[Bl4ckBl1zZ]

What is this PR about?

This PR integrates Dokploy upstream canary through eaffeba4a (2026-10-26). The fork last synced at 3efa90ea0 in #45, so the range is 3efa90ea0..eaffeba4a: 11 commits across 8 upstream changes. All of them are fixes; there are no new features.

Upstream changes:

• Self-update: settings.updateServer now fails with a clear error when Dokploy isn't running as a Docker Swarm service, instead of silently doing nothing (fix(server): fail fast when update is triggered without a dokploy docker resource Dokploy/dokploy#5676). The UI toast now shows the server's error message.
• Encryption: env vars encrypted while the install still used the hardcoded legacy auth secret stay decryptable after switching to a real BETTER_AUTH_SECRET (decrypt-only fallback key). Deploys now fail with a clear error when env vars can't be decrypted, instead of deploying with them silently dropped (fix(encryption): keep env vars readable after leaving the legacy auth secret Dokploy/dokploy#5779).
• Compose: compose.delete defaults deleteVolumes to false, so deleting from the project page no longer fails validation (fix(compose): default deleteVolumes to false on compose.delete Dokploy/dokploy#5666).
• Docker webhook: untagged GHCR registry_package events (per-platform manifests, attestations) are skipped with a 200 instead of each one triggering a deployment (fix(deploy): skip untagged GHCR package events in docker webhook Dokploy/dokploy#5682).
• Logs: a readLogs search with no matches returns an empty result instead of a 500, and the search now runs over the whole log before tail is applied (fix(logs): return empty result when readLogs search has no matches Dokploy/dokploy#5667).
• UI: cluster settings load the saved replicas and registry and no longer reset on unrelated data changes (fix(cluster): load saved replicas and registry in cluster settings Dokploy/dokploy#5778), and the env editor keeps saved values after save (fix(environment): keep saved env in the editor after save Dokploy/dokploy#5777).

Integration review

The merge had no conflicts. Overlap with fork-only code:

• routers/settings.ts updateServer: upstream's new getDockerResourceType("dokploy") guard lands above the fork's update path. The fork still calls reloadDockerResource("dokploy", undefined, data.latestVersion), which keeps the running image's repository (GHCR fork namespace) and the start-first Swarm update. The fork runs as the dokploy Swarm service, so the guard passes.
• utils/docker/utils.ts: the new undecryptable-env check sits after the fork's vault-reference check in prepareEnvironmentVariables; both are kept.
• services/docker.ts: the log-search rewrite uses local exec, which the fork doesn't change.

Fork behavior checked:

• Removed license gating: no hasValidLicense, isEnterpriseCloud or licenseKey in non-test code.
• Untouched areas: the range does not touch Cloudflare Tunnel, Tailscale, Halifax CI, deployment isolation, GHCR publish/release, versioning or remoteStream.ts; the pipeBetweenServers unpipe/resume fix is still present.
• Lint: two noUnusedTemplateLiteral errors inherited from upstream's services/docker.ts, fixed in 3840dfec1.

CLAUDE.md Product Overview is unchanged: this range adds no features.

Migrations, dependencies, environment

• Migrations: none. migration:generate reported "No schema changes" on both runs (the compose.ts change is a Zod default only).
• Dependencies: none; pnpm install --frozen-lockfile passes.
• Environment: no new variables.
• OpenAPI: regenerated (654 endpoints); compose.delete deleteVolumes becomes optional.

Verification (local)

• pnpm install --frozen-lockfile: pass
• Migration generation twice: pass, "No schema changes" both times
• generate:openapi: pass (654 endpoints)
• pnpm run format-and-lint: pass (0 errors, after 3840dfec1)
• Typecheck (pnpm run typecheck --checkers 2) for packages/server, apps/dokploy, apps/api and apps/schedules: pass
• Vitest: 1571 passed, 11 skipped, 4 failed before the test fix below. The 4 are the application.real.test.ts REAL deployment tests, which need docker build / nixpacks build; this machine has neither binary. These are infra-only failures, the same as in chore(sync): integrate Dokploy canary through 5df820a #38–chore(sync): integrate Dokploy canary through 3efa90e #45.
• Test fix: upstream's new update-server.test.ts expected upstream's inline spawnAsync("docker", ["service", "update", …]). The fork updates through reloadDockerResource("dokploy", undefined, latestVersion) (image-repo preservation), so the test failed with the shared mock. I changed the test to assert the fork's call instead (9699177e8); the fork's code is unchanged and all 4 tests in the file pass.
• Production build with an ephemeral BETTER_AUTH_SECRET (never printed or stored): pass

Hosted checks

None ran. GitHub Actions created no runs for this PR, so it stays a draft and is not auto-merged: the rule requires every hosted check to pass. Mergeability against main is clean.

This is the same outage as #45: no workflow in this repo has run since Release on 2026-10-18 21:21 UTC, and the push of #45's merge (2b7355732) to main didn't start Release either.

• Repo Actions are enabled (allowed_actions=all), and the "Pull Request", "Release" and GHCR workflows are all active.
• I tried waiting 12 minutes after opened, closing and reopening the PR, and pushing an empty commit (543529622), polling 5 minutes after each. Every attempt gave 0 runs.

Next step: check the repo's Actions tab and the account's Actions/billing status. Once runs are created again, pushing to this branch (or the next scheduled sync) will run the checks.

Risk / rollout / rollback

Risk is low: small bug fixes, no migrations or dependency changes.

• Rollout: deploy as usual. No database backup is needed for this PR itself (but see chore(sync): integrate Dokploy canary through 3efa90e #45's migration 0185 if it hasn't been deployed yet).
• Rollback: roll back the application image.

Checklist

• You created a dedicated branch based on the canary branch. (This branch is based on the fork's main and integrates upstream canary.)
• You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• You have tested this PR in your local instance. (Automated checks and a production build ran locally; no live Dokploy instance was changed.)

Issues related (if applicable)

Not applicable for this upstream integration PR.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: bbf8349b-db71-4d33-9710-14963f84cfbd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}