7 @@ export const createGotifyNotification = async (
 };

 export const updateGotifyNotification = async (
-	input: typeof apiUpdateGotify._type,
+	input: z.infer<typeof apiUpdateGotify>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -574,6 +589,7 @@ export const updateGotifyNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -605,7 +621,7 @@ export const updateGotifyNotification = async (
 };

 export const createNtfyNotification = async (
-	input: typeof apiCreateNtfy._type,
+	input: z.infer<typeof apiCreateNtfy>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -635,6 +651,7 @@ export const createNtfyNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -656,7 +673,7 @@ export const createNtfyNotification = async (
 };

 export const updateNtfyNotification = async (
-	input: typeof apiUpdateNtfy._type,
+	input: z.infer<typeof apiUpdateNtfy>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -666,6 +683,7 @@ export const updateNtfyNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -697,7 +715,7 @@ export const updateNtfyNotification = async (
 };

 export const createCustomNotification = async (
-	input: typeof apiCreateCustom._type,
+	input: z.infer<typeof apiCreateCustom>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -725,6 +743,8 @@ export const createCustomNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
+				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
 				notificationType: "custom",
@@ -746,7 +766,7 @@ export const createCustomNotification = async (
 };

 export const updateCustomNotification = async (
-	input: typeof apiUpdateCustom._type,
+	input: z.infer<typeof apiUpdateCustom>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -756,6 +776,7 @@ export const updateCustomNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -796,6 +817,7 @@ export const findNotificationById = async (notificationId: string) => {
 			resend: true,
 			gotify: true,
 			ntfy: true,
+			mattermost: true,
 			custom: true,
 			lark: true,
 			pushover: true,
@@ -821,7 +843,7 @@ export const removeNotificationById = async (notificationId: string) => {
 };

 export const createLarkNotification = async (
-	input: typeof apiCreateLark._type,
+	input: z.infer<typeof apiCreateLark>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -848,6 +870,8 @@ export const createLarkNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
+				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
 				notificationType: "lark",
@@ -869,7 +893,7 @@ export const createLarkNotification = async (
 };

 export const updateLarkNotification = async (
-	input: typeof apiUpdateLark._type,
+	input: z.infer<typeof apiUpdateLark>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -879,6 +903,7 @@ export const updateLarkNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -910,7 +935,7 @@ export const updateLarkNotification = async (
 };

 export const createTeamsNotification = async (
-	input: typeof apiCreateTeams._type,
+	input: z.infer<typeof apiCreateTeams>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -937,6 +962,7 @@ export const createTeamsNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -959,7 +985,7 @@ export const createTeamsNotification = async (
 };

 export const updateTeamsNotification = async (
-	input: typeof apiUpdateTeams._type,
+	input: z.infer<typeof apiUpdateTeams>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -969,6 +995,7 @@ export const updateTeamsNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -1014,8 +1041,104 @@ export const updateNotificationById = async (
 	return result[0];
 };

+export const createMattermostNotification = async (
+	input: z.infer<typeof apiCreateMattermost>,
+	organizationId: string,
+) => {
+	await db.transaction(async (tx) => {
+		const newMattermost = await tx
+			.insert(mattermost)
+			.values({
+				webhookUrl: input.webhookUrl,
+				channel: input.channel,
+				username: input.username,
+			})
+			.returning()
+			.then((value) => value[0]);
+
+		if (!newMattermost) {
+			throw new TRPCError({
+				code: "BAD_REQUEST",
+				message: "Error input: Inserting mattermost",
+			});
+		}
+
+		const newDestination = await tx
+			.insert(notifications)
+			.values({
+				mattermostId: newMattermost.mattermostId,
+				name: input.name,
+				appDeploy: input.appDeploy,
+				appBuildError: input.appBuildError,
+				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
+				volumeBackup: input.volumeBackup,
+				dokployRestart: input.dokployRestart,
+				dockerCleanup: input.dockerCleanup,
+				notificationType: "mattermost",
+				organizationId: organizationId,
+				serverThreshold: input.serverThreshold,
+			})
+			.returning()
+			.then((value) => value[0]);
+
+		if (!newDestination) {
+			throw new TRPCError({
+				code: "BAD_REQUEST",
+				message: "Error input: Inserting notification",
+			});
+		}
+
+		return newDestination;
+	});
+};
+
+export const updateMattermostNotification = async (
+	input: z.infer<typeof apiUpdateMattermost>,
+) => {
+	await db.transaction(async (tx) => {
+		const newDestination = await tx
+			.update(notifications)
+			.set({
+				name: input.name,
+				appDeploy: input.appDeploy,
+				appBuildError: input.appBuildError,
+				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
+				volumeBackup: input.volumeBackup,
+				dokployRestart: input.dokployRestart,
+				dockerCleanup: input.dockerCleanup,
+				organizationId: input.organizationId,
+				serverThreshold: input.serverThreshold,
+			})
+			.where(eq(notifications.notificationId, input.notificationId))
+			.returning()
+			.then((value) => value[0]);
+
+		if (!newDestination) {
+			throw new TRPCError({
+				code: "BAD_REQUEST",
+				message: "Error Updating notification",
+			});
+		}
+
+		await tx
+			.update(mattermost)
+			.set({
+				webhookUrl: input.webhookUrl,
+				channel: input.channel,
+				username: input.username,
+			})
+			.where(eq(mattermost.mattermostId, input.mattermostId))
+			.returning()
+			.then((value) => value[0]);
+
+		return newDestination;
+	});
+};
+
 export const createPushoverNotification = async (
-	input: typeof apiCreatePushover._type,
+	input: z.infer<typeof apiCreatePushover>,
 	organizationId: string,
 ) => {
 	await db.transaction(async (tx) => {
@@ -1046,6 +1169,7 @@ export const createPushoverNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
@@ -1068,7 +1192,7 @@ export const createPushoverNotification = async (
 };

 export const updatePushoverNotification = async (
-	input: typeof apiUpdatePushover._type,
+	input: z.infer<typeof apiUpdatePushover>,
 ) => {
 	await db.transaction(async (tx) => {
 		const newDestination = await tx
@@ -1078,6 +1202,7 @@ export const updatePushoverNotification = async (
 				appDeploy: input.appDeploy,
 				appBuildError: input.appBuildError,
 				databaseBackup: input.databaseBackup,
+				dokployBackup: input.dokployBackup,
 				volumeBackup: input.volumeBackup,
 				dokployRestart: input.dokployRestart,
 				dockerCleanup: input.dockerCleanup,
--- a/packages/server/src/services/patch-repo.ts
+++ b/packages/server/src/services/patch-repo.ts
@@ -0,0 +1,197 @@
+import { join } from "node:path";
+import { paths } from "@dokploy/server/constants";
+import { TRPCError } from "@trpc/server";
+import { execAsync, execAsyncRemote } from "../utils/process/execAsync";
+import { cloneBitbucketRepository } from "../utils/providers/bitbucket";
+import { cloneGitRepository } from "../utils/providers/git";
+import { cloneGiteaRepository } from "../utils/providers/gitea";
+import { cloneGithubRepository } from "../utils/providers/github";
+import { cloneGitlabRepository } from "../utils/providers/gitlab";
+import { findApplicationById } from "./application";
+import { findComposeById } from "./compose";
+
+interface PatchRepoConfig {
+	type: "application" | "compose";
+	id: string;
+}
+
+/**
+ * Ensure patch repo exists and is up-to-date
+ * Returns path to the repo
+ */
+export const ensurePatchRepo = async ({
+	type,
+	id,
+}: PatchRepoConfig): Promise<string> => {
+	let serverId: string | null = null;
+
+	if (type === "application") {
+		const application = await findApplicationById(id);
+		serverId = application.buildServerId || application.serverId;
+	} else {
+		const compose = await findComposeById(id);
+		serverId = compose.serverId;
+	}
+
+	const application =
+		type === "application"
+			? await findApplicationById(id)
+			: await findComposeById(id);
+
+	const { PATCH_REPOS_PATH } = paths(!!serverId);
+	const repoPath = join(PATCH_REPOS_PATH, type, application.appName);
+
+	const applicationEntity = {
+		...application,
+		type,
+		serverId: serverId,
+		outputPathOverride: repoPath,
+	};
+
+	let command = "set -e;";
+	if (application.sourceType === "github") {
+		command += await cloneGithubRepository(applicationEntity);
+	} else if (application.sourceType === "gitlab") {
+		command += await cloneGitlabRepository(applicationEntity);
+	} else if (application.sourceType === "gitea") {
+		command += await cloneGiteaRepository(applicationEntity);
+	} else if (application.sourceType === "bitbucket") {
+		command += await cloneBitbucketRepository(applicationEntity);
+	} else if (application.sourceType === "git") {
+		command += await cloneGitRepository(applicationEntity);
+	}
+
+	if (serverId) {
+		await execAsyncRemote(serverId, command);
+	} else {
+		await execAsync(command);
+	}
+
+	return repoPath;
+};
+
+interface DirectoryEntry {
+	name: string;
+	path: string;
+	type: "file" | "directory";
+	children?: DirectoryEntry[];
+}
+
+/**
+ * Read directory tree of the patch repo
+ */
+export const readPatchRepoDirectory = async (
+	repoPath: string,
+	serverId?: string | null,
+): Promise<DirectoryEntry[]> => {
+	// Use git ls-tree to get tracked files only
+	const command = `cd "${repoPath}" && git ls-tree -r --name-only HEAD`;
+
+	let stdout: string;
+	try {
+		if (serverId) {
+			const result = await execAsyncRemote(serverId, command);
+			stdout = result.stdout;
+		} else {
+			const result = await execAsync(command);
+			stdout = result.stdout;
+		}
+	} catch (error) {
+		throw new TRPCError({
+			code: "INTERNAL_SERVER_ERROR",
+			message: `Failed to read repository: ${error}`,
+		});
+	}
+
+	const files = stdout.trim().split("\n").filter(Boolean);
+
+	// Build tree structure
+	const root: DirectoryEntry[] = [];
+	const dirMap = new Map<string, DirectoryEntry>();
+
+	for (const filePath of files) {
+		const parts = filePath.split("/");
+		let currentPath = "";
+
+		for (let i = 0; i < parts.length; i++) {
+			const part = parts[i];
+			if (!part) continue;
+
+			const isFile = i === parts.length - 1;
+			const parentPath = currentPath;
+			currentPath = currentPath ? `${currentPath}/${part}` : part;
+
+			if (!dirMap.has(currentPath)) {
+				const entry: DirectoryEntry = {
+					name: part,
+					path: currentPath,
+					type: isFile ? "file" : "directory",
+					children: isFile ? undefined : [],
+				};
+
+				dirMap.set(currentPath, entry);
+
+				if (parentPath) {
+					const parent = dirMap.get(parentPath);
+					parent?.children?.push(entry);
+				} else {
+					root.push(entry);
+				}
+			}
+		}
+	}
+
+	return root;
+};
+
+export const readPatchRepoFile = async (
+	id: string,
+	type: "application" | "compose",
+	filePath: string,
+) => {
+	let serverId: string | null = null;
+
+	if (type === "application") {
+		const application = await findApplicationById(id);
+		serverId = application.buildServerId || application.serverId;
+	} else {
+		const compose = await findComposeById(id);
+		serverId = compose.serverId;
+	}
+	const { PATCH_REPOS_PATH } = paths(!!serverId);
+
+	const application =
+		type === "application"
+			? await findApplicationById(id)
+			: await findComposeById(id);
+
+	const repoPath = join(PATCH_REPOS_PATH, type, application.appName);
+	const fullPath = join(repoPath, filePath);
+
+	const command = `cat "${fullPath}"`;
+
+	if (serverId) {
+		const result = await execAsyncRemote(serverId, command);
+		return result.stdout;
+	}
+
+	const result = await execAsync(command);
+	return result.stdout;
+};
+
+/**
+ * Clean all patch repos
+ */
+export const cleanPatchRepos = async (
+	serverId?: string | null,
+): Promise<void> => {
+	const { PATCH_REPOS_PATH } = paths(!!serverId);
+
+	const command = `rm -rf "${PATCH_REPOS_PATH}"/* 2>/dev/null || true`;
+
+	if (serverId) {
+		await execAsyncRemote(serverId, command);
+	} else {
+		await execAsync(command);
+	}
+};
--- a/packages/server/src/services/patch.ts
+++ b/packages/server/src/services/patch.ts
@@ -0,0 +1,176 @@
+import { join } from "node:path";
+import { paths } from "@dokploy/server/constants";
+import { db } from "@dokploy/server/db";
+import { type apiCreatePatch, patch } from "@dokploy/server/db/schema";
+import { TRPCError } from "@trpc/server";
+import { and, eq } from "drizzle-orm";
+import type { z } from "zod";
+import { encodeBase64 } from "../utils/docker/utils";
+import { findApplicationById } from "./application";
+import { findComposeById } from "./compose";
+
+export type Patch = typeof patch.$inferSelect;
+
+export const createPatch = async (input: z.infer<typeof apiCreatePatch>) => {
+	if (!input.applicationId && !input.composeId) {
+		throw new TRPCError({
+			code: "BAD_REQUEST",
+			message: "Either applicationId or composeId must be provided",
+		});
+	}
+
+	const newPatch = await db
+		.insert(patch)
+		.values({
+			...input,
+			content: input.content,
+			enabled: true,
+		})
+		.returning()
+		.then((value) => value[0]);
+
+	if (!newPatch) {
+		throw new TRPCError({
+			code: "BAD_REQUEST",
+			message: "Error creating the patch",
+		});
+	}
+
+	return newPatch;
+};
+
+export const findPatchById = async (patchId: string) => {
+	const result = await db.query.patch.findFirst({
+		where: eq(patch.patchId, patchId),
+	});
+
+	if (!result) {
+		throw new TRPCError({
+			code: "NOT_FOUND",
+			message: "Patch not found",
+		});
+	}
+
+	return result;
+};
+
+export const findPatchesByEntityId = async (
+	id: string,
+	type: "application" | "compose",
+) => {
+	return await db.query.patch.findMany({
+		where: eq(
+			type === "application" ? patch.applicationId : patch.composeId,
+			id,
+		),
+		orderBy: (patch, { asc }) => [asc(patch.filePath)],
+	});
+};
+
+export const findPatchByFilePath = async (
+	filePath: string,
+	id: string,
+	type: "application" | "compose",
+) => {
+	return await db.query.patch.findFirst({
+		where: and(
+			eq(patch.filePath, filePath),
+			eq(type === "application" ? patch.applicationId : patch.composeId, id),
+		),
+	});
+};
+
+export const updatePatch = async (patchId: string, data: Partial<Patch>) => {
+	const result = await db
+		.update(patch)
+		.set({
+			...data,
+			...(data.content && {
+				content: data.content.endsWith("\n")
+					? data.content
+					: `${data.content}\n`,
+			}),
+			updatedAt: new Date().toISOString(),
+		})
+		.where(eq(patch.patchId, patchId))
+		.returning();
+
+	return result[0];
+};
+
+export const deletePatch = async (patchId: string) => {
+	const result = await db
+		.delete(patch)
+		.where(eq(patch.patchId, patchId))
+		.returning();
+
+	return result[0];
+};
+
+export const markPatchForDeletion = async (
+	filePath: string,
+	entityId: string,
+	entityType: "application" | "compose",
+) => {
+	const existing = await findPatchByFilePath(filePath, entityId, entityType);
+
+	if (existing) {
+		return await updatePatch(existing.patchId, { type: "delete", content: "" });
+	}
+
+	return await createPatch({
+		filePath,
+		content: "",
+		type: "delete",
+		applicationId: entityType === "application" ? entityId : undefined,
+		composeId: entityType === "compose" ? entityId : undefined,
+	});
+};
+
+interface ApplyPatchesOptions {
+	id: string;
+	type: "application" | "compose";
+	serverId: string | null;
+}
+
+export const generateApplyPatchesCommand = async ({
+	id,
+	type,
+	serverId,
+}: ApplyPatchesOptions) => {
+	const entity =
+		type === "application"
+			? await findApplicationById(id)
+			: await findComposeById(id);
+	const { COMPOSE_PATH, APPLICATIONS_PATH } = paths(!!serverId);
+	const basePath = type === "compose" ? COMPOSE_PATH : APPLICATIONS_PATH;
+	const codePath = join(basePath, entity.appName, "code");
+
+	const resultPatches = await findPatchesByEntityId(id, type);
+	const patches = resultPatches.filter((p) => p.enabled);
+
+	if (patches.length === 0) {
+		return "";
+	}
+
+	let command = `echo "Applying ${patches.length} patch(es)...";`;
+
+	for (const p of patches) {
+		const filePath = join(codePath, p.filePath);
+
+		if (p.type === "delete") {
+			command += `
+			rm -f "${filePath}";
+			`;
+		} else {
+			command += `
+file="${filePath}"
+dir="$(dirname "$file")"
+mkdir -p "$dir"
+echo "${encodeBase64(p.content)}" | base64 -d > "$file"
+`;
+		}
+	}
+
+	return command;
+};
--- a/packages/server/src/services/permission.ts
+++ b/packages/server/src/services/permission.ts
@@ -0,0 +1,431 @@
+import { db } from "@dokploy/server/db";
+import { member, organizationRole } from "@dokploy/server/db/schema";
+import { hasValidLicense } from "@dokploy/server/services/proprietary/license-key";
+import { TRPCError } from "@trpc/server";
+import { and, eq } from "drizzle-orm";
+import {
+	ac,
+	adminRole,
+	enterpriseOnlyResources,
+	memberRole,
+	ownerRole,
+	statements,
+} from "../lib/access-control";
+
+type Statements = typeof statements;
+type Resource = keyof Statements;
+type Action<R extends Resource> = Statements[R][number];
+type Permissions = {
+	[R in Resource]?: Action<R>[];
+};
+
+export type PermissionCtx = {
+	user: { id: string };
+	session: { activeOrganizationId: string };
+};
+
+export type ResolvedPermissions = {
+	[R in Resource]: {
+		[A in Statements[R][number]]: boolean;
+	};
+};
+
+const staticRoles: Record<string, ReturnType<typeof ac.newRole>> = {
+	owner: ownerRole,
+	admin: adminRole,
+	member: memberRole,
+};
+
+const resolveRole = async (
+	roleName: string,
+	organizationId: string,
+): Promise<ReturnType<typeof ac.newRole> | null> => {
+	if (staticRoles[roleName]) {
+		return staticRoles[roleName];
+	}
+
+	const licensed = await hasValidLicense(organizationId);
+	if (!licensed) {
+		return null;
+	}
+
+	const customRoles = await db.query.organizationRole.findMany({
+		where: and(
+			eq(organizationRole.organizationId, organizationId),
+			eq(organizationRole.role, roleName),
+		),
+	});
+
+	if (customRoles.length === 0) {
+		return null;
+	}
+
+	const merged: Record<string, string[]> = {};
+	for (const entry of customRoles) {
+		const parsed = JSON.parse(entry.permission) as Record<string, string[]>;
+		for (const [resource, actions] of Object.entries(parsed)) {
+			merged[resource] = [
+				...new Set([...(merged[resource] ?? []), ...actions]),
+			];
+		}
+	}
+
+	return ac.newRole(merged as any);
+};
+
+export const checkPermission = async (
+	ctx: PermissionCtx,
+	permissions: Permissions,
+) => {
+	const { id: userId } = ctx.user;
+	const { activeOrganizationId: organizationId } = ctx.session;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+	const isStaticRole = memberRecord.role in staticRoles;
+
+	if (isStaticRole) {
+		const allEnterprise = Object.keys(permissions).every((r) =>
+			enterpriseOnlyResources.has(r),
+		);
+		if (allEnterprise) return;
+	}
+
+	const role = await resolveRole(memberRecord.role, organizationId);
+
+	if (!role) {
+		throw new TRPCError({
+			code: "UNAUTHORIZED",
+			message: "Invalid role",
+		});
+	}
+
+	const result = role.authorize(permissions);
+	if (result.success) {
+		return;
+	}
+
+	if (memberRecord.role === "member") {
+		const overrides = getLegacyOverrides(memberRecord);
+		const allGranted = Object.entries(permissions).every(
+			([resource, actions]) =>
+				(actions as string[]).every(
+					(action) =>
+						!!(overrides[resource] as Record<string, boolean> | undefined)?.[
+							action
+						],
+				),
+		);
+		if (allGranted) {
+			return;
+		}
+	}
+
+	throw new TRPCError({
+		code: "UNAUTHORIZED",
+		message: result.error || "Permission denied",
+	});
+};
+
+export const hasPermission = async (
+	ctx: PermissionCtx,
+	permissions: Permissions,
+): Promise<boolean> => {
+	try {
+		await checkPermission(ctx, permissions);
+		return true;
+	} catch {
+		return false;
+	}
+};
+
+const getLegacyOverrides = (
+	memberRecord: Awaited<ReturnType<typeof findMemberByUserId>>,
+): Partial<Record<string, Record<string, boolean>>> => {
+	return {
+		project: {
+			create: !!memberRecord.canCreateProjects,
+			delete: !!memberRecord.canDeleteProjects,
+		},
+		service: {
+			create: !!memberRecord.canCreateServices,
+			delete: !!memberRecord.canDeleteServices,
+		},
+		environment: {
+			create: !!memberRecord.canCreateEnvironments,
+			delete: !!memberRecord.canDeleteEnvironments,
+		},
+		traefikFiles: {
+			read: !!memberRecord.canAccessToTraefikFiles,
+		},
+		docker: {
+			read: !!memberRecord.canAccessToDocker,
+		},
+		api: {
+			read: !!memberRecord.canAccessToAPI,
+		},
+		sshKeys: {
+			read: !!memberRecord.canAccessToSSHKeys,
+		},
+		gitProviders: {
+			read: !!memberRecord.canAccessToGitProviders,
+		},
+	};
+};
+
+export const resolvePermissions = async (
+	ctx: PermissionCtx,
+): Promise<ResolvedPermissions> => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+	const role = await resolveRole(memberRecord.role, organizationId);
+
+	const legacyOverrides =
+		memberRecord.role === "member" ? getLegacyOverrides(memberRecord) : {};
+
+	const isPrivilegedRole =
+		memberRecord.role === "owner" || memberRecord.role === "admin";
+	const result = {} as ResolvedPermissions;
+
+	for (const [resource, actions] of Object.entries(statements)) {
+		const resourcePerms = {} as Record<string, boolean>;
+		for (const action of actions) {
+			if (isPrivilegedRole && enterpriseOnlyResources.has(resource)) {
+				resourcePerms[action] = true;
+				continue;
+			}
+			if (!role) {
+				resourcePerms[action] = false;
+				continue;
+			}
+			const check = role.authorize({ [resource]: [action] });
+			resourcePerms[action] =
+				check.success ||
+				!!(legacyOverrides[resource] as Record<string, boolean> | undefined)?.[
+					action
+				];
+		}
+		(result as any)[resource] = resourcePerms;
+	}
+
+	return result;
+};
+
+export const checkProjectAccess = async (
+	ctx: PermissionCtx,
+	action: "create" | "delete",
+	projectId?: string,
+) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+
+	await checkPermission(ctx, { project: [action] });
+
+	if (
+		action !== "create" &&
+		projectId &&
+		memberRecord.role !== "owner" &&
+		memberRecord.role !== "admin"
+	) {
+		if (!memberRecord.accessedProjects.includes(projectId)) {
+			throw new TRPCError({
+				code: "UNAUTHORIZED",
+				message: "You don't have access to this project",
+			});
+		}
+	}
+};
+
+export const checkServicePermissionAndAccess = async (
+	ctx: PermissionCtx,
+	serviceId: string,
+	permissions: Permissions,
+) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+	await checkPermission(ctx, permissions);
+	if (memberRecord.role !== "owner" && memberRecord.role !== "admin") {
+		if (!memberRecord.accessedServices.includes(serviceId)) {
+			throw new TRPCError({
+				code: "UNAUTHORIZED",
+				message: "You don't have access to this service",
+			});
+		}
+	}
+};
+
+export const checkServiceAccess = async (
+	ctx: PermissionCtx,
+	serviceId: string,
+	action: "create" | "read" | "delete" = "read",
+) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+
+	await checkPermission(ctx, { service: [action] });
+
+	if (memberRecord.role !== "owner" && memberRecord.role !== "admin") {
+		if (action === "create") {
+			if (!memberRecord.accessedProjects.includes(serviceId)) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "You don't have access to this project",
+				});
+			}
+		} else {
+			if (!memberRecord.accessedServices.includes(serviceId)) {
+				throw new TRPCError({
+					code: "UNAUTHORIZED",
+					message: "You don't have access to this service",
+				});
+			}
+		}
+	}
+};
+
+export const checkEnvironmentAccess = async (
+	ctx: PermissionCtx,
+	environmentId: string,
+	action: "read" | "create" | "delete" = "read",
+) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+
+	await checkPermission(ctx, { environment: [action] });
+
+	if (
+		action !== "create" &&
+		memberRecord.role !== "owner" &&
+		memberRecord.role !== "admin"
+	) {
+		if (!memberRecord.accessedEnvironments.includes(environmentId)) {
+			throw new TRPCError({
+				code: "UNAUTHORIZED",
+				message: "You don't have access to this environment",
+			});
+		}
+	}
+};
+
+export const checkEnvironmentCreationPermission = async (
+	ctx: PermissionCtx,
+	projectId: string,
+) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+
+	await checkPermission(ctx, { environment: ["create"] });
+
+	if (memberRecord.role !== "owner" && memberRecord.role !== "admin") {
+		if (!memberRecord.accessedProjects.includes(projectId)) {
+			throw new TRPCError({
+				code: "UNAUTHORIZED",
+				message: "You don't have access to this project",
+			});
+		}
+	}
+};
+
+export const checkEnvironmentDeletionPermission = async (
+	ctx: PermissionCtx,
+	projectId: string,
+) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+
+	await checkPermission(ctx, { environment: ["delete"] });
+
+	if (memberRecord.role !== "owner" && memberRecord.role !== "admin") {
+		if (!memberRecord.accessedProjects.includes(projectId)) {
+			throw new TRPCError({
+				code: "UNAUTHORIZED",
+				message: "You don't have access to this project",
+			});
+		}
+	}
+};
+
+export const addNewProject = async (ctx: PermissionCtx, projectId: string) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+	await db
+		.update(member)
+		.set({
+			accessedProjects: [...memberRecord.accessedProjects, projectId],
+		})
+		.where(
+			and(
+				eq(member.id, memberRecord.id),
+				eq(member.organizationId, organizationId),
+			),
+		);
+};
+
+export const addNewEnvironment = async (
+	ctx: PermissionCtx,
+	environmentId: string,
+) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+	await db
+		.update(member)
+		.set({
+			accessedEnvironments: [
+				...memberRecord.accessedEnvironments,
+				environmentId,
+			],
+		})
+		.where(
+			and(
+				eq(member.id, memberRecord.id),
+				eq(member.organizationId, organizationId),
+			),
+		);
+};
+
+export const addNewService = async (ctx: PermissionCtx, serviceId: string) => {
+	const userId = ctx.user.id;
+	const organizationId = ctx.session.activeOrganizationId;
+	const memberRecord = await findMemberByUserId(userId, organizationId);
+	await db
+		.update(member)
+		.set({
+			accessedServices: [...memberRecord.accessedServices, serviceId],
+		})
+		.where(
+			and(
+				eq(member.id, memberRecord.id),
+				eq(member.organizationId, organizationId),
+			),
+		);
+};
+
+export const findMemberByUserId = async (
+	userId: string,
+	organizationId: string,
+) => {
+	const result = await db.query.member.findFirst({
+		where: and(
+			eq(member.userId, userId),
+			eq(member.organizationId, organizationId),
+		),
+		with: {
+			user: true,
+		},
+	});
+
+	if (!result) {
+		throw new TRPCError({
+			code: "UNAUTHORIZED",
+			message: "Permission denied",
+		});
+	}
+	return result;
+};
--- a/packages/server/src/services/port.ts
+++ b/packages/server/src/services/port.ts
@@ -2,10 +2,11 @@ import { db } from "@dokploy/server/db";
 import { type apiCreatePort, ports } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";

 export type Port = typeof ports.$inferSelect;

-export const createPort = async (input: typeof apiCreatePort._type) => {
+export const createPort = async (input: z.infer<typeof apiCreatePort>) => {
 	const newPort = await db
 		.insert(ports)
 		.values({
--- a/packages/server/src/services/postgres.ts
+++ b/packages/server/src/services/postgres.ts
@@ -11,6 +11,7 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
+import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";

 export function getMountPath(dockerImage: string): string {
@@ -28,7 +29,9 @@ export function getMountPath(dockerImage: string): string {

 export type Postgres = typeof postgres.$inferSelect;

-export const createPostgres = async (input: typeof apiCreatePostgres._type) => {
+export const createPostgres = async (
+	input: z.infer<typeof apiCreatePostgres>,
+) => {
 	const appName = buildAppName("postgres", input.appName);

 	const valid = await validUniqueServerAppName(appName);
--- a/packages/server/src/services/preview-deployment.ts
+++ b/packages/server/src/services/preview-deployment.ts
@@ -7,6 +7,7 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { and, desc, eq } from "drizzle-orm";
+import type { z } from "zod";
 import { generatePassword } from "../templates";
 import { removeService } from "../utils/docker/utils";
 import { removeDirectoryCode } from "../utils/filesystem/directory";
@@ -130,7 +131,7 @@ export const findPreviewDeploymentsByApplicationId = async (
 };

 export const createPreviewDeployment = async (
-	schema: typeof apiCreatePreviewDeployment._type,
+	schema: z.infer<typeof apiCreatePreviewDeployment>,
 ) => {
 	const application = await findApplicationById(schema.applicationId);
 	const appName = `preview-${application.appName}-${generatePassword(6)}`;
@@ -235,7 +236,7 @@ const generateWildcardDomain = async (
 	baseDomain: string,
 	appName: string,
 	serverIp: string,
-	userId: string,
+	_userId: string,
 ): Promise<string> => {
 	if (!baseDomain.startsWith("*.")) {
 		throw new Error('The base domain must start with "*."');
--- a/packages/server/src/services/project.ts
+++ b/packages/server/src/services/project.ts
@@ -2,6 +2,7 @@ import { db } from "@dokploy/server/db";
 import {
 	type apiCreateProject,
 	applications,
+	libsql,
 	mariadb,
 	mongo,
 	mysql,
@@ -11,12 +12,13 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 import { createProductionEnvironment } from "./environment";

 export type Project = typeof projects.$inferSelect;

 export const createProject = async (
-	input: typeof apiCreateProject._type,
+	input: z.infer<typeof apiCreateProject>,
 	organizationId: string,
 ) => {
 	const newProject = await db
@@ -52,12 +54,18 @@ export const findProjectById = async (projectId: string) => {
 			environments: {
 				with: {
 					applications: true,
+					compose: true,
+					libsql: true,
 					mariadb: true,
 					mongo: true,
 					mysql: true,
 					postgres: true,
 					redis: true,
-					compose: true,
+				},
+			},
+			projectTags: {
+				with: {
+					tag: true,
 				},
 			},
 		},
@@ -103,6 +111,9 @@ export const validUniqueServerAppName = async (appName: string) => {
 			applications: {
 				where: eq(applications.appName, appName),
 			},
+			libsql: {
+				where: eq(libsql.appName, appName),
+			},
 			mariadb: {
 				where: eq(mariadb.appName, appName),
 			},
@@ -125,6 +136,7 @@ export const validUniqueServerAppName = async (appName: string) => {
 	const nonEmptyProjects = query.filter(
 		(project) =>
 			project.applications.length > 0 ||
+			project.libsql.length > 0 ||
 			project.mariadb.length > 0 ||
 			project.mongo.length > 0 ||
 			project.mysql.length > 0 ||
--- a/packages/server/src/services/proprietary/audit-log.ts
+++ b/packages/server/src/services/proprietary/audit-log.ts
@@ -0,0 +1,95 @@
+import { db } from "@dokploy/server/db";
+import type { AuditAction, AuditResourceType } from "@dokploy/server/db/schema";
+import { auditLog } from "@dokploy/server/db/schema";
+import { hasValidLicense } from "@dokploy/server/services/proprietary/license-key";
+import { and, desc, eq, gte, ilike, lte } from "drizzle-orm";
+
+export type { AuditAction, AuditResourceType };
+
+export interface CreateAuditLogInput {
+	organizationId: string;
+	userId: string;
+	userEmail: string;
+	userRole: string;
+	action: AuditAction;
+	resourceType: AuditResourceType;
+	resourceId?: string;
+	resourceName?: string;
+	metadata?: Record<string, unknown>;
+}
+
+/**
+ * Creates an audit log entry. Fire-and-forget safe — errors are swallowed
+ * so a logging failure never breaks the main operation.
+ */
+export const createAuditLog = async (input: CreateAuditLogInput) => {
+	try {
+		const licensed = await hasValidLicense(input.organizationId);
+		if (!licensed) return;
+
+		await db.insert(auditLog).values({
+			organizationId: input.organizationId,
+			userId: input.userId,
+			userEmail: input.userEmail,
+			userRole: input.userRole,
+			action: input.action,
+			resourceType: input.resourceType,
+			resourceId: input.resourceId,
+			resourceName: input.resourceName,
+			metadata: input.metadata ? JSON.stringify(input.metadata) : undefined,
+		});
+	} catch (err) {
+		console.error("[audit-log] Failed to create audit log entry:", err);
+	}
+};
+
+export interface GetAuditLogsInput {
+	organizationId: string;
+	userId?: string;
+	userEmail?: string;
+	resourceName?: string;
+	action?: AuditAction;
+	resourceType?: AuditResourceType;
+	from?: Date;
+	to?: Date;
+	limit?: number;
+	offset?: number;
+}
+
+export const getAuditLogs = async (input: GetAuditLogsInput) => {
+	const {
+		organizationId,
+		userId,
+		userEmail,
+		resourceName,
+		action,
+		resourceType,
+		from,
+		to,
+		limit = 50,
+		offset = 0,
+	} = input;
+
+	const conditions = [eq(auditLog.organizationId, organizationId)];
+
+	if (userId) conditions.push(eq(auditLog.userId, userId));
+	if (userEmail) conditions.push(ilike(auditLog.userEmail, `%${userEmail}%`));
+	if (resourceName)
+		conditions.push(ilike(auditLog.resourceName, `%${resourceName}%`));
+	if (action) conditions.push(eq(auditLog.action, action));
+	if (resourceType) conditions.push(eq(auditLog.resourceType, resourceType));
+	if (from) conditions.push(gte(auditLog.createdAt, from));
+	if (to) conditions.push(lte(auditLog.createdAt, to));
+
+	const [logs, total] = await Promise.all([
+		db.query.auditLog.findMany({
+			where: and(...conditions),
+			orderBy: [desc(auditLog.createdAt)],
+			limit,
+			offset,
+		}),
+		db.$count(auditLog, and(...conditions)),
+	]);
+
+	return { logs, total };
+};
--- a/packages/server/src/services/redis.ts
+++ b/packages/server/src/services/redis.ts
@@ -10,12 +10,13 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";

 export type Redis = typeof redis.$inferSelect;

 // https://github.com/drizzle-team/drizzle-orm/discussions/1483#discussioncomment-7523881
-export const createRedis = async (input: typeof apiCreateRedis._type) => {
+export const createRedis = async (input: z.infer<typeof apiCreateRedis>) => {
 	const appName = buildAppName("redis", input.appName);

 	const valid = await validUniqueServerAppName(appName);
--- a/packages/server/src/services/registry.ts
+++ b/packages/server/src/services/registry.ts
@@ -6,6 +6,7 @@ import {
 } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";
 import { IS_CLOUD } from "../constants";

 export type Registry = typeof registry.$inferSelect;
@@ -15,7 +16,7 @@ function shEscape(s: string | undefined): string {
 	return `'${s.replace(/'/g, `'\\''`)}'`;
 }

-function safeDockerLoginCommand(
+export function safeDockerLoginCommand(
 	registry: string | undefined,
 	user: string | undefined,
 	pass: string | undefined,
@@ -27,7 +28,7 @@ function safeDockerLoginCommand(
 }

 export const createRegistry = async (
-	input: typeof apiCreateRegistry._type,
+	input: z.infer<typeof apiCreateRegistry>,
 	organizationId: string,
 ) => {
 	return await db.transaction(async (tx) => {
--- a/packages/server/src/services/rollbacks.ts
+++ b/packages/server/src/services/rollbacks.ts
@@ -23,7 +23,7 @@ import { findDeploymentById } from "./deployment";
 import type { Mount } from "./mount";
 import type { Port } from "./port";
 import type { Project } from "./project";
-import type { Registry } from "./registry";
+import { type Registry, safeDockerLoginCommand } from "./registry";

 export const createRollback = async (
 	input: z.infer<typeof createRollbackSchema>,
@@ -111,7 +111,7 @@ const deleteRollbackImage = async (image: string, serverId?: string | null) => {
 	const command = `docker image rm ${image} --force`;

 	if (serverId) {
-		await execAsyncRemote(command, serverId);
+		await execAsyncRemote(serverId, command);
 	} else {
 		await execAsync(command);
 	}
@@ -171,6 +171,23 @@ export const rollback = async (rollbackId: string) => {
 	);
 };

+const dockerLoginForRegistry = async (
+	registry: Registry,
+	serverId?: string | null,
+) => {
+	const loginCommand = safeDockerLoginCommand(
+		registry.registryUrl,
+		registry.username,
+		registry.password,
+	);
+
+	if (serverId) {
+		await execAsyncRemote(serverId, loginCommand);
+	} else {
+		await execAsync(loginCommand);
+	}
+};
+
 const rollbackApplication = async (
 	appName: string,
 	image: string,
@@ -188,6 +205,14 @@ const rollbackApplication = async (
 		throw new Error("Full context is required for rollback");
 	}

+	// Ensure Docker daemon is authenticated with the rollback registry
+	// before updating the swarm service. The authconfig in CreateServiceOptions
+	// alone is not sufficient — Docker Swarm also relies on the daemon's
+	// cached credentials (~/.docker/config.json) to distribute auth to nodes.
+	if (fullContext.rollbackRegistry) {
+		await dockerLoginForRegistry(fullContext.rollbackRegistry, serverId);
+	}
+
 	const docker = await getRemoteDocker(serverId);

 	// Use the same configuration as mechanizeDockerContainer
--- a/packages/server/src/services/schedule.ts
+++ b/packages/server/src/services/schedule.ts
@@ -18,7 +18,10 @@ export const createSchedule = async (
 	input: z.infer<typeof createScheduleSchema>,
 ) => {
 	const { scheduleId, ...rest } = input;
-	const [newSchedule] = await db.insert(schedules).values(rest).returning();
+	const [newSchedule] = await db
+		.insert(schedules)
+		.values(rest as typeof schedules.$inferInsert)
+		.returning();

 	if (
 		newSchedule &&
@@ -120,7 +123,7 @@ export const updateSchedule = async (
 	const { scheduleId, ...rest } = input;
 	const [updatedSchedule] = await db
 		.update(schedules)
-		.set(rest)
+		.set(rest as Partial<typeof schedules.$inferInsert>)
 		.where(eq(schedules.scheduleId, scheduleId))
 		.returning();

--- a/packages/server/src/services/security.ts
+++ b/packages/server/src/services/security.ts
@@ -50,7 +50,8 @@ export const createSecurity = async (
 	} catch (error) {
 		throw new TRPCError({
 			code: "BAD_REQUEST",
-			message: "Error creating this security",
+			message:
+				error instanceof Error ? error.message : "Error creating this security",
 			cause: error,
 		});
 	}
@@ -90,15 +91,35 @@ export const updateSecurityById = async (
 	data: Partial<Security>,
 ) => {
 	try {
-		const response = await db
-			.update(security)
-			.set({
-				...data,
-			})
-			.where(eq(security.securityId, securityId))
-			.returning();
+		await db.transaction(async (tx) => {
+			const securityResponse = await findSecurityById(securityId);

-		return response[0];
+			const application = await findApplicationById(
+				securityResponse.applicationId,
+			);
+
+			await removeSecurityMiddleware(application, securityResponse);
+
+			const response = await tx
+				.update(security)
+				.set({
+					...data,
+				})
+				.where(eq(security.securityId, securityId))
+				.returning()
+				.then((res) => res[0]);
+
+			if (!response) {
+				throw new TRPCError({
+					code: "NOT_FOUND",
+					message: "Security not found",
+				});
+			}
+
+			await createSecurityMiddleware(application, response);
+
+			return response;
+		});
 	} catch (error) {
 		const message =
 			error instanceof Error ? error.message : "Error updating this security";
--- a/packages/server/src/services/server.ts
+++ b/packages/server/src/services/server.ts
@@ -6,11 +6,12 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";

 export type Server = typeof server.$inferSelect;

 export const createServer = async (
-	input: typeof apiCreateServer._type,
+	input: z.infer<typeof apiCreateServer>,
 	organizationId: string,
 ) => {
 	const newServer = await db
@@ -19,7 +20,7 @@ export const createServer = async (
 			...input,
 			organizationId: organizationId,
 			createdAt: new Date().toISOString(),
-		})
+		} as typeof server.$inferInsert)
 		.returning()
 		.then((value) => value[0]);

@@ -79,11 +80,12 @@ export const haveActiveServices = async (serverId: string) => {
 		with: {
 			applications: true,
 			compose: true,
-			redis: true,
+			libsql: true,
 			mariadb: true,
 			mongo: true,
 			mysql: true,
 			postgres: true,
+			redis: true,
 		},
 	});

@@ -94,11 +96,12 @@ export const haveActiveServices = async (serverId: string) => {
 	const total =
 		currentServer?.applications?.length +
 		currentServer?.compose?.length +
-		currentServer?.redis?.length +
+		currentServer?.libsql?.length +
 		currentServer?.mariadb?.length +
 		currentServer?.mongo?.length +
 		currentServer?.mysql?.length +
-		currentServer?.postgres?.length;
+		currentServer?.postgres?.length +
+		currentServer?.redis?.length;

 	if (total === 0) {
 		return false;
--- a/packages/server/src/services/settings.ts
+++ b/packages/server/src/services/settings.ts
@@ -383,12 +383,12 @@ export const readPorts = async (
 	const seenPorts = new Set<string>();
 	for (const key in parsedResult) {
 		if (Object.hasOwn(parsedResult, key)) {
-			const containerPortMapppings = parsedResult[key];
+			const containerPortMappings = parsedResult[key];
 			const protocol = key.split("/")[1];
 			const targetPort = Number.parseInt(key.split("/")[0] ?? "0", 10);

 			// Take only the first mapping to avoid duplicates (IPv4 and IPv6)
-			const firstMapping = containerPortMapppings[0];
+			const firstMapping = containerPortMappings[0];
 			if (firstMapping) {
 				const publishedPort = Number.parseInt(firstMapping.HostPort, 10);
 				const portKey = `${targetPort}-${publishedPort}-${protocol}`;
@@ -413,17 +413,38 @@ export const checkPortInUse = async (
 	serverId?: string,
 ): Promise<{ isInUse: boolean; conflictingContainer?: string }> => {
 	try {
-		const command = `docker ps -a --format '{{.Names}}' | grep -v '^dokploy-traefik$' | while read name; do docker port "$name" 2>/dev/null | grep -q ':${port}' && echo "$name" && break; done || true`;
-		const { stdout } = serverId
-			? await execAsyncRemote(serverId, command)
-			: await execAsync(command);
+		// Check if port is in use by a Docker container
+		const dockerCommand = `docker ps -a --format '{{.Names}}' | grep -v '^dokploy-traefik$' | while read name; do docker port "$name" 2>/dev/null | grep -q ':${port}' && echo "$name" && break; done || true`;
+		const { stdout: dockerOut } = serverId
+			? await execAsyncRemote(serverId, dockerCommand)
+			: await execAsync(dockerCommand);

-		const container = stdout.trim();
+		const container = dockerOut.trim();

-		return {
-			isInUse: !!container,
-			conflictingContainer: container || undefined,
-		};
+		if (container) {
+			return {
+				isInUse: true,
+				conflictingContainer: `container "${container}"`,
+			};
+		}
+
+		// Check if port is in use by a host-level service (non-Docker)
+		// Dokploy runs inside a container, so we spawn an ephemeral container
+		// with --net=host to share the host's network stack and use nc -z to
+		// check if something is listening on the port
+		const hostCommand = `docker run --rm --net=host busybox sh -c 'nc -z 0.0.0.0 ${port} 2>/dev/null && echo in_use || echo free'`;
+		const { stdout: hostOut } = serverId
+			? await execAsyncRemote(serverId, hostCommand)
+			: await execAsync(hostCommand);
+
+		if (hostOut.includes("in_use")) {
+			return {
+				isInUse: true,
+				conflictingContainer: "a host-level service",
+			};
+		}
+
+		return { isInUse: false };
 	} catch (error) {
 		console.error("Error checking port availability:", error);
 		return { isInUse: false };
--- a/packages/server/src/services/ssh-key.ts
+++ b/packages/server/src/services/ssh-key.ts
@@ -8,8 +8,9 @@ import {
 } from "@dokploy/server/db/schema";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
+import type { z } from "zod";

-export const createSshKey = async (input: typeof apiCreateSshKey._type) => {
+export const createSshKey = async (input: z.infer<typeof apiCreateSshKey>) => {
 	await db.transaction(async (tx) => {
 		const sshKey = await tx
 			.insert(sshKeys)
@@ -29,7 +30,7 @@ export const createSshKey = async (input: typeof apiCreateSshKey._type) => {
 };

 export const removeSSHKeyById = async (
-	sshKeyId: (typeof apiRemoveSshKey._type)["sshKeyId"],
+	sshKeyId: z.infer<typeof apiRemoveSshKey>["sshKeyId"],
 ) => {
 	const result = await db
 		.delete(sshKeys)
@@ -42,7 +43,7 @@ export const removeSSHKeyById = async (
 export const updateSSHKeyById = async ({
 	sshKeyId,
 	...input
-}: typeof apiUpdateSshKey._type) => {
+}: z.infer<typeof apiUpdateSshKey>) => {
 	const result = await db
 		.update(sshKeys)
 		.set(input)
@@ -53,7 +54,7 @@ export const updateSSHKeyById = async ({
 };

 export const findSSHKeyById = async (
-	sshKeyId: (typeof apiFindOneSshKey._type)["sshKeyId"],
+	sshKeyId: z.infer<typeof apiFindOneSshKey>["sshKeyId"],
 ) => {
 	const sshKey = await db.query.sshKeys.findFirst({
 		where: eq(sshKeys.sshKeyId, sshKeyId),
--- a/packages/server/src/services/user.ts
+++ b/packages/server/src/services/user.ts
@@ -96,7 +96,7 @@ export const canPerformAccessService = async (
 	return false;
 };

-export const canPeformDeleteService = async (
+export const canPerformDeleteService = async (
 	userId: string,
 	serviceId: string,
 	organizationId: string,
@@ -222,7 +222,7 @@ export const checkServiceAccess = async (
 			);
 			break;
 		case "delete":
-			hasPermission = await canPeformDeleteService(
+			hasPermission = await canPerformDeleteService(
 				userId,
 				serviceId,
 				organizationId,
@@ -526,7 +526,7 @@ export const createApiKey = async (
 		refillInterval?: number;
 	},
 ) => {
-	const apiKey = await auth.createApiKey({
+	const result = await auth.createApiKey({
 		body: {
 			name: input.name,
 			expiresIn: input.expiresIn,
@@ -544,10 +544,9 @@ export const createApiKey = async (
 	if (input.metadata) {
 		await db
 			.update(apikey)
-			.set({
-				metadata: JSON.stringify(input.metadata),
-			})
-			.where(eq(apikey.id, apiKey.id));
+			.set({ metadata: JSON.stringify(input.metadata) })
+			.where(eq(apikey.id, result.id));
 	}
-	return apiKey;
+
+	return result;
 };
--- a/packages/server/src/services/volume-backups.ts
+++ b/packages/server/src/services/volume-backups.ts
@@ -75,6 +75,15 @@ export const findVolumeBackupById = async (volumeBackupId: string) => {
 					},
 				},
 			},
+			libsql: {
+				with: {
+					environment: {
+						with: {
+							project: true,
+						},
+					},
+				},
+			},
 			destination: true,
 		},
 	});
@@ -94,7 +103,7 @@ export const createVolumeBackup = async (
 ) => {
 	const newVolumeBackup = await db
 		.insert(volumeBackups)
-		.values(volumeBackup)
+		.values(volumeBackup as typeof volumeBackups.$inferInsert)
 		.returning()
 		.then((e) => e[0]);

@@ -113,7 +122,7 @@ export const updateVolumeBackup = async (
 ) => {
 	return await db
 		.update(volumeBackups)
-		.set(volumeBackup)
+		.set(volumeBackup as Partial<typeof volumeBackups.$inferInsert>)
 		.where(eq(volumeBackups.volumeBackupId, volumeBackupId))
 		.returning()
 		.then((e) => e[0]);