GET /services/:id/env-check (read scope) reports, without exposing values:
- unresolved: ${{service.KEY}} refs that don't match a sibling service/env
- empty: variables with blank values
- unreadable: secrets whose ciphertext fails decryption (key rotation)
install.sh now generates SECRETS_KEY explicitly (was falling back to
JWT_SECRET — a rotation would orphan ciphertext). .env.example documents it.
Surfaces: CLI `services env-check`, MCP containr_services_env_check
(90 tools), OpenAPI path, and a warning banner in the service Variables
panel listing each issue.
Verified live: injected a bogus ${{nosuchservice.PORT}} var plus an
unreadable ciphertext row; the endpoint flagged both, ok=false.
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- First registered account becomes admin (users.is_admin, backfilled
to earliest account); better-auth mirror path does the same
- Public registration closes after bootstrap; admin can reopen it via
GET/PUT /api/v1/settings (admin-gated) or SIGNUP_ENABLED env
- In-app settings override env vars; secrets stored in app_settings,
token values never returned by the API
- Saving a Cloudflare Tunnel token pulls and runs a managed
cloudflared sidecar on the backend's networks; clearing removes it;
startup restores it from saved settings
- group_add DOCKER_GID grants the non-root backend user Docker socket
access; install.sh probes the in-container socket gid
- Settings page gains an owner-only Platform section (registration
toggle, tunnel token, link to Cloudflare dashboard); sign-up page
stays reachable while registration is open
- OpenAPI spec + generated types updated; manual user creation now
requires admin
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- Replace redis:7-alpine with Dragonfly (Redis-protocol compatible; go-redis
client unchanged) in root, infra, and backend-dev compose files. Bounded
defaults --proactor_threads/--maxmemory so it boots on small VPSs.
- Frontend now defaults to same-origin API calls; nginx proxies /api/* to the
backend (WebSocket-aware, docker DNS resolver for upstream re-resolution).
Removes the baked localhost:8082 that broke installs reached by IP/domain.
- /auth/bootstrap returns configured OAuth providers; the UI hides
GitHub/Google buttons unless real credentials exist. Self-hosted stays
email/password only - OAuth reserved for a future managed offering.
- Sidecar ignores PLACEHOLDER_* OAuth credentials and trusts same-host
origins dynamically (Origin host == request Host) so remote installs pass
origin checks without config; cross-origin requests still rejected.
- install.sh writes ENVIRONMENT=production; COOKIE_SECURE=false in
production is now a startup warning instead of fatal (plain-HTTP installs).
- Bootstrap failure surfaces an error notice instead of silently rendering
the sign-in page.
Authored By: TDvorak <[email protected]>
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- install.sh works outside a checkout: installs into CONTAINR_DIR
(default ./containr), downloads docker-compose.yml + .env.example from
the repo, generates secrets, pulls published images
- CONTAINR_REF selects the git ref for downloads; CONTAINR_BUILD=1 or a
failed pull fetches the source tarball and builds locally
- env-var overrides (HTTP_PORT/API_PORT/...) are persisted into .env;
health-wait ports resolve env -> .env -> defaults
- drop fixed `name: containr` from root compose so installs in different
directories get distinct project names
- README: curl one-liner is the primary install path
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
- docker-compose.yml now references ghcr.io/dvorinka/containr-*:latest with
pull_policy: missing, so `docker compose up` pulls published images by
default; CONTAINR_VERSION pins a release tag, build config retained for
source builds
- install.sh pulls instead of always building (CONTAINR_BUILD=1 or a failed
pull falls back to a source build)
- README gains a Screenshots section (dashboard, canvas, service detail,
databases) captured from a live local stack, plus updated install docs
Generated with [Devin](https://devin.ai)
Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
