diff --git a/.github/workflows/installer.yml b/.github/workflows/installer.yml
new file mode 100644
index 00000000..405bc7b9
--- /dev/null
+++ b/.github/workflows/installer.yml
@@ -0,0 +1,196 @@
+name: Installer quality
+
+on:
+  pull_request:
+    paths:
+      - apps/website/public/install.sh
+      - apps/website/public/install.sh.sha256
+      - apps/docs/content/docs/core/installation.mdx
+      - apps/docs/content/docs/core/manual-installation.mdx
+      - apps/docs/content/docs/core/troubleshooting/networking.mdx
+      - apps/website/components/Hero.tsx
+      - apps/website/app/self-hosted-paas/page.tsx
+      - tests/installer/**
+      - .github/workflows/installer.yml
+  push:
+    branches: [main, canary]
+    paths:
+      - apps/website/public/install.sh
+      - apps/website/public/install.sh.sha256
+      - apps/docs/content/docs/core/installation.mdx
+      - apps/docs/content/docs/core/manual-installation.mdx
+      - apps/docs/content/docs/core/troubleshooting/networking.mdx
+      - apps/website/components/Hero.tsx
+      - apps/website/app/self-hosted-paas/page.tsx
+      - tests/installer/**
+      - .github/workflows/installer.yml
+  workflow_dispatch:
+  schedule:
+    - cron: "17 3 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  shell-quality:
+    name: ShellCheck, shfmt, syntax, and Bats
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install shell quality tools
+        run: sudo apt-get update && sudo apt-get install -y bats shellcheck shfmt
+      - name: Validate Bash syntax
+        run: bash -n apps/website/public/install.sh
+      - name: Verify published installer checksum
+        working-directory: apps/website/public
+        run: sha256sum --check install.sh.sha256
+      - name: Run ShellCheck
+        run: shellcheck --severity=style apps/website/public/install.sh tests/installer/install.bats
+      - name: Verify shfmt
+        run: shfmt -d -i 0 -ci apps/website/public/install.sh tests/installer/install.bats
+      - name: Run installer unit tests
+        run: bats tests/installer/install.bats
+      - name: Verify checksum tamper detection
+        run: |
+          checksum_dir=$(mktemp -d)
+          cp apps/website/public/install.sh "$checksum_dir/install.sh"
+          cd "$checksum_dir"
+          sha256sum install.sh >install.sh.sha256
+          sha256sum --check install.sh.sha256
+          printf '\n# tampered\n' >>install.sh
+          if sha256sum --check install.sh.sha256; then
+            echo "Checksum verification accepted a modified installer" >&2
+            exit 1
+          fi
+
+  platform-contract:
+    name: Platform contract (${{ matrix.name }})
+    runs-on: ubuntu-24.04
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Ubuntu 22.04 amd64
+            image: ubuntu:22.04
+          - name: Ubuntu 24.04 amd64
+            image: ubuntu:24.04
+          - name: Debian 12 amd64
+            image: debian:12
+    steps:
+      - uses: actions/checkout@v4
+      - name: Validate platform and architecture detection
+        run: |
+          docker run --rm \
+            -v "$PWD:/work:ro" \
+            -w /work \
+            "${{ matrix.image }}" \
+            bash -c 'source ./apps/website/public/install.sh; detect_platform; test "$PLATFORM_CLASS" = supported; test "$ARCHITECTURE" = amd64'
+
+  arm64-contract:
+    name: Platform contract (Ubuntu 24.04 arm64)
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - uses: actions/checkout@v4
+      - name: Validate arm64 architecture detection
+        run: |
+          docker run --rm \
+            -v "$PWD:/work:ro" \
+            -w /work \
+            ubuntu:24.04 \
+            bash -c 'source ./apps/website/public/install.sh; detect_platform; test "$PLATFORM_CLASS" = supported; test "$ARCHITECTURE" = arm64'
+
+  integration-versions:
+    name: Resolve integration upgrade path
+    if: github.event_name == 'workflow_dispatch' || github.event_name == 'schedule'
+    runs-on: ubuntu-24.04
+    outputs:
+      initial: ${{ steps.versions.outputs.initial }}
+      target: ${{ steps.versions.outputs.target }}
+    steps:
+      - name: Resolve stable upgrade pair
+        id: versions
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if [ "$GITHUB_REF_NAME" = "main" ]; then
+            releases=$(curl --fail --show-error --location --retry 5 \
+              -H "Authorization: Bearer $GH_TOKEN" \
+              'https://api.github.com/repos/Dokploy/dokploy/releases?per_page=10')
+            initial=$(node -e '
+              const releases = JSON.parse(process.argv[1]).filter((release) => !release.draft && !release.prerelease);
+              if (releases.length < 2) process.exit(1);
+              process.stdout.write(releases[1].tag_name);
+            ' "$releases")
+            echo "initial=$initial" >>"$GITHUB_OUTPUT"
+            echo "target=latest" >>"$GITHUB_OUTPUT"
+          else
+            echo "initial=latest" >>"$GITHUB_OUTPUT"
+            echo "target=canary" >>"$GITHUB_OUTPUT"
+          fi
+
+  vm-integration:
+    name: VM integration (${{ matrix.runner }})
+    needs: integration-versions
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        runner: [ubuntu-22.04, ubuntu-24.04, ubuntu-24.04-arm]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check host readiness without changes
+        run: sudo env DOKPLOY_INSTALL_ACTION=check DOKPLOY_VERSION="${{ needs.integration-versions.outputs.initial }}" DOKPLOY_ALLOW_LOW_RESOURCES=1 bash apps/website/public/install.sh
+      - name: Fresh installation on a systemd VM
+        run: sudo env DOKPLOY_VERSION="${{ needs.integration-versions.outputs.initial }}" DOKPLOY_ALLOW_LOW_RESOURCES=1 DOKPLOY_STABILIZATION_SECONDS=3 bash apps/website/public/install.sh
+      - name: Idempotent rerun
+        run: sudo env DOKPLOY_VERSION="${{ needs.integration-versions.outputs.initial }}" DOKPLOY_ALLOW_LOW_RESOURCES=1 DOKPLOY_STABILIZATION_SECONDS=3 bash apps/website/public/install.sh
+      - name: Upgrade and validate
+        run: sudo env DOKPLOY_VERSION="${{ needs.integration-versions.outputs.target }}" DOKPLOY_ALLOW_LOW_RESOURCES=1 DOKPLOY_STABILIZATION_SECONDS=3 bash apps/website/public/install.sh
+      - name: Preserve failure diagnostics
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: installer-diagnostics-${{ matrix.runner }}
+          path: /var/log/dokploy/
+          if-no-files-found: ignore
+
+  debian-vm-integration:
+    name: VM integration (Debian 12 amd64)
+    needs: integration-versions
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    steps:
+      - uses: actions/checkout@v4
+      - uses: lima-vm/lima-actions/setup@v1
+        id: lima
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/lima
+          key: lima-${{ steps.lima.outputs.version }}-debian-12
+      - name: Start Debian 12 systemd VM
+        run: limactl start --plain --name=debian --cpus=4 --memory=6 --disk=40 template://debian-12
+      - name: Copy installer sources into VM
+        run: |
+          ssh lima-debian mkdir -p /tmp/dokploy
+          scp apps/website/public/install.sh lima-debian:/tmp/dokploy/install.sh
+      - name: Check host readiness without changes
+        run: ssh lima-debian sudo env DOKPLOY_INSTALL_ACTION=check DOKPLOY_VERSION="${{ needs.integration-versions.outputs.initial }}" bash /tmp/dokploy/install.sh
+      - name: Fresh install, idempotent rerun, and upgrade
+        run: |
+          ssh lima-debian sudo env DOKPLOY_VERSION="${{ needs.integration-versions.outputs.initial }}" DOKPLOY_STABILIZATION_SECONDS=3 bash /tmp/dokploy/install.sh
+          ssh lima-debian sudo env DOKPLOY_VERSION="${{ needs.integration-versions.outputs.initial }}" DOKPLOY_STABILIZATION_SECONDS=3 bash /tmp/dokploy/install.sh
+          ssh lima-debian sudo env DOKPLOY_VERSION="${{ needs.integration-versions.outputs.target }}" DOKPLOY_STABILIZATION_SECONDS=3 bash /tmp/dokploy/install.sh
+      - name: Collect failure diagnostics
+        if: failure()
+        run: |
+          if ssh lima-debian 'sudo tar -C /var/log -czf /tmp/dokploy-diagnostics.tar.gz dokploy'; then
+            scp lima-debian:/tmp/dokploy-diagnostics.tar.gz .
+          fi
+      - name: Upload failure diagnostics
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: installer-diagnostics-debian-12
+          path: dokploy-diagnostics.tar.gz
+          if-no-files-found: ignore
diff --git a/apps/docs/content/docs/core/installation.mdx b/apps/docs/content/docs/core/installation.mdx
index 9b95509d..081fada5 100644
--- a/apps/docs/content/docs/core/installation.mdx
+++ b/apps/docs/content/docs/core/installation.mdx
@@ -13,19 +13,17 @@ You need to follow this steps in the same order:
 
 There are multiple VPS providers to choose from:
 
-We have tested on the following Linux Distros:
-
-- Ubuntu 24.04 LTS
-- Ubuntu 23.10
-- Ubuntu 22.04 LTS
-- Ubuntu 20.04 LTS
-- Ubuntu 18.04 LTS
-- Debian 12
-- Debian 11
-- Debian 10
-- Fedora 40
-- Centos 9
-- Centos 8
+The production installer supports these 64-bit platforms:
+
+- Ubuntu 24.04 LTS (`amd64` and `arm64`)
+- Ubuntu 22.04 LTS (`amd64` and `arm64`)
+- Debian 12 (`amd64` and `arm64`)
+
+Other systemd-based Linux distributions with an existing supported Docker
+Engine installation are experimental and require
+`DOKPLOY_ALLOW_UNSUPPORTED=1`. Rootless Docker, Docker installed through Snap,
+Podman aliases, Docker Desktop, remote Docker contexts, Docker/OpenVZ containers,
+and WSL are not supported server environments.
 
 ### Providers
 
@@ -42,7 +40,10 @@ We have tested on the following Linux Distros:
 
 ### Requirements
 
-To ensure a smooth experience with Dokploy, your server should have at least 2GB of RAM and 30GB of disk space. This specification helps to handle the resources consumed by Docker during builds and prevents system freezes.
+Dokploy requires at least 2 GB of RAM and 10 GB of free disk space. Four GB of
+RAM and 30 GB of free disk space are recommended for Docker builds and backups.
+Systems with 1–2 GB of RAM require `DOKPLOY_ALLOW_LOW_RESOURCES=1`; systems below
+1 GB are rejected. Linux kernel 5.4+, systemd, and Bash 4.3+ are required.
 
 import { Callout } from "fumadocs-ui/components/callout";
 
@@ -73,48 +74,104 @@ Dokploy utilizes Docker, so it is essential to have Docker installed on your ser
  Dokploy Cloud:  Use Dokploy directly without worrying about maintenance or updates. Enjoy a hassle-free experience with Dokploy Cloud.  <a href="https://app.dokploy.com/register" className="text-green-600 underline">Sign up</a>
 </div>
 
+For an inspectable installation, download the installer and its checksum first:
+
+```bash
+curl --fail --show-error --location --retry 5 \
+  --output install.sh https://dokploy.com/install.sh
+curl --fail --show-error --location --retry 5 \
+  --output install.sh.sha256 https://dokploy.com/install.sh.sha256
+sha256sum --check install.sh.sha256
+less install.sh
+sudo bash install.sh
+```
+
+The shorter convenience command is also available:
+
 ```bash
-curl -sSL https://dokploy.com/install.sh | sh
+curl --fail --show-error --location https://dokploy.com/install.sh | sudo bash
 ```
 
+The installer requires Bash; do not invoke it with `sh`.
+
 See [Manual Installation](/docs/core/manual-installation) if you want to customize your Dokploy installation.
 
 
+### Check Your Server Before Installation
+
+Check mode performs platform, dependency, resource, filesystem, port, Docker,
+DNS, TLS, registry, version, and configuration validation without installing
+packages, writing files, pulling images, creating Docker resources, or restarting
+services:
+
+```bash
+curl --fail --show-error --location --output install.sh https://dokploy.com/install.sh
+sudo DOKPLOY_INSTALL_ACTION=check bash install.sh
+```
+
+`DRY_RUN=1` is an alias for check mode and also prints the actions that would be
+performed.
+
 ### Advanced Installation Options
 
-The installation script automatically detects and installs the latest stable version from GitHub. However, you can customize the installation using environment variables:
+The installer resolves `latest` to an immutable stable release tag before
+changing the host. All important choices can be supplied noninteractively with
+environment variables.
 
 #### Install Specific Versions
 
 **Install Canary Version (Development):**
 ```bash
-export DOKPLOY_VERSION=canary && curl -sSL https://dokploy.com/install.sh | sh
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOKPLOY_VERSION=canary bash
 ```
 
 **Install Latest Stable:**
 ```bash
-export DOKPLOY_VERSION=latest && curl -sSL https://dokploy.com/install.sh | sh
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOKPLOY_VERSION=latest bash
 ```
 
 **Install a Specific Version:**
 
-Every [Dokploy release](https://github.com/Dokploy/dokploy/releases) includes its own `install.sh` as a release asset, which installs exactly that version with the setup it expects. Replace the version tag in the URL with the one you want:
+Pin the requested version for reproducible provisioning:
 
 ```bash
-curl -sL https://github.com/Dokploy/dokploy/releases/download/v0.26.6/install.sh | sh
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOKPLOY_VERSION=v0.29.13 bash
 ```
 
 <Callout type='info'>
-  Don't use `DOKPLOY_VERSION` to install a specific version — the main script at `dokploy.com/install.sh` always targets the latest release, so its setup may not be compatible with older versions.
+  Review release notes and test upgrade paths before pinning an older or breaking
+  version. Major-version transitions and downgrades require
+  `DOKPLOY_ALLOW_BREAKING_UPGRADE=1`.
 </Callout>
 
+#### Installation Actions
+
+`DOKPLOY_INSTALL_ACTION` accepts the following values:
+
+- `auto` (default): install, upgrade, repair, or validate according to detected state
+- `install`: require a completely fresh Dokploy state
+- `upgrade`: require an existing healthy installation with a different target version
+- `repair`: recreate only missing or unhealthy resources while preserving data
+- `abort`: report the detected state and stop
+- `check`: run the non-destructive preflight only
+
+The installer classifies existing hosts as fresh, healthy, upgradeable, in need
+of repair, partial, or conflicting. A healthy rerun performs validation without
+rotating secrets or recreating resources.
+
 #### Custom Network Configuration
 
-If you need to customize the Docker Swarm network configuration (useful to avoid CIDR conflicts with cloud provider VPCs):
+If you need to customize Docker Swarm's address pool to avoid a VPC CIDR
+conflict, pass the legacy `DOCKER_SWARM_INIT_ARGS` option inline. The installer
+splits this value without `eval`, so quoted values containing spaces are not
+supported:
 
 ```bash
-export DOCKER_SWARM_INIT_ARGS="--default-addr-pool 172.20.0.0/16 --default-addr-pool-mask-length 24"
-curl -sSL https://dokploy.com/install.sh | sh
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOCKER_SWARM_INIT_ARGS="--default-addr-pool 172.20.0.0/16 --default-addr-pool-mask-length 24" bash
 ```
 
 #### Manual Advertise Address
@@ -122,11 +179,14 @@ curl -sSL https://dokploy.com/install.sh | sh
 If the script cannot detect your server's IP automatically, or you want the Swarm to use a specific interface (e.g. a VPN/WireGuard IP), specify it manually:
 
 ```bash
-curl -sSL https://dokploy.com/install.sh | sudo ADVERTISE_ADDR=192.168.1.100 sh
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOKPLOY_ADVERTISE_ADDR=192.168.1.100 bash
 ```
 
 <Callout type='warn'>
-  If you run the installer with `sudo`, don't rely on `export ADVERTISE_ADDR=...` from your user shell — `sudo` resets the environment, so the variable never reaches the script and it falls back to auto-detection. Pass the variable inline as shown above, or use `sudo -E sh` to preserve your environment. The same applies to `DOKPLOY_VERSION`, `DOCKER_SWARM_INIT_ARGS`, and `ENDPOINT_MODE`.
+  Do not rely on variables exported before `sudo`, because `sudo` normally
+  resets the environment. Pass variables with `sudo env` as shown above.
+  `ADVERTISE_ADDR` and `ENDPOINT_MODE` remain supported as deprecated aliases.
 </Callout>
 
 #### Kernels Without IPVS Support
@@ -134,7 +194,8 @@ curl -sSL https://dokploy.com/install.sh | sudo ADVERTISE_ADDR=192.168.1.100 sh
 Docker Swarm's default service discovery requires IPVS support in the kernel. Some minimal or appliance-style distributions (e.g. ZimaOS and other Buildroot-based images) ship kernels without it. On those systems, install with DNSRR endpoint mode:
 
 ```bash
-curl -sSL https://dokploy.com/install.sh | sudo ENDPOINT_MODE=dnsrr sh
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOKPLOY_ENDPOINT_MODE=dnsrr DOKPLOY_ALLOW_UNSUPPORTED=1 bash
 ```
 
 See [Services Can't Reach Each Other (Missing IPVS Kernel Modules)](/docs/core/troubleshooting/networking#services-cant-reach-each-other-missing-ipvs-kernel-modules) for how to detect this situation and its trade-offs.
@@ -142,7 +203,9 @@ See [Services Can't Reach Each Other (Missing IPVS Kernel Modules)](/docs/core/t
 ### Proxmox LXC Support
 
 <Callout type='info'>
-  The installation script automatically detects Proxmox LXC containers and applies the necessary configurations (`--endpoint-mode dnsrr`) for compatibility.
+  Proxmox LXC is experimental. The installer detects it, requires
+  `DOKPLOY_ALLOW_UNSUPPORTED=1`, and automatically uses DNSRR endpoint mode.
+  Docker and OpenVZ containers remain unsupported.
 </Callout>
 
 ### Updating Dokploy
@@ -150,17 +213,90 @@ See [Services Can't Reach Each Other (Missing IPVS Kernel Modules)](/docs/core/t
 To update your Dokploy installation to the latest version:
 
 ```bash
-curl -sSL https://dokploy.com/install.sh | sh -s update
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOKPLOY_INSTALL_ACTION=upgrade bash
 ```
 
 **Update to Specific Version:**
 
-Use the `install.sh` from that version's [GitHub release](https://github.com/Dokploy/dokploy/releases):
+Pin the target version explicitly:
 
 ```bash
-curl -sL https://github.com/Dokploy/dokploy/releases/download/v0.26.6/install.sh | sh -s update
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOKPLOY_INSTALL_ACTION=upgrade DOKPLOY_VERSION=v0.29.13 bash
 ```
 
+Before an upgrade, the installer records the installed and target versions,
+classifies the upgrade, validates compatibility, creates a protected backup,
+pulls images, and resolves them to immutable repository digests. It validates
+the database, application, mounts, networks, reverse proxy, restart counts, and
+a stabilization period before reporting success.
+
+Automatic rollback is enabled only for an upgrade pair explicitly marked
+`database-safe` in `DOKPLOY_ROLLBACK_COMPATIBILITY_FILE`. Otherwise the backup
+is preserved for manual recovery instead of risking an unsafe database restore.
+
+### Ports and Existing Reverse Proxies
+
+Use `DOKPLOY_HTTP_PORT`, `DOKPLOY_HTTPS_PORT`, and `DOKPLOY_APP_PORT` to choose
+alternate host ports. If an existing proxy will route to Dokploy, set
+`DOKPLOY_SKIP_TRAEFIK=1`. `DOKPLOY_ALLOW_PORT_CONFLICT=1` acknowledges a known
+conflict, but does not make two processes able to bind the same port.
+
+### Configuration Reference
+
+All installer input is validated before host changes. Boolean options accept
+only `0` or `1`; ports must be from 1 to 65535; paths must be absolute; and
+versions must be `latest`, `canary`, or a release tag such as `v0.29.13`.
+
+| Variable | Default | Purpose and scope |
+| --- | --- | --- |
+| `DOKPLOY_VERSION` | `latest` | Immutable target release for install or upgrade. |
+| `DOKPLOY_INSTALL_ACTION` | `auto` | Selects `auto`, `install`, `upgrade`, `repair`, `abort`, or `check`. |
+| `DOKPLOY_DATA_DIR` | `/etc/dokploy` | Protected host configuration directory. Existing content is backed up before replacement. |
+| `DOKPLOY_BACKUP_DIR` | `/var/backups/dokploy` | Upgrade backup location; should be on a trusted local filesystem. |
+| `DOKPLOY_LOG_DIR` | `/var/log/dokploy` | Persistent installer logs and failure diagnostics. |
+| `DOKPLOY_HTTP_PORT` / `DOKPLOY_HTTPS_PORT` / `DOKPLOY_APP_PORT` | `80` / `443` / `3000` | Validated host ports used during installation and health checks. |
+| `DOKPLOY_NETWORK_NAME` | `dokploy-network` | Overlay network name; must be a safe Docker resource name. |
+| `DOKPLOY_ADVERTISE_ADDR` | auto-detected | IPv4/IPv6 address or interface advertised by a newly initialized Swarm. |
+| `DOKPLOY_ENDPOINT_MODE` | `auto` | `auto`, `vip`, or `dnsrr`; DNSRR is selected automatically when IPVS is unavailable. |
+| `DOKPLOY_DOMAIN` | empty | Optional domain used for the HTTPS routing health check. |
+| `DOKPLOY_EMAIL` | empty | Validated contact metadata reserved for installation automation; it is not logged. |
+| `DOKPLOY_TIMEZONE` | `UTC` | Validated IANA timezone for installation metadata. |
+| `DOKPLOY_SKIP_DOCKER_INSTALL` | `0` | Require an existing supported Docker Engine instead of installing it. |
+| `DOKPLOY_SKIP_TRAEFIK` | `0` | Integrate with an existing reverse proxy rather than create Dokploy's Traefik container. |
+| `DOKPLOY_REUSE_EXISTING_SWARM` | `0` | Permit installation into an existing manager Swarm without leaving or reinitializing it. |
+| `DOKPLOY_ALLOW_PORT_CONFLICT` | `0` | Explicitly acknowledge detected port ownership; use only after verifying the integration. |
+| `DOKPLOY_ALLOW_UNSUPPORTED` | `0` | Opt into an experimental platform after reviewing the preflight report. |
+| `DOKPLOY_ALLOW_LOW_RESOURCES` | `0` | Permit 1–2 GB RAM or capacity below the recommended values, but never below hard limits. |
+| `DOKPLOY_ALLOW_BREAKING_UPGRADE` | `0` | Explicitly permit a major-version transition or downgrade. |
+| `DOKPLOY_MIN_UPGRADE_VERSION` | empty | Optional minimum installed version accepted by an automated upgrade policy. |
+| `DOKPLOY_ROLLBACK_COMPATIBILITY_FILE` | data-directory metadata file | Lists `old-version new-version database-safe` upgrade pairs eligible for automatic rollback. |
+| `DOKPLOY_DIAGNOSTICS` | `1` | Create a local, sanitized failure bundle; set to `0` to opt out. Nothing is uploaded. |
+| `DOKPLOY_HEALTH_ATTEMPTS` / `DOKPLOY_HEALTH_INTERVAL` | `45` / `2` | Number and interval in seconds for health retries. |
+| `DOKPLOY_STABILIZATION_SECONDS` | `10` | Required healthy period before installation success. |
+| `DOKPLOY_DOCKER_VERSION` | `28.5` | Docker package stream installed on supported distributions when Docker is absent. |
+| `DOKPLOY_LOCK_FILE` | `/var/lock/dokploy-installer.lock` | `flock` lock preventing concurrent installer runs. |
+| `DOKPLOY_NONINTERACTIVE` | auto | Forces automation-friendly behavior; no prompt is required by default. |
+| `DRY_RUN` | `0` | Alias for non-destructive check mode. |
+| `DEBUG` | `0` | Enables Bash tracing except around secret operations. |
+| `NO_COLOR` | empty | Disables color; non-terminal output is plain automatically. |
+
+### Logs, Backups, and Diagnostics
+
+Every run writes a timestamped log under `/var/log/dokploy`, including installer
+and target versions, the preflight report, commands, upgrades, warnings, and
+health results. On failure, a sanitized diagnostics archive is created in the
+same directory by default. It includes host and Docker state but redacts common
+password, token, key, cookie, and connection-string patterns; application
+environment variables are excluded. Review any bundle before sharing it.
+
+Upgrade backups are written under `/var/backups/dokploy` with restrictive
+permissions. They preserve installer metadata, relevant host configuration,
+service specifications, image references, and a PostgreSQL dump. Cleanup never
+deletes persistent volumes or existing user data, and a database dump is never
+restored automatically unless the upgrade path is explicitly declared safe.
+
 ## Completing the Setup
 
 After running the installation script, Dokploy and its dependencies will be set up on your server. Here's how to finalize the setup and start using Dokploy:
@@ -207,4 +343,3 @@ docker service update --publish-rm "published=3000,target=3000,mode=host" dokplo
 ```
 
 To further secure your installation, consider reading the [Security recommendations](/docs/core/remote-servers/security#security-recommendations) section.
-
diff --git a/apps/docs/content/docs/core/manual-installation.mdx b/apps/docs/content/docs/core/manual-installation.mdx
index 1b55ee8d..7e21ecef 100644
--- a/apps/docs/content/docs/core/manual-installation.mdx
+++ b/apps/docs/content/docs/core/manual-installation.mdx
@@ -3,258 +3,49 @@ title: 'Manual Installation'
 description: 'Learn how to manually install Dokploy on your server.'
 ---
 
-If you wish to customize the Dokploy installation on your server, you can modify several environment variables:
+The production installer is the canonical, audited source for provisioning Dokploy.
+It supports version pinning and noninteractive customization without requiring a
+fork of the script. See [Installation](/docs/core/installation) for the complete
+configuration reference.
 
-1. **PORT** - Ideal for avoiding conflicts with other services.
-2. **TRAEFIK_SSL_PORT** - Set to another port if you want to use a different port for SSL.
-3. **TRAEFIK_PORT** - Set to another port if you want to use a different port for Traefik.
-4. **ADVERTISE_ADDR** - Set to another IP address if you want to use a different IP address for Swarm.
-5. **RELEASE_TAG** - Set to a dokploy docker hub tag(latest, canary, feature, etc)
-6. **DATABASE_URL** - Set to another database url if you want to use a different database.
-7. **TZ** - Set to another timezone if you want to use a different timezone.
-
-## Installation Script
-
-Here is a Bash script for installing Dokploy on a Linux server. Make sure you run this as root on a Linux environment that is not a container, and ensure ports 80, 443, and 3000 are free.
+## Inspect the Installation Script
 
+Download the installer and its published SHA-256 checksum before running it:
 
 ```bash
-#!/bin/bash
-install_dokploy() {
-    if [ "$(id -u)" != "0" ]; then
-        echo "This script must be run as root" >&2
-        exit 1
-    fi
-
-    # check if is Mac OS
-    if [ "$(uname)" = "Darwin" ]; then
-        echo "This script must be run on Linux" >&2
-        exit 1
-    fi
-
-    # check if is running inside a container
-    if [ -f /.dockerenv ]; then
-        echo "This script must be run on Linux" >&2
-        exit 1
-    fi
-
-    # check if something is running on port 80
-    if ss -tulnp | grep ':80 ' >/dev/null; then
-        echo "Error: something is already running on port 80" >&2
-        exit 1
-    fi
-
-    # check if something is running on port 443
-    if ss -tulnp | grep ':443 ' >/dev/null; then
-        echo "Error: something is already running on port 443" >&2
-        exit 1
-    fi
-
-    # check if something is running on port 3000
-    if ss -tulnp | grep ':3000 ' >/dev/null; then
-        echo "Error: something is already running on port 3000" >&2
-        echo "Dokploy requires port 3000 to be available. Please stop any service using this port." >&2
-        exit 1
-    fi
-
-    command_exists() {
-      command -v "$@" > /dev/null 2>&1
-    }
-
-    if command_exists docker; then
-      echo "Docker already installed"
-    else
-      curl -sSL https://get.docker.com | sh
-    fi
-
-    docker swarm leave --force 2>/dev/null
-
-    get_ip() {
-        local ip=""
-        
-        # Try IPv4 first
-        # First attempt: ifconfig.io
-        ip=$(curl -4s --connect-timeout 5 https://ifconfig.io 2>/dev/null)
-        
-        # Second attempt: icanhazip.com
-        if [ -z "$ip" ]; then
-            ip=$(curl -4s --connect-timeout 5 https://icanhazip.com 2>/dev/null)
-        fi
-        
-        # Third attempt: ipecho.net
-        if [ -z "$ip" ]; then
-            ip=$(curl -4s --connect-timeout 5 https://ipecho.net/plain 2>/dev/null)
-        fi
-
-        # If no IPv4, try IPv6
-        if [ -z "$ip" ]; then
-            # Try IPv6 with ifconfig.io
-            ip=$(curl -6s --connect-timeout 5 https://ifconfig.io 2>/dev/null)
-            
-            # Try IPv6 with icanhazip.com
-            if [ -z "$ip" ]; then
-                ip=$(curl -6s --connect-timeout 5 https://icanhazip.com 2>/dev/null)
-            fi
-            
-            # Try IPv6 with ipecho.net
-            if [ -z "$ip" ]; then
-                ip=$(curl -6s --connect-timeout 5 https://ipecho.net/plain 2>/dev/null)
-            fi
-        fi
-
-        if [ -z "$ip" ]; then
-            echo "Error: Could not determine server IP address automatically (neither IPv4 nor IPv6)." >&2
-            echo "Please set the ADVERTISE_ADDR environment variable manually." >&2
-            echo "Example: export ADVERTISE_ADDR=<your-server-ip>" >&2
-            exit 1
-        fi
-
-        echo "$ip"
-    }
-
-    advertise_addr="${ADVERTISE_ADDR:-$(get_ip)}"
-    echo "Using advertise address: $advertise_addr"
-
-    docker swarm init --advertise-addr $advertise_addr
-    
-     if [ $? -ne 0 ]; then
-        echo "Error: Failed to initialize Docker Swarm" >&2
-        exit 1
-    fi
-
-    echo "Swarm initialized"
-
-    docker network rm -f dokploy-network 2>/dev/null
-    docker network create --driver overlay --attachable dokploy-network
-
-    echo "Network created"
-
-    mkdir -p /etc/dokploy
-
-    chmod 777 /etc/dokploy
-
-    # Generate secure random password for Postgres
-    POSTGRES_PASSWORD=$(openssl rand -base64 32 | tr -d "=+/" | cut -c1-32)
-    
-    # Store password as Docker Secret (encrypted and secure)
-    echo "$POSTGRES_PASSWORD" | docker secret create dokploy_postgres_password - 2>/dev/null || true
-    
-    echo "Generated secure database credentials (stored in Docker Secrets)"
-
-    docker service create \
-    --name dokploy-postgres \
-    --constraint 'node.role==manager' \
-    --network dokploy-network \
-    --env POSTGRES_USER=dokploy \
-    --env POSTGRES_DB=dokploy \
-    --secret source=dokploy_postgres_password,target=/run/secrets/postgres_password \
-    --env POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password \
-    --mount type=volume,source=dokploy-postgres,target=/var/lib/postgresql/data \
-    postgres:16
-
-    # Installation
-    docker service create \
-      --name dokploy \
-      --replicas 1 \
-      --network dokploy-network \
-      --mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock \
-      --mount type=bind,source=/etc/dokploy,target=/etc/dokploy \
-      --mount type=volume,source=dokploy,target=/root/.docker \
-      --secret source=dokploy_postgres_password,target=/run/secrets/postgres_password \
-      --publish published=3000,target=3000,mode=host \
-      --update-parallelism 1 \
-      --update-order stop-first \
-      --constraint 'node.role == manager' \
-      -e POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password \
-      dokploy/dokploy:latest
-
-
-    docker run -d \
-        --name dokploy-traefik \
-        --restart always \
-        -v /etc/dokploy/traefik/traefik.yml:/etc/traefik/traefik.yml \
-        -v /etc/dokploy/traefik/dynamic:/etc/dokploy/traefik/dynamic \
-        -v /var/run/docker.sock:/var/run/docker.sock:ro \
-        -p 80:80/tcp \
-        -p 443:443/tcp \
-        -p 443:443/udp \
-        traefik:v3.6.7
-
-    docker network connect dokploy-network dokploy-traefik
-
-
-    # Optional: Use docker service create instead of docker run
-    #   docker service create \
-    #     --name dokploy-traefik \
-    #     --constraint 'node.role==manager' \
-    #     --network dokploy-network \
-    #     --mount type=bind,source=/etc/dokploy/traefik/traefik.yml,target=/etc/traefik/traefik.yml \
-    #     --mount type=bind,source=/etc/dokploy/traefik/dynamic,target=/etc/dokploy/traefik/dynamic \
-    #     --mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock,readonly \
-    #     --publish mode=host,published=443,target=443 \
-    #     --publish mode=host,published=80,target=80 \
-    #     --publish mode=host,published=443,target=443,protocol=udp \
-    #     traefik:v3.6.7
-
-    GREEN="\033[0;32m"
-    YELLOW="\033[1;33m"
-    BLUE="\033[0;34m"
-    NC="\033[0m" # No Color
-
-    format_ip_for_url() {
-        local ip="$1"
-        if echo "$ip" | grep -q ':'; then
-            # IPv6
-            echo "[${ip}]"
-        else
-            # IPv4
-            echo "${ip}"
-        fi
-    }
-
-    formatted_addr=$(format_ip_for_url "$advertise_addr")
-    echo ""
-    printf "${GREEN}Congratulations, Dokploy is installed!${NC}\n"
-    printf "${BLUE}Wait 15 seconds for the server to start${NC}\n"
-    printf "${YELLOW}Please go to http://${formatted_addr}:3000${NC}\n\n"
-}
-
-update_dokploy() {
-    echo "Updating Dokploy..."
-    
-    # Pull the latest image
-    docker pull dokploy/dokploy:latest
-
-    # Update the service
-    docker service update --image dokploy/dokploy:latest dokploy
-
-    echo "Dokploy has been updated to the latest version."
-}
-
-# Main script execution
-if [ "$1" = "update" ]; then
-    update_dokploy
-else
-    install_dokploy
-fi
-
+curl --fail --show-error --location --retry 5 \
+  --output install.sh https://dokploy.com/install.sh
+curl --fail --show-error --location --retry 5 \
+  --output install.sh.sha256 https://dokploy.com/install.sh.sha256
+sha256sum --check install.sh.sha256
+less install.sh
+sudo bash install.sh
 ```
 
-This script includes checks for common pitfalls, installs Docker if it’s not already installed, initializes a Docker Swarm, creates a network, and then pulls and deploys Dokploy. After the script runs, it provides a success message and instructions for accessing Dokploy.
+The installer requires Bash 4.3 or newer. It performs a preflight before changing
+the host, preserves existing state, and writes a persistent installation log.
+Use `DOKPLOY_INSTALL_ACTION=check` to inspect a host without installing packages,
+writing files, restarting services, creating Docker resources, or pulling images.
+
+The remainder of this guide documents the individual Docker resources for
+operators who intentionally need to provision or integrate them by hand. Manual
+changes bypass the installer's state detection, backups, verified image digests,
+rollback rules, and health validation, so test them before using them in
+production.
 
-This structured format clearly lays out the prerequisites, steps, and post-installation information, making it user-friendly and accessible for those performing manual installations.
+## Customize Installation
 
-## Customize install 
-#### Customize swarm advertise address
+### Customize the Swarm Advertise Address
 
 The --advertise-addr parameter in the docker swarm init command specifies the IP address or interface that the Docker Swarm manager node should advertise to other nodes in the Swarm. This address is used by other nodes to communicate with the manager.
 
 By default, the script auto-detects the server IP address (the installer at `dokploy.com/install.sh` prefers a private RFC1918 address and falls back to the public IP). However, you might need to customize this address based on your network configuration, especially if your server has multiple network interfaces or if you're setting up Swarm in a private network.
 
-To customize it, set the `ADVERTISE_ADDR` environment variable when running the script:
+To customize it, set `DOKPLOY_ADVERTISE_ADDR` when running the script:
 
 ```bash
-curl -sSL https://dokploy.com/install.sh | sudo ADVERTISE_ADDR=192.168.1.100 sh
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOKPLOY_ADVERTISE_ADDR=192.168.1.100 bash
 ```
 
 :warning: This IP address should be accessible to all nodes that will join the Swarm.
@@ -262,7 +53,9 @@ curl -sSL https://dokploy.com/install.sh | sudo ADVERTISE_ADDR=192.168.1.100 sh
 
 ## Proxmox LXC Considerations
 
-If you're installing Dokploy in a Proxmox LXC container, the installation script automatically detects the environment and adds `--endpoint-mode dnsrr` to Docker services for compatibility. 
+Proxmox LXC is experimental. The installer requires
+`DOKPLOY_ALLOW_UNSUPPORTED=1`, detects this environment, and adds
+`--endpoint-mode dnsrr` to Docker services for compatibility.
 
 For manual installations in LXC, add this flag to your service creation commands:
 
@@ -279,9 +72,14 @@ docker service create \
 
 ## Existing Docker Swarm
 
-If you already have a Docker Swarm running on your server, do **not** use the installation script — it forces the node to leave the current swarm (`docker swarm leave --force`) and re-initializes it, which would disrupt your existing services.
+The installer never forces a host to leave an existing Swarm. By default it
+stops when a non-Dokploy Swarm is detected. To install on an existing manager
+after reviewing the resource names and port requirements, set
+`DOKPLOY_REUSE_EXISTING_SWARM=1`. The manual steps below show the equivalent
+resource topology.
 
-Instead, run the following steps on a **manager** node. They replicate exactly what the install script does, minus the swarm initialization:
+To provision the resources yourself, run the following steps on a **manager**
+node. They show the same resource topology without Swarm initialization:
 
 ```bash
 # 1. Create the network
@@ -289,7 +87,7 @@ docker network create --driver overlay --attachable dokploy-network
 
 # 2. Create the config directory
 mkdir -p /etc/dokploy
-chmod 777 /etc/dokploy
+chmod 700 /etc/dokploy
 
 # 3. Create the secrets (Postgres password + auth secret)
 openssl rand -base64 32 | tr -d "=+/" | cut -c1-32 | docker secret create dokploy_postgres_password -
@@ -369,57 +167,66 @@ docker service update --env-add TZ=America/New_York dokploy
 To upgrade Dokploy manually, you can use the following command:
 
 ```bash
-curl -sSL https://dokploy.com/install.sh | sh -s update
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOKPLOY_INSTALL_ACTION=upgrade bash
 ```
 
 ### Version-Specific Installation & Updates
 
 The installation script automatically detects the latest stable version from GitHub. You can also specify a particular version:
 
-**Install a Specific Version (Recommended):**
+**Install or Upgrade to a Specific Version:**
 
-Every [Dokploy release](https://github.com/Dokploy/dokploy/releases) includes its own `install.sh` as a release asset, which installs exactly that version with the setup it expects. Just replace the version tag in the URL with the one you want:
+Pin the canonical installer to an immutable release tag:
 
 ```bash
-curl -sL https://github.com/Dokploy/dokploy/releases/download/v0.15.0/install.sh | sh
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOKPLOY_VERSION=v0.29.13 bash
 ```
 
 <Callout type='info'>
-  This is the recommended way to install older versions of Dokploy. The main script at `dokploy.com/install.sh` always targets the latest release, so its setup may not be compatible with older versions.
+  For an existing installation, also set `DOKPLOY_INSTALL_ACTION=upgrade`.
+  Major-version transitions and downgrades require
+  `DOKPLOY_ALLOW_BREAKING_UPGRADE=1`.
 </Callout>
 
 **Install/Update to Canary (Development):**
 ```bash
-export DOKPLOY_VERSION=canary && curl -sSL https://dokploy.com/install.sh | sh
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOKPLOY_VERSION=canary bash
 ```
 
 **Install/Update to Latest Stable:**
 ```bash
-export DOKPLOY_VERSION=latest && curl -sSL https://dokploy.com/install.sh | sh
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOKPLOY_VERSION=latest bash
 ```
 
 **Auto-detect Latest Stable (Default):**
 ```bash
-curl -sSL https://dokploy.com/install.sh | sh
+curl --fail --show-error --location https://dokploy.com/install.sh | sudo bash
 ```
 
-Alternatively, you can use `bash -s` for inline version specification:
+Alternatively, download the script first and pass the version directly to
+`sudo env`:
 
 ```bash
-DOKPLOY_VERSION=canary bash -s < <(curl -sSL https://dokploy.com/install.sh)
+curl --fail --show-error --location --output install.sh https://dokploy.com/install.sh
+sudo env DOKPLOY_VERSION=canary bash install.sh
 ```
 
 ### Additional Environment Variables
 
 **Custom Docker Swarm Network Configuration:**
 ```bash
-export DOCKER_SWARM_INIT_ARGS="--default-addr-pool 172.20.0.0/16 --default-addr-pool-mask-length 24"
-curl -sSL https://dokploy.com/install.sh | sh
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOCKER_SWARM_INIT_ARGS="--default-addr-pool 172.20.0.0/16 --default-addr-pool-mask-length 24" bash
 ```
 
 **Manual Advertise Address:**
 ```bash
-curl -sSL https://dokploy.com/install.sh | sudo ADVERTISE_ADDR=192.168.1.100 sh
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOKPLOY_ADVERTISE_ADDR=192.168.1.100 bash
 ```
 
 Note: if you run the installer with `sudo`, pass the variable inline as shown above. Using `export` beforehand won't work because `sudo` resets the environment before executing the script.
diff --git a/apps/docs/content/docs/core/troubleshooting/networking.mdx b/apps/docs/content/docs/core/troubleshooting/networking.mdx
index 7f23435b..91727384 100644
--- a/apps/docs/content/docs/core/troubleshooting/networking.mdx
+++ b/apps/docs/content/docs/core/troubleshooting/networking.mdx
@@ -15,10 +15,13 @@ To fix this, you need to assign a the public IP address to the Docker Swarm, ide
 will need to use a public IP address.
 
 ```bash
-curl -sSL https://dokploy.com/install.sh | sudo ADVERTISE_ADDR=your-ip sh
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOKPLOY_ADVERTISE_ADDR=your-ip bash
 ```
 
-Note: pass `ADVERTISE_ADDR` inline as shown above — if you `export` it in your shell and then run the script with `sudo`, the variable won't reach the script because `sudo` resets the environment.
+Pass `DOKPLOY_ADVERTISE_ADDR` inline as shown above. If you export it in your
+shell and then run the script with `sudo`, the variable normally will not reach
+the installer because `sudo` resets the environment.
 
 
 ## Services Can't Reach Each Other (Missing IPVS Kernel Modules)
@@ -63,10 +66,12 @@ If `modprobe ip_vs` fails or the config options are missing (not set to `y` or `
 
 If you can't switch to a kernel with IPVS support, run Dokploy's services in **DNSRR mode** (DNS round-robin), which bypasses the IPVS-based load balancer entirely.
 
-**For a fresh installation**, pass `ENDPOINT_MODE=dnsrr` to the install script:
+**For a fresh installation**, pass `DOKPLOY_ENDPOINT_MODE=dnsrr` to the installer.
+Systems without the supported kernel capabilities are experimental:
 
 ```bash
-curl -sSL https://dokploy.com/install.sh | sudo ENDPOINT_MODE=dnsrr sh
+curl --fail --show-error --location https://dokploy.com/install.sh |
+  sudo env DOKPLOY_ENDPOINT_MODE=dnsrr DOKPLOY_ALLOW_UNSUPPORTED=1 bash
 ```
 
 **For an existing installation**, switch the Dokploy services to DNSRR mode:
diff --git a/apps/website/app/self-hosted-paas/page.tsx b/apps/website/app/self-hosted-paas/page.tsx
index 9400e92e..78d221aa 100644
--- a/apps/website/app/self-hosted-paas/page.tsx
+++ b/apps/website/app/self-hosted-paas/page.tsx
@@ -8,26 +8,26 @@ import {
 import AnimatedGridPattern from "@/components/ui/animated-grid-pattern";
 import { Button } from "@/components/ui/button";
 import {
-	Wallet,
-	Unlock,
-	Lock,
-	Settings2,
+	Bot,
+	CheckCircle2,
+	Cloud,
+	Cpu,
+	GitBranch,
 	KeyRound,
-	ScrollText,
-	Shield,
 	LifeBuoy,
-	ServerCog,
-	TerminalSquare,
+	Lock,
 	MonitorSmartphone,
-	GitBranch,
-	CheckCircle2,
-	Cloud,
+	ScrollText,
 	Server,
-	Bot,
-	Cpu,
+	ServerCog,
+	Settings2,
+	Shield,
+	TerminalSquare,
+	Unlock,
+	Wallet,
 } from "lucide-react";
-import Link from "next/link";
 import type { Metadata } from "next";
+import Link from "next/link";
 
 export const metadata: Metadata = {
 	title: "The Self-Hosted PaaS Built for Developers",
@@ -242,7 +242,8 @@ const faqs = [
 	},
 ];
 
-const INSTALL_COMMAND = "curl -sSL https://dokploy.com/install.sh | sh";
+const INSTALL_COMMAND =
+	"curl --fail --show-error --location https://dokploy.com/install.sh | sudo bash";
 
 export default function SelfHostedPaasPage() {
 	return (
@@ -283,7 +284,11 @@ export default function SelfHostedPaasPage() {
 								className="rounded-full bg-[#5965F2] hover:bg-[#4A55E0]"
 								asChild
 							>
-								<Link href="/contact" aria-label="Contact Us" className="text-white">
+								<Link
+									href="/contact"
+									aria-label="Contact Us"
+									className="text-white"
+								>
 									Contact Us
 								</Link>
 							</Button>
@@ -353,7 +358,9 @@ export default function SelfHostedPaasPage() {
 						</p>
 						<div className="mt-8">
 							<Button className="rounded-full" asChild>
-								<Link href="/enterprise">Learn more about Dokploy Enterprise</Link>
+								<Link href="/enterprise">
+									Learn more about Dokploy Enterprise
+								</Link>
 							</Button>
 						</div>
 					</div>
@@ -427,9 +434,9 @@ export default function SelfHostedPaasPage() {
 							Should you choose Cloud or Self-Hosted?
 						</h2>
 						<p className="mt-4 text-lg text-muted-foreground">
-							Both are great options. Every key feature available in
-							Self-Hosted is also available in Cloud, and vice versa. The choice
-							comes down to how much you want to manage yourself.
+							Both are great options. Every key feature available in Self-Hosted
+							is also available in Cloud, and vice versa. The choice comes down
+							to how much you want to manage yourself.
 						</p>
 					</div>
 					<div className="mx-auto mt-16 grid max-w-5xl gap-8 sm:grid-cols-2">
diff --git a/apps/website/components/Hero.tsx b/apps/website/components/Hero.tsx
index 289a5b4d..97b67cf7 100644
--- a/apps/website/components/Hero.tsx
+++ b/apps/website/components/Hero.tsx
@@ -104,8 +104,9 @@ export function Hero() {
 							animate={{ opacity: 1, y: 0 }}
 							transition={{ duration: 0.3, delay: 0.2 }}
 						>
-							Manage containerized deployments and AI-built apps across multiple servers with ease,
-							thanks to our all-in-one platform for developers.
+							Manage containerized deployments and AI-built apps across multiple
+							servers with ease, thanks to our all-in-one platform for
+							developers.
 						</motion.p>
 						<motion.div
 							className="flex flex-col items-center justify-center space-y-4 sm:flex-row sm:space-x-4 sm:space-y-0"
@@ -139,13 +140,14 @@ export function Hero() {
 								</div>
 								<div className="flex flex-wrap items-center justify-center gap-6 md:flex-nowrap">
 									<code className="flex flex-row items-center gap-4 rounded-xl border p-3 font-sans">
-										curl -sSL https://dokploy.com/install.sh | sh
+										curl --fail --show-error --location
+										https://dokploy.com/install.sh | sudo bash
 										<button
 											type="button"
 											onClick={() =>
 												navigator.clipboard
 													.writeText(
-														"curl -sSL https://dokploy.com/install.sh | sh",
+														"curl --fail --show-error --location https://dokploy.com/install.sh | sudo bash",
 													)
 													.then(() => setIsCopied(true))
 													.catch(() => setIsCopied(false))
diff --git a/apps/website/public/install.sh b/apps/website/public/install.sh
old mode 100644
new mode 100755
index 43a100b7..a3e6ba88
--- a/apps/website/public/install.sh
+++ b/apps/website/public/install.sh
@@ -1,410 +1,1749 @@
-#!/bin/bash
-
-# Docker version to install and maintain
-DOCKER_VERSION="28.5.0"
-
-# Detect version from environment variable or default to latest
-# Usage with curl (export first): export DOKPLOY_VERSION=canary && curl -sSL https://dokploy.com/install.sh | sh
-# Usage with curl (export first): export DOKPLOY_VERSION=latest && curl -sSL https://dokploy.com/install.sh | sh
-# Usage with curl (bash -s): DOKPLOY_VERSION=canary bash -s < <(curl -sSL https://dokploy.com/install.sh)
-# Usage with curl (default): curl -sSL https://dokploy.com/install.sh | sh (detects latest stable version)
-# Usage with bash: DOKPLOY_VERSION=canary bash install.sh
-# Usage with bash: DOKPLOY_VERSION=latest bash install.sh
-# Usage with bash: bash install.sh (detects latest stable version)
-detect_version() {
-    local version="${DOKPLOY_VERSION}"
-    
-    # If no version specified, get latest stable version from GitHub releases
-    if [ -z "$version" ]; then
-        echo "Detecting latest stable version from GitHub..." >&2
-        
-        # Try to get latest release from GitHub by following redirects
-        version=$(curl -fsSL --connect-timeout 10 -o /dev/null -w '%{url_effective}\n' \
-            https://github.com/dokploy/dokploy/releases/latest 2>/dev/null | \
-            sed 's#.*/tag/##')
-
-        # When the request fails (unreachable network, rate limit), curl still
-        # prints the attempted URL, which would produce an invalid image tag
-        # like dokploy/dokploy:https://... Accept only values that look like a
-        # release tag (e.g. v0.29.10).
-        case "$version" in
-            v[0-9]*) ;;
-            *) version="" ;;
-        esac
-
-        # Fallback to latest tag if detection fails
-        if [ -z "$version" ]; then
-            echo "Warning: Could not detect latest version from GitHub, using fallback version latest" >&2
-            version="latest"
-        else
-            echo "Latest stable version detected: $version" >&2
-        fi
-    fi
-    
-    echo "$version"
-}
-
-# Function to detect if running in Proxmox LXC container
-is_proxmox_lxc() {
-    # Check for LXC in environment
-    if [ -n "$container" ] && [ "$container" = "lxc" ]; then
-        return 0  # LXC container
-    fi
-    
-    # Check for LXC in /proc/1/environ
-    if grep -q "container=lxc" /proc/1/environ 2>/dev/null; then
-        return 0  # LXC container
-    fi
-    
-    return 1  # Not LXC
-}
-
-generate_random_password() {
-    # Generate a secure random password using multiple methods with fallbacks
-    local password=""
-    
-    # Try using openssl (most reliable, available on most systems)
-    if command -v openssl >/dev/null 2>&1; then
-        password=$(openssl rand -base64 32 | tr -d "=+/" | cut -c1-32)
-    # Fallback to /dev/urandom with tr (most Linux systems)
-    elif [ -r /dev/urandom ]; then
-        password=$(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 32)
-    # Last resort fallback using date and simple hashing
-    else
-        if command -v sha256sum >/dev/null 2>&1; then
-            password=$(date +%s%N | sha256sum | base64 | head -c 32)
-        elif command -v shasum >/dev/null 2>&1; then
-            password=$(date +%s%N | shasum -a 256 | base64 | head -c 32)
-        else
-            # Very basic fallback - combines multiple sources of entropy
-            password=$(echo "$(date +%s%N)-$(hostname)-$$-$RANDOM" | base64 | tr -d "=+/" | head -c 32)
-        fi
-    fi
-    
-    # Ensure we got a password of correct length
-    if [ -z "$password" ] || [ ${#password} -lt 20 ]; then
-        echo "Error: Failed to generate random password" >&2
-        exit 1
-    fi
-    
-    echo "$password"
-}
-
-install_dokploy() {
-    # Detect version tag
-    VERSION_TAG=$(detect_version)
-    DOCKER_IMAGE="dokploy/dokploy:${VERSION_TAG}"
-    
-    echo "Installing Dokploy version: ${VERSION_TAG}"
-    if [ "$(id -u)" != "0" ]; then
-        echo "This script must be run as root" >&2
-        exit 1
-    fi
-
-    # check if is Mac OS
-    if [ "$(uname)" = "Darwin" ]; then
-        echo "This script must be run on Linux" >&2
-        exit 1
-    fi
-
-    # check if is running inside a container
-    if [ -f /.dockerenv ]; then
-        echo "This script must be run on Linux" >&2
-        exit 1
-    fi
-
-    # check if something is running on port 80
-    if ss -tulnp | grep ':80 ' >/dev/null; then
-        echo "Error: something is already running on port 80" >&2
-        exit 1
-    fi
-
-    # check if something is running on port 443
-    if ss -tulnp | grep ':443 ' >/dev/null; then
-        echo "Error: something is already running on port 443" >&2
-        exit 1
-    fi
-
-    # check if something is running on port 3000
-    if ss -tulnp | grep ':3000 ' >/dev/null; then
-        echo "Error: something is already running on port 3000" >&2
-        echo "Dokploy requires port 3000 to be available. Please stop any service using this port." >&2
-        exit 1
-    fi
-
-    command_exists() {
-      command -v "$@" > /dev/null 2>&1
-    }
-
-    if command_exists docker; then
-      echo "Docker already installed"
-    else
-      curl -sSL https://get.docker.com | sh -s -- --version $DOCKER_VERSION
-      # Hold docker packages to prevent unintended upgrades (apt-based distros only)
-      if command_exists apt-mark; then
-        apt-mark hold docker-ce docker-ce-cli docker-ce-rootless-extras
-      fi
-    fi
-
-    # Check if running in Proxmox LXC container and set endpoint mode
-    endpoint_mode=""
-    if [ "$ENDPOINT_MODE" = "dnsrr" ]; then
-        echo "ENDPOINT_MODE=dnsrr set — adding --endpoint-mode dnsrr to Docker services."
-        echo "Use this on kernels without IPVS support (e.g. ZimaOS / Buildroot-based images)."
-        echo ""
-        endpoint_mode="--endpoint-mode dnsrr"
-    elif is_proxmox_lxc; then
-        echo "⚠️ WARNING: Detected Proxmox LXC container environment!"
-        echo "Adding --endpoint-mode dnsrr to Docker services for LXC compatibility."
-        echo "This may affect service discovery but is required for LXC containers."
-        echo ""
-        endpoint_mode="--endpoint-mode dnsrr"
-        echo "Waiting for 5 seconds before continuing..."
-        sleep 5
-    fi
-
-
-    docker swarm leave --force 2>/dev/null
-
-    get_ip() {
-        local ip=""
-        
-        # Try IPv4 first
-        # First attempt: ifconfig.io
-        ip=$(curl -4s --connect-timeout 5 https://ifconfig.io 2>/dev/null)
-        
-        # Second attempt: icanhazip.com
-        if [ -z "$ip" ]; then
-            ip=$(curl -4s --connect-timeout 5 https://icanhazip.com 2>/dev/null)
-        fi
-        
-        # Third attempt: ipecho.net
-        if [ -z "$ip" ]; then
-            ip=$(curl -4s --connect-timeout 5 https://ipecho.net/plain 2>/dev/null)
-        fi
-
-        # If no IPv4, try IPv6
-        if [ -z "$ip" ]; then
-            # Try IPv6 with ifconfig.io
-            ip=$(curl -6s --connect-timeout 5 https://ifconfig.io 2>/dev/null)
-            
-            # Try IPv6 with icanhazip.com
-            if [ -z "$ip" ]; then
-                ip=$(curl -6s --connect-timeout 5 https://icanhazip.com 2>/dev/null)
-            fi
-            
-            # Try IPv6 with ipecho.net
-            if [ -z "$ip" ]; then
-                ip=$(curl -6s --connect-timeout 5 https://ipecho.net/plain 2>/dev/null)
-            fi
-        fi
-
-        if [ -z "$ip" ]; then
-            echo "Error: Could not determine server IP address automatically (neither IPv4 nor IPv6)." >&2
-            echo "Please set the ADVERTISE_ADDR environment variable manually." >&2
-            echo "Example: export ADVERTISE_ADDR=<your-server-ip>" >&2
-            exit 1
-        fi
-
-        echo "$ip"
-    }
-
-    get_private_ip() {
-        # Pick the first private (RFC1918) IP from a real interface. Docker-created
-        # interfaces (docker0, br-*, veth*) are excluded: their IPs (e.g. 172.17.0.1)
-        # are host-local and never reachable from other swarm nodes.
-        ip -o -4 addr show scope global \
-            | awk '$2 !~ /^(docker|br-|veth)/ {print $4}' \
-            | cut -d/ -f1 \
-            | grep -E "^(192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.)" \
-            | head -n1
-    }
-
-    advertise_addr="${ADVERTISE_ADDR:-$(get_private_ip)}"
-
-    # Servers with only a public IP have no private interface: fall back to the public IP
-    if [ -z "$advertise_addr" ]; then
-        advertise_addr=$(get_ip)
-    fi
-
-    if [ -z "$advertise_addr" ]; then
-        echo "ERROR: We couldn't detect your server IP address."
-        echo "Please set the ADVERTISE_ADDR environment variable manually."
-        echo "Example: curl -sSL https://dokploy.com/install.sh | sudo ADVERTISE_ADDR=192.168.1.100 sh"
-        exit 1
-    fi
-    echo "Using advertise address: $advertise_addr"
-
-    # Allow custom Docker Swarm init arguments via DOCKER_SWARM_INIT_ARGS environment variable
-    # Example: export DOCKER_SWARM_INIT_ARGS="--default-addr-pool 172.20.0.0/16 --default-addr-pool-mask-length 24"
-    # This is useful to avoid CIDR overlapping with cloud provider VPCs (e.g., AWS)
-    swarm_init_args="${DOCKER_SWARM_INIT_ARGS:-}"
-    
-    if [ -n "$swarm_init_args" ]; then
-        echo "Using custom swarm init arguments: $swarm_init_args"
-        docker swarm init --advertise-addr $advertise_addr $swarm_init_args
-    else
-        docker swarm init --advertise-addr $advertise_addr
-    fi
-    
-     if [ $? -ne 0 ]; then
-        echo "Error: Failed to initialize Docker Swarm" >&2
-        exit 1
-    fi
-
-    echo "Swarm initialized"
-
-    docker network rm -f dokploy-network 2>/dev/null
-    docker network create --driver overlay --attachable dokploy-network
-
-    echo "Network created"
-
-    mkdir -p /etc/dokploy
-
-    chmod 777 /etc/dokploy
-
-    # Generate secure random password for Postgres
-    POSTGRES_PASSWORD=$(generate_random_password)
-
-    # Store password as Docker Secret (encrypted and secure)
-    echo "$POSTGRES_PASSWORD" | docker secret create dokploy_postgres_password - 2>/dev/null || true
-
-    # Generate secure auth secret for Better Auth
-    AUTH_SECRET=$(openssl rand -hex 32)
-
-    # Store auth secret as Docker Secret (encrypted and secure)
-    echo "$AUTH_SECRET" | docker secret create dokploy_auth_secret - 2>/dev/null || true
-
-    echo "Generated secure database credentials and auth secret (stored in Docker Secrets)"
-
-    docker service create \
-    --name dokploy-postgres \
-    --constraint 'node.role==manager' \
-    --network dokploy-network \
-    --env POSTGRES_USER=dokploy \
-    --env POSTGRES_DB=dokploy \
-    --secret source=dokploy_postgres_password,target=/run/secrets/postgres_password \
-    --env POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password \
-    --mount type=volume,source=dokploy-postgres,target=/var/lib/postgresql/data \
-    $endpoint_mode \
-    postgres:16
-
-    # Installation
-    # Set RELEASE_TAG environment variable for canary/feature versions
-    # POSIX-compatible (no [[ ]]): the script is documented as `curl ... | sh`,
-    # and on Debian/Ubuntu sh is dash, which has no [[ or =~ (issue #157)
-    release_tag_env=""
-    case "$VERSION_TAG" in
-        v[0-9]*.[0-9]*.[0-9]*)
-            # Specific version (v0.26.6, v0.26.7, etc.) → latest
-            release_tag_env="-e RELEASE_TAG=latest"
-            ;;
-        latest)
-            ;;
-        *)
-            # canary, feature/*, etc. → use the tag as-is
-            release_tag_env="-e RELEASE_TAG=$VERSION_TAG"
-            ;;
-    esac
-    
-    docker service create \
-      --name dokploy \
-      --replicas 1 \
-      --network dokploy-network \
-      --mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock \
-      --mount type=bind,source=/etc/dokploy,target=/etc/dokploy \
-      --mount type=volume,source=dokploy,target=/root/.docker \
-      --secret source=dokploy_postgres_password,target=/run/secrets/postgres_password \
-      --secret source=dokploy_auth_secret,target=/run/secrets/dokploy_auth_secret \
-      --publish published=3000,target=3000,mode=host \
-      --update-parallelism 1 \
-      --update-order stop-first \
-      --constraint 'node.role == manager' \
-      $endpoint_mode \
-      $release_tag_env \
-      -e POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password \
-      -e BETTER_AUTH_SECRET_FILE=/run/secrets/dokploy_auth_secret \
-      $DOCKER_IMAGE
-
-    sleep 4
-
-    docker run -d \
-        --name dokploy-traefik \
-        --restart always \
-        -v /etc/dokploy/traefik/traefik.yml:/etc/traefik/traefik.yml \
-        -v /etc/dokploy/traefik/dynamic:/etc/dokploy/traefik/dynamic \
-        -v /var/run/docker.sock:/var/run/docker.sock:ro \
-        -p 80:80/tcp \
-        -p 443:443/tcp \
-        -p 443:443/udp \
-        traefik:v3.6.7
-    
-    docker network connect dokploy-network dokploy-traefik
-
-
-    # Optional: Use docker service create instead of docker run
-    #   docker service create \
-    #     --name dokploy-traefik \
-    #     --constraint 'node.role==manager' \
-    #     --network dokploy-network \
-    #     --mount type=bind,source=/etc/dokploy/traefik/traefik.yml,target=/etc/traefik/traefik.yml \
-    #     --mount type=bind,source=/etc/dokploy/traefik/dynamic,target=/etc/dokploy/traefik/dynamic \
-    #     --mount type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock \
-    #     --publish mode=host,published=443,target=443 \
-    #     --publish mode=host,published=80,target=80 \
-    #     --publish mode=host,published=443,target=443,protocol=udp \
-    #     traefik:v3.6.7
-
-    GREEN="\033[0;32m"
-    YELLOW="\033[1;33m"
-    BLUE="\033[0;34m"
-    NC="\033[0m" # No Color
-
-    format_ip_for_url() {
-        local ip="$1"
-        if echo "$ip" | grep -q ':'; then
-            # IPv6
-            echo "[${ip}]"
-        else
-            # IPv4
-            echo "${ip}"
-        fi
-    }
-
-    public_ip="${ADVERTISE_ADDR:-$(get_ip)}"
-    private_ip=$(get_private_ip)
-    formatted_addr=$(format_ip_for_url "$public_ip")
-    echo ""
-    printf "${GREEN}Congratulations, Dokploy is installed!${NC}\n"
-    printf "${BLUE}Wait 15 seconds for the server to start${NC}\n"
-    printf "${YELLOW}Please go to http://${formatted_addr}:3000${NC}\n"
-    # Home servers and local VMs are often not reachable on their public IP
-    # (no port forwarding), so also print the private IP when there is one.
-    if [ -n "$private_ip" ] && [ "$private_ip" != "$public_ip" ]; then
-        printf "${YELLOW}If you are on the same local network, use http://${private_ip}:3000${NC}\n"
-    fi
-    printf "\n"
-}
-
-update_dokploy() {
-    # Detect version tag
-    VERSION_TAG=$(detect_version)
-    DOCKER_IMAGE="dokploy/dokploy:${VERSION_TAG}"
-
-    echo "Updating Dokploy to version: ${VERSION_TAG}"
-
-    # Pull the image
-    docker pull $DOCKER_IMAGE
-
-    # Update the service
-    docker service update --image $DOCKER_IMAGE dokploy
-
-    echo "Dokploy has been updated to version: ${VERSION_TAG}"
-}
-
-# Main script execution
-if [ "$1" = "update" ]; then
-    update_dokploy
+#!/usr/bin/env bash
+# Dokploy production installer
+#
+# Supported: Ubuntu 22.04/24.04 and Debian 12 on amd64 or arm64.
+# Experimental: other systemd-based Linux distributions with an existing,
+# supported Docker Engine installation. Docker/OpenVZ containers, rootless,
+# Snap, Podman, Docker Desktop, and remote Docker daemons are unsupported.
+#
+# Run as root with Bash 4.3 or newer. Use DOKPLOY_INSTALL_ACTION=check for a
+# non-destructive preflight. Important settings are documented in
+# https://docs.dokploy.com/docs/core/installation. Logs and sanitized failure diagnostics are written to
+# /var/log/dokploy by default. Secret material is created with mode 0600, is
+# never logged, and is stored in Docker secrets.
+#
+# Version pinning: DOKPLOY_VERSION=v0.29.13 bash install.sh
+# Debug tracing: DEBUG=1 bash install.sh (secret operations disable tracing)
+
+set -Eeuo pipefail
+IFS=$'\n\t'
+umask 077
+
+readonly INSTALLER_VERSION="2.0.0"
+readonly MINIMUM_BASH_MAJOR=4
+readonly MINIMUM_BASH_MINOR=3
+readonly MINIMUM_KERNEL_MAJOR=5
+readonly MINIMUM_KERNEL_MINOR=4
+readonly HARD_MINIMUM_MEMORY_MB=1024
+readonly MINIMUM_MEMORY_MB=2048
+readonly RECOMMENDED_MEMORY_MB=4096
+readonly MINIMUM_DISK_MB=10240
+readonly RECOMMENDED_DISK_MB=30720
+readonly MINIMUM_DOCKER_MAJOR=24
+readonly MINIMUM_COMPOSE_MAJOR=2
+readonly MINIMUM_COMPOSE_MINOR=20
+readonly DOCKER_GPG_FINGERPRINT="9DC858229FC7DD38854AE2D88D81803C0EBFCD88"
+readonly DOKPLOY_IMAGE_REPOSITORY="dokploy/dokploy"
+readonly POSTGRES_IMAGE="postgres:16"
+readonly TRAEFIK_IMAGE="traefik:v3.6.7"
+readonly SUPPORT_URL="https://docs.dokploy.com/docs/core/installation"
+readonly SUPPORT_CHANNEL="https://discord.gg/2tBnJ3jDJc"
+
+# Central configuration. See the installation documentation for formats and security notes.
+DOKPLOY_VERSION="${DOKPLOY_VERSION:-latest}"
+DOKPLOY_DATA_DIR="${DOKPLOY_DATA_DIR:-/etc/dokploy}"
+DOKPLOY_HTTP_PORT="${DOKPLOY_HTTP_PORT:-80}"
+DOKPLOY_HTTPS_PORT="${DOKPLOY_HTTPS_PORT:-443}"
+DOKPLOY_APP_PORT="${DOKPLOY_APP_PORT:-3000}"
+DOKPLOY_DOMAIN="${DOKPLOY_DOMAIN:-}"
+DOKPLOY_EMAIL="${DOKPLOY_EMAIL:-}"
+DOKPLOY_TIMEZONE="${DOKPLOY_TIMEZONE:-UTC}"
+DOKPLOY_NETWORK_NAME="${DOKPLOY_NETWORK_NAME:-dokploy-network}"
+DOKPLOY_ADVERTISE_ADDR="${DOKPLOY_ADVERTISE_ADDR:-${ADVERTISE_ADDR:-}}"
+DOKPLOY_INSTALL_ACTION="${DOKPLOY_INSTALL_ACTION:-auto}"
+DOKPLOY_LOG_DIR="${DOKPLOY_LOG_DIR:-/var/log/dokploy}"
+DOKPLOY_BACKUP_DIR="${DOKPLOY_BACKUP_DIR:-/var/backups/dokploy}"
+DOKPLOY_SKIP_DOCKER_INSTALL="${DOKPLOY_SKIP_DOCKER_INSTALL:-0}"
+DOKPLOY_NONINTERACTIVE="${DOKPLOY_NONINTERACTIVE:-0}"
+DOKPLOY_ALLOW_PORT_CONFLICT="${DOKPLOY_ALLOW_PORT_CONFLICT:-0}"
+DOKPLOY_ALLOW_UNSUPPORTED="${DOKPLOY_ALLOW_UNSUPPORTED:-0}"
+DOKPLOY_ALLOW_LOW_RESOURCES="${DOKPLOY_ALLOW_LOW_RESOURCES:-0}"
+DOKPLOY_SKIP_TRAEFIK="${DOKPLOY_SKIP_TRAEFIK:-0}"
+DOKPLOY_DIAGNOSTICS="${DOKPLOY_DIAGNOSTICS:-1}"
+DOKPLOY_HEALTH_ATTEMPTS="${DOKPLOY_HEALTH_ATTEMPTS:-45}"
+DOKPLOY_HEALTH_INTERVAL="${DOKPLOY_HEALTH_INTERVAL:-2}"
+DOKPLOY_STABILIZATION_SECONDS="${DOKPLOY_STABILIZATION_SECONDS:-10}"
+DOKPLOY_DOCKER_VERSION="${DOKPLOY_DOCKER_VERSION:-28.5}"
+DOKPLOY_MIN_UPGRADE_VERSION="${DOKPLOY_MIN_UPGRADE_VERSION:-}"
+DOKPLOY_ALLOW_BREAKING_UPGRADE="${DOKPLOY_ALLOW_BREAKING_UPGRADE:-0}"
+DOKPLOY_ROLLBACK_COMPATIBILITY_FILE="${DOKPLOY_ROLLBACK_COMPATIBILITY_FILE:-${DOKPLOY_DATA_DIR}/installer-rollback-compatible}"
+DOKPLOY_REUSE_EXISTING_SWARM="${DOKPLOY_REUSE_EXISTING_SWARM:-0}"
+DOKPLOY_ENDPOINT_MODE="${DOKPLOY_ENDPOINT_MODE:-${ENDPOINT_MODE:-auto}}"
+DOKPLOY_LOCK_FILE="${DOKPLOY_LOCK_FILE:-/var/lock/dokploy-installer.lock}"
+DRY_RUN="${DRY_RUN:-0}"
+DEBUG="${DEBUG:-0}"
+NO_COLOR="${NO_COLOR:-}"
+
+LOG_FILE=""
+DIAGNOSTICS_FILE=""
+TMP_DIR=""
+LOCK_FILE="$DOKPLOY_LOCK_FILE"
+CURRENT_PHASE="initialization"
+START_EPOCH=0
+INSTALLATION_STATE="unknown"
+SELECTED_ACTION=""
+TARGET_VERSION=""
+TARGET_IMAGE=""
+TARGET_IMAGE_DIGEST=""
+POSTGRES_IMAGE_DIGEST=""
+TRAEFIK_IMAGE_DIGEST=""
+INSTALLED_VERSION="none"
+INSTALLED_IMAGE=""
+UPGRADE_TYPE="none"
+ROLLBACK_SUPPORTED="no"
+BACKUP_PATH=""
+HOST_CONFIG_BACKUP_PATH=""
+PLATFORM_ID="unknown"
+PLATFORM_VERSION="unknown"
+PLATFORM_CLASS="unsupported"
+PACKAGE_MANAGER="unknown"
+INIT_SYSTEM="unknown"
+ARCHITECTURE="unknown"
+VIRTUALIZATION="none"
+KERNEL_VERSION="unknown"
+MEMORY_MB=0
+SWAP_MB=0
+INSTALL_FREE_MB=0
+BACKUP_FREE_MB=0
+DOCKER_FREE_MB=0
+TMP_FREE_MB=0
+FILESYSTEM_TYPE="unknown"
+BACKUP_FILESYSTEM_TYPE="unknown"
+DOCKER_AVAILABLE=0
+DOCKER_DAEMON_AVAILABLE=0
+DOCKER_VERSION="not installed"
+COMPOSE_VERSION="not installed"
+DOCKER_STORAGE_DRIVER="unknown"
+DOCKER_ROOT_DIR="unknown"
+SWARM_STATE="unknown"
+ENDPOINT_MODE=""
+PREFLIGHT_FAILURES=0
+PREFLIGHT_WARNINGS=0
+FAILURE_HANDLED=0
+INSTALL_SUCCEEDED=0
+CREATED_NETWORK=0
+CREATED_DOKPLOY_SERVICE=0
+CREATED_POSTGRES_SERVICE=0
+CREATED_TRAEFIK_CONTAINER=0
+CREATED_POSTGRES_SECRET=0
+CREATED_AUTH_SECRET=0
+ROLLBACK_ATTEMPTED="no"
+ROLLBACK_RESULT="not attempted"
+TRACE_WAS_ENABLED=0
+STEP_NUMBER=0
+
+if [[ -t 1 && -z "$NO_COLOR" ]]; then
+	readonly COLOR_GREEN=$'\033[0;32m'
+	readonly COLOR_YELLOW=$'\033[1;33m'
+	readonly COLOR_RED=$'\033[0;31m'
+	readonly COLOR_BLUE=$'\033[0;34m'
+	readonly COLOR_RESET=$'\033[0m'
 else
-    install_dokploy
-fi
\ No newline at end of file
+	readonly COLOR_GREEN=""
+	readonly COLOR_YELLOW=""
+	readonly COLOR_RED=""
+	readonly COLOR_BLUE=""
+	readonly COLOR_RESET=""
+fi
+
+# Print a timestamped message. Arguments must not contain secrets.
+log() {
+	printf '%s %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$*"
+}
+
+section() {
+	STEP_NUMBER=$((STEP_NUMBER + 1))
+	printf '\n%s== [%s] %s ==%s\n' "$COLOR_BLUE" "$STEP_NUMBER" "$1" "$COLOR_RESET"
+}
+
+ok() {
+	printf '%s[OK]%s %s\n' "$COLOR_GREEN" "$COLOR_RESET" "$1"
+}
+
+warn() {
+	PREFLIGHT_WARNINGS=$((PREFLIGHT_WARNINGS + 1))
+	printf '%s[WARN]%s %s\n' "$COLOR_YELLOW" "$COLOR_RESET" "$1" >&2
+}
+
+audit_command() {
+	local rendered="" argument
+	for argument in "$@"; do
+		printf -v rendered '%s%q ' "$rendered" "$argument"
+	done
+	printf '%s RUN %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "${rendered% }" >&2
+}
+
+run_logged() {
+	audit_command "$@"
+	"$@"
+}
+
+failure_guidance() {
+	case "$CURRENT_PHASE" in
+		*port*) printf 'Likely cause: a configured host port is owned by another proxy, container, or system service.\n' >&2 ;;
+		*Docker\ installation*) printf 'Likely cause: the signed Docker repository, requested package version, or systemd service is unavailable.\n' >&2 ;;
+		*network\ connectivity* | *version\ resolution* | *image\ download*) printf 'Likely cause: DNS, proxy, TLS trust, system clock, GitHub, or registry connectivity failed.\n' >&2 ;;
+		*backup*) printf 'Likely cause: PostgreSQL is unavailable or the protected backup filesystem lacks space/permissions.\n' >&2 ;;
+		*reverse\ proxy*) printf 'Likely cause: Traefik configuration was not generated, a port is occupied, or Docker network attachment failed.\n' >&2 ;;
+		*health*) printf 'Likely cause: a service is restarting, PostgreSQL is unavailable, the app endpoint failed, or required mounts/networks are missing.\n' >&2 ;;
+		*rollback*) printf 'Recovery requires the prior image/configuration and a database-compatible migration path.\n' >&2 ;;
+		*) printf 'Review the failed phase and the immediately preceding log entries for the rejected operation.\n' >&2 ;;
+	esac
+}
+
+fail_check() {
+	PREFLIGHT_FAILURES=$((PREFLIGHT_FAILURES + 1))
+	printf '%s[FAIL]%s %s\n' "$COLOR_RED" "$COLOR_RESET" "$1" >&2
+}
+
+# Exit with a consistent, supportable error. The ERR trap is suppressed while
+# this function exits so the original phase and message remain visible.
+error() {
+	local message="${1:-Unknown error}"
+	FAILURE_HANDLED=1
+	printf '\n%sERROR:%s %s\n' "$COLOR_RED" "$COLOR_RESET" "$message" >&2
+	printf 'Failed phase: %s\n' "$CURRENT_PHASE" >&2
+	failure_guidance
+	[[ -n "$LOG_FILE" ]] && printf 'Installation log: %s\n' "$LOG_FILE" >&2
+	printf 'Documentation: %s\nSupport: %s\n' "$SUPPORT_URL" "$SUPPORT_CHANNEL" >&2
+	exit 1
+}
+
+# ERR handler: report location without printing BASH_COMMAND, which may contain
+# credentials supplied by the caller.
+on_error() {
+	local exit_code=$?
+	local line_number="${1:-unknown}"
+	((FAILURE_HANDLED == 1)) && return "$exit_code"
+	FAILURE_HANDLED=1
+	printf '\n%sERROR:%s Unexpected command failure at line %s (exit %s).\n' \
+		"$COLOR_RED" "$COLOR_RESET" "$line_number" "$exit_code" >&2
+	printf 'Failed phase: %s\n' "$CURRENT_PHASE" >&2
+	failure_guidance
+	[[ -n "$LOG_FILE" ]] && printf 'Installation log: %s\n' "$LOG_FILE" >&2
+	return "$exit_code"
+}
+
+on_signal() {
+	FAILURE_HANDLED=1
+	printf '\nInstallation interrupted during %s. Existing user data will be preserved.\n' "$CURRENT_PHASE" >&2
+	exit 130
+}
+
+# Remove only temporary files and resources positively identified as created by
+# this failed fresh-install run. Persistent volumes and user data are untouched.
+cleanup() {
+	local exit_code=$?
+	set +e
+	if ((exit_code != 0 && INSTALL_SUCCEEDED == 0)); then
+		if [[ "$DOKPLOY_DIAGNOSTICS" == "1" && "$DOKPLOY_INSTALL_ACTION" != "check" && "$DRY_RUN" != "1" ]]; then
+			generate_diagnostics_bundle || true
+		fi
+		cleanup_partial_install
+	fi
+	if [[ -n "$TMP_DIR" && -d "$TMP_DIR" ]]; then
+		rm -rf -- "$TMP_DIR"
+	fi
+	if ((exit_code != 0)); then
+		printf 'Recovery status: %s\nRollback attempted: %s\n' "$ROLLBACK_RESULT" "$ROLLBACK_ATTEMPTED" >&2
+		[[ -n "$DIAGNOSTICS_FILE" ]] && printf 'Diagnostics: %s\n' "$DIAGNOSTICS_FILE" >&2
+	fi
+	log "Dokploy installer ended with exit code $exit_code after $(($(date +%s) - START_EPOCH))s"
+	exit "$exit_code"
+}
+
+enable_debug_trace() {
+	if [[ "$DEBUG" == "1" ]]; then
+		TRACE_WAS_ENABLED=1
+		export PS4='+ ${BASH_SOURCE##*/}:${LINENO}:${FUNCNAME[0]:-main}: '
+		set -x
+	fi
+}
+
+trace_off() {
+	case "$-" in
+		*x*)
+			TRACE_WAS_ENABLED=1
+			set +x
+			;;
+		*) TRACE_WAS_ENABLED=0 ;;
+	esac
+}
+
+trace_restore() {
+	((TRACE_WAS_ENABLED == 1)) && set -x
+}
+
+validate_bool() {
+	local name="$1"
+	local value="$2"
+	[[ "$value" == "0" || "$value" == "1" ]] || error "$name must be 0 or 1 (received: $value)"
+}
+
+validate_port() {
+	local port="$1"
+	[[ "$port" =~ ^[0-9]+$ ]] && ((port >= 1 && port <= 65535))
+}
+
+validate_path() {
+	local value="$1"
+	[[ "$value" == /* && "$value" != *$'\n'* && "$value" != *$'\r'* ]]
+}
+
+validate_safe_directory() {
+	local value="$1"
+	validate_path "$value" || return 1
+	case "$value" in
+		/ | /bin | /boot | /dev | /etc | /home | /lib | /lib64 | /opt | /proc | /root | /run | /sbin | /srv | /sys | /tmp | /usr | /var) return 1 ;;
+	esac
+	return 0
+}
+
+validate_version() {
+	local version="$1"
+	[[ "$version" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([.-][A-Za-z0-9][A-Za-z0-9.-]*)?$ || "$version" == "latest" || "$version" == "canary" ]]
+}
+
+# Validate every supported environment input before host mutation. Populates no
+# external state and terminates with a named input error on invalid data.
+validate_configuration() {
+	CURRENT_PHASE="configuration validation"
+	local name
+	for name in DOKPLOY_SKIP_DOCKER_INSTALL DOKPLOY_NONINTERACTIVE DOKPLOY_ALLOW_PORT_CONFLICT \
+		DOKPLOY_ALLOW_UNSUPPORTED DOKPLOY_ALLOW_LOW_RESOURCES DOKPLOY_SKIP_TRAEFIK \
+		DOKPLOY_DIAGNOSTICS DOKPLOY_ALLOW_BREAKING_UPGRADE DOKPLOY_REUSE_EXISTING_SWARM DRY_RUN DEBUG; do
+		validate_bool "$name" "${!name}"
+	done
+	validate_port "$DOKPLOY_HTTP_PORT" || error "DOKPLOY_HTTP_PORT must be an integer from 1 to 65535"
+	validate_port "$DOKPLOY_HTTPS_PORT" || error "DOKPLOY_HTTPS_PORT must be an integer from 1 to 65535"
+	validate_port "$DOKPLOY_APP_PORT" || error "DOKPLOY_APP_PORT must be an integer from 1 to 65535"
+	[[ "$DOKPLOY_HTTP_PORT" != "$DOKPLOY_HTTPS_PORT" && "$DOKPLOY_HTTP_PORT" != "$DOKPLOY_APP_PORT" && "$DOKPLOY_HTTPS_PORT" != "$DOKPLOY_APP_PORT" ]] ||
+		error "HTTP, HTTPS, and application ports must be distinct"
+	validate_safe_directory "$DOKPLOY_DATA_DIR" || error "DOKPLOY_DATA_DIR must be a dedicated absolute directory, not a system root"
+	validate_safe_directory "$DOKPLOY_LOG_DIR" || error "DOKPLOY_LOG_DIR must be a dedicated absolute directory, not a system root"
+	validate_safe_directory "$DOKPLOY_BACKUP_DIR" || error "DOKPLOY_BACKUP_DIR must be a dedicated absolute directory, not a system root"
+	validate_path "$DOKPLOY_ROLLBACK_COMPATIBILITY_FILE" || error "DOKPLOY_ROLLBACK_COMPATIBILITY_FILE must be an absolute path"
+	validate_path "$DOKPLOY_LOCK_FILE" || error "DOKPLOY_LOCK_FILE must be an absolute path"
+	[[ "$DOKPLOY_BACKUP_DIR/" != "$DOKPLOY_DATA_DIR/"* ]] || error "DOKPLOY_BACKUP_DIR must not be inside DOKPLOY_DATA_DIR"
+	[[ ! -L "$DOKPLOY_DATA_DIR" && ! -L "$DOKPLOY_LOG_DIR" && ! -L "$DOKPLOY_BACKUP_DIR" ]] || error "Dokploy data, log, and backup directories must not be symbolic links"
+	[[ "$DOKPLOY_NETWORK_NAME" =~ ^[A-Za-z0-9][A-Za-z0-9_.-]{0,62}$ ]] || error "Invalid DOKPLOY_NETWORK_NAME"
+	validate_version "$DOKPLOY_VERSION" || error "Invalid DOKPLOY_VERSION: $DOKPLOY_VERSION"
+	[[ -z "$DOKPLOY_MIN_UPGRADE_VERSION" || "$DOKPLOY_MIN_UPGRADE_VERSION" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+$ ]] || error "DOKPLOY_MIN_UPGRADE_VERSION must be an explicit release version"
+	[[ "$DOKPLOY_DOCKER_VERSION" =~ ^[0-9]+\.[0-9]+(\.[0-9]+)?$ ]] || error "DOKPLOY_DOCKER_VERSION must be a numeric version prefix"
+	[[ "$DOKPLOY_ENDPOINT_MODE" =~ ^(auto|vip|dnsrr)$ ]] || error "DOKPLOY_ENDPOINT_MODE must be auto, vip, or dnsrr"
+	[[ "$DOKPLOY_ADVERTISE_ADDR" != *$'\n'* && "$DOKPLOY_ADVERTISE_ADDR" != *$'\r'* ]] || error "DOKPLOY_ADVERTISE_ADDR must not contain newlines"
+	[[ "$DOKPLOY_INSTALL_ACTION" =~ ^(auto|install|upgrade|repair|abort|check)$ ]] || error "DOKPLOY_INSTALL_ACTION must be auto, install, upgrade, repair, abort, or check"
+	[[ "$DOKPLOY_HEALTH_ATTEMPTS" =~ ^[0-9]+$ && "$DOKPLOY_HEALTH_ATTEMPTS" -gt 0 ]] || error "DOKPLOY_HEALTH_ATTEMPTS must be positive"
+	[[ "$DOKPLOY_HEALTH_INTERVAL" =~ ^[0-9]+$ && "$DOKPLOY_HEALTH_INTERVAL" -gt 0 ]] || error "DOKPLOY_HEALTH_INTERVAL must be positive"
+	[[ "$DOKPLOY_STABILIZATION_SECONDS" =~ ^[0-9]+$ ]] || error "DOKPLOY_STABILIZATION_SECONDS must be zero or positive"
+	[[ -z "$DOKPLOY_DOMAIN" || "$DOKPLOY_DOMAIN" =~ ^([A-Za-z0-9]([A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z]{2,63}$ ]] || error "Invalid DOKPLOY_DOMAIN"
+	[[ -z "$DOKPLOY_EMAIL" || "$DOKPLOY_EMAIL" =~ ^[^[:space:]@]+@[^[:space:]@]+\.[^[:space:]@]+$ ]] || error "Invalid DOKPLOY_EMAIL"
+	[[ "$DOKPLOY_TIMEZONE" =~ ^[A-Za-z0-9_+/-]+$ && -e "/usr/share/zoneinfo/$DOKPLOY_TIMEZONE" ]] || error "Invalid DOKPLOY_TIMEZONE"
+	if [[ "$DRY_RUN" == "1" ]]; then
+		DOKPLOY_INSTALL_ACTION="check"
+	fi
+}
+
+# Configure a persistent combined stdout/stderr log. Check mode is deliberately
+# write-free and therefore only writes to the caller's stdout.
+configure_logging() {
+	CURRENT_PHASE="logging setup"
+	START_EPOCH=$(date +%s)
+	if [[ "$DOKPLOY_INSTALL_ACTION" == "check" || "$DRY_RUN" == "1" ]]; then
+		LOG_FILE="check mode: no file created"
+		return
+	fi
+	mkdir -p -- "$DOKPLOY_LOG_DIR" || error "Cannot create log directory $DOKPLOY_LOG_DIR"
+	chmod 0750 "$DOKPLOY_LOG_DIR"
+	LOG_FILE="$DOKPLOY_LOG_DIR/install-$(date -u +%Y%m%dT%H%M%SZ).log"
+	touch "$LOG_FILE"
+	chmod 0600 "$LOG_FILE"
+	exec > >(tee -a "$LOG_FILE") 2>&1
+}
+
+acquire_lock() {
+	CURRENT_PHASE="installation lock"
+	[[ "$DOKPLOY_INSTALL_ACTION" == "check" ]] && return
+	command -v flock >/dev/null 2>&1 || error "flock is required (install util-linux)"
+	mkdir -p -- "$(dirname "$LOCK_FILE")"
+	[[ ! -L "$LOCK_FILE" ]] || error "Installer lock file must not be a symbolic link: $LOCK_FILE"
+	exec 9>>"$LOCK_FILE"
+	flock -n 9 || error "Another Dokploy installation process is running"
+}
+
+validate_privileges() {
+	CURRENT_PHASE="privilege validation"
+	if ((EUID != 0)); then
+		if [[ "$DOKPLOY_INSTALL_ACTION" == "check" ]]; then
+			fail_check "Root privileges are required for installation (check mode will continue)"
+		else
+			error "This installer must run as root because it manages Docker, system services, and /etc/dokploy"
+		fi
+	else
+		ok "Running with required root privileges"
+	fi
+}
+
+command_exists() {
+	command -v "$1" >/dev/null 2>&1
+}
+
+os_release_value() {
+	local key="$1"
+	awk -F= -v key="$key" '$1 == key {value=substr($0, index($0, "=") + 1); gsub(/^"|"$/, "", value); print value; exit}' /etc/os-release
+}
+
+# Detect OS support class, package manager, init, architecture, kernel, and
+# virtualization. Reads host metadata and sets platform globals; changes nothing.
+detect_platform() {
+	CURRENT_PHASE="platform detection"
+	[[ "${BASH_VERSINFO[0]}" -gt "$MINIMUM_BASH_MAJOR" ||
+		("${BASH_VERSINFO[0]}" -eq "$MINIMUM_BASH_MAJOR" && "${BASH_VERSINFO[1]}" -ge "$MINIMUM_BASH_MINOR") ]] ||
+		error "Bash ${MINIMUM_BASH_MAJOR}.${MINIMUM_BASH_MINOR} or newer is required"
+	[[ "$(uname -s)" == "Linux" ]] || error "Dokploy supports Linux servers only"
+
+	if [[ -r /etc/os-release ]]; then
+		PLATFORM_ID=$(os_release_value ID)
+		PLATFORM_VERSION=$(os_release_value VERSION_ID)
+		[[ "$PLATFORM_ID" =~ ^[a-z0-9._-]+$ ]] || error "Invalid ID in /etc/os-release"
+		[[ "$PLATFORM_VERSION" =~ ^[A-Za-z0-9._-]+$ ]] || error "Invalid VERSION_ID in /etc/os-release"
+	fi
+	case "$PLATFORM_ID:$PLATFORM_VERSION" in
+		ubuntu:22.04 | ubuntu:24.04 | debian:12*) PLATFORM_CLASS="supported" ;;
+		ubuntu:* | debian:*) PLATFORM_CLASS="experimental" ;;
+		*) PLATFORM_CLASS="experimental" ;;
+	esac
+	if command_exists apt-get; then
+		PACKAGE_MANAGER="apt"
+	elif command_exists dnf; then
+		PACKAGE_MANAGER="dnf"
+	elif command_exists yum; then
+		PACKAGE_MANAGER="yum"
+	elif command_exists zypper; then
+		PACKAGE_MANAGER="zypper"
+	elif command_exists pacman; then
+		PACKAGE_MANAGER="pacman"
+	fi
+	if command_exists systemctl && [[ "$(ps -p 1 -o comm= 2>/dev/null || true)" == "systemd" ]]; then
+		INIT_SYSTEM="systemd"
+	else
+		INIT_SYSTEM="unsupported"
+	fi
+	case "$(uname -m)" in
+		x86_64 | amd64) ARCHITECTURE="amd64" ;;
+		aarch64 | arm64) ARCHITECTURE="arm64" ;;
+		*) ARCHITECTURE="unsupported" ;;
+	esac
+	KERNEL_VERSION="$(uname -r)"
+	if command_exists systemd-detect-virt; then
+		VIRTUALIZATION="$(systemd-detect-virt 2>/dev/null || printf 'none')"
+	elif [[ -f /.dockerenv ]]; then
+		VIRTUALIZATION="docker"
+	elif [[ -r /proc/1/environ ]] && grep -aq 'container=lxc' /proc/1/environ; then
+		VIRTUALIZATION="lxc"
+	fi
+	if [[ "$VIRTUALIZATION" == "lxc" ]]; then
+		ENDPOINT_MODE="dnsrr"
+	fi
+	case "$DOKPLOY_ENDPOINT_MODE" in
+		dnsrr) ENDPOINT_MODE="dnsrr" ;;
+		vip) ENDPOINT_MODE="" ;;
+	esac
+}
+
+# Report mandatory and optional command capabilities. Missing mandatory tools
+# add blocking preflight failures and are never installed implicitly.
+check_dependencies() {
+	CURRENT_PHASE="dependency validation"
+	local required=(awk basename cat chmod cmp cp curl date df dirname findmnt flock getent grep gzip head install ip mkdir mktemp mv openssl ps rm sed sha256sum sort ss stat systemctl tar tee touch tr uname wc)
+	local optional=(gpg journalctl modprobe timedatectl)
+	local missing=()
+	local tool
+	for tool in "${required[@]}"; do
+		command_exists "$tool" || missing+=("$tool")
+	done
+	if ((${#missing[@]} > 0)); then
+		fail_check "Missing required tools: ${missing[*]}. Install them with your distribution package manager."
+	else
+		ok "Required host tools are available"
+	fi
+	for tool in "${optional[@]}"; do
+		command_exists "$tool" || warn "Optional tool $tool is unavailable; related diagnostics will be limited"
+	done
+}
+
+# Measure RAM, swap, disk, filesystems, mount writability, and inode capacity for
+# data, backup, Docker, and temporary paths. Only preflight globals are changed.
+detect_resources() {
+	CURRENT_PHASE="resource detection"
+	MEMORY_MB=$(awk '/MemTotal:/ {printf "%d", $2 / 1024}' /proc/meminfo 2>/dev/null || printf '0')
+	SWAP_MB=$(awk '/SwapTotal:/ {printf "%d", $2 / 1024}' /proc/meminfo 2>/dev/null || printf '0')
+	local install_parent="$DOKPLOY_DATA_DIR"
+	while [[ ! -e "$install_parent" && "$install_parent" != "/" ]]; do install_parent=$(dirname "$install_parent"); done
+	local backup_parent="$DOKPLOY_BACKUP_DIR"
+	while [[ ! -e "$backup_parent" && "$backup_parent" != "/" ]]; do backup_parent=$(dirname "$backup_parent"); done
+	INSTALL_FREE_MB=$(df -Pm "$install_parent" 2>/dev/null | awk 'NR==2 {print $4}' || printf '0')
+	BACKUP_FREE_MB=$(df -Pm "$backup_parent" 2>/dev/null | awk 'NR==2 {print $4}' || printf '0')
+	TMP_FREE_MB=$(df -Pm "${TMPDIR:-/tmp}" 2>/dev/null | awk 'NR==2 {print $4}' || printf '0')
+	FILESYSTEM_TYPE=$(findmnt -n -o FSTYPE --target "$install_parent" 2>/dev/null || printf 'unknown')
+	BACKUP_FILESYSTEM_TYPE=$(findmnt -n -o FSTYPE --target "$backup_parent" 2>/dev/null || printf 'unknown')
+	local mount_options
+	mount_options=$(findmnt -n -o OPTIONS --target "$install_parent" 2>/dev/null || true)
+	[[ ",$mount_options," != *,ro,* ]] || fail_check "$DOKPLOY_DATA_DIR is on a read-only mount"
+	mount_options=$(findmnt -n -o OPTIONS --target "$backup_parent" 2>/dev/null || true)
+	[[ ",$mount_options," != *,ro,* ]] || fail_check "$DOKPLOY_BACKUP_DIR is on a read-only mount"
+	case "$FILESYSTEM_TYPE" in
+		nfs | nfs4 | cifs | smb3 | fuse.* | 9p) fail_check "Network filesystem $FILESYSTEM_TYPE is unsupported for Dokploy data" ;;
+		ext4 | xfs | btrfs | zfs) ok "Installation filesystem $FILESYSTEM_TYPE is supported" ;;
+		overlay) fail_check "Overlay filesystem indicates an unsupported nested/container installation" ;;
+		*) warn "Filesystem $FILESYSTEM_TYPE is untested; ext4 or xfs is recommended" ;;
+	esac
+	case "$BACKUP_FILESYSTEM_TYPE" in
+		nfs | nfs4 | cifs | smb3 | fuse.* | 9p) warn "Backup filesystem $BACKUP_FILESYSTEM_TYPE is remote; verify durability, locking, and access controls" ;;
+		overlay) fail_check "Overlay filesystem is unsupported for Dokploy backups" ;;
+	esac
+	local inode_free
+	inode_free=$(df -Pi "$install_parent" 2>/dev/null | awk 'NR==2 {print $4}' || printf '0')
+	if [[ "$inode_free" =~ ^[0-9]+$ ]] && ((inode_free < 100000)); then
+		warn "Only $inode_free free inodes are available at $install_parent"
+	else
+		ok "Filesystem has sufficient free inodes"
+	fi
+}
+
+# Validate kernel/cgroup/overlay capabilities and reject unsupported nested
+# environments. Experimental LXC requires an explicit override.
+check_kernel_and_virtualization() {
+	CURRENT_PHASE="kernel and virtualization validation"
+	local kernel_major kernel_minor
+	kernel_major=${KERNEL_VERSION%%.*}
+	kernel_minor=${KERNEL_VERSION#*.}
+	kernel_minor=${kernel_minor%%.*}
+	if [[ "$kernel_major" =~ ^[0-9]+$ && "$kernel_minor" =~ ^[0-9]+$ ]] &&
+		((kernel_major < MINIMUM_KERNEL_MAJOR || (kernel_major == MINIMUM_KERNEL_MAJOR && kernel_minor < MINIMUM_KERNEL_MINOR))); then
+		fail_check "Kernel $KERNEL_VERSION is too old; ${MINIMUM_KERNEL_MAJOR}.${MINIMUM_KERNEL_MINOR}+ is required"
+	else
+		ok "Kernel $KERNEL_VERSION meets the minimum requirement"
+	fi
+	case "$VIRTUALIZATION" in
+		docker | podman | openvz | systemd-nspawn | wsl) fail_check "$VIRTUALIZATION is unsupported; use a systemd VM or bare-metal host" ;;
+		lxc)
+			if [[ "$DOKPLOY_ALLOW_UNSUPPORTED" == "1" ]]; then
+				warn "LXC is experimental; DNSRR endpoint mode will be used because IPVS may be unavailable"
+			else
+				fail_check "LXC is experimental. Use a VM, or set DOKPLOY_ALLOW_UNSUPPORTED=1 after enabling nesting and keyctl"
+			fi
+			;;
+		*) ok "Virtualization environment: $VIRTUALIZATION" ;;
+	esac
+	[[ -d /sys/fs/cgroup ]] || fail_check "Linux cgroups are unavailable"
+	if [[ -r /proc/filesystems ]] && grep -qw overlay /proc/filesystems; then
+		ok "Overlay filesystem kernel support is available"
+	else
+		fail_check "Kernel overlay filesystem support is required by Docker"
+	fi
+	local ipvs_available=0
+	if [[ -r /proc/net/ip_vs ]] || grep -q '^ip_vs ' /proc/modules 2>/dev/null; then
+		ipvs_available=1
+	elif command_exists modprobe && modprobe -n ip_vs >/dev/null 2>&1; then
+		ipvs_available=1
+	fi
+	if ((ipvs_available == 1)); then
+		ok "IPVS capability is available for Swarm VIP networking"
+	elif [[ "$DOKPLOY_ENDPOINT_MODE" == "vip" ]]; then
+		fail_check "Swarm VIP mode was requested, but the kernel has no detectable IPVS capability"
+	else
+		ENDPOINT_MODE="dnsrr"
+		warn "IPVS capability is unavailable; Swarm services will use DNSRR endpoint mode"
+	fi
+}
+
+check_resource_thresholds() {
+	if ((MEMORY_MB < HARD_MINIMUM_MEMORY_MB)); then
+		fail_check "${MEMORY_MB} MB RAM detected; at least ${HARD_MINIMUM_MEMORY_MB} MB is required"
+	elif ((MEMORY_MB < MINIMUM_MEMORY_MB)); then
+		if [[ "$DOKPLOY_ALLOW_LOW_RESOURCES" == "1" ]]; then
+			warn "${MEMORY_MB} MB RAM is below the supported minimum of ${MINIMUM_MEMORY_MB} MB"
+		else
+			fail_check "${MEMORY_MB} MB RAM is below the supported minimum; set DOKPLOY_ALLOW_LOW_RESOURCES=1 to override"
+		fi
+	elif ((MEMORY_MB < RECOMMENDED_MEMORY_MB)); then
+		warn "${MEMORY_MB} MB RAM meets the minimum; ${RECOMMENDED_MEMORY_MB} MB is recommended (swap: ${SWAP_MB} MB)"
+	else
+		ok "Memory: ${MEMORY_MB} MB RAM, ${SWAP_MB} MB swap"
+	fi
+	if ((INSTALL_FREE_MB < MINIMUM_DISK_MB)); then
+		fail_check "Only ${INSTALL_FREE_MB} MB is free for $DOKPLOY_DATA_DIR; ${MINIMUM_DISK_MB} MB is required"
+	elif ((INSTALL_FREE_MB < RECOMMENDED_DISK_MB)); then
+		warn "${INSTALL_FREE_MB} MB free at $DOKPLOY_DATA_DIR; ${RECOMMENDED_DISK_MB} MB is recommended"
+	else
+		ok "Installation disk space: ${INSTALL_FREE_MB} MB free"
+	fi
+	if ((TMP_FREE_MB < 1024)); then
+		fail_check "Less than 1 GB is available for temporary downloads"
+	else
+		ok "Temporary disk space: ${TMP_FREE_MB} MB free"
+	fi
+	if ((BACKUP_FREE_MB < MINIMUM_DISK_MB)); then
+		fail_check "Only ${BACKUP_FREE_MB} MB is free for backups at $DOKPLOY_BACKUP_DIR; ${MINIMUM_DISK_MB} MB is required"
+	else
+		ok "Backup disk space: ${BACKUP_FREE_MB} MB free"
+	fi
+}
+
+docker_info_value() {
+	local format="$1"
+	docker info --format "$format" 2>/dev/null || true
+}
+
+# Inspect the client, daemon, socket, Engine/Compose versions, storage, Swarm,
+# context, and installation origin. Existing Docker configuration is read-only.
+detect_docker() {
+	CURRENT_PHASE="Docker detection"
+	if ! command_exists docker; then
+		DOCKER_AVAILABLE=0
+		return
+	fi
+	DOCKER_AVAILABLE=1
+	DOCKER_VERSION=$(docker version --format '{{.Client.Version}}' 2>/dev/null || docker --version 2>/dev/null || printf 'unknown')
+	if docker --version 2>/dev/null | grep -qi podman; then
+		fail_check "Podman Docker compatibility is unsupported; install Docker Engine"
+	fi
+	if command_exists snap && snap list docker >/dev/null 2>&1; then
+		fail_check "Docker installed through Snap is unsupported. Remove it with 'snap remove docker' and install Docker Engine from Docker's apt repository"
+	fi
+	if [[ -n "${DOCKER_HOST:-}" && "${DOCKER_HOST:-}" != "unix:///var/run/docker.sock" ]]; then
+		fail_check "Remote or nonstandard DOCKER_HOST is unsupported; unset DOCKER_HOST and use /var/run/docker.sock"
+	fi
+	local context
+	context=$(docker context show 2>/dev/null || printf 'default')
+	[[ "$context" == "default" ]] || fail_check "Remote Docker context '$context' is unsupported; select the default local context"
+	if ! docker info >/dev/null 2>&1; then
+		fail_check "Docker is installed, but the daemon is not reachable through /var/run/docker.sock"
+		return
+	fi
+	DOCKER_DAEMON_AVAILABLE=1
+	[[ -S /var/run/docker.sock && -r /var/run/docker.sock && -w /var/run/docker.sock ]] || fail_check "The supported local Docker socket /var/run/docker.sock is not accessible"
+	local security_options operating_system
+	security_options=$(docker_info_value '{{json .SecurityOptions}}')
+	operating_system=$(docker_info_value '{{.OperatingSystem}}')
+	[[ "$security_options" != *rootless* ]] || fail_check "Rootless Docker is unsupported; install the system Docker Engine daemon"
+	[[ "$operating_system" != *"Docker Desktop"* ]] || fail_check "Docker Desktop is unsupported for server installation"
+	DOCKER_STORAGE_DRIVER=$(docker_info_value '{{.Driver}}')
+	DOCKER_ROOT_DIR=$(docker_info_value '{{.DockerRootDir}}')
+	SWARM_STATE=$(docker_info_value '{{.Swarm.LocalNodeState}}')
+	COMPOSE_VERSION=$(docker compose version --short 2>/dev/null || true)
+	[[ -n "$COMPOSE_VERSION" ]] || fail_check "The Docker Compose v2 plugin is required"
+	local docker_major compose_numeric compose_major compose_minor
+	docker_major=${DOCKER_VERSION#v}
+	docker_major=${docker_major%%.*}
+	compose_numeric=${COMPOSE_VERSION#v}
+	compose_major=${compose_numeric%%.*}
+	compose_minor=${compose_numeric#*.}
+	compose_minor=${compose_minor%%.*}
+	if [[ "$docker_major" =~ ^[0-9]+$ ]] && ((docker_major < MINIMUM_DOCKER_MAJOR)); then
+		fail_check "Docker Engine $DOCKER_VERSION is unsupported; version $MINIMUM_DOCKER_MAJOR or newer is required"
+	fi
+	if [[ "$compose_major" =~ ^[0-9]+$ && "$compose_minor" =~ ^[0-9]+$ ]] &&
+		((compose_major < MINIMUM_COMPOSE_MAJOR || (compose_major == MINIMUM_COMPOSE_MAJOR && compose_minor < MINIMUM_COMPOSE_MINOR))); then
+		fail_check "Docker Compose $COMPOSE_VERSION is unsupported; ${MINIMUM_COMPOSE_MAJOR}.${MINIMUM_COMPOSE_MINOR}+ is required"
+	fi
+	case "$DOCKER_STORAGE_DRIVER" in
+		overlay2 | btrfs | zfs) ok "Docker storage driver: $DOCKER_STORAGE_DRIVER" ;;
+		*) warn "Docker storage driver $DOCKER_STORAGE_DRIVER is untested; overlay2 is recommended" ;;
+	esac
+	if [[ -n "$DOCKER_ROOT_DIR" && "$DOCKER_ROOT_DIR" != "unknown" ]]; then
+		DOCKER_FREE_MB=$(df -Pm "$DOCKER_ROOT_DIR" 2>/dev/null | awk 'NR==2 {print $4}' || printf '0')
+		local docker_fs
+		docker_fs=$(findmnt -n -o FSTYPE --target "$DOCKER_ROOT_DIR" 2>/dev/null || printf 'unknown')
+		case "$docker_fs" in nfs | nfs4 | cifs | smb3 | 9p) fail_check "Docker data root is on unsupported network filesystem $docker_fs" ;; esac
+		((DOCKER_FREE_MB >= MINIMUM_DISK_MB)) || fail_check "Docker data root has only ${DOCKER_FREE_MB} MB free"
+	fi
+	if [[ -r /etc/docker/daemon.json ]]; then
+		docker info >/dev/null 2>&1 || fail_check "Existing /etc/docker/daemon.json is incompatible with the Docker daemon"
+		ok "Existing Docker daemon configuration is accepted without modification"
+	fi
+	ok "Docker daemon $DOCKER_VERSION is reachable; Compose $COMPOSE_VERSION is available"
+}
+
+# Validate DNS, TLS, registries, proxy settings, address families, and clock
+# synchronization before image downloads or host changes.
+check_connectivity() {
+	CURRENT_PHASE="network connectivity validation"
+	local dns_ok=1 https_ok=1 registry_ok=1
+	getent ahosts github.com >/dev/null 2>&1 || dns_ok=0
+	getent ahosts registry-1.docker.io >/dev/null 2>&1 || dns_ok=0
+	if ((dns_ok == 1)); then ok "DNS resolution works"; else fail_check "DNS cannot resolve GitHub or Docker Hub"; fi
+	curl --fail --silent --show-error --location --retry 2 --retry-delay 1 --connect-timeout 10 --max-time 30 \
+		-o /dev/null https://github.com/dokploy/dokploy/releases/latest || https_ok=0
+	if ((https_ok == 1)); then ok "HTTPS and certificate validation work"; else fail_check "Cannot reach Dokploy releases over verified HTTPS"; fi
+	local registry_code
+	registry_code=$(curl --silent --show-error --output /dev/null --write-out '%{http_code}' --retry 2 --connect-timeout 10 --max-time 30 \
+		https://registry-1.docker.io/v2/ || true)
+	[[ "$registry_code" == "200" || "$registry_code" == "401" ]] || registry_ok=0
+	if ((registry_ok == 1)); then ok "Docker Hub registry is reachable"; else fail_check "Docker Hub registry is unreachable (HTTP ${registry_code:-none})"; fi
+	if ip -4 route show default 2>/dev/null | grep -q .; then ok "IPv4 default route detected"; else warn "No IPv4 default route detected"; fi
+	if ip -6 route show default 2>/dev/null | grep -q .; then
+		ok "IPv6 default route detected"
+		curl -6 --fail --silent --show-error --connect-timeout 5 --max-time 15 -o /dev/null https://github.com/ || warn "IPv6 has a default route but verified HTTPS over IPv6 failed; Docker should prefer working IPv4"
+	else
+		log "IPv6 default route not detected (optional)"
+	fi
+	if [[ -n "${HTTP_PROXY:-}${HTTPS_PROXY:-}${http_proxy:-}${https_proxy:-}" ]]; then
+		warn "Proxy environment variables are set; ensure Docker daemon proxy settings match"
+	fi
+	if command_exists timedatectl; then
+		local clock_sync
+		clock_sync=$(timedatectl show -p NTPSynchronized --value 2>/dev/null || printf 'unknown')
+		if [[ "$clock_sync" == "yes" ]]; then ok "System clock is synchronized"; else warn "System clock synchronization is $clock_sync; TLS and releases require accurate time"; fi
+	fi
+}
+
+has_service() { docker service inspect "$1" >/dev/null 2>&1; }
+has_container() { docker container inspect "$1" >/dev/null 2>&1; }
+has_network() { docker network inspect "$1" >/dev/null 2>&1; }
+has_volume() { docker volume inspect "$1" >/dev/null 2>&1; }
+
+service_running() {
+	local service="$1"
+	local desired running
+	desired=$(docker service inspect --format '{{.Spec.Mode.Replicated.Replicas}}' "$service" 2>/dev/null || printf '1')
+	running=$(docker service ps --filter desired-state=running --format '{{.CurrentState}}' "$service" 2>/dev/null | grep -c '^Running' || true)
+	((running >= desired))
+}
+
+detect_installed_version() {
+	INSTALLED_VERSION="none"
+	INSTALLED_IMAGE=""
+	if [[ -r "$DOKPLOY_DATA_DIR/installer-state.env" ]]; then
+		INSTALLED_VERSION=$(sed -n 's/^DOKPLOY_INSTALLED_VERSION=//p' "$DOKPLOY_DATA_DIR/installer-state.env" | head -n1)
+	fi
+	if has_service dokploy; then
+		INSTALLED_IMAGE=$(docker service inspect --format '{{.Spec.TaskTemplate.ContainerSpec.Image}}' dokploy 2>/dev/null || true)
+		if [[ "$INSTALLED_VERSION" == "none" || -z "$INSTALLED_VERSION" ]]; then
+			local without_digest
+			without_digest=${INSTALLED_IMAGE%@*}
+			if [[ "$without_digest" == *:* ]]; then INSTALLED_VERSION=${without_digest##*:}; else INSTALLED_VERSION="unknown"; fi
+		fi
+	fi
+	if [[ ! "$INSTALLED_VERSION" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([.-][A-Za-z0-9][A-Za-z0-9.-]*)?$ && "$INSTALLED_VERSION" != "latest" && "$INSTALLED_VERSION" != "canary" && "$INSTALLED_VERSION" != "none" ]]; then
+		warn "Installed version metadata is invalid or unavailable; treating the version as unknown"
+		INSTALLED_VERSION="unknown"
+	fi
+}
+
+# Classify named services, containers, Compose projects, networks, volumes, and
+# metadata into a safe install/upgrade/repair/conflict state. No state is changed.
+determine_installation_state() {
+	CURRENT_PHASE="installation state detection"
+	if ((DOCKER_DAEMON_AVAILABLE == 0)); then
+		INSTALLATION_STATE="Fresh install"
+		INSTALLED_VERSION="none"
+		return
+	fi
+	if has_container dokploy || has_container dokploy-postgres ||
+		[[ -n "$(docker ps -a --filter label=com.docker.compose.project=dokploy --format '{{.ID}}' 2>/dev/null | head -n1)" ]]; then
+		INSTALLATION_STATE="Conflicting installation"
+		detect_installed_version
+		return
+	fi
+	local markers=0 expected=0
+	has_service dokploy && markers=$((markers + 1))
+	has_service dokploy-postgres && markers=$((markers + 1))
+	has_container dokploy-traefik && markers=$((markers + 1))
+	has_network "$DOKPLOY_NETWORK_NAME" && markers=$((markers + 1))
+	has_volume dokploy-postgres && markers=$((markers + 1))
+	[[ -d "$DOKPLOY_DATA_DIR" ]] && markers=$((markers + 1))
+	detect_installed_version
+	if ((markers == 0)); then
+		if [[ "$SWARM_STATE" == "active" && "$DOKPLOY_REUSE_EXISTING_SWARM" != "1" ]]; then
+			INSTALLATION_STATE="Conflicting installation"
+		else
+			INSTALLATION_STATE="Fresh install"
+		fi
+		return
+	fi
+	has_service dokploy && expected=$((expected + 1))
+	has_service dokploy-postgres && expected=$((expected + 1))
+	has_network "$DOKPLOY_NETWORK_NAME" && expected=$((expected + 1))
+	if [[ "$DOKPLOY_SKIP_TRAEFIK" == "1" ]] || has_container dokploy-traefik; then expected=$((expected + 1)); fi
+	if ((expected < 4)); then
+		INSTALLATION_STATE="Partial installation"
+		return
+	fi
+	if service_running dokploy && service_running dokploy-postgres &&
+		{ [[ "$DOKPLOY_SKIP_TRAEFIK" == "1" ]] || [[ "$(docker inspect -f '{{.State.Running}}' dokploy-traefik 2>/dev/null)" == "true" ]]; }; then
+		if [[ "$TARGET_VERSION" != "" && "$INSTALLED_VERSION" != "$TARGET_VERSION" && "$INSTALLED_VERSION" != "unknown" ]]; then
+			INSTALLATION_STATE="Upgrade available"
+		else
+			INSTALLATION_STATE="Existing healthy install"
+		fi
+	else
+		INSTALLATION_STATE="Repair required"
+	fi
+}
+
+# Resolve "latest" over verified HTTPS to a validated immutable release tag.
+# Sets TARGET_VERSION/TARGET_IMAGE and fails closed if resolution is ambiguous.
+resolve_target_version() {
+	CURRENT_PHASE="version resolution"
+	local requested="$DOKPLOY_VERSION"
+	if [[ "$requested" == "latest" ]]; then
+		local effective
+		effective=$(curl --fail --silent --show-error --location --retry 5 --retry-delay 2 --connect-timeout 10 --max-time 60 \
+			-o /dev/null --write-out '%{url_effective}' https://github.com/dokploy/dokploy/releases/latest) ||
+			error "Could not resolve the latest immutable Dokploy release; pin DOKPLOY_VERSION explicitly"
+		requested=${effective##*/}
+		[[ "$requested" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+([.-][A-Za-z0-9][A-Za-z0-9.-]*)?$ ]] ||
+			error "Release endpoint returned an invalid version: $requested"
+	fi
+	TARGET_VERSION="$requested"
+	TARGET_IMAGE="$DOKPLOY_IMAGE_REPOSITORY:$TARGET_VERSION"
+	ok "Target Dokploy version resolved to $TARGET_VERSION"
+}
+
+normalize_version() { printf '%s' "${1#v}"; }
+
+version_compare() {
+	local left right
+	left=$(normalize_version "$1")
+	right=$(normalize_version "$2")
+	if [[ "$left" == "$right" ]]; then
+		printf 'equal'
+		return
+	fi
+	if [[ "$(printf '%s\n%s\n' "$left" "$right" | sort -V | head -n1)" == "$left" ]]; then printf 'older'; else printf 'newer'; fi
+}
+
+classify_upgrade() {
+	UPGRADE_TYPE="unknown"
+	ROLLBACK_SUPPORTED="no"
+	if [[ ! "$INSTALLED_VERSION" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+ || ! "$TARGET_VERSION" =~ ^v?[0-9]+\.[0-9]+\.[0-9]+ ]]; then
+		return 0
+	fi
+	local old new old_major old_minor old_patch new_major new_minor new_patch direction
+	old=$(normalize_version "$INSTALLED_VERSION")
+	new=$(normalize_version "$TARGET_VERSION")
+	IFS=. read -r old_major old_minor old_patch <<<"${old%%-*}"
+	IFS=. read -r new_major new_minor new_patch <<<"${new%%-*}"
+	direction=$(version_compare "$INSTALLED_VERSION" "$TARGET_VERSION")
+	if [[ "$direction" == "newer" ]]; then
+		UPGRADE_TYPE="downgrade"
+	elif [[ "$old_major" != "$new_major" ]]; then
+		UPGRADE_TYPE="major"
+	elif [[ "$old_minor" != "$new_minor" ]]; then
+		UPGRADE_TYPE="minor"
+	elif [[ "$old_patch" != "$new_patch" ]]; then
+		UPGRADE_TYPE="patch"
+	else
+		UPGRADE_TYPE="same"
+	fi
+	if [[ -r "$DOKPLOY_ROLLBACK_COMPATIBILITY_FILE" ]] &&
+		awk -v old="$INSTALLED_VERSION" -v new="$TARGET_VERSION" '$1 == old && $2 == new && $3 == "database-safe" {found=1} END {exit !found}' "$DOKPLOY_ROLLBACK_COMPATIBILITY_FILE"; then
+		ROLLBACK_SUPPORTED="yes"
+	fi
+}
+
+validate_upgrade_path() {
+	classify_upgrade
+	if [[ -n "$DOKPLOY_MIN_UPGRADE_VERSION" && "$INSTALLED_VERSION" =~ ^v?[0-9] ]]; then
+		[[ "$(version_compare "$INSTALLED_VERSION" "$DOKPLOY_MIN_UPGRADE_VERSION")" != "older" ]] ||
+			error "Installed version $INSTALLED_VERSION is below the minimum direct-upgrade version $DOKPLOY_MIN_UPGRADE_VERSION"
+	fi
+	case "$UPGRADE_TYPE" in
+		downgrade | major)
+			[[ "$DOKPLOY_ALLOW_BREAKING_UPGRADE" == "1" ]] || error "$UPGRADE_TYPE upgrade path $INSTALLED_VERSION -> $TARGET_VERSION requires DOKPLOY_ALLOW_BREAKING_UPGRADE=1 after reviewing release notes"
+			;;
+	esac
+}
+
+port_owner() {
+	local port="$1"
+	ss -H -ltnup "sport = :$port" 2>/dev/null | head -n1 || true
+}
+
+container_port_owner() {
+	local port="$1"
+	docker ps --format '{{.Names}} {{.Ports}}' 2>/dev/null | awk -v p=":$port->" 'index($0,p) {print; exit}' || true
+}
+
+# Inspect TCP and UDP ownership for each configured host port and identify the
+# owning Docker container where possible. External-proxy mode skips 80/443.
+check_ports() {
+	CURRENT_PHASE="port validation"
+	command_exists ss || {
+		fail_check "Cannot inspect ports because ss is missing"
+		return
+	}
+	local label port owner container_owner expected
+	while IFS='|' read -r label port; do
+		if [[ "$DOKPLOY_SKIP_TRAEFIK" == "1" && "$label" != "Application" ]]; then
+			log "$label port $port is managed by the operator's external reverse proxy"
+			continue
+		fi
+		owner=$(port_owner "$port")
+		[[ -z "$owner" ]] && {
+			ok "$label port $port is available"
+			continue
+		}
+		container_owner=""
+		((DOCKER_DAEMON_AVAILABLE == 1)) && container_owner=$(container_port_owner "$port")
+		expected=0
+		if [[ "$INSTALLATION_STATE" != "Fresh install" ]]; then
+			[[ "$label" == "Application" && "$container_owner" == dokploy.* ]] && expected=1
+			[[ "$label" != "Application" && "$container_owner" == dokploy-traefik* ]] && expected=1
+		fi
+		if ((expected == 1)); then
+			ok "$label port $port is owned by the existing Dokploy installation"
+		elif [[ "$DOKPLOY_ALLOW_PORT_CONFLICT" == "1" ]]; then
+			warn "$label port $port is occupied and conflict override is enabled. Host owner: $owner; container: ${container_owner:-none}"
+		else
+			fail_check "$label port $port is occupied. Host owner: $owner; container: ${container_owner:-none}. Choose an alternate DOKPLOY_*_PORT, integrate an existing proxy with DOKPLOY_SKIP_TRAEFIK=1, or explicitly set DOKPLOY_ALLOW_PORT_CONFLICT=1"
+		fi
+	done <<EOF
+HTTP|$DOKPLOY_HTTP_PORT
+HTTPS|$DOKPLOY_HTTPS_PORT
+Application|$DOKPLOY_APP_PORT
+EOF
+}
+
+select_action() {
+	local requested="$DOKPLOY_INSTALL_ACTION"
+	if [[ "$requested" == "check" ]]; then
+		SELECTED_ACTION="check"
+		return
+	fi
+	if [[ "$requested" == "abort" ]]; then
+		SELECTED_ACTION="abort"
+		fail_check "DOKPLOY_INSTALL_ACTION=abort requested; no changes will be made"
+		return
+	fi
+	if [[ "$requested" != "auto" ]]; then
+		SELECTED_ACTION="$requested"
+	else
+		case "$INSTALLATION_STATE" in
+			"Fresh install") SELECTED_ACTION="install" ;;
+			"Upgrade available") SELECTED_ACTION="upgrade" ;;
+			"Repair required" | "Partial installation") SELECTED_ACTION="repair" ;;
+			"Existing healthy install") SELECTED_ACTION="validate" ;;
+			*) SELECTED_ACTION="abort" ;;
+		esac
+	fi
+	case "$SELECTED_ACTION:$INSTALLATION_STATE" in
+		install:"Fresh install" | upgrade:"Upgrade available" | repair:"Repair required" | repair:"Partial installation" | validate:"Existing healthy install") ;;
+		*) fail_check "Action '$SELECTED_ACTION' is incompatible with state '$INSTALLATION_STATE'" ;;
+	esac
+}
+
+print_preflight_report() {
+	section "Dokploy installation preflight"
+	printf '%-22s %s\n' \
+		"Installer version:" "$INSTALLER_VERSION" \
+		"Operating system:" "$PLATFORM_ID $PLATFORM_VERSION ($PLATFORM_CLASS)" \
+		"Package manager:" "$PACKAGE_MANAGER" \
+		"Init system:" "$INIT_SYSTEM" \
+		"Architecture:" "$ARCHITECTURE" \
+		"Kernel:" "$KERNEL_VERSION" \
+		"Virtualization:" "$VIRTUALIZATION" \
+		"Memory:" "${MEMORY_MB} MB (recommended: ${RECOMMENDED_MEMORY_MB} MB)" \
+		"Swap:" "${SWAP_MB} MB" \
+		"Free disk:" "${INSTALL_FREE_MB} MB at $DOKPLOY_DATA_DIR" \
+		"Backup disk:" "${BACKUP_FREE_MB} MB at $DOKPLOY_BACKUP_DIR" \
+		"Filesystem:" "$FILESYSTEM_TYPE" \
+		"Backup filesystem:" "$BACKUP_FILESYSTEM_TYPE" \
+		"Docker:" "$DOCKER_VERSION" \
+		"Docker Compose:" "$COMPOSE_VERSION" \
+		"Docker data root:" "$DOCKER_ROOT_DIR (${DOCKER_FREE_MB} MB free)" \
+		"Docker Swarm:" "$SWARM_STATE" \
+		"Existing install:" "$INSTALLATION_STATE" \
+		"Installed version:" "$INSTALLED_VERSION" \
+		"Target version:" "$TARGET_VERSION" \
+		"Upgrade type:" "$UPGRADE_TYPE" \
+		"DB migration:" "$([[ "$INSTALLATION_STATE" == "Upgrade available" ]] && printf 'application-managed' || printf 'not required')" \
+		"Rollback supported:" "$ROLLBACK_SUPPORTED" \
+		"Requested action:" "$DOKPLOY_INSTALL_ACTION" \
+		"Selected action:" "${SELECTED_ACTION:-pending}" \
+		"Log file:" "$LOG_FILE"
+	if ((PREFLIGHT_FAILURES > 0)); then
+		printf '\n%sPreflight result: blocked (%s failure(s), %s warning(s))%s\n' "$COLOR_RED" "$PREFLIGHT_FAILURES" "$PREFLIGHT_WARNINGS" "$COLOR_RESET"
+	else
+		printf '\n%sPreflight result: ready (%s warning(s))%s\n' "$COLOR_GREEN" "$PREFLIGHT_WARNINGS" "$COLOR_RESET"
+	fi
+}
+
+print_dry_run_actions() {
+	section "Planned actions (no changes made)"
+	if ((DOCKER_AVAILABLE == 0)); then printf 'Would install Docker Engine %s from its signed apt repository\n' "$DOKPLOY_DOCKER_VERSION"; fi
+	case "$INSTALLATION_STATE" in
+		"Fresh install")
+			printf 'Would create %s with restrictive permissions\n' "$DOKPLOY_DATA_DIR"
+			printf 'Would initialize Docker Swarm only if inactive\n'
+			printf 'Would create Docker network %s only if absent\n' "$DOKPLOY_NETWORK_NAME"
+			printf 'Would create PostgreSQL and Dokploy services using Docker secrets\n'
+			[[ "$DOKPLOY_SKIP_TRAEFIK" == "1" ]] || printf 'Would reserve ports %s and %s and start Traefik\n' "$DOKPLOY_HTTP_PORT" "$DOKPLOY_HTTPS_PORT"
+			printf 'Would install Dokploy %s on port %s\n' "$TARGET_VERSION" "$DOKPLOY_APP_PORT"
+			;;
+		"Upgrade available") printf 'Would back up version %s, pull verified image %s, upgrade, validate, and roll back only if the declared path is safe\n' "$INSTALLED_VERSION" "$TARGET_IMAGE" ;;
+		"Repair required" | "Partial installation") printf 'Would preserve existing data and recreate only missing or unhealthy Dokploy resources\n' ;;
+		"Existing healthy install") printf 'Would make no changes; the requested version is already healthy\n' ;;
+	esac
+}
+
+# Execute all read-only host, Docker, resource, and connectivity checks. Results
+# accumulate in PREFLIGHT_FAILURES/WARNINGS for one structured report.
+run_preflight() {
+	section "Preflight checks"
+	validate_privileges
+	detect_platform
+	check_dependencies
+	if [[ "$ARCHITECTURE" == "unsupported" ]]; then fail_check "Unsupported CPU architecture $(uname -m); amd64 and arm64 are supported"; else ok "Architecture $ARCHITECTURE is supported"; fi
+	if [[ "$PLATFORM_CLASS" == "supported" ]]; then
+		ok "$PLATFORM_ID $PLATFORM_VERSION is supported"
+	elif [[ "$DOKPLOY_ALLOW_UNSUPPORTED" == "1" ]]; then
+		warn "$PLATFORM_ID $PLATFORM_VERSION is experimental and explicitly allowed"
+	else
+		fail_check "$PLATFORM_ID $PLATFORM_VERSION is experimental. Supported releases: Ubuntu 22.04/24.04 and Debian 12. Set DOKPLOY_ALLOW_UNSUPPORTED=1 only after testing"
+	fi
+	if [[ "$INIT_SYSTEM" == "systemd" ]]; then ok "systemd init is available"; else fail_check "A systemd-based server is required"; fi
+	detect_resources
+	check_kernel_and_virtualization
+	check_resource_thresholds
+	detect_docker
+	if ((DOCKER_AVAILABLE == 0)); then
+		if [[ "$DOKPLOY_SKIP_DOCKER_INSTALL" == "1" ]]; then
+			fail_check "Docker is absent and automatic Docker installation is disabled"
+		elif [[ "$PACKAGE_MANAGER" != "apt" ]]; then
+			fail_check "Docker is absent; automatic installation is available only on supported apt hosts"
+		else
+			warn "Docker is absent and will be installed from Docker's signed apt repository"
+		fi
+	fi
+	check_connectivity
+}
+
+install_host_file() {
+	local source="$1" target="$2" mode="$3"
+	if [[ -f "$target" ]] && cmp -s "$source" "$target"; then
+		ok "Existing $target already matches the validated configuration"
+		return
+	fi
+	[[ ! -L "$target" ]] || error "Refusing to replace symbolic-link host configuration $target"
+	if [[ -e "$target" ]]; then
+		if [[ -z "$HOST_CONFIG_BACKUP_PATH" ]]; then
+			HOST_CONFIG_BACKUP_PATH="$DOKPLOY_BACKUP_DIR/host-config-$(date -u +%Y%m%dT%H%M%SZ)"
+			mkdir -p "$HOST_CONFIG_BACKUP_PATH"
+			chmod 0700 "$HOST_CONFIG_BACKUP_PATH"
+		fi
+		cp -a -- "$target" "$HOST_CONFIG_BACKUP_PATH/$(basename "$target")"
+		sha256sum "$HOST_CONFIG_BACKUP_PATH/$(basename "$target")" >"$HOST_CONFIG_BACKUP_PATH/$(basename "$target").sha256"
+		ok "Backed up $target to $HOST_CONFIG_BACKUP_PATH"
+	fi
+	install -m "$mode" "$source" "$target.dokploy-new"
+	mv -f -- "$target.dokploy-new" "$target"
+	ok "Atomically installed validated host configuration $target"
+}
+
+# Install Docker from Docker's signed apt repository. Existing installations
+# are never replaced and daemon.json is never modified.
+install_docker() {
+	CURRENT_PHASE="Docker installation"
+	((DOCKER_AVAILABLE == 0)) || return
+	[[ "$DOKPLOY_SKIP_DOCKER_INSTALL" == "0" ]] || error "Docker is absent and DOKPLOY_SKIP_DOCKER_INSTALL=1"
+	[[ "$PACKAGE_MANAGER" == "apt" ]] || error "Automatic Docker installation is supported only on apt systems. Install Docker Engine and Compose v2 manually, then rerun"
+	section "Install Docker Engine"
+	local repo_os="$PLATFORM_ID" codename key_file fingerprint package_version
+	case "$repo_os" in ubuntu | debian) ;; *) error "Docker apt repository does not support detected OS $repo_os" ;; esac
+	codename=$(os_release_value VERSION_CODENAME)
+	[[ "$codename" =~ ^[a-z0-9._-]+$ ]] || error "Invalid distribution codename in /etc/os-release"
+	[[ -n "$codename" ]] || error "Cannot determine distribution codename"
+	run_logged apt-get update
+	audit_command env DEBIAN_FRONTEND=noninteractive apt-get install -y ca-certificates curl gpg
+	DEBIAN_FRONTEND=noninteractive apt-get install -y ca-certificates curl gpg
+	command_exists gpg || error "gpg was installed but is unavailable for Docker repository identity verification"
+	install -m 0755 -d /etc/apt/keyrings
+	key_file="$TMP_DIR/docker.asc"
+	curl --fail --show-error --location --retry 5 --retry-delay 2 --connect-timeout 10 --max-time 120 \
+		https://download.docker.com/linux/"$repo_os"/gpg --output "$key_file"
+	fingerprint=$(gpg --show-keys --with-colons "$key_file" 2>/dev/null | awk -F: '$1 == "fpr" {print $10; exit}')
+	[[ "$fingerprint" == "$DOCKER_GPG_FINGERPRINT" ]] || error "Docker repository key identity verification failed"
+	install_host_file "$key_file" /etc/apt/keyrings/docker.asc 0644
+	printf 'deb [arch=%s signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/%s %s stable\n' \
+		"$ARCHITECTURE" "$repo_os" "$codename" >"$TMP_DIR/docker.list"
+	install_host_file "$TMP_DIR/docker.list" /etc/apt/sources.list.d/docker.list 0644
+	run_logged apt-get update
+	package_version=$(apt-cache madison docker-ce | awk -v want="$DOKPLOY_DOCKER_VERSION" '$3 ~ want {print $3; exit}')
+	[[ -n "$package_version" ]] || error "Docker Engine $DOKPLOY_DOCKER_VERSION is unavailable for $repo_os $codename"
+	audit_command env DEBIAN_FRONTEND=noninteractive apt-get install -y "docker-ce=$package_version" "docker-ce-cli=$package_version" containerd.io docker-buildx-plugin docker-compose-plugin
+	DEBIAN_FRONTEND=noninteractive apt-get install -y \
+		"docker-ce=$package_version" "docker-ce-cli=$package_version" containerd.io docker-buildx-plugin docker-compose-plugin
+	run_logged systemctl enable --now docker
+	local failures_before_validation=$PREFLIGHT_FAILURES
+	DOCKER_AVAILABLE=0
+	DOCKER_DAEMON_AVAILABLE=0
+	detect_docker
+	((DOCKER_DAEMON_AVAILABLE == 1)) || error "Docker was installed, but its daemon is not reachable"
+	((PREFLIGHT_FAILURES == failures_before_validation)) || error "Docker was installed but failed post-install compatibility validation"
+}
+
+get_private_ip() {
+	ip -o -4 addr show scope global 2>/dev/null |
+		awk '$2 !~ /^(docker|br-|veth)/ {split($4,a,"/"); if (a[1] ~ /^10\./ || a[1] ~ /^192\.168\./ || a[1] ~ /^172\.(1[6-9]|2[0-9]|3[01])\./) {print a[1]; exit}}'
+}
+
+get_public_ip() {
+	local endpoint ip_value=""
+	for endpoint in https://ifconfig.io/ip https://icanhazip.com https://ipecho.net/plain; do
+		ip_value=$(curl -4 --fail --silent --show-error --connect-timeout 5 --max-time 10 "$endpoint" 2>/dev/null | tr -d '[:space:]') || true
+		[[ "$ip_value" =~ ^[0-9]{1,3}(\.[0-9]{1,3}){3}$ ]] && {
+			printf '%s' "$ip_value"
+			return
+		}
+	done
+	return 1
+}
+
+resolve_advertise_address() {
+	local address="$DOKPLOY_ADVERTISE_ADDR"
+	[[ -n "$address" ]] || address=$(get_private_ip || true)
+	[[ -n "$address" ]] || address=$(get_public_ip || true)
+	[[ -n "$address" && "$address" != *[[:space:]]* ]] || error "Could not determine a Docker Swarm advertise address. Set DOKPLOY_ADVERTISE_ADDR to a local interface address"
+	DOKPLOY_ADVERTISE_ADDR="$address"
+}
+
+# Initialize Swarm only when inactive, or reuse it when Dokploy/explicit policy
+# permits. Never leaves an existing swarm or interpolates arguments with eval.
+initialize_swarm() {
+	CURRENT_PHASE="Docker Swarm initialization"
+	SWARM_STATE=$(docker_info_value '{{.Swarm.LocalNodeState}}')
+	case "$SWARM_STATE" in
+		active)
+			if has_service dokploy || [[ "$INSTALLATION_STATE" == "Fresh install" && "$DOKPLOY_REUSE_EXISTING_SWARM" == "1" ]]; then
+				ok "Reusing active Docker Swarm"
+			else
+				error "This host is already in a non-Dokploy swarm. Set DOKPLOY_REUSE_EXISTING_SWARM=1 only if Dokploy should share it"
+			fi
+			;;
+		inactive | pending | locked | error | unknown | "")
+			resolve_advertise_address
+			local init_args=(swarm init --advertise-addr "$DOKPLOY_ADVERTISE_ADDR")
+			if [[ -n "${DOCKER_SWARM_INIT_ARGS:-}" ]]; then
+				warn "DOCKER_SWARM_INIT_ARGS is deprecated; values are split without eval and must not contain quoted spaces"
+				local extra_args=()
+				IFS=' ' read -r -a extra_args <<<"$DOCKER_SWARM_INIT_ARGS"
+				init_args+=("${extra_args[@]}")
+			fi
+			run_logged docker "${init_args[@]}" || error "Failed to initialize Docker Swarm at $DOKPLOY_ADVERTISE_ADDR"
+			ok "Docker Swarm initialized"
+			;;
+		*) error "Unsupported Docker Swarm state: $SWARM_STATE" ;;
+	esac
+}
+
+# Reuse a compatible attachable overlay network or create it idempotently. An
+# incompatible same-name network is a blocking conflict and is never replaced.
+ensure_network() {
+	CURRENT_PHASE="Docker network setup"
+	if has_network "$DOKPLOY_NETWORK_NAME"; then
+		local driver scope
+		driver=$(docker network inspect --format '{{.Driver}}' "$DOKPLOY_NETWORK_NAME")
+		scope=$(docker network inspect --format '{{.Scope}}' "$DOKPLOY_NETWORK_NAME")
+		[[ "$driver:$scope" == "overlay:swarm" ]] || error "Existing network $DOKPLOY_NETWORK_NAME is $driver/$scope, but overlay/swarm is required"
+		ok "Reusing Docker network $DOKPLOY_NETWORK_NAME"
+	else
+		run_logged docker network create --driver overlay --attachable "$DOKPLOY_NETWORK_NAME" >/dev/null || error "Failed to create overlay network $DOKPLOY_NETWORK_NAME"
+		CREATED_NETWORK=1
+		ok "Docker network $DOKPLOY_NETWORK_NAME created"
+	fi
+}
+
+# Create a missing Docker secret from a protected temporary file with tracing
+# disabled. Existing secrets are preserved and secret values are never logged.
+create_secret_if_missing() {
+	local secret_name="$1"
+	local generator="$2"
+	if docker secret inspect "$secret_name" >/dev/null 2>&1; then
+		ok "Reusing Docker secret $secret_name"
+		return
+	fi
+	local secret_file="$TMP_DIR/$secret_name"
+	trace_off
+	case "$generator" in
+		password) openssl rand -hex 24 >"$secret_file" ;;
+		hex) openssl rand -hex 32 >"$secret_file" ;;
+		*)
+			trace_restore
+			error "Unknown secret generator"
+			;;
+	esac
+	[[ $(wc -c <"$secret_file") -ge 32 ]] || {
+		trace_restore
+		error "Failed to generate secret $secret_name"
+	}
+	chmod 0600 "$secret_file"
+	docker secret create "$secret_name" "$secret_file" >/dev/null || {
+		trace_restore
+		error "Failed to create Docker secret $secret_name"
+	}
+	: >"$secret_file"
+	trace_restore
+	case "$secret_name" in
+		dokploy_postgres_password) CREATED_POSTGRES_SECRET=1 ;;
+		dokploy_auth_secret) CREATED_AUTH_SECRET=1 ;;
+	esac
+	ok "Created Docker secret $secret_name"
+}
+
+validate_repair_secrets() {
+	if has_volume dokploy-postgres && ! docker secret inspect dokploy_postgres_password >/dev/null 2>&1 && ! has_service dokploy-postgres; then
+		error "The existing dokploy-postgres volume has no recoverable Docker password secret. Restore the original secret or a database backup before repair; generating a new password would make the preserved database unreachable"
+	fi
+}
+
+prepare_repair_target() {
+	if has_service dokploy && [[ "$INSTALLED_VERSION" != "none" && "$INSTALLED_VERSION" != "unknown" && "$INSTALLED_VERSION" != "$TARGET_VERSION" ]]; then
+		warn "Repair preserves installed version $INSTALLED_VERSION; run a separate upgrade after the repaired installation is healthy"
+		TARGET_VERSION="$INSTALLED_VERSION"
+		TARGET_IMAGE="$DOKPLOY_IMAGE_REPOSITORY:$TARGET_VERSION"
+	elif has_service dokploy && [[ "$INSTALLED_VERSION" == "unknown" && -n "$INSTALLED_IMAGE" ]]; then
+		TARGET_VERSION="unknown"
+		TARGET_IMAGE="$INSTALLED_IMAGE"
+	fi
+}
+
+release_tag_for_version() {
+	case "$TARGET_VERSION" in v[0-9]*.[0-9]*.[0-9]* | latest) printf 'latest' ;; *) printf '%s' "$TARGET_VERSION" ;; esac
+}
+
+# Pull through Docker's TLS registry client, verify that the image supplies a
+# content-addressed RepoDigest, and use that immutable digest for deployment.
+pull_and_verify_images() {
+	CURRENT_PHASE="verified image download"
+	section "Download and verify container images"
+	local scope="${1:-all}" image digest
+	local images=("$TARGET_IMAGE")
+	if [[ "$scope" == "all" ]]; then
+		images+=("$POSTGRES_IMAGE" "$TRAEFIK_IMAGE")
+	fi
+	for image in "${images[@]}"; do
+		[[ "$image" == "$TRAEFIK_IMAGE" && "$DOKPLOY_SKIP_TRAEFIK" == "1" ]] && continue
+		run_logged docker pull "$image" || error "Failed to pull image $image from the verified registry connection"
+		digest=$(docker image inspect --format '{{index .RepoDigests 0}}' "$image" 2>/dev/null || true)
+		[[ "$digest" == *@sha256:* ]] || error "Image $image has no verified content digest"
+		ok "Verified $image as $digest"
+		case "$image" in
+			"$TARGET_IMAGE") TARGET_IMAGE_DIGEST="$digest" ;;
+			"$POSTGRES_IMAGE") POSTGRES_IMAGE_DIGEST="$digest" ;;
+			"$TRAEFIK_IMAGE") TRAEFIK_IMAGE_DIGEST="$digest" ;;
+		esac
+	done
+	return 0
+}
+
+ensure_data_directory() {
+	CURRENT_PHASE="data directory setup"
+	mkdir -p -- "$DOKPLOY_DATA_DIR"
+	chmod 0750 "$DOKPLOY_DATA_DIR"
+}
+
+# Create PostgreSQL when absent or force an unhealthy existing task during
+# repair. The persistent volume is always retained on failures and reruns.
+create_postgres_service() {
+	CURRENT_PHASE="PostgreSQL service setup"
+	if has_service dokploy-postgres; then
+		if ! service_running dokploy-postgres && [[ "$SELECTED_ACTION" == "repair" ]]; then
+			run_logged docker service update --force dokploy-postgres >/dev/null || error "Failed to restart the existing PostgreSQL service during repair"
+			ok "PostgreSQL service repair requested"
+		else
+			ok "Reusing dokploy-postgres service"
+		fi
+		return
+	fi
+	local args=(service create --name dokploy-postgres --constraint 'node.role==manager' --network "$DOKPLOY_NETWORK_NAME"
+		--env POSTGRES_USER=dokploy --env POSTGRES_DB=dokploy
+		--secret "source=dokploy_postgres_password,target=/run/secrets/postgres_password"
+		--env POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password
+		--mount "type=volume,source=dokploy-postgres,target=/var/lib/postgresql/data")
+	[[ -n "$ENDPOINT_MODE" ]] && args+=(--endpoint-mode "$ENDPOINT_MODE")
+	[[ -n "$POSTGRES_IMAGE_DIGEST" ]] || error "Verified PostgreSQL image digest is unavailable"
+	args+=("$POSTGRES_IMAGE_DIGEST")
+	run_logged docker "${args[@]}" >/dev/null || error "Failed to create PostgreSQL service"
+	CREATED_POSTGRES_SERVICE=1
+	ok "PostgreSQL service created"
+}
+
+# Create Dokploy at the verified image digest or force an unhealthy repair task.
+# Mounts, secrets, network, port, and manager placement are explicit.
+create_dokploy_service() {
+	CURRENT_PHASE="Dokploy service setup"
+	if has_service dokploy; then
+		if ! service_running dokploy && [[ "$SELECTED_ACTION" == "repair" ]]; then
+			run_logged docker service update --force --image "$TARGET_IMAGE_DIGEST" dokploy >/dev/null || error "Failed to restart the existing Dokploy service during repair"
+			ok "Dokploy service repair requested"
+		else
+			ok "Reusing dokploy service"
+		fi
+		return
+	fi
+	local release_tag args
+	release_tag=$(release_tag_for_version)
+	args=(service create --name dokploy --replicas 1 --network "$DOKPLOY_NETWORK_NAME"
+		--mount "type=bind,source=/var/run/docker.sock,target=/var/run/docker.sock"
+		--mount "type=bind,source=$DOKPLOY_DATA_DIR,target=/etc/dokploy"
+		--mount "type=volume,source=dokploy,target=/root/.docker"
+		--secret "source=dokploy_postgres_password,target=/run/secrets/postgres_password"
+		--secret "source=dokploy_auth_secret,target=/run/secrets/dokploy_auth_secret"
+		--publish "published=$DOKPLOY_APP_PORT,target=3000,mode=host"
+		--update-parallelism 1 --update-order stop-first --constraint 'node.role == manager'
+		--env POSTGRES_PASSWORD_FILE=/run/secrets/postgres_password
+		--env BETTER_AUTH_SECRET_FILE=/run/secrets/dokploy_auth_secret
+		--env "RELEASE_TAG=$release_tag")
+	[[ -n "$ENDPOINT_MODE" ]] && args+=(--endpoint-mode "$ENDPOINT_MODE")
+	args+=("$TARGET_IMAGE_DIGEST")
+	run_logged docker "${args[@]}" >/dev/null || error "Failed to create Dokploy service"
+	CREATED_DOKPLOY_SERVICE=1
+	ok "Dokploy service created at immutable image digest"
+}
+
+wait_for_file() {
+	local path="$1" attempts="${2:-30}" i
+	for ((i = 1; i <= attempts; i++)); do
+		[[ -f "$path" ]] && return 0
+		sleep 2
+	done
+	return 1
+}
+
+# Start or repair the bundled proxy after Dokploy generates validated bind-file
+# paths. Existing proxy mode leaves ports and proxy ownership to the operator.
+ensure_traefik() {
+	CURRENT_PHASE="reverse proxy setup"
+	[[ "$DOKPLOY_SKIP_TRAEFIK" == "0" ]] || {
+		warn "Traefik installation skipped; configure the existing reverse proxy to route to port $DOKPLOY_APP_PORT"
+		return
+	}
+	if has_container dokploy-traefik; then
+		if [[ "$(docker inspect -f '{{.State.Running}}' dokploy-traefik 2>/dev/null)" != "true" ]]; then docker start dokploy-traefik >/dev/null; fi
+		docker network inspect "$DOKPLOY_NETWORK_NAME" --format '{{json .Containers}}' | grep -q dokploy-traefik ||
+			docker network connect "$DOKPLOY_NETWORK_NAME" dokploy-traefik
+		ok "Reusing dokploy-traefik container"
+		return
+	fi
+	wait_for_file "$DOKPLOY_DATA_DIR/traefik/traefik.yml" 45 || error "Dokploy did not generate Traefik configuration within 90 seconds"
+	[[ -n "$TRAEFIK_IMAGE_DIGEST" ]] || error "Verified Traefik image digest is unavailable"
+	audit_command docker run -d --name dokploy-traefik --restart always \
+		-v "$DOKPLOY_DATA_DIR/traefik/traefik.yml:/etc/traefik/traefik.yml:ro" \
+		-v "$DOKPLOY_DATA_DIR/traefik/dynamic:/etc/dokploy/traefik/dynamic" \
+		-v /var/run/docker.sock:/var/run/docker.sock:ro \
+		-p "$DOKPLOY_HTTP_PORT:80/tcp" -p "$DOKPLOY_HTTPS_PORT:443/tcp" -p "$DOKPLOY_HTTPS_PORT:443/udp" "$TRAEFIK_IMAGE_DIGEST"
+	docker run -d --name dokploy-traefik --restart always \
+		-v "$DOKPLOY_DATA_DIR/traefik/traefik.yml:/etc/traefik/traefik.yml:ro" \
+		-v "$DOKPLOY_DATA_DIR/traefik/dynamic:/etc/dokploy/traefik/dynamic" \
+		-v /var/run/docker.sock:/var/run/docker.sock:ro \
+		-p "$DOKPLOY_HTTP_PORT:80/tcp" -p "$DOKPLOY_HTTPS_PORT:443/tcp" -p "$DOKPLOY_HTTPS_PORT:443/udp" \
+		"$TRAEFIK_IMAGE_DIGEST" >/dev/null || error "Failed to start Dokploy Traefik reverse proxy"
+	CREATED_TRAEFIK_CONTAINER=1
+	docker network connect "$DOKPLOY_NETWORK_NAME" dokploy-traefik || error "Failed to attach Traefik to $DOKPLOY_NETWORK_NAME"
+	ok "Traefik reverse proxy created"
+}
+
+# Preserve service specs, prior image/channel, configuration, and a PostgreSQL
+# dump in a private checksummed directory. Any backup failure blocks the upgrade.
+create_backup() {
+	CURRENT_PHASE="pre-upgrade backup"
+	section "Create pre-upgrade backup"
+	mkdir -p -- "$DOKPLOY_BACKUP_DIR"
+	chmod 0700 "$DOKPLOY_BACKUP_DIR"
+	BACKUP_PATH="$DOKPLOY_BACKUP_DIR/${INSTALLED_VERSION}-$(date -u +%Y%m%dT%H%M%SZ)"
+	mkdir -p "$BACKUP_PATH"
+	chmod 0700 "$BACKUP_PATH"
+	docker service inspect dokploy >"$BACKUP_PATH/dokploy-service.json"
+	docker service inspect dokploy-postgres >"$BACKUP_PATH/postgres-service.json"
+	printf '%s\n' "$INSTALLED_IMAGE" >"$BACKUP_PATH/previous-image"
+	docker service inspect --format '{{range .Spec.TaskTemplate.ContainerSpec.Env}}{{println .}}{{end}}' dokploy |
+		sed -n 's/^RELEASE_TAG=//p' | head -n1 >"$BACKUP_PATH/previous-release-tag"
+	if [[ -d "$DOKPLOY_DATA_DIR" ]]; then
+		tar --acls --xattrs -czf "$BACKUP_PATH/dokploy-config.tar.gz" -C "$(dirname "$DOKPLOY_DATA_DIR")" "$(basename "$DOKPLOY_DATA_DIR")" || error "Failed to back up Dokploy configuration"
+	fi
+	local postgres_container
+	postgres_container=$(docker ps --filter name=dokploy-postgres --filter status=running --format '{{.ID}}' | head -n1)
+	[[ -n "$postgres_container" ]] || error "Cannot back up database because the PostgreSQL task is not running"
+	docker exec "$postgres_container" pg_dump -U dokploy -d dokploy -Fc >"$BACKUP_PATH/database.dump" || error "Database backup failed; upgrade was not started"
+	sha256sum "$BACKUP_PATH"/* >"$BACKUP_PATH/SHA256SUMS"
+	chmod 0600 "$BACKUP_PATH"/*
+	ok "Backup created and checksummed at $BACKUP_PATH"
+}
+
+# Run the ordered validation, backup, digest pull, migration handoff, service
+# update, health validation, rollback decision, and retention/cleanup phases.
+upgrade_dokploy() {
+	CURRENT_PHASE="upgrade validation"
+	validate_upgrade_path
+	create_backup
+	pull_and_verify_images target
+	CURRENT_PHASE="configuration migration"
+	log "No installer-owned configuration migration is required for $INSTALLED_VERSION -> $TARGET_VERSION"
+	CURRENT_PHASE="database migration"
+	log "Database migrations are application-managed during Dokploy startup; pre-migration backup is available at $BACKUP_PATH/database.dump"
+	CURRENT_PHASE="service upgrade"
+	local release_tag update_args
+	release_tag=$(release_tag_for_version)
+	update_args=(service update --image "$TARGET_IMAGE_DIGEST" --update-order stop-first --update-parallelism 1)
+	if docker service inspect --format '{{range .Spec.TaskTemplate.ContainerSpec.Env}}{{println .}}{{end}}' dokploy | grep -q '^RELEASE_TAG='; then
+		update_args+=(--env-rm RELEASE_TAG)
+	fi
+	update_args+=(--env-add "RELEASE_TAG=$release_tag" dokploy)
+	run_logged docker "${update_args[@]}" >/dev/null || {
+		attempt_rollback || true
+		error "Dokploy service update failed"
+	}
+	if ! validate_services; then
+		attempt_rollback || true
+		error "Upgraded services did not pass health validation"
+	fi
+	CURRENT_PHASE="post-upgrade cleanup"
+	log "Upgrade cleanup complete; the prior image and checksummed backup are intentionally retained for recovery"
+}
+
+# Restore the previous image/channel only for an explicitly database-safe pair,
+# then run the same health checks. Database dumps are never restored destructively.
+attempt_rollback() {
+	ROLLBACK_ATTEMPTED="yes"
+	CURRENT_PHASE="automatic rollback"
+	if [[ "$ROLLBACK_SUPPORTED" != "yes" ]]; then
+		ROLLBACK_RESULT="not safe for this migration path; backup preserved at $BACKUP_PATH"
+		warn "Automatic rollback is not declared database-safe for $INSTALLED_VERSION -> $TARGET_VERSION. The failed deployment and backup were preserved for manual recovery."
+		return 1
+	fi
+	local previous_image previous_release_tag rollback_args
+	previous_image=$(<"$BACKUP_PATH/previous-image")
+	[[ -n "$previous_image" ]] || {
+		ROLLBACK_RESULT="failed: previous image is unknown"
+		return 1
+	}
+	previous_release_tag=$(<"$BACKUP_PATH/previous-release-tag")
+	rollback_args=(service update --image "$previous_image" --rollback-order stop-first)
+	if docker service inspect --format '{{range .Spec.TaskTemplate.ContainerSpec.Env}}{{println .}}{{end}}' dokploy | grep -q '^RELEASE_TAG='; then
+		rollback_args+=(--env-rm RELEASE_TAG)
+	fi
+	[[ -n "$previous_release_tag" ]] && rollback_args+=(--env-add "RELEASE_TAG=$previous_release_tag")
+	rollback_args+=(dokploy)
+	run_logged docker "${rollback_args[@]}" >/dev/null || {
+		ROLLBACK_RESULT="failed while restoring previous image"
+		return 1
+	}
+	if validate_services; then
+		ROLLBACK_RESULT="previous image restored and healthy; database backup retained (not destructively restored)"
+		return 0
+	fi
+	ROLLBACK_RESULT="failed health validation after restoring previous image"
+	return 1
+}
+
+# Recreate only missing/unhealthy Dokploy resources at the installed version.
+# Existing data and credentials are preserved; unrecoverable secrets fail closed.
+repair_installation() {
+	CURRENT_PHASE="installation repair"
+	section "Repair installation"
+	initialize_swarm
+	ensure_network
+	ensure_data_directory
+	validate_repair_secrets
+	prepare_repair_target
+	create_secret_if_missing dokploy_postgres_password password
+	create_secret_if_missing dokploy_auth_secret hex
+	pull_and_verify_images
+	create_postgres_service
+	create_dokploy_service
+	ensure_traefik
+}
+
+# Provision a fresh supported host in dependency order. Every resource creation
+# is tracked so failure cleanup can remove only resources from this run.
+apply_fresh_install() {
+	CURRENT_PHASE="fresh installation"
+	section "Install Dokploy"
+	install_docker
+	initialize_swarm
+	ensure_network
+	ensure_data_directory
+	create_secret_if_missing dokploy_postgres_password password
+	create_secret_if_missing dokploy_auth_secret hex
+	pull_and_verify_images
+	create_postgres_service
+	create_dokploy_service
+	ensure_traefik
+}
+
+wait_for_service() {
+	local service="$1" attempts="$2" i
+	for ((i = 1; i <= attempts; i++)); do
+		service_running "$service" && return 0
+		sleep "$DOKPLOY_HEALTH_INTERVAL"
+	done
+	return 1
+}
+
+wait_for_http() {
+	local url="$1" attempts="$2" i
+	for ((i = 1; i <= attempts; i++)); do
+		if curl --fail --silent --show-error --max-time 5 "$url" >/dev/null 2>&1; then return 0; fi
+		sleep "$DOKPLOY_HEALTH_INTERVAL"
+	done
+	return 1
+}
+
+check_restart_loops() {
+	local service="$1"
+	! docker service ps --filter desired-state=running --no-trunc --format '{{.CurrentState}} {{.Error}}' "$service" 2>/dev/null | grep -Eq 'Rejected|Failed|non-zero exit'
+}
+
+# Verify service tasks, database reachability, endpoint response, mounts,
+# network attachment, proxy state, HTTPS (when configured), and stability.
+validate_services() {
+	CURRENT_PHASE="post-install health validation"
+	section "Validate Dokploy services"
+	wait_for_service dokploy-postgres "$DOKPLOY_HEALTH_ATTEMPTS" || {
+		warn "PostgreSQL service did not reach running state"
+		return 1
+	}
+	wait_for_service dokploy "$DOKPLOY_HEALTH_ATTEMPTS" || {
+		warn "Dokploy service did not reach running state"
+		return 1
+	}
+	local postgres_container dokploy_mounts postgres_mounts networks postgres_networks
+	postgres_container=$(docker ps --filter name=dokploy-postgres --filter status=running --format '{{.ID}}' | head -n1)
+	[[ -n "$postgres_container" ]] || return 1
+	docker exec "$postgres_container" pg_isready -U dokploy -d dokploy >/dev/null || {
+		warn "PostgreSQL is not accepting connections"
+		return 1
+	}
+	wait_for_http "http://127.0.0.1:$DOKPLOY_APP_PORT" "$DOKPLOY_HEALTH_ATTEMPTS" || {
+		warn "Dokploy application endpoint did not respond"
+		return 1
+	}
+	check_restart_loops dokploy || {
+		warn "Dokploy has failed or restarting tasks"
+		return 1
+	}
+	check_restart_loops dokploy-postgres || {
+		warn "PostgreSQL has failed or restarting tasks"
+		return 1
+	}
+	dokploy_mounts=$(docker service inspect --format '{{json .Spec.TaskTemplate.ContainerSpec.Mounts}}' dokploy)
+	[[ "$dokploy_mounts" == *"$DOKPLOY_DATA_DIR"* && "$dokploy_mounts" == *docker.sock* ]] || {
+		warn "Required Dokploy mounts are missing"
+		return 1
+	}
+	postgres_mounts=$(docker service inspect --format '{{json .Spec.TaskTemplate.ContainerSpec.Mounts}}' dokploy-postgres)
+	[[ "$postgres_mounts" == *dokploy-postgres* && "$postgres_mounts" == */var/lib/postgresql/data* ]] || {
+		warn "Required PostgreSQL persistent volume mount is missing"
+		return 1
+	}
+	networks=$(docker service inspect --format '{{json .Spec.TaskTemplate.Networks}}' dokploy)
+	[[ "$networks" == *"$(docker network inspect --format '{{.Id}}' "$DOKPLOY_NETWORK_NAME")"* ]] || {
+		warn "Dokploy is not attached to $DOKPLOY_NETWORK_NAME"
+		return 1
+	}
+	postgres_networks=$(docker service inspect --format '{{json .Spec.TaskTemplate.Networks}}' dokploy-postgres)
+	[[ "$postgres_networks" == *"$(docker network inspect --format '{{.Id}}' "$DOKPLOY_NETWORK_NAME")"* ]] || {
+		warn "PostgreSQL is not attached to $DOKPLOY_NETWORK_NAME"
+		return 1
+	}
+	if [[ "$DOKPLOY_SKIP_TRAEFIK" == "0" ]]; then
+		[[ "$(docker inspect -f '{{.State.Running}}' dokploy-traefik 2>/dev/null)" == "true" ]] || {
+			warn "Traefik is not running"
+			return 1
+		}
+		docker inspect --format '{{json .NetworkSettings.Networks}}' dokploy-traefik | grep -Fq "\"$DOKPLOY_NETWORK_NAME\"" || {
+			warn "Traefik is not attached to $DOKPLOY_NETWORK_NAME"
+			return 1
+		}
+		curl --silent --show-error --max-time 5 "http://127.0.0.1:$DOKPLOY_HTTP_PORT" >/dev/null 2>&1 || warn "Traefik HTTP entrypoint is running but no default route responded (expected before domain configuration)"
+		if [[ -n "$DOKPLOY_DOMAIN" ]]; then
+			curl --fail --silent --show-error --max-time 10 --resolve "$DOKPLOY_DOMAIN:$DOKPLOY_HTTPS_PORT:127.0.0.1" \
+				"https://$DOKPLOY_DOMAIN:$DOKPLOY_HTTPS_PORT" >/dev/null || {
+				warn "Configured HTTPS domain did not pass certificate/routing validation"
+				return 1
+			}
+		fi
+	fi
+	if ((DOKPLOY_STABILIZATION_SECONDS > 0)); then
+		log "Observing service stability for ${DOKPLOY_STABILIZATION_SECONDS}s"
+		sleep "$DOKPLOY_STABILIZATION_SECONDS"
+		if ! service_running dokploy || ! service_running dokploy-postgres; then
+			warn "Services became unhealthy during stabilization"
+			return 1
+		fi
+		check_restart_loops dokploy || return 1
+	fi
+	ok "Expected containers, database, endpoint, mounts, networks, and stability checks passed"
+	return 0
+}
+
+write_state_metadata() {
+	CURRENT_PHASE="installation finalization"
+	local temporary="$TMP_DIR/installer-state.env"
+	printf 'DOKPLOY_INSTALLED_VERSION=%s\nDOKPLOY_IMAGE=%s\nINSTALLED_AT=%s\nINSTALLER_VERSION=%s\n' \
+		"$TARGET_VERSION" "$TARGET_IMAGE_DIGEST" "$(date -u +%Y-%m-%dT%H:%M:%SZ)" "$INSTALLER_VERSION" >"$temporary"
+	chmod 0600 "$temporary"
+	install -m 0600 "$temporary" "$DOKPLOY_DATA_DIR/installer-state.env.new"
+	mv -f "$DOKPLOY_DATA_DIR/installer-state.env.new" "$DOKPLOY_DATA_DIR/installer-state.env"
+}
+
+redact_stream() {
+	local host_pattern
+	host_pattern=$(uname -n 2>/dev/null || true)
+	if [[ "$host_pattern" =~ ^[A-Za-z0-9._-]+$ ]]; then
+		host_pattern=${host_pattern//./\\.}
+	else
+		host_pattern='a^'
+	fi
+	sed -E \
+		-e "s/$host_pattern/[HOSTNAME]/g" \
+		-e 's/((authorization|proxy-authorization|cookie|set-cookie)[[:space:]]*:[[:space:]]*).*/\1[REDACTED]/Ig' \
+		-e 's/((password|passwd|token|secret|authorization|cookie|username|email|private[_-]?key)[[:space:]]*[:=][[:space:]]*)[^[:space:]",}]+/\1[REDACTED]/Ig' \
+		-e 's#(postgres(ql)?://)[^/@[:space:]]+@#\1[REDACTED]@#Ig' \
+		-e 's/(Bearer[[:space:]]+)[A-Za-z0-9._~+\/-]+/\1[REDACTED]/Ig' \
+		-e '/-----BEGIN ([A-Z ]+ )?PRIVATE KEY-----/,/-----END ([A-Z ]+ )?PRIVATE KEY-----/c\[PRIVATE KEY REDACTED]'
+}
+
+# Build an opt-out support bundle containing host/Docker/Dokploy status only.
+# Application environment variables and non-Dokploy workload logs are excluded.
+generate_diagnostics_bundle() {
+	[[ -n "$DOKPLOY_LOG_DIR" && -d "$DOKPLOY_LOG_DIR" ]] || return 0
+	local stamp diagnostics_dir output file
+	stamp=$(date -u +%Y%m%dT%H%M%SZ)
+	diagnostics_dir=$(mktemp -d "${TMPDIR:-/tmp}/dokploy-diagnostics.XXXXXX")
+	output="$DOKPLOY_LOG_DIR/diagnostics-$stamp.tar.gz"
+	{
+		printf 'installer=%s\nphase=%s\ninstalled=%s\ntarget=%s\nstate=%s\nrollback=%s\n' "$INSTALLER_VERSION" "$CURRENT_PHASE" "$INSTALLED_VERSION" "$TARGET_VERSION" "$INSTALLATION_STATE" "$ROLLBACK_RESULT"
+		uname -a
+		[[ -r /etc/os-release ]] && sed -n '1,40p' /etc/os-release
+		cat /proc/meminfo
+		df -hT
+		df -hi
+		ss -ltnp 2>&1
+	} >"$diagnostics_dir/host.txt" 2>&1
+	if command_exists docker; then
+		{
+			docker version
+			docker compose version
+			docker info
+			docker service ls
+			docker service ps --no-trunc dokploy
+			docker service ps --no-trunc dokploy-postgres
+			docker ps -a --filter name=dokploy --format '{{json .}}'
+			docker network ls
+		} >"$diagnostics_dir/docker.txt" 2>&1 || true
+		docker service logs --tail 200 --timestamps dokploy >"$diagnostics_dir/dokploy.log" 2>&1 || true
+		docker service logs --tail 200 --timestamps dokploy-postgres >"$diagnostics_dir/postgres.log" 2>&1 || true
+		docker logs --tail 200 --timestamps dokploy-traefik >"$diagnostics_dir/traefik.log" 2>&1 || true
+	fi
+	if command_exists systemctl; then systemctl status docker --no-pager >"$diagnostics_dir/docker-systemd.txt" 2>&1 || true; fi
+	if command_exists journalctl; then journalctl -u docker --since '-30 minutes' --no-pager -n 300 >"$diagnostics_dir/docker-journal.txt" 2>&1 || true; fi
+	[[ -n "$LOG_FILE" && -f "$LOG_FILE" ]] && cp "$LOG_FILE" "$diagnostics_dir/installer.log"
+	for file in "$diagnostics_dir"/*; do
+		[[ -f "$file" ]] || continue
+		redact_stream <"$file" >"$file.redacted"
+		mv -f "$file.redacted" "$file"
+		chmod 0600 "$file"
+	done
+	tar -czf "$output" -C "$diagnostics_dir" .
+	chmod 0600 "$output"
+	rm -rf -- "$diagnostics_dir"
+	DIAGNOSTICS_FILE="$output"
+}
+
+# Remove only containers, services, secrets, and networks positively tracked as
+# created by a failed install/repair. Persistent volumes and data are untouched.
+cleanup_partial_install() {
+	[[ "$SELECTED_ACTION" == "install" || "$SELECTED_ACTION" == "repair" ]] || return 0
+	if ((CREATED_TRAEFIK_CONTAINER == 1)); then docker rm -f dokploy-traefik >/dev/null 2>&1 || true; fi
+	if ((CREATED_DOKPLOY_SERVICE == 1)); then docker service rm dokploy >/dev/null 2>&1 || true; fi
+	if ((CREATED_POSTGRES_SERVICE == 1)); then docker service rm dokploy-postgres >/dev/null 2>&1 || true; fi
+	local attempt
+	for ((attempt = 1; attempt <= 5; attempt++)); do
+		if ! has_service dokploy && ! has_service dokploy-postgres; then break; fi
+		sleep 1
+	done
+	if ((CREATED_POSTGRES_SECRET == 1)); then docker secret rm dokploy_postgres_password >/dev/null 2>&1 || true; fi
+	if ((CREATED_AUTH_SECRET == 1)); then docker secret rm dokploy_auth_secret >/dev/null 2>&1 || true; fi
+	if ((CREATED_NETWORK == 1)); then
+		for ((attempt = 1; attempt <= 5; attempt++)); do
+			docker network rm "$DOKPLOY_NETWORK_NAME" >/dev/null 2>&1 && break
+			sleep 1
+		done
+	fi
+	ROLLBACK_RESULT="partial resources and secrets created by this run were removed; persistent volumes and data were preserved"
+}
+
+format_ip_for_url() {
+	local address="$1"
+	if [[ "$address" == *:* ]]; then printf '[%s]' "$address"; else printf '%s' "$address"; fi
+}
+
+# Persist atomic installation metadata after health succeeds and print access,
+# elapsed-time, log, and security guidance. Healthy no-op reruns do not rewrite it.
+finalize_installation() {
+	[[ -n "$TARGET_IMAGE_DIGEST" ]] || TARGET_IMAGE_DIGEST="$INSTALLED_IMAGE"
+	if [[ "$SELECTED_ACTION" != "validate" ]]; then
+		write_state_metadata
+	fi
+	INSTALL_SUCCEEDED=1
+	local elapsed address
+	elapsed=$(($(date +%s) - START_EPOCH))
+	address=${DOKPLOY_ADVERTISE_ADDR:-$(get_public_ip || printf 'SERVER_IP')}
+	section "Installation complete"
+	printf '%sDokploy installation completed successfully.%s\n' "$COLOR_GREEN" "$COLOR_RESET"
+	printf 'Version: %s\nAccess: http://%s:%s\nElapsed time: %ss\nLog: %s\n' \
+		"$TARGET_VERSION" "$(format_ip_for_url "$address")" "$DOKPLOY_APP_PORT" "$elapsed" "$LOG_FILE"
+	printf 'Security: create the first administrator immediately, configure DNS/HTTPS, and retain the backup/log in a protected location.\n'
+}
+
+# Orchestrate initialization, lock/log setup, preflight/state/action selection,
+# mutation, validation, recovery traps, and final reporting.
+main() {
+	if [[ "${1:-}" == "update" && "$DOKPLOY_INSTALL_ACTION" == "auto" ]]; then DOKPLOY_INSTALL_ACTION="upgrade"; fi
+	if [[ ! -t 0 || ! -t 1 ]]; then DOKPLOY_NONINTERACTIVE=1; fi
+	validate_configuration
+	configure_logging
+	enable_debug_trace
+	trap 'on_error "$LINENO"' ERR
+	trap cleanup EXIT
+	trap on_signal INT TERM
+	if [[ "$DOKPLOY_INSTALL_ACTION" != "check" ]]; then
+		TMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/dokploy-installer.XXXXXX")
+		chmod 0700 "$TMP_DIR"
+	fi
+	acquire_lock
+	log "Dokploy installer $INSTALLER_VERSION started; requested version=$DOKPLOY_VERSION action=$DOKPLOY_INSTALL_ACTION"
+	run_preflight
+	resolve_target_version
+	determine_installation_state
+	classify_upgrade
+	check_ports
+	select_action
+	print_preflight_report
+	if [[ "$SELECTED_ACTION" == "check" ]]; then
+		print_dry_run_actions
+		CURRENT_PHASE="preflight result"
+		((PREFLIGHT_FAILURES == 0)) || error "Preflight found $PREFLIGHT_FAILURES blocking problem(s); no changes were made"
+		INSTALL_SUCCEEDED=1
+		return 0
+	fi
+	CURRENT_PHASE="preflight result"
+	((PREFLIGHT_FAILURES == 0)) || error "Preflight found $PREFLIGHT_FAILURES blocking problem(s); no installation changes were made"
+	case "$SELECTED_ACTION" in
+		install) apply_fresh_install ;;
+		upgrade) upgrade_dokploy ;;
+		repair) repair_installation ;;
+		validate) log "Requested version is already installed; validating without changing resources" ;;
+		*) error "No safe action was selected" ;;
+	esac
+	if [[ "$SELECTED_ACTION" != "upgrade" ]]; then validate_services || error "Dokploy services failed post-install health validation"; fi
+	finalize_installation
+}
+
+if [[ "${BASH_SOURCE[0]}" == "$0" ]]; then
+	main "$@"
+fi
diff --git a/apps/website/public/install.sh.sha256 b/apps/website/public/install.sh.sha256
new file mode 100644
index 00000000..5862a759
--- /dev/null
+++ b/apps/website/public/install.sh.sha256
@@ -0,0 +1 @@
+f4c88270f4c9a602e078d9114c196767d5f3e18f7bb18ab45145df914ddb1921  install.sh
diff --git a/tests/installer/install.bats b/tests/installer/install.bats
new file mode 100644
index 00000000..25be7417
--- /dev/null
+++ b/tests/installer/install.bats
@@ -0,0 +1,337 @@
+#!/usr/bin/env bats
+
+setup() {
+	REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../.." && pwd)"
+	INSTALLER="$REPO_ROOT/apps/website/public/install.sh"
+}
+
+@test "installer has valid Bash syntax" {
+	run bash -n "$INSTALLER"
+	[ "$status" -eq 0 ]
+}
+
+@test "port validation accepts only the TCP/UDP port range" {
+	run bash -c 'source "$1"; validate_port 1; validate_port 443; validate_port 65535' _ "$INSTALLER"
+	[ "$status" -eq 0 ]
+
+	for value in 0 65536 abc '80;id' ''; do
+		run bash -c 'source "$1"; validate_port "$2"' _ "$INSTALLER" "$value"
+		[ "$status" -ne 0 ]
+	done
+}
+
+@test "version validation rejects command and URL input" {
+	run bash -c 'source "$1"; validate_version v0.29.13; validate_version 0.29.13; validate_version latest; validate_version canary' _ "$INSTALLER"
+	[ "$status" -eq 0 ]
+
+	for value in 'latest;id' 'https://example.com/image' "\$(id)" 'v1'; do
+		run bash -c 'source "$1"; validate_version "$2"' _ "$INSTALLER" "$value"
+		[ "$status" -ne 0 ]
+	done
+}
+
+@test "version comparison and upgrade classification are deterministic" {
+	run bash -c '
+		source "$1"
+		printf "%s " "$(version_compare v0.29.1 v0.29.2)"
+		printf "%s " "$(version_compare v0.29.2 v0.29.1)"
+		printf "%s\n" "$(version_compare v0.29.2 v0.29.2)"
+		INSTALLED_VERSION=v0.29.1 TARGET_VERSION=v0.29.2 classify_upgrade
+		printf "%s %s\n" "$UPGRADE_TYPE" "$ROLLBACK_SUPPORTED"
+		INSTALLED_VERSION=v0.29.2 TARGET_VERSION=v0.30.0 classify_upgrade
+		printf "%s\n" "$UPGRADE_TYPE"
+	' _ "$INSTALLER"
+	[ "$status" -eq 0 ]
+	[ "${lines[0]}" = "older newer equal" ]
+	[ "${lines[1]}" = "patch no" ]
+	[ "${lines[2]}" = "minor" ]
+}
+
+@test "rollback is advertised only for an explicitly database-safe pair" {
+	compatibility="$BATS_TEST_TMPDIR/rollback-compatible"
+	printf '%s\n' 'v0.29.1 v0.29.2 database-safe' >"$compatibility"
+	run bash -c '
+		source "$1"
+		DOKPLOY_ROLLBACK_COMPATIBILITY_FILE="$2"
+		INSTALLED_VERSION=v0.29.1 TARGET_VERSION=v0.29.2 classify_upgrade
+		printf "%s %s\n" "$UPGRADE_TYPE" "$ROLLBACK_SUPPORTED"
+		INSTALLED_VERSION=v0.29.2 TARGET_VERSION=v0.29.3 classify_upgrade
+		printf "%s\n" "$ROLLBACK_SUPPORTED"
+	' _ "$INSTALLER" "$compatibility"
+	[ "$status" -eq 0 ]
+	[ "${lines[0]}" = "patch yes" ]
+	[ "${lines[1]}" = "no" ]
+}
+
+@test "auto action is idempotent for an existing healthy installation" {
+	run bash -c '
+		source "$1"
+		DOKPLOY_INSTALL_ACTION=auto
+		INSTALLATION_STATE="Existing healthy install"
+		select_action
+		printf "%s\n" "$SELECTED_ACTION"
+	' _ "$INSTALLER"
+	[ "$status" -eq 0 ]
+	[ "$output" = "validate" ]
+}
+
+@test "fresh state never leaves or replaces an active foreign swarm" {
+	run bash -c '
+		source "$1"
+		DOCKER_DAEMON_AVAILABLE=1
+		SWARM_STATE=active
+		TARGET_VERSION=v0.29.13
+		DOKPLOY_DATA_DIR="$2/nonexistent"
+		has_service() { return 1; }
+		has_container() { return 1; }
+		has_network() { return 1; }
+		has_volume() { return 1; }
+		determine_installation_state
+		printf "%s\n" "$INSTALLATION_STATE"
+	' _ "$INSTALLER" "$BATS_TEST_TMPDIR"
+	[ "$status" -eq 0 ]
+	[ "$output" = "Conflicting installation" ]
+}
+
+@test "diagnostic redaction masks credentials and private keys" {
+	run bash -c '
+		source "$1"
+		printf "%s\n" \
+			"password=visible token:abc postgres://user:pass@db:5432/dokploy" \
+			"Authorization: Bearer abc.def" \
+			"-----BEGIN PRIVATE KEY-----" \
+			"very-secret-key" \
+			"-----END PRIVATE KEY-----" | redact_stream
+	' _ "$INSTALLER"
+	[ "$status" -eq 0 ]
+	[[ "$output" != *visible* ]]
+	[[ "$output" != *abc.def* ]]
+	[[ "$output" != *user:pass* ]]
+	[[ "$output" != *very-secret-key* ]]
+	[[ "$output" == *REDACTED* ]]
+}
+
+@test "release tags map to the stable application channel without eval" {
+	run bash -c '
+		source "$1"
+		TARGET_VERSION=v0.29.13; printf "%s\n" "$(release_tag_for_version)"
+		TARGET_VERSION=canary; printf "%s\n" "$(release_tag_for_version)"
+	' _ "$INSTALLER"
+	[ "$status" -eq 0 ]
+	[ "${lines[0]}" = "latest" ]
+	[ "${lines[1]}" = "canary" ]
+}
+
+@test "check mode does not create a log, lock, or temporary directory" {
+	run bash -c '
+		source "$1"
+		DOKPLOY_INSTALL_ACTION=check
+		DRY_RUN=0
+		validate_configuration
+		configure_logging
+		acquire_lock
+		printf "%s|%s\n" "$LOG_FILE" "$TMP_DIR"
+	' _ "$INSTALLER"
+	[ "$status" -eq 0 ]
+	[ "$output" = "check mode: no file created|" ]
+}
+
+@test "external proxy integration ignores HTTP and HTTPS ownership only" {
+	run bash -c '
+		source "$1"
+		DOKPLOY_SKIP_TRAEFIK=1
+		DOKPLOY_ALLOW_PORT_CONFLICT=0
+		DOCKER_DAEMON_AVAILABLE=0
+		INSTALLATION_STATE="Fresh install"
+		command_exists() { return 0; }
+		port_owner() { printf "occupied"; }
+		check_ports
+		printf "failures=%s\n" "$PREFLIGHT_FAILURES"
+	' _ "$INSTALLER"
+	[ "$status" -eq 0 ]
+	[ "${lines[${#lines[@]} - 1]}" = "failures=1" ]
+}
+
+@test "healthy rerun validates without rewriting installation metadata" {
+	run bash -c '
+		source "$1"
+		SELECTED_ACTION=validate
+		TARGET_IMAGE_DIGEST=sha256:existing
+		DOKPLOY_ADVERTISE_ADDR=127.0.0.1
+		START_EPOCH=$(date +%s)
+		write_state_metadata() { printf "metadata-written\n"; }
+		finalize_installation
+	' _ "$INSTALLER"
+	[ "$status" -eq 0 ]
+	[[ "$output" != *metadata-written* ]]
+}
+
+@test "repair refuses to replace a lost password for an existing database" {
+	run bash -c '
+		source "$1"
+		has_volume() { return 0; }
+		has_service() { return 1; }
+		docker() { return 1; }
+		validate_repair_secrets
+	' _ "$INSTALLER"
+	[ "$status" -eq 1 ]
+	[[ "$output" == *"existing dokploy-postgres volume"* ]]
+}
+
+@test "failed fresh cleanup removes only resources created by that run" {
+	run bash -c '
+		source "$1"
+		CLEANUP_LOG="$2"
+		SELECTED_ACTION=install
+		CREATED_TRAEFIK_CONTAINER=1
+		CREATED_DOKPLOY_SERVICE=1
+		CREATED_POSTGRES_SERVICE=1
+		CREATED_NETWORK=1
+		CREATED_POSTGRES_SECRET=1
+		CREATED_AUTH_SECRET=1
+		has_service() { return 1; }
+		docker() {
+			printf "docker" >>"$CLEANUP_LOG"
+			printf " %s" "$@" >>"$CLEANUP_LOG"
+			printf "\n" >>"$CLEANUP_LOG"
+		}
+		cleanup_partial_install
+		cat "$CLEANUP_LOG"
+	' _ "$INSTALLER" "$BATS_TEST_TMPDIR/cleanup.log"
+	[ "$status" -eq 0 ]
+	[[ "$output" == *"service rm dokploy"* ]]
+	[[ "$output" == *"network rm"* ]]
+	[[ "$output" != *"volume rm"* ]]
+	[[ "$output" == *"secret rm dokploy_postgres_password"* ]]
+}
+
+@test "declared-safe rollback restores the previous image and release channel" {
+	backup="$BATS_TEST_TMPDIR/backup"
+	mkdir -p "$backup"
+	printf '%s\n' 'dokploy/dokploy:v0.29.1@sha256:previous' >"$backup/previous-image"
+	printf '%s\n' 'latest' >"$backup/previous-release-tag"
+	run bash -c '
+		source "$1"
+		BACKUP_PATH="$2"
+		ROLLBACK_SUPPORTED=yes
+		INSTALLED_VERSION=v0.29.1
+		TARGET_VERSION=v0.29.2
+		docker() {
+			if [[ "${1:-}" == service && "${2:-}" == inspect ]]; then printf "RELEASE_TAG=canary\n"; fi
+			return 0
+		}
+		validate_services() { return 0; }
+		attempt_rollback
+		printf "%s\n" "$ROLLBACK_RESULT"
+	' _ "$INSTALLER" "$backup"
+	[ "$status" -eq 0 ]
+	[[ "$output" == *"previous image restored and healthy"* ]]
+}
+
+@test "undeclared migration path never attempts an unsafe rollback" {
+	run bash -c '
+		source "$1"
+		ROLLBACK_SUPPORTED=no
+		INSTALLED_VERSION=v0.28.0
+		TARGET_VERSION=v0.29.0
+		BACKUP_PATH=/protected/backup
+		docker() { printf "docker-must-not-run\n"; }
+		attempt_rollback
+	' _ "$INSTALLER"
+	[ "$status" -ne 0 ]
+	[[ "$output" != *docker-must-not-run* ]]
+	[[ "$output" == *"not declared database-safe"* ]]
+}
+
+@test "resource preflight distinguishes hard minimums from recommendations" {
+	run bash -c '
+		source "$1"
+		MEMORY_MB=512
+		SWAP_MB=0
+		INSTALL_FREE_MB=100
+		BACKUP_FREE_MB=100
+		TMP_FREE_MB=100
+		check_resource_thresholds
+		printf "failures=%s\n" "$PREFLIGHT_FAILURES"
+	' _ "$INSTALLER"
+	[ "$status" -eq 0 ]
+	[[ "$output" == *"failures=4"* ]]
+}
+
+@test "network preflight reports DNS, HTTPS, and registry failures" {
+	run bash -c '
+		source "$1"
+		getent() { return 1; }
+		curl() { return 1; }
+		ip() { return 1; }
+		command_exists() { return 1; }
+		check_connectivity
+		printf "failures=%s\n" "$PREFLIGHT_FAILURES"
+	' _ "$INSTALLER"
+	[ "$status" -eq 0 ]
+	[[ "$output" == *"failures=3"* ]]
+}
+
+@test "Docker validation rejects Snap and rootless installations" {
+	run bash -c '
+		source "$1"
+		command_exists() { return 0; }
+		snap() { return 0; }
+		docker() {
+			if [[ "${1:-}" == --version ]]; then printf "Docker version 24.0.0\n"
+			elif [[ "${1:-}" == version ]]; then printf "24.0.0\n"
+			elif [[ "${1:-}" == context ]]; then printf "production-remote\n"
+			elif [[ "${1:-}" == compose ]]; then printf "2.20.0\n"
+			elif [[ "${1:-}" == info && "${2:-}" != --format ]]; then return 0
+			elif [[ "${3:-}" == *SecurityOptions* ]]; then printf "[\"name=rootless\"]\n"
+			elif [[ "${3:-}" == *OperatingSystem* ]]; then printf "Docker Desktop\n"
+			elif [[ "${3:-}" == *DockerRootDir* ]]; then printf "/tmp\n"
+			elif [[ "${3:-}" == *LocalNodeState* ]]; then printf "inactive\n"
+			elif [[ "${3:-}" == *Driver* ]]; then printf "overlay2\n"
+			fi
+		}
+		detect_docker
+	' _ "$INSTALLER"
+	[ "$status" -eq 0 ]
+	[[ "$output" == *"Docker installed through Snap is unsupported"* ]]
+	[[ "$output" == *"Rootless Docker is unsupported"* ]]
+	[[ "$output" == *"Docker Desktop is unsupported"* ]]
+	[[ "$output" == *"Remote Docker context"* ]]
+}
+
+@test "Docker validation rejects Podman aliases" {
+	run bash -c '
+		source "$1"
+		command_exists() { return 0; }
+		snap() { return 1; }
+		docker() {
+			if [[ "${1:-}" == --version ]]; then printf "podman version 5.0\n"
+			elif [[ "${1:-}" == version ]]; then printf "5.0\n"
+			elif [[ "${1:-}" == context ]]; then printf "default\n"
+			elif [[ "${1:-}" == info ]]; then return 1
+			fi
+		}
+		detect_docker
+	' _ "$INSTALLER"
+	[ "$status" -eq 0 ]
+	[[ "$output" == *"Podman Docker compatibility is unsupported"* ]]
+}
+
+@test "host configuration replacement is atomic and backed up" {
+	work="$BATS_TEST_TMPDIR/host-config"
+	mkdir -p "$work"
+	printf '%s\n' old >"$work/target"
+	printf '%s\n' new >"$work/source"
+	run bash -c '
+		source "$1"
+		DOKPLOY_BACKUP_DIR="$2/backups"
+		install_host_file "$2/source" "$2/target" 0600
+		printf "current="; cat "$2/target"
+		printf "backup="; cat "$HOST_CONFIG_BACKUP_PATH/target"
+		stat -c "mode=%a" "$2/target"
+	' _ "$INSTALLER" "$work"
+	[ "$status" -eq 0 ]
+	[[ "$output" == *"current=new"* ]]
+	[[ "$output" == *"backup=old"* ]]
+	[[ "$output" == *"mode=600"* ]]
+}