Files

T

ci/woodpecker/pr/ci Pipeline was successful

Details

fix(#1320 ): placeholder-ize private-network topology, drop raw-curl force-merge recipe

Implements the rev-security-01 verdict on #1320 (comment 23282):

Should Fix (first, per tasking): mosaic-deploy's branch-protected-repos
section shipped a working recipe for both failure modes the estate removes
identity that is not the actor's (a legacy shared credential path,
~/.config/mosaic/credentials/gitea.env, which no longer exists in the
credential system) and a quality gate routed around (raw curl +
force_merge:true, no queue guard, no head pin). Replaced with wrapper-only
merge guidance: protection blocks are signals to fix, not to bypass.

Placeholder-ized estate RFC1918 topology and hostnames (six carriers, one
more than the verdict's five — the original scan missed guides/):
- skills/mosaic-portainer: Portainer URL, Docker host
- skills/mosaic-gitea: SSH resolution target
- skills/mosaic-deploy: Docker node, stack-name map (now generic example
  shape; estate mappings belong in skills-local overrides, which link with
  precedence)
- tools/coolify/README: base URL
- guides/INFRASTRUCTURE: cloudflare example moved from 10.0.0.5 to the
  RFC 5737 documentation range (192.0.2.5), the unambiguous example form

Left as-is per the verdict's split: estate DNS endpoints (e.g.
git.mosaicstack.dev, ci.mosaicstack.dev) pass as examples.

Rescan of the whole shipped framework tree for RFC1918, estate hosts, and
stack-name patterns: zero remaining hits. The gate defect itself is filed
separately as #1321 (cross-referenced on #1320, comment 23285).

2026-08-19 15:54:44 -05:00

2.2 KiB

Raw Blame History

Coolify Tool Suite

Manage Coolify container deployment platform (projects, services, deployments, environment variables).

Prerequisites

jq and curl installed
Coolify credentials in ~/.config/mosaic/credentials.json (or $MOSAIC_CREDENTIALS_FILE)
Required fields: coolify.url, coolify.app_token

Scripts

Script	Purpose
`team-list.sh`	List teams
`project-list.sh`	List projects
`service-list.sh`	List all services
`service-status.sh`	Get service details and status
`deploy.sh`	Trigger service deployment
`env-set.sh`	Set environment variable on a service

Common Options

-f json — JSON output (default: table)
-u uuid — Service UUID (for service-specific operations)
-h — Show help

API Reference

Base URL: http://coolify.example.internal:8000
API prefix: /api/v1/
Auth: Bearer token in Authorization header
Rate limit: 200 requests per interval

Known Limitations

FQDN updates on compose sub-apps not supported via API. Workaround: update directly in Coolify's PostgreSQL DB (coolify-db container, service_applications table).
Compose must be base64-encoded in docker_compose_raw field when creating services via API.
Don't send type with docker_compose_raw — API rejects payloads with both fields.

Coolify Magic Variables

Coolify reads special env vars from compose files:

SERVICE_FQDN_{NAME}_{PORT} — assigns a domain to a compose service
SERVICE_URL_{NAME}_{PORT} — internal URL reference
Must use list-style env syntax (- SERVICE_FQDN_API_3001), NOT dict-style.

Examples

# List all projects
~/.config/mosaic/tools/coolify/project-list.sh

# List services as JSON
~/.config/mosaic/tools/coolify/service-list.sh -f json

# Check service status
~/.config/mosaic/tools/coolify/service-status.sh -u <uuid>

# Set an env var
~/.config/mosaic/tools/coolify/env-set.sh -u <uuid> -k DATABASE_URL -v "postgres://..."

# Deploy a service
~/.config/mosaic/tools/coolify/deploy.sh -u <uuid>

2.2 KiB Raw Blame History