Laravel Coolify Laravel Package

Product Decisions This Supports

• Security and compliance roadmap: v3.5.0 closes several meaningful risks in the dashboard and provisioning flow, including token leakage into provisioned apps, secrets passed as Docker build args, root-run boot commands, and unvalidated dashboard parameters. This makes the package easier to defend in a security review.
• Build vs. buy: The release shows active maintenance and defensive defaults for Coolify deployments. For teams already on Coolify, this strengthens the case to standardize on the package rather than maintain custom provisioning scripts.
• Upgrade planning: This is a security-led minor release, but it carries operational migration work: rotate the operator token, remove COOLIFY_TOKEN from apps that do not use the dashboard, replace it with a minimal-scope token where needed, and regenerate Docker files.
• Production readiness: Fixes around POST /deploy, idempotent re-provisioning, APP_KEY preservation, env var PATCH behavior, and non-root container boot reduce deploy reliability risk.
• Feature and roadmap decisions: The dashboard action rate limit, log clamping, and env validation make the dashboard safer to expose internally. The removal of coolify.kick.cache_ttl simplifies configuration but requires cleanup.
• Release coordination: Because the package only generates Docker files and never rewrites existing ones, teams must explicitly run php artisan coolify:install to pick up the non-root entrypoint and build-time storage:link.

When to Consider This Package

• Consider it when: your Laravel app is deployed to self-hosted Coolify; you want CLI-assisted provisioning, Dockerfile generation, deploy hooks, and a lightweight dashboard; your team values repeatable deployment setup over bespoke scripts.
• Strong fit when: you are standardizing new Laravel services on Coolify and can adopt the newer token model from day one.
• Look elsewhere when: you are not on Coolify, need multi-cloud/PaaS orchestration, cannot absorb token rotation and Dockerfile regeneration work, or require a deployment abstraction with a more stable config/API surface.
• Upgrade caution: apps provisioned before v3.5.0 still have the operator COOLIFY_TOKEN in Coolify. Treat this release as requiring a migration checklist, not a drop-in patch. The removal of coolify.kick.cache_ttl / COOLIFY_KICK_CACHE_TTL may break configs that still reference it.

How to Pitch It (Stakeholders)

• To executives: v3.5.0 is a security-hardening release that reduces credential exposure, limits dashboard abuse, and improves deploy reliability. The upgrade is worthwhile, but it needs a short, planned migration because existing provisioned apps may still carry the old token.
• To engineering: upgrade to v3.5.0, regenerate Docker files with php artisan coolify:install, rotate the Coolify operator token, remove COOLIFY_TOKEN from apps that do not use the dashboard, and replace it with a minimal-scope token where the dashboard is needed. Validate re-provisioning, APP_KEY preservation, env updates, and deploys before rolling across environments.
• To security: the release materially improves the package’s posture: no operator token copied into apps, secrets no longer used as build args, non-root artisan boot, restricted dashboard route parameters, rate-limited actions, and bounded log requests.