fix(v5): defer production runtime activation

Remove Flux token provisioning and container role handling from production.
Restore private server IP support and document the activation checklist.

tests/Feature/ContainerRoleScriptTest.php

@@ -33,9 +33,16 @@ it('falls back to the container role from the local env file', function () {
     expect($result->successful())->toBeTrue();
 });
 
-it('keeps production and development role helpers in sync', function () {
-    expect(file_get_contents(base_path('docker/production/etc/s6-overlay/scripts/container-role')))
-        ->toBe(file_get_contents(base_path('docker/development/etc/s6-overlay/scripts/container-role')));
+it('keeps container roles out of the production image', function () {
+    expect(base_path('docker/production/etc/s6-overlay/scripts/container-role'))->not->toBeFile();
+
+    foreach (['horizon', 'nightwatch-agent', 'scheduler-worker'] as $service) {
+        $runScript = file_get_contents(base_path("docker/production/etc/s6-overlay/s6-rc.d/{$service}/run"));
+
+        expect($runScript)
+            ->not->toContain('container-role')
+            ->not->toContain('COOLIFY_CONTAINER_ROLE');
+    }
 });
 
 function runContainerRoleHelper(string $roles, string $serviceRole, ?string $workingDirectory = null): ProcessResult
@@ -61,17 +68,15 @@ it('does not register a separate v5 flux status listener service', function () {
     }
 });
 
-it('configures flux to publish v5 resource statuses to laravel over local http by default', function () {
-    foreach (['development', 'production'] as $environment) {
-        $runScript = file_get_contents(base_path("docker/{$environment}/etc/s6-overlay/s6-rc.d/flux/run"));
+it('configures development flux to publish v5 resource statuses to laravel over local http by default', function () {
+    $runScript = file_get_contents(base_path('docker/development/etc/s6-overlay/s6-rc.d/flux/run'));
 
-        expect($runScript)
-            ->toContain('COOLIFY_FLUX_LARAVEL_API_URL')
-            ->toContain('http://127.0.0.1:8080')
-            ->toContain('COOLIFY_FLUX_LARAVEL_API_TOKEN')
-            ->not->toContain('APP_KEY')
-            ->not->toContain("grep -E '^APP_KEY=' .env")
-            ->not->toContain('COOLIFY_FLUX_REDIS_URL')
-            ->not->toContain('COOLIFY_FLUX_RESOURCE_STATUS_CHANNEL');
-    }
+    expect($runScript)
+        ->toContain('COOLIFY_FLUX_LARAVEL_API_URL')
+        ->toContain('http://127.0.0.1:8080')
+        ->toContain('COOLIFY_FLUX_LARAVEL_API_TOKEN')
+        ->not->toContain('APP_KEY')
+        ->not->toContain("grep -E '^APP_KEY=' .env")
+        ->not->toContain('COOLIFY_FLUX_REDIS_URL')
+        ->not->toContain('COOLIFY_FLUX_RESOURCE_STATUS_CHANNEL');
 });

tests/Unit/UpgradePostgresScriptTest.php

@@ -44,24 +44,22 @@ it('downloads postgres upgrade script during install and upgrade without auto-ru
     'nightly upgrade' => 'other/nightly/upgrade.sh',
 ]);
 
-it('generates a dedicated flux laravel api token during install and upgrade', function (string $path) {
-    $script = file_get_contents(getcwd().'/'.$path);
+it('does not provision a flux laravel api token before v5 production activation', function (string $path) {
+    $source = file_get_contents(getcwd().'/'.$path);
 
-    expect($script)
-        ->toContain('update_env_var "COOLIFY_FLUX_LARAVEL_API_TOKEN" "$(openssl rand -hex 32)"');
+    expect($source)->not->toContain('COOLIFY_FLUX_LARAVEL_API_TOKEN');
 })->with([
+    'production env' => '.env.production',
     'stable install' => 'scripts/install.sh',
     'nightly install' => 'other/nightly/install.sh',
     'stable upgrade' => 'scripts/upgrade.sh',
     'nightly upgrade' => 'other/nightly/upgrade.sh',
 ]);
 
-it('creates a writable flux storage directory during install and upgrade', function (string $path) {
-    $script = file_get_contents(getcwd().'/'.$path);
+it('does not provision flux storage before v5 production activation', function (string $path) {
+    $source = file_get_contents(getcwd().'/'.$path);
 
-    expect($script)
-        ->toContain('/data/coolify/flux')
-        ->toContain('chown -R 9999:root /data/coolify/flux');
+    expect($source)->not->toContain('/data/coolify/flux');
 })->with([
     'stable install' => 'scripts/install.sh',
     'nightly install' => 'other/nightly/install.sh',

tests/Unit/ValidServerIpTest.php

@@ -0,0 +1,23 @@
+<?php
+
+use App\Rules\ValidServerIp;
+use Tests\TestCase;
+
+uses(TestCase::class);
+
+it('accepts private and reserved IP addresses like the next branch', function (string $ip) {
+    $rule = new ValidServerIp;
+    $failCalled = false;
+
+    $rule->validate('ip', $ip, function () use (&$failCalled): void {
+        $failCalled = true;
+    });
+
+    expect($failCalled)->toBeFalse();
+})->with([
+    'private IPv4' => '192.168.1.10',
+    'loopback IPv4' => '127.0.0.1',
+    'link-local IPv4' => '169.254.1.10',
+    'loopback IPv6' => '::1',
+    'unique local IPv6' => 'fd00::1',
+]);