Merge remote-tracking branch 'origin/next' into jean/allow-dots-username

app/Livewire/Destination/Index.php

@@ -3,6 +3,7 @@
 namespace App\Livewire\Destination;
 
 use App\Models\Server;
+use Illuminate\Support\Collection;
 use Livewire\Attributes\Locked;
 use Livewire\Component;
 
@@ -11,9 +12,15 @@ class Index extends Component
     #[Locked]
     public $servers;
 
-    public function mount()
+    #[Locked]
+    public Collection $destinations;
+
+    public function mount(): void
     {
         $this->servers = Server::isUsable()->get();
+        $this->destinations = $this->servers
+            ->flatMap(fn (Server $server) => $server->standaloneDockers->concat($server->swarmDockers))
+            ->values();
     }
 
     public function render()

app/Livewire/Destination/New/Docker.php

@@ -33,44 +33,49 @@ class Docker extends Component
     #[Validate(['required', 'boolean'])]
     public bool $isSwarm = false;
 
-    public function mount(?string $server_id = null)
+    public function mount(?string $server_id = null): void
     {
-        $this->network = new Cuid2;
+        $this->network = (string) new Cuid2;
         $this->servers = Server::isUsable()->get();
-        if ($server_id) {
-            $foundServer = $this->servers->find($server_id) ?: $this->servers->first();
-            if (! $foundServer) {
-                throw new \Exception('Server not found.');
+
+        if (filled($server_id)) {
+            $this->selectedServer = Server::ownedByCurrentTeam()->whereKey($server_id)->firstOrFail();
+
+            if (! $this->servers->contains('id', $this->selectedServer->id)) {
+                $this->servers->push($this->selectedServer);
             }
-            $this->selectedServer = $foundServer;
-            $this->serverId = $this->selectedServer->id;
+
+            $this->serverId = (string) $this->selectedServer->id;
         } else {
             $foundServer = $this->servers->first();
             if (! $foundServer) {
                 throw new \Exception('Server not found.');
             }
             $this->selectedServer = $foundServer;
-            $this->serverId = $this->selectedServer->id;
+            $this->serverId = (string) $this->selectedServer->id;
         }
         $this->generateName();
     }
 
-    public function updatedServerId()
+    public function updatedServerId(): void
     {
         $this->selectedServer = $this->servers->find($this->serverId);
+        if (! $this->selectedServer) {
+            throw new \Exception('Server not found.');
+        }
         $this->generateName();
     }
 
-    public function generateName()
+    public function generateName(): void
     {
         $name = data_get($this->selectedServer, 'name', new Cuid2);
         $this->name = str("{$name}-{$this->network}")->kebab();
     }
 
-    public function submit()
+    public function submit(): mixed
     {
         try {
-            $this->authorize('create', StandaloneDocker::class);
+            $this->authorize('create', $this->isSwarm ? SwarmDocker::class : StandaloneDocker::class);
             $this->validate();
             if ($this->isSwarm) {
                 $found = $this->selectedServer->swarmDockers()->where('network', $this->network)->first();

app/Livewire/Destination/Resources.php

@@ -0,0 +1,125 @@
+<?php
+
+namespace App\Livewire\Destination;
+
+use App\Models\Application;
+use App\Models\BaseModel;
+use App\Models\Service;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDocker;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use Illuminate\Contracts\View\View;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+
+class Resources extends Component
+{
+    #[Locked]
+    public $destination;
+
+    public array $resources = [];
+
+    public function mount(string $destination_uuid)
+    {
+        try {
+            $destination = find_destination_for_current_team($destination_uuid);
+            if (! $destination) {
+                return redirect()->route('destination.index');
+            }
+            if (! $destination instanceof StandaloneDocker) {
+                return redirect()->route('destination.show', ['destination_uuid' => $destination->uuid]);
+            }
+
+            $this->destination = $destination;
+            $this->loadResources();
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    /**
+     * Load applications, services, and database resources deployed to the standalone Docker destination.
+     *
+     * @return void Populates the resources property for display.
+     */
+    public function loadResources(): void
+    {
+        $this->resources = $this->collectResources([
+            $this->destination->applications,
+            $this->destination->services,
+            $this->destination->postgresqls,
+            $this->destination->redis,
+            $this->destination->mongodbs,
+            $this->destination->mysqls,
+            $this->destination->mariadbs,
+            $this->destination->keydbs,
+            $this->destination->dragonflies,
+            $this->destination->clickhouses,
+        ]);
+    }
+
+    /**
+     * @param  array<int, iterable<Application|Service|StandalonePostgresql|StandaloneRedis|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse>>  $groups
+     * @return array<int, array{uuid:string,type:string,name:string,project:string|null,environment:string|null,url:string|null,search:string}>
+     */
+    protected function collectResources(array $groups): array
+    {
+        $rows = [];
+        foreach ($groups as $group) {
+            foreach ($group as $resource) {
+                $rows[] = $this->resourceRow($resource);
+            }
+        }
+
+        return $rows;
+    }
+
+    /**
+     * @param  Application|Service|StandalonePostgresql|StandaloneRedis|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse  $resource
+     * @return array{uuid:string,type:string,name:string,project:string|null,environment:string|null,url:string|null,search:string}
+     */
+    protected function resourceRow(BaseModel $resource): array
+    {
+        $type = match (true) {
+            $resource instanceof Application => 'application',
+            $resource instanceof Service => 'service',
+            default => 'database',
+        };
+        $environment = $resource->environment;
+        $project = $environment?->project;
+        $routeName = "project.{$type}.configuration";
+        $url = ($project && $environment)
+            ? route($routeName, [
+                'project_uuid' => $project->uuid,
+                'environment_uuid' => $environment->uuid,
+                "{$type}_uuid" => $resource->uuid,
+            ])
+            : null;
+
+        return [
+            'uuid' => $resource->uuid,
+            'type' => $type,
+            'name' => $resource->name,
+            'project' => $project?->name,
+            'environment' => $environment?->name,
+            'url' => $url,
+            'search' => strtolower(implode(' ', array_filter([
+                $type,
+                $resource->name,
+                $project?->name,
+                $environment?->name,
+            ]))),
+        ];
+    }
+
+    public function render(): View
+    {
+        return view('livewire.destination.resources');
+    }
+}

app/Livewire/ForcePasswordReset.php

@@ -47,14 +47,10 @@ class ForcePasswordReset extends Component
         try {
             $this->rateLimit(10);
             $this->validate();
-            $firstLogin = auth()->user()->created_at == auth()->user()->updated_at;
             auth()->user()->fill([
                 'password' => Hash::make($this->password),
                 'force_password_reset' => false,
             ])->save();
-            if ($firstLogin) {
-                send_internal_notification('First login for '.auth()->user()->email);
-            }
 
             return redirect()->route('dashboard');
         } catch (\Throwable $e) {

app/Livewire/Profile/Appearance.php

@@ -0,0 +1,13 @@
+<?php
+
+namespace App\Livewire\Profile;
+
+use Livewire\Component;
+
+class Appearance extends Component
+{
+    public function render()
+    {
+        return view('livewire.profile.appearance');
+    }
+}

app/Livewire/Project/Application/Advanced.php

@@ -4,6 +4,8 @@ namespace App\Livewire\Project\Application;
 
 use App\Models\Application;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\ValidationException;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
@@ -61,6 +63,9 @@ class Advanced extends Component
     #[Validate(['string', 'nullable'])]
     public ?string $gpuOptions = null;
 
+    #[Validate(['string', 'nullable'])]
+    public ?string $stopGracePeriod = null;
+
     #[Validate(['boolean'])]
     public bool $isBuildServerEnabled = false;
 
@@ -82,6 +87,9 @@ class Advanced extends Component
     #[Validate(['boolean'])]
     public bool $isConnectToDockerNetworkEnabled = false;
 
+    #[Validate(['integer', 'min:0'])]
+    public int $maxRestartCount = 10;
+
     public function mount()
     {
         try {
@@ -144,7 +152,12 @@ class Advanced extends Component
             $this->disableBuildCache = $this->application->settings->disable_build_cache;
             $this->injectBuildArgsToDockerfile = $this->application->settings->inject_build_args_to_dockerfile ?? true;
             $this->includeSourceCommitInBuild = $this->application->settings->include_source_commit_in_build ?? false;
+            $this->maxRestartCount = $this->application->max_restart_count ?? 10;
         }
+
+        // Load stop_grace_period separately since it has its own save handler
+        // Convert null to empty string to prevent dirty detection issues
+        $this->stopGracePeriod = $this->application->settings->stop_grace_period ?? '';
     }
 
     private function resetDefaultLabels()
@@ -210,6 +223,7 @@ class Advanced extends Component
             }
             $this->syncData(true);
             $this->dispatch('success', 'Settings saved.');
+            $this->dispatch('configurationChanged');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -228,6 +242,7 @@ class Advanced extends Component
             if (is_null($this->customInternalName)) {
                 $this->syncData(true);
                 $this->dispatch('success', 'Custom name saved.');
+                $this->dispatch('configurationChanged');
 
                 return;
             }
@@ -247,6 +262,47 @@ class Advanced extends Component
             }
             $this->syncData(true);
             $this->dispatch('success', 'Custom name saved.');
+            $this->dispatch('configurationChanged');
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function saveStopGracePeriod()
+    {
+        try {
+            $this->authorize('update', $this->application);
+
+            $validated = Validator::make(
+                ['stopGracePeriod' => $this->stopGracePeriod === '' ? null : $this->stopGracePeriod],
+                ['stopGracePeriod' => ['nullable', 'integer', 'min:'.MIN_STOP_GRACE_PERIOD_SECONDS, 'max:'.MAX_STOP_GRACE_PERIOD_SECONDS]],
+                [],
+                ['stopGracePeriod' => 'stop grace period']
+            )->validate();
+
+            $this->application->settings->stop_grace_period = $validated['stopGracePeriod'] === null
+                ? null
+                : (int) $validated['stopGracePeriod'];
+            $this->application->settings->save();
+
+            $this->dispatch('success', 'Stop grace period updated.');
+        } catch (ValidationException $e) {
+            throw $e;
+        } catch (\Throwable $e) {
+            return handleError($e, $this);
+        }
+    }
+
+    public function saveMaxRestartCount()
+    {
+        try {
+            $this->authorize('update', $this->application);
+            $this->validate([
+                'maxRestartCount' => 'integer|min:0',
+            ]);
+            $this->application->max_restart_count = $this->maxRestartCount;
+            $this->application->save();
+            $this->dispatch('success', 'Max restart count saved.');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }

app/Livewire/Project/Application/Configuration.php

@@ -17,17 +17,10 @@ class Configuration extends Component
 
     public $servers;
 
-    public function getListeners()
-    {
-        $teamId = auth()->user()->currentTeam()->id;
-
-        return [
-            "echo-private:team.{$teamId},ServiceChecked" => '$refresh',
-            "echo-private:team.{$teamId},ServiceStatusChanged" => '$refresh',
-            'buildPackUpdated' => '$refresh',
-            'refresh' => '$refresh',
-        ];
-    }
+    protected $listeners = [
+        'buildPackUpdated' => '$refresh',
+        'refresh' => '$refresh',
+    ];
 
     public function mount()
     {
@@ -35,7 +28,7 @@ class Configuration extends Component
 
         $project = currentTeam()
             ->projects()
-            ->select('id', 'uuid', 'team_id')
+            ->select('id', 'uuid', 'name', 'team_id')
             ->where('uuid', request()->route('project_uuid'))
             ->firstOrFail();
         $environment = $project->environments()
@@ -51,8 +44,6 @@ class Configuration extends Component
         $this->environment = $environment;
         $this->application = $application;
 
-
-
         if ($this->application->build_pack === 'dockercompose' && $this->currentRoute === 'project.application.healthcheck') {
             return redirect()->route('project.application.configuration', ['project_uuid' => $project->uuid, 'environment_uuid' => $environment->uuid, 'application_uuid' => $application->uuid]);
         }

app/Livewire/Project/Application/General.php

@@ -5,6 +5,7 @@ namespace App\Livewire\Project\Application;
 use App\Actions\Application\GenerateConfig;
 use App\Jobs\ApplicationDeploymentJob;
 use App\Models\Application;
+use App\Rules\ValidGitBranch;
 use App\Support\ValidationPatterns;
 use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
@@ -144,7 +145,7 @@ class General extends Component
             'description' => ValidationPatterns::descriptionRules(),
             'fqdn' => 'nullable',
             'gitRepository' => 'required',
-            'gitBranch' => 'required',
+            'gitBranch' => ['required', 'string', new ValidGitBranch],
             'gitCommitSha' => ['nullable', 'string', 'regex:/^[a-zA-Z0-9][a-zA-Z0-9._\-\/]*$/'],
             'installCommand' => ValidationPatterns::shellSafeCommandRules(),
             'buildCommand' => ValidationPatterns::shellSafeCommandRules(),
@@ -153,12 +154,12 @@ class General extends Component
             'staticImage' => 'required',
             'baseDirectory' => array_merge(['required'], array_slice(ValidationPatterns::directoryPathRules(), 1)),
             'publishDirectory' => ValidationPatterns::directoryPathRules(),
-            'portsExposes' => ['required', 'string', 'regex:/^(\d+)(,\d+)*$/'],
+            'portsExposes' => ['nullable', 'string', 'regex:/^(\d+)(,\d+)*$/'],
             'portsMappings' => ValidationPatterns::portMappingRules(),
             'customNetworkAliases' => 'nullable',
             'dockerfile' => 'nullable',
-            'dockerRegistryImageName' => 'nullable',
-            'dockerRegistryImageTag' => 'nullable',
+            'dockerRegistryImageName' => ValidationPatterns::dockerImageNameRules(),
+            'dockerRegistryImageTag' => ValidationPatterns::dockerImageTagRules(),
             'dockerfileLocation' => ValidationPatterns::filePathRules(),
             'dockerComposeLocation' => ValidationPatterns::filePathRules(),
             'dockerCompose' => 'nullable',
@@ -211,7 +212,6 @@ class General extends Component
                 'buildPack.required' => 'The Build Pack field is required.',
                 'staticImage.required' => 'The Static Image field is required.',
                 'baseDirectory.required' => 'The Base Directory field is required.',
-                'portsExposes.required' => 'The Exposed Ports field is required.',
                 'portsExposes.regex' => 'Ports exposes must be a comma-separated list of port numbers (e.g. 3000,3001).',
                 ...ValidationPatterns::portMappingMessages(),
                 'isStatic.required' => 'The Static setting is required.',
@@ -606,7 +606,7 @@ class General extends Component
         // Sync property to model before checking/modifying
         $this->syncData(toModel: true);
 
-        if ($this->buildPack !== 'nixpacks') {
+        if ($this->buildPack !== 'nixpacks' && $this->buildPack !== 'railpack') {
             $this->isStatic = false;
             $this->application->settings->is_static = false;
             $this->application->settings->save();
@@ -759,7 +759,7 @@ class General extends Component
 
             $this->resetErrorBag();
 
-            $this->portsExposes = str($this->portsExposes)->replace(' ', '')->trim()->toString();
+            $this->portsExposes = str($this->portsExposes)->replace(' ', '')->trim()->toString() ?: null;
             if ($this->portsMappings) {
                 $this->portsMappings = str($this->portsMappings)->replace(' ', '')->trim()->toString();
             }
@@ -848,7 +848,7 @@ class General extends Component
             }
             if ($this->buildPack === 'dockerimage') {
                 $this->validate([
-                    'dockerRegistryImageName' => 'required',
+                    'dockerRegistryImageName' => ValidationPatterns::dockerImageNameRules(required: true),
                 ]);
             }
 

app/Livewire/Project/Application/Previews.php

@@ -338,10 +338,11 @@ class Previews extends Component
     private function stopContainers(array $containers, $server)
     {
         $containersToStop = collect($containers)->pluck('Names')->toArray();
+        $timeout = $this->application->settings->stopGracePeriodSeconds();
 
         foreach ($containersToStop as $containerName) {
             instant_remote_process(command: [
-                "docker stop -t 30 $containerName",
+                "docker stop --time=$timeout $containerName",
                 "docker rm -f $containerName",
             ], server: $server, throwError: false);
         }

app/Livewire/Project/Application/ServerStatusBadge.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Livewire\Project\Application;
+
+use App\Models\Application;
+use Illuminate\Contracts\View\View;
+use Illuminate\Support\Facades\Auth;
+use Livewire\Component;
+
+class ServerStatusBadge extends Component
+{
+    public Application $application;
+
+    public function getListeners(): array
+    {
+        $user = Auth::user();
+        if (! $user) {
+            return [];
+        }
+
+        $team = $user->currentTeam();
+        if (! $team) {
+            return [];
+        }
+
+        return [
+            "echo-private:team.{$team->id},ServiceStatusChanged" => 'refreshStatus',
+            "echo-private:team.{$team->id},ServiceChecked" => 'refreshStatus',
+        ];
+    }
+
+    public function refreshStatus(): void
+    {
+        $this->application->refresh();
+    }
+
+    public function render(): View
+    {
+        return view('livewire.project.application.server-status-badge');
+    }
+}

app/Livewire/Project/Application/Source.php

@@ -3,7 +3,10 @@
 namespace App\Livewire\Project\Application;
 
 use App\Models\Application;
+use App\Models\GithubApp;
+use App\Models\GitlabApp;
 use App\Models\PrivateKey;
+use App\Rules\ValidGitBranch;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
@@ -21,13 +24,13 @@ class Source extends Component
     #[Validate(['nullable', 'string'])]
     public ?string $privateKeyName = null;
 
-    #[Validate(['nullable', 'integer'])]
+    #[Locked]
     public ?int $privateKeyId = null;
 
     #[Validate(['required', 'string'])]
     public string $gitRepository;
 
-    #[Validate(['required', 'string'])]
+    #[Validate(['required', 'string', new ValidGitBranch])]
     public string $gitBranch;
 
     #[Validate(['nullable', 'string', 'regex:/^[a-zA-Z0-9][a-zA-Z0-9._\-\/]*$/'])]
@@ -103,12 +106,14 @@ class Source extends Component
     {
         try {
             $this->authorize('update', $this->application);
-            $this->privateKeyId = $privateKeyId;
+            $key = PrivateKey::ownedByCurrentTeam()->findOrFail($privateKeyId);
+            $this->privateKeyId = $key->id;
             $this->syncData(true);
             $this->getPrivateKeys();
             $this->application->refresh();
             $this->privateKeyName = $this->application->private_key->name;
             $this->dispatch('success', 'Private key updated!');
+            $this->dispatch('configurationChanged');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -124,6 +129,7 @@ class Source extends Component
             }
             $this->syncData(true);
             $this->dispatch('success', 'Application source updated!');
+            $this->dispatch('configurationChanged');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -134,8 +140,11 @@ class Source extends Component
 
         try {
             $this->authorize('update', $this->application);
+            $allowedSourceTypes = [GithubApp::class, GitlabApp::class];
+            abort_unless(in_array($sourceType, $allowedSourceTypes, true), 404);
+            $source = $sourceType::ownedByCurrentTeam()->findOrFail($sourceId);
             $this->application->update([
-                'source_id' => $sourceId,
+                'source_id' => $source->id,
                 'source_type' => $sourceType,
             ]);
 

app/Livewire/Project/Database/BackupEdit.php

@@ -3,6 +3,7 @@
 namespace App\Livewire\Project\Database;
 
 use App\Models\ScheduledDatabaseBackup;
+use App\Models\ServiceDatabase;
 use Exception;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Locked;
@@ -144,7 +145,7 @@ class BackupEdit extends Component
 
         try {
             $server = null;
-            if ($this->backup->database instanceof \App\Models\ServiceDatabase) {
+            if ($this->backup->database instanceof ServiceDatabase) {
                 $server = $this->backup->database->service->destination->server;
             } elseif ($this->backup->database->destination && $this->backup->database->destination->server) {
                 $server = $this->backup->database->destination->server;
@@ -170,7 +171,7 @@ class BackupEdit extends Component
 
             $this->backup->delete();
 
-            if ($this->backup->database->getMorphClass() === \App\Models\ServiceDatabase::class) {
+            if ($this->backup->database->getMorphClass() === ServiceDatabase::class) {
                 $serviceDatabase = $this->backup->database;
 
                 return redirect()->route('project.service.database.backups', [
@@ -182,7 +183,7 @@ class BackupEdit extends Component
             } else {
                 return redirect()->route('project.database.backup.index', $this->parameters);
             }
-        } catch (\Exception $e) {
+        } catch (Exception $e) {
             $this->dispatch('error', 'Failed to delete backup: '.$e->getMessage());
 
             return handleError($e, $this);
@@ -207,6 +208,13 @@ class BackupEdit extends Component
             $this->backup->s3_storage_id = null;
         }
 
+        // S3 backup cannot be enabled without a valid S3 storage owned by the team
+        $availableS3Ids = collect($this->s3s)->pluck('id');
+        if ($this->backup->save_s3 && ! $availableS3Ids->contains($this->backup->s3_storage_id)) {
+            $this->backup->save_s3 = $this->saveS3 = false;
+            $this->backup->s3_storage_id = $this->s3StorageId = null;
+        }
+
         // Validate that disable_local_backup can only be true when S3 backup is enabled
         if ($this->backup->disable_local_backup && ! $this->backup->save_s3) {
             $this->backup->disable_local_backup = $this->disableLocalBackup = false;
@@ -214,7 +222,7 @@ class BackupEdit extends Component
 
         $isValid = validate_cron_expression($this->backup->frequency);
         if (! $isValid) {
-            throw new \Exception('Invalid Cron / Human expression');
+            throw new Exception('Invalid Cron / Human expression');
         }
         $this->validate();
     }

app/Livewire/Project/Database/Clickhouse/General.php

@@ -40,18 +40,21 @@ class General extends Component
 
     public ?string $customDockerRunOptions = null;
 
-    public ?string $dbUrl = null;
-
-    public ?string $dbUrlPublic = null;
-
     public bool $isLogDrainEnabled = false;
 
-    public function getListeners()
+    public function getListeners(): array
     {
-        $teamId = Auth::user()->currentTeam()->id;
+        $user = Auth::user();
+        if (! $user) {
+            return [];
+        }
+        $team = $user->currentTeam();
+        if (! $team) {
+            return [];
+        }
 
         return [
-            "echo-private:team.{$teamId},DatabaseProxyStopped" => 'databaseProxyStopped',
+            "echo-private:team.{$team->id},DatabaseProxyStopped" => 'databaseProxyStopped',
         ];
     }
 
@@ -88,8 +91,6 @@ class General extends Component
             'publicPort' => 'nullable|integer|min:1|max:65535',
             'publicPortTimeout' => 'nullable|integer|min:1',
             'customDockerRunOptions' => 'nullable|string',
-            'dbUrl' => 'nullable|string',
-            'dbUrlPublic' => 'nullable|string',
             'isLogDrainEnabled' => 'nullable|boolean',
         ];
     }
@@ -129,9 +130,6 @@ class General extends Component
             $this->database->custom_docker_run_options = $this->customDockerRunOptions;
             $this->database->is_log_drain_enabled = $this->isLogDrainEnabled;
             $this->database->save();
-
-            $this->dbUrl = $this->database->internal_db_url;
-            $this->dbUrlPublic = $this->database->external_db_url;
         } else {
             $this->name = $this->database->name;
             $this->description = $this->database->description;
@@ -144,8 +142,6 @@ class General extends Component
             $this->publicPortTimeout = $this->database->public_port_timeout;
             $this->customDockerRunOptions = $this->database->custom_docker_run_options;
             $this->isLogDrainEnabled = $this->database->is_log_drain_enabled;
-            $this->dbUrl = $this->database->internal_db_url;
-            $this->dbUrlPublic = $this->database->external_db_url;
         }
     }
 
@@ -194,6 +190,7 @@ class General extends Component
                 StopDatabaseProxy::run($this->database);
                 $this->dispatch('success', 'Database is no longer publicly accessible.');
             }
+            $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
@@ -202,9 +199,13 @@ class General extends Component
         }
     }
 
-    public function databaseProxyStopped()
+    public function databaseProxyStopped(): void
     {
-        $this->syncData();
+        $this->database->refresh();
+        $this->isPublic = $this->database->is_public;
+        $this->publicPort = $this->database->public_port;
+        $this->publicPortTimeout = $this->database->public_port_timeout;
+        $this->dispatch('databaseUpdated');
     }
 
     public function submit()
@@ -220,6 +221,7 @@ class General extends Component
             }
             $this->syncData(true);
             $this->dispatch('success', 'Database updated.');
+            $this->dispatch('databaseUpdated');
         } catch (Exception $e) {
             return handleError($e, $this);
         } finally {

app/Livewire/Project/Database/Clickhouse/StatusInfo.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Livewire\Project\Database\Clickhouse;
+
+use App\Models\StandaloneClickhouse;
+use App\Traits\HasDatabaseStatusInfo;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class StatusInfo extends Component
+{
+    use AuthorizesRequests;
+    use HasDatabaseStatusInfo;
+
+    public StandaloneClickhouse $database;
+
+    protected function databaseLabel(): string
+    {
+        return 'Clickhouse';
+    }
+
+    protected function supportsSsl(): bool
+    {
+        return false;
+    }
+
+    protected function showPublicUrlPlaceholder(): bool
+    {
+        return true;
+    }
+}

app/Livewire/Project/Database/Configuration.php

@@ -2,8 +2,9 @@
 
 namespace App\Livewire\Project\Database;
 
-use Auth;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\ItemNotFoundException;
 use Livewire\Component;
 
 class Configuration extends Component
@@ -18,15 +19,6 @@ class Configuration extends Component
 
     public $environment;
 
-    public function getListeners()
-    {
-        $teamId = Auth::user()->currentTeam()->id;
-
-        return [
-            "echo-private:team.{$teamId},ServiceChecked" => '$refresh',
-        ];
-    }
-
     public function mount()
     {
         try {
@@ -34,7 +26,7 @@ class Configuration extends Component
 
             $project = currentTeam()
                 ->projects()
-                ->select('id', 'uuid', 'team_id')
+                ->select('id', 'uuid', 'name', 'team_id')
                 ->where('uuid', request()->route('project_uuid'))
                 ->firstOrFail();
             $environment = $project->environments()
@@ -55,10 +47,10 @@ class Configuration extends Component
                 $this->dispatch('configurationChanged');
             }
         } catch (\Throwable $e) {
-            if ($e instanceof \Illuminate\Auth\Access\AuthorizationException) {
+            if ($e instanceof AuthorizationException) {
                 return redirect()->route('dashboard');
             }
-            if ($e instanceof \Illuminate\Support\ItemNotFoundException) {
+            if ($e instanceof ItemNotFoundException) {
                 return redirect()->route('dashboard');
             }
 

app/Livewire/Project/Database/CreateScheduledBackup.php

@@ -2,7 +2,9 @@
 
 namespace App\Livewire\Project\Database;
 
+use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
+use App\Models\ServiceDatabase;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
 use Livewire\Attributes\Locked;
@@ -48,6 +50,20 @@ class CreateScheduledBackup extends Component
 
             $this->validate();
 
+            if ($this->saveToS3) {
+                $s3StorageExists = ! is_null($this->s3StorageId)
+                    && S3Storage::where('team_id', currentTeam()->id)
+                        ->where('is_usable', true)
+                        ->whereKey($this->s3StorageId)
+                        ->exists();
+
+                if (! $s3StorageExists) {
+                    $this->dispatch('error', 'Please select a valid S3 storage to enable S3 backups.');
+
+                    return;
+                }
+            }
+
             $isValid = validate_cron_expression($this->frequency);
             if (! $isValid) {
                 $this->dispatch('error', 'Invalid Cron / Human expression.');
@@ -74,7 +90,7 @@ class CreateScheduledBackup extends Component
             }
 
             $databaseBackup = ScheduledDatabaseBackup::create($payload);
-            if ($this->database->getMorphClass() === \App\Models\ServiceDatabase::class) {
+            if ($this->database->getMorphClass() === ServiceDatabase::class) {
                 $this->dispatch('refreshScheduledBackups', $databaseBackup->id);
             } else {
                 $this->dispatch('refreshScheduledBackups');

app/Livewire/Project/Database/Dragonfly/General.php

@@ -4,11 +4,9 @@ namespace App\Livewire\Project\Database\Dragonfly;
 
 use App\Actions\Database\StartDatabaseProxy;
 use App\Actions\Database\StopDatabaseProxy;
-use App\Helpers\SslHelper;
 use App\Models\Server;
 use App\Models\StandaloneDragonfly;
 use App\Support\ValidationPatterns;
-use Carbon\Carbon;
 use Exception;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
@@ -40,25 +38,21 @@ class General extends Component
 
     public ?string $customDockerRunOptions = null;
 
-    public ?string $dbUrl = null;
-
-    public ?string $dbUrlPublic = null;
-
     public bool $isLogDrainEnabled = false;
 
-    public ?Carbon $certificateValidUntil = null;
-
-    public bool $enable_ssl = false;
-
-    public function getListeners()
+    public function getListeners(): array
     {
-        $userId = Auth::id();
-        $teamId = Auth::user()->currentTeam()->id;
+        $user = Auth::user();
+        if (! $user) {
+            return [];
+        }
+        $team = $user->currentTeam();
+        if (! $team) {
+            return [];
+        }
 
         return [
-            "echo-private:team.{$teamId},DatabaseProxyStopped" => 'databaseProxyStopped',
-            "echo-private:user.{$userId},DatabaseStatusChanged" => 'refresh',
-            "echo-private:team.{$teamId},ServiceChecked" => 'refresh',
+            "echo-private:team.{$team->id},DatabaseProxyStopped" => 'databaseProxyStopped',
         ];
     }
 
@@ -73,12 +67,6 @@ class General extends Component
 
                 return;
             }
-
-            $existingCert = $this->database->sslCertificates()->first();
-
-            if ($existingCert) {
-                $this->certificateValidUntil = $existingCert->valid_until;
-            }
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -98,10 +86,7 @@ class General extends Component
             'publicPort' => 'nullable|integer|min:1|max:65535',
             'publicPortTimeout' => 'nullable|integer|min:1',
             'customDockerRunOptions' => 'nullable|string',
-            'dbUrl' => 'nullable|string',
-            'dbUrlPublic' => 'nullable|string',
             'isLogDrainEnabled' => 'nullable|boolean',
-            'enable_ssl' => 'nullable|boolean',
         ];
     }
 
@@ -137,11 +122,7 @@ class General extends Component
             $this->database->public_port_timeout = $this->publicPortTimeout ?: null;
             $this->database->custom_docker_run_options = $this->customDockerRunOptions;
             $this->database->is_log_drain_enabled = $this->isLogDrainEnabled;
-            $this->database->enable_ssl = $this->enable_ssl;
             $this->database->save();
-
-            $this->dbUrl = $this->database->internal_db_url;
-            $this->dbUrlPublic = $this->database->external_db_url;
         } else {
             $this->name = $this->database->name;
             $this->description = $this->database->description;
@@ -153,9 +134,6 @@ class General extends Component
             $this->publicPortTimeout = $this->database->public_port_timeout;
             $this->customDockerRunOptions = $this->database->custom_docker_run_options;
             $this->isLogDrainEnabled = $this->database->is_log_drain_enabled;
-            $this->enable_ssl = $this->database->enable_ssl;
-            $this->dbUrl = $this->database->internal_db_url;
-            $this->dbUrlPublic = $this->database->external_db_url;
         }
     }
 
@@ -204,6 +182,7 @@ class General extends Component
                 StopDatabaseProxy::run($this->database);
                 $this->dispatch('success', 'Database is no longer publicly accessible.');
             }
+            $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
@@ -212,9 +191,13 @@ class General extends Component
         }
     }
 
-    public function databaseProxyStopped()
+    public function databaseProxyStopped(): void
     {
-        $this->syncData();
+        $this->database->refresh();
+        $this->isPublic = $this->database->is_public;
+        $this->publicPort = $this->database->public_port;
+        $this->publicPortTimeout = $this->database->public_port_timeout;
+        $this->dispatch('databaseUpdated');
     }
 
     public function submit()
@@ -230,6 +213,7 @@ class General extends Component
             }
             $this->syncData(true);
             $this->dispatch('success', 'Database updated.');
+            $this->dispatch('databaseUpdated');
         } catch (Exception $e) {
             return handleError($e, $this);
         } finally {
@@ -241,67 +225,6 @@ class General extends Component
         }
     }
 
-    public function instantSaveSSL()
-    {
-        try {
-            $this->authorize('update', $this->database);
-
-            $this->syncData(true);
-            $this->dispatch('success', 'SSL configuration updated.');
-        } catch (Exception $e) {
-            return handleError($e, $this);
-        }
-    }
-
-    public function regenerateSslCertificate()
-    {
-        try {
-            $this->authorize('update', $this->database);
-
-            $existingCert = $this->database->sslCertificates()->first();
-
-            if (! $existingCert) {
-                $this->dispatch('error', 'No existing SSL certificate found for this database.');
-
-                return;
-            }
-
-            $server = $this->database->destination->server;
-
-            $caCert = $server->sslCertificates()
-                ->where('is_ca_certificate', true)
-                ->first();
-
-            if (! $caCert) {
-                $server->generateCaCertificate();
-                $caCert = $server->sslCertificates()->where('is_ca_certificate', true)->first();
-            }
-
-            if (! $caCert) {
-                $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
-
-                return;
-            }
-
-            SslHelper::generateSslCertificate(
-                commonName: $existingCert->common_name,
-                subjectAlternativeNames: $existingCert->subject_alternative_names ?? [],
-                resourceType: $existingCert->resource_type,
-                resourceId: $existingCert->resource_id,
-                serverId: $existingCert->server_id,
-                caCert: $caCert->ssl_certificate,
-                caKey: $caCert->ssl_private_key,
-                configurationDir: $existingCert->configuration_dir,
-                mountPath: $existingCert->mount_path,
-                isPemKeyFileRequired: true,
-            );
-
-            $this->dispatch('success', 'SSL certificates regenerated. Restart database to apply changes.');
-        } catch (Exception $e) {
-            handleError($e, $this);
-        }
-    }
-
     public function refresh(): void
     {
         $this->database->refresh();

app/Livewire/Project/Database/Dragonfly/StatusInfo.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Livewire\Project\Database\Dragonfly;
+
+use App\Models\StandaloneDragonfly;
+use App\Traits\HasDatabaseStatusInfo;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class StatusInfo extends Component
+{
+    use AuthorizesRequests;
+    use HasDatabaseStatusInfo;
+
+    public StandaloneDragonfly $database;
+
+    protected function databaseLabel(): string
+    {
+        return 'Dragonfly';
+    }
+
+    protected function showPublicUrlPlaceholder(): bool
+    {
+        return true;
+    }
+}

app/Livewire/Project/Database/Health.php

@@ -0,0 +1,117 @@
+<?php
+
+namespace App\Livewire\Project\Database;
+
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\Validate;
+use Livewire\Component;
+
+class Health extends Component
+{
+    use AuthorizesRequests;
+
+    public $database;
+
+    #[Validate(['boolean'])]
+    public bool $healthCheckEnabled = true;
+
+    #[Validate(['integer', 'min:1'])]
+    public int $healthCheckInterval = 15;
+
+    #[Validate(['integer', 'min:1'])]
+    public int $healthCheckTimeout = 5;
+
+    #[Validate(['integer', 'min:1'])]
+    public int $healthCheckRetries = 5;
+
+    #[Validate(['integer', 'min:0'])]
+    public int $healthCheckStartPeriod = 5;
+
+    public function mount(): void
+    {
+        $this->authorize('view', $this->database);
+        $this->syncData();
+    }
+
+    public function syncData(bool $toModel = false): void
+    {
+        if ($toModel) {
+            $this->validate();
+            $this->database->health_check_enabled = $this->healthCheckEnabled;
+            $this->database->health_check_interval = $this->healthCheckInterval;
+            $this->database->health_check_timeout = $this->healthCheckTimeout;
+            $this->database->health_check_retries = $this->healthCheckRetries;
+            $this->database->health_check_start_period = $this->healthCheckStartPeriod;
+            $this->database->save();
+        } else {
+            $this->healthCheckEnabled = $this->database->health_check_enabled;
+            $this->healthCheckInterval = $this->database->health_check_interval;
+            $this->healthCheckTimeout = $this->database->health_check_timeout;
+            $this->healthCheckRetries = $this->database->health_check_retries;
+            $this->healthCheckStartPeriod = $this->database->health_check_start_period;
+        }
+    }
+
+    public function instantSave(): void
+    {
+        $this->submit();
+    }
+
+    public function submit(): void
+    {
+        $updateSuccessful = false;
+
+        try {
+            $this->authorize('update', $this->database);
+            $this->syncData(true);
+            $updateSuccessful = true;
+            $this->dispatch('success', 'Health check updated. Restart the database to apply the changes.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+
+        if (! $updateSuccessful) {
+            return;
+        }
+
+        $this->markConfigurationChanged();
+    }
+
+    public function toggleHealthcheck(): void
+    {
+        $updateSuccessful = false;
+
+        try {
+            $this->authorize('update', $this->database);
+            $this->healthCheckEnabled = ! $this->healthCheckEnabled;
+            $this->syncData(true);
+            $updateSuccessful = true;
+            $this->dispatch('success', 'Health check '.($this->healthCheckEnabled ? 'enabled' : 'disabled').'. Restart the database to apply the changes.');
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+
+        if (! $updateSuccessful) {
+            return;
+        }
+
+        $this->markConfigurationChanged();
+    }
+
+    private function markConfigurationChanged(): void
+    {
+        if (is_null($this->database->config_hash)) {
+            $this->database->isConfigurationChanged(true);
+
+            return;
+        }
+
+        $this->dispatch('configurationChanged');
+    }
+
+    public function render(): View
+    {
+        return view('livewire.project.database.health');
+    }
+}

app/Livewire/Project/Database/Import.php

@@ -2,14 +2,14 @@
 
 namespace App\Livewire\Project\Database;
 
-use App\Models\S3Storage;
-use App\Models\Server;
-use App\Models\Service;
-use App\Support\ValidationPatterns;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneRedis;
+use Illuminate\Contracts\View\View;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
-use Illuminate\Support\Facades\Storage;
-use Livewire\Attributes\Computed;
 use Livewire\Attributes\Locked;
 use Livewire\Component;
 
@@ -17,797 +17,134 @@ class Import extends Component
 {
     use AuthorizesRequests;
 
-    /**
-     * Validate that a string is safe for use as an S3 bucket name.
-     * Allows alphanumerics, dots, dashes, and underscores.
-     */
-    private function validateBucketName(string $bucket): bool
-    {
-        return preg_match('/^[a-zA-Z0-9.\-_]+$/', $bucket) === 1;
-    }
-
-    /**
-     * Validate that a string is safe for use as an S3 path.
-     * Allows alphanumerics, dots, dashes, underscores, slashes, and common file characters.
-     */
-    private function validateS3Path(string $path): bool
-    {
-        // Must not be empty
-        if (empty($path)) {
-            return false;
-        }
-
-        // Must not contain dangerous shell metacharacters or command injection patterns
-        $dangerousPatterns = [
-            '..', // Directory traversal
-            '$(', // Command substitution
-            '`',  // Backtick command substitution
-            '|',  // Pipe
-            ';',  // Command separator
-            '&',  // Background/AND
-            '>',  // Redirect
-            '<',  // Redirect
-            "\n", // Newline
-            "\r", // Carriage return
-            "\0", // Null byte
-            "'",  // Single quote
-            '"',  // Double quote
-            '\\', // Backslash
-        ];
-
-        foreach ($dangerousPatterns as $pattern) {
-            if (str_contains($path, $pattern)) {
-                return false;
-            }
-        }
-
-        // Allow alphanumerics, dots, dashes, underscores, slashes, spaces, plus, equals, at
-        return preg_match('/^[a-zA-Z0-9.\-_\/\s+@=]+$/', $path) === 1;
-    }
-
-    /**
-     * Validate that a string is safe for use as a file path on the server.
-     */
-    private function validateServerPath(string $path): bool
-    {
-        // Must be an absolute path
-        if (! str_starts_with($path, '/')) {
-            return false;
-        }
-
-        // Must not contain dangerous shell metacharacters or command injection patterns
-        $dangerousPatterns = [
-            '..', // Directory traversal
-            '$(', // Command substitution
-            '`',  // Backtick command substitution
-            '|',  // Pipe
-            ';',  // Command separator
-            '&',  // Background/AND
-            '>',  // Redirect
-            '<',  // Redirect
-            "\n", // Newline
-            "\r", // Carriage return
-            "\0", // Null byte
-            "'",  // Single quote
-            '"',  // Double quote
-            '\\', // Backslash
-        ];
-
-        foreach ($dangerousPatterns as $pattern) {
-            if (str_contains($path, $pattern)) {
-                return false;
-            }
-        }
-
-        // Allow alphanumerics, dots, dashes, underscores, slashes, and spaces
-        return preg_match('/^[a-zA-Z0-9.\-_\/\s]+$/', $path) === 1;
-    }
-
-    public bool $unsupported = false;
-
-    // Store IDs instead of models for proper Livewire serialization
     #[Locked]
     public ?int $resourceId = null;
 
     #[Locked]
     public ?string $resourceType = null;
 
-    #[Locked]
-    public ?int $serverId = null;
-
-    // View-friendly properties to avoid computed property access in Blade
-    #[Locked]
-    public string $resourceUuid = '';
-
     public string $resourceStatus = '';
 
-    #[Locked]
-    public string $resourceDbType = '';
+    public string $resourceUuid = '';
 
-    public array $parameters = [];
+    public bool $unsupported = false;
 
-    public array $containers = [];
-
-    public bool $scpInProgress = false;
-
-    public bool $importRunning = false;
-
-    public ?string $filename = null;
-
-    public ?string $filesize = null;
-
-    public bool $isUploading = false;
-
-    public int $progress = 0;
-
-    public bool $error = false;
-
-    #[Locked]
-    public string $container;
-
-    public array $importCommands = [];
-
-    public bool $dumpAll = false;
-
-    public string $restoreCommandText = '';
-
-    public string $customLocation = '';
-
-    public ?int $activityId = null;
-
-    public string $postgresqlRestoreCommand = 'pg_restore -U $POSTGRES_USER -d ${POSTGRES_DB:-${POSTGRES_USER:-postgres}}';
-
-    public string $mysqlRestoreCommand = 'mysql -u $MYSQL_USER -p$MYSQL_PASSWORD $MYSQL_DATABASE';
-
-    public string $mariadbRestoreCommand = 'mariadb -u $MARIADB_USER -p$MARIADB_PASSWORD $MARIADB_DATABASE';
-
-    public string $mongodbRestoreCommand = 'mongorestore --authenticationDatabase=admin --username $MONGO_INITDB_ROOT_USERNAME --password $MONGO_INITDB_ROOT_PASSWORD --uri mongodb://localhost:27017 --gzip --archive=';
-
-    // S3 Restore properties
-    public array $availableS3Storages = [];
-
-    public ?int $s3StorageId = null;
-
-    public string $s3Path = '';
-
-    public ?int $s3FileSize = null;
-
-    #[Computed]
-    public function resource()
+    public function getListeners(): array
     {
-        if ($this->resourceId === null || $this->resourceType === null) {
-            return null;
+        $listeners = ['databaseUpdated' => 'refreshStatus'];
+
+        $user = Auth::user();
+        if (! $user) {
+            return $listeners;
         }
 
-        return $this->resourceType::find($this->resourceId);
-    }
+        $listeners["echo-private:user.{$user->id},DatabaseStatusChanged"] = 'refreshStatus';
 
-    #[Computed]
-    public function server()
-    {
-        if ($this->serverId === null) {
-            return null;
+        $team = $user->currentTeam();
+        if ($team) {
+            $listeners["echo-private:team.{$team->id},ServiceChecked"] = 'refreshStatus';
         }
 
-        return Server::ownedByCurrentTeam()->find($this->serverId);
+        return $listeners;
     }
 
-    public function getListeners()
+    public function mount(): void
     {
-        $userId = Auth::id();
-
-        return [
-            "echo-private:user.{$userId},DatabaseStatusChanged" => '$refresh',
-            'slideOverClosed' => 'resetActivityId',
-        ];
-    }
-
-    public function resetActivityId()
-    {
-        $this->activityId = null;
-    }
-
-    public function mount()
-    {
-        $this->parameters = get_route_parameters();
-        $this->getContainers();
-        $this->loadAvailableS3Storages();
-    }
-
-    public function updatedDumpAll($value)
-    {
-        $morphClass = $this->resource->getMorphClass();
-
-        // Handle ServiceDatabase by checking the database type
-        if ($morphClass === \App\Models\ServiceDatabase::class) {
-            $dbType = $this->resource->databaseType();
-            if (str_contains($dbType, 'mysql')) {
-                $morphClass = 'mysql';
-            } elseif (str_contains($dbType, 'mariadb')) {
-                $morphClass = 'mariadb';
-            } elseif (str_contains($dbType, 'postgres')) {
-                $morphClass = 'postgresql';
-            }
-        }
-
-        switch ($morphClass) {
-            case \App\Models\StandaloneMariadb::class:
-            case 'mariadb':
-                if ($value === true) {
-                    $this->mariadbRestoreCommand = <<<'EOD'
-for pid in $(mariadb -u root -p$MARIADB_ROOT_PASSWORD -N -e "SELECT id FROM information_schema.processlist WHERE user != 'root';"); do
-  mariadb -u root -p$MARIADB_ROOT_PASSWORD -e "KILL $pid" 2>/dev/null || true
-done && \
-mariadb -u root -p$MARIADB_ROOT_PASSWORD -N -e "SELECT CONCAT('DROP DATABASE IF EXISTS \`',schema_name,'\`;') FROM information_schema.schemata WHERE schema_name NOT IN ('information_schema','mysql','performance_schema','sys');" | mariadb -u root -p$MARIADB_ROOT_PASSWORD && \
-mariadb -u root -p$MARIADB_ROOT_PASSWORD -e "CREATE DATABASE IF NOT EXISTS \`${MARIADB_DATABASE:-default}\`;" && \
-(gunzip -cf $tmpPath 2>/dev/null || cat $tmpPath) | sed -e '/^CREATE DATABASE/d' -e '/^USE \`mysql\`/d' | mariadb -u root -p$MARIADB_ROOT_PASSWORD ${MARIADB_DATABASE:-default}
-EOD;
-                    $this->restoreCommandText = $this->mariadbRestoreCommand.' && (gunzip -cf <temp_backup_file> 2>/dev/null || cat <temp_backup_file>) | mariadb -u root -p$MARIADB_ROOT_PASSWORD ${MARIADB_DATABASE:-default}';
-                } else {
-                    $this->mariadbRestoreCommand = 'mariadb -u $MARIADB_USER -p$MARIADB_PASSWORD $MARIADB_DATABASE';
-                }
-                break;
-            case \App\Models\StandaloneMysql::class:
-            case 'mysql':
-                if ($value === true) {
-                    $this->mysqlRestoreCommand = <<<'EOD'
-for pid in $(mysql -u root -p$MYSQL_ROOT_PASSWORD -N -e "SELECT id FROM information_schema.processlist WHERE user != 'root';"); do
-  mysql -u root -p$MYSQL_ROOT_PASSWORD -e "KILL $pid" 2>/dev/null || true
-done && \
-mysql -u root -p$MYSQL_ROOT_PASSWORD -N -e "SELECT CONCAT('DROP DATABASE IF EXISTS \`',schema_name,'\`;') FROM information_schema.schemata WHERE schema_name NOT IN ('information_schema','mysql','performance_schema','sys');" | mysql -u root -p$MYSQL_ROOT_PASSWORD && \
-mysql -u root -p$MYSQL_ROOT_PASSWORD -e "CREATE DATABASE IF NOT EXISTS \`${MYSQL_DATABASE:-default}\`;" && \
-(gunzip -cf $tmpPath 2>/dev/null || cat $tmpPath) | sed -e '/^CREATE DATABASE/d' -e '/^USE \`mysql\`/d' | mysql -u root -p$MYSQL_ROOT_PASSWORD ${MYSQL_DATABASE:-default}
-EOD;
-                    $this->restoreCommandText = $this->mysqlRestoreCommand.' && (gunzip -cf <temp_backup_file> 2>/dev/null || cat <temp_backup_file>) | mysql -u root -p$MYSQL_ROOT_PASSWORD ${MYSQL_DATABASE:-default}';
-                } else {
-                    $this->mysqlRestoreCommand = 'mysql -u $MYSQL_USER -p$MYSQL_PASSWORD $MYSQL_DATABASE';
-                }
-                break;
-            case \App\Models\StandalonePostgresql::class:
-            case 'postgresql':
-                if ($value === true) {
-                    $this->postgresqlRestoreCommand = <<<'EOD'
-psql -U ${POSTGRES_USER} -c "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname IS NOT NULL AND pid <> pg_backend_pid()" && \
-psql -U ${POSTGRES_USER} -t -c "SELECT datname FROM pg_database WHERE NOT datistemplate" | xargs -I {} dropdb -U ${POSTGRES_USER} --if-exists {} && \
-createdb -U ${POSTGRES_USER} ${POSTGRES_DB:-${POSTGRES_USER:-postgres}}
-EOD;
-                    $this->restoreCommandText = $this->postgresqlRestoreCommand.' && (gunzip -cf <temp_backup_file> 2>/dev/null || cat <temp_backup_file>) | psql -U ${POSTGRES_USER} -d ${POSTGRES_DB:-${POSTGRES_USER:-postgres}}';
-                } else {
-                    $this->postgresqlRestoreCommand = 'pg_restore -U ${POSTGRES_USER} -d ${POSTGRES_DB:-${POSTGRES_USER:-postgres}}';
-                }
-                break;
-        }
-
-    }
-
-    public function getContainers()
-    {
-        $this->containers = [];
-        $teamId = data_get(auth()->user()->currentTeam(), 'id');
-
-        // Try to find resource by route parameter
-        $databaseUuid = data_get($this->parameters, 'database_uuid');
-        $stackServiceUuid = data_get($this->parameters, 'stack_service_uuid');
-
-        $resource = null;
-        if ($databaseUuid) {
-            // Standalone database route
-            $resource = getResourceByUuid($databaseUuid, $teamId);
-            if (is_null($resource)) {
-                abort(404);
-            }
-        } elseif ($stackServiceUuid) {
-            // ServiceDatabase route - look up the service database
-            $serviceUuid = data_get($this->parameters, 'service_uuid');
-            $service = Service::whereUuid($serviceUuid)->first();
-            if (! $service) {
-                abort(404);
-            }
-            $resource = $service->databases()->whereUuid($stackServiceUuid)->first();
-            if (is_null($resource)) {
-                abort(404);
-            }
-        } else {
-            abort(404);
-        }
-
+        $resource = $this->resolveResourceFromRoute();
         $this->authorize('view', $resource);
 
-        // Store IDs for Livewire serialization
         $this->resourceId = $resource->id;
         $this->resourceType = get_class($resource);
 
-        // Store view-friendly properties
+        $this->refreshStatus();
+    }
+
+    public function refreshStatus(): void
+    {
+        $resource = $this->resolveStoredResource();
+        $this->authorize('view', $resource);
+
+        $resource->refresh();
+        $this->resourceUuid = $resource->uuid;
         $this->resourceStatus = $resource->status ?? '';
+        $this->unsupported = $this->isUnsupportedResource($resource);
+    }
 
-        // Handle ServiceDatabase server access differently
-        if ($resource->getMorphClass() === \App\Models\ServiceDatabase::class) {
-            $server = $resource->service?->server;
-            if (! $server) {
-                abort(404, 'Server not found for this service database.');
-            }
-            $this->serverId = $server->id;
-            $this->container = $resource->name.'-'.$resource->service->uuid;
-            $this->resourceUuid = $resource->uuid; // Use ServiceDatabase's own UUID
+    public function render(): View
+    {
+        return view('livewire.project.database.import');
+    }
 
-            // Determine database type for ServiceDatabase
-            $dbType = $resource->databaseType();
-            if (str_contains($dbType, 'postgres')) {
-                $this->resourceDbType = 'standalone-postgresql';
-            } elseif (str_contains($dbType, 'mysql')) {
-                $this->resourceDbType = 'standalone-mysql';
-            } elseif (str_contains($dbType, 'mariadb')) {
-                $this->resourceDbType = 'standalone-mariadb';
-            } elseif (str_contains($dbType, 'mongo')) {
-                $this->resourceDbType = 'standalone-mongodb';
-            } else {
-                $this->resourceDbType = $dbType;
+    private function resolveResourceFromRoute(): object
+    {
+        $parameters = get_route_parameters();
+        $teamId = data_get(Auth::user()?->currentTeam(), 'id');
+        $databaseUuid = data_get($parameters, 'database_uuid');
+        $stackServiceUuid = data_get($parameters, 'stack_service_uuid');
+
+        if ($databaseUuid) {
+            $resource = getResourceByUuid($databaseUuid, $teamId);
+            if ($resource) {
+                return $resource;
             }
-        } else {
-            $server = $resource->destination?->server;
-            if (! $server) {
-                abort(404, 'Server not found for this database.');
-            }
-            $this->serverId = $server->id;
-            $this->container = $resource->uuid;
-            $this->resourceUuid = $resource->uuid;
-            $this->resourceDbType = $resource->type();
+
+            abort(404);
         }
 
-        if (str($resource->status)->startsWith('running')) {
-            $this->containers[] = $this->container;
+        if ($stackServiceUuid) {
+            $project = currentTeam()
+                ->projects()
+                ->select('id', 'uuid', 'team_id')
+                ->where('uuid', data_get($parameters, 'project_uuid'))
+                ->firstOrFail();
+            $environment = $project->environments()
+                ->select('id', 'uuid', 'name', 'project_id')
+                ->where('uuid', data_get($parameters, 'environment_uuid'))
+                ->firstOrFail();
+            $service = $environment->services()->whereUuid(data_get($parameters, 'service_uuid'))->firstOrFail();
+            $resource = $service->databases()->whereUuid($stackServiceUuid)->first();
+            if ($resource) {
+                return $resource;
+            }
         }
 
+        abort(404);
+    }
+
+    private function resolveStoredResource(): object
+    {
+        if ($this->resourceId === null || $this->resourceType === null) {
+            return $this->resolveResourceFromRoute();
+        }
+
+        $resource = $this->resourceType::find($this->resourceId);
+        if ($resource) {
+            return $resource;
+        }
+
+        abort(404);
+    }
+
+    private function isUnsupportedResource(object $resource): bool
+    {
         if (
-            $resource->getMorphClass() === \App\Models\StandaloneRedis::class ||
-            $resource->getMorphClass() === \App\Models\StandaloneKeydb::class ||
-            $resource->getMorphClass() === \App\Models\StandaloneDragonfly::class ||
-            $resource->getMorphClass() === \App\Models\StandaloneClickhouse::class
+            $resource instanceof StandaloneRedis ||
+            $resource instanceof StandaloneKeydb ||
+            $resource instanceof StandaloneDragonfly ||
+            $resource instanceof StandaloneClickhouse
         ) {
-            $this->unsupported = true;
+            return true;
         }
 
-        // Mark unsupported ServiceDatabase types (Redis, KeyDB, etc.)
-        if ($resource->getMorphClass() === \App\Models\ServiceDatabase::class) {
+        if ($resource instanceof ServiceDatabase) {
             $dbType = $resource->databaseType();
-            if (str_contains($dbType, 'redis') || str_contains($dbType, 'keydb') ||
-                str_contains($dbType, 'dragonfly') || str_contains($dbType, 'clickhouse')) {
-                $this->unsupported = true;
-            }
-        }
-    }
 
-    public function checkFile()
-    {
-        if (filled($this->customLocation)) {
-            // Validate the custom location to prevent command injection
-            if (! $this->validateServerPath($this->customLocation)) {
-                $this->dispatch('error', 'Invalid file path. Path must be absolute and contain only safe characters (alphanumerics, dots, dashes, underscores, slashes).');
-
-                return;
-            }
-
-            if (! $this->server) {
-                $this->dispatch('error', 'Server not found. Please refresh the page.');
-
-                return;
-            }
-
-            try {
-                $escapedPath = escapeshellarg($this->customLocation);
-                $result = instant_remote_process(["ls -l {$escapedPath}"], $this->server, throwError: false);
-                if (blank($result)) {
-                    $this->dispatch('error', 'The file does not exist or has been deleted.');
-
-                    return;
-                }
-                $this->filename = $this->customLocation;
-                $this->dispatch('success', 'The file exists.');
-            } catch (\Throwable $e) {
-                return handleError($e, $this);
-            }
-        }
-    }
-
-    public function runImport(string $password = ''): bool|string
-    {
-        if (! verifyPasswordConfirmation($password, $this)) {
-            return 'The provided password is incorrect.';
+            return str_contains($dbType, 'redis') ||
+                str_contains($dbType, 'keydb') ||
+                str_contains($dbType, 'dragonfly') ||
+                str_contains($dbType, 'clickhouse');
         }
 
-        $this->authorize('update', $this->resource);
-
-        if (! ValidationPatterns::isValidContainerName($this->container)) {
-            $this->dispatch('error', 'Invalid container name.');
-
-            return true;
-        }
-
-        if ($this->filename === '') {
-            $this->dispatch('error', 'Please select a file to import.');
-
-            return true;
-        }
-
-        if (! $this->server) {
-            $this->dispatch('error', 'Server not found. Please refresh the page.');
-
-            return true;
-        }
-
-        try {
-            $this->importRunning = true;
-            $this->importCommands = [];
-            $backupFileName = "upload/{$this->resourceUuid}/restore";
-
-            // Check if an uploaded file exists first (takes priority over custom location)
-            if (Storage::exists($backupFileName)) {
-                $path = Storage::path($backupFileName);
-                $tmpPath = '/tmp/'.basename($backupFileName).'_'.$this->resourceUuid;
-                instant_scp($path, $tmpPath, $this->server);
-                Storage::delete($backupFileName);
-                $this->importCommands[] = "docker cp {$tmpPath} {$this->container}:{$tmpPath}";
-            } elseif (filled($this->customLocation)) {
-                // Validate the custom location to prevent command injection
-                if (! $this->validateServerPath($this->customLocation)) {
-                    $this->dispatch('error', 'Invalid file path. Path must be absolute and contain only safe characters.');
-
-                    return true;
-                }
-                $tmpPath = '/tmp/restore_'.$this->resourceUuid;
-                $escapedCustomLocation = escapeshellarg($this->customLocation);
-                $this->importCommands[] = "docker cp {$escapedCustomLocation} {$this->container}:{$tmpPath}";
-            } else {
-                $this->dispatch('error', 'The file does not exist or has been deleted.');
-
-                return true;
-            }
-
-            // Copy the restore command to a script file
-            $scriptPath = "/tmp/restore_{$this->resourceUuid}.sh";
-
-            $restoreCommand = $this->buildRestoreCommand($tmpPath);
-
-            $restoreCommandBase64 = base64_encode($restoreCommand);
-            $this->importCommands[] = "echo \"{$restoreCommandBase64}\" | base64 -d > {$scriptPath}";
-            $this->importCommands[] = "chmod +x {$scriptPath}";
-            $this->importCommands[] = "docker cp {$scriptPath} {$this->container}:{$scriptPath}";
-
-            $this->importCommands[] = "docker exec {$this->container} sh -c '{$scriptPath}'";
-            $this->importCommands[] = "docker exec {$this->container} sh -c 'echo \"Import finished with exit code $?\"'";
-
-            if (! empty($this->importCommands)) {
-                $activity = remote_process($this->importCommands, $this->server, ignore_errors: true, callEventOnFinish: 'RestoreJobFinished', callEventData: [
-                    'scriptPath' => $scriptPath,
-                    'tmpPath' => $tmpPath,
-                    'container' => $this->container,
-                    'serverId' => $this->server->id,
-                ]);
-
-                // Track the activity ID
-                $this->activityId = $activity->id;
-
-                // Dispatch activity to the monitor and open slide-over
-                $this->dispatch('activityMonitor', $activity->id);
-                $this->dispatch('databaserestore');
-            }
-        } catch (\Throwable $e) {
-            handleError($e, $this);
-
-            return true;
-        } finally {
-            $this->filename = null;
-            $this->importCommands = [];
-        }
-
-        return true;
-    }
-
-    public function loadAvailableS3Storages()
-    {
-        try {
-            $this->availableS3Storages = S3Storage::ownedByCurrentTeam(['id', 'name', 'description'])
-                ->where('is_usable', true)
-                ->get()
-                ->map(fn ($s) => ['id' => $s->id, 'name' => $s->name, 'description' => $s->description])
-                ->toArray();
-        } catch (\Throwable $e) {
-            $this->availableS3Storages = [];
-        }
-    }
-
-    public function updatedS3Path($value)
-    {
-        // Reset validation state when path changes
-        $this->s3FileSize = null;
-
-        // Ensure path starts with a slash
-        if ($value !== null && $value !== '') {
-            $this->s3Path = str($value)->trim()->start('/')->value();
-        }
-    }
-
-    public function updatedS3StorageId()
-    {
-        // Reset validation state when storage changes
-        $this->s3FileSize = null;
-    }
-
-    public function checkS3File()
-    {
-        if (! $this->s3StorageId) {
-            $this->dispatch('error', 'Please select an S3 storage.');
-
-            return;
-        }
-
-        if (blank($this->s3Path)) {
-            $this->dispatch('error', 'Please provide an S3 path.');
-
-            return;
-        }
-
-        // Clean the path (remove leading slash if present)
-        $cleanPath = ltrim($this->s3Path, '/');
-
-        // Validate the S3 path early to prevent command injection in subsequent operations
-        if (! $this->validateS3Path($cleanPath)) {
-            $this->dispatch('error', 'Invalid S3 path. Path must contain only safe characters (alphanumerics, dots, dashes, underscores, slashes).');
-
-            return;
-        }
-
-        try {
-            $s3Storage = S3Storage::ownedByCurrentTeam()->findOrFail($this->s3StorageId);
-
-            // Validate bucket name early
-            if (! $this->validateBucketName($s3Storage->bucket)) {
-                $this->dispatch('error', 'Invalid S3 bucket name. Bucket name must contain only alphanumerics, dots, dashes, and underscores.');
-
-                return;
-            }
-
-            // Test connection
-            $s3Storage->testConnection();
-
-            // Build S3 disk configuration
-            $disk = Storage::build([
-                'driver' => 's3',
-                'region' => $s3Storage->region,
-                'key' => $s3Storage->key,
-                'secret' => $s3Storage->secret,
-                'bucket' => $s3Storage->bucket,
-                'endpoint' => $s3Storage->endpoint,
-                'use_path_style_endpoint' => true,
-            ]);
-
-            // Check if file exists
-            if (! $disk->exists($cleanPath)) {
-                $this->dispatch('error', 'File not found in S3. Please check the path.');
-
-                return;
-            }
-
-            // Get file size
-            $this->s3FileSize = $disk->size($cleanPath);
-
-            $this->dispatch('success', 'File found in S3. Size: '.formatBytes($this->s3FileSize));
-        } catch (\Throwable $e) {
-            $this->s3FileSize = null;
-
-            return handleError($e, $this);
-        }
-    }
-
-    public function restoreFromS3(string $password = ''): bool|string
-    {
-        if (! verifyPasswordConfirmation($password, $this)) {
-            return 'The provided password is incorrect.';
-        }
-
-        $this->authorize('update', $this->resource);
-
-        if (! ValidationPatterns::isValidContainerName($this->container)) {
-            $this->dispatch('error', 'Invalid container name.');
-
-            return true;
-        }
-
-        if (! $this->s3StorageId || blank($this->s3Path)) {
-            $this->dispatch('error', 'Please select S3 storage and provide a path first.');
-
-            return true;
-        }
-
-        if (is_null($this->s3FileSize)) {
-            $this->dispatch('error', 'Please check the file first by clicking "Check File".');
-
-            return true;
-        }
-
-        if (! $this->server) {
-            $this->dispatch('error', 'Server not found. Please refresh the page.');
-
-            return true;
-        }
-
-        try {
-            $this->importRunning = true;
-
-            $s3Storage = S3Storage::ownedByCurrentTeam()->findOrFail($this->s3StorageId);
-
-            $key = $s3Storage->key;
-            $secret = $s3Storage->secret;
-            $bucket = $s3Storage->bucket;
-            $endpoint = $s3Storage->endpoint;
-
-            // Validate bucket name to prevent command injection
-            if (! $this->validateBucketName($bucket)) {
-                $this->dispatch('error', 'Invalid S3 bucket name. Bucket name must contain only alphanumerics, dots, dashes, and underscores.');
-
-                return true;
-            }
-
-            // Clean the S3 path
-            $cleanPath = ltrim($this->s3Path, '/');
-
-            // Validate the S3 path to prevent command injection
-            if (! $this->validateS3Path($cleanPath)) {
-                $this->dispatch('error', 'Invalid S3 path. Path must contain only safe characters (alphanumerics, dots, dashes, underscores, slashes).');
-
-                return true;
-            }
-
-            // Get helper image
-            $helperImage = config('constants.coolify.helper_image');
-            $latestVersion = getHelperVersion();
-            $fullImageName = "{$helperImage}:{$latestVersion}";
-
-            // Get the database destination network
-            if ($this->resource->getMorphClass() === \App\Models\ServiceDatabase::class) {
-                $destinationNetwork = $this->resource->service->destination->network ?? 'coolify';
-            } else {
-                $destinationNetwork = $this->resource->destination->network ?? 'coolify';
-            }
-
-            // Generate unique names for this operation
-            $containerName = "s3-restore-{$this->resourceUuid}";
-            $helperTmpPath = '/tmp/'.basename($cleanPath);
-            $serverTmpPath = "/tmp/s3-restore-{$this->resourceUuid}-".basename($cleanPath);
-            $containerTmpPath = "/tmp/restore_{$this->resourceUuid}-".basename($cleanPath);
-            $scriptPath = "/tmp/restore_{$this->resourceUuid}.sh";
-
-            // Prepare all commands in sequence
-            $commands = [];
-
-            // 1. Clean up any existing helper container and temp files from previous runs
-            $commands[] = "docker rm -f {$containerName} 2>/dev/null || true";
-            $commands[] = "rm -f {$serverTmpPath} 2>/dev/null || true";
-            $commands[] = "docker exec {$this->container} rm -f {$containerTmpPath} {$scriptPath} 2>/dev/null || true";
-
-            // 2. Start helper container on the database network
-            $commands[] = "docker run -d --network {$destinationNetwork} --name {$containerName} {$fullImageName} sleep 3600";
-
-            // 3. Configure S3 access in helper container
-            $escapedEndpoint = escapeshellarg($endpoint);
-            $escapedKey = escapeshellarg($key);
-            $escapedSecret = escapeshellarg($secret);
-            $commands[] = "docker exec {$containerName} mc alias set s3temp {$escapedEndpoint} {$escapedKey} {$escapedSecret}";
-
-            // 4. Check file exists in S3 (bucket and path already validated above)
-            $escapedBucket = escapeshellarg($bucket);
-            $escapedCleanPath = escapeshellarg($cleanPath);
-            $escapedS3Source = escapeshellarg("s3temp/{$bucket}/{$cleanPath}");
-            $commands[] = "docker exec {$containerName} mc stat {$escapedS3Source}";
-
-            // 5. Download from S3 to helper container (progress shown by default)
-            $escapedHelperTmpPath = escapeshellarg($helperTmpPath);
-            $commands[] = "docker exec {$containerName} mc cp {$escapedS3Source} {$escapedHelperTmpPath}";
-
-            // 6. Copy from helper to server, then immediately to database container
-            $commands[] = "docker cp {$containerName}:{$helperTmpPath} {$serverTmpPath}";
-            $commands[] = "docker cp {$serverTmpPath} {$this->container}:{$containerTmpPath}";
-
-            // 7. Cleanup helper container and server temp file immediately (no longer needed)
-            $commands[] = "docker rm -f {$containerName} 2>/dev/null || true";
-            $commands[] = "rm -f {$serverTmpPath} 2>/dev/null || true";
-
-            // 8. Build and execute restore command inside database container
-            $restoreCommand = $this->buildRestoreCommand($containerTmpPath);
-
-            $restoreCommandBase64 = base64_encode($restoreCommand);
-            $commands[] = "echo \"{$restoreCommandBase64}\" | base64 -d > {$scriptPath}";
-            $commands[] = "chmod +x {$scriptPath}";
-            $commands[] = "docker cp {$scriptPath} {$this->container}:{$scriptPath}";
-
-            // 9. Execute restore and cleanup temp files immediately after completion
-            $commands[] = "docker exec {$this->container} sh -c '{$scriptPath} && rm -f {$containerTmpPath} {$scriptPath}'";
-            $commands[] = "docker exec {$this->container} sh -c 'echo \"Import finished with exit code $?\"'";
-
-            // Execute all commands with cleanup event (as safety net for edge cases)
-            $activity = remote_process($commands, $this->server, ignore_errors: true, callEventOnFinish: 'S3RestoreJobFinished', callEventData: [
-                'containerName' => $containerName,
-                'serverTmpPath' => $serverTmpPath,
-                'scriptPath' => $scriptPath,
-                'containerTmpPath' => $containerTmpPath,
-                'container' => $this->container,
-                'serverId' => $this->server->id,
-            ]);
-
-            // Track the activity ID
-            $this->activityId = $activity->id;
-
-            // Dispatch activity to the monitor and open slide-over
-            $this->dispatch('activityMonitor', $activity->id);
-            $this->dispatch('databaserestore');
-            $this->dispatch('info', 'Restoring database from S3. Progress will be shown in the activity monitor...');
-        } catch (\Throwable $e) {
-            $this->importRunning = false;
-            handleError($e, $this);
-
-            return true;
-        }
-
-        return true;
-    }
-
-    public function buildRestoreCommand(string $tmpPath): string
-    {
-        $morphClass = $this->resource->getMorphClass();
-
-        // Handle ServiceDatabase by checking the database type
-        if ($morphClass === \App\Models\ServiceDatabase::class) {
-            $dbType = $this->resource->databaseType();
-            if (str_contains($dbType, 'mysql')) {
-                $morphClass = 'mysql';
-            } elseif (str_contains($dbType, 'mariadb')) {
-                $morphClass = 'mariadb';
-            } elseif (str_contains($dbType, 'postgres')) {
-                $morphClass = 'postgresql';
-            } elseif (str_contains($dbType, 'mongo')) {
-                $morphClass = 'mongodb';
-            }
-        }
-
-        switch ($morphClass) {
-            case \App\Models\StandaloneMariadb::class:
-            case 'mariadb':
-                $restoreCommand = $this->mariadbRestoreCommand;
-                if ($this->dumpAll) {
-                    $restoreCommand .= " && (gunzip -cf {$tmpPath} 2>/dev/null || cat {$tmpPath}) | mariadb -u root -p\$MARIADB_ROOT_PASSWORD \${MARIADB_DATABASE:-default}";
-                } else {
-                    $restoreCommand .= " < {$tmpPath}";
-                }
-                break;
-            case \App\Models\StandaloneMysql::class:
-            case 'mysql':
-                $restoreCommand = $this->mysqlRestoreCommand;
-                if ($this->dumpAll) {
-                    $restoreCommand .= " && (gunzip -cf {$tmpPath} 2>/dev/null || cat {$tmpPath}) | mysql -u root -p\$MYSQL_ROOT_PASSWORD \${MYSQL_DATABASE:-default}";
-                } else {
-                    $restoreCommand .= " < {$tmpPath}";
-                }
-                break;
-            case \App\Models\StandalonePostgresql::class:
-            case 'postgresql':
-                $restoreCommand = $this->postgresqlRestoreCommand;
-                if ($this->dumpAll) {
-                    $restoreCommand .= " && (gunzip -cf {$tmpPath} 2>/dev/null || cat {$tmpPath}) | psql -U \${POSTGRES_USER} -d \${POSTGRES_DB:-\${POSTGRES_USER:-postgres}}";
-                } else {
-                    $restoreCommand .= " {$tmpPath}";
-                }
-                break;
-            case \App\Models\StandaloneMongodb::class:
-            case 'mongodb':
-                $restoreCommand = $this->mongodbRestoreCommand;
-                if ($this->dumpAll === false) {
-                    $restoreCommand .= "{$tmpPath}";
-                }
-                break;
-            default:
-                $restoreCommand = '';
-        }
-
-        return $restoreCommand;
+        return false;
     }
 }

app/Livewire/Project/Database/ImportForm.php

@@ -0,0 +1,825 @@
+<?php
+
+namespace App\Livewire\Project\Database;
+
+use App\Models\S3Storage;
+use App\Models\Server;
+use App\Models\Service;
+use App\Models\ServiceDatabase;
+use App\Models\StandaloneClickhouse;
+use App\Models\StandaloneDragonfly;
+use App\Models\StandaloneKeydb;
+use App\Models\StandaloneMariadb;
+use App\Models\StandaloneMongodb;
+use App\Models\StandaloneMysql;
+use App\Models\StandalonePostgresql;
+use App\Models\StandaloneRedis;
+use App\Support\ValidationPatterns;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\Storage;
+use Livewire\Attributes\Computed;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+
+class ImportForm extends Component
+{
+    use AuthorizesRequests;
+
+    /**
+     * Validate that a string is safe for use as an S3 bucket name.
+     * Allows alphanumerics, dots, dashes, and underscores.
+     */
+    private function validateBucketName(string $bucket): bool
+    {
+        return preg_match('/^[a-zA-Z0-9.\-_]+$/', $bucket) === 1;
+    }
+
+    /**
+     * Validate that a string is safe for use as an S3 path.
+     * Allows alphanumerics, dots, dashes, underscores, slashes, and common file characters.
+     */
+    private function validateS3Path(string $path): bool
+    {
+        // Must not be empty
+        if (empty($path)) {
+            return false;
+        }
+
+        // Must not contain dangerous shell metacharacters or command injection patterns
+        $dangerousPatterns = [
+            '..', // Directory traversal
+            '$(', // Command substitution
+            '`',  // Backtick command substitution
+            '|',  // Pipe
+            ';',  // Command separator
+            '&',  // Background/AND
+            '>',  // Redirect
+            '<',  // Redirect
+            "\n", // Newline
+            "\r", // Carriage return
+            "\0", // Null byte
+            "'",  // Single quote
+            '"',  // Double quote
+            '\\', // Backslash
+        ];
+
+        foreach ($dangerousPatterns as $pattern) {
+            if (str_contains($path, $pattern)) {
+                return false;
+            }
+        }
+
+        // Allow alphanumerics, dots, dashes, underscores, slashes, spaces, plus, equals, at
+        return preg_match('/^[a-zA-Z0-9.\-_\/\s+@=]+$/', $path) === 1;
+    }
+
+    /**
+     * Validate that a string is safe for use as a file path on the server.
+     */
+    private function validateServerPath(string $path): bool
+    {
+        // Must be an absolute path
+        if (! str_starts_with($path, '/')) {
+            return false;
+        }
+
+        // Must not contain dangerous shell metacharacters or command injection patterns
+        $dangerousPatterns = [
+            '..', // Directory traversal
+            '$(', // Command substitution
+            '`',  // Backtick command substitution
+            '|',  // Pipe
+            ';',  // Command separator
+            '&',  // Background/AND
+            '>',  // Redirect
+            '<',  // Redirect
+            "\n", // Newline
+            "\r", // Carriage return
+            "\0", // Null byte
+            "'",  // Single quote
+            '"',  // Double quote
+            '\\', // Backslash
+        ];
+
+        foreach ($dangerousPatterns as $pattern) {
+            if (str_contains($path, $pattern)) {
+                return false;
+            }
+        }
+
+        // Allow alphanumerics, dots, dashes, underscores, slashes, and spaces
+        return preg_match('/^[a-zA-Z0-9.\-_\/\s]+$/', $path) === 1;
+    }
+
+    public bool $unsupported = false;
+
+    // Store IDs instead of models for proper Livewire serialization
+    #[Locked]
+    public ?int $resourceId = null;
+
+    #[Locked]
+    public ?string $resourceType = null;
+
+    #[Locked]
+    public ?int $serverId = null;
+
+    // View-friendly properties to avoid computed property access in Blade
+    #[Locked]
+    public string $resourceUuid = '';
+
+    public string $resourceStatus = '';
+
+    #[Locked]
+    public string $resourceDbType = '';
+
+    public array $parameters = [];
+
+    public array $containers = [];
+
+    public bool $scpInProgress = false;
+
+    public bool $importRunning = false;
+
+    public ?string $filename = null;
+
+    public ?string $filesize = null;
+
+    public bool $isUploading = false;
+
+    public int $progress = 0;
+
+    public bool $error = false;
+
+    #[Locked]
+    public string $container;
+
+    public array $importCommands = [];
+
+    public bool $dumpAll = false;
+
+    public string $restoreCommandText = '';
+
+    public string $customLocation = '';
+
+    public ?int $activityId = null;
+
+    public string $postgresqlRestoreCommand = 'pg_restore -U $POSTGRES_USER -d ${POSTGRES_DB:-${POSTGRES_USER:-postgres}}';
+
+    public string $mysqlRestoreCommand = 'mysql -u $MYSQL_USER -p$MYSQL_PASSWORD $MYSQL_DATABASE';
+
+    public string $mariadbRestoreCommand = 'mariadb -u $MARIADB_USER -p$MARIADB_PASSWORD $MARIADB_DATABASE';
+
+    public string $mongodbRestoreCommand = 'mongorestore --authenticationDatabase=admin --username $MONGO_INITDB_ROOT_USERNAME --password $MONGO_INITDB_ROOT_PASSWORD --uri mongodb://localhost:27017 --gzip --archive=';
+
+    // S3 Restore properties
+    public array $availableS3Storages = [];
+
+    public ?int $s3StorageId = null;
+
+    public string $s3Path = '';
+
+    public ?int $s3FileSize = null;
+
+    #[Computed]
+    public function resource()
+    {
+        if ($this->resourceId === null || $this->resourceType === null) {
+            return null;
+        }
+
+        return $this->resourceType::find($this->resourceId);
+    }
+
+    #[Computed]
+    public function server()
+    {
+        if ($this->serverId === null) {
+            return null;
+        }
+
+        return Server::ownedByCurrentTeam()->find($this->serverId);
+    }
+
+    protected $listeners = [
+        'slideOverClosed' => 'resetActivityId',
+    ];
+
+    public function resetActivityId()
+    {
+        $this->activityId = null;
+    }
+
+    public function mount()
+    {
+        $this->parameters = get_route_parameters();
+        $this->getContainers();
+        $this->loadAvailableS3Storages();
+    }
+
+    public function updatedDumpAll($value)
+    {
+        $morphClass = $this->resource->getMorphClass();
+
+        // Handle ServiceDatabase by checking the database type
+        if ($morphClass === ServiceDatabase::class) {
+            $dbType = $this->resource->databaseType();
+            if (str_contains($dbType, 'mysql')) {
+                $morphClass = 'mysql';
+            } elseif (str_contains($dbType, 'mariadb')) {
+                $morphClass = 'mariadb';
+            } elseif (str_contains($dbType, 'postgres')) {
+                $morphClass = 'postgresql';
+            }
+        }
+
+        switch ($morphClass) {
+            case StandaloneMariadb::class:
+            case 'mariadb':
+                if ($value === true) {
+                    $this->mariadbRestoreCommand = <<<'EOD'
+for pid in $(mariadb -u root -p$MARIADB_ROOT_PASSWORD -N -e "SELECT id FROM information_schema.processlist WHERE user != 'root';"); do
+  mariadb -u root -p$MARIADB_ROOT_PASSWORD -e "KILL $pid" 2>/dev/null || true
+done && \
+mariadb -u root -p$MARIADB_ROOT_PASSWORD -N -e "SELECT CONCAT('DROP DATABASE IF EXISTS \`',schema_name,'\`;') FROM information_schema.schemata WHERE schema_name NOT IN ('information_schema','mysql','performance_schema','sys');" | mariadb -u root -p$MARIADB_ROOT_PASSWORD && \
+mariadb -u root -p$MARIADB_ROOT_PASSWORD -e "CREATE DATABASE IF NOT EXISTS \`${MARIADB_DATABASE:-default}\`;" && \
+(gunzip -cf $tmpPath 2>/dev/null || cat $tmpPath) | sed -e '/^CREATE DATABASE/d' -e '/^USE \`mysql\`/d' | mariadb -u root -p$MARIADB_ROOT_PASSWORD ${MARIADB_DATABASE:-default}
+EOD;
+                    $this->restoreCommandText = $this->mariadbRestoreCommand.' && (gunzip -cf <temp_backup_file> 2>/dev/null || cat <temp_backup_file>) | mariadb -u root -p$MARIADB_ROOT_PASSWORD ${MARIADB_DATABASE:-default}';
+                } else {
+                    $this->mariadbRestoreCommand = 'mariadb -u $MARIADB_USER -p$MARIADB_PASSWORD $MARIADB_DATABASE';
+                }
+                break;
+            case StandaloneMysql::class:
+            case 'mysql':
+                if ($value === true) {
+                    $this->mysqlRestoreCommand = <<<'EOD'
+for pid in $(mysql -u root -p$MYSQL_ROOT_PASSWORD -N -e "SELECT id FROM information_schema.processlist WHERE user != 'root';"); do
+  mysql -u root -p$MYSQL_ROOT_PASSWORD -e "KILL $pid" 2>/dev/null || true
+done && \
+mysql -u root -p$MYSQL_ROOT_PASSWORD -N -e "SELECT CONCAT('DROP DATABASE IF EXISTS \`',schema_name,'\`;') FROM information_schema.schemata WHERE schema_name NOT IN ('information_schema','mysql','performance_schema','sys');" | mysql -u root -p$MYSQL_ROOT_PASSWORD && \
+mysql -u root -p$MYSQL_ROOT_PASSWORD -e "CREATE DATABASE IF NOT EXISTS \`${MYSQL_DATABASE:-default}\`;" && \
+(gunzip -cf $tmpPath 2>/dev/null || cat $tmpPath) | sed -e '/^CREATE DATABASE/d' -e '/^USE \`mysql\`/d' | mysql -u root -p$MYSQL_ROOT_PASSWORD ${MYSQL_DATABASE:-default}
+EOD;
+                    $this->restoreCommandText = $this->mysqlRestoreCommand.' && (gunzip -cf <temp_backup_file> 2>/dev/null || cat <temp_backup_file>) | mysql -u root -p$MYSQL_ROOT_PASSWORD ${MYSQL_DATABASE:-default}';
+                } else {
+                    $this->mysqlRestoreCommand = 'mysql -u $MYSQL_USER -p$MYSQL_PASSWORD $MYSQL_DATABASE';
+                }
+                break;
+            case StandalonePostgresql::class:
+            case 'postgresql':
+                if ($value === true) {
+                    $this->postgresqlRestoreCommand = <<<'EOD'
+psql -U ${POSTGRES_USER} -c "SELECT pg_terminate_backend(pid) FROM pg_stat_activity WHERE datname IS NOT NULL AND pid <> pg_backend_pid()" && \
+psql -U ${POSTGRES_USER} -t -c "SELECT datname FROM pg_database WHERE NOT datistemplate" | xargs -I {} dropdb -U ${POSTGRES_USER} --if-exists {} && \
+createdb -U ${POSTGRES_USER} ${POSTGRES_DB:-${POSTGRES_USER:-postgres}}
+EOD;
+                    $this->restoreCommandText = $this->postgresqlRestoreCommand.' && (gunzip -cf <temp_backup_file> 2>/dev/null || cat <temp_backup_file>) | psql -U ${POSTGRES_USER} -d ${POSTGRES_DB:-${POSTGRES_USER:-postgres}}';
+                } else {
+                    $this->postgresqlRestoreCommand = 'pg_restore -U ${POSTGRES_USER} -d ${POSTGRES_DB:-${POSTGRES_USER:-postgres}}';
+                }
+                break;
+        }
+
+    }
+
+    public function getContainers()
+    {
+        $this->containers = [];
+        $teamId = data_get(auth()->user()->currentTeam(), 'id');
+
+        // Try to find resource by route parameter
+        $databaseUuid = data_get($this->parameters, 'database_uuid');
+        $stackServiceUuid = data_get($this->parameters, 'stack_service_uuid');
+
+        $resource = null;
+        if ($databaseUuid) {
+            // Standalone database route
+            $resource = getResourceByUuid($databaseUuid, $teamId);
+            if (is_null($resource)) {
+                abort(404);
+            }
+        } elseif ($stackServiceUuid) {
+            // ServiceDatabase route - look up the service database
+            $serviceUuid = data_get($this->parameters, 'service_uuid');
+            $project = currentTeam()
+                ->projects()
+                ->select('id', 'uuid', 'team_id')
+                ->where('uuid', data_get($this->parameters, 'project_uuid'))
+                ->firstOrFail();
+            $environment = $project->environments()
+                ->select('id', 'uuid', 'name', 'project_id')
+                ->where('uuid', data_get($this->parameters, 'environment_uuid'))
+                ->firstOrFail();
+            $service = $environment->services()->whereUuid($serviceUuid)->firstOrFail();
+            $resource = $service->databases()->whereUuid($stackServiceUuid)->first();
+            if (is_null($resource)) {
+                abort(404);
+            }
+        } else {
+            abort(404);
+        }
+
+        $this->authorize('view', $resource);
+
+        // Store IDs for Livewire serialization
+        $this->resourceId = $resource->id;
+        $this->resourceType = get_class($resource);
+
+        // Store view-friendly properties
+        $this->resourceStatus = $resource->status ?? '';
+
+        // Handle ServiceDatabase server access differently
+        if ($resource->getMorphClass() === ServiceDatabase::class) {
+            $server = $resource->service?->server;
+            if (! $server) {
+                abort(404, 'Server not found for this service database.');
+            }
+            $this->serverId = $server->id;
+            $this->container = $resource->name.'-'.$resource->service->uuid;
+            $this->resourceUuid = $resource->uuid; // Use ServiceDatabase's own UUID
+
+            // Determine database type for ServiceDatabase
+            $dbType = $resource->databaseType();
+            if (str_contains($dbType, 'postgres')) {
+                $this->resourceDbType = 'standalone-postgresql';
+            } elseif (str_contains($dbType, 'mysql')) {
+                $this->resourceDbType = 'standalone-mysql';
+            } elseif (str_contains($dbType, 'mariadb')) {
+                $this->resourceDbType = 'standalone-mariadb';
+            } elseif (str_contains($dbType, 'mongo')) {
+                $this->resourceDbType = 'standalone-mongodb';
+            } else {
+                $this->resourceDbType = $dbType;
+            }
+        } else {
+            $server = $resource->destination?->server;
+            if (! $server) {
+                abort(404, 'Server not found for this database.');
+            }
+            $this->serverId = $server->id;
+            $this->container = $resource->uuid;
+            $this->resourceUuid = $resource->uuid;
+            $this->resourceDbType = $resource->type();
+        }
+
+        if (str($resource->status)->startsWith('running')) {
+            $this->containers[] = $this->container;
+        }
+
+        if (
+            $resource->getMorphClass() === StandaloneRedis::class ||
+            $resource->getMorphClass() === StandaloneKeydb::class ||
+            $resource->getMorphClass() === StandaloneDragonfly::class ||
+            $resource->getMorphClass() === StandaloneClickhouse::class
+        ) {
+            $this->unsupported = true;
+        }
+
+        // Mark unsupported ServiceDatabase types (Redis, KeyDB, etc.)
+        if ($resource->getMorphClass() === ServiceDatabase::class) {
+            $dbType = $resource->databaseType();
+            if (str_contains($dbType, 'redis') || str_contains($dbType, 'keydb') ||
+                str_contains($dbType, 'dragonfly') || str_contains($dbType, 'clickhouse')) {
+                $this->unsupported = true;
+            }
+        }
+    }
+
+    public function checkFile()
+    {
+        if (filled($this->customLocation)) {
+            // Validate the custom location to prevent command injection
+            if (! $this->validateServerPath($this->customLocation)) {
+                $this->dispatch('error', 'Invalid file path. Path must be absolute and contain only safe characters (alphanumerics, dots, dashes, underscores, slashes).');
+
+                return;
+            }
+
+            if (! $this->server) {
+                $this->dispatch('error', 'Server not found. Please refresh the page.');
+
+                return;
+            }
+
+            try {
+                $escapedPath = escapeshellarg($this->customLocation);
+                $result = instant_remote_process(["ls -l {$escapedPath}"], $this->server, throwError: false);
+                if (blank($result)) {
+                    $this->dispatch('error', 'The file does not exist or has been deleted.');
+
+                    return;
+                }
+                $this->filename = $this->customLocation;
+                $this->dispatch('success', 'The file exists.');
+            } catch (\Throwable $e) {
+                return handleError($e, $this);
+            }
+        }
+    }
+
+    public function runImport(string $password = ''): bool|string
+    {
+        if (! verifyPasswordConfirmation($password, $this)) {
+            return 'The provided password is incorrect.';
+        }
+
+        $this->authorize('update', $this->resource);
+
+        if (! ValidationPatterns::isValidContainerName($this->container)) {
+            $this->dispatch('error', 'Invalid container name.');
+
+            return true;
+        }
+
+        if ($this->filename === '') {
+            $this->dispatch('error', 'Please select a file to import.');
+
+            return true;
+        }
+
+        if (! $this->server) {
+            $this->dispatch('error', 'Server not found. Please refresh the page.');
+
+            return true;
+        }
+
+        try {
+            $this->importRunning = true;
+            $this->importCommands = [];
+            $backupFileName = "upload/{$this->resourceUuid}/restore";
+
+            // Check if an uploaded file exists first (takes priority over custom location)
+            if (Storage::exists($backupFileName)) {
+                $path = Storage::path($backupFileName);
+                $tmpPath = '/tmp/'.basename($backupFileName).'_'.$this->resourceUuid;
+                instant_scp($path, $tmpPath, $this->server);
+                Storage::delete($backupFileName);
+                $this->importCommands[] = "docker cp {$tmpPath} {$this->container}:{$tmpPath}";
+            } elseif (filled($this->customLocation)) {
+                // Validate the custom location to prevent command injection
+                if (! $this->validateServerPath($this->customLocation)) {
+                    $this->dispatch('error', 'Invalid file path. Path must be absolute and contain only safe characters.');
+
+                    return true;
+                }
+                $tmpPath = '/tmp/restore_'.$this->resourceUuid;
+                $escapedCustomLocation = escapeshellarg($this->customLocation);
+                $this->importCommands[] = "docker cp {$escapedCustomLocation} {$this->container}:{$tmpPath}";
+            } else {
+                $this->dispatch('error', 'The file does not exist or has been deleted.');
+
+                return true;
+            }
+
+            // Copy the restore command to a script file
+            $scriptPath = "/tmp/restore_{$this->resourceUuid}.sh";
+
+            $restoreCommand = $this->buildRestoreCommand($tmpPath);
+
+            $restoreCommandBase64 = base64_encode($restoreCommand);
+            $this->importCommands[] = "echo \"{$restoreCommandBase64}\" | base64 -d > {$scriptPath}";
+            $this->importCommands[] = "chmod +x {$scriptPath}";
+            $this->importCommands[] = "docker cp {$scriptPath} {$this->container}:{$scriptPath}";
+
+            $this->importCommands[] = "docker exec {$this->container} sh -c '{$scriptPath}'";
+            $this->importCommands[] = "docker exec {$this->container} sh -c 'echo \"Import finished with exit code $?\"'";
+
+            if (! empty($this->importCommands)) {
+                $activity = remote_process($this->importCommands, $this->server, ignore_errors: true, callEventOnFinish: 'RestoreJobFinished', callEventData: [
+                    'scriptPath' => $scriptPath,
+                    'tmpPath' => $tmpPath,
+                    'container' => $this->container,
+                    'serverId' => $this->server->id,
+                ]);
+
+                // Track the activity ID
+                $this->activityId = $activity->id;
+
+                // Dispatch activity to the monitor and open slide-over
+                $this->dispatch('activityMonitor', $activity->id);
+                $this->dispatch('databaserestore');
+            }
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+
+            return true;
+        } finally {
+            $this->filename = null;
+            $this->importCommands = [];
+        }
+
+        return true;
+    }
+
+    public function loadAvailableS3Storages()
+    {
+        try {
+            $this->availableS3Storages = S3Storage::ownedByCurrentTeam(['id', 'name', 'description'])
+                ->where('is_usable', true)
+                ->get()
+                ->map(fn ($s) => ['id' => $s->id, 'name' => $s->name, 'description' => $s->description])
+                ->toArray();
+        } catch (\Throwable $e) {
+            $this->availableS3Storages = [];
+        }
+    }
+
+    public function updatedS3Path($value)
+    {
+        // Reset validation state when path changes
+        $this->s3FileSize = null;
+
+        // Ensure path starts with a slash
+        if ($value !== null && $value !== '') {
+            $this->s3Path = str($value)->trim()->start('/')->value();
+        }
+    }
+
+    public function updatedS3StorageId()
+    {
+        // Reset validation state when storage changes
+        $this->s3FileSize = null;
+    }
+
+    public function checkS3File()
+    {
+        if (! $this->s3StorageId) {
+            $this->dispatch('error', 'Please select an S3 storage.');
+
+            return;
+        }
+
+        if (blank($this->s3Path)) {
+            $this->dispatch('error', 'Please provide an S3 path.');
+
+            return;
+        }
+
+        // Clean the path (remove leading slash if present)
+        $cleanPath = ltrim($this->s3Path, '/');
+
+        // Validate the S3 path early to prevent command injection in subsequent operations
+        if (! $this->validateS3Path($cleanPath)) {
+            $this->dispatch('error', 'Invalid S3 path. Path must contain only safe characters (alphanumerics, dots, dashes, underscores, slashes).');
+
+            return;
+        }
+
+        try {
+            $s3Storage = S3Storage::ownedByCurrentTeam()->findOrFail($this->s3StorageId);
+
+            // Validate bucket name early
+            if (! $this->validateBucketName($s3Storage->bucket)) {
+                $this->dispatch('error', 'Invalid S3 bucket name. Bucket name must contain only alphanumerics, dots, dashes, and underscores.');
+
+                return;
+            }
+
+            // Test connection
+            $s3Storage->testConnection();
+
+            // Build S3 disk configuration
+            $disk = Storage::build([
+                'driver' => 's3',
+                'region' => $s3Storage->region,
+                'key' => $s3Storage->key,
+                'secret' => $s3Storage->secret,
+                'bucket' => $s3Storage->bucket,
+                'endpoint' => $s3Storage->endpoint,
+                'use_path_style_endpoint' => true,
+            ]);
+
+            // Check if file exists
+            if (! $disk->exists($cleanPath)) {
+                $this->dispatch('error', 'File not found in S3. Please check the path.');
+
+                return;
+            }
+
+            // Get file size
+            $this->s3FileSize = $disk->size($cleanPath);
+
+            $this->dispatch('success', 'File found in S3. Size: '.formatBytes($this->s3FileSize));
+        } catch (\Throwable $e) {
+            $this->s3FileSize = null;
+
+            return handleError($e, $this);
+        }
+    }
+
+    public function restoreFromS3(string $password = ''): bool|string
+    {
+        if (! verifyPasswordConfirmation($password, $this)) {
+            return 'The provided password is incorrect.';
+        }
+
+        $this->authorize('update', $this->resource);
+
+        if (! ValidationPatterns::isValidContainerName($this->container)) {
+            $this->dispatch('error', 'Invalid container name.');
+
+            return true;
+        }
+
+        if (! $this->s3StorageId || blank($this->s3Path)) {
+            $this->dispatch('error', 'Please select S3 storage and provide a path first.');
+
+            return true;
+        }
+
+        if (is_null($this->s3FileSize)) {
+            $this->dispatch('error', 'Please check the file first by clicking "Check File".');
+
+            return true;
+        }
+
+        if (! $this->server) {
+            $this->dispatch('error', 'Server not found. Please refresh the page.');
+
+            return true;
+        }
+
+        try {
+            $this->importRunning = true;
+
+            $s3Storage = S3Storage::ownedByCurrentTeam()->findOrFail($this->s3StorageId);
+
+            $key = $s3Storage->key;
+            $secret = $s3Storage->secret;
+            $bucket = $s3Storage->bucket;
+            $endpoint = $s3Storage->endpoint;
+
+            // Validate bucket name to prevent command injection
+            if (! $this->validateBucketName($bucket)) {
+                $this->dispatch('error', 'Invalid S3 bucket name. Bucket name must contain only alphanumerics, dots, dashes, and underscores.');
+
+                return true;
+            }
+
+            // Clean the S3 path
+            $cleanPath = ltrim($this->s3Path, '/');
+
+            // Validate the S3 path to prevent command injection
+            if (! $this->validateS3Path($cleanPath)) {
+                $this->dispatch('error', 'Invalid S3 path. Path must contain only safe characters (alphanumerics, dots, dashes, underscores, slashes).');
+
+                return true;
+            }
+
+            // Get helper image
+            $helperImage = config('constants.coolify.helper_image');
+            $latestVersion = getHelperVersion();
+            $fullImageName = "{$helperImage}:{$latestVersion}";
+
+            // Get the database destination network
+            if ($this->resource->getMorphClass() === ServiceDatabase::class) {
+                $destinationNetwork = $this->resource->service->destination->network ?? 'coolify';
+            } else {
+                $destinationNetwork = $this->resource->destination->network ?? 'coolify';
+            }
+
+            // Generate unique names for this operation
+            $containerName = "s3-restore-{$this->resourceUuid}";
+            $helperTmpPath = '/tmp/'.basename($cleanPath);
+            $serverTmpPath = "/tmp/s3-restore-{$this->resourceUuid}-".basename($cleanPath);
+            $containerTmpPath = "/tmp/restore_{$this->resourceUuid}-".basename($cleanPath);
+            $scriptPath = "/tmp/restore_{$this->resourceUuid}.sh";
+
+            $escapedServerTmpPath = escapeshellarg($serverTmpPath);
+            $escapedContainerTmpPath = escapeshellarg($containerTmpPath);
+            $escapedScriptPath = escapeshellarg($scriptPath);
+            $escapedHelperContainerPath = escapeshellarg("{$containerName}:{$helperTmpPath}");
+            $escapedDatabaseContainerTmpPath = escapeshellarg("{$this->container}:{$containerTmpPath}");
+            $escapedDatabaseContainerScriptPath = escapeshellarg("{$this->container}:{$scriptPath}");
+            $restoreAndCleanupCommand = escapeshellarg("{$escapedScriptPath} && rm -f {$escapedContainerTmpPath} {$escapedScriptPath}");
+
+            // Prepare all commands in sequence
+            $commands = [];
+
+            // 1. Clean up any existing helper container and temp files from previous runs
+            $commands[] = "docker rm -f {$containerName} 2>/dev/null || true";
+            $commands[] = "rm -f {$escapedServerTmpPath} 2>/dev/null || true";
+            $commands[] = "docker exec {$this->container} rm -f {$escapedContainerTmpPath} {$escapedScriptPath} 2>/dev/null || true";
+
+            // 2. Start helper container on the database network
+            $commands[] = "docker run -d --network {$destinationNetwork} --name {$containerName} {$fullImageName} sleep 3600";
+
+            // 3. Configure S3 access in helper container
+            $escapedEndpoint = escapeshellarg($endpoint);
+            $escapedKey = escapeshellarg($key);
+            $escapedSecret = escapeshellarg($secret);
+            $commands[] = "docker exec {$containerName} mc alias set s3temp {$escapedEndpoint} {$escapedKey} {$escapedSecret}";
+
+            // 4. Check file exists in S3 (bucket and path already validated above)
+            $escapedS3Source = escapeshellarg("s3temp/{$bucket}/{$cleanPath}");
+            $commands[] = "docker exec {$containerName} mc stat {$escapedS3Source}";
+
+            // 5. Download from S3 to helper container (progress shown by default)
+            $escapedHelperTmpPath = escapeshellarg($helperTmpPath);
+            $commands[] = "docker exec {$containerName} mc cp {$escapedS3Source} {$escapedHelperTmpPath}";
+
+            // 6. Copy from helper to server, then immediately to database container
+            $commands[] = "docker cp {$escapedHelperContainerPath} {$escapedServerTmpPath}";
+            $commands[] = "docker cp {$escapedServerTmpPath} {$escapedDatabaseContainerTmpPath}";
+
+            // 7. Cleanup helper container and server temp file immediately (no longer needed)
+            $commands[] = "docker rm -f {$containerName} 2>/dev/null || true";
+            $commands[] = "rm -f {$escapedServerTmpPath} 2>/dev/null || true";
+
+            // 8. Build and execute restore command inside database container
+            $restoreCommand = $this->buildRestoreCommand($containerTmpPath);
+
+            $restoreCommandBase64 = base64_encode($restoreCommand);
+            $commands[] = "echo \"{$restoreCommandBase64}\" | base64 -d > {$escapedScriptPath}";
+            $commands[] = "chmod +x {$escapedScriptPath}";
+            $commands[] = "docker cp {$escapedScriptPath} {$escapedDatabaseContainerScriptPath}";
+
+            // 9. Execute restore and cleanup temp files immediately after completion
+            $commands[] = "docker exec {$this->container} sh -c {$restoreAndCleanupCommand}";
+            $commands[] = "docker exec {$this->container} sh -c 'echo \"Import finished with exit code $?\"'";
+
+            // Execute all commands with cleanup event (as safety net for edge cases)
+            $activity = remote_process($commands, $this->server, ignore_errors: true, callEventOnFinish: 'S3RestoreJobFinished', callEventData: [
+                'containerName' => $containerName,
+                'serverTmpPath' => $serverTmpPath,
+                'scriptPath' => $scriptPath,
+                'containerTmpPath' => $containerTmpPath,
+                'container' => $this->container,
+                'serverId' => $this->server->id,
+            ]);
+
+            // Track the activity ID
+            $this->activityId = $activity->id;
+
+            // Dispatch activity to the monitor and open slide-over
+            $this->dispatch('activityMonitor', $activity->id);
+            $this->dispatch('databaserestore');
+            $this->dispatch('info', 'Restoring database from S3. Progress will be shown in the activity monitor...');
+        } catch (\Throwable $e) {
+            $this->importRunning = false;
+            handleError($e, $this);
+
+            return true;
+        }
+
+        return true;
+    }
+
+    public function buildRestoreCommand(string $tmpPath): string
+    {
+        $escapedTmpPath = escapeshellarg($tmpPath);
+        $morphClass = $this->resource->getMorphClass();
+
+        // Handle ServiceDatabase by checking the database type
+        if ($morphClass === ServiceDatabase::class) {
+            $dbType = $this->resource->databaseType();
+            if (str_contains($dbType, 'mysql')) {
+                $morphClass = 'mysql';
+            } elseif (str_contains($dbType, 'mariadb')) {
+                $morphClass = 'mariadb';
+            } elseif (str_contains($dbType, 'postgres')) {
+                $morphClass = 'postgresql';
+            } elseif (str_contains($dbType, 'mongo')) {
+                $morphClass = 'mongodb';
+            }
+        }
+
+        switch ($morphClass) {
+            case StandaloneMariadb::class:
+            case 'mariadb':
+                $restoreCommand = $this->mariadbRestoreCommand;
+                if ($this->dumpAll) {
+                    $restoreCommand .= " && (gunzip -cf {$escapedTmpPath} 2>/dev/null || cat {$escapedTmpPath}) | mariadb -u root -p\$MARIADB_ROOT_PASSWORD \${MARIADB_DATABASE:-default}";
+                } else {
+                    $restoreCommand .= " < {$escapedTmpPath}";
+                }
+                break;
+            case StandaloneMysql::class:
+            case 'mysql':
+                $restoreCommand = $this->mysqlRestoreCommand;
+                if ($this->dumpAll) {
+                    $restoreCommand .= " && (gunzip -cf {$escapedTmpPath} 2>/dev/null || cat {$escapedTmpPath}) | mysql -u root -p\$MYSQL_ROOT_PASSWORD \${MYSQL_DATABASE:-default}";
+                } else {
+                    $restoreCommand .= " < {$escapedTmpPath}";
+                }
+                break;
+            case StandalonePostgresql::class:
+            case 'postgresql':
+                $restoreCommand = $this->postgresqlRestoreCommand;
+                if ($this->dumpAll) {
+                    $restoreCommand .= " && (gunzip -cf {$escapedTmpPath} 2>/dev/null || cat {$escapedTmpPath}) | psql -U \${POSTGRES_USER} -d \${POSTGRES_DB:-\${POSTGRES_USER:-postgres}}";
+                } else {
+                    $restoreCommand .= " {$escapedTmpPath}";
+                }
+                break;
+            case StandaloneMongodb::class:
+            case 'mongodb':
+                $restoreCommand = $this->mongodbRestoreCommand.$escapedTmpPath;
+                break;
+            default:
+                $restoreCommand = '';
+        }
+
+        return $restoreCommand;
+    }
+}

app/Livewire/Project/Database/Keydb/General.php

@@ -4,11 +4,9 @@ namespace App\Livewire\Project\Database\Keydb;
 
 use App\Actions\Database\StartDatabaseProxy;
 use App\Actions\Database\StopDatabaseProxy;
-use App\Helpers\SslHelper;
 use App\Models\Server;
 use App\Models\StandaloneKeydb;
 use App\Support\ValidationPatterns;
-use Carbon\Carbon;
 use Exception;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
@@ -42,25 +40,21 @@ class General extends Component
 
     public ?string $customDockerRunOptions = null;
 
-    public ?string $dbUrl = null;
-
-    public ?string $dbUrlPublic = null;
-
     public bool $isLogDrainEnabled = false;
 
-    public ?Carbon $certificateValidUntil = null;
-
-    public bool $enable_ssl = false;
-
-    public function getListeners()
+    public function getListeners(): array
     {
-        $userId = Auth::id();
-        $teamId = Auth::user()->currentTeam()->id;
+        $user = Auth::user();
+        if (! $user) {
+            return [];
+        }
+        $team = $user->currentTeam();
+        if (! $team) {
+            return [];
+        }
 
         return [
-            "echo-private:team.{$teamId},DatabaseProxyStopped" => 'databaseProxyStopped',
-            "echo-private:user.{$userId},DatabaseStatusChanged" => 'refresh',
-            "echo-private:team.{$teamId},ServiceChecked" => 'refresh',
+            "echo-private:team.{$team->id},DatabaseProxyStopped" => 'databaseProxyStopped',
         ];
     }
 
@@ -75,12 +69,6 @@ class General extends Component
 
                 return;
             }
-
-            $existingCert = $this->database->sslCertificates()->first();
-
-            if ($existingCert) {
-                $this->certificateValidUntil = $existingCert->valid_until;
-            }
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -88,7 +76,7 @@ class General extends Component
 
     protected function rules(): array
     {
-        $baseRules = [
+        return [
             'name' => ValidationPatterns::nameRules(),
             'description' => ValidationPatterns::descriptionRules(),
             'keydbConf' => 'nullable|string',
@@ -101,13 +89,8 @@ class General extends Component
             'publicPort' => 'nullable|integer|min:1|max:65535',
             'publicPortTimeout' => 'nullable|integer|min:1',
             'customDockerRunOptions' => 'nullable|string',
-            'dbUrl' => 'nullable|string',
-            'dbUrlPublic' => 'nullable|string',
             'isLogDrainEnabled' => 'nullable|boolean',
-            'enable_ssl' => 'boolean',
         ];
-
-        return $baseRules;
     }
 
     protected function messages(): array
@@ -143,11 +126,7 @@ class General extends Component
             $this->database->public_port_timeout = $this->publicPortTimeout ?: null;
             $this->database->custom_docker_run_options = $this->customDockerRunOptions;
             $this->database->is_log_drain_enabled = $this->isLogDrainEnabled;
-            $this->database->enable_ssl = $this->enable_ssl;
             $this->database->save();
-
-            $this->dbUrl = $this->database->internal_db_url;
-            $this->dbUrlPublic = $this->database->external_db_url;
         } else {
             $this->name = $this->database->name;
             $this->description = $this->database->description;
@@ -160,9 +139,6 @@ class General extends Component
             $this->publicPortTimeout = $this->database->public_port_timeout;
             $this->customDockerRunOptions = $this->database->custom_docker_run_options;
             $this->isLogDrainEnabled = $this->database->is_log_drain_enabled;
-            $this->enable_ssl = $this->database->enable_ssl;
-            $this->dbUrl = $this->database->internal_db_url;
-            $this->dbUrlPublic = $this->database->external_db_url;
         }
     }
 
@@ -211,6 +187,7 @@ class General extends Component
                 StopDatabaseProxy::run($this->database);
                 $this->dispatch('success', 'Database is no longer publicly accessible.');
             }
+            $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
@@ -219,9 +196,13 @@ class General extends Component
         }
     }
 
-    public function databaseProxyStopped()
+    public function databaseProxyStopped(): void
     {
-        $this->syncData();
+        $this->database->refresh();
+        $this->isPublic = $this->database->is_public;
+        $this->publicPort = $this->database->public_port;
+        $this->publicPortTimeout = $this->database->public_port_timeout;
+        $this->dispatch('databaseUpdated');
     }
 
     public function submit()
@@ -237,6 +218,7 @@ class General extends Component
             }
             $this->syncData(true);
             $this->dispatch('success', 'Database updated.');
+            $this->dispatch('databaseUpdated');
         } catch (Exception $e) {
             return handleError($e, $this);
         } finally {
@@ -248,65 +230,6 @@ class General extends Component
         }
     }
 
-    public function instantSaveSSL()
-    {
-        try {
-            $this->authorize('update', $this->database);
-
-            $this->syncData(true);
-            $this->dispatch('success', 'SSL configuration updated.');
-        } catch (Exception $e) {
-            return handleError($e, $this);
-        }
-    }
-
-    public function regenerateSslCertificate()
-    {
-        try {
-            $this->authorize('update', $this->database);
-
-            $existingCert = $this->database->sslCertificates()->first();
-
-            if (! $existingCert) {
-                $this->dispatch('error', 'No existing SSL certificate found for this database.');
-
-                return;
-            }
-
-            $caCert = $this->server->sslCertificates()
-                ->where('is_ca_certificate', true)
-                ->first();
-
-            if (! $caCert) {
-                $this->server->generateCaCertificate();
-                $caCert = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
-            }
-
-            if (! $caCert) {
-                $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
-
-                return;
-            }
-
-            SslHelper::generateSslCertificate(
-                commonName: $existingCert->common_name,
-                subjectAlternativeNames: $existingCert->subject_alternative_names ?? [],
-                resourceType: $existingCert->resource_type,
-                resourceId: $existingCert->resource_id,
-                serverId: $existingCert->server_id,
-                caCert: $caCert->ssl_certificate,
-                caKey: $caCert->ssl_private_key,
-                configurationDir: $existingCert->configuration_dir,
-                mountPath: $existingCert->mount_path,
-                isPemKeyFileRequired: true,
-            );
-
-            $this->dispatch('success', 'SSL certificates regenerated. Restart database to apply changes.');
-        } catch (Exception $e) {
-            handleError($e, $this);
-        }
-    }
-
     public function refresh(): void
     {
         $this->database->refresh();

app/Livewire/Project/Database/Keydb/StatusInfo.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Livewire\Project\Database\Keydb;
+
+use App\Models\StandaloneKeydb;
+use App\Traits\HasDatabaseStatusInfo;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class StatusInfo extends Component
+{
+    use AuthorizesRequests;
+    use HasDatabaseStatusInfo;
+
+    public StandaloneKeydb $database;
+
+    protected function databaseLabel(): string
+    {
+        return 'KeyDB';
+    }
+
+    protected function showPublicUrlPlaceholder(): bool
+    {
+        return true;
+    }
+}

app/Livewire/Project/Database/Mariadb/General.php

@@ -4,14 +4,11 @@ namespace App\Livewire\Project\Database\Mariadb;
 
 use App\Actions\Database\StartDatabaseProxy;
 use App\Actions\Database\StopDatabaseProxy;
-use App\Helpers\SslHelper;
 use App\Models\Server;
 use App\Models\StandaloneMariadb;
 use App\Support\ValidationPatterns;
-use Carbon\Carbon;
 use Exception;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
 
 class General extends Component
@@ -50,25 +47,6 @@ class General extends Component
 
     public ?string $customDockerRunOptions = null;
 
-    public bool $enableSsl = false;
-
-    public ?string $db_url = null;
-
-    public ?string $db_url_public = null;
-
-    public ?Carbon $certificateValidUntil = null;
-
-    public function getListeners()
-    {
-        $userId = Auth::id();
-        $teamId = Auth::user()->currentTeam()->id;
-
-        return [
-            "echo-private:user.{$userId},DatabaseStatusChanged" => 'refresh',
-            "echo-private:team.{$teamId},ServiceChecked" => 'refresh',
-        ];
-    }
-
     protected function rules(): array
     {
         return [
@@ -94,7 +72,6 @@ class General extends Component
             'publicPortTimeout' => 'nullable|integer|min:1',
             'isLogDrainEnabled' => 'nullable|boolean',
             'customDockerRunOptions' => 'nullable',
-            'enableSsl' => 'boolean',
         ];
     }
 
@@ -133,7 +110,6 @@ class General extends Component
         'publicPort' => 'Public Port',
         'publicPortTimeout' => 'Public Port Timeout',
         'customDockerRunOptions' => 'Custom Docker Options',
-        'enableSsl' => 'Enable SSL',
     ];
 
     public function mount()
@@ -147,12 +123,6 @@ class General extends Component
 
                 return;
             }
-
-            $existingCert = $this->database->sslCertificates()->first();
-
-            if ($existingCert) {
-                $this->certificateValidUntil = $existingCert->valid_until;
-            }
         } catch (Exception $e) {
             return handleError($e, $this);
         }
@@ -176,11 +146,7 @@ class General extends Component
             $this->database->public_port_timeout = $this->publicPortTimeout ?: null;
             $this->database->is_log_drain_enabled = $this->isLogDrainEnabled;
             $this->database->custom_docker_run_options = $this->customDockerRunOptions;
-            $this->database->enable_ssl = $this->enableSsl;
             $this->database->save();
-
-            $this->db_url = $this->database->internal_db_url;
-            $this->db_url_public = $this->database->external_db_url;
         } else {
             $this->name = $this->database->name;
             $this->description = $this->database->description;
@@ -196,9 +162,6 @@ class General extends Component
             $this->publicPortTimeout = $this->database->public_port_timeout;
             $this->isLogDrainEnabled = $this->database->is_log_drain_enabled;
             $this->customDockerRunOptions = $this->database->custom_docker_run_options;
-            $this->enableSsl = $this->database->enable_ssl;
-            $this->db_url = $this->database->internal_db_url;
-            $this->db_url_public = $this->database->external_db_url;
         }
     }
 
@@ -234,6 +197,7 @@ class General extends Component
             }
             $this->syncData(true);
             $this->dispatch('success', 'Database updated.');
+            $this->dispatch('databaseUpdated');
         } catch (Exception $e) {
             return handleError($e, $this);
         } finally {
@@ -270,6 +234,7 @@ class General extends Component
                 StopDatabaseProxy::run($this->database);
                 $this->dispatch('success', 'Database is no longer publicly accessible.');
             }
+            $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
@@ -278,63 +243,6 @@ class General extends Component
         }
     }
 
-    public function instantSaveSSL()
-    {
-        try {
-            $this->authorize('update', $this->database);
-
-            $this->syncData(true);
-            $this->dispatch('success', 'SSL configuration updated.');
-        } catch (Exception $e) {
-            return handleError($e, $this);
-        }
-    }
-
-    public function regenerateSslCertificate()
-    {
-        try {
-            $this->authorize('update', $this->database);
-
-            $existingCert = $this->database->sslCertificates()->first();
-
-            if (! $existingCert) {
-                $this->dispatch('error', 'No existing SSL certificate found for this database.');
-
-                return;
-            }
-
-            $caCert = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
-
-            if (! $caCert) {
-                $this->server->generateCaCertificate();
-                $caCert = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
-            }
-
-            if (! $caCert) {
-                $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
-
-                return;
-            }
-
-            SslHelper::generateSslCertificate(
-                commonName: $existingCert->common_name,
-                subjectAlternativeNames: $existingCert->subject_alternative_names ?? [],
-                resourceType: $existingCert->resource_type,
-                resourceId: $existingCert->resource_id,
-                serverId: $existingCert->server_id,
-                caCert: $caCert->ssl_certificate,
-                caKey: $caCert->ssl_private_key,
-                configurationDir: $existingCert->configuration_dir,
-                mountPath: $existingCert->mount_path,
-                isPemKeyFileRequired: true,
-            );
-
-            $this->dispatch('success', 'SSL certificates have been regenerated. Please restart the database for changes to take effect.');
-        } catch (Exception $e) {
-            return handleError($e, $this);
-        }
-    }
-
     public function refresh(): void
     {
         $this->database->refresh();

app/Livewire/Project/Database/Mariadb/StatusInfo.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Livewire\Project\Database\Mariadb;
+
+use App\Models\StandaloneMariadb;
+use App\Traits\HasDatabaseStatusInfo;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class StatusInfo extends Component
+{
+    use AuthorizesRequests;
+    use HasDatabaseStatusInfo;
+
+    public StandaloneMariadb $database;
+
+    protected function databaseLabel(): string
+    {
+        return 'MariaDB';
+    }
+}

app/Livewire/Project/Database/Mongodb/General.php

@@ -4,14 +4,11 @@ namespace App\Livewire\Project\Database\Mongodb;
 
 use App\Actions\Database\StartDatabaseProxy;
 use App\Actions\Database\StopDatabaseProxy;
-use App\Helpers\SslHelper;
 use App\Models\Server;
 use App\Models\StandaloneMongodb;
 use App\Support\ValidationPatterns;
-use Carbon\Carbon;
 use Exception;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
 
 class General extends Component
@@ -48,27 +45,6 @@ class General extends Component
 
     public ?string $customDockerRunOptions = null;
 
-    public bool $enableSsl = false;
-
-    public ?string $sslMode = null;
-
-    public ?string $db_url = null;
-
-    public ?string $db_url_public = null;
-
-    public ?Carbon $certificateValidUntil = null;
-
-    public function getListeners()
-    {
-        $userId = Auth::id();
-        $teamId = Auth::user()->currentTeam()->id;
-
-        return [
-            "echo-private:user.{$userId},DatabaseStatusChanged" => 'refresh',
-            "echo-private:team.{$teamId},ServiceChecked" => 'refresh',
-        ];
-    }
-
     protected function rules(): array
     {
         return [
@@ -91,8 +67,6 @@ class General extends Component
             'publicPortTimeout' => 'nullable|integer|min:1',
             'isLogDrainEnabled' => 'nullable|boolean',
             'customDockerRunOptions' => 'nullable',
-            'enableSsl' => 'boolean',
-            'sslMode' => 'nullable|string|in:allow,prefer,require,verify-full',
         ];
     }
 
@@ -112,7 +86,6 @@ class General extends Component
                 'publicPort.max' => 'The Public Port must not exceed 65535.',
                 'publicPortTimeout.integer' => 'The Public Port Timeout must be an integer.',
                 'publicPortTimeout.min' => 'The Public Port Timeout must be at least 1.',
-                'sslMode.in' => 'The SSL Mode must be one of: allow, prefer, require, verify-full.',
             ]
         );
     }
@@ -130,8 +103,6 @@ class General extends Component
         'publicPort' => 'Public Port',
         'publicPortTimeout' => 'Public Port Timeout',
         'customDockerRunOptions' => 'Custom Docker Run Options',
-        'enableSsl' => 'Enable SSL',
-        'sslMode' => 'SSL Mode',
     ];
 
     public function mount()
@@ -145,12 +116,6 @@ class General extends Component
 
                 return;
             }
-
-            $existingCert = $this->database->sslCertificates()->first();
-
-            if ($existingCert) {
-                $this->certificateValidUntil = $existingCert->valid_until;
-            }
         } catch (Exception $e) {
             return handleError($e, $this);
         }
@@ -173,12 +138,7 @@ class General extends Component
             $this->database->public_port_timeout = $this->publicPortTimeout ?: null;
             $this->database->is_log_drain_enabled = $this->isLogDrainEnabled;
             $this->database->custom_docker_run_options = $this->customDockerRunOptions;
-            $this->database->enable_ssl = $this->enableSsl;
-            $this->database->ssl_mode = $this->sslMode;
             $this->database->save();
-
-            $this->db_url = $this->database->internal_db_url;
-            $this->db_url_public = $this->database->external_db_url;
         } else {
             $this->name = $this->database->name;
             $this->description = $this->database->description;
@@ -193,10 +153,6 @@ class General extends Component
             $this->publicPortTimeout = $this->database->public_port_timeout;
             $this->isLogDrainEnabled = $this->database->is_log_drain_enabled;
             $this->customDockerRunOptions = $this->database->custom_docker_run_options;
-            $this->enableSsl = $this->database->enable_ssl;
-            $this->sslMode = $this->database->ssl_mode;
-            $this->db_url = $this->database->internal_db_url;
-            $this->db_url_public = $this->database->external_db_url;
         }
     }
 
@@ -235,6 +191,7 @@ class General extends Component
             }
             $this->syncData(true);
             $this->dispatch('success', 'Database updated.');
+            $this->dispatch('databaseUpdated');
         } catch (Exception $e) {
             return handleError($e, $this);
         } finally {
@@ -271,6 +228,7 @@ class General extends Component
                 StopDatabaseProxy::run($this->database);
                 $this->dispatch('success', 'Database is no longer publicly accessible.');
             }
+            $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
@@ -279,68 +237,6 @@ class General extends Component
         }
     }
 
-    public function updatedSslMode()
-    {
-        $this->instantSaveSSL();
-    }
-
-    public function instantSaveSSL()
-    {
-        try {
-            $this->authorize('update', $this->database);
-
-            $this->syncData(true);
-            $this->dispatch('success', 'SSL configuration updated.');
-        } catch (Exception $e) {
-            return handleError($e, $this);
-        }
-    }
-
-    public function regenerateSslCertificate()
-    {
-        try {
-            $this->authorize('update', $this->database);
-
-            $existingCert = $this->database->sslCertificates()->first();
-
-            if (! $existingCert) {
-                $this->dispatch('error', 'No existing SSL certificate found for this database.');
-
-                return;
-            }
-
-            $caCert = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
-
-            if (! $caCert) {
-                $this->server->generateCaCertificate();
-                $caCert = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
-            }
-
-            if (! $caCert) {
-                $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
-
-                return;
-            }
-
-            SslHelper::generateSslCertificate(
-                commonName: $existingCert->common_name,
-                subjectAlternativeNames: $existingCert->subject_alternative_names ?? [],
-                resourceType: $existingCert->resource_type,
-                resourceId: $existingCert->resource_id,
-                serverId: $existingCert->server_id,
-                caCert: $caCert->ssl_certificate,
-                caKey: $caCert->ssl_private_key,
-                configurationDir: $existingCert->configuration_dir,
-                mountPath: $existingCert->mount_path,
-                isPemKeyFileRequired: true,
-            );
-
-            $this->dispatch('success', 'SSL certificates have been regenerated. Please restart the database for changes to take effect.');
-        } catch (Exception $e) {
-            return handleError($e, $this);
-        }
-    }
-
     public function refresh(): void
     {
         $this->database->refresh();

app/Livewire/Project/Database/Mongodb/StatusInfo.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Livewire\Project\Database\Mongodb;
+
+use App\Models\StandaloneMongodb;
+use App\Traits\HasDatabaseStatusInfo;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class StatusInfo extends Component
+{
+    use AuthorizesRequests;
+    use HasDatabaseStatusInfo;
+
+    public StandaloneMongodb $database;
+
+    protected function databaseLabel(): string
+    {
+        return 'Mongo';
+    }
+
+    protected function sslModeOptions(): array
+    {
+        return [
+            'allow' => ['title' => 'Allow insecure connections', 'label' => 'allow (insecure)'],
+            'prefer' => ['title' => 'Prefer secure connections', 'label' => 'prefer (secure)'],
+            'require' => ['title' => 'Require secure connections', 'label' => 'require (secure)'],
+            'verify-full' => ['title' => 'Verify full certificate', 'label' => 'verify-full (secure)'],
+        ];
+    }
+
+    protected function sslModeHelper(): string
+    {
+        return 'Choose the SSL verification mode for MongoDB connections';
+    }
+
+    protected function afterRefresh(): void
+    {
+        $this->sslMode = $this->database->ssl_mode;
+    }
+
+    protected function applyExtraSslAttributes(): void
+    {
+        $this->database->ssl_mode = $this->sslMode;
+    }
+
+    public function updatedSslMode(): void
+    {
+        $this->instantSaveSSL();
+    }
+}

app/Livewire/Project/Database/Mysql/General.php

@@ -4,14 +4,11 @@ namespace App\Livewire\Project\Database\Mysql;
 
 use App\Actions\Database\StartDatabaseProxy;
 use App\Actions\Database\StopDatabaseProxy;
-use App\Helpers\SslHelper;
 use App\Models\Server;
 use App\Models\StandaloneMysql;
 use App\Support\ValidationPatterns;
-use Carbon\Carbon;
 use Exception;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
 
 class General extends Component
@@ -50,27 +47,6 @@ class General extends Component
 
     public ?string $customDockerRunOptions = null;
 
-    public bool $enableSsl = false;
-
-    public ?string $sslMode = null;
-
-    public ?string $db_url = null;
-
-    public ?string $db_url_public = null;
-
-    public ?Carbon $certificateValidUntil = null;
-
-    public function getListeners()
-    {
-        $userId = Auth::id();
-        $teamId = Auth::user()->currentTeam()->id;
-
-        return [
-            "echo-private:user.{$userId},DatabaseStatusChanged" => 'refresh',
-            "echo-private:team.{$teamId},ServiceChecked" => 'refresh',
-        ];
-    }
-
     protected function rules(): array
     {
         return [
@@ -96,8 +72,6 @@ class General extends Component
             'publicPortTimeout' => 'nullable|integer|min:1',
             'isLogDrainEnabled' => 'nullable|boolean',
             'customDockerRunOptions' => 'nullable',
-            'enableSsl' => 'boolean',
-            'sslMode' => 'nullable|string|in:PREFERRED,REQUIRED,VERIFY_CA,VERIFY_IDENTITY',
         ];
     }
 
@@ -118,7 +92,6 @@ class General extends Component
                 'publicPort.max' => 'The Public Port must not exceed 65535.',
                 'publicPortTimeout.integer' => 'The Public Port Timeout must be an integer.',
                 'publicPortTimeout.min' => 'The Public Port Timeout must be at least 1.',
-                'sslMode.in' => 'The SSL Mode must be one of: PREFERRED, REQUIRED, VERIFY_CA, VERIFY_IDENTITY.',
             ]
         );
     }
@@ -137,8 +110,6 @@ class General extends Component
         'publicPort' => 'Public Port',
         'publicPortTimeout' => 'Public Port Timeout',
         'customDockerRunOptions' => 'Custom Docker Run Options',
-        'enableSsl' => 'Enable SSL',
-        'sslMode' => 'SSL Mode',
     ];
 
     public function mount()
@@ -152,12 +123,6 @@ class General extends Component
 
                 return;
             }
-
-            $existingCert = $this->database->sslCertificates()->first();
-
-            if ($existingCert) {
-                $this->certificateValidUntil = $existingCert->valid_until;
-            }
         } catch (Exception $e) {
             return handleError($e, $this);
         }
@@ -181,12 +146,7 @@ class General extends Component
             $this->database->public_port_timeout = $this->publicPortTimeout ?: null;
             $this->database->is_log_drain_enabled = $this->isLogDrainEnabled;
             $this->database->custom_docker_run_options = $this->customDockerRunOptions;
-            $this->database->enable_ssl = $this->enableSsl;
-            $this->database->ssl_mode = $this->sslMode;
             $this->database->save();
-
-            $this->db_url = $this->database->internal_db_url;
-            $this->db_url_public = $this->database->external_db_url;
         } else {
             $this->name = $this->database->name;
             $this->description = $this->database->description;
@@ -202,10 +162,6 @@ class General extends Component
             $this->publicPortTimeout = $this->database->public_port_timeout;
             $this->isLogDrainEnabled = $this->database->is_log_drain_enabled;
             $this->customDockerRunOptions = $this->database->custom_docker_run_options;
-            $this->enableSsl = $this->database->enable_ssl;
-            $this->sslMode = $this->database->ssl_mode;
-            $this->db_url = $this->database->internal_db_url;
-            $this->db_url_public = $this->database->external_db_url;
         }
     }
 
@@ -241,6 +197,7 @@ class General extends Component
             }
             $this->syncData(true);
             $this->dispatch('success', 'Database updated.');
+            $this->dispatch('databaseUpdated');
         } catch (Exception $e) {
             return handleError($e, $this);
         } finally {
@@ -277,6 +234,7 @@ class General extends Component
                 StopDatabaseProxy::run($this->database);
                 $this->dispatch('success', 'Database is no longer publicly accessible.');
             }
+            $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
@@ -285,68 +243,6 @@ class General extends Component
         }
     }
 
-    public function updatedSslMode()
-    {
-        $this->instantSaveSSL();
-    }
-
-    public function instantSaveSSL()
-    {
-        try {
-            $this->authorize('update', $this->database);
-
-            $this->syncData(true);
-            $this->dispatch('success', 'SSL configuration updated.');
-        } catch (Exception $e) {
-            return handleError($e, $this);
-        }
-    }
-
-    public function regenerateSslCertificate()
-    {
-        try {
-            $this->authorize('update', $this->database);
-
-            $existingCert = $this->database->sslCertificates()->first();
-
-            if (! $existingCert) {
-                $this->dispatch('error', 'No existing SSL certificate found for this database.');
-
-                return;
-            }
-
-            $caCert = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
-
-            if (! $caCert) {
-                $this->server->generateCaCertificate();
-                $caCert = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
-            }
-
-            if (! $caCert) {
-                $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
-
-                return;
-            }
-
-            SslHelper::generateSslCertificate(
-                commonName: $existingCert->common_name,
-                subjectAlternativeNames: $existingCert->subject_alternative_names ?? [],
-                resourceType: $existingCert->resource_type,
-                resourceId: $existingCert->resource_id,
-                serverId: $existingCert->server_id,
-                caCert: $caCert->ssl_certificate,
-                caKey: $caCert->ssl_private_key,
-                configurationDir: $existingCert->configuration_dir,
-                mountPath: $existingCert->mount_path,
-                isPemKeyFileRequired: true,
-            );
-
-            $this->dispatch('success', 'SSL certificates have been regenerated. Please restart the database for changes to take effect.');
-        } catch (Exception $e) {
-            return handleError($e, $this);
-        }
-    }
-
     public function refresh(): void
     {
         $this->database->refresh();

app/Livewire/Project/Database/Mysql/StatusInfo.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Livewire\Project\Database\Mysql;
+
+use App\Models\StandaloneMysql;
+use App\Traits\HasDatabaseStatusInfo;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class StatusInfo extends Component
+{
+    use AuthorizesRequests;
+    use HasDatabaseStatusInfo;
+
+    public StandaloneMysql $database;
+
+    protected function databaseLabel(): string
+    {
+        return 'MySQL';
+    }
+
+    protected function sslModeOptions(): array
+    {
+        return [
+            'PREFERRED' => ['title' => 'Prefer secure connections', 'label' => 'Prefer (secure)'],
+            'REQUIRED' => ['title' => 'Require secure connections', 'label' => 'Require (secure)'],
+            'VERIFY_CA' => ['title' => 'Verify CA certificate', 'label' => 'Verify CA (secure)'],
+            'VERIFY_IDENTITY' => ['title' => 'Verify full certificate', 'label' => 'Verify Full (secure)'],
+        ];
+    }
+
+    protected function sslModeHelper(): string
+    {
+        return 'Choose the SSL verification mode for MySQL connections';
+    }
+
+    protected function afterRefresh(): void
+    {
+        $this->sslMode = $this->database->ssl_mode;
+    }
+
+    protected function applyExtraSslAttributes(): void
+    {
+        $this->database->ssl_mode = $this->sslMode;
+    }
+
+    public function updatedSslMode(): void
+    {
+        $this->instantSaveSSL();
+    }
+}

app/Livewire/Project/Database/Postgresql/General.php

@@ -4,14 +4,11 @@ namespace App\Livewire\Project\Database\Postgresql;
 
 use App\Actions\Database\StartDatabaseProxy;
 use App\Actions\Database\StopDatabaseProxy;
-use App\Helpers\SslHelper;
 use App\Models\Server;
 use App\Models\StandalonePostgresql;
 use App\Support\ValidationPatterns;
-use Carbon\Carbon;
 use Exception;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
 
 class General extends Component
@@ -54,32 +51,14 @@ class General extends Component
 
     public ?string $customDockerRunOptions = null;
 
-    public bool $enableSsl = false;
-
-    public ?string $sslMode = null;
-
     public string $new_filename;
 
     public string $new_content;
 
-    public ?string $db_url = null;
-
-    public ?string $db_url_public = null;
-
-    public ?Carbon $certificateValidUntil = null;
-
-    public function getListeners()
-    {
-        $userId = Auth::id();
-        $teamId = Auth::user()->currentTeam()->id;
-
-        return [
-            "echo-private:user.{$userId},DatabaseStatusChanged" => 'refresh',
-            "echo-private:team.{$teamId},ServiceChecked" => 'refresh',
-            'save_init_script',
-            'delete_init_script',
-        ];
-    }
+    protected $listeners = [
+        'save_init_script',
+        'delete_init_script',
+    ];
 
     protected function rules(): array
     {
@@ -106,8 +85,6 @@ class General extends Component
             'publicPortTimeout' => 'nullable|integer|min:1',
             'isLogDrainEnabled' => 'nullable|boolean',
             'customDockerRunOptions' => 'nullable',
-            'enableSsl' => 'boolean',
-            'sslMode' => 'nullable|string|in:allow,prefer,require,verify-ca,verify-full',
         ];
     }
 
@@ -127,7 +104,6 @@ class General extends Component
                 'publicPort.max' => 'The Public Port must not exceed 65535.',
                 'publicPortTimeout.integer' => 'The Public Port Timeout must be an integer.',
                 'publicPortTimeout.min' => 'The Public Port Timeout must be at least 1.',
-                'sslMode.in' => 'The SSL Mode must be one of: allow, prefer, require, verify-ca, verify-full.',
             ]
         );
     }
@@ -148,8 +124,6 @@ class General extends Component
         'publicPort' => 'Public Port',
         'publicPortTimeout' => 'Public Port Timeout',
         'customDockerRunOptions' => 'Custom Docker Run Options',
-        'enableSsl' => 'Enable SSL',
-        'sslMode' => 'SSL Mode',
     ];
 
     public function mount()
@@ -163,12 +137,6 @@ class General extends Component
 
                 return;
             }
-
-            $existingCert = $this->database->sslCertificates()->first();
-
-            if ($existingCert) {
-                $this->certificateValidUntil = $existingCert->valid_until;
-            }
         } catch (Exception $e) {
             return handleError($e, $this);
         }
@@ -194,12 +162,7 @@ class General extends Component
             $this->database->public_port_timeout = $this->publicPortTimeout ?: null;
             $this->database->is_log_drain_enabled = $this->isLogDrainEnabled;
             $this->database->custom_docker_run_options = $this->customDockerRunOptions;
-            $this->database->enable_ssl = $this->enableSsl;
-            $this->database->ssl_mode = $this->sslMode;
             $this->database->save();
-
-            $this->db_url = $this->database->internal_db_url;
-            $this->db_url_public = $this->database->external_db_url;
         } else {
             $this->name = $this->database->name;
             $this->description = $this->database->description;
@@ -217,10 +180,6 @@ class General extends Component
             $this->publicPortTimeout = $this->database->public_port_timeout;
             $this->isLogDrainEnabled = $this->database->is_log_drain_enabled;
             $this->customDockerRunOptions = $this->database->custom_docker_run_options;
-            $this->enableSsl = $this->database->enable_ssl;
-            $this->sslMode = $this->database->ssl_mode;
-            $this->db_url = $this->database->internal_db_url;
-            $this->db_url_public = $this->database->external_db_url;
         }
     }
 
@@ -243,68 +202,6 @@ class General extends Component
         }
     }
 
-    public function updatedSslMode()
-    {
-        $this->instantSaveSSL();
-    }
-
-    public function instantSaveSSL()
-    {
-        try {
-            $this->authorize('update', $this->database);
-
-            $this->syncData(true);
-            $this->dispatch('success', 'SSL configuration updated.');
-        } catch (Exception $e) {
-            return handleError($e, $this);
-        }
-    }
-
-    public function regenerateSslCertificate()
-    {
-        try {
-            $this->authorize('update', $this->database);
-
-            $existingCert = $this->database->sslCertificates()->first();
-
-            if (! $existingCert) {
-                $this->dispatch('error', 'No existing SSL certificate found for this database.');
-
-                return;
-            }
-
-            $caCert = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
-
-            if (! $caCert) {
-                $this->server->generateCaCertificate();
-                $caCert = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
-            }
-
-            if (! $caCert) {
-                $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
-
-                return;
-            }
-
-            SslHelper::generateSslCertificate(
-                commonName: $existingCert->common_name,
-                subjectAlternativeNames: $existingCert->subject_alternative_names ?? [],
-                resourceType: $existingCert->resource_type,
-                resourceId: $existingCert->resource_id,
-                serverId: $existingCert->server_id,
-                caCert: $caCert->ssl_certificate,
-                caKey: $caCert->ssl_private_key,
-                configurationDir: $existingCert->configuration_dir,
-                mountPath: $existingCert->mount_path,
-                isPemKeyFileRequired: true,
-            );
-
-            $this->dispatch('success', 'SSL certificates have been regenerated. Please restart the database for changes to take effect.');
-        } catch (Exception $e) {
-            return handleError($e, $this);
-        }
-    }
-
     public function instantSave()
     {
         try {
@@ -330,6 +227,7 @@ class General extends Component
                 StopDatabaseProxy::run($this->database);
                 $this->dispatch('success', 'Database is no longer publicly accessible.');
             }
+            $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
@@ -493,6 +391,7 @@ class General extends Component
             }
             $this->syncData(true);
             $this->dispatch('success', 'Database updated.');
+            $this->dispatch('databaseUpdated');
         } catch (Exception $e) {
             return handleError($e, $this);
         } finally {

app/Livewire/Project/Database/Postgresql/StatusInfo.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Livewire\Project\Database\Postgresql;
+
+use App\Models\StandalonePostgresql;
+use App\Traits\HasDatabaseStatusInfo;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class StatusInfo extends Component
+{
+    use AuthorizesRequests;
+    use HasDatabaseStatusInfo;
+
+    public StandalonePostgresql $database;
+
+    protected function databaseLabel(): string
+    {
+        return 'Postgres';
+    }
+
+    protected function sslModeOptions(): array
+    {
+        return [
+            'allow' => ['title' => 'Allow insecure connections', 'label' => 'allow (insecure)'],
+            'prefer' => ['title' => 'Prefer secure connections', 'label' => 'prefer (secure)'],
+            'require' => ['title' => 'Require secure connections', 'label' => 'require (secure)'],
+            'verify-ca' => ['title' => 'Verify CA certificate', 'label' => 'verify-ca (secure)'],
+            'verify-full' => ['title' => 'Verify full certificate', 'label' => 'verify-full (secure)'],
+        ];
+    }
+
+    protected function sslModeHelper(): string
+    {
+        return 'Choose the SSL verification mode for PostgreSQL connections';
+    }
+
+    protected function afterRefresh(): void
+    {
+        $this->sslMode = $this->database->ssl_mode;
+    }
+
+    protected function applyExtraSslAttributes(): void
+    {
+        $this->database->ssl_mode = $this->sslMode;
+    }
+
+    public function updatedSslMode(): void
+    {
+        $this->instantSaveSSL();
+    }
+}

app/Livewire/Project/Database/Redis/General.php

@@ -4,14 +4,11 @@ namespace App\Livewire\Project\Database\Redis;
 
 use App\Actions\Database\StartDatabaseProxy;
 use App\Actions\Database\StopDatabaseProxy;
-use App\Helpers\SslHelper;
 use App\Models\Server;
 use App\Models\StandaloneRedis;
 use App\Support\ValidationPatterns;
-use Carbon\Carbon;
 use Exception;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
 
 class General extends Component
@@ -48,25 +45,9 @@ class General extends Component
 
     public string $redisVersion;
 
-    public ?string $dbUrl = null;
-
-    public ?string $dbUrlPublic = null;
-
-    public bool $enableSsl = false;
-
-    public ?Carbon $certificateValidUntil = null;
-
-    public function getListeners()
-    {
-        $userId = Auth::id();
-        $teamId = Auth::user()->currentTeam()->id;
-
-        return [
-            "echo-private:user.{$userId},DatabaseStatusChanged" => 'refresh',
-            "echo-private:team.{$teamId},ServiceChecked" => 'refresh',
-            'envsUpdated' => 'refresh',
-        ];
-    }
+    protected $listeners = [
+        'envsUpdated' => 'refresh',
+    ];
 
     protected function rules(): array
     {
@@ -87,7 +68,6 @@ class General extends Component
             'redisPassword' => ValidationPatterns::databasePasswordRules(
                 enforcePattern: $this->redisPassword !== $this->database->redis_password,
             ),
-            'enableSsl' => 'boolean',
         ];
     }
 
@@ -122,7 +102,6 @@ class General extends Component
         'customDockerRunOptions' => 'Custom Docker Options',
         'redisUsername' => 'Redis Username',
         'redisPassword' => 'Redis Password',
-        'enableSsl' => 'Enable SSL',
     ];
 
     public function mount()
@@ -136,12 +115,6 @@ class General extends Component
 
                 return;
             }
-
-            $existingCert = $this->database->sslCertificates()->first();
-
-            if ($existingCert) {
-                $this->certificateValidUntil = $existingCert->valid_until;
-            }
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -161,11 +134,7 @@ class General extends Component
             $this->database->public_port_timeout = $this->publicPortTimeout ?: null;
             $this->database->is_log_drain_enabled = $this->isLogDrainEnabled;
             $this->database->custom_docker_run_options = $this->customDockerRunOptions;
-            $this->database->enable_ssl = $this->enableSsl;
             $this->database->save();
-
-            $this->dbUrl = $this->database->internal_db_url;
-            $this->dbUrlPublic = $this->database->external_db_url;
         } else {
             $this->name = $this->database->name;
             $this->description = $this->database->description;
@@ -177,9 +146,6 @@ class General extends Component
             $this->publicPortTimeout = $this->database->public_port_timeout;
             $this->isLogDrainEnabled = $this->database->is_log_drain_enabled;
             $this->customDockerRunOptions = $this->database->custom_docker_run_options;
-            $this->enableSsl = $this->database->enable_ssl;
-            $this->dbUrl = $this->database->internal_db_url;
-            $this->dbUrlPublic = $this->database->external_db_url;
             $this->redisVersion = $this->database->getRedisVersion();
             $this->redisUsername = $this->database->redis_username;
             $this->redisPassword = $this->database->redis_password;
@@ -227,6 +193,7 @@ class General extends Component
             );
 
             $this->dispatch('success', 'Database updated.');
+            $this->dispatch('databaseUpdated');
         } catch (Exception $e) {
             return handleError($e, $this);
         } finally {
@@ -259,6 +226,7 @@ class General extends Component
                 StopDatabaseProxy::run($this->database);
                 $this->dispatch('success', 'Database is no longer publicly accessible.');
             }
+            $this->dispatch('databaseUpdated');
         } catch (\Throwable $e) {
             $this->isPublic = ! $this->isPublic;
             $this->syncData(true);
@@ -267,63 +235,6 @@ class General extends Component
         }
     }
 
-    public function instantSaveSSL()
-    {
-        try {
-            $this->authorize('update', $this->database);
-
-            $this->syncData(true);
-            $this->dispatch('success', 'SSL configuration updated.');
-        } catch (Exception $e) {
-            return handleError($e, $this);
-        }
-    }
-
-    public function regenerateSslCertificate()
-    {
-        try {
-            $this->authorize('update', $this->database);
-
-            $existingCert = $this->database->sslCertificates()->first();
-
-            if (! $existingCert) {
-                $this->dispatch('error', 'No existing SSL certificate found for this database.');
-
-                return;
-            }
-
-            $caCert = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
-
-            if (! $caCert) {
-                $this->server->generateCaCertificate();
-                $caCert = $this->server->sslCertificates()->where('is_ca_certificate', true)->first();
-            }
-
-            if (! $caCert) {
-                $this->dispatch('error', 'No CA certificate found for this database. Please generate a CA certificate for this server in the server/advanced page.');
-
-                return;
-            }
-
-            SslHelper::generateSslCertificate(
-                commonName: $existingCert->common_name,
-                subjectAlternativeNames: $existingCert->subject_alternative_names ?? [],
-                resourceType: $existingCert->resource_type,
-                resourceId: $existingCert->resource_id,
-                serverId: $existingCert->server_id,
-                caCert: $caCert->ssl_certificate,
-                caKey: $caCert->ssl_private_key,
-                configurationDir: $existingCert->configuration_dir,
-                mountPath: $existingCert->mount_path,
-                isPemKeyFileRequired: true,
-            );
-
-            $this->dispatch('success', 'SSL certificates regenerated. Restart database to apply changes.');
-        } catch (Exception $e) {
-            handleError($e, $this);
-        }
-    }
-
     public function refresh(): void
     {
         $this->database->refresh();

app/Livewire/Project/Database/Redis/StatusInfo.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Livewire\Project\Database\Redis;
+
+use App\Models\StandaloneRedis;
+use App\Traits\HasDatabaseStatusInfo;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class StatusInfo extends Component
+{
+    use AuthorizesRequests;
+    use HasDatabaseStatusInfo;
+
+    public StandaloneRedis $database;
+
+    protected function databaseLabel(): string
+    {
+        return 'Redis';
+    }
+}

app/Livewire/Project/DeleteEnvironment.php

@@ -4,12 +4,14 @@ namespace App\Livewire\Project;
 
 use App\Models\Environment;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\Locked;
 use Livewire\Component;
 
 class DeleteEnvironment extends Component
 {
     use AuthorizesRequests;
 
+    #[Locked]
     public int $environment_id;
 
     public bool $disabled = false;
@@ -20,12 +22,8 @@ class DeleteEnvironment extends Component
 
     public function mount()
     {
-        try {
-            $this->environmentName = Environment::findOrFail($this->environment_id)->name;
-            $this->parameters = get_route_parameters();
-        } catch (\Exception $e) {
-            return handleError($e, $this);
-        }
+        $this->parameters = get_route_parameters();
+        $this->environmentName = Environment::ownedByCurrentTeam()->findOrFail($this->environment_id)->name;
     }
 
     public function delete()
@@ -33,7 +31,7 @@ class DeleteEnvironment extends Component
         $this->validate([
             'environment_id' => 'required|int',
         ]);
-        $environment = Environment::findOrFail($this->environment_id);
+        $environment = Environment::ownedByCurrentTeam()->findOrFail($this->environment_id);
         $this->authorize('delete', $environment);
 
         if ($environment->isEmpty()) {

app/Livewire/Project/New/DockerImage.php

@@ -5,6 +5,7 @@ namespace App\Livewire\Project\New;
 use App\Models\Application;
 use App\Models\Project;
 use App\Services\DockerImageParser;
+use App\Support\ValidationPatterns;
 use Livewire\Component;
 use Visus\Cuid2\Cuid2;
 
@@ -81,8 +82,8 @@ class DockerImage extends Component
     public function submit()
     {
         $this->validate([
-            'imageName' => ['required', 'string'],
-            'imageTag' => ['nullable', 'string', 'regex:/^[a-z0-9][a-z0-9._-]*$/i'],
+            'imageName' => ValidationPatterns::dockerImageNameRules(required: true),
+            'imageTag' => ValidationPatterns::dockerImageTagRules(),
             'imageSha256' => ['nullable', 'string', 'regex:/^[a-f0-9]{64}$/i'],
         ]);
 

app/Livewire/Project/New/GithubPrivateRepository.php

@@ -9,6 +9,7 @@ use App\Rules\ValidGitBranch;
 use App\Support\ValidationPatterns;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Route;
+use Livewire\Attributes\Locked;
 use Livewire\Component;
 
 class GithubPrivateRepository extends Component
@@ -29,6 +30,7 @@ class GithubPrivateRepository extends Component
 
     public int $selected_repository_id;
 
+    #[Locked]
     public int $selected_github_app_id;
 
     public string $selected_repository_owner;
@@ -37,8 +39,6 @@ class GithubPrivateRepository extends Component
 
     public string $selected_branch_name = 'main';
 
-    public string $token;
-
     public $repositories;
 
     public int $total_repositories_count = 0;
@@ -71,7 +71,10 @@ class GithubPrivateRepository extends Component
         $this->parameters = get_route_parameters();
         $this->query = request()->query();
         $this->repositories = $this->branches = collect();
-        $this->github_apps = GithubApp::private();
+        $this->github_apps = GithubApp::ownedByCurrentTeam()
+            ->where('is_public', false)
+            ->whereNotNull('app_id')
+            ->get();
     }
 
     public function updatedSelectedRepositoryId(): void
@@ -81,9 +84,11 @@ class GithubPrivateRepository extends Component
 
     public function updatedBuildPack()
     {
-        if ($this->build_pack === 'nixpacks') {
+        if ($this->build_pack === 'nixpacks' || $this->build_pack === 'railpack') {
             $this->show_is_static = true;
-            $this->port = 3000;
+            if (! $this->is_static) {
+                $this->port = 3000;
+            }
         } elseif ($this->build_pack === 'static') {
             $this->show_is_static = false;
             $this->is_static = false;
@@ -94,22 +99,25 @@ class GithubPrivateRepository extends Component
         }
     }
 
-    public function loadRepositories($github_app_id)
+    public function loadRepositories(int $github_app_id): void
     {
         $this->repositories = collect();
         $this->branches = collect();
         $this->total_branches_count = 0;
         $this->page = 1;
         $this->selected_github_app_id = $github_app_id;
-        $this->github_app = GithubApp::where('id', $github_app_id)->first();
-        $this->token = generateGithubInstallationToken($this->github_app);
-        $repositories = loadRepositoryByPage($this->github_app, $this->token, $this->page);
+        $this->github_app = GithubApp::ownedByCurrentTeam()
+            ->where('is_public', false)
+            ->whereNotNull('app_id')
+            ->findOrFail($github_app_id);
+        $token = generateGithubInstallationToken($this->github_app);
+        $repositories = loadRepositoryByPage($this->github_app, $token, $this->page);
         $this->total_repositories_count = $repositories['total_count'];
         $this->repositories = $this->repositories->concat(collect($repositories['repositories']));
         if ($this->repositories->count() < $this->total_repositories_count) {
             while ($this->repositories->count() < $this->total_repositories_count) {
                 $this->page++;
-                $repositories = loadRepositoryByPage($this->github_app, $this->token, $this->page);
+                $repositories = loadRepositoryByPage($this->github_app, $token, $this->page);
                 $this->total_repositories_count = $repositories['total_count'];
                 $this->repositories = $this->repositories->concat(collect($repositories['repositories']));
             }
@@ -140,7 +148,9 @@ class GithubPrivateRepository extends Component
 
     protected function loadBranchByPage()
     {
-        $response = Http::GitHub($this->github_app->api_url, $this->token)
+        $token = generateGithubInstallationToken($this->github_app);
+
+        $response = Http::GitHub($this->github_app->api_url, $token)
             ->timeout(20)
             ->retry(3, 200, throw: false)
             ->get("/repos/{$this->selected_repository_owner}/{$this->selected_repository_repo}/branches", [

app/Livewire/Project/New/GithubPrivateRepositoryDeployKey.php

@@ -94,9 +94,11 @@ class GithubPrivateRepositoryDeployKey extends Component
 
     public function updatedBuildPack()
     {
-        if ($this->build_pack === 'nixpacks') {
+        if ($this->build_pack === 'nixpacks' || $this->build_pack === 'railpack') {
             $this->show_is_static = true;
-            $this->port = 3000;
+            if (! $this->is_static) {
+                $this->port = 3000;
+            }
         } elseif ($this->build_pack === 'static') {
             $this->show_is_static = false;
             $this->is_static = false;

app/Livewire/Project/New/PublicGitRepository.php

@@ -96,9 +96,11 @@ class PublicGitRepository extends Component
 
     public function updatedBuildPack()
     {
-        if ($this->build_pack === 'nixpacks') {
+        if ($this->build_pack === 'nixpacks' || $this->build_pack === 'railpack') {
             $this->show_is_static = true;
-            $this->port = 3000;
+            if (! $this->isStatic) {
+                $this->port = 3000;
+            }
         } elseif ($this->build_pack === 'static') {
             $this->show_is_static = false;
             $this->isStatic = false;

app/Livewire/Project/Service/Configuration.php

@@ -4,7 +4,6 @@ namespace App\Livewire\Project\Service;
 
 use App\Models\Service;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
 
 class Configuration extends Component
@@ -27,16 +26,10 @@ class Configuration extends Component
 
     public array $parameters;
 
-    public function getListeners()
-    {
-        $teamId = Auth::user()->currentTeam()->id;
-
-        return [
-            "echo-private:team.{$teamId},ServiceChecked" => 'serviceChecked',
-            'refreshServices' => 'refreshServices',
-            'refresh' => 'refreshServices',
-        ];
-    }
+    protected $listeners = [
+        'refreshServices' => 'refreshServices',
+        'refresh' => 'refreshServices',
+    ];
 
     public function render()
     {
@@ -51,7 +44,7 @@ class Configuration extends Component
             $this->query = request()->query();
             $project = currentTeam()
                 ->projects()
-                ->select('id', 'uuid', 'team_id')
+                ->select('id', 'uuid', 'name', 'team_id')
                 ->where('uuid', request()->route('project_uuid'))
                 ->firstOrFail();
             $environment = $project->environments()
@@ -105,18 +98,4 @@ class Configuration extends Component
             return handleError($e, $this);
         }
     }
-
-    public function serviceChecked()
-    {
-        try {
-            $this->service->applications->each(function ($application) {
-                $application->refresh();
-            });
-            $this->service->databases->each(function ($database) {
-                $database->refresh();
-            });
-        } catch (\Exception $e) {
-            return handleError($e, $this);
-        }
-    }
 }

app/Livewire/Project/Service/DatabaseBackups.php

@@ -28,10 +28,16 @@ class DatabaseBackups extends Component
         try {
             $this->parameters = get_route_parameters();
             $this->query = request()->query();
-            $this->service = Service::whereUuid($this->parameters['service_uuid'])->first();
-            if (! $this->service) {
-                return redirect()->route('dashboard');
-            }
+            $project = currentTeam()
+                ->projects()
+                ->select('id', 'uuid', 'team_id')
+                ->where('uuid', $this->parameters['project_uuid'])
+                ->firstOrFail();
+            $environment = $project->environments()
+                ->select('id', 'uuid', 'name', 'project_id')
+                ->where('uuid', $this->parameters['environment_uuid'])
+                ->firstOrFail();
+            $this->service = $environment->services()->whereUuid($this->parameters['service_uuid'])->firstOrFail();
             $this->authorize('view', $this->service);
 
             $this->serviceDatabase = $this->service->databases()->whereUuid($this->parameters['stack_service_uuid'])->first();

app/Livewire/Project/Service/Heading.php

@@ -7,12 +7,15 @@ use App\Actions\Service\StartService;
 use App\Actions\Service\StopService;
 use App\Enums\ProcessStatus;
 use App\Models\Service;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Facades\Auth;
 use Livewire\Component;
 use Spatie\Activitylog\Models\Activity;
 
 class Heading extends Component
 {
+    use AuthorizesRequests;
+
     public Service $service;
 
     public array $parameters;
@@ -27,6 +30,8 @@ class Heading extends Component
 
     public function mount()
     {
+        $this->authorizeService('view');
+
         if (str($this->service->status)->contains('running') && is_null($this->service->config_hash)) {
             $this->service->isConfigurationChanged(true);
             $this->dispatch('configurationChanged');
@@ -47,6 +52,8 @@ class Heading extends Component
 
     public function checkStatus()
     {
+        $this->authorizeService('view');
+
         if ($this->service->server->isFunctional()) {
             GetContainersStatus::dispatch($this->service->server);
         } else {
@@ -61,6 +68,8 @@ class Heading extends Component
 
     public function serviceChecked()
     {
+        $this->authorizeService('view');
+
         try {
             $this->service->applications->each(function ($application) {
                 $application->refresh();
@@ -82,6 +91,8 @@ class Heading extends Component
 
     public function checkDeployments()
     {
+        $this->authorizeService('view');
+
         try {
             $activity = Activity::where('properties->type_uuid', $this->service->uuid)->latest()->first();
             $status = data_get($activity, 'properties.status');
@@ -99,12 +110,16 @@ class Heading extends Component
 
     public function start()
     {
+        $this->authorizeService('deploy');
+
         $activity = StartService::run($this->service, pullLatestImages: true);
         $this->dispatch('activityMonitor', $activity->id);
     }
 
     public function forceDeploy()
     {
+        $this->authorizeService('deploy');
+
         try {
             $activities = Activity::where('properties->type_uuid', $this->service->uuid)
                 ->where(function ($q) {
@@ -124,6 +139,8 @@ class Heading extends Component
 
     public function stop()
     {
+        $this->authorizeService('stop');
+
         try {
             StopService::dispatch($this->service, false, $this->docker_cleanup);
         } catch (\Exception $e) {
@@ -133,6 +150,8 @@ class Heading extends Component
 
     public function restart()
     {
+        $this->authorizeService('deploy');
+
         $this->checkDeployments();
         if ($this->isDeploymentProgress) {
             $this->dispatch('error', 'There is a deployment in progress.');
@@ -145,6 +164,8 @@ class Heading extends Component
 
     public function pullAndRestartEvent()
     {
+        $this->authorizeService('deploy');
+
         $this->checkDeployments();
         if ($this->isDeploymentProgress) {
             $this->dispatch('error', 'There is a deployment in progress.');
@@ -155,6 +176,15 @@ class Heading extends Component
         $this->dispatch('activityMonitor', $activity->id);
     }
 
+    private function authorizeService(string $ability): void
+    {
+        $this->service = Service::ownedByCurrentTeam()
+            ->whereKey($this->service->getKey())
+            ->firstOrFail();
+
+        $this->authorize($ability, $this->service);
+    }
+
     public function render()
     {
         return view('livewire.project.service.heading', [

app/Livewire/Project/Service/Index.php

@@ -108,10 +108,16 @@ class Index extends Component
             $this->parameters = get_route_parameters();
             $this->query = request()->query();
             $this->currentRoute = request()->route()->getName();
-            $this->service = Service::whereUuid($this->parameters['service_uuid'])->first();
-            if (! $this->service) {
-                return redirect()->route('dashboard');
-            }
+            $project = currentTeam()
+                ->projects()
+                ->select('id', 'uuid', 'team_id')
+                ->where('uuid', $this->parameters['project_uuid'])
+                ->firstOrFail();
+            $environment = $project->environments()
+                ->select('id', 'uuid', 'name', 'project_id')
+                ->where('uuid', $this->parameters['environment_uuid'])
+                ->firstOrFail();
+            $this->service = $environment->services()->whereUuid($this->parameters['service_uuid'])->firstOrFail();
             $this->authorize('view', $this->service);
             $service = $this->service->applications()->whereUuid($this->parameters['stack_service_uuid'])->first();
             if ($service) {

app/Livewire/Project/Service/ResourceCard.php

@@ -0,0 +1,66 @@
+<?php
+
+namespace App\Livewire\Project\Service;
+
+use App\Models\Service;
+use App\Models\ServiceApplication;
+use App\Models\ServiceDatabase;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\Auth;
+use Livewire\Component;
+
+class ResourceCard extends Component
+{
+    use AuthorizesRequests;
+
+    public Service $service;
+
+    public ServiceApplication|ServiceDatabase $resource;
+
+    public array $parameters = [];
+
+    public function getListeners(): array
+    {
+        $user = Auth::user();
+        if (! $user) {
+            return [];
+        }
+
+        $team = $user->currentTeam();
+        if (! $team) {
+            return [];
+        }
+
+        return [
+            "echo-private:team.{$team->id},ServiceChecked" => 'refreshResource',
+        ];
+    }
+
+    public function refreshResource(): void
+    {
+        $this->resource->refresh();
+    }
+
+    public function restart(): void
+    {
+        try {
+            $this->authorize('update', $this->service);
+            $this->resource->restart();
+            $message = $this->resource instanceof ServiceApplication
+                ? 'Service application restarted successfully.'
+                : 'Service database restarted successfully.';
+            $this->dispatch('success', $message);
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function render(): View
+    {
+        return view('livewire.project.service.resource-card', [
+            'isApplication' => $this->resource instanceof ServiceApplication,
+            'isDatabase' => $this->resource instanceof ServiceDatabase,
+        ]);
+    }
+}

app/Livewire/Project/Shared/ConfigurationChecker.php

@@ -12,15 +12,18 @@ use App\Models\StandaloneMongodb;
 use App\Models\StandaloneMysql;
 use App\Models\StandalonePostgresql;
 use App\Models\StandaloneRedis;
+use Illuminate\Contracts\View\View;
 use Livewire\Component;
 
 class ConfigurationChecker extends Component
 {
     public bool $isConfigurationChanged = false;
 
+    public array $configurationDiff = [];
+
     public Application|Service|StandaloneRedis|StandalonePostgresql|StandaloneMongodb|StandaloneMysql|StandaloneMariadb|StandaloneKeydb|StandaloneDragonfly|StandaloneClickhouse $resource;
 
-    public function getListeners()
+    public function getListeners(): array
     {
         $teamId = auth()->user()->currentTeam()->id;
 
@@ -30,18 +33,71 @@ class ConfigurationChecker extends Component
         ];
     }
 
-    public function mount()
+    public function mount(): void
     {
         $this->configurationChanged();
     }
 
-    public function render()
+    public function render(): View
     {
         return view('livewire.project.shared.configuration-checker');
     }
 
-    public function configurationChanged()
+    public function refreshConfigurationChanges(): void
     {
+        $this->configurationChanged();
+    }
+
+    /**
+     * Members must never see environment variable values, so redact every
+     * environment-section change before it is serialized to the browser.
+     *
+     * @param  array<int, array<string, mixed>>  $changes
+     * @return array<int, array<string, mixed>>
+     */
+    private function redactEnvironmentChanges(array $changes, bool $redact): array
+    {
+        if (! $redact) {
+            return $changes;
+        }
+
+        return collect($changes)
+            ->map(function (array $change): array {
+                if (data_get($change, 'section') !== 'environment') {
+                    return $change;
+                }
+
+                $change['old_display_value'] = data_get($change, 'old_display_value') === '-' ? '-' : '••••••••';
+                $change['new_display_value'] = data_get($change, 'new_display_value') === '-' ? '-' : '••••••••';
+                $change['old_full_value'] = null;
+                $change['new_full_value'] = null;
+                $change['expandable'] = false;
+                $change['display_summary'] = data_get($change, 'type') === 'changed' ? 'Changed' : null;
+
+                return $change;
+            })
+            ->all();
+    }
+
+    public function configurationChanged(): void
+    {
+        $this->resource->refresh();
+
+        if ($this->resource instanceof Application) {
+            $diff = $this->resource->pendingDeploymentConfigurationDiff();
+            // Fail closed: only owners/admins may see unlocked env values.
+            $redactEnvironment = ! (bool) auth()->user()?->isAdmin();
+
+            $array = $diff->toArray();
+            $array['changes'] = $this->redactEnvironmentChanges($array['changes'] ?? [], $redactEnvironment);
+
+            $this->isConfigurationChanged = $diff->isChanged();
+            $this->configurationDiff = $array;
+
+            return;
+        }
+
         $this->isConfigurationChanged = $this->resource->isConfigurationChanged();
+        $this->configurationDiff = [];
     }
 }

app/Livewire/Project/Shared/Destination.php

@@ -110,15 +110,27 @@ class Destination extends Component
 
     public function promote(int $network_id, int $server_id)
     {
-        $main_destination = $this->resource->destination;
-        $this->resource->update([
-            'destination_id' => $network_id,
-            'destination_type' => StandaloneDocker::class,
-        ]);
-        $this->resource->additional_networks()->detach($network_id, ['server_id' => $server_id]);
-        $this->resource->additional_networks()->attach($main_destination->id, ['server_id' => $main_destination->server->id]);
-        $this->refreshServers();
-        $this->resource->refresh();
+        try {
+            $server = Server::ownedByCurrentTeam()->findOrFail($server_id);
+            $network = StandaloneDocker::ownedByCurrentTeam()->where('server_id', $server->id)->findOrFail($network_id);
+            $this->authorize('update', $this->resource);
+
+            $this->resource->getConnection()->transaction(function () use ($network, $server) {
+                $main_destination = $this->resource->destination;
+                $this->resource->update([
+                    'destination_id' => $network->id,
+                    'destination_type' => StandaloneDocker::class,
+                ]);
+                $this->resource->additional_networks()
+                    ->wherePivot('server_id', $server->id)
+                    ->detach($network->id);
+                $this->resource->additional_networks()->attach($main_destination->id, ['server_id' => $main_destination->server->id]);
+            });
+            $this->resource->refresh();
+            $this->refreshServers();
+        } catch (\Exception $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function refreshServers()
@@ -130,8 +142,16 @@ class Destination extends Component
 
     public function addServer(int $network_id, int $server_id)
     {
-        $this->resource->additional_networks()->attach($network_id, ['server_id' => $server_id]);
-        $this->dispatch('refresh');
+        try {
+            $server = Server::ownedByCurrentTeam()->findOrFail($server_id);
+            $network = StandaloneDocker::ownedByCurrentTeam()->where('server_id', $server->id)->findOrFail($network_id);
+            $this->authorize('update', $this->resource);
+
+            $this->resource->additional_networks()->attach($network->id, ['server_id' => $server->id]);
+            $this->dispatch('refresh');
+        } catch (\Exception $e) {
+            return handleError($e, $this);
+        }
     }
 
     public function removeServer(int $network_id, int $server_id, $password, $selectedActions = [])
@@ -148,7 +168,9 @@ class Destination extends Component
             }
             $server = Server::ownedByCurrentTeam()->findOrFail($server_id);
             StopApplicationOneServer::run($this->resource, $server);
-            $this->resource->additional_networks()->detach($network_id, ['server_id' => $server_id]);
+            $this->resource->additional_networks()
+                ->wherePivot('server_id', $server_id)
+                ->detach($network_id);
             $this->loadData();
             $this->dispatch('refresh');
             ApplicationStatusChanged::dispatch(data_get($this->resource, 'environment.project.team.id'));

app/Livewire/Project/Shared/EnvironmentVariable/Add.php

@@ -2,9 +2,14 @@
 
 namespace App\Livewire\Project\Shared\EnvironmentVariable;
 
+use App\Models\Application;
 use App\Models\Environment;
 use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
+use App\Support\ValidationPatterns;
 use App\Traits\EnvironmentVariableAnalyzer;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Computed;
 use Livewire\Component;
@@ -37,15 +42,23 @@ class Add extends Component
 
     protected $listeners = ['clearAddEnv' => 'clear'];
 
-    protected $rules = [
-        'key' => 'required|string',
-        'value' => 'nullable',
-        'is_multiline' => 'required|boolean',
-        'is_literal' => 'required|boolean',
-        'is_runtime' => 'required|boolean',
-        'is_buildtime' => 'required|boolean',
-        'comment' => 'nullable|string|max:256',
-    ];
+    protected function rules(): array
+    {
+        return [
+            'key' => ValidationPatterns::environmentVariableKeyRules(),
+            'value' => 'nullable',
+            'is_multiline' => 'required|boolean',
+            'is_literal' => 'required|boolean',
+            'is_runtime' => 'required|boolean',
+            'is_buildtime' => 'required|boolean',
+            'comment' => 'nullable|string|max:256',
+        ];
+    }
+
+    protected function messages(): array
+    {
+        return ValidationPatterns::environmentVariableKeyMessages('key');
+    }
 
     protected $validationAttributes = [
         'key' => 'key',
@@ -85,7 +98,7 @@ class Add extends Component
             $result['team'] = $team->environment_variables()
                 ->pluck('key')
                 ->toArray();
-        } catch (\Illuminate\Auth\Access\AuthorizationException $e) {
+        } catch (AuthorizationException $e) {
             // User not authorized to view team variables
         }
 
@@ -116,12 +129,12 @@ class Add extends Component
                                 $result['environment'] = $environment->environment_variables()
                                     ->pluck('key')
                                     ->toArray();
-                            } catch (\Illuminate\Auth\Access\AuthorizationException $e) {
+                            } catch (AuthorizationException $e) {
                                 // User not authorized to view environment variables
                             }
                         }
                     }
-                } catch (\Illuminate\Auth\Access\AuthorizationException $e) {
+                } catch (AuthorizationException $e) {
                     // User not authorized to view project variables
                 }
             }
@@ -131,7 +144,7 @@ class Add extends Component
         $serverUuid = data_get($this->parameters, 'server_uuid');
         if ($serverUuid) {
             // If we have a specific server_uuid, show variables for that server
-            $server = \App\Models\Server::where('team_id', $team->id)
+            $server = Server::where('team_id', $team->id)
                 ->where('uuid', $serverUuid)
                 ->first();
 
@@ -141,7 +154,7 @@ class Add extends Component
                     $result['server'] = $server->environment_variables()
                         ->pluck('key')
                         ->toArray();
-                } catch (\Illuminate\Auth\Access\AuthorizationException $e) {
+                } catch (AuthorizationException $e) {
                     // User not authorized to view server variables
                 }
             }
@@ -149,7 +162,7 @@ class Add extends Component
             // For application environment variables, try to use the application's destination server
             $applicationUuid = data_get($this->parameters, 'application_uuid');
             if ($applicationUuid) {
-                $application = \App\Models\Application::whereRelation('environment.project.team', 'id', $team->id)
+                $application = Application::whereRelation('environment.project.team', 'id', $team->id)
                     ->where('uuid', $applicationUuid)
                     ->with('destination.server')
                     ->first();
@@ -160,7 +173,7 @@ class Add extends Component
                         $result['server'] = $application->destination->server->environment_variables()
                             ->pluck('key')
                             ->toArray();
-                    } catch (\Illuminate\Auth\Access\AuthorizationException $e) {
+                    } catch (AuthorizationException $e) {
                         // User not authorized to view server variables
                     }
                 }
@@ -168,7 +181,7 @@ class Add extends Component
                 // For service environment variables, try to use the service's server
                 $serviceUuid = data_get($this->parameters, 'service_uuid');
                 if ($serviceUuid) {
-                    $service = \App\Models\Service::whereRelation('environment.project.team', 'id', $team->id)
+                    $service = Service::whereRelation('environment.project.team', 'id', $team->id)
                         ->where('uuid', $serviceUuid)
                         ->with('server')
                         ->first();
@@ -179,7 +192,7 @@ class Add extends Component
                             $result['server'] = $service->server->environment_variables()
                                 ->pluck('key')
                                 ->toArray();
-                        } catch (\Illuminate\Auth\Access\AuthorizationException $e) {
+                        } catch (AuthorizationException $e) {
                             // User not authorized to view server variables
                         }
                     }
@@ -192,6 +205,7 @@ class Add extends Component
 
     public function submit()
     {
+        $this->key = ValidationPatterns::normalizeEnvironmentVariableKey($this->key);
         $this->validate();
         $this->dispatch('saveKey', [
             'key' => $this->key,

app/Livewire/Project/Shared/EnvironmentVariable/All.php

@@ -2,7 +2,9 @@
 
 namespace App\Livewire\Project\Shared\EnvironmentVariable;
 
+use App\Models\Application;
 use App\Models\EnvironmentVariable;
+use App\Support\ValidationPatterns;
 use App\Traits\EnvironmentVariableProtection;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
@@ -38,7 +40,7 @@ class All extends Component
         $this->is_env_sorting_enabled = data_get($this->resource, 'settings.is_env_sorting_enabled', false);
         $this->use_build_secrets = data_get($this->resource, 'settings.use_build_secrets', false);
         $this->resourceClass = get_class($this->resource);
-        $resourceWithPreviews = [\App\Models\Application::class];
+        $resourceWithPreviews = [Application::class];
         $simpleDockerfile = filled(data_get($this->resource, 'dockerfile'));
         if (str($this->resourceClass)->contains($resourceWithPreviews) && ! $simpleDockerfile) {
             $this->showPreview = true;
@@ -194,7 +196,7 @@ class All extends Component
 
     private function updateOrder()
     {
-        $variables = parseEnvFormatToArray($this->variables);
+        $variables = $this->normalizeEnvironmentVariables(parseEnvFormatToArray($this->variables));
         $order = 1;
         foreach ($variables as $key => $value) {
             $env = $this->resource->environment_variables()->where('key', $key)->first();
@@ -206,7 +208,7 @@ class All extends Component
         }
 
         if ($this->showPreview) {
-            $previewVariables = parseEnvFormatToArray($this->variablesPreview);
+            $previewVariables = $this->normalizeEnvironmentVariables(parseEnvFormatToArray($this->variablesPreview));
             $order = 1;
             foreach ($previewVariables as $key => $value) {
                 $env = $this->resource->environment_variables_preview()->where('key', $key)->first();
@@ -221,7 +223,7 @@ class All extends Component
 
     private function handleBulkSubmit()
     {
-        $variables = parseEnvFormatToArray($this->variables);
+        $variables = $this->normalizeEnvironmentVariables(parseEnvFormatToArray($this->variables));
         $changesMade = false;
         $errorOccurred = false;
 
@@ -241,7 +243,7 @@ class All extends Component
         }
 
         if ($this->showPreview) {
-            $previewVariables = parseEnvFormatToArray($this->variablesPreview);
+            $previewVariables = $this->normalizeEnvironmentVariables(parseEnvFormatToArray($this->variablesPreview));
 
             // Try to delete removed preview variables
             $deletedPreviewCount = $this->deleteRemovedVariables(true, $previewVariables);
@@ -267,6 +269,7 @@ class All extends Component
 
     private function handleSingleSubmit($data)
     {
+        $data['key'] = ValidationPatterns::validatedEnvironmentVariableKey($data['key']);
         $found = $this->resource->environment_variables()->where('key', $data['key'])->first();
         if ($found) {
             $this->dispatch('error', 'Environment variable already exists.');
@@ -334,6 +337,23 @@ class All extends Component
         return $variablesToDelete->count();
     }
 
+    private function normalizeEnvironmentVariables(array $variables): array
+    {
+        $normalizedVariables = [];
+
+        foreach ($variables as $key => $data) {
+            $normalizedKey = ValidationPatterns::validatedEnvironmentVariableKey((string) $key);
+
+            if (array_key_exists($normalizedKey, $normalizedVariables)) {
+                throw new \InvalidArgumentException("Duplicate environment variable key after normalization: {$normalizedKey}.");
+            }
+
+            $normalizedVariables[$normalizedKey] = $data;
+        }
+
+        return $normalizedVariables;
+    }
+
     private function updateOrCreateVariables($isPreview, $variables)
     {
         $count = 0;

app/Livewire/Project/Shared/EnvironmentVariable/Show.php

@@ -2,12 +2,17 @@
 
 namespace App\Livewire\Project\Shared\EnvironmentVariable;
 
+use App\Models\Application;
 use App\Models\Environment;
 use App\Models\EnvironmentVariable as ModelsEnvironmentVariable;
 use App\Models\Project;
+use App\Models\Server;
+use App\Models\Service;
 use App\Models\SharedEnvironmentVariable;
+use App\Support\ValidationPatterns;
 use App\Traits\EnvironmentVariableAnalyzer;
 use App\Traits\EnvironmentVariableProtection;
+use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Attributes\Computed;
 use Livewire\Component;
@@ -64,23 +69,31 @@ class Show extends Component
         'compose_loaded' => '$refresh',
     ];
 
-    protected $rules = [
-        'key' => 'required|string',
-        'value' => 'nullable',
-        'comment' => 'nullable|string|max:256',
-        'is_multiline' => 'required|boolean',
-        'is_literal' => 'required|boolean',
-        'is_shown_once' => 'required|boolean',
-        'is_runtime' => 'required|boolean',
-        'is_buildtime' => 'required|boolean',
-        'real_value' => 'nullable',
-        'is_required' => 'required|boolean',
-    ];
+    protected function rules(): array
+    {
+        return [
+            'key' => ValidationPatterns::environmentVariableKeyRules(),
+            'value' => 'nullable',
+            'comment' => 'nullable|string|max:256',
+            'is_multiline' => 'required|boolean',
+            'is_literal' => 'required|boolean',
+            'is_shown_once' => 'required|boolean',
+            'is_runtime' => 'required|boolean',
+            'is_buildtime' => 'required|boolean',
+            'real_value' => 'nullable',
+            'is_required' => 'required|boolean',
+        ];
+    }
+
+    protected function messages(): array
+    {
+        return ValidationPatterns::environmentVariableKeyMessages('key');
+    }
 
     public function mount()
     {
         $this->syncData();
-        if ($this->env->getMorphClass() === \App\Models\SharedEnvironmentVariable::class) {
+        if ($this->env->getMorphClass() === SharedEnvironmentVariable::class) {
             $this->isSharedVariable = true;
         }
         $this->parameters = get_route_parameters();
@@ -108,9 +121,11 @@ class Show extends Component
     public function syncData(bool $toModel = false)
     {
         if ($toModel) {
+            $this->key = ValidationPatterns::normalizeEnvironmentVariableKey($this->key);
+
             if ($this->isSharedVariable) {
                 $this->validate([
-                    'key' => 'required|string',
+                    'key' => ValidationPatterns::environmentVariableKeyRules(),
                     'value' => 'nullable',
                     'comment' => 'nullable|string|max:256',
                     'is_multiline' => 'required|boolean',
@@ -233,7 +248,7 @@ class Show extends Component
             $result['team'] = $team->environment_variables()
                 ->pluck('key')
                 ->toArray();
-        } catch (\Illuminate\Auth\Access\AuthorizationException $e) {
+        } catch (AuthorizationException $e) {
             // User not authorized to view team variables
         }
 
@@ -264,12 +279,12 @@ class Show extends Component
                                 $result['environment'] = $environment->environment_variables()
                                     ->pluck('key')
                                     ->toArray();
-                            } catch (\Illuminate\Auth\Access\AuthorizationException $e) {
+                            } catch (AuthorizationException $e) {
                                 // User not authorized to view environment variables
                             }
                         }
                     }
-                } catch (\Illuminate\Auth\Access\AuthorizationException $e) {
+                } catch (AuthorizationException $e) {
                     // User not authorized to view project variables
                 }
             }
@@ -279,7 +294,7 @@ class Show extends Component
         $serverUuid = data_get($this->parameters, 'server_uuid');
         if ($serverUuid) {
             // If we have a specific server_uuid, show variables for that server
-            $server = \App\Models\Server::where('team_id', $team->id)
+            $server = Server::where('team_id', $team->id)
                 ->where('uuid', $serverUuid)
                 ->first();
 
@@ -289,7 +304,7 @@ class Show extends Component
                     $result['server'] = $server->environment_variables()
                         ->pluck('key')
                         ->toArray();
-                } catch (\Illuminate\Auth\Access\AuthorizationException $e) {
+                } catch (AuthorizationException $e) {
                     // User not authorized to view server variables
                 }
             }
@@ -297,7 +312,7 @@ class Show extends Component
             // For application environment variables, try to use the application's destination server
             $applicationUuid = data_get($this->parameters, 'application_uuid');
             if ($applicationUuid) {
-                $application = \App\Models\Application::whereRelation('environment.project.team', 'id', $team->id)
+                $application = Application::whereRelation('environment.project.team', 'id', $team->id)
                     ->where('uuid', $applicationUuid)
                     ->with('destination.server')
                     ->first();
@@ -308,7 +323,7 @@ class Show extends Component
                         $result['server'] = $application->destination->server->environment_variables()
                             ->pluck('key')
                             ->toArray();
-                    } catch (\Illuminate\Auth\Access\AuthorizationException $e) {
+                    } catch (AuthorizationException $e) {
                         // User not authorized to view server variables
                     }
                 }
@@ -316,7 +331,7 @@ class Show extends Component
                 // For service environment variables, try to use the service's server
                 $serviceUuid = data_get($this->parameters, 'service_uuid');
                 if ($serviceUuid) {
-                    $service = \App\Models\Service::whereRelation('environment.project.team', 'id', $team->id)
+                    $service = Service::whereRelation('environment.project.team', 'id', $team->id)
                         ->where('uuid', $serviceUuid)
                         ->with('server')
                         ->first();
@@ -327,7 +342,7 @@ class Show extends Component
                             $result['server'] = $service->server->environment_variables()
                                 ->pluck('key')
                                 ->toArray();
-                        } catch (\Illuminate\Auth\Access\AuthorizationException $e) {
+                        } catch (AuthorizationException $e) {
                             // User not authorized to view server variables
                         }
                     }

app/Livewire/Project/Shared/ResourceDetails.php

@@ -0,0 +1,91 @@
+<?php
+
+namespace App\Livewire\Project\Shared;
+
+use App\Models\Service;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class ResourceDetails extends Component
+{
+    use AuthorizesRequests;
+
+    public $resource;
+
+    public ?string $project_uuid = null;
+
+    public ?string $project_name = null;
+
+    public ?string $environment_uuid = null;
+
+    public ?string $environment_name = null;
+
+    public ?string $server_uuid = null;
+
+    public ?string $server_name = null;
+
+    public array $stack_applications = [];
+
+    public array $stack_databases = [];
+
+    public function mount()
+    {
+        $this->authorize('view', $this->resource);
+
+        $environment = $this->resource->environment ?? null;
+        if ($environment) {
+            $this->environment_uuid = $environment->uuid;
+            $this->environment_name = $environment->name;
+            $project = $environment->project ?? null;
+            if ($project) {
+                $this->project_uuid = $project->uuid;
+                $this->project_name = $project->name;
+            }
+        }
+
+        $server = $this->resolveServer();
+        if ($server) {
+            $this->server_uuid = $server->uuid;
+            $this->server_name = $server->name;
+        }
+
+        if ($this->resource instanceof Service) {
+            $this->stack_applications = $this->resource->applications
+                ->map(fn ($app) => [
+                    'name' => $app->human_name ?: $app->name,
+                    'uuid' => $app->uuid,
+                ])
+                ->values()
+                ->all();
+
+            $this->stack_databases = $this->resource->databases
+                ->map(fn ($db) => [
+                    'name' => $db->human_name ?: $db->name,
+                    'uuid' => $db->uuid,
+                ])
+                ->values()
+                ->all();
+        }
+    }
+
+    private function resolveServer()
+    {
+        try {
+            if (isset($this->resource->destination) && $this->resource->destination && isset($this->resource->destination->server)) {
+                return $this->resource->destination->server;
+            }
+            if (method_exists($this->resource, 'server') && $this->resource->server) {
+                return $this->resource->server;
+            }
+        } catch (\Throwable $e) {
+            return null;
+        }
+
+        return null;
+    }
+
+    public function render()
+    {
+        return view('livewire.project.shared.resource-details');
+    }
+}

app/Livewire/Project/Shared/Terminal.php

@@ -12,6 +12,8 @@ class Terminal extends Component
 {
     public bool $hasShell = true;
 
+    public bool $isTerminalConnected = false;
+
     private function checkShellAvailability(Server $server, string $container): bool
     {
         $escapedContainer = escapeshellarg($container);
@@ -65,12 +67,20 @@ class Terminal extends Component
                 $dockerCommand = "sudo {$dockerCommand}";
             }
 
-            $command = SshMultiplexingHelper::generateSshCommand($server, $dockerCommand);
+            $command = SshMultiplexingHelper::generateSshCommand(
+                $server,
+                $dockerCommand,
+                commandTimeout: (int) config('constants.terminal.command_timeout')
+            );
         } else {
             $shellCommand = 'PATH=$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin && '.
                             'if [ -f ~/.profile ]; then . ~/.profile; fi && '.
                             'if [ -n "$SHELL" ] && [ -x "$SHELL" ]; then exec $SHELL; else sh; fi';
-            $command = SshMultiplexingHelper::generateSshCommand($server, $shellCommand);
+            $command = SshMultiplexingHelper::generateSshCommand(
+                $server,
+                $shellCommand,
+                commandTimeout: (int) config('constants.terminal.command_timeout')
+            );
         }
         // ssh command is sent back to frontend then to websocket
         // this is done because the websocket connection is not available here
@@ -84,6 +94,23 @@ class Terminal extends Component
         $this->dispatch('send-back-command', $command);
     }
 
+    #[On('terminalConnected')]
+    public function markTerminalConnected(): void
+    {
+        $this->isTerminalConnected = true;
+    }
+
+    #[On('terminalDisconnected')]
+    public function markTerminalDisconnected(): void
+    {
+        $this->isTerminalConnected = false;
+    }
+
+    public function keepTerminalPageAlive(): void
+    {
+        $this->isTerminalConnected = true;
+    }
+
     public function render()
     {
         return view('livewire.project.shared.terminal');

app/Livewire/Security/ApiTokens.php

@@ -5,6 +5,7 @@ namespace App\Livewire\Security;
 use App\Models\InstanceSettings;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Laravel\Sanctum\PersonalAccessToken;
+use Livewire\Attributes\Locked;
 use Livewire\Component;
 
 class ApiTokens extends Component
@@ -29,8 +30,10 @@ class ApiTokens extends Component
 
     public $isApiEnabled;
 
+    #[Locked]
     public bool $canUseRootPermissions = false;
 
+    #[Locked]
     public bool $canUseWritePermissions = false;
 
     public function render()
@@ -54,7 +57,7 @@ class ApiTokens extends Component
     public function updatedPermissions($permissionToUpdate)
     {
         // Check if user is trying to use restricted permissions
-        if ($permissionToUpdate == 'root' && ! $this->canUseRootPermissions) {
+        if ($permissionToUpdate == 'root' && ! auth()->user()->can('useRootPermissions', PersonalAccessToken::class)) {
             $this->dispatch('error', 'You do not have permission to use root permissions.');
             // Remove root from permissions if it was somehow added
             $this->permissions = array_diff($this->permissions, ['root']);
@@ -62,7 +65,7 @@ class ApiTokens extends Component
             return;
         }
 
-        if (in_array($permissionToUpdate, ['write', 'write:sensitive']) && ! $this->canUseWritePermissions) {
+        if (in_array($permissionToUpdate, ['write', 'write:sensitive'], true) && ! auth()->user()->can('useWritePermissions', PersonalAccessToken::class)) {
             $this->dispatch('error', 'You do not have permission to use write permissions.');
             // Remove write permissions if they were somehow added
             $this->permissions = array_diff($this->permissions, ['write', 'write:sensitive']);
@@ -72,7 +75,7 @@ class ApiTokens extends Component
 
         if ($permissionToUpdate == 'root') {
             $this->permissions = ['root'];
-        } elseif ($permissionToUpdate == 'read:sensitive' && ! in_array('read', $this->permissions)) {
+        } elseif ($permissionToUpdate == 'read:sensitive' && ! in_array('read', $this->permissions, true)) {
             $this->permissions[] = 'read';
         } elseif ($permissionToUpdate == 'deploy') {
             $this->permissions = ['deploy'];
@@ -90,11 +93,11 @@ class ApiTokens extends Component
             $this->authorize('create', PersonalAccessToken::class);
 
             // Validate permissions based on user role
-            if (in_array('root', $this->permissions) && ! $this->canUseRootPermissions) {
+            if (in_array('root', $this->permissions, true) && ! auth()->user()->can('useRootPermissions', PersonalAccessToken::class)) {
                 throw new \Exception('You do not have permission to create tokens with root permissions.');
             }
 
-            if (array_intersect(['write', 'write:sensitive'], $this->permissions) && ! $this->canUseWritePermissions) {
+            if (array_intersect(['write', 'write:sensitive'], $this->permissions) && ! auth()->user()->can('useWritePermissions', PersonalAccessToken::class)) {
                 throw new \Exception('You do not have permission to create tokens with write permissions.');
             }
 

app/Livewire/Server/Charts.php

@@ -2,11 +2,15 @@
 
 namespace App\Livewire\Server;
 
+use App\Actions\Server\StartSentinel;
 use App\Models\Server;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
 class Charts extends Component
 {
+    use AuthorizesRequests;
+
     public Server $server;
 
     public $chartId = 'server';
@@ -28,6 +32,29 @@ class Charts extends Component
         }
     }
 
+    public function toggleMetrics(): void
+    {
+        try {
+            $this->authorize('update', $this->server);
+            $this->server->settings->is_metrics_enabled = ! $this->server->settings->is_metrics_enabled;
+            $this->server->settings->save();
+            $this->server->refresh();
+
+            if ($this->server->isMetricsEnabled()) {
+                StartSentinel::run($this->server, true);
+                $this->dispatch('success', 'Metrics enabled. Starting Sentinel.');
+                $this->dispatch('refreshServerShow');
+                $this->redirect(route('server.metrics', ['server_uuid' => $this->server->uuid]), navigate: true);
+            } else {
+                $this->server->restartSentinel();
+                $this->dispatch('success', 'Metrics disabled. Restarting Sentinel.');
+                $this->dispatch('refreshServerShow');
+            }
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
     public function pollData()
     {
         if ($this->poll || $this->interval <= 10) {

app/Livewire/Server/Destinations.php

@@ -45,7 +45,7 @@ class Destinations extends Component
             } else {
                 SwarmDocker::create([
                     'name' => $this->server->name.'-'.$name,
-                    'network' => $this->name,
+                    'network' => $name,
                     'server_id' => $this->server->id,
                 ]);
             }

app/Livewire/Server/Proxy/DynamicConfigurationNavbar.php

@@ -28,12 +28,11 @@ class DynamicConfigurationNavbar extends Component
 
         // Decode filename: pipes are used to encode dots for Livewire property binding
         // (e.g., 'my|service.yaml' -> 'my.service.yaml')
-        // This must happen BEFORE validation because validateShellSafePath() correctly
-        // rejects pipe characters as dangerous shell metacharacters
+        // This must happen BEFORE validation because validateFilenameSafe()
+        // rejects pipe characters through validateShellSafePath().
         $file = str_replace('|', '.', $fileName);
 
-        // Validate filename to prevent command injection
-        validateShellSafePath($file, 'proxy configuration filename');
+        validateFilenameSafe($file, 'proxy configuration filename');
 
         if ($proxy_type === 'CADDY' && $file === 'Caddyfile') {
             $this->dispatch('error', 'Cannot delete Caddyfile.');

app/Livewire/Server/Proxy/NewDynamicConfiguration.php

@@ -43,8 +43,7 @@ class NewDynamicConfiguration extends Component
                 'value' => 'required',
             ]);
 
-            // Additional security validation to prevent command injection
-            validateShellSafePath($this->fileName, 'proxy configuration filename');
+            validateFilenameSafe($this->fileName, 'proxy configuration filename');
 
             if (data_get($this->parameters, 'server_uuid')) {
                 $this->server = Server::ownedByCurrentTeam()->whereUuid(data_get($this->parameters, 'server_uuid'))->first();

app/Livewire/Server/Sentinel.php

@@ -15,8 +15,6 @@ class Sentinel extends Component
 
     public Server $server;
 
-    public array $parameters = [];
-
     public bool $isMetricsEnabled;
 
     #[Validate(['required', 'string', 'max:500', 'regex:/\A[a-zA-Z0-9._\-+=\/]+\z/'])]
@@ -51,15 +49,9 @@ class Sentinel extends Component
         ];
     }
 
-    public function mount(string $server_uuid)
+    public function mount()
     {
-        try {
-            $this->server = Server::ownedByCurrentTeam()->whereUuid($server_uuid)->firstOrFail();
-            $this->parameters = get_route_parameters();
-            $this->syncData();
-        } catch (\Throwable) {
-            return redirect()->route('server.index');
-        }
+        $this->syncData();
     }
 
     public function syncData(bool $toModel = false)
@@ -93,7 +85,9 @@ class Sentinel extends Component
     {
         if ($event['serverUuid'] === $this->server->uuid) {
             $this->server->refresh();
-            $this->syncData();
+            // Only refresh display-only state; never re-sync text-input properties
+            // (would clobber any unsaved typing — see coolify#6062 / #6354 / #9695).
+            $this->sentinelUpdatedAt = $this->server->sentinel_updated_at;
             $this->dispatch('success', 'Sentinel has been restarted successfully.');
         }
     }
@@ -110,27 +104,29 @@ class Sentinel extends Component
         }
     }
 
-    public function updatedIsSentinelEnabled($value)
+    public function toggleSentinel(): void
     {
         try {
             $this->authorize('manageSentinel', $this->server);
-            if ($value === true) {
+            if (! $this->isSentinelEnabled) {
                 if ($this->server->isBuildServer()) {
-                    $this->isSentinelEnabled = false;
                     $this->dispatch('error', 'Sentinel cannot be enabled on build servers.');
 
                     return;
                 }
+                $this->isSentinelEnabled = true;
                 $customImage = isDev() ? $this->sentinelCustomDockerImage : null;
                 StartSentinel::run($this->server, true, null, $customImage);
             } else {
+                $this->isSentinelEnabled = false;
                 $this->isMetricsEnabled = false;
                 $this->isSentinelDebugEnabled = false;
                 StopSentinel::dispatch($this->server);
             }
             $this->submit();
+            $this->dispatch('refreshServerShow');
         } catch (\Throwable $e) {
-            return handleError($e, $this);
+            handleError($e, $this);
         }
     }
 

app/Livewire/Server/Sentinel/Logs.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Livewire\Server\Sentinel;
+
+use App\Models\Server;
+use Illuminate\View\View;
+use Livewire\Component;
+
+class Logs extends Component
+{
+    public ?Server $server = null;
+
+    public array $parameters = [];
+
+    public function mount(): void
+    {
+        $this->parameters = get_route_parameters();
+        try {
+            $this->server = Server::ownedByCurrentTeam()->whereUuid(request()->server_uuid)->firstOrFail();
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function render(): View
+    {
+        return view('livewire.server.sentinel.logs');
+    }
+}

app/Livewire/Server/Sentinel/Show.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App\Livewire\Server\Sentinel;
+
+use App\Models\Server;
+use Illuminate\View\View;
+use Livewire\Component;
+
+class Show extends Component
+{
+    public ?Server $server = null;
+
+    public array $parameters = [];
+
+    public function mount(): void
+    {
+        $this->parameters = get_route_parameters();
+        try {
+            $this->server = Server::ownedByCurrentTeam()->whereUuid(request()->server_uuid)->firstOrFail();
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function render(): View
+    {
+        return view('livewire.server.sentinel.show');
+    }
+}

app/Livewire/Server/Show.php

@@ -278,7 +278,9 @@ class Show extends Component
         // Only refresh if the event is for this server
         if (isset($event['serverUuid']) && $event['serverUuid'] === $this->server->uuid) {
             $this->server->refresh();
-            $this->syncData();
+            // Only refresh display-only state; never re-sync text-input properties
+            // (would clobber any unsaved typing — see coolify#6062 / #6354 / #9695).
+            $this->sentinelUpdatedAt = $this->server->sentinel_updated_at;
             $this->dispatch('success', 'Sentinel has been restarted successfully.');
         }
     }
@@ -458,12 +460,15 @@ class Show extends Component
             return;
         }
 
-        // Refresh server data
+        // Refresh server data and only the display-only state that validation produces.
+        // Never re-sync text-input properties via syncData() — would clobber any
+        // unsaved typing (see coolify#6062 / #6354 / #9695).
         $this->server->refresh();
-        $this->syncData();
-
-        // Update validation state
+        $this->server->settings->refresh();
         $this->isValidating = $this->server->is_validating ?? false;
+        $this->validationLogs = $this->server->validation_logs;
+        $this->isReachable = $this->server->settings->is_reachable;
+        $this->isUsable = $this->server->settings->is_usable;
 
         // Reload Hetzner tokens in case the linking section should now be shown
         $this->loadHetznerTokens();

app/Livewire/SettingsDropdown.php

@@ -11,6 +11,8 @@ class SettingsDropdown extends Component
 {
     public $showWhatsNewModal = false;
 
+    public string $trigger = 'preferences';
+
     public function getUnreadCountProperty()
     {
         return Auth::user()->getUnreadChangelogCount();

app/Livewire/Source/Github/Change.php

@@ -7,7 +7,9 @@ use App\Models\GithubApp;
 use App\Models\PrivateKey;
 use App\Rules\SafeExternalUrl;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Facades\Cache;
 use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Str;
 use Lcobucci\JWT\Configuration;
 use Lcobucci\JWT\Signer\Key\InMemory;
 use Lcobucci\JWT\Signer\Rsa\Sha256;
@@ -19,6 +21,10 @@ class Change extends Component
 
     public string $webhook_endpoint = '';
 
+    public string $custom_webhook_endpoint = '';
+
+    public bool $use_custom_webhook_endpoint = false;
+
     public ?string $ipv4 = null;
 
     public ?string $ipv6 = null;
@@ -72,6 +78,10 @@ class Change extends Component
 
     public $privateKeys;
 
+    public string $manifestState = '';
+
+    public string $activeTab = 'general';
+
     protected function rules(): array
     {
         return [
@@ -91,6 +101,9 @@ class Change extends Component
             'metadata' => 'nullable|string',
             'pullRequests' => 'nullable|string',
             'privateKeyId' => 'nullable|int',
+            'webhook_endpoint' => ['required', 'string', 'url'],
+            'custom_webhook_endpoint' => ['nullable', 'string', 'url'],
+            'use_custom_webhook_endpoint' => ['required', 'bool'],
         ];
     }
 
@@ -147,6 +160,24 @@ class Change extends Component
         }
     }
 
+    private function githubAppSetupStateCacheKey(string $state): string
+    {
+        return 'github-app-setup-state:'.hash('sha256', $state);
+    }
+
+    private function createGithubAppSetupState(string $action): string
+    {
+        $state = Str::random(64);
+
+        Cache::put($this->githubAppSetupStateCacheKey($state), [
+            'action' => $action,
+            'github_app_id' => $this->github_app->id,
+            'team_id' => $this->github_app->team_id,
+        ], now()->addMinutes(60));
+
+        return $state;
+    }
+
     public function checkPermissions()
     {
         try {
@@ -179,6 +210,9 @@ class Change extends Component
 
             GithubAppPermissionJob::dispatchSync($this->github_app);
             $this->github_app->refresh()->makeVisible('client_secret')->makeVisible('webhook_secret');
+            $this->syncData(false);
+            $this->name = str($this->github_app->name)->kebab();
+
             $this->dispatch('success', 'Github App permissions updated.');
         } catch (\Throwable $e) {
             // Provide better error message for unsupported key formats
@@ -211,6 +245,7 @@ class Change extends Component
             // Override name with kebab case for display
             $this->name = str($this->github_app->name)->kebab();
             $this->fqdn = $settings->fqdn;
+            $this->manifestState = $this->createGithubAppSetupState('manifest');
 
             if ($settings->public_ipv4) {
                 $this->ipv4 = 'http://'.$settings->public_ipv4.':'.config('app.port');
@@ -240,10 +275,18 @@ class Change extends Component
                 }
             }
             $this->parameters = get_route_parameters();
+            $routeName = request()->route()?->getName();
+            if ($routeName === 'source.github.permissions') {
+                $this->activeTab = 'permissions';
+            } elseif ($routeName === 'source.github.resources') {
+                $this->activeTab = 'resources';
+            } else {
+                $this->activeTab = 'general';
+            }
             if (isCloud() && ! isDev()) {
                 $this->webhook_endpoint = config('app.url');
             } else {
-                $this->webhook_endpoint = $this->fqdn ?? $this->ipv4 ?? '';
+                $this->webhook_endpoint = $this->fqdn ?? $this->ipv4 ?? $this->ipv6 ?? config('app.url') ?? '';
                 $this->is_system_wide = $this->github_app->is_system_wide;
             }
         } catch (\Throwable $e) {

app/Livewire/Team/InviteLink.php

@@ -61,7 +61,7 @@ class InviteLink extends Component
             if ($member_emails->contains($this->email)) {
                 return handleError(livewire: $this, customErrorMessage: "$this->email is already a member of ".currentTeam()->name.'.');
             }
-            $uuid = new Cuid2(32);
+            $uuid = (string) new Cuid2(32);
             $link = url('/').config('constants.invitation.link.base_url').$uuid;
             $user = User::whereEmail($this->email)->first();
 
@@ -73,7 +73,7 @@ class InviteLink extends Component
                     'password' => Hash::make($password),
                     'force_password_reset' => true,
                 ]);
-                $token = Crypt::encryptString("{$user->email}@@@$password");
+                $token = Crypt::encryptString("{$user->email}@@@{$uuid}@@@{$password}");
                 $link = route('auth.link', ['token' => $token]);
             }
             $invitation = TeamInvitation::whereEmail($this->email)->first();

app/Livewire/Team/Member.php

@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Team;
 
+use App\Actions\User\RevokeUserTeamTokens;
 use App\Enums\Role;
 use App\Models\User;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
@@ -23,7 +24,9 @@ class Member extends Component
                 || Role::from($this->getMemberRole())->gt(auth()->user()->role())) {
                 throw new \Exception('You are not authorized to perform this action.');
             }
-            $this->member->teams()->updateExistingPivot(currentTeam()->id, ['role' => Role::ADMIN->value]);
+            $teamId = currentTeam()->id;
+            $this->member->teams()->updateExistingPivot($teamId, ['role' => Role::ADMIN->value]);
+            RevokeUserTeamTokens::forUserTeam($this->member, $teamId);
             $this->dispatch('reloadWindow');
         } catch (\Exception $e) {
             $this->dispatch('error', $e->getMessage());
@@ -39,7 +42,9 @@ class Member extends Component
                 || Role::from($this->getMemberRole())->gt(auth()->user()->role())) {
                 throw new \Exception('You are not authorized to perform this action.');
             }
-            $this->member->teams()->updateExistingPivot(currentTeam()->id, ['role' => Role::OWNER->value]);
+            $teamId = currentTeam()->id;
+            $this->member->teams()->updateExistingPivot($teamId, ['role' => Role::OWNER->value]);
+            RevokeUserTeamTokens::forUserTeam($this->member, $teamId);
             $this->dispatch('reloadWindow');
         } catch (\Exception $e) {
             $this->dispatch('error', $e->getMessage());
@@ -55,7 +60,9 @@ class Member extends Component
                 || Role::from($this->getMemberRole())->gt(auth()->user()->role())) {
                 throw new \Exception('You are not authorized to perform this action.');
             }
-            $this->member->teams()->updateExistingPivot(currentTeam()->id, ['role' => Role::MEMBER->value]);
+            $teamId = currentTeam()->id;
+            $this->member->teams()->updateExistingPivot($teamId, ['role' => Role::MEMBER->value]);
+            RevokeUserTeamTokens::forUserTeam($this->member, $teamId);
             $this->dispatch('reloadWindow');
         } catch (\Exception $e) {
             $this->dispatch('error', $e->getMessage());
@@ -73,6 +80,7 @@ class Member extends Component
             }
             $teamId = currentTeam()->id;
             $this->member->teams()->detach(currentTeam());
+            RevokeUserTeamTokens::forUserTeam($this->member, $teamId);
             // Clear cache for the removed user - both old and new key formats
             Cache::forget("team:{$this->member->id}");
             Cache::forget("user:{$this->member->id}:team:{$teamId}");