fargo
c8f46341cc
ci/woodpecker/pr/ci Pipeline was successful
Implements the rev-security-01 verdict on #1320 (comment 23282): Should Fix (first, per tasking): mosaic-deploy's branch-protected-repos section shipped a working recipe for both failure modes the estate removes identity that is not the actor's (a legacy shared credential path, ~/.config/mosaic/credentials/gitea.env, which no longer exists in the credential system) and a quality gate routed around (raw curl + force_merge:true, no queue guard, no head pin). Replaced with wrapper-only merge guidance: protection blocks are signals to fix, not to bypass. Placeholder-ized estate RFC1918 topology and hostnames (six carriers, one more than the verdict's five — the original scan missed guides/): - skills/mosaic-portainer: Portainer URL, Docker host - skills/mosaic-gitea: SSH resolution target - skills/mosaic-deploy: Docker node, stack-name map (now generic example shape; estate mappings belong in skills-local overrides, which link with precedence) - tools/coolify/README: base URL - guides/INFRASTRUCTURE: cloudflare example moved from 10.0.0.5 to the RFC 5737 documentation range (192.0.2.5), the unambiguous example form Left as-is per the verdict's split: estate DNS endpoints (e.g. git.mosaicstack.dev, ci.mosaicstack.dev) pass as examples. Rescan of the whole shipped framework tree for RFC1918, estate hosts, and stack-name patterns: zero remaining hits. The gate defect itself is filed separately as #1321 (cross-referenced on #1320, comment 23285).
67 lines
2.2 KiB
Markdown
67 lines
2.2 KiB
Markdown
# Coolify Tool Suite
|
|
|
|
Manage Coolify container deployment platform (projects, services, deployments, environment variables).
|
|
|
|
## Prerequisites
|
|
|
|
- `jq` and `curl` installed
|
|
- Coolify credentials in `~/.config/mosaic/credentials.json` (or `$MOSAIC_CREDENTIALS_FILE`)
|
|
- Required fields: `coolify.url`, `coolify.app_token`
|
|
|
|
## Scripts
|
|
|
|
| Script | Purpose |
|
|
| ------------------- | ------------------------------------- |
|
|
| `team-list.sh` | List teams |
|
|
| `project-list.sh` | List projects |
|
|
| `service-list.sh` | List all services |
|
|
| `service-status.sh` | Get service details and status |
|
|
| `deploy.sh` | Trigger service deployment |
|
|
| `env-set.sh` | Set environment variable on a service |
|
|
|
|
## Common Options
|
|
|
|
- `-f json` — JSON output (default: table)
|
|
- `-u uuid` — Service UUID (for service-specific operations)
|
|
- `-h` — Show help
|
|
|
|
## API Reference
|
|
|
|
- Base URL: `http://coolify.example.internal:8000`
|
|
- API prefix: `/api/v1/`
|
|
- Auth: Bearer token in `Authorization` header
|
|
- Rate limit: 200 requests per interval
|
|
|
|
## Known Limitations
|
|
|
|
- **FQDN updates on compose sub-apps not supported via API.** Workaround: update directly in Coolify's PostgreSQL DB (`coolify-db` container, `service_applications` table).
|
|
- **Compose must be base64-encoded** in `docker_compose_raw` field when creating services via API.
|
|
- **Don't send `type` with `docker_compose_raw`** — API rejects payloads with both fields.
|
|
|
|
## Coolify Magic Variables
|
|
|
|
Coolify reads special env vars from compose files:
|
|
|
|
- `SERVICE_FQDN_{NAME}_{PORT}` — assigns a domain to a compose service
|
|
- `SERVICE_URL_{NAME}_{PORT}` — internal URL reference
|
|
- Must use list-style env syntax (`- SERVICE_FQDN_API_3001`), NOT dict-style.
|
|
|
|
## Examples
|
|
|
|
```bash
|
|
# List all projects
|
|
~/.config/mosaic/tools/coolify/project-list.sh
|
|
|
|
# List services as JSON
|
|
~/.config/mosaic/tools/coolify/service-list.sh -f json
|
|
|
|
# Check service status
|
|
~/.config/mosaic/tools/coolify/service-status.sh -u <uuid>
|
|
|
|
# Set an env var
|
|
~/.config/mosaic/tools/coolify/env-set.sh -u <uuid> -k DATABASE_URL -v "postgres://..."
|
|
|
|
# Deploy a service
|
|
~/.config/mosaic/tools/coolify/deploy.sh -u <uuid>
|
|
```
|