chore: rebase fork onto Dokploy v0.30.10 - #9

chore: create .mcp.json for MCP server configuration

chore: automate git worktree setup

…rectory

…-valid-directory

fix(server): allow '+' and '@' in readValidDirectory path validation

…ntainer

fix(monitoring): remove legacy container and default empty cronJob

Escaping in prepareEnvironmentVariablesForFile escaped every $,
including inside a deliberate ${VAR} reference, breaking Compose's
documented .env variable interpolation. Only escape $ that isn't
part of a ${IDENTIFIER} sequence.

Fixes Dokploy#5151

…tion

…lation-5151

fix: preserve ${VAR} interpolation in .env values

Network sync compared only by name, so a network deleted and
recreated with the same name but different attributes (driver,
attachable, etc.) was reported as already in sync.

Store Docker's network Id (dockerId column) and compare it against
the live Id during sync. A name match with a dockerId mismatch is
now surfaced as a new "changed" state, with an Update action to
refresh the DB row from the live network.

Fixes Dokploy#5179

…id-5179

fix: detect network delete/recreate by Docker ID during sync

…w focus

…et-window-focus-5146

fix: unsaved organization form fields reset on window visibility change

Network chart showed values labeled as KB/s, but the underlying data
is MB totals accumulated since boot. Convert to GB and relabel as
Network Total (since Boot).

Fixes Dokploy#5115

…-5115

fix: correct network monitoring chart labels and units

…y-sudo-5007

fix: run Railpack install with sudo during remote deploy

…ose deploys

Compose deployments using a git provider (GitHub/GitLab/Gitea/Bitbucket/
custom Git) clone the repo verbatim, so composePath can point into a
subdirectory (e.g. deploy/docker-compose.yml). Docker Compose resolves
relative bind mounts (../files) against the compose file's own directory,
not against the code/ dir where file mounts are actually written, so the
mount silently binds an empty directory instead of the configured content.

Pin --project-directory to code/ when building the docker compose command
so relative mounts always resolve the same way raw deployments already do.

Fixes Dokploy#5181

fix: resolve relative bind mounts against code dir for git-based compose deploys

…invalid yaml

Attaching Basic Auth or a Redirect to an application with no domains
wrote an empty routers/services block to the app's dynamic config
file. Traefik's file provider rejects that as invalid and aborts its
watcher, blocking config updates for every other application.

Fixes Dokploy#5189

…c-config-5189

fix: don't write invalid empty traefik config for apps without domains

Fixes Dokploy#5152. updateFileMount wrote directly to the target path without
ensuring its parent directory existed, and silently swallowed errors
instead of surfacing them. If the path already existed as a directory
(e.g. Docker pre-creating a bind mount target), the write silently
failed and left an empty directory instead of the file.

…th-update-5152

fix: File Mount update fails silently on nested paths

…nt function

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

* feat: add dynamic open graph metadata for enterprise whitelabeling

…d-filter

perf(dns): filter Infomaniak records server-side when upserting

…eserve-existing-records

# Conflicts:
#	packages/server/src/utils/dns/infomaniak.ts

…xisting-records

fix(dns): match record content in upsertRecord to prevent overwriting existing records

…cret-references

fix(vault): expand Infisical secret references when listing secrets

An Infisical provider is pinned to one non-recursive `secretPath`, so reading
two folders means two providers, two machine identities and two sets of
credentials to rotate. This lets a reference name the folder instead:

    ${{vault.my-provider.external/sentry:SENTRY_DSN}}

`<path>:<KEY>` mirrors the HashiCorp client in this directory, which already
documents that exact format. A relative path resolves against the provider's
`secretPath`, a leading slash is absolute, and a ref without a colon keeps its
current meaning — the whole ref is the secret name at the provider's own path.

A dot cannot be the separator here: Infisical accepts dots inside secret names
(`A.B.C` is a valid key), so `provider.a.b.C` cannot be split unambiguously
and would silently break anyone using such a name.

Refs are grouped by resolved path so each path is listed once, and the login
happens once per batch rather than once per path.

Tests cover the bare ref, relative and absolute paths, a provider at `/`,
grouping with a single login, the error naming the path, and a malformed ref.

…reference

feat(vault): address an Infisical folder from the reference

/etc/docker/daemon.json isn't mounted into the dokploy container, only
docker.sock is, so cat-ing it always failed silently. Read the effective
config over the already-mounted socket instead.

Fixes Dokploy#5383

…s-pools

fix(server-health): detect custom default-address-pools via docker info

🚀 Release v0.30.6

feat: added missing Railpack versions
(cherry picked from commit 3269088)

[skip ci]

…ails

fix(billing): pick a plan for the trial and warn before it expires

(cherry picked from commit d7d75f7)

[skip ci]

fix(cloud): load HubSpot chat widget for startup plan users

(cherry picked from commit d0ec74f)

[skip ci]

…verflow

fix(templates): cap visible tags so the Create button stays visible

(cherry picked from commit d9fe046)

[skip ci]

chore: bump Node.js to 24.22.1 (security release)
(cherry picked from commit eb98876)

[skip ci]