fargo
c8f46341cc
ci/woodpecker/pr/ci Pipeline was successful
Implements the rev-security-01 verdict on #1320 (comment 23282): Should Fix (first, per tasking): mosaic-deploy's branch-protected-repos section shipped a working recipe for both failure modes the estate removes identity that is not the actor's (a legacy shared credential path, ~/.config/mosaic/credentials/gitea.env, which no longer exists in the credential system) and a quality gate routed around (raw curl + force_merge:true, no queue guard, no head pin). Replaced with wrapper-only merge guidance: protection blocks are signals to fix, not to bypass. Placeholder-ized estate RFC1918 topology and hostnames (six carriers, one more than the verdict's five — the original scan missed guides/): - skills/mosaic-portainer: Portainer URL, Docker host - skills/mosaic-gitea: SSH resolution target - skills/mosaic-deploy: Docker node, stack-name map (now generic example shape; estate mappings belong in skills-local overrides, which link with precedence) - tools/coolify/README: base URL - guides/INFRASTRUCTURE: cloudflare example moved from 10.0.0.5 to the RFC 5737 documentation range (192.0.2.5), the unambiguous example form Left as-is per the verdict's split: estate DNS endpoints (e.g. git.mosaicstack.dev, ci.mosaicstack.dev) pass as examples. Rescan of the whole shipped framework tree for RFC1918, estate hosts, and stack-name patterns: zero remaining hits. The gate defect itself is filed separately as #1321 (cross-referenced on #1320, comment 23285).
Coolify Tool Suite
Manage Coolify container deployment platform (projects, services, deployments, environment variables).
Prerequisites
jqandcurlinstalled- Coolify credentials in
~/.config/mosaic/credentials.json(or$MOSAIC_CREDENTIALS_FILE) - Required fields:
coolify.url,coolify.app_token
Scripts
| Script | Purpose |
|---|---|
team-list.sh |
List teams |
project-list.sh |
List projects |
service-list.sh |
List all services |
service-status.sh |
Get service details and status |
deploy.sh |
Trigger service deployment |
env-set.sh |
Set environment variable on a service |
Common Options
-f json— JSON output (default: table)-u uuid— Service UUID (for service-specific operations)-h— Show help
API Reference
- Base URL:
http://coolify.example.internal:8000 - API prefix:
/api/v1/ - Auth: Bearer token in
Authorizationheader - Rate limit: 200 requests per interval
Known Limitations
- FQDN updates on compose sub-apps not supported via API. Workaround: update directly in Coolify's PostgreSQL DB (
coolify-dbcontainer,service_applicationstable). - Compose must be base64-encoded in
docker_compose_rawfield when creating services via API. - Don't send
typewithdocker_compose_raw— API rejects payloads with both fields.
Coolify Magic Variables
Coolify reads special env vars from compose files:
SERVICE_FQDN_{NAME}_{PORT}— assigns a domain to a compose serviceSERVICE_URL_{NAME}_{PORT}— internal URL reference- Must use list-style env syntax (
- SERVICE_FQDN_API_3001), NOT dict-style.
Examples
# List all projects
~/.config/mosaic/tools/coolify/project-list.sh
# List services as JSON
~/.config/mosaic/tools/coolify/service-list.sh -f json
# Check service status
~/.config/mosaic/tools/coolify/service-status.sh -u <uuid>
# Set an env var
~/.config/mosaic/tools/coolify/env-set.sh -u <uuid> -k DATABASE_URL -v "postgres://..."
# Deploy a service
~/.config/mosaic/tools/coolify/deploy.sh -u <uuid>