Merge d27104659a into 03a8621516

app/Actions/Server/StartLogDrain.php

@@ -35,96 +35,100 @@ class StartLogDrain
                     throw new \Exception('New Relic log drain is not enabled.');
                 }
                 $config = base64_encode("
-[SERVICE]
-    Flush     5
-    Daemon    off
-    Tag container_logs
-    Log_Level debug
-    Parsers_File  parsers.conf
-[INPUT]
-    Name              forward
-    Buffer_Chunk_Size 1M
-    Buffer_Max_Size   6M
-[FILTER]
-    Name grep
-    Match *
-    Exclude log 127.0.0.1
-[FILTER]
-    Name                modify
-    Match               *
-    Set                 coolify.server_name {$server->name}
-    Rename              COOLIFY_APP_NAME coolify.app_name
-    Rename              COOLIFY_PROJECT_NAME coolify.project_name
-    Rename              COOLIFY_SERVER_IP coolify.server_ip
-    Rename              COOLIFY_ENVIRONMENT_NAME coolify.environment_name
-[OUTPUT]
-    Name nrlogs
-    Match *
-    license_key \${LICENSE_KEY}
-    # https://log-api.eu.newrelic.com/log/v1 - EU
-    # https://log-api.newrelic.com/log/v1 - US
-    base_uri \${BASE_URI}
+service:
+    flush: 5
+    daemon: off
+    log_level: debug
+    parsers_file: parsers.yml
+pipeline:
+    inputs:
+        - name: forward
+          buffer_chunk_size: 1M
+          buffer_max_size: 6M
+          tag: container_logs
+    filters:
+        - name: grep
+          match: '*'
+          exclude: log 127.0.0.1
+        - name: modify
+          match: '*'
+          Add:
+            - coolify.server_name {$server->name}
+          Rename:
+            - coolify.name coolify.app_name
+            - coolify.projectName coolify.project_name
+            - coolify.environmentName coolify.environment_name
+    outputs:
+        - name: nrlogs
+          match: '*'
+          license_key: \${LICENSE_KEY}
+          # https://log-api.eu.newrelic.com/log/v1 - EU
+          # https://log-api.newrelic.com/log/v1 - US
+          base_uri: \${BASE_URI}
 ");
             } elseif ($type === 'highlight') {
                 if (! $server->settings->is_logdrain_highlight_enabled) {
                     throw new \Exception('Highlight log drain is not enabled.');
                 }
                 $config = base64_encode('
-[SERVICE]
-    Flush     5
-    Daemon    off
-    Log_Level debug
-    Parsers_File  parsers.conf
-[INPUT]
-    Name              forward
-    tag               ${HIGHLIGHT_PROJECT_ID}
-    Buffer_Chunk_Size 1M
-    Buffer_Max_Size   6M
-[OUTPUT]
-    Name                forward
-    Match               *
-    Host                otel.highlight.io
-    Port                24224
+service:
+    flush: 5
+    daemon: off
+    log_level: debug
+    parsers_file: parsers.yml
+pipeline:
+    inputs:
+        - name: forward
+          buffer_chunk_size: 1M
+          buffer_max_size: 6M
+          tag: ${HIGHLIGHT_PROJECT_ID}
+    outputs:
+        - name: forward
+          match: '*'
+          host: otel.highlight.io
+          port: 24224
 ');
             } elseif ($type === 'axiom') {
                 if (! $server->settings->is_logdrain_axiom_enabled) {
                     throw new \Exception('Axiom log drain is not enabled.');
                 }
                 $config = base64_encode("
-[SERVICE]
-    Flush     5
-    Daemon    off
-    Log_Level debug
-    Parsers_File  parsers.conf
-[INPUT]
-    Name              forward
-    Buffer_Chunk_Size 1M
-    Buffer_Max_Size   6M
-[FILTER]
-    Name grep
-    Match *
-    Exclude log 127.0.0.1
-[FILTER]
-    Name                modify
-    Match               *
-    Set                 coolify.server_name {$server->name}
-    Rename              COOLIFY_APP_NAME coolify.app_name
-    Rename              COOLIFY_PROJECT_NAME coolify.project_name
-    Rename              COOLIFY_SERVER_IP coolify.server_ip
-    Rename              COOLIFY_ENVIRONMENT_NAME coolify.environment_name
-[OUTPUT]
-    Name            http
-    Match           *
-    Host            api.axiom.co
-    Port            443
-    URI             /v1/datasets/\${AXIOM_DATASET_NAME}/ingest
-    # Authorization Bearer should be an API token
-    Header Authorization Bearer \${AXIOM_API_KEY}
-    compress gzip
-    format json
-    json_date_key _time
-    json_date_format iso8601
-    tls On
+service:
+    flush: 5
+    daemon: off
+    log_level: debug
+    parsers_file: parsers.yml
+pipeline:
+    inputs:
+        - name: forward
+          buffer_chunk_size: 1M
+          buffer_max_size: 6M
+    filters:
+        - name: grep
+          match: '*'
+          exclude: log 127.0.0.1
+        - name: modify
+          match: '*'
+          Add:
+            - coolify.server_name {$server->name}
+          Rename:
+            - coolify.name coolify.app_name
+            - coolify.projectName coolify.project_name
+            - coolify.environmentName coolify.environment_name
+    outputs:
+        - name: http
+          match: '*'
+          host: api.axiom.co
+          port: 443
+          uri: /v1/datasets/\${AXIOM_DATASET_NAME}/ingest
+          header:
+            # Authorization Bearer should be an API token
+            - Authorization Bearer \${AXIOM_API_KEY}
+          compress: gzip
+          format: json
+          json_date_key _time
+          json_date_format: iso8601
+          tls: on
 ");
             } elseif ($type === 'custom') {
                 if (! $server->settings->is_logdrain_custom_enabled) {
@@ -137,23 +141,23 @@ class StartLogDrain
             }
             if ($type !== 'custom') {
                 $parsers = base64_encode("
-[PARSER]
-    Name        empty_line_skipper
-    Format      regex
-    Regex       /^(?!\s*$).+/
+parsers:
+    - name: empty_line_skipper
+      format: regex
+      regex: '/^(?!\s*$).+/'
 ");
             }
             $compose = base64_encode('
 services:
   coolify-log-drain:
-    image: cr.fluentbit.io/fluent/fluent-bit:2.0
+    image: cr.fluentbit.io/fluent/fluent-bit:4.0
     container_name: coolify-log-drain
-    command: -c /fluent-bit.conf
+    command: -c /fluent-bit.yml
     env_file:
       - .env
     volumes:
-      - ./fluent-bit.conf:/fluent-bit.conf
-      - ./parsers.conf:/parsers.conf
+      - ./fluent-bit.yml:/fluent-bit.yml
+      - ./parsers.yml:/parsers.yml
     ports:
       - 127.0.0.1:24224:24224
     labels:
@@ -164,7 +168,7 @@ services:
 This log drain is based on [Fluent Bit](https://fluentbit.io/) and New Relic Log Forwarder.
 
 Files:
-- `fluent-bit.conf` - configuration file for Fluent Bit
+- `fluent-bit.yml` - configuration file for Fluent Bit
 - `docker-compose.yml` - docker-compose file to run Fluent Bit
 - `.env` - environment variables for Fluent Bit
 ');
@@ -173,8 +177,8 @@ Files:
             $base_path = config('constants.coolify.base_config_path');
 
             $config_path = $base_path.'/log-drains';
-            $fluent_bit_config = $config_path.'/fluent-bit.conf';
-            $parsers_config = $config_path.'/parsers.conf';
+            $fluent_bit_config = $config_path.'/fluent-bit.yml';
+            $parsers_config = $config_path.'/parsers.yml';
             $compose_path = $config_path.'/docker-compose.yml';
             $readme_path = $config_path.'/README.md';
             $command = [

app/Jobs/ApplicationDeploymentJob.php

@@ -2756,28 +2756,46 @@ class ApplicationDeploymentJob implements ShouldBeEncrypted, ShouldQueue
     private function generate_healthcheck_commands()
     {
         if (! $this->application->health_check_port) {
-            $health_check_port = $this->application->ports_exposes_array[0];
+            $health_check_port = (int) $this->application->ports_exposes_array[0];
         } else {
-            $health_check_port = $this->application->health_check_port;
+            $health_check_port = (int) $this->application->health_check_port;
         }
         if ($this->application->settings->is_static || $this->application->build_pack === 'static') {
             $health_check_port = 80;
         }
-        if ($this->application->health_check_path) {
-            $this->full_healthcheck_url = "{$this->application->health_check_method}: {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}{$this->application->health_check_path}";
-            $generated_healthchecks_commands = [
-                "curl -s -X {$this->application->health_check_method} -f {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}{$this->application->health_check_path} > /dev/null || wget -q -O- {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}{$this->application->health_check_path} > /dev/null || exit 1",
-            ];
+
+        $method = $this->sanitizeHealthCheckValue($this->application->health_check_method, '/^[A-Z]+$/', 'GET');
+        $scheme = $this->sanitizeHealthCheckValue($this->application->health_check_scheme, '/^https?$/', 'http');
+        $host = $this->sanitizeHealthCheckValue($this->application->health_check_host, '/^[a-zA-Z0-9.\-_]+$/', 'localhost');
+        $path = $this->application->health_check_path
+            ? $this->sanitizeHealthCheckValue($this->application->health_check_path, '#^[a-zA-Z0-9/\-_.~%]+$#', '/')
+            : null;
+
+        $url = escapeshellarg("{$scheme}://{$host}:{$health_check_port}".($path ?? '/'));
+        $method = escapeshellarg($method);
+
+        if ($path) {
+            $this->full_healthcheck_url = "{$this->application->health_check_method}: {$scheme}://{$host}:{$health_check_port}{$path}";
         } else {
-            $this->full_healthcheck_url = "{$this->application->health_check_method}: {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}/";
-            $generated_healthchecks_commands = [
-                "curl -s -X {$this->application->health_check_method} -f {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}/ > /dev/null || wget -q -O- {$this->application->health_check_scheme}://{$this->application->health_check_host}:{$health_check_port}/ > /dev/null || exit 1",
-            ];
+            $this->full_healthcheck_url = "{$this->application->health_check_method}: {$scheme}://{$host}:{$health_check_port}/";
         }
 
+        $generated_healthchecks_commands = [
+            "curl -s -X {$method} -f {$url} > /dev/null || wget -q -O- {$url} > /dev/null || exit 1",
+        ];
+
         return implode(' ', $generated_healthchecks_commands);
     }
 
+    private function sanitizeHealthCheckValue(string $value, string $pattern, string $default): string
+    {
+        if (preg_match($pattern, $value)) {
+            return $value;
+        }
+
+        return $default;
+    }
+
     private function pull_latest_image($image)
     {
         $this->application_deployment_queue->addLogEntry("Pulling latest image ($image) from the registry.");

app/Livewire/Project/Shared/HealthChecks.php

@@ -16,19 +16,19 @@ class HealthChecks extends Component
     #[Validate(['boolean'])]
     public bool $healthCheckEnabled = false;
 
-    #[Validate(['string'])]
+    #[Validate(['required', 'string', 'in:GET,HEAD,POST,OPTIONS'])]
     public string $healthCheckMethod;
 
-    #[Validate(['string'])]
+    #[Validate(['required', 'string', 'in:http,https'])]
     public string $healthCheckScheme;
 
-    #[Validate(['string'])]
+    #[Validate(['required', 'string', 'regex:/^[a-zA-Z0-9.\-_]+$/'])]
     public string $healthCheckHost;
 
-    #[Validate(['nullable', 'string'])]
+    #[Validate(['nullable', 'integer', 'min:1', 'max:65535'])]
     public ?string $healthCheckPort = null;
 
-    #[Validate(['string'])]
+    #[Validate(['required', 'string', 'regex:#^[a-zA-Z0-9/\-_.~%]+$#'])]
     public string $healthCheckPath;
 
     #[Validate(['integer'])]
@@ -54,12 +54,12 @@ class HealthChecks extends Component
 
     protected $rules = [
         'healthCheckEnabled' => 'boolean',
-        'healthCheckPath' => 'string',
-        'healthCheckPort' => 'nullable|string',
-        'healthCheckHost' => 'string',
-        'healthCheckMethod' => 'string',
+        'healthCheckPath' => ['required', 'string', 'regex:#^[a-zA-Z0-9/\-_.~%]+$#'],
+        'healthCheckPort' => 'nullable|integer|min:1|max:65535',
+        'healthCheckHost' => ['required', 'string', 'regex:/^[a-zA-Z0-9.\-_]+$/'],
+        'healthCheckMethod' => 'required|string|in:GET,HEAD,POST,OPTIONS',
         'healthCheckReturnCode' => 'integer',
-        'healthCheckScheme' => 'string',
+        'healthCheckScheme' => 'required|string|in:http,https',
         'healthCheckResponseText' => 'nullable|string',
         'healthCheckInterval' => 'integer|min:1',
         'healthCheckTimeout' => 'integer|min:1',

bootstrap/helpers/api.php

@@ -104,12 +104,12 @@ function sharedDataApplications()
         'base_directory' => 'string|nullable',
         'publish_directory' => 'string|nullable',
         'health_check_enabled' => 'boolean',
-        'health_check_path' => 'string',
-        'health_check_port' => 'string|nullable',
-        'health_check_host' => 'string',
-        'health_check_method' => 'string',
+        'health_check_path' => ['string', 'regex:#^[a-zA-Z0-9/\-_.~%]+$#'],
+        'health_check_port' => 'integer|nullable|min:1|max:65535',
+        'health_check_host' => ['string', 'regex:/^[a-zA-Z0-9.\-_]+$/'],
+        'health_check_method' => 'string|in:GET,HEAD,POST,OPTIONS',
         'health_check_return_code' => 'numeric',
-        'health_check_scheme' => 'string',
+        'health_check_scheme' => 'string|in:http,https',
         'health_check_response_text' => 'string|nullable',
         'health_check_interval' => 'numeric',
         'health_check_timeout' => 'numeric',

bootstrap/helpers/shared.php

@@ -2830,8 +2830,8 @@ function generate_fluentd_configuration(): array
             'fluentd-address' => 'tcp://127.0.0.1:24224',
             'fluentd-async' => 'true',
             'fluentd-sub-second-precision' => 'true',
-            // env vars are used in the LogDrain configurations
-            'env' => 'COOLIFY_APP_NAME,COOLIFY_PROJECT_NAME,COOLIFY_SERVER_IP,COOLIFY_ENVIRONMENT_NAME',
+            // labels are used in the LogDrain configurations
+            'labels' => 'coolify.name,coolify.projectName,coolify.environmentName',
         ],
     ];
 }

routes/api.php

@@ -55,7 +55,7 @@ Route::group([
     Route::post('/projects/{uuid}/environments', [ProjectController::class, 'create_environment'])->middleware(['api.ability:write']);
     Route::delete('/projects/{uuid}/environments/{environment_name_or_uuid}', [ProjectController::class, 'delete_environment'])->middleware(['api.ability:write']);
 
-    Route::post('/projects', [ProjectController::class, 'create_project'])->middleware(['api.ability:read']);
+    Route::post('/projects', [ProjectController::class, 'create_project'])->middleware(['api.ability:write']);
     Route::patch('/projects/{uuid}', [ProjectController::class, 'update_project'])->middleware(['api.ability:write']);
     Route::delete('/projects/{uuid}', [ProjectController::class, 'delete_project'])->middleware(['api.ability:write']);
 
@@ -86,7 +86,7 @@ Route::group([
 
     Route::get('/servers/{uuid}/validate', [ServersController::class, 'validate_server'])->middleware(['api.ability:read']);
 
-    Route::post('/servers', [ServersController::class, 'create_server'])->middleware(['api.ability:read']);
+    Route::post('/servers', [ServersController::class, 'create_server'])->middleware(['api.ability:write']);
     Route::patch('/servers/{uuid}', [ServersController::class, 'update_server'])->middleware(['api.ability:write']);
     Route::delete('/servers/{uuid}', [ServersController::class, 'delete_server'])->middleware(['api.ability:write']);
 

tests/Feature/ApiTokenPermissionTest.php

@@ -0,0 +1,75 @@
+<?php
+
+use App\Models\Team;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+
+uses(RefreshDatabase::class);
+
+beforeEach(function () {
+    $this->team = Team::factory()->create();
+    $this->user = User::factory()->create();
+    $this->team->members()->attach($this->user->id, ['role' => 'owner']);
+
+    session(['currentTeam' => $this->team]);
+});
+
+describe('POST /api/v1/projects', function () {
+    test('read-only token cannot create a project', function () {
+        $token = $this->user->createToken('read-only', ['read']);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$token->plainTextToken,
+            'Content-Type' => 'application/json',
+        ])->postJson('/api/v1/projects', [
+            'name' => 'Test Project',
+        ]);
+
+        $response->assertStatus(403);
+    });
+
+    test('write token can create a project', function () {
+        $token = $this->user->createToken('write-token', ['write']);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$token->plainTextToken,
+            'Content-Type' => 'application/json',
+        ])->postJson('/api/v1/projects', [
+            'name' => 'Test Project',
+        ]);
+
+        $response->assertStatus(201);
+        $response->assertJsonStructure(['uuid']);
+    });
+
+    test('root token can create a project', function () {
+        $token = $this->user->createToken('root-token', ['root']);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$token->plainTextToken,
+            'Content-Type' => 'application/json',
+        ])->postJson('/api/v1/projects', [
+            'name' => 'Test Project',
+        ]);
+
+        $response->assertStatus(201);
+        $response->assertJsonStructure(['uuid']);
+    });
+});
+
+describe('POST /api/v1/servers', function () {
+    test('read-only token cannot create a server', function () {
+        $token = $this->user->createToken('read-only', ['read']);
+
+        $response = $this->withHeaders([
+            'Authorization' => 'Bearer '.$token->plainTextToken,
+            'Content-Type' => 'application/json',
+        ])->postJson('/api/v1/servers', [
+            'name' => 'Test Server',
+            'ip' => '1.2.3.4',
+            'private_key_uuid' => 'fake-uuid',
+        ]);
+
+        $response->assertStatus(403);
+    });
+});

tests/Unit/HealthCheckCommandInjectionTest.php

@@ -0,0 +1,211 @@
+<?php
+
+use App\Jobs\ApplicationDeploymentJob;
+use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
+use App\Models\ApplicationSetting;
+use Illuminate\Support\Facades\Validator;
+use Mockery;
+
+beforeEach(function () {
+    Mockery::close();
+});
+
+afterEach(function () {
+    Mockery::close();
+});
+
+it('sanitizes health_check_host to prevent command injection', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_host' => 'localhost; id > /tmp/pwned #',
+    ]);
+
+    // Should fall back to 'localhost' because input contains shell metacharacters
+    expect($result)->not->toContain('; id')
+        ->and($result)->not->toContain('/tmp/pwned')
+        ->and($result)->toContain('localhost');
+});
+
+it('sanitizes health_check_method to prevent command injection', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_method' => 'GET; curl http://evil.com #',
+    ]);
+
+    expect($result)->not->toContain('evil.com')
+        ->and($result)->not->toContain('; curl');
+});
+
+it('sanitizes health_check_path to prevent command injection', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_path' => '/health; rm -rf / #',
+    ]);
+
+    expect($result)->not->toContain('rm -rf')
+        ->and($result)->not->toContain('; rm');
+});
+
+it('sanitizes health_check_scheme to prevent command injection', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_scheme' => 'http; cat /etc/passwd #',
+    ]);
+
+    expect($result)->not->toContain('/etc/passwd')
+        ->and($result)->not->toContain('; cat');
+});
+
+it('casts health_check_port to integer to prevent injection', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_port' => '8080; whoami',
+    ]);
+
+    // (int) cast on non-numeric after digits yields 8080
+    expect($result)->not->toContain('whoami')
+        ->and($result)->toContain('8080');
+});
+
+it('generates valid healthcheck command with safe inputs', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_method' => 'GET',
+        'health_check_scheme' => 'http',
+        'health_check_host' => 'localhost',
+        'health_check_port' => '8080',
+        'health_check_path' => '/health',
+    ]);
+
+    expect($result)->toContain('curl -s -X')
+        ->and($result)->toContain('http://localhost:8080/health')
+        ->and($result)->toContain('wget -q -O-');
+});
+
+it('uses escapeshellarg on the constructed URL', function () {
+    $result = callGenerateHealthcheckCommands([
+        'health_check_host' => 'my-app.local',
+        'health_check_path' => '/api/health',
+    ]);
+
+    // escapeshellarg wraps in single quotes
+    expect($result)->toContain("'http://my-app.local:80/api/health'");
+});
+
+it('validates health_check_host rejects shell metacharacters via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        ['health_check_host' => 'localhost; id #'],
+        ['health_check_host' => $rules['health_check_host']]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('validates health_check_method rejects invalid methods via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        ['health_check_method' => 'GET; curl evil.com'],
+        ['health_check_method' => $rules['health_check_method']]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('validates health_check_scheme rejects invalid schemes via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        ['health_check_scheme' => 'http; whoami'],
+        ['health_check_scheme' => $rules['health_check_scheme']]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('validates health_check_path rejects shell metacharacters via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        ['health_check_path' => '/health; rm -rf /'],
+        ['health_check_path' => $rules['health_check_path']]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('validates health_check_port rejects non-numeric values via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        ['health_check_port' => '8080; whoami'],
+        ['health_check_port' => $rules['health_check_port']]
+    );
+
+    expect($validator->fails())->toBeTrue();
+});
+
+it('allows valid health check values via API rules', function () {
+    $rules = sharedDataApplications();
+
+    $validator = Validator::make(
+        [
+            'health_check_host' => 'my-app.localhost',
+            'health_check_method' => 'GET',
+            'health_check_scheme' => 'https',
+            'health_check_path' => '/api/v1/health',
+            'health_check_port' => 8080,
+        ],
+        [
+            'health_check_host' => $rules['health_check_host'],
+            'health_check_method' => $rules['health_check_method'],
+            'health_check_scheme' => $rules['health_check_scheme'],
+            'health_check_path' => $rules['health_check_path'],
+            'health_check_port' => $rules['health_check_port'],
+        ]
+    );
+
+    expect($validator->fails())->toBeFalse();
+});
+
+/**
+ * Helper: Invokes the private generate_healthcheck_commands() method via reflection.
+ */
+function callGenerateHealthcheckCommands(array $overrides = []): string
+{
+    $defaults = [
+        'health_check_method' => 'GET',
+        'health_check_scheme' => 'http',
+        'health_check_host' => 'localhost',
+        'health_check_port' => null,
+        'health_check_path' => '/',
+        'ports_exposes' => '80',
+    ];
+
+    $values = array_merge($defaults, $overrides);
+
+    $application = Mockery::mock(Application::class)->makePartial();
+    $application->shouldReceive('getAttribute')->with('health_check_method')->andReturn($values['health_check_method']);
+    $application->shouldReceive('getAttribute')->with('health_check_scheme')->andReturn($values['health_check_scheme']);
+    $application->shouldReceive('getAttribute')->with('health_check_host')->andReturn($values['health_check_host']);
+    $application->shouldReceive('getAttribute')->with('health_check_port')->andReturn($values['health_check_port']);
+    $application->shouldReceive('getAttribute')->with('health_check_path')->andReturn($values['health_check_path']);
+    $application->shouldReceive('getAttribute')->with('ports_exposes_array')->andReturn(explode(',', $values['ports_exposes']));
+    $application->shouldReceive('getAttribute')->with('build_pack')->andReturn('nixpacks');
+
+    $settings = Mockery::mock(ApplicationSetting::class)->makePartial();
+    $settings->shouldReceive('getAttribute')->with('is_static')->andReturn(false);
+    $application->shouldReceive('getAttribute')->with('settings')->andReturn($settings);
+
+    $deploymentQueue = Mockery::mock(ApplicationDeploymentQueue::class)->makePartial();
+
+    $job = Mockery::mock(ApplicationDeploymentJob::class)->makePartial();
+
+    $reflection = new ReflectionClass($job);
+
+    $appProp = $reflection->getProperty('application');
+    $appProp->setAccessible(true);
+    $appProp->setValue($job, $application);
+
+    $method = $reflection->getMethod('generate_healthcheck_commands');
+    $method->setAccessible(true);
+
+    return $method->invoke($job);
+}