fix(reverb): align ports, host validation, and dev instance tooling

Author: andrasbacsai

.github/workflows/coolify-next-build.yml

@@ -6,11 +6,8 @@ on:
     paths-ignore:
       - .github/workflows/coolify-helper.yml
       - .github/workflows/coolify-helper-next.yml
-      - .github/workflows/coolify-realtime.yml
-      - .github/workflows/coolify-realtime-next.yml
       - .github/workflows/pr-quality.yaml
       - docker/coolify-helper/Dockerfile
-      - docker/coolify-realtime/Dockerfile
       - docker/testing-host/Dockerfile
       - templates/**
       - CHANGELOG.md

app/Http/Middleware/TrustHosts.php

@@ -14,16 +14,13 @@ class TrustHosts extends Middleware
      * Handle the incoming request.
      *
      * Skip host validation for certain routes:
-     * - Terminal auth routes (called by realtime container)
      * - API routes (use token-based authentication, not host validation)
      * - Webhook endpoints (use cryptographic signature validation)
      */
     public function handle(Request $request, $next)
     {
         // Skip host validation for these routes
         if ($request->is(
-            'terminal/auth',
-            'terminal/auth/ips',
             'api/*',
             'webhooks/*'
         )) {

docker-compose.prod.yml

@@ -25,7 +25,7 @@ services:
       - /data/coolify/source/.env
     ports:
       - "${APP_PORT:-8000}:8080"
-      - "${SOKETI_PORT:-6001}:6001"
+      - "${REVERB_PORT:-${SOKETI_PORT:-6001}}:6001"
       - "${TERMINAL_PORT:-6002}:6002"
     expose:
       - "${APP_PORT:-8000}"

docker-compose.windows.yml

@@ -51,7 +51,7 @@ services:
       - IS_WINDOWS_DOCKER_DESKTOP=true
     ports:
       - "${APP_PORT:-8000}:8080"
-      - "${SOKETI_PORT:-6001}:6001"
+      - "${REVERB_PORT:-${SOKETI_PORT:-6001}}:6001"
       - "${TERMINAL_PORT:-6002}:6002"
     expose:
       - "${APP_PORT:-8000}"

other/nightly/docker-compose.prod.yml

@@ -25,7 +25,7 @@ services:
       - /data/coolify/source/.env
     ports:
       - "${APP_PORT:-8000}:8080"
-      - "${SOKETI_PORT:-6001}:6001"
+      - "${REVERB_PORT:-${SOKETI_PORT:-6001}}:6001"
       - "${TERMINAL_PORT:-6002}:6002"
     expose:
       - "${APP_PORT:-8000}"

other/nightly/docker-compose.windows.yml

@@ -50,7 +50,7 @@ services:
       - IS_WINDOWS_DOCKER_DESKTOP=true
     ports:
       - "${APP_PORT:-8000}:8080"
-      - "${SOKETI_PORT:-6001}:6001"
+      - "${REVERB_PORT:-${SOKETI_PORT:-6001}}:6001"
       - "${TERMINAL_PORT:-6002}:6002"
     expose:
       - "${APP_PORT:-8000}"

scripts/dev-instances

@@ -265,18 +265,19 @@ cmd_urls() {
     parse_args "$@"
     names=("${NAMES[@]}")
   fi
-  printf '%-6s %-28s %-8s %-8s %-12s\n' "NAME" "URL" "DB" "REDIS" "SOKETI"
+  printf '%-6s %-28s %-8s %-8s %-12s %-12s\n' "NAME" "URL" "DB" "REDIS" "REVERB" "TERMINAL"
   local name envf
   for name in "${names[@]}"; do
     name="$(normalize_name "$name")"
     ensure_env "$name" >/dev/null
     envf="$(env_file "$name")"
-    printf '%-6s %-28s %-8s %-8s %-12s\n' \
+    printf '%-6s %-28s %-8s %-8s %-12s %-12s\n' \
       "$name" \
       "$(grep -E '^APP_URL=' "$envf" | cut -d= -f2-)" \
       "$(grep -E '^FORWARD_DB_PORT=' "$envf" | cut -d= -f2-)" \
       "$(grep -E '^FORWARD_REDIS_PORT=' "$envf" | cut -d= -f2-)" \
-      "$(grep -E '^FORWARD_PUSHER_PORT=' "$envf" | cut -d= -f2-)"
+      "$(grep -E '^FORWARD_PUSHER_PORT=' "$envf" | cut -d= -f2-)" \
+      "$(grep -E '^FORWARD_TERMINAL_PORT=' "$envf" | cut -d= -f2-)"
   done
 }
 

tests/Feature/ReverbAndTerminalPackagingTest.php

@@ -129,7 +129,7 @@
 
 it('does not use the browser websocket port as the Docker host port', function (string $composeFile) {
     expect(file_get_contents(base_path($composeFile)))
-        ->toContain('"${SOKETI_PORT:-6001}:6001"')
+        ->toContain('"${REVERB_PORT:-${SOKETI_PORT:-6001}}:6001"')
         ->not->toContain('"${PUSHER_PORT:-6001}:6001"');
 })->with([
     'production compose' => ['docker-compose.prod.yml'],
@@ -166,8 +166,15 @@
         ->and(is_dir(base_path('docker/coolify-realtime')))->toBeFalse()
         ->and(file_exists(base_path('.github/workflows/coolify-realtime.yml')))->toBeFalse()
         ->and(file_exists(base_path('.github/workflows/coolify-realtime-next.yml')))->toBeFalse()
+        ->and(file_get_contents(base_path('.github/workflows/coolify-next-build.yml')))->not->toContain('coolify-realtime')
         ->and($productionInstallScript)->not->toContain('LATEST_REALTIME_VERSION')
         ->not->toContain('| Realtime')
         ->and($nightlyInstallScript)->not->toContain('LATEST_REALTIME_VERSION')
         ->not->toContain('| Realtime');
 });
+
+it('uses current Reverb and terminal names in development tooling', function () {
+    expect(file_get_contents(base_path('scripts/dev-instances')))
+        ->toContain('"REVERB" "TERMINAL"')
+        ->not->toContain('"SOKETI"');
+});

tests/Feature/Security/TrustHostsMiddlewareTest.php

@@ -229,24 +229,26 @@
     expect($hosts2)->not->toBeEmpty();
 });
 
-it('skips host validation for terminal auth routes', function () {
-    // These routes should be accessible with any Host header (for internal container communication)
+it('allows terminal auth requests from the local terminal server', function () {
     $response = $this->postJson('/terminal/auth', [], [
-        'Host' => 'coolify:8080',  // Internal Docker host
+        'Host' => '127.0.0.1:8080',
     ]);
 
-    // Should not get 400 Bad Host (might get 401 Unauthorized instead)
     expect($response->status())->not->toBe(400);
 });
 
-it('skips host validation for terminal auth ips route', function () {
-    // These routes should be accessible with any Host header (for internal container communication)
+it('enforces host validation for terminal auth routes', function () {
+    InstanceSettings::updateOrCreate(
+        ['id' => 0],
+        ['fqdn' => 'https://coolify.example.com']
+    );
+    Cache::forget('instance_settings_fqdn_host');
+
     $response = $this->postJson('/terminal/auth/ips', [], [
-        'Host' => 'soketi:6002',  // Another internal Docker host
+        'Host' => 'evil.com',
     ]);
 
-    // Should not get 400 Bad Host (might get 401 Unauthorized instead)
-    expect($response->status())->not->toBe(400);
+    expect($response->status())->toBe(400);
 });
 
 it('still enforces host validation for non-terminal routes', function () {