Merge pull request #4813 from Dokploy/canary

🚀 Release v0.29.12

.github/workflows/dokploy.yml

@@ -152,6 +152,14 @@ jobs:
           VERSION=$(node -p "require('./apps/dokploy/package.json').version")
           echo "version=$VERSION" >> $GITHUB_OUTPUT
 
+      - name: Fetch install.sh
+        run: |
+          curl -fsSL https://raw.githubusercontent.com/Dokploy/website/main/apps/website/public/install.sh -o install.sh
+          head -1 install.sh | grep -q '^#!' || { echo "Downloaded install.sh is not a shell script"; exit 1; }
+          grep -q 'DOKPLOY_VERSION' install.sh || { echo "install.sh no longer supports DOKPLOY_VERSION pinning"; exit 1; }
+          { head -1 install.sh; echo "DOKPLOY_VERSION=\"\${DOKPLOY_VERSION:-${{ steps.get_version.outputs.version }}}\""; tail -n +2 install.sh; } > install-pinned.sh
+          mv install-pinned.sh install.sh
+
       - name: Create Release
         uses: softprops/action-gh-release@v2
         with:
@@ -160,6 +168,7 @@ jobs:
           generate_release_notes: true
           draft: false
           prerelease: false
+          files: install.sh
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

Dockerfile

@@ -69,4 +69,5 @@ EXPOSE 3000
 HEALTHCHECK --interval=30s --timeout=5s --start-period=60s --retries=5 \
   CMD curl -fs http://localhost:3000/api/trpc/settings.health || exit 1
 
-  CMD ["sh", "-c", "pnpm run wait-for-postgres && exec pnpm start"]
+# Ejecutar node directamente: pnpm como wrapper queda residente (~100MB RSS)
+  CMD ["sh", "-c", "node -r dotenv/config dist/wait-for-postgres.mjs && node -r dotenv/config dist/migration.mjs && exec node -r dotenv/config dist/server.mjs"]

apps/dokploy/__test__/env/encryption.test.ts

@@ -0,0 +1,93 @@
+import {
+	decryptValue,
+	encryptValue,
+	exportEncryptionKeys,
+	isEncrypted,
+} from "@dokploy/server/lib/encryption";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+describe("encryptValue / decryptValue", () => {
+	it("round-trips a value", () => {
+		const value =
+			"DATABASE_URL=postgres://user:secret@host:5432/db\nAPI_KEY=123";
+		const encrypted = encryptValue(value);
+
+		expect(encrypted).not.toBe(value);
+		expect(isEncrypted(encrypted)).toBe(true);
+		expect(encrypted).not.toContain("secret");
+		expect(decryptValue(encrypted)).toBe(value);
+	});
+
+	it("uses a random IV so equal inputs produce different ciphertexts", () => {
+		const value = "KEY=value";
+		expect(encryptValue(value)).not.toBe(encryptValue(value));
+	});
+
+	it("passes legacy plaintext through on decrypt", () => {
+		const plaintext = "KEY=legacy-plaintext-value";
+		expect(decryptValue(plaintext)).toBe(plaintext);
+	});
+
+	it("passes empty values through unchanged", () => {
+		expect(encryptValue("")).toBe("");
+		expect(decryptValue("")).toBe("");
+	});
+
+	it("does not double-encrypt an already encrypted value", () => {
+		const encrypted = encryptValue("KEY=value");
+		expect(encryptValue(encrypted)).toBe(encrypted);
+	});
+
+	it("throws a descriptive error on tampered ciphertext", () => {
+		const encrypted = encryptValue("KEY=value");
+		const tampered = `${encrypted.slice(0, -4)}AAAA`;
+		expect(() => decryptValue(tampered)).toThrow(/BETTER_AUTH_SECRET/);
+	});
+
+	it("exports the derived keys as 32-byte hex lines for backups", () => {
+		expect(exportEncryptionKeys()).toMatch(/^[0-9a-f]{64}(\n[0-9a-f]{64})*$/);
+	});
+});
+
+describe("dedicated ENCRYPTION_KEY", () => {
+	afterEach(() => {
+		vi.unstubAllEnvs();
+		vi.resetModules();
+	});
+
+	const loadWithEncryptionKey = async (key: string) => {
+		vi.stubEnv("ENCRYPTION_KEY", key);
+		vi.resetModules();
+		return await import("@dokploy/server/lib/encryption");
+	};
+
+	it("encrypts with the dedicated key when set", async () => {
+		const withKey = await loadWithEncryptionKey("my-dedicated-key");
+		const encrypted = withKey.encryptValue("KEY=value");
+
+		expect(withKey.decryptValue(encrypted)).toBe("KEY=value");
+		// The default (auth-secret derived) module cannot read it
+		expect(() => decryptValue(encrypted)).toThrow(/ENCRYPTION_KEY/);
+	});
+
+	it("still decrypts legacy values via the auth-secret fallback", async () => {
+		// Encrypted before the install adopted a dedicated key
+		const legacyEncrypted = encryptValue("KEY=legacy-value");
+
+		const withKey = await loadWithEncryptionKey("my-dedicated-key");
+		expect(withKey.decryptValue(legacyEncrypted)).toBe("KEY=legacy-value");
+	});
+
+	it("re-encrypts with the dedicated key on write", async () => {
+		const withKey = await loadWithEncryptionKey("my-dedicated-key");
+		const reEncrypted = withKey.encryptValue(
+			withKey.decryptValue(encryptValue("KEY=migrated")),
+		);
+
+		const other = await loadWithEncryptionKey("another-key");
+		// Readable only by the dedicated key (or its own fallback), proving
+		// the write used the primary key, not the legacy one
+		expect(withKey.decryptValue(reEncrypted)).toBe("KEY=migrated");
+		expect(() => other.decryptValue(reEncrypted)).toThrow();
+	});
+});

apps/dokploy/__test__/git-provider/git-provider-access.test.ts

@@ -1,8 +1,8 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
 import {
 	canEditDeployGitSource,
 	getAccessibleGitProviderIds,
 } from "@dokploy/server/services/git-provider";
+import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const mockDb = vi.hoisted(() => ({
 	query: {

apps/dokploy/__test__/queues/concurrency.test.ts

@@ -1,16 +1,11 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
-const hasValidLicense = vi.fn();
 const getWebServerSettings = vi.fn();
-const findFirstOrg = vi.fn();
 const findFirstServer = vi.fn();
 
 vi.mock("@dokploy/server/db", () => ({
 	db: {
 		query: {
-			organization: {
-				findFirst: (...args: unknown[]) => findFirstOrg(...args),
-			},
 			server: {
 				findFirst: (...args: unknown[]) => findFirstServer(...args),
 			},
@@ -19,91 +14,56 @@ vi.mock("@dokploy/server/db", () => ({
 }));
 
 vi.mock("@dokploy/server/db/schema", () => ({
-	organization: {},
 	server: {},
 }));
 
-vi.mock("@dokploy/server/services/proprietary/license-key", () => ({
-	hasValidLicense: (...args: unknown[]) => hasValidLicense(...args),
-}));
-
 vi.mock("@dokploy/server/services/web-server-settings", () => ({
 	getWebServerSettings: (...args: unknown[]) => getWebServerSettings(...args),
 }));
 
 vi.mock("drizzle-orm", () => ({ eq: vi.fn() }));
 
-import {
-	assertBuildsConcurrencyAllowed,
-	resolveBuildsConcurrency,
-} from "../../server/queues/concurrency";
+import { resolveBuildsConcurrency } from "../../server/queues/concurrency";
 import { LOCAL_PARTITION } from "../../server/queues/in-memory-queue";
 
-describe("resolveBuildsConcurrency (enterprise gating)", () => {
+describe("resolveBuildsConcurrency", () => {
 	beforeEach(() => {
 		vi.clearAllMocks();
-		findFirstOrg.mockResolvedValue({ id: "org-1" });
 	});
 
 	describe("local web server partition", () => {
-		it("returns the configured concurrency when licensed", async () => {
+		it("returns the configured concurrency", async () => {
 			getWebServerSettings.mockResolvedValue({ buildsConcurrency: 5 });
-			hasValidLicense.mockResolvedValue(true);
 
 			await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(5);
 		});
 
-		it("clamps to the free max (2) when there is no valid license", async () => {
-			getWebServerSettings.mockResolvedValue({ buildsConcurrency: 10 });
-			hasValidLicense.mockResolvedValue(false);
-
-			await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(2);
-		});
-
-		it("allows the free max (2) without a license", async () => {
-			getWebServerSettings.mockResolvedValue({ buildsConcurrency: 2 });
-			hasValidLicense.mockResolvedValue(false);
-
-			await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(2);
-		});
-
-		it("does not cap the value when licensed (N allowed)", async () => {
+		it("does not cap high values", async () => {
 			getWebServerSettings.mockResolvedValue({ buildsConcurrency: 999 });
-			hasValidLicense.mockResolvedValue(true);
 
 			await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(
 				999,
 			);
 		});
 
+		it("floors values below 1 to 1", async () => {
+			getWebServerSettings.mockResolvedValue({ buildsConcurrency: 0 });
+
+			await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(1);
+		});
+
 		it("defaults to 1 when settings are missing", async () => {
 			getWebServerSettings.mockResolvedValue(undefined);
-			hasValidLicense.mockResolvedValue(true);
 
 			await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(1);
 		});
 	});
 
 	describe("remote server partition", () => {
-		it("returns the server concurrency when its org is licensed", async () => {
-			findFirstServer.mockResolvedValue({
-				buildsConcurrency: 4,
-				organizationId: "org-1",
-			});
-			hasValidLicense.mockResolvedValue(true);
+		it("returns the server concurrency", async () => {
+			findFirstServer.mockResolvedValue({ buildsConcurrency: 4 });
 
 			await expect(resolveBuildsConcurrency("server-1")).resolves.toBe(4);
-			expect(hasValidLicense).toHaveBeenCalledWith("org-1");
-		});
-
-		it("clamps to the free max (2) when the server org is not licensed", async () => {
-			findFirstServer.mockResolvedValue({
-				buildsConcurrency: 8,
-				organizationId: "org-1",
-			});
-			hasValidLicense.mockResolvedValue(false);
-
-			await expect(resolveBuildsConcurrency("server-1")).resolves.toBe(2);
 		});
 
 		it("defaults to 1 for an unknown server", async () => {
@@ -119,30 +79,3 @@ describe("resolveBuildsConcurrency (enterprise gating)", () => {
 		await expect(resolveBuildsConcurrency(LOCAL_PARTITION)).resolves.toBe(1);
 	});
 });
-
-describe("assertBuildsConcurrencyAllowed", () => {
-	beforeEach(() => {
-		vi.clearAllMocks();
-	});
-
-	it("allows up to the free max (2) without checking the license", async () => {
-		await expect(
-			assertBuildsConcurrencyAllowed(2, "org-1"),
-		).resolves.toBeUndefined();
-		expect(hasValidLicense).not.toHaveBeenCalled();
-	});
-
-	it("allows more than 2 when licensed", async () => {
-		hasValidLicense.mockResolvedValue(true);
-		await expect(
-			assertBuildsConcurrencyAllowed(5, "org-1"),
-		).resolves.toBeUndefined();
-	});
-
-	it("rejects more than 2 without a license", async () => {
-		hasValidLicense.mockResolvedValue(false);
-		await expect(assertBuildsConcurrencyAllowed(3, "org-1")).rejects.toThrow(
-			/enterprise license/i,
-		);
-	});
-});

apps/dokploy/components/dashboard/application/general/show.tsx

@@ -1,4 +1,3 @@
-import { Tooltip as TooltipPrimitive } from "radix-ui";
 import {
 	Ban,
 	CheckCircle2,
@@ -8,6 +7,7 @@ import {
 	Terminal,
 } from "lucide-react";
 import { useRouter } from "next/router";
+import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { toast } from "sonner";
 import { ShowBuildChooseForm } from "@/components/dashboard/application/build/show";
 import { ShowProviderForm } from "@/components/dashboard/application/general/generic/show";

apps/dokploy/components/dashboard/application/preview-deployments/show-preview-deployments.tsx

@@ -1,4 +1,3 @@
-import { Tooltip as TooltipPrimitive } from "radix-ui";
 import {
 	ExternalLink,
 	FileText,
@@ -9,6 +8,7 @@ import {
 	RocketIcon,
 	Trash2,
 } from "lucide-react";
+import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { toast } from "sonner";
 import { GithubIcon } from "@/components/icons/data-tools-icons";
 import { DateTooltip } from "@/components/shared/date-tooltip";

apps/dokploy/components/dashboard/compose/general/actions.tsx

@@ -1,6 +1,6 @@
-import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { Ban, CheckCircle2, RefreshCcw, Rocket, Terminal } from "lucide-react";
 import { useRouter } from "next/router";
+import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { toast } from "sonner";
 import { DialogAction } from "@/components/shared/dialog-action";
 import { Button } from "@/components/ui/button";

apps/dokploy/components/dashboard/database/backups/handle-backup.tsx

@@ -79,6 +79,7 @@ const Schema = z
 		schedule: z.string().min(1, "Schedule (Cron) required"),
 		prefix: z.string().min(1, "Prefix required"),
 		enabled: z.boolean(),
+		includeEncryptionKey: z.boolean(),
 		database: z.string().min(1, "Database required"),
 		keepLatestCount: z.coerce.number().optional(),
 		serviceName: z.string().nullable(),
@@ -223,6 +224,7 @@ export const HandleBackup = ({
 						: "",
 			destinationId: "",
 			enabled: true,
+			includeEncryptionKey: true,
 			prefix: "/",
 			schedule: "",
 			keepLatestCount: undefined,
@@ -262,6 +264,7 @@ export const HandleBackup = ({
 						: "",
 			destinationId: backup?.destinationId ?? "",
 			enabled: backup?.enabled ?? true,
+			includeEncryptionKey: backup?.includeEncryptionKey ?? true,
 			prefix: backup?.prefix ?? "/",
 			schedule: backup?.schedule ?? "",
 			keepLatestCount: backup?.keepLatestCount ?? undefined,
@@ -309,6 +312,7 @@ export const HandleBackup = ({
 			prefix: data.prefix,
 			schedule: data.schedule,
 			enabled: data.enabled,
+			includeEncryptionKey: data.includeEncryptionKey,
 			database: data.database,
 			keepLatestCount: data.keepLatestCount ?? null,
 			databaseType: data.databaseType || databaseType,
@@ -665,6 +669,31 @@ export const HandleBackup = ({
 									</FormItem>
 								)}
 							/>
+							{databaseType === "web-server" && (
+								<FormField
+									control={form.control}
+									name="includeEncryptionKey"
+									render={({ field }) => (
+										<FormItem className="flex flex-row items-center justify-between rounded-lg border p-3 ">
+											<div className="space-y-0.5">
+												<FormLabel>Include encryption key</FormLabel>
+												<FormDescription>
+													Stores the encryption key inside the backup so
+													environment variables can be restored on a new server.
+													Anyone with access to the backup file can decrypt
+													them.
+												</FormDescription>
+											</div>
+											<FormControl>
+												<Switch
+													checked={field.value}
+													onCheckedChange={field.onChange}
+												/>
+											</FormControl>
+										</FormItem>
+									)}
+								/>
+							)}
 							{backupType === "compose" && (
 								<>
 									{form.watch("databaseType") === "postgres" && (

apps/dokploy/components/dashboard/docker/show/columns.tsx

@@ -1,10 +1,13 @@
 import type { ColumnDef } from "@tanstack/react-table";
+import copy from "copy-to-clipboard";
 import { ArrowUpDown, MoreHorizontal } from "lucide-react";
+import { toast } from "sonner";
 import { Badge } from "@/components/ui/badge";
 import { Button } from "@/components/ui/button";
 import {
 	DropdownMenu,
 	DropdownMenuContent,
+	DropdownMenuItem,
 	DropdownMenuLabel,
 	DropdownMenuTrigger,
 } from "@/components/ui/dropdown-menu";
@@ -37,6 +40,7 @@ export const columns: ColumnDef<Container>[] = [
 	},
 	{
 		accessorKey: "state",
+		filterFn: "equals",
 		header: ({ column }) => {
 			return (
 				<Button
@@ -56,7 +60,7 @@ export const columns: ColumnDef<Container>[] = [
 						variant={
 							value === "running"
 								? "default"
-								: value === "failed"
+								: value === "exited" || value === "dead"
 									? "destructive"
 									: "secondary"
 						}
@@ -99,6 +103,28 @@ export const columns: ColumnDef<Container>[] = [
 		},
 		cell: ({ row }) => <div className="lowercase">{row.getValue("image")}</div>,
 	},
+	{
+		accessorKey: "ports",
+		header: ({ column }) => {
+			return (
+				<Button
+					variant="ghost"
+					onClick={() => column.toggleSorting(column.getIsSorted() === "asc")}
+				>
+					Ports
+					<ArrowUpDown className="ml-2 h-4 w-4" />
+				</Button>
+			);
+		},
+		cell: ({ row }) => {
+			const value = row.getValue("ports") as string;
+			return (
+				<div className="max-w-[16rem] truncate lowercase" title={value}>
+					{value}
+				</div>
+			);
+		},
+	},
 	{
 		id: "actions",
 		enableHiding: false,
@@ -115,6 +141,14 @@ export const columns: ColumnDef<Container>[] = [
 					</DropdownMenuTrigger>
 					<DropdownMenuContent align="end">
 						<DropdownMenuLabel>Actions</DropdownMenuLabel>
+						<DropdownMenuItem
+							onClick={() => {
+								copy(container.containerId);
+								toast.success("Container ID copied to clipboard");
+							}}
+						>
+							Copy Container ID
+						</DropdownMenuItem>
 						<ShowDockerModalLogs
 							containerId={container.containerId}
 							serverId={container.serverId}

apps/dokploy/components/dashboard/docker/show/show-containers.tsx

@@ -9,7 +9,7 @@ import {
 	useReactTable,
 	type VisibilityState,
 } from "@tanstack/react-table";
-import { ChevronDown, Container } from "lucide-react";
+import { ChevronDown, Container, RefreshCw } from "lucide-react";
 import * as React from "react";
 import { Button } from "@/components/ui/button";
 import {
@@ -26,6 +26,13 @@ import {
 	DropdownMenuTrigger,
 } from "@/components/ui/dropdown-menu";
 import { Input } from "@/components/ui/input";
+import {
+	Select,
+	SelectContent,
+	SelectItem,
+	SelectTrigger,
+	SelectValue,
+} from "@/components/ui/select";
 import {
 	Table,
 	TableBody,
@@ -44,10 +51,26 @@ interface Props {
 	serverId?: string;
 }
 
+const CONTAINER_STATES = [
+	"running",
+	"exited",
+	"paused",
+	"restarting",
+	"created",
+	"removing",
+	"dead",
+];
+
 export const ShowContainers = ({ serverId }: Props) => {
-	const { data, isPending } = api.docker.getContainers.useQuery({
-		serverId,
-	});
+	const { data, isPending, refetch, isRefetching } =
+		api.docker.getContainers.useQuery(
+			{
+				serverId,
+			},
+			{
+				refetchInterval: 10_000,
+			},
+		);
 
 	const [sorting, setSorting] = React.useState<SortingState>([]);
 	const [columnFilters, setColumnFilters] = React.useState<ColumnFiltersState>(
@@ -106,12 +129,48 @@ export const ShowContainers = ({ serverId }: Props) => {
 										}
 										className="md:max-w-sm"
 									/>
+									<Select
+										value={
+											(table.getColumn("state")?.getFilterValue() as string) ??
+											"all"
+										}
+										onValueChange={(value) =>
+											table
+												.getColumn("state")
+												?.setFilterValue(value === "all" ? undefined : value)
+										}
+									>
+										<SelectTrigger className="w-40 max-sm:w-full capitalize">
+											<SelectValue placeholder="Filter by state" />
+										</SelectTrigger>
+										<SelectContent>
+											<SelectItem value="all">All states</SelectItem>
+											{CONTAINER_STATES.map((state) => (
+												<SelectItem
+													key={state}
+													value={state}
+													className="capitalize"
+												>
+													{state}
+												</SelectItem>
+											))}
+										</SelectContent>
+									</Select>
+									<Button
+										variant="outline"
+										size="icon"
+										className="shrink-0 sm:ml-auto"
+										onClick={() => refetch()}
+										disabled={isRefetching}
+									>
+										<RefreshCw
+											className={`h-4 w-4 ${isRefetching ? "animate-spin" : ""}`}
+										/>
+										<span className="sr-only">Refresh</span>
+									</Button>
 									<DropdownMenu>
 										<DropdownMenuTrigger asChild>
-											<Button
-												variant="outline"
-												className="sm:ml-auto max-sm:w-full"
-											>
+											<Button variant="outline" className="max-sm:w-full">
 												Columns <ChevronDown className="ml-2 h-4 w-4" />
 											</Button>
 										</DropdownMenuTrigger>

apps/dokploy/components/dashboard/libsql/general/show-general-libsql.tsx

@@ -1,5 +1,5 @@
-import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { Ban, CheckCircle2, RefreshCcw, Rocket, Terminal } from "lucide-react";
+import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { useState } from "react";
 import { toast } from "sonner";
 import { DialogAction } from "@/components/shared/dialog-action";

apps/dokploy/components/dashboard/mariadb/general/show-general-mariadb.tsx

@@ -1,5 +1,5 @@
-import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { Ban, CheckCircle2, RefreshCcw, Rocket, Terminal } from "lucide-react";
+import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { useState } from "react";
 import { toast } from "sonner";
 import { DialogAction } from "@/components/shared/dialog-action";

apps/dokploy/components/dashboard/mongo/general/show-general-mongo.tsx

@@ -1,5 +1,5 @@
-import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { Ban, CheckCircle2, RefreshCcw, Rocket, Terminal } from "lucide-react";
+import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { useState } from "react";
 import { toast } from "sonner";
 import { DialogAction } from "@/components/shared/dialog-action";

apps/dokploy/components/dashboard/mysql/general/show-general-mysql.tsx

@@ -1,5 +1,5 @@
-import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { Ban, CheckCircle2, RefreshCcw, Rocket, Terminal } from "lucide-react";
+import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { useState } from "react";
 import { toast } from "sonner";
 import { DialogAction } from "@/components/shared/dialog-action";

apps/dokploy/components/dashboard/postgres/general/show-general-postgres.tsx

@@ -1,5 +1,5 @@
-import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { Ban, CheckCircle2, RefreshCcw, Rocket, Terminal } from "lucide-react";
+import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { useState } from "react";
 import { toast } from "sonner";
 import { DialogAction } from "@/components/shared/dialog-action";

apps/dokploy/components/dashboard/redis/general/show-general-redis.tsx

@@ -1,5 +1,5 @@
-import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { Ban, CheckCircle2, RefreshCcw, Rocket, Terminal } from "lucide-react";
+import { Tooltip as TooltipPrimitive } from "radix-ui";
 import { useState } from "react";
 import { toast } from "sonner";
 import { DialogAction } from "@/components/shared/dialog-action";

apps/dokploy/components/dashboard/requests/request-distribution-chart.tsx

@@ -1,11 +1,4 @@
-import {
-	Area,
-	AreaChart,
-	CartesianGrid,
-	ResponsiveContainer,
-	XAxis,
-	YAxis,
-} from "recharts";
+import { Area, AreaChart, CartesianGrid, XAxis, YAxis } from "recharts";
 import {
 	type ChartConfig,
 	ChartContainer,
@@ -49,65 +42,60 @@ export const RequestDistributionChart = ({
 	);
 
 	return (
-		<div className="w-full h-[200px] overflow-hidden">
-			<ResponsiveContainer
-				width="100%"
-				height="100%"
-				className="overflow-hidden"
+		<ChartContainer
+			config={chartConfig}
+			className="aspect-auto h-[200px] w-full"
+		>
+			<AreaChart
+				accessibilityLayer
+				data={stats || []}
+				margin={{
+					top: 10,
+					left: 12,
+					right: 12,
+					bottom: 0,
+				}}
 			>
-				<ChartContainer config={chartConfig}>
-					<AreaChart
-						accessibilityLayer
-						data={stats || []}
-						margin={{
-							top: 10,
-							left: 12,
-							right: 12,
-							bottom: 0,
-						}}
-					>
-						<CartesianGrid vertical={false} />
-						<XAxis
-							dataKey="hour"
-							tickLine={false}
-							axisLine={false}
-							tickMargin={8}
-							tickFormatter={(value) =>
-								new Date(value).toLocaleTimeString([], {
-									hour: "2-digit",
-									minute: "2-digit",
-								})
-							}
-						/>
-						<YAxis
-							tickLine={false}
-							axisLine={false}
-							tickMargin={8}
-							allowDataOverflow={false}
-							domain={[0, "auto"]}
-						/>
-						<ChartTooltip
-							cursor={false}
-							content={<ChartTooltipContent indicator="line" />}
-							labelFormatter={(value) =>
-								new Date(value).toLocaleString([], {
-									month: "short",
-									day: "numeric",
-									hour: "2-digit",
-									minute: "2-digit",
-								})
-							}
-						/>
-						<Area
-							dataKey="count"
-							type="monotone"
-							fill="hsl(var(--chart-1))"
-							fillOpacity={0.4}
-							stroke="hsl(var(--chart-1))"
-						/>
-					</AreaChart>
-				</ChartContainer>
-			</ResponsiveContainer>
-		</div>
+				<CartesianGrid vertical={false} />
+				<XAxis
+					dataKey="hour"
+					tickLine={false}
+					axisLine={false}
+					tickMargin={8}
+					tickFormatter={(value) =>
+						new Date(value).toLocaleTimeString([], {
+							hour: "2-digit",
+							minute: "2-digit",
+						})
+					}
+				/>
+				<YAxis
+					tickLine={false}
+					axisLine={false}
+					tickMargin={8}
+					allowDataOverflow={false}
+					domain={[0, "auto"]}
+				/>
+				<ChartTooltip
+					cursor={false}
+					content={<ChartTooltipContent indicator="line" />}
+					labelFormatter={(value) =>
+						new Date(value).toLocaleString([], {
+							month: "short",
+							day: "numeric",
+							hour: "2-digit",
+							minute: "2-digit",
+						})
+					}
+				/>
+				<Area
+					dataKey="count"
+					type="monotone"
+					fill="hsl(var(--chart-1))"
+					fillOpacity={0.4}
+					stroke="hsl(var(--chart-1))"
+				/>
+			</AreaChart>
+		</ChartContainer>
 	);
 };

apps/dokploy/components/dashboard/settings/servers/actions/builds-concurrency.tsx

@@ -4,9 +4,7 @@ import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { api } from "@/utils/api";
 
-// Free tier may set up to 2 concurrent builds; enterprise unlocks more.
-const FREE_MAX_CONCURRENCY = 2;
-const ENTERPRISE_MAX_CONCURRENCY = 100;
+const MAX_CONCURRENCY = 100;
 
 interface Props {
 	/**
@@ -20,14 +18,10 @@ interface Props {
 
 /**
  * Control to set the number of concurrent builds, either for a remote server
- * (`serverId` provided) or the local web server (omitted). Available to
- * everyone self-hosted up to FREE_MAX_CONCURRENCY; higher values require a
- * valid enterprise license. Not shown in cloud.
+ * (`serverId` provided) or the local web server (omitted). Not shown in cloud.
  */
 export const BuildsConcurrency = ({ serverId, label }: Props) => {
 	const { data: isCloud } = api.settings.isCloud.useQuery();
-	const { data: haveValidLicense } =
-		api.licenseKey.haveValidLicenseKey.useQuery();
 
 	const serverQuery = api.server.one.useQuery(
 		{ serverId: serverId ?? "" },
@@ -59,10 +53,7 @@ export const BuildsConcurrency = ({ serverId, label }: Props) => {
 	// Concurrent builds are a self-hosted feature; not shown in cloud.
 	if (isCloud) return null;
 
-	const max = haveValidLicense
-		? ENTERPRISE_MAX_CONCURRENCY
-		: FREE_MAX_CONCURRENCY;
-	const clamp = (n: number) => Math.min(max, Math.max(1, n));
+	const clamp = (n: number) => Math.min(MAX_CONCURRENCY, Math.max(1, n));
 
 	const handleSave = async () => {
 		const parsed = clamp(Number.parseInt(value, 10) || 1);
@@ -101,7 +92,7 @@ export const BuildsConcurrency = ({ serverId, label }: Props) => {
 					<Input
 						type="number"
 						min={1}
-						max={max}
+						max={MAX_CONCURRENCY}
 						value={value}
 						onChange={(e) => setValue(e.target.value)}
 						className="w-20"

apps/dokploy/components/dashboard/settings/users/show-users.tsx

@@ -97,6 +97,7 @@ export const ShowUsers = () => {
 												<TableRow>
 													<TableHead className="w-[100px]">Email</TableHead>
 													<TableHead className="text-center">Role</TableHead>
+													<TableHead className="text-center">Status</TableHead>
 													<TableHead className="text-center">2FA</TableHead>
 
 													<TableHead className="text-center">
@@ -173,6 +174,19 @@ export const ShowUsers = () => {
 																	{member.role}
 																</Badge>
 															</TableCell>
+															<TableCell className="text-center">
+																<Badge
+																	variant={
+																		member.user.banned
+																			? "destructive"
+																			: "outline"
+																	}
+																>
+																	{member.user.banned
+																		? "Deactivated"
+																		: "Active"}
+																</Badge>
+															</TableCell>
 															<TableCell className="text-center">
 																{member.user.twoFactorEnabled
 																	? "Enabled"

apps/dokploy/components/dashboard/shared/rebuild-database.tsx

@@ -87,29 +87,29 @@ export const RebuildDatabase = ({ id, type }: Props) => {
 									<AlertTriangle className="h-5 w-5 text-destructive" />
 									Are you absolutely sure?
 								</AlertDialogTitle>
-								<AlertDialogDescription className="space-y-2">
-									<p>This action will:</p>
-									<ul className="list-disc list-inside space-y-1">
-										<li>Stop the current database service</li>
-										<li>Delete all existing data and volumes</li>
-										<li>Reset to the default configuration</li>
-										<li>Restart the service with a clean state</li>
-									</ul>
-									<p className="font-medium text-destructive mt-4">
-										This action cannot be undone.
-									</p>
+								<AlertDialogDescription asChild>
+									<div className="space-y-2">
+										<p>This action will:</p>
+										<ul className="list-disc list-inside space-y-1">
+											<li>Stop the current database service</li>
+											<li>Delete all existing data and volumes</li>
+											<li>Reset to the default configuration</li>
+											<li>Restart the service with a clean state</li>
+										</ul>
+										<p className="font-medium text-destructive mt-4">
+											This action cannot be undone.
+										</p>
+									</div>
 								</AlertDialogDescription>
 							</AlertDialogHeader>
 							<AlertDialogFooter>
 								<AlertDialogCancel>Cancel</AlertDialogCancel>
 								<AlertDialogAction
 									onClick={handleRebuild}
-									className="bg-destructive text-destructive-foreground hover:bg-destructive/90"
-									asChild
+									disabled={isPending}
+									variant="destructive"
 								>
-									<Button isLoading={isPending} type="submit">
-										Yes, rebuild database
-									</Button>
+									Yes, rebuild database
 								</AlertDialogAction>
 							</AlertDialogFooter>
 						</AlertDialogContent>

apps/dokploy/components/layouts/side.tsx

@@ -41,6 +41,7 @@ import Link from "next/link";
 import { usePathname } from "next/navigation";
 import { useEffect, useState } from "react";
 import { toast } from "sonner";
+import { Badge } from "@/components/ui/badge";
 import {
 	Breadcrumb,
 	BreadcrumbItem,
@@ -564,6 +565,8 @@ function SidebarLogo() {
 	const { isMobile } = useSidebar();
 	const isCollapsed = state === "collapsed" && !isMobile;
 	const { data: activeOrganization } = api.organization.active.useQuery();
+	const { data: haveValidLicense } =
+		api.licenseKey.haveValidLicenseKey.useQuery();
 
 	const { data: invitations, refetch: refetchInvitations } =
 		api.user.getInvitations.useQuery();
@@ -629,9 +632,14 @@ function SidebarLogo() {
 												isCollapsed && "hidden",
 											)}
 										>
-											<p className="text-sm font-medium leading-none">
-												{activeOrganization?.name ?? "Select Organization"}
-											</p>
+											<div className="flex items-center gap-1.5">
+												<p className="text-sm font-medium leading-none">
+													{activeOrganization?.name ?? "Select Organization"}
+												</p>
+												{haveValidLicense && (
+													<Badge variant="blue">Enterprise</Badge>
+												)}
+											</div>
 										</div>
 									</div>
 									<ChevronsUpDown

apps/dokploy/components/proprietary/sso/scim-dialog.tsx

@@ -0,0 +1,235 @@
+"use client";
+
+import copy from "copy-to-clipboard";
+import { Copy, KeyRound, Loader2, Plus, Trash2 } from "lucide-react";
+import { type ReactNode, useState } from "react";
+import { toast } from "sonner";
+import { DialogAction } from "@/components/shared/dialog-action";
+import { Button } from "@/components/ui/button";
+import {
+	Dialog,
+	DialogContent,
+	DialogDescription,
+	DialogFooter,
+	DialogHeader,
+	DialogTitle,
+	DialogTrigger,
+} from "@/components/ui/dialog";
+import { Input } from "@/components/ui/input";
+import { Label } from "@/components/ui/label";
+import { api } from "@/utils/api";
+import { useUrl } from "@/utils/hooks/use-url";
+
+interface Props {
+	children: ReactNode;
+}
+
+export const ScimDialog = ({ children }: Props) => {
+	const utils = api.useUtils();
+	const baseURL = useUrl();
+	const [open, setOpen] = useState(false);
+	const [newProviderId, setNewProviderId] = useState("");
+	const [justCreatedToken, setJustCreatedToken] = useState<{
+		providerId: string;
+		token: string;
+	} | null>(null);
+
+	const { data: providers = [], isPending } = api.scim.listProviders.useQuery(
+		undefined,
+		{ enabled: open },
+	);
+	const { mutateAsync: generateToken, isPending: isGenerating } =
+		api.scim.generateToken.useMutation();
+	const { mutateAsync: deleteProvider, isPending: isDeleting } =
+		api.scim.deleteProvider.useMutation();
+
+	const scimUrl = `${baseURL || "{baseURL}"}/api/auth/scim/v2`;
+
+	const handleGenerate = async () => {
+		const providerId = newProviderId.trim().toLowerCase();
+		if (!providerId) return;
+		try {
+			const result = await generateToken({ providerId });
+			setJustCreatedToken({
+				providerId: result.providerId,
+				token: result.scimToken,
+			});
+			setNewProviderId("");
+			await utils.scim.listProviders.invalidate();
+		} catch (err) {
+			toast.error(
+				err instanceof Error ? err.message : "Failed to generate SCIM token",
+			);
+		}
+	};
+
+	const handleDelete = async (providerId: string) => {
+		try {
+			await deleteProvider({ providerId });
+			toast.success("SCIM provider removed");
+			await utils.scim.listProviders.invalidate();
+		} catch (err) {
+			toast.error(
+				err instanceof Error ? err.message : "Failed to delete SCIM provider",
+			);
+		}
+	};
+
+	const handleCopy = (value: string, label: string) => {
+		copy(value);
+		toast.success(`${label} copied`);
+	};
+
+	const handleOpenChange = (next: boolean) => {
+		setOpen(next);
+		if (!next) setJustCreatedToken(null);
+	};
+
+	return (
+		<Dialog open={open} onOpenChange={handleOpenChange}>
+			<DialogTrigger asChild>{children}</DialogTrigger>
+			<DialogContent className="sm:max-w-[560px]">
+				<DialogHeader>
+					<DialogTitle className="flex items-center gap-2">
+						<KeyRound className="size-5" />
+						SCIM provisioning
+					</DialogTitle>
+					<DialogDescription>
+						Automatically provision, update, and deactivate users from your
+						identity provider (Okta, Entra ID, etc.). Configure the SCIM
+						endpoint below in your IdP.
+					</DialogDescription>
+				</DialogHeader>
+				<div className="space-y-4 py-2">
+					<div className="grid gap-1">
+						<Label className="text-xs font-medium text-muted-foreground">
+							SCIM 2.0 endpoint URL
+						</Label>
+						<div className="flex items-center gap-2">
+							<p className="flex-1 break-all rounded-md bg-muted px-2 py-1.5 font-mono text-xs">
+								{scimUrl}
+							</p>
+							<Button
+								variant="outline"
+								size="icon"
+								className="size-8 shrink-0"
+								onClick={() => handleCopy(scimUrl, "Endpoint URL")}
+								disabled={!baseURL}
+							>
+								<Copy className="size-3.5" />
+							</Button>
+						</div>
+					</div>
+
+					{justCreatedToken && (
+						<div className="rounded-md border border-amber-500/40 bg-amber-500/10 p-3">
+							<p className="text-sm font-medium">
+								Bearer token for {justCreatedToken.providerId}
+							</p>
+							<p className="mt-1 text-xs text-muted-foreground">
+								Copy this token now — it will not be shown again. Paste it into
+								your IdP's SCIM configuration.
+							</p>
+							<div className="mt-2 flex items-center gap-2">
+								<p className="flex-1 break-all rounded-md bg-background px-2 py-1.5 font-mono text-xs">
+									{justCreatedToken.token}
+								</p>
+								<Button
+									variant="outline"
+									size="icon"
+									className="size-8 shrink-0"
+									onClick={() =>
+										handleCopy(justCreatedToken.token, "Bearer token")
+									}
+								>
+									<Copy className="size-3.5" />
+								</Button>
+							</div>
+						</div>
+					)}
+
+					<div className="space-y-2">
+						<Label className="text-sm font-medium">
+							Generate token for a new provider
+						</Label>
+						<div className="flex gap-2">
+							<Input
+								value={newProviderId}
+								onChange={(e) => setNewProviderId(e.target.value)}
+								placeholder="okta, entra, jumpcloud..."
+								className="font-mono text-sm"
+								onKeyDown={(e) => {
+									if (e.key === "Enter") {
+										e.preventDefault();
+										void handleGenerate();
+									}
+								}}
+							/>
+							<Button
+								size="sm"
+								onClick={handleGenerate}
+								disabled={!newProviderId.trim() || isGenerating}
+							>
+								<Plus className="mr-1 size-4" />
+								Generate
+							</Button>
+						</div>
+						<p className="text-xs text-muted-foreground">
+							Choose a unique identifier for this IdP connection (lowercase,
+							alphanumeric, dashes).
+						</p>
+					</div>
+
+					<div className="space-y-2">
+						<Label className="text-sm font-medium">Existing providers</Label>
+						{isPending ? (
+							<div className="flex items-center gap-2 justify-center py-4">
+								<Loader2 className="size-4 animate-spin text-muted-foreground" />
+								<span className="text-sm text-muted-foreground">
+									Loading...
+								</span>
+							</div>
+						) : providers.length === 0 ? (
+							<p className="rounded-md border border-dashed bg-muted/30 px-3 py-4 text-center text-sm text-muted-foreground">
+								No SCIM providers configured yet.
+							</p>
+						) : (
+							<ul className="flex flex-col gap-2">
+								{providers.map((provider) => (
+									<li
+										key={provider.id}
+										className="flex items-center gap-2 rounded-md border bg-muted/30 px-3 py-2"
+									>
+										<span className="flex-1 font-mono text-sm">
+											{provider.providerId}
+										</span>
+										<DialogAction
+											title="Remove SCIM provider"
+											description={`Remove "${provider.providerId}"? Existing provisioned users will stay but the IdP will no longer be able to sync.`}
+											type="destructive"
+											onClick={() => handleDelete(provider.providerId)}
+										>
+											<Button
+												variant="ghost"
+												size="icon"
+												className="size-8 shrink-0 text-destructive hover:text-destructive"
+												disabled={isDeleting}
+											>
+												<Trash2 className="size-3.5" />
+											</Button>
+										</DialogAction>
+									</li>
+								))}
+							</ul>
+						)}
+					</div>
+				</div>
+				<DialogFooter>
+					<Button variant="outline" onClick={() => handleOpenChange(false)}>
+						Close
+					</Button>
+				</DialogFooter>
+			</DialogContent>
+		</Dialog>
+	);
+};

apps/dokploy/components/proprietary/sso/sso-settings.tsx

@@ -2,6 +2,7 @@
 
 import {
 	Eye,
+	KeyRound,
 	Loader2,
 	LogIn,
 	Pencil,
@@ -34,6 +35,7 @@ import { api } from "@/utils/api";
 import { useUrl } from "@/utils/hooks/use-url";
 import { RegisterOidcDialog } from "./register-oidc-dialog";
 import { RegisterSamlDialog } from "./register-saml-dialog";
+import { ScimDialog } from "./scim-dialog";
 
 type ProviderForDetails = {
 	id: string | null;
@@ -169,15 +171,22 @@ export const SSOSettings = () => {
 						Users can sign in with their organization's IdP.
 					</CardDescription>
 				</div>
-				<Button
-					variant="outline"
-					size="sm"
-					onClick={() => setManageOriginsOpen(true)}
-					className="shrink-0"
-				>
-					<Shield className="mr-2 size-4" />
-					Manage origins
-				</Button>
+				<div className="flex flex-wrap gap-2 shrink-0">
+					<Button
+						variant="outline"
+						size="sm"
+						onClick={() => setManageOriginsOpen(true)}
+					>
+						<Shield className="mr-2 size-4" />
+						Manage origins
+					</Button>
+					<ScimDialog>
+						<Button variant="outline" size="sm">
+							<KeyRound className="mr-2 size-4" />
+							Manage SCIM
+						</Button>
+					</ScimDialog>
+				</div>
 			</div>
 
 			{isPending ? (

apps/dokploy/components/ui/accordion.tsx

@@ -1,8 +1,7 @@
-import * as React from "react";
-import { Accordion as AccordionPrimitive } from "radix-ui";
-
-import { cn } from "@/lib/utils";
 import { ChevronDownIcon, ChevronUpIcon } from "lucide-react";
+import { Accordion as AccordionPrimitive } from "radix-ui";
+import type * as React from "react";
+import { cn } from "@/lib/utils";
 
 function Accordion({
 	className,

apps/dokploy/components/ui/alert-dialog.tsx

@@ -1,10 +1,9 @@
 "use client";
 
-import * as React from "react";
 import { AlertDialog as AlertDialogPrimitive } from "radix-ui";
-
-import { cn } from "@/lib/utils";
+import type * as React from "react";
 import { Button } from "@/components/ui/button";
+import { cn } from "@/lib/utils";
 
 function AlertDialog({
 	...props

apps/dokploy/components/ui/alert.tsx

@@ -1,5 +1,5 @@
-import * as React from "react";
 import { cva, type VariantProps } from "class-variance-authority";
+import type * as React from "react";
 
 import { cn } from "@/lib/utils";
 

apps/dokploy/components/ui/avatar.tsx

@@ -1,7 +1,7 @@
 "use client";
 
-import * as React from "react";
 import { Avatar as AvatarPrimitive } from "radix-ui";
+import type * as React from "react";
 
 import { cn } from "@/lib/utils";
 

apps/dokploy/components/ui/breadcrumb.tsx

@@ -1,8 +1,7 @@
-import * as React from "react";
-import { Slot } from "radix-ui";
-
-import { cn } from "@/lib/utils";
 import { ChevronRightIcon, MoreHorizontalIcon } from "lucide-react";
+import { Slot } from "radix-ui";
+import type * as React from "react";
+import { cn } from "@/lib/utils";
 
 function Breadcrumb({ className, ...props }: React.ComponentProps<"nav">) {
 	return (

apps/dokploy/components/ui/card.tsx

@@ -1,4 +1,4 @@
-import * as React from "react";
+import type * as React from "react";
 
 import { cn } from "@/lib/utils";
 

apps/dokploy/components/ui/chart.tsx

@@ -1,6 +1,6 @@
 import * as React from "react";
-import * as RechartsPrimitive from "recharts";
 import type { TooltipValueType } from "recharts";
+import * as RechartsPrimitive from "recharts";
 
 import { cn } from "@/lib/utils";
 

apps/dokploy/components/ui/checkbox.tsx

@@ -1,10 +1,9 @@
 "use client";
 
-import * as React from "react";
-import { Checkbox as CheckboxPrimitive } from "radix-ui";
-
-import { cn } from "@/lib/utils";
 import { CheckIcon } from "lucide-react";
+import { Checkbox as CheckboxPrimitive } from "radix-ui";
+import type * as React from "react";
+import { cn } from "@/lib/utils";
 
 function Checkbox({
 	className,

apps/dokploy/components/ui/command.tsx

@@ -1,9 +1,8 @@
 "use client";
 
-import * as React from "react";
 import { Command as CommandPrimitive } from "cmdk";
-
-import { cn } from "@/lib/utils";
+import { CheckIcon, SearchIcon } from "lucide-react";
+import type * as React from "react";
 import {
 	Dialog,
 	DialogContent,
@@ -12,7 +11,7 @@ import {
 	DialogTitle,
 } from "@/components/ui/dialog";
 import { InputGroup, InputGroupAddon } from "@/components/ui/input-group";
-import { SearchIcon, CheckIcon } from "lucide-react";
+import { cn } from "@/lib/utils";
 
 function Command({
 	className,
@@ -45,10 +44,6 @@ function CommandDialog({
 }) {
 	return (
 		<Dialog {...props}>
-			<DialogHeader className="sr-only">
-				<DialogTitle>{title}</DialogTitle>
-				<DialogDescription>{description}</DialogDescription>
-			</DialogHeader>
 			<DialogContent
 				className={cn(
 					"top-1/3 translate-y-0 overflow-hidden rounded-xl! p-0",
@@ -56,7 +51,11 @@ function CommandDialog({
 				)}
 				showCloseButton={showCloseButton}
 			>
-				{children}
+				<DialogHeader className="sr-only">
+					<DialogTitle>{title}</DialogTitle>
+					<DialogDescription>{description}</DialogDescription>
+				</DialogHeader>
+				<Command>{children}</Command>
 			</DialogContent>
 		</Dialog>
 	);
@@ -68,7 +67,7 @@ function CommandInput({
 }: React.ComponentProps<typeof CommandPrimitive.Input>) {
 	return (
 		<div data-slot="command-input-wrapper" className="p-1 pb-0">
-			<InputGroup className="h-11! rounded-lg! border-input/30 bg-input/30 shadow-none! *:data-[slot=input-group-addon]:pl-2!">
+			<InputGroup className="h-11! in-data-[slot=dialog-content]:h-12! rounded-lg! border-input/30 bg-input/30 shadow-none! *:data-[slot=input-group-addon]:pl-2! in-data-[slot=dialog-content]:*:[svg]:size-5">
 				<CommandPrimitive.Input
 					data-slot="command-input"
 					className={cn(
@@ -122,7 +121,7 @@ function CommandGroup({
 		<CommandPrimitive.Group
 			data-slot="command-group"
 			className={cn(
-				"overflow-hidden p-1 text-foreground **:[[cmdk-group-heading]]:px-2 **:[[cmdk-group-heading]]:py-1.5 **:[[cmdk-group-heading]]:text-xs **:[[cmdk-group-heading]]:font-medium **:[[cmdk-group-heading]]:text-muted-foreground",
+				"overflow-hidden p-1 text-foreground **:[[cmdk-group-heading]]:px-2 **:[[cmdk-group-heading]]:py-1.5 **:[[cmdk-group-heading]]:text-xs **:[[cmdk-group-heading]]:font-medium **:[[cmdk-group-heading]]:text-muted-foreground in-data-[slot=dialog-content]:**:[[cmdk-group]:not([hidden])_~[cmdk-group]]:pt-0",
 				className,
 			)}
 			{...props}
@@ -152,7 +151,7 @@ function CommandItem({
 		<CommandPrimitive.Item
 			data-slot="command-item"
 			className={cn(
-				"group/command-item relative flex cursor-default items-center gap-2 rounded-sm px-2 py-1.5 text-sm outline-hidden select-none in-data-[slot=dialog-content]:rounded-lg! data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50 data-selected:bg-muted data-selected:text-foreground [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 data-selected:*:[svg]:text-foreground",
+				"group/command-item relative flex cursor-default items-center gap-2 rounded-sm px-2 py-1.5 in-data-[slot=dialog-content]:py-3 text-sm outline-hidden select-none in-data-[slot=dialog-content]:rounded-lg! data-[disabled=true]:pointer-events-none data-[disabled=true]:opacity-50 data-selected:bg-muted data-selected:text-foreground [&_svg]:pointer-events-none [&_svg]:shrink-0 [&_svg:not([class*='size-'])]:size-4 in-data-[slot=dialog-content]:[&_svg:not([class*='size-'])]:size-5 data-selected:*:[svg]:text-foreground",
 				className,
 			)}
 			{...props}

apps/dokploy/components/ui/context-menu.tsx

@@ -1,10 +1,9 @@
 "use client";
 
-import * as React from "react";
+import { CheckIcon, ChevronRightIcon } from "lucide-react";
 import { ContextMenu as ContextMenuPrimitive } from "radix-ui";
-
+import type * as React from "react";
 import { cn } from "@/lib/utils";
-import { ChevronRightIcon, CheckIcon } from "lucide-react";
 
 function ContextMenu({
 	...props

apps/dokploy/components/ui/dialog.tsx

@@ -1,10 +1,9 @@
-import * as React from "react";
+import { XIcon } from "lucide-react";
 import { Dialog as DialogPrimitive } from "radix-ui";
-
-import { cn } from "@/lib/utils";
+import type * as React from "react";
 import { Button } from "@/components/ui/button";
 import { wasNestedPopupJustClosed } from "@/components/ui/nested-popup-context";
-import { XIcon } from "lucide-react";
+import { cn } from "@/lib/utils";
 
 function Dialog({
 	...props

apps/dokploy/components/ui/dropdown-menu.tsx

@@ -1,9 +1,8 @@
-import * as React from "react";
-import { DropdownMenu as DropdownMenuPrimitive } from "radix-ui";
-
-import { cn } from "@/lib/utils";
-import { markNestedPopupClosed } from "@/components/ui/nested-popup-context";
 import { CheckIcon, ChevronRightIcon } from "lucide-react";
+import { DropdownMenu as DropdownMenuPrimitive } from "radix-ui";
+import type * as React from "react";
+import { markNestedPopupClosed } from "@/components/ui/nested-popup-context";
+import { cn } from "@/lib/utils";
 
 function DropdownMenu({
 	onOpenChange,

apps/dokploy/components/ui/file-tree.tsx

@@ -1,9 +1,9 @@
 "use client";
 
-import { Accordion as AccordionPrimitive } from "radix-ui";
 // import { ScrollArea } from "@acme/components/ui/scroll-area";
 // import { cn } from "@acme/components/lib/utils";
 import { ChevronRight, type LucideIcon } from "lucide-react";
+import { Accordion as AccordionPrimitive } from "radix-ui";
 import React from "react";
 import useResizeObserver from "use-resize-observer";
 import { cn } from "@/lib/utils";

apps/dokploy/components/ui/form.tsx

@@ -1,4 +1,4 @@
-import { Label as LabelPrimitive, Slot } from "radix-ui";
+import { type Label as LabelPrimitive, Slot } from "radix-ui";
 import * as React from "react";
 import {
 	Controller,

apps/dokploy/components/ui/input-group.tsx

@@ -1,12 +1,11 @@
 "use client";
 
-import * as React from "react";
 import { cva, type VariantProps } from "class-variance-authority";
-
-import { cn } from "@/lib/utils";
+import type * as React from "react";
 import { Button } from "@/components/ui/button";
 import { Input } from "@/components/ui/input";
 import { Textarea } from "@/components/ui/textarea";
+import { cn } from "@/lib/utils";
 
 function InputGroup({ className, ...props }: React.ComponentProps<"div">) {
 	return (

apps/dokploy/components/ui/input-otp.tsx

@@ -1,8 +1,7 @@
-import * as React from "react";
 import { OTPInput, OTPInputContext } from "input-otp";
-
-import { cn } from "@/lib/utils";
 import { MinusIcon } from "lucide-react";
+import * as React from "react";
+import { cn } from "@/lib/utils";
 
 function InputOTP({
 	className,

apps/dokploy/components/ui/label.tsx

@@ -1,5 +1,5 @@
-import * as React from "react";
 import { Label as LabelPrimitive } from "radix-ui";
+import type * as React from "react";
 
 import { cn } from "@/lib/utils";
 

apps/dokploy/components/ui/popover.tsx

@@ -1,10 +1,9 @@
 "use client";
 
-import * as React from "react";
 import { Popover as PopoverPrimitive } from "radix-ui";
-
-import { cn } from "@/lib/utils";
+import type * as React from "react";
 import { markNestedPopupClosed } from "@/components/ui/nested-popup-context";
+import { cn } from "@/lib/utils";
 
 function Popover({
 	onOpenChange,

apps/dokploy/components/ui/progress.tsx

@@ -1,5 +1,5 @@
-import * as React from "react";
 import { Progress as ProgressPrimitive } from "radix-ui";
+import type * as React from "react";
 
 import { cn } from "@/lib/utils";
 

apps/dokploy/components/ui/radio-group.tsx

@@ -1,7 +1,7 @@
 "use client";
 
-import * as React from "react";
 import { RadioGroup as RadioGroupPrimitive } from "radix-ui";
+import type * as React from "react";
 
 import { cn } from "@/lib/utils";
 

apps/dokploy/components/ui/scroll-area.tsx

@@ -1,5 +1,5 @@
-import * as React from "react";
 import { ScrollArea as ScrollAreaPrimitive } from "radix-ui";
+import type * as React from "react";
 
 import { cn } from "@/lib/utils";
 

apps/dokploy/components/ui/select.tsx

@@ -1,8 +1,7 @@
-import * as React from "react";
+import { CheckIcon, ChevronDownIcon, ChevronUpIcon } from "lucide-react";
 import { Select as SelectPrimitive } from "radix-ui";
-
+import type * as React from "react";
 import { cn } from "@/lib/utils";
-import { ChevronDownIcon, CheckIcon, ChevronUpIcon } from "lucide-react";
 
 function Select({
 	...props

apps/dokploy/components/ui/separator.tsx

@@ -1,5 +1,5 @@
-import * as React from "react";
 import { Separator as SeparatorPrimitive } from "radix-ui";
+import type * as React from "react";
 
 import { cn } from "@/lib/utils";
 

apps/dokploy/components/ui/sheet.tsx

@@ -1,9 +1,8 @@
-import * as React from "react";
-import { Dialog as SheetPrimitive } from "radix-ui";
-
-import { cn } from "@/lib/utils";
-import { Button } from "@/components/ui/button";
 import { XIcon } from "lucide-react";
+import { Dialog as SheetPrimitive } from "radix-ui";
+import type * as React from "react";
+import { Button } from "@/components/ui/button";
+import { cn } from "@/lib/utils";
 
 function Sheet({ ...props }: React.ComponentProps<typeof SheetPrimitive.Root>) {
 	return <SheetPrimitive.Root data-slot="sheet" {...props} />;

apps/dokploy/components/ui/sidebar.tsx

@@ -368,7 +368,7 @@ function SidebarContent({ className, ...props }: React.ComponentProps<"div">) {
 			data-slot="sidebar-content"
 			data-sidebar="content"
 			className={cn(
-				"no-scrollbar flex min-h-0 flex-1 flex-col gap-2 overflow-auto group-data-[collapsible=icon]:overflow-hidden",
+				"no-scrollbar flex min-h-0 flex-1 flex-col gap-2 overflow-y-auto overflow-x-hidden",
 				className,
 			)}
 			{...props}

apps/dokploy/components/ui/sonner.tsx

@@ -1,14 +1,14 @@
 "use client";
 
-import { useTheme } from "next-themes";
-import { Toaster as Sonner, type ToasterProps } from "sonner";
 import {
 	CircleCheckIcon,
 	InfoIcon,
-	TriangleAlertIcon,
-	OctagonXIcon,
 	Loader2Icon,
+	OctagonXIcon,
+	TriangleAlertIcon,
 } from "lucide-react";
+import { useTheme } from "next-themes";
+import { Toaster as Sonner, type ToasterProps } from "sonner";
 
 const Toaster = ({ ...props }: ToasterProps) => {
 	const { theme = "system" } = useTheme();

apps/dokploy/components/ui/switch.tsx

@@ -1,5 +1,5 @@
-import * as React from "react";
 import { Switch as SwitchPrimitive } from "radix-ui";
+import type * as React from "react";
 
 import { cn } from "@/lib/utils";
 

apps/dokploy/components/ui/table.tsx

@@ -1,6 +1,6 @@
 "use client";
 
-import * as React from "react";
+import type * as React from "react";
 
 import { cn } from "@/lib/utils";
 

apps/dokploy/components/ui/tabs.tsx

@@ -1,6 +1,6 @@
-import * as React from "react";
 import { cva, type VariantProps } from "class-variance-authority";
 import { Tabs as TabsPrimitive } from "radix-ui";
+import type * as React from "react";
 
 import { cn } from "@/lib/utils";
 

apps/dokploy/components/ui/textarea.tsx

@@ -1,4 +1,4 @@
-import * as React from "react";
+import type * as React from "react";
 
 import { cn } from "@/lib/utils";
 

apps/dokploy/components/ui/toggle.tsx

@@ -1,8 +1,8 @@
 "use client";
 
-import * as React from "react";
 import { cva, type VariantProps } from "class-variance-authority";
 import { Toggle as TogglePrimitive } from "radix-ui";
+import type * as React from "react";
 
 import { cn } from "@/lib/utils";
 

apps/dokploy/drizzle/0173_aspiring_annihilus.sql

@@ -0,0 +1,13 @@
+CREATE TABLE "scim_provider" (
+	"id" text PRIMARY KEY NOT NULL,
+	"provider_id" text NOT NULL,
+	"scim_token" text NOT NULL,
+	"organization_id" text,
+	CONSTRAINT "scim_provider_provider_id_unique" UNIQUE("provider_id"),
+	CONSTRAINT "scim_provider_scim_token_unique" UNIQUE("scim_token")
+);
+--> statement-breakpoint
+ALTER TABLE "two_factor" ADD COLUMN "verified" boolean DEFAULT true NOT NULL;--> statement-breakpoint
+ALTER TABLE "two_factor" ADD COLUMN "failed_verification_count" integer DEFAULT 0 NOT NULL;--> statement-breakpoint
+ALTER TABLE "two_factor" ADD COLUMN "locked_until" timestamp;--> statement-breakpoint
+ALTER TABLE "scim_provider" ADD CONSTRAINT "scim_provider_organization_id_organization_id_fk" FOREIGN KEY ("organization_id") REFERENCES "public"."organization"("id") ON DELETE cascade ON UPDATE no action;

apps/dokploy/drizzle/0174_great_naoko.sql

@@ -0,0 +1 @@
+ALTER TABLE "backup" ADD COLUMN "includeEncryptionKey" boolean DEFAULT true NOT NULL;

apps/dokploy/drizzle/meta/_journal.json

@@ -1212,6 +1212,20 @@
       "when": 1781045439162,
       "tag": "0172_quick_the_professor",
       "breakpoints": true
+    },
+    {
+      "idx": 173,
+      "version": "7",
+      "when": 1783494977500,
+      "tag": "0173_aspiring_annihilus",
+      "breakpoints": true
+    },
+    {
+      "idx": 174,
+      "version": "7",
+      "when": 1783674181297,
+      "tag": "0174_great_naoko",
+      "breakpoints": true
     }
   ]
 }

apps/dokploy/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "dokploy",
-	"version": "v0.29.10",
+	"version": "v0.29.12",
 	"private": true,
 	"license": "Apache-2.0",
 	"type": "module",
@@ -47,8 +47,9 @@
 		"@ai-sdk/mistral": "^3.0.20",
 		"@ai-sdk/openai": "^3.0.29",
 		"@ai-sdk/openai-compatible": "^2.0.30",
-		"@better-auth/api-key": "1.5.4",
-		"@better-auth/sso": "1.5.4",
+		"@better-auth/api-key": "1.6.23",
+		"@better-auth/scim": "1.6.23",
+		"@better-auth/sso": "1.6.23",
 		"@codemirror/autocomplete": "^6.18.6",
 		"@codemirror/lang-css": "^6.3.1",
 		"@codemirror/lang-json": "^6.0.1",
@@ -82,7 +83,7 @@
 		"ai": "^6.0.86",
 		"ai-sdk-ollama": "^3.7.0",
 		"bcrypt": "5.1.1",
-		"better-auth": "1.5.4",
+		"better-auth": "1.6.23",
 		"bl": "6.0.11",
 		"boxen": "^7.1.1",
 		"bullmq": "5.67.3",
@@ -94,7 +95,7 @@
 		"dockerode": "4.0.2",
 		"dompurify": "^3.3.3",
 		"dotenv": "16.4.5",
-		"drizzle-orm": "0.45.1",
+		"drizzle-orm": "0.45.2",
 		"drizzle-zod": "0.8.3",
 		"fancy-ansi": "^0.1.3",
 		"input-otp": "^1.4.2",

apps/dokploy/pages/dashboard/project/[projectId]/environment/[environmentId].tsx

@@ -1039,7 +1039,9 @@ const EnvironmentPage = (
 							<CardHeader className="p-0">
 								<CardTitle className="text-xl flex flex-row gap-2 items-center">
 									<FolderInput className="size-6 text-muted-foreground self-center" />
-									{currentEnvironment.project.name}
+									<p className="text-base font-medium max-w-[250px] truncate">
+										{currentEnvironment.project.name}
+									</p>
 									<AdvancedEnvironmentSelector
 										projectId={projectId}
 										currentEnvironmentId={environmentId}

apps/dokploy/pages/dashboard/settings/deployments.tsx

@@ -29,8 +29,6 @@ const Page = () => {
 							<CardDescription>
 								Configure how many deployments can build at the same time on
 								each server. Builds of the same service are always serialized.
-								Free plan allows up to 2 concurrent builds; an enterprise
-								license unlocks more.
 							</CardDescription>
 						</CardHeader>
 						<CardContent className="flex flex-col gap-6">

apps/dokploy/pages/dashboard/settings/sso.tsx

@@ -54,20 +54,6 @@ const Page = ({ isCloud }: Props) => {
 						</EnterpriseFeatureGate>
 					</div>
 				</Card>
-				<Card className="h-full bg-sidebar p-2.5 rounded-xl mx-auto w-full">
-					<div className="rounded-xl bg-background shadow-md">
-						<EnterpriseFeatureGate
-							lockedProps={{
-								title: "Application Authentication",
-								description:
-									"Protect deployed applications behind an OIDC SSO gate (oauth2-proxy). Part of Dokploy Enterprise.",
-								ctaLabel: "Go to License",
-							}}
-						>
-							<ForwardAuthServers />
-						</EnterpriseFeatureGate>
-					</div>
-				</Card>
 				{!isCloud && (
 					<Card className="h-full bg-sidebar p-2.5 rounded-xl mx-auto w-full">
 						<div className="rounded-xl bg-background shadow-md">

apps/dokploy/pages/index.tsx

@@ -310,7 +310,7 @@ export default function Home({ IS_CLOUD, enforceSSO }: Props) {
 								</button>
 							</div>
 
-							<div className="flex gap-4">
+							<div className="grid grid-cols-2 gap-4">
 								<Button
 									variant="outline"
 									className="w-full"

apps/dokploy/server/api/root.ts

@@ -32,6 +32,7 @@ import { auditLogRouter } from "./routers/proprietary/audit-log";
 import { customRoleRouter } from "./routers/proprietary/custom-role";
 import { forwardAuthRouter } from "./routers/proprietary/forward-auth";
 import { licenseKeyRouter } from "./routers/proprietary/license-key";
+import { scimRouter } from "./routers/proprietary/scim";
 import { ssoRouter } from "./routers/proprietary/sso";
 import { whitelabelingRouter } from "./routers/proprietary/whitelabeling";
 import { redirectsRouter } from "./routers/redirects";
@@ -94,6 +95,7 @@ export const appRouter = createTRPCRouter({
 	organization: organizationRouter,
 	licenseKey: licenseKeyRouter,
 	sso: ssoRouter,
+	scim: scimRouter,
 	forwardAuth: forwardAuthRouter,
 	whitelabeling: whitelabelingRouter,
 	customRole: customRoleRouter,

apps/dokploy/server/api/routers/proprietary/scim.ts

@@ -0,0 +1,75 @@
+import { db } from "@dokploy/server/db";
+import { scimProvider } from "@dokploy/server/db/schema";
+import { requestToHeaders } from "@dokploy/server/index";
+import { auth } from "@dokploy/server/lib/auth";
+import { TRPCError } from "@trpc/server";
+import { and, asc, eq } from "drizzle-orm";
+import { z } from "zod";
+import { createTRPCRouter, enterpriseProcedure } from "@/server/api/trpc";
+
+const providerIdSchema = z
+	.string()
+	.min(1)
+	.max(64)
+	.regex(
+		/^[a-z0-9][a-z0-9-]*$/,
+		"Provider ID must be lowercase alphanumeric with optional dashes",
+	);
+
+export const scimRouter = createTRPCRouter({
+	listProviders: enterpriseProcedure.query(async ({ ctx }) => {
+		const providers = await db.query.scimProvider.findMany({
+			where: eq(scimProvider.organizationId, ctx.session.activeOrganizationId),
+			columns: {
+				id: true,
+				providerId: true,
+				organizationId: true,
+			},
+			orderBy: [asc(scimProvider.providerId)],
+		});
+		return providers;
+	}),
+	generateToken: enterpriseProcedure
+		.input(z.object({ providerId: providerIdSchema }))
+		.mutation(async ({ ctx, input }) => {
+			const existing = await db.query.scimProvider.findFirst({
+				where: eq(scimProvider.providerId, input.providerId),
+				columns: { id: true, organizationId: true },
+			});
+			if (existing) {
+				throw new TRPCError({
+					code: "BAD_REQUEST",
+					message: "A SCIM provider with this ID already exists",
+				});
+			}
+			const result = await auth.generateSCIMToken({
+				body: {
+					providerId: input.providerId,
+					organizationId: ctx.session.activeOrganizationId,
+				},
+				headers: requestToHeaders(ctx.req),
+			});
+			return { scimToken: result.scimToken, providerId: input.providerId };
+		}),
+	deleteProvider: enterpriseProcedure
+		.input(z.object({ providerId: providerIdSchema }))
+		.mutation(async ({ ctx, input }) => {
+			const [deleted] = await db
+				.delete(scimProvider)
+				.where(
+					and(
+						eq(scimProvider.providerId, input.providerId),
+						eq(scimProvider.organizationId, ctx.session.activeOrganizationId),
+					),
+				)
+				.returning({ id: scimProvider.id });
+			if (!deleted) {
+				throw new TRPCError({
+					code: "NOT_FOUND",
+					message:
+						"SCIM provider not found or you do not have permission to delete it",
+				});
+			}
+			return { success: true };
+		}),
+});

apps/dokploy/server/api/routers/proprietary/sso.ts

@@ -8,6 +8,7 @@ import {
 	requestToHeaders,
 } from "@dokploy/server/index";
 import { auth } from "@dokploy/server/lib/auth";
+import { invalidateTrustedOriginsCache } from "@dokploy/server/services/admin";
 import { getWebServerSettings } from "@dokploy/server/services/web-server-settings";
 import { TRPCError } from "@trpc/server";
 import { and, asc, eq } from "drizzle-orm";
@@ -319,6 +320,7 @@ export const ssoRouter = createTRPCRouter({
 				.update(user)
 				.set({ trustedOrigins: next })
 				.where(eq(user.id, ownerId));
+			invalidateTrustedOriginsCache();
 			return { success: true };
 		}),
 	removeTrustedOrigin: enterpriseProcedure
@@ -346,6 +348,7 @@ export const ssoRouter = createTRPCRouter({
 				.update(user)
 				.set({ trustedOrigins: next })
 				.where(eq(user.id, ownerId));
+			invalidateTrustedOriginsCache();
 			return { success: true };
 		}),
 	updateTrustedOrigin: enterpriseProcedure
@@ -379,6 +382,7 @@ export const ssoRouter = createTRPCRouter({
 				.update(user)
 				.set({ trustedOrigins: next })
 				.where(eq(user.id, ownerId));
+			invalidateTrustedOriginsCache();
 			return { success: true };
 		}),
 });

apps/dokploy/server/api/routers/proprietary/whitelabeling.ts

@@ -1,5 +1,7 @@
 import {
+	getPublicWhitelabelingConfig,
 	getWebServerSettings,
+	hasValidLicense,
 	IS_CLOUD,
 	updateWebServerSettings,
 } from "@dokploy/server";
@@ -13,10 +15,13 @@ import {
 } from "../../trpc";
 
 export const whitelabelingRouter = createTRPCRouter({
-	get: protectedProcedure.query(async () => {
+	get: protectedProcedure.query(async ({ ctx }) => {
 		if (IS_CLOUD) {
 			return null;
 		}
+		if (!(await hasValidLicense(ctx.session.activeOrganizationId))) {
+			return null;
+		}
 		const settings = await getWebServerSettings();
 		return settings?.whitelabelingConfig ?? null;
 	}),
@@ -82,25 +87,5 @@ export const whitelabelingRouter = createTRPCRouter({
 
 	// Public endpoint only for unauthenticated pages (login, register, error)
 	// Returns only the fields needed for public pages
-	getPublic: publicProcedure.query(async () => {
-		if (IS_CLOUD) {
-			return null;
-		}
-		const settings = await getWebServerSettings();
-		const config = settings?.whitelabelingConfig;
-		if (!config) return null;
-
-		return {
-			appName: config.appName,
-			appDescription: config.appDescription,
-			logoUrl: config.logoUrl,
-			loginLogoUrl: config.loginLogoUrl,
-			faviconUrl: config.faviconUrl,
-			customCss: config.customCss,
-			metaTitle: config.metaTitle,
-			errorPageTitle: config.errorPageTitle,
-			errorPageDescription: config.errorPageDescription,
-			footerText: config.footerText,
-		};
-	}),
+	getPublic: publicProcedure.query(() => getPublicWhitelabelingConfig()),
 });

apps/dokploy/server/api/routers/server.ts

@@ -46,7 +46,6 @@ import {
 	redis,
 	server,
 } from "@/server/db/schema";
-import { assertBuildsConcurrencyAllowed } from "@/server/queues/concurrency";
 import { applyDockerCleanupSchedule } from "@/server/utils/docker-cleanup";
 
 export const serverRouter = createTRPCRouter({
@@ -491,10 +490,6 @@ export const serverRouter = createTRPCRouter({
 					message: "You are not authorized to update this server",
 				});
 			}
-			await assertBuildsConcurrencyAllowed(
-				input.buildsConcurrency,
-				ctx.session.activeOrganizationId,
-			);
 			return await updateServerById(input.serverId, {
 				buildsConcurrency: input.buildsConcurrency,
 			});

apps/dokploy/server/api/routers/settings.ts

@@ -71,7 +71,6 @@ import {
 	projects,
 	server,
 } from "@/server/db/schema";
-import { assertBuildsConcurrencyAllowed } from "@/server/queues/concurrency";
 import { cleanAllDeploymentQueue } from "@/server/queues/queueSetup";
 import { removeJob, schedule } from "@/server/utils/backup";
 import packageInfo from "../../../package.json";
@@ -480,11 +479,6 @@ export const settingsRouter = createTRPCRouter({
 				});
 			}
 
-			await assertBuildsConcurrencyAllowed(
-				input.buildsConcurrency,
-				ctx.session.activeOrganizationId,
-			);
-
 			await updateWebServerSettings({
 				buildsConcurrency: input.buildsConcurrency,
 			});

apps/dokploy/server/queues/concurrency.ts

@@ -1,32 +1,30 @@
 import { db } from "@dokploy/server/db";
-import { organization, server } from "@dokploy/server/db/schema";
-import { hasValidLicense } from "@dokploy/server/services/proprietary/license-key";
+import { server } from "@dokploy/server/db/schema";
 import { getWebServerSettings } from "@dokploy/server/services/web-server-settings";
-import { TRPCError } from "@trpc/server";
 import { eq } from "drizzle-orm";
 import { LOCAL_PARTITION } from "./in-memory-queue";
 
 /**
  * Resolve the effective builds concurrency for a queue partition.
  *
- * Concurrent deployments (concurrency > 1) are an enterprise feature: without a
- * valid license the effective concurrency is always clamped to 1, so the
- * community experience is unchanged and an expired license degrades gracefully
- * back to sequential deployments instead of breaking anything.
- *
  * - `LOCAL_PARTITION` -> concurrency stored on the web server settings (the
- *   local Dokploy web server), gated by the owner organization's license.
- * - any other partition -> concurrency stored on the matching `server` row,
- *   gated by that server's organization license.
+ *   local Dokploy web server).
+ * - any other partition -> concurrency stored on the matching `server` row.
  */
 export const resolveBuildsConcurrency = async (
 	partition: string,
 ): Promise<number> => {
 	try {
 		if (partition === LOCAL_PARTITION) {
-			return await resolveLocalConcurrency();
+			const settings = await getWebServerSettings();
+			return normalize(settings?.buildsConcurrency ?? 1);
 		}
-		return await resolveServerConcurrency(partition);
+
+		const currentServer = await db.query.server.findFirst({
+			where: eq(server.serverId, partition),
+			columns: { buildsConcurrency: true },
+		});
+		return normalize(currentServer?.buildsConcurrency ?? 1);
 	} catch (error) {
 		console.error(
 			"Failed to resolve builds concurrency, defaulting to 1",
@@ -36,55 +34,4 @@ export const resolveBuildsConcurrency = async (
 	}
 };
 
-// Max concurrent builds allowed without an enterprise license. With a valid
-// license the value is unbounded (N) — only the free tier is capped.
-export const FREE_MAX_CONCURRENCY = 2;
-
-const clamp = (value: number, licensed: boolean): number => {
-	const min = Math.max(1, Math.floor(value));
-	return licensed ? min : Math.min(FREE_MAX_CONCURRENCY, min);
-};
-
-/**
- * Validate a requested builds-concurrency value before persisting it. Free tier
- * may set up to FREE_MAX_CONCURRENCY; anything higher requires a valid
- * enterprise license. Throws a TRPCError when the value is not allowed.
- */
-export const assertBuildsConcurrencyAllowed = async (
-	value: number,
-	organizationId: string,
-): Promise<void> => {
-	if (value <= FREE_MAX_CONCURRENCY) return;
-	const licensed = await hasValidLicense(organizationId);
-	if (!licensed) {
-		throw new TRPCError({
-			code: "FORBIDDEN",
-			message: `A valid enterprise license is required to set more than ${FREE_MAX_CONCURRENCY} concurrent builds.`,
-		});
-	}
-};
-
-const resolveLocalConcurrency = async (): Promise<number> => {
-	const settings = await getWebServerSettings();
-	const buildsConcurrency = settings?.buildsConcurrency ?? 1;
-
-	// Self-hosted is single-tenant; gate on any organization's license.
-	const anyOrg = await db.query.organization.findFirst({
-		columns: { id: true },
-	});
-	const licensed = anyOrg ? await hasValidLicense(anyOrg.id) : false;
-
-	return clamp(buildsConcurrency, licensed);
-};
-
-const resolveServerConcurrency = async (serverId: string): Promise<number> => {
-	const currentServer = await db.query.server.findFirst({
-		where: eq(server.serverId, serverId),
-		columns: { buildsConcurrency: true, organizationId: true },
-	});
-
-	if (!currentServer) return 1;
-
-	const licensed = await hasValidLicense(currentServer.organizationId);
-	return clamp(currentServer.buildsConcurrency, licensed);
-};
+const normalize = (value: number): number => Math.max(1, Math.floor(value));

apps/dokploy/server/queues/queueSetup.ts

@@ -12,8 +12,8 @@ import type { DeploymentJob } from "./queue-types";
  * Deployment queue.
  *
  * Self-hosted uses an in-memory, per-group FIFO queue with configurable
- * concurrency per server (enterprise-gated). Cloud does not use the queue at
- * all — deployments run directly in the background — so we expose a no-op.
+ * concurrency per server. Cloud does not use the queue at all — deployments
+ * run directly in the background — so we expose a no-op.
  */
 
 interface DeploymentQueue {

package.json

@@ -46,7 +46,9 @@
 	},
 	"pnpm": {
 		"overrides": {
-			"esbuild": "0.20.2"
+			"esbuild": "0.20.2",
+			"better-call": "1.3.7",
+			"@better-fetch/fetch": "1.3.1"
 		},
 		"peerDependencyRules": {
 			"ignoreMissing": [

packages/server/auth-schema2.ts

@@ -22,6 +22,9 @@ export const user = pgTable("user", {
 		.notNull(),
 	twoFactorEnabled: boolean("two_factor_enabled").default(false),
 	role: text("role"),
+	banned: boolean("banned").default(false),
+	banReason: text("ban_reason"),
+	banExpires: timestamp("ban_expires"),
 	ownerId: text("owner_id"),
 	allowImpersonation: boolean("allow_impersonation").default(false),
 	lastName: text("last_name").default(""),
@@ -45,6 +48,7 @@ export const session = pgTable(
 			.notNull()
 			.references(() => user.id, { onDelete: "cascade" }),
 		activeOrganizationId: text("active_organization_id"),
+		impersonatedBy: text("impersonated_by"),
 	},
 	(table) => [index("session_userId_idx").on(table.userId)],
 );
@@ -142,6 +146,9 @@ export const twoFactor = pgTable(
 		userId: text("user_id")
 			.notNull()
 			.references(() => user.id, { onDelete: "cascade" }),
+		verified: boolean("verified").default(true),
+		failedVerificationCount: integer("failed_verification_count").default(0),
+		lockedUntil: timestamp("locked_until"),
 	},
 	(table) => [
 		index("twoFactor_secret_idx").on(table.secret),
@@ -223,6 +230,13 @@ export const invitation = pgTable(
 	],
 );
 
+export const scimProvider = pgTable("scim_provider", {
+	id: text("id").primaryKey(),
+	providerId: text("provider_id").notNull().unique(),
+	scimToken: text("scim_token").notNull().unique(),
+	organizationId: text("organization_id"),
+});
+
 export const userRelations = relations(user, ({ many }) => ({
 	sessions: many(session),
 	accounts: many(account),

packages/server/package.json

@@ -37,9 +37,10 @@
     "@ai-sdk/mistral": "^3.0.20",
     "@ai-sdk/openai": "^3.0.29",
     "@ai-sdk/openai-compatible": "^2.0.30",
-    "@better-auth/api-key": "1.5.4",
-    "@better-auth/sso": "1.5.4",
-    "@better-auth/utils": "0.3.1",
+    "@better-auth/api-key": "1.6.23",
+    "@better-auth/scim": "1.6.23",
+    "@better-auth/sso": "1.6.23",
+    "@better-auth/utils": "0.4.2",
     "@faker-js/faker": "^8.4.1",
     "@octokit/auth-app": "^6.1.3",
     "@octokit/rest": "^20.1.2",
@@ -51,15 +52,14 @@
     "ai": "^6.0.86",
     "ai-sdk-ollama": "^3.7.0",
     "bcrypt": "5.1.1",
-    "better-auth": "1.5.4",
-    "better-call": "2.0.2",
+    "better-auth": "1.6.23",
     "bl": "6.0.11",
     "boxen": "^7.1.1",
     "date-fns": "3.6.0",
     "dockerode": "4.0.2",
     "dotenv": "16.4.5",
     "drizzle-dbml-generator": "0.10.0",
-    "drizzle-orm": "0.45.1",
+    "drizzle-orm": "0.45.2",
     "drizzle-zod": "0.5.1",
     "lodash": "4.17.21",
     "micromatch": "4.0.8",
@@ -87,7 +87,6 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@better-auth/cli": "1.4.21",
     "@types/adm-zip": "^0.5.7",
     "@types/bcrypt": "5.0.2",
     "@types/dockerode": "3.3.23",

packages/server/src/constants/index.ts

@@ -81,7 +81,17 @@ const getDockerConfig = (): Docker => {
 	return new Docker({ ...versionOption });
 };
 
-export const docker = getDockerConfig();
+// Igual que db: el módulo se evalúa una vez por copia bundleada, el cache
+// evita crear un cliente (y loguear la detección del socket) por cada una.
+const globalForDocker = globalThis as unknown as {
+	docker?: Docker;
+};
+
+if (!globalForDocker.docker) {
+	globalForDocker.docker = getDockerConfig();
+}
+
+export const docker = globalForDocker.docker;
 
 export const paths = (isServer = false) => {
 	const BASE_PATH =

packages/server/src/db/index.ts

@@ -9,32 +9,19 @@ export * from "./schema";
 
 type Database = PostgresJsDatabase<typeof schema>;
 
-/**
- * Evita problemas de redeclaración global en monorepos.
- * No usamos `declare global`.
- */
+// Este módulo se evalúa varias veces por proceso (copias duplicadas por
+// esbuild y los chunks de Next); el cache en globalThis garantiza un solo
+// pool de conexiones por proceso.
 const globalForDb = globalThis as unknown as {
 	db?: Database;
 };
 
-let dbConnection: Database;
-
-if (process.env.NODE_ENV === "production") {
-	// En producción no usamos global cache
-	dbConnection = drizzle(postgres(dbUrl), {
+if (!globalForDb.db) {
+	globalForDb.db = drizzle(postgres(dbUrl), {
 		schema,
 	});
-} else {
-	// En desarrollo reutilizamos conexión para evitar múltiples conexiones
-	if (!globalForDb.db) {
-		globalForDb.db = drizzle(postgres(dbUrl), {
-			schema,
-		});
-	}
-
-	dbConnection = globalForDb.db;
 }
 
-export const db: Database = dbConnection;
+export const db: Database = globalForDb.db;
 
 export { dbUrl };

packages/server/src/db/schema/account.ts

@@ -214,6 +214,11 @@ export const twoFactor = pgTable("two_factor", {
 	userId: text("user_id")
 		.notNull()
 		.references(() => user.id, { onDelete: "cascade" }),
+	verified: boolean("verified").notNull().default(true),
+	failedVerificationCount: integer("failed_verification_count")
+		.notNull()
+		.default(0),
+	lockedUntil: timestamp("locked_until"),
 });
 
 export const apikey = pgTable("apikey", {

packages/server/src/db/schema/application.ts

@@ -51,7 +51,12 @@ import {
 	UpdateConfigSwarmSchema,
 } from "./shared";
 import { sshKeys } from "./ssh-key";
-import { APP_NAME_MESSAGE, APP_NAME_REGEX, generateAppName } from "./utils";
+import {
+	APP_NAME_MESSAGE,
+	APP_NAME_REGEX,
+	encryptedText,
+	generateAppName,
+} from "./utils";
 export const sourceType = pgEnum("sourceType", [
 	"docker",
 	"git",
@@ -82,11 +87,11 @@ export const applications = pgTable("application", {
 		.$defaultFn(() => generateAppName("app"))
 		.unique(),
 	description: text("description"),
-	env: text("env"),
-	previewEnv: text("previewEnv"),
+	env: encryptedText("env"),
+	previewEnv: encryptedText("previewEnv"),
 	watchPaths: text("watchPaths").array(),
-	previewBuildArgs: text("previewBuildArgs"),
-	previewBuildSecrets: text("previewBuildSecrets"),
+	previewBuildArgs: encryptedText("previewBuildArgs"),
+	previewBuildSecrets: encryptedText("previewBuildSecrets"),
 	previewLabels: text("previewLabels").array(),
 	previewWildcard: text("previewWildcard"),
 	previewPort: integer("previewPort").default(3000),
@@ -105,8 +110,8 @@ export const applications = pgTable("application", {
 		"previewRequireCollaboratorPermissions",
 	).default(true),
 	rollbackActive: boolean("rollbackActive").default(false),
-	buildArgs: text("buildArgs"),
-	buildSecrets: text("buildSecrets"),
+	buildArgs: encryptedText("buildArgs"),
+	buildSecrets: encryptedText("buildSecrets"),
 	memoryReservation: text("memoryReservation"),
 	memoryLimit: text("memoryLimit"),
 	cpuReservation: text("cpuReservation"),

packages/server/src/db/schema/backups.ts

@@ -50,6 +50,7 @@ export const backups = pgTable("backup", {
 		.notNull()
 		.references(() => destinations.destinationId, { onDelete: "cascade" }),
 	keepLatestCount: integer("keepLatestCount"),
+	includeEncryptionKey: boolean("includeEncryptionKey").notNull().default(true),
 	backupType: backupType("backupType").notNull().default("database"),
 	databaseType: databaseType("databaseType").notNull(),
 	composeId: text("composeId").references(
@@ -160,6 +161,7 @@ const createSchema = createInsertSchema(backups, {
 	mongoId: z.string().optional(),
 	libsqlId: z.string().optional(),
 	userId: z.string().optional(),
+	includeEncryptionKey: z.boolean().optional(),
 	metadata: z.any().optional(),
 });
 
@@ -180,6 +182,7 @@ export const apiCreateBackup = createSchema.pick({
 	backupType: true,
 	composeId: true,
 	serviceName: true,
+	includeEncryptionKey: true,
 	metadata: true,
 });
 
@@ -206,7 +209,10 @@ export const apiUpdateBackup = createSchema
 		metadata: true,
 		databaseType: true,
 	})
-	.required();
+	.required()
+	.extend({
+		includeEncryptionKey: z.boolean().optional(),
+	});
 
 export const apiRestoreBackup = z.object({
 	databaseId: z.string(),

packages/server/src/db/schema/compose.ts

@@ -17,7 +17,12 @@ import { schedules } from "./schedule";
 import { server } from "./server";
 import { applicationStatus, triggerType } from "./shared";
 import { sshKeys } from "./ssh-key";
-import { APP_NAME_MESSAGE, APP_NAME_REGEX, generateAppName } from "./utils";
+import {
+	APP_NAME_MESSAGE,
+	APP_NAME_REGEX,
+	encryptedText,
+	generateAppName,
+} from "./utils";
 export const sourceTypeCompose = pgEnum("sourceTypeCompose", [
 	"git",
 	"github",
@@ -39,7 +44,7 @@ export const compose = pgTable("compose", {
 		.notNull()
 		.$defaultFn(() => generateAppName("compose")),
 	description: text("description"),
-	env: text("env"),
+	env: encryptedText("env"),
 	composeFile: text("composeFile").notNull().default(""),
 	refreshToken: text("refreshToken").$defaultFn(() => nanoid()),
 	sourceType: sourceTypeCompose("sourceType").notNull().default("github"),

packages/server/src/db/schema/environment.ts

@@ -11,6 +11,7 @@ import { mysql } from "./mysql";
 import { postgres } from "./postgres";
 import { projects } from "./project";
 import { redis } from "./redis";
+import { encryptedText } from "./utils";
 
 export const environments = pgTable("environment", {
 	environmentId: text("environmentId")
@@ -22,7 +23,7 @@ export const environments = pgTable("environment", {
 	createdAt: text("createdAt")
 		.notNull()
 		.$defaultFn(() => new Date().toISOString()),
-	env: text("env").notNull().default(""),
+	env: encryptedText("env").notNull().default(""),
 	projectId: text("projectId")
 		.notNull()
 		.references(() => projects.projectId, { onDelete: "cascade" }),

packages/server/src/db/schema/index.ts

@@ -31,6 +31,7 @@ export * from "./redis";
 export * from "./registry";
 export * from "./rollbacks";
 export * from "./schedule";
+export * from "./scim";
 export * from "./security";
 export * from "./server";
 export * from "./session";

packages/server/src/db/schema/libsql.ts

@@ -37,6 +37,7 @@ import {
 import {
 	DATABASE_PASSWORD_MESSAGE,
 	DATABASE_PASSWORD_REGEX,
+	encryptedText,
 	generateAppName,
 } from "./utils";
 
@@ -58,7 +59,7 @@ export const libsql = pgTable("libsql", {
 	enableNamespaces: boolean("enableNamespaces").notNull().default(false),
 	dockerImage: text("dockerImage").notNull(),
 	command: text("command"),
-	env: text("env"),
+	env: encryptedText("env"),
 	// RESOURCES
 	memoryReservation: text("memoryReservation"),
 	memoryLimit: text("memoryLimit"),

packages/server/src/db/schema/mariadb.ts

@@ -33,6 +33,7 @@ import {
 	APP_NAME_REGEX,
 	DATABASE_PASSWORD_MESSAGE,
 	DATABASE_PASSWORD_REGEX,
+	encryptedText,
 	generateAppName,
 } from "./utils";
 
@@ -54,7 +55,7 @@ export const mariadb = pgTable("mariadb", {
 	dockerImage: text("dockerImage").notNull(),
 	command: text("command"),
 	args: text("args").array(),
-	env: text("env"),
+	env: encryptedText("env"),
 	// RESOURCES
 	memoryReservation: text("memoryReservation"),
 	memoryLimit: text("memoryLimit"),

packages/server/src/db/schema/mongo.ts

@@ -40,6 +40,7 @@ import {
 	APP_NAME_REGEX,
 	DATABASE_PASSWORD_MESSAGE,
 	DATABASE_PASSWORD_REGEX,
+	encryptedText,
 	generateAppName,
 } from "./utils";
 
@@ -59,7 +60,7 @@ export const mongo = pgTable("mongo", {
 	dockerImage: text("dockerImage").notNull().default("mongo:8"),
 	command: text("command"),
 	args: text("args").array(),
-	env: text("env"),
+	env: encryptedText("env"),
 	memoryReservation: text("memoryReservation"),
 	memoryLimit: text("memoryLimit"),
 	cpuReservation: text("cpuReservation"),

packages/server/src/db/schema/mysql.ts

@@ -33,6 +33,7 @@ import {
 	APP_NAME_REGEX,
 	DATABASE_PASSWORD_MESSAGE,
 	DATABASE_PASSWORD_REGEX,
+	encryptedText,
 	generateAppName,
 } from "./utils";
 
@@ -54,7 +55,7 @@ export const mysql = pgTable("mysql", {
 	dockerImage: text("dockerImage").notNull(),
 	command: text("command"),
 	args: text("args").array(),
-	env: text("env"),
+	env: encryptedText("env"),
 	memoryReservation: text("memoryReservation"),
 	memoryLimit: text("memoryLimit"),
 	cpuReservation: text("cpuReservation"),

packages/server/src/db/schema/postgres.ts

@@ -33,6 +33,7 @@ import {
 	APP_NAME_REGEX,
 	DATABASE_PASSWORD_MESSAGE,
 	DATABASE_PASSWORD_REGEX,
+	encryptedText,
 	generateAppName,
 } from "./utils";
 
@@ -53,7 +54,7 @@ export const postgres = pgTable("postgres", {
 	dockerImage: text("dockerImage").notNull(),
 	command: text("command"),
 	args: text("args").array(),
-	env: text("env"),
+	env: encryptedText("env"),
 	memoryReservation: text("memoryReservation"),
 	externalPort: integer("externalPort"),
 	memoryLimit: text("memoryLimit"),

packages/server/src/db/schema/project.ts

@@ -6,6 +6,7 @@ import { z } from "zod";
 import { organization } from "./account";
 import { environments } from "./environment";
 import { projectTags } from "./tag";
+import { encryptedText } from "./utils";
 
 export const projects = pgTable("project", {
 	projectId: text("projectId")
@@ -21,7 +22,7 @@ export const projects = pgTable("project", {
 	organizationId: text("organizationId")
 		.notNull()
 		.references(() => organization.id, { onDelete: "cascade" }),
-	env: text("env").notNull().default(""),
+	env: encryptedText("env").notNull().default(""),
 });
 
 export const projectRelations = relations(projects, ({ many, one }) => ({
@@ -37,6 +38,7 @@ const createSchema = createInsertSchema(projects, {
 	projectId: z.string().min(1),
 	name: z.string().min(1),
 	description: z.string().optional(),
+	env: z.string().optional(),
 });
 
 export const apiCreateProject = createSchema.pick({

packages/server/src/db/schema/redis.ts

@@ -27,7 +27,12 @@ import {
 	type UpdateConfigSwarm,
 	UpdateConfigSwarmSchema,
 } from "./shared";
-import { APP_NAME_MESSAGE, APP_NAME_REGEX, generateAppName } from "./utils";
+import {
+	APP_NAME_MESSAGE,
+	APP_NAME_REGEX,
+	encryptedText,
+	generateAppName,
+} from "./utils";
 
 export const redis = pgTable("redis", {
 	redisId: text("redisId")
@@ -44,7 +49,7 @@ export const redis = pgTable("redis", {
 	dockerImage: text("dockerImage").notNull(),
 	command: text("command"),
 	args: text("args").array(),
-	env: text("env"),
+	env: encryptedText("env"),
 	memoryReservation: text("memoryReservation"),
 	memoryLimit: text("memoryLimit"),
 	cpuReservation: text("cpuReservation"),

packages/server/src/db/schema/scim.ts

@@ -0,0 +1,22 @@
+import { relations } from "drizzle-orm";
+import { pgTable, text } from "drizzle-orm/pg-core";
+import { nanoid } from "nanoid";
+import { organization } from "./account";
+
+export const scimProvider = pgTable("scim_provider", {
+	id: text("id")
+		.primaryKey()
+		.$defaultFn(() => nanoid()),
+	providerId: text("provider_id").notNull().unique(),
+	scimToken: text("scim_token").notNull().unique(),
+	organizationId: text("organization_id").references(() => organization.id, {
+		onDelete: "cascade",
+	}),
+});
+
+export const scimProviderRelations = relations(scimProvider, ({ one }) => ({
+	organization: one(organization, {
+		fields: [scimProvider.organizationId],
+		references: [organization.id],
+	}),
+}));

packages/server/src/db/schema/utils.ts

@@ -1,7 +1,36 @@
+import { decryptValue, encryptValue } from "@dokploy/server/lib/encryption";
 import { generatePassword } from "@dokploy/server/templates";
 import { faker } from "@faker-js/faker";
+import { customType } from "drizzle-orm/pg-core";
 import { customAlphabet } from "nanoid";
 
+/**
+ * Text column encrypted at rest (AES-256-GCM, key derived from
+ * BETTER_AUTH_SECRET). Legacy plaintext values are passed through on read
+ * and get encrypted the next time they are written.
+ */
+export const encryptedText = customType<{ data: string; driverData: string }>({
+	dataType() {
+		return "text";
+	},
+	toDriver(value) {
+		return encryptValue(value);
+	},
+	fromDriver(value) {
+		try {
+			return decryptValue(value);
+		} catch {
+			// Fail open so a key mismatch (e.g. restoring a backup under a
+			// different BETTER_AUTH_SECRET) degrades to showing ciphertext
+			// instead of breaking every query that touches the row.
+			console.error(
+				"Failed to decrypt an encrypted column; returning the raw value. This usually means BETTER_AUTH_SECRET changed after the value was encrypted.",
+			);
+			return value;
+		}
+	},
+});
+
 const alphabet = "abcdefghijklmnopqrstuvwxyz123456789";
 
 const customNanoid = customAlphabet(alphabet, 6);

packages/server/src/db/schema/web-server-settings.ts

@@ -105,7 +105,7 @@ export const webServerSettings = pgTable("webServerSettings", {
 		}),
 	// Deployment Configuration (self-hosted only)
 	remoteServersOnly: boolean("remoteServersOnly").notNull().default(false),
-	// Concurrent builds on the local web server (enterprise-gated to > 1)
+	// Concurrent builds on the local web server
 	buildsConcurrency: integer("buildsConcurrency").notNull().default(1),
 	// Auth Configuration (self-hosted only)
 	enforceSSO: boolean("enforceSSO").notNull().default(false),

packages/server/src/index.ts

@@ -38,6 +38,7 @@ export * from "./services/project";
 export * from "./services/proprietary/forward-auth";
 export * from "./services/proprietary/license-key";
 export * from "./services/proprietary/sso";
+export * from "./services/proprietary/whitelabeling";
 export * from "./services/redirect";
 export * from "./services/redis";
 export * from "./services/registry";

packages/server/src/lib/auth-cli.ts

@@ -0,0 +1,47 @@
+import { apiKey } from "@better-auth/api-key";
+import { scim } from "@better-auth/scim";
+import { sso } from "@better-auth/sso";
+import { betterAuth } from "better-auth";
+import { drizzleAdapter } from "better-auth/adapters/drizzle";
+import { admin, organization, twoFactor } from "better-auth/plugins";
+import { db } from "../db";
+import * as schema from "../db/schema";
+import { ac, adminRole, memberRole, ownerRole } from "./access-control";
+
+// CLI-only config for `@better-auth/cli generate` — must mirror the plugin set
+// in auth.ts. Never import this from runtime code.
+export const auth = betterAuth({
+	database: drizzleAdapter(db, {
+		provider: "pg",
+		schema,
+	}),
+	user: {
+		modelName: "user",
+		fields: {
+			name: "firstName",
+		},
+		additionalFields: {
+			role: { type: "string", input: false },
+			ownerId: { type: "string", input: false },
+			allowImpersonation: { type: "boolean", defaultValue: false },
+			lastName: { type: "string", required: false, defaultValue: "" },
+			enableEnterpriseFeatures: { type: "boolean", required: false },
+			isValidEnterpriseLicense: { type: "boolean", required: false },
+		},
+	},
+	plugins: [
+		apiKey({ enableMetadata: true, references: "user" }),
+		sso(),
+		twoFactor(),
+		organization({
+			ac,
+			roles: { owner: ownerRole, admin: adminRole, member: memberRole },
+			dynamicAccessControl: {
+				enabled: true,
+				maximumRolesPerOrganization: 10,
+			},
+		}),
+		scim(),
+		admin(),
+	],
+});

packages/server/src/lib/auth.ts

@@ -1,10 +1,11 @@
 import type { IncomingMessage } from "node:http";
 import { apiKey } from "@better-auth/api-key";
+import { scim } from "@better-auth/scim";
 import { sso } from "@better-auth/sso";
 import * as bcrypt from "bcrypt";
 import { betterAuth } from "better-auth";
 import { drizzleAdapter } from "better-auth/adapters/drizzle";
-import { APIError } from "better-auth/api";
+import { APIError, createAuthMiddleware } from "better-auth/api";
 import { admin, organization, twoFactor } from "better-auth/plugins";
 import { and, desc, eq } from "drizzle-orm";
 import { IS_CLOUD } from "../constants";
@@ -29,404 +30,454 @@ import { getPublicIpWithFallback } from "../wss/utils";
 import { ac, adminRole, memberRole, ownerRole } from "./access-control";
 import { betterAuthSecret } from "./auth-secret";
 
-const { handler, api } = betterAuth({
-	database: drizzleAdapter(db, {
-		provider: "pg",
-		schema: schema,
-	}),
-	disabledPaths: [
-		"/sso/register",
-		"/organization/create",
-		"/organization/update",
-		"/organization/delete",
-		...(!IS_CLOUD ? ["/verify-email"] : []),
-	],
-	secret: betterAuthSecret,
-	...(!IS_CLOUD
-		? {
-				advanced: {
-					useSecureCookies: false,
-					defaultCookieAttributes: {
-						sameSite: "lax",
-						secure: false,
-						httpOnly: true,
-						path: "/",
-					},
-				},
-			}
-		: {}),
-
-	account: {
-		accountLinking: {
-			enabled: true,
-			async trustedProviders() {
-				const fromDb = await getTrustedProviders();
-				return ["github", "google", ...fromDb];
-			},
-			allowDifferentEmails: true,
-		},
-	},
-	appName: "Dokploy",
-	socialProviders: {
-		github: {
-			clientId: process.env.GITHUB_CLIENT_ID as string,
-			clientSecret: process.env.GITHUB_CLIENT_SECRET as string,
-		},
-		google: {
-			clientId: process.env.GOOGLE_CLIENT_ID as string,
-			clientSecret: process.env.GOOGLE_CLIENT_SECRET as string,
-		},
-	},
-	logger: {
-		disabled: process.env.NODE_ENV === "production",
-	},
-	async trustedOrigins() {
-		try {
-			if (IS_CLOUD) {
-				return await getTrustedOrigins();
-			}
-			const [trustedOrigins, settings] = await Promise.all([
-				getTrustedOrigins(),
-				getWebServerSettings(),
-			]);
-			if (!settings) return [];
-			const devOrigins =
-				process.env.NODE_ENV === "development"
-					? [
-							"http://localhost:3000",
-							"https://absolutely-handy-falcon.ngrok-free.app",
-						]
-					: [];
-			return [
-				...(settings?.serverIp ? [`http://${settings?.serverIp}:3000`] : []),
-				...(settings?.host ? [`https://${settings?.host}`] : []),
-				...devOrigins,
-				...trustedOrigins,
-			];
-		} catch (error) {
-			console.error("Failed to resolve trusted origins:", error);
-			return [];
+const resolveTrustedOrigins = async () => {
+	try {
+		if (IS_CLOUD) {
+			return await getTrustedOrigins();
 		}
-	},
-	emailVerification: {
-		sendOnSignUp: true,
-		autoSignInAfterVerification: true,
-		sendOnSignIn: true,
-		sendVerificationEmail: async ({ user, url }) => {
-			if (IS_CLOUD) {
-				await sendVerificationEmail({
-					userName: user.name || "User",
+		const [trustedOrigins, settings] = await Promise.all([
+			getTrustedOrigins(),
+			getWebServerSettings(),
+		]);
+
+		if (!settings) return [];
+
+		const devOrigins =
+			process.env.NODE_ENV === "development"
+				? [
+						"http://localhost:3000",
+						"https://absolutely-handy-falcon.ngrok-free.app",
+					]
+				: [];
+		return [
+			...(settings?.serverIp ? [`http://${settings?.serverIp}:3000`] : []),
+			...(settings?.host ? [`https://${settings?.host}`] : []),
+			...devOrigins,
+			...trustedOrigins,
+		];
+	} catch (error) {
+		console.error("Failed to resolve trusted origins:", error);
+		return [];
+	}
+};
+
+const createBetterAuth = () =>
+	betterAuth({
+		database: drizzleAdapter(db, {
+			provider: "pg",
+			schema: schema,
+		}),
+		disabledPaths: [
+			"/sso/register",
+			"/organization/create",
+			"/organization/update",
+			"/organization/delete",
+			...(!IS_CLOUD ? ["/verify-email"] : []),
+		],
+		secret: betterAuthSecret,
+		...(!IS_CLOUD
+			? {
+					advanced: {
+						useSecureCookies: false,
+						defaultCookieAttributes: {
+							sameSite: "lax",
+							secure: false,
+							httpOnly: true,
+							path: "/",
+						},
+					},
+				}
+			: {}),
+
+		account: {
+			accountLinking: {
+				enabled: true,
+				async trustedProviders() {
+					const fromDb = await getTrustedProviders();
+					return ["github", "google", ...fromDb];
+				},
+				allowDifferentEmails: true,
+			},
+		},
+		appName: "Dokploy",
+		socialProviders: {
+			github: {
+				clientId: process.env.GITHUB_CLIENT_ID as string,
+				clientSecret: process.env.GITHUB_CLIENT_SECRET as string,
+			},
+			google: {
+				clientId: process.env.GOOGLE_CLIENT_ID as string,
+				clientSecret: process.env.GOOGLE_CLIENT_SECRET as string,
+			},
+		},
+		logger: {
+			disabled: process.env.NODE_ENV === "production",
+		},
+		trustedOrigins: resolveTrustedOrigins,
+		hooks: {
+			before: createAuthMiddleware(async (ctx) => {
+				ctx.context.trustedOrigins = [
+					...(ctx.context.baseURL ? [new URL(ctx.context.baseURL).origin] : []),
+					...(await resolveTrustedOrigins()),
+				].filter(Boolean);
+			}),
+		},
+		emailVerification: {
+			sendOnSignUp: true,
+			autoSignInAfterVerification: true,
+			sendOnSignIn: true,
+			sendVerificationEmail: async ({ user, url }) => {
+				if (IS_CLOUD) {
+					await sendVerificationEmail({
+						userName: user.name || "User",
+						email: user.email,
+						verificationUrl: url,
+					});
+				}
+			},
+		},
+		emailAndPassword: {
+			enabled: true,
+			autoSignIn: !IS_CLOUD,
+			requireEmailVerification:
+				IS_CLOUD && process.env.NODE_ENV === "production",
+			password: {
+				async hash(password) {
+					return bcrypt.hashSync(password, 10);
+				},
+				async verify({ hash, password }) {
+					return bcrypt.compareSync(password, hash);
+				},
+			},
+			sendResetPassword: async ({ user, url }) => {
+				await sendEmail({
 					email: user.email,
-					verificationUrl: url,
-				});
-			}
-		},
-	},
-	emailAndPassword: {
-		enabled: true,
-		autoSignIn: !IS_CLOUD,
-		requireEmailVerification: IS_CLOUD && process.env.NODE_ENV === "production",
-		password: {
-			async hash(password) {
-				return bcrypt.hashSync(password, 10);
-			},
-			async verify({ hash, password }) {
-				return bcrypt.compareSync(password, hash);
-			},
-		},
-		sendResetPassword: async ({ user, url }) => {
-			await sendEmail({
-				email: user.email,
-				subject: "Reset your password",
-				text: `
+					subject: "Reset your password",
+					text: `
 				<p>Click the link to reset your password: <a href="${url}">Reset Password</a></p>
 				`,
-			});
+				});
+			},
 		},
-	},
-	databaseHooks: {
-		user: {
-			create: {
-				before: async (_user, context) => {
-					if (!IS_CLOUD) {
-						const xDokployToken =
-							context?.request?.headers?.get("x-dokploy-token");
-						if (xDokployToken) {
-							let invitation: Awaited<ReturnType<typeof getUserByToken>>;
+		databaseHooks: {
+			user: {
+				create: {
+					before: async (_user, context) => {
+						if (!IS_CLOUD) {
+							const xDokployToken =
+								context?.request?.headers?.get("x-dokploy-token");
+							if (xDokployToken) {
+								let invitation: Awaited<ReturnType<typeof getUserByToken>>;
+								try {
+									invitation = await getUserByToken(xDokployToken);
+								} catch {
+									throw new APIError("BAD_REQUEST", {
+										message: "Invalid invitation token",
+									});
+								}
+								if (invitation.isExpired) {
+									throw new APIError("BAD_REQUEST", {
+										message: "Invitation has expired",
+									});
+								}
+								if (invitation.status !== "pending") {
+									throw new APIError("BAD_REQUEST", {
+										message: "Invitation has already been used",
+									});
+								}
+								if (
+									_user.email.toLowerCase().trim() !==
+									invitation.email.toLowerCase().trim()
+								) {
+									throw new APIError("BAD_REQUEST", {
+										message: "Email does not match invitation",
+									});
+								}
+							} else {
+								const isSSORequest = context?.path.includes("/sso");
+								const isSCIMRequest = context?.path.includes("/scim");
+								if (isSSORequest || isSCIMRequest) {
+									return;
+								}
+								const isAdminPresent = await db.query.member.findFirst({
+									where: eq(schema.member.role, "owner"),
+								});
+								if (isAdminPresent) {
+									throw new APIError("BAD_REQUEST", {
+										message: "Admin is already created",
+									});
+								}
+							}
+						}
+					},
+					after: async (user, context) => {
+						const isSSORequest = context?.path.includes("/sso");
+						const isSCIMRequest = context?.path.includes("/scim");
+						const isAdminPresent = await db.query.member.findFirst({
+							where: eq(schema.member.role, "owner"),
+						});
+
+						if (!IS_CLOUD && !isAdminPresent) {
+							await updateWebServerSettings({
+								serverIp: await getPublicIpWithFallback(),
+							});
+						}
+
+						if (IS_CLOUD) {
 							try {
-								invitation = await getUserByToken(xDokployToken);
-							} catch {
-								throw new APIError("BAD_REQUEST", {
-									message: "Invalid invitation token",
-								});
-							}
-							if (invitation.isExpired) {
-								throw new APIError("BAD_REQUEST", {
-									message: "Invitation has expired",
-								});
-							}
-							if (invitation.status !== "pending") {
-								throw new APIError("BAD_REQUEST", {
-									message: "Invitation has already been used",
-								});
-							}
-							if (
-								_user.email.toLowerCase().trim() !==
-								invitation.email.toLowerCase().trim()
-							) {
-								throw new APIError("BAD_REQUEST", {
-									message: "Email does not match invitation",
-								});
-							}
-						} else {
-							const isSSORequest = context?.path.includes("/sso");
-							if (isSSORequest) {
-								return;
-							}
-							const isAdminPresent = await db.query.member.findFirst({
-								where: eq(schema.member.role, "owner"),
-							});
-							if (isAdminPresent) {
-								throw new APIError("BAD_REQUEST", {
-									message: "Admin is already created",
-								});
+								const hutk = getHubSpotUTK(
+									context?.request?.headers?.get("cookie") || undefined,
+								);
+								// Cast to include additional fields
+								const userWithFields = user as typeof user & {
+									lastName?: string;
+								};
+								const hubspotSuccess = await submitToHubSpot(
+									{
+										email: user.email,
+										firstName: user.name || "", // name is mapped to firstName column
+										lastName: userWithFields.lastName || "",
+									},
+									hutk,
+								);
+								if (!hubspotSuccess) {
+									console.error("Failed to submit to HubSpot");
+								}
+							} catch (error) {
+								console.error("Error submitting to HubSpot", error);
 							}
 						}
-					}
-				},
-				after: async (user, context) => {
-					const isSSORequest = context?.path.includes("/sso");
-					const isAdminPresent = await db.query.member.findFirst({
-						where: eq(schema.member.role, "owner"),
-					});
 
-					if (!IS_CLOUD && !isAdminPresent) {
-						await updateWebServerSettings({
-							serverIp: await getPublicIpWithFallback(),
-						});
-					}
-
-					if (IS_CLOUD) {
-						try {
-							const hutk = getHubSpotUTK(
-								context?.request?.headers?.get("cookie") || undefined,
-							);
-							// Cast to include additional fields
-							const userWithFields = user as typeof user & {
-								lastName?: string;
-							};
-							const hubspotSuccess = await submitToHubSpot(
-								{
-									email: user.email,
-									firstName: user.name || "", // name is mapped to firstName column
-									lastName: userWithFields.lastName || "",
-								},
-								hutk,
-							);
-							if (!hubspotSuccess) {
-								console.error("Failed to submit to HubSpot");
-							}
-						} catch (error) {
-							console.error("Error submitting to HubSpot", error);
+						if (isSCIMRequest) {
+							return;
 						}
-					}
 
-					if (IS_CLOUD || !isAdminPresent) {
-						await db.transaction(async (tx) => {
-							const organization = await tx
-								.insert(schema.organization)
-								.values({
-									name: "My Organization",
-									ownerId: user.id,
+						if (IS_CLOUD || !isAdminPresent) {
+							await db.transaction(async (tx) => {
+								const organization = await tx
+									.insert(schema.organization)
+									.values({
+										name: "My Organization",
+										ownerId: user.id,
+										createdAt: new Date(),
+									})
+									.returning()
+									.then((res) => res[0]);
+
+								await tx.insert(schema.member).values({
+									userId: user.id,
+									organizationId: organization?.id || "",
+									role: "owner",
 									createdAt: new Date(),
-								})
-								.returning()
-								.then((res) => res[0]);
+									isDefault: true, // Mark first organization as default
+								});
+							});
+						} else if (isSSORequest) {
+							const providerId = context?.params?.providerId;
+							if (!providerId) {
+								throw new APIError("BAD_REQUEST", {
+									message: "Provider ID is required",
+								});
+							}
+							const provider = await db.query.ssoProvider.findFirst({
+								where: eq(schema.ssoProvider.providerId, providerId),
+							});
 
-							await tx.insert(schema.member).values({
+							if (!provider) {
+								throw new APIError("BAD_REQUEST", {
+									message: "Provider not found",
+								});
+							}
+							await db.insert(schema.member).values({
 								userId: user.id,
-								organizationId: organization?.id || "",
-								role: "owner",
+								organizationId: provider?.organizationId || "",
+								role: "member",
 								createdAt: new Date(),
-								isDefault: true, // Mark first organization as default
-							});
-						});
-					} else if (isSSORequest) {
-						const providerId = context?.params?.providerId;
-						if (!providerId) {
-							throw new APIError("BAD_REQUEST", {
-								message: "Provider ID is required",
+								isDefault: true,
 							});
 						}
-						const provider = await db.query.ssoProvider.findFirst({
-							where: eq(schema.ssoProvider.providerId, providerId),
+					},
+				},
+			},
+			session: {
+				create: {
+					before: async (session) => {
+						// Find the default organization for this user
+						// Priority: 1) isDefault=true, 2) most recently created
+						const member = await db.query.member.findFirst({
+							where: eq(schema.member.userId, session.userId),
+							orderBy: [
+								desc(schema.member.isDefault),
+								desc(schema.member.createdAt),
+							],
+							with: {
+								organization: true,
+							},
 						});
 
-						if (!provider) {
-							throw new APIError("BAD_REQUEST", {
-								message: "Provider not found",
-							});
-						}
-						await db.insert(schema.member).values({
-							userId: user.id,
-							organizationId: provider?.organizationId || "",
-							role: "member",
-							createdAt: new Date(),
-							isDefault: true,
+						return {
+							data: {
+								...session,
+								activeOrganizationId: member?.organization.id,
+							},
+						};
+					},
+					after: async (session) => {
+						const orgId = (
+							session as typeof session & { activeOrganizationId?: string }
+						).activeOrganizationId;
+						if (!orgId) return;
+						const memberRecord = await db.query.member.findFirst({
+							where: and(
+								eq(schema.member.userId, session.userId),
+								eq(schema.member.organizationId, orgId),
+							),
+							with: { user: true },
 						});
-					}
+						if (!memberRecord) return;
+						await createAuditLog({
+							organizationId: orgId,
+							userId: session.userId,
+							userEmail: memberRecord.user.email,
+							userRole: memberRecord.role,
+							action: "login",
+							resourceType: "session",
+						});
+					},
+				},
+				delete: {
+					after: async (session) => {
+						const orgId = (
+							session as typeof session & { activeOrganizationId?: string }
+						).activeOrganizationId;
+						if (!orgId) return;
+						const memberRecord = await db.query.member.findFirst({
+							where: and(
+								eq(schema.member.userId, session.userId),
+								eq(schema.member.organizationId, orgId),
+							),
+							with: { user: true },
+						});
+						if (!memberRecord) return;
+						await createAuditLog({
+							organizationId: orgId,
+							userId: session.userId,
+							userEmail: memberRecord.user.email,
+							userRole: memberRecord.role,
+							action: "logout",
+							resourceType: "session",
+						});
+					},
 				},
 			},
 		},
 		session: {
-			create: {
-				before: async (session) => {
-					// Find the default organization for this user
-					// Priority: 1) isDefault=true, 2) most recently created
-					const member = await db.query.member.findFirst({
-						where: eq(schema.member.userId, session.userId),
-						orderBy: [
-							desc(schema.member.isDefault),
-							desc(schema.member.createdAt),
-						],
-						with: {
-							organization: true,
-						},
+			expiresIn: 60 * 60 * 24 * 3,
+			updateAge: 60 * 60 * 24,
+		},
+		user: {
+			modelName: "user",
+			fields: {
+				name: "firstName", // Map better-auth's default 'name' field to 'firstName' column
+			},
+			additionalFields: {
+				role: {
+					type: "string",
+					// required: true,
+					input: false,
+				},
+				ownerId: {
+					type: "string",
+					// required: true,
+					input: false,
+				},
+				allowImpersonation: {
+					fieldName: "allowImpersonation",
+					type: "boolean",
+					defaultValue: false,
+				},
+				lastName: {
+					type: "string",
+					required: false,
+					input: true,
+					defaultValue: "",
+				},
+				enableEnterpriseFeatures: {
+					type: "boolean",
+					required: false,
+					input: false,
+				},
+				isValidEnterpriseLicense: {
+					type: "boolean",
+					required: false,
+					input: false,
+				},
+			},
+		},
+		plugins: [
+			apiKey({
+				enableMetadata: true,
+				references: "user",
+			}),
+			sso(),
+			scim({
+				beforeSCIMTokenGenerated: async ({ user }) => {
+					const dbUser = await db.query.user.findFirst({
+						where: eq(schema.user.id, user.id),
+						columns: { enableEnterpriseFeatures: true },
 					});
 
-					return {
-						data: {
-							...session,
-							activeOrganizationId: member?.organization.id,
-						},
-					};
+					if (!dbUser?.enableEnterpriseFeatures) {
+						throw new APIError("FORBIDDEN", {
+							message: "SCIM provisioning requires an enterprise license",
+						});
+					}
 				},
-				after: async (session) => {
-					const orgId = (
-						session as typeof session & { activeOrganizationId?: string }
-					).activeOrganizationId;
-					if (!orgId) return;
-					const memberRecord = await db.query.member.findFirst({
-						where: and(
-							eq(schema.member.userId, session.userId),
-							eq(schema.member.organizationId, orgId),
-						),
-						with: { user: true },
-					});
-					if (!memberRecord) return;
-					await createAuditLog({
-						organizationId: orgId,
-						userId: session.userId,
-						userEmail: memberRecord.user.email,
-						userRole: memberRecord.role,
-						action: "login",
-						resourceType: "session",
-					});
+			}),
+			twoFactor(),
+			organization({
+				ac,
+				roles: {
+					owner: ownerRole,
+					admin: adminRole,
+					member: memberRole,
 				},
-			},
-			delete: {
-				after: async (session) => {
-					const orgId = (
-						session as typeof session & { activeOrganizationId?: string }
-					).activeOrganizationId;
-					if (!orgId) return;
-					const memberRecord = await db.query.member.findFirst({
-						where: and(
-							eq(schema.member.userId, session.userId),
-							eq(schema.member.organizationId, orgId),
-						),
-						with: { user: true },
-					});
-					if (!memberRecord) return;
-					await createAuditLog({
-						organizationId: orgId,
-						userId: session.userId,
-						userEmail: memberRecord.user.email,
-						userRole: memberRecord.role,
-						action: "logout",
-						resourceType: "session",
-					});
+				dynamicAccessControl: {
+					enabled: true,
+					maximumRolesPerOrganization: 10,
 				},
-			},
-		},
-	},
-	session: {
-		expiresIn: 60 * 60 * 24 * 3,
-		updateAge: 60 * 60 * 24,
-	},
-	user: {
-		modelName: "user",
-		fields: {
-			name: "firstName", // Map better-auth's default 'name' field to 'firstName' column
-		},
-		additionalFields: {
-			role: {
-				type: "string",
-				// required: true,
-				input: false,
-			},
-			ownerId: {
-				type: "string",
-				// required: true,
-				input: false,
-			},
-			allowImpersonation: {
-				fieldName: "allowImpersonation",
-				type: "boolean",
-				defaultValue: false,
-			},
-			lastName: {
-				type: "string",
-				required: false,
-				input: true,
-				defaultValue: "",
-			},
-			enableEnterpriseFeatures: {
-				type: "boolean",
-				required: false,
-				input: false,
-			},
-			isValidEnterpriseLicense: {
-				type: "boolean",
-				required: false,
-				input: false,
-			},
-		},
-	},
-	plugins: [
-		apiKey({
-			enableMetadata: true,
-			references: "user",
-		}),
-		sso(),
-		twoFactor(),
-		organization({
-			ac,
-			roles: {
-				owner: ownerRole,
-				admin: adminRole,
-				member: memberRole,
-			},
-			dynamicAccessControl: {
-				enabled: true,
-				maximumRolesPerOrganization: 10,
-			},
-		}),
-		...(IS_CLOUD
-			? [
-					admin({
-						adminUserIds: [process.env.USER_ADMIN_ID as string],
-					}),
-				]
-			: []),
-	],
-});
+			}),
+			// Self-hosted needs the admin plugin too: SCIM deactivation (active: false)
+			// maps to the admin plugin's `banned` field and is rejected without it.
+			// adminRoles: [] keeps every /admin/* endpoint locked on self-hosted.
+			admin(
+				IS_CLOUD
+					? { adminUserIds: [process.env.USER_ADMIN_ID as string] }
+					: { adminRoles: [] },
+			),
+		],
+	});
+
+// Una sola instancia de better-auth por proceso aunque el módulo esté
+// duplicado en varios bundles.
+const globalForAuth = globalThis as unknown as {
+	betterAuthInstance?: ReturnType<typeof createBetterAuth>;
+};
+
+if (!globalForAuth.betterAuthInstance) {
+	globalForAuth.betterAuthInstance = createBetterAuth();
+}
+
+const { handler, api } = globalForAuth.betterAuthInstance;
 
 const _auth = {
 	handler,
 	createApiKey: api.createApiKey,
 	registerSSOProvider: api.registerSSOProvider,
 	updateSSOProvider: api.updateSSOProvider,
+	generateSCIMToken: api.generateSCIMToken,
+	listSCIMProviderConnections: api.listSCIMProviderConnections,
+	deleteSCIMProviderConnection: api.deleteSCIMProviderConnection,
 };
 
 export type AuthType = typeof _auth;

packages/server/src/lib/encryption-secret.ts

@@ -0,0 +1,15 @@
+import { readSecret } from "../db/constants";
+
+const { ENCRYPTION_KEY, ENCRYPTION_KEY_FILE } = process.env;
+
+function resolveEncryptionSecret(): string | undefined {
+	if (ENCRYPTION_KEY) {
+		return ENCRYPTION_KEY;
+	}
+	if (ENCRYPTION_KEY_FILE) {
+		return readSecret(ENCRYPTION_KEY_FILE);
+	}
+	return undefined;
+}
+
+export const encryptionSecret = resolveEncryptionSecret();

packages/server/src/lib/encryption.ts

@@ -0,0 +1,108 @@
+import {
+	createCipheriv,
+	createDecipheriv,
+	createHmac,
+	randomBytes,
+} from "node:crypto";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { paths } from "@dokploy/server/constants";
+import { betterAuthSecret } from "./auth-secret";
+import { encryptionSecret } from "./encryption-secret";
+
+export const ENCRYPTION_KEY_BACKUP_FILE = "encryption.key";
+
+const ENCRYPTION_PREFIX = "enc:v1:";
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+
+const deriveKey = (secret: string) =>
+	createHmac("sha256", secret).update("dokploy:db-encryption:v1").digest();
+
+const primaryKey = deriveKey(encryptionSecret ?? betterAuthSecret);
+
+// Installs that adopt a dedicated ENCRYPTION_KEY still hold values encrypted
+// with the auth-secret-derived key; keep it as a decrypt fallback so they
+// lazily re-encrypt on the next write instead of becoming unreadable.
+const decryptionKeys = encryptionSecret
+	? [primaryKey, deriveKey(betterAuthSecret)]
+	: [primaryKey];
+
+// Derived keys only — never the raw secrets. A leaked key can decrypt
+// stored values, but the raw BETTER_AUTH_SECRET could also forge sessions.
+export const exportEncryptionKeys = () =>
+	decryptionKeys.map((key) => key.toString("hex")).join("\n");
+
+let restoredKeys: Buffer[] | undefined;
+
+// A backup created with "include encryption key" places the original
+// server's keys at BASE_PATH when restored; use them as a last-resort
+// decryption fallback so restored values keep working on the new server.
+const loadRestoredKeys = (): Buffer[] => {
+	if (restoredKeys?.length) {
+		return restoredKeys;
+	}
+	try {
+		const { BASE_PATH } = paths();
+		const keys = readFileSync(
+			join(BASE_PATH, ENCRYPTION_KEY_BACKUP_FILE),
+			"utf8",
+		)
+			.split("\n")
+			.map((line) => line.trim())
+			.filter(Boolean)
+			.map((hex) => Buffer.from(hex, "hex"))
+			.filter(
+				(key) =>
+					key.length === 32 && !decryptionKeys.some((own) => own.equals(key)),
+			);
+		if (keys.length) {
+			restoredKeys = keys;
+		}
+	} catch {
+		// No restored key file present.
+	}
+	return restoredKeys ?? [];
+};
+
+export const isEncrypted = (value: string) =>
+	value.startsWith(ENCRYPTION_PREFIX);
+
+export const encryptValue = (value: string): string => {
+	if (!value || isEncrypted(value)) {
+		return value;
+	}
+	const iv = randomBytes(IV_LENGTH);
+	const cipher = createCipheriv("aes-256-gcm", primaryKey, iv);
+	const encrypted = Buffer.concat([
+		cipher.update(value, "utf8"),
+		cipher.final(),
+	]);
+	return `${ENCRYPTION_PREFIX}${Buffer.concat([iv, cipher.getAuthTag(), encrypted]).toString("base64")}`;
+};
+
+export const decryptValue = (value: string): string => {
+	if (!value || !isEncrypted(value)) {
+		return value;
+	}
+	const payload = Buffer.from(value.slice(ENCRYPTION_PREFIX.length), "base64");
+	const iv = payload.subarray(0, IV_LENGTH);
+	const authTag = payload.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
+	const encrypted = payload.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
+	const keys = [...decryptionKeys, ...loadRestoredKeys()];
+	for (const key of keys) {
+		try {
+			const decipher = createDecipheriv("aes-256-gcm", key, iv);
+			decipher.setAuthTag(authTag);
+			return Buffer.concat([
+				decipher.update(encrypted),
+				decipher.final(),
+			]).toString("utf8");
+		} catch {
+			// GCM auth failed for this key; try the next one.
+		}
+	}
+	throw new Error(
+		"Failed to decrypt a stored secret. This usually means ENCRYPTION_KEY or BETTER_AUTH_SECRET changed after the value was encrypted.",
+	);
+};

packages/server/src/services/admin.ts

@@ -120,6 +120,10 @@ export const getDokployUrl = async () => {
 const TRUSTED_ORIGINS_CACHE_TTL_MS = 30 * 60_000;
 let trustedOriginsCache: { data: string[]; expiresAt: number } | null = null;
 
+export const invalidateTrustedOriginsCache = () => {
+	trustedOriginsCache = null;
+};
+
 export const getTrustedOrigins = async () => {
 	const runQuery = async () => {
 		const rows = await db