Port upstream Trigger.dev self-hosting changes (v4.7.3...v4.8.1) #11

Upstream hosting/docker changed: v4.7.3 → v4.8.1

Port these upstream self-hosting changes into this Coolify template. Follow the Coolify parser
rules in the header of docker-compose.yaml and CLAUDE.md — upstream's compose is not
Coolify-shaped (ports, networks, restart, .env secrets vs SERVICE_* magic variables).
Not everything applies: skip local-only tooling (generate-secrets.sh, Traefik example, publish IPs).

Full diff: triggerdotdev/trigger.dev@v4.7.3...v4.8.1

Self-hosting notes from releases in range

v4.7.4

• Self-hosted instances can require custom deploy base images per runtime via the new DEPLOY_BASE_IMAGES and DEPLOY_BUILD_BASE_IMAGES webapp settings. The CLI builds on the images the instance specifies, and older CLIs are rejected with an upgrade message. (#5005)
• Self-hosted instances can add a Cloudflare Turnstile bot check to the magic-link sign-in form by setting TURNSTILE_SITE_KEY and TURNSTILE_SECRET_KEY. It's off unless both are set.
• Magic links now only sign you in from the browser that requested them, so a link opened elsewhere (including by an email security scanner) no longer logs anyone in. Self-hosted instances can turn this off with MAGIC_LINK_SAME_BROWSER_REQUIRED=false.
• Magic-link sign-in emails now always link to LOGIN_ORIGIN, whatever host the request came in on.

v4.7.5

• trigger deploy and trigger promote now say which environment they're targeting, and accept --prod as a shorthand for --env prod. When TRIGGER_ACCESS_TOKEN holds an environment API key and you don't pass --env, they now use that key's environment instead of assuming prod. Passing an --env that doesn't match the key is now an error, where before the deploy went to the key's environment. (70ea83d38)

v4.7.6

• NODE_EXTRA_CA_CERTS set as an environment variable now reaches the task process at startup instead of being overwritten by the image's empty default. (fee21c38c)

v4.7.7

• Self-hosted: the webapp and supervisor images now run on Node.js 24.22.1. The supervisor no longer trusts certificates issued under the compromised emSign (eMudhra) certificate authorities, and the webapp image builds its database migration tool with Go 1.26.10, which rejects the compromised eMudhra intermediates.

v4.8.0

• Set KUBERNETES_POD_RESERVED_SOURCE_PORTS on the supervisor (for example 50080,50081) to stop runs using those ports for outbound connections, which is useful to avoid port clashes.
• Runs now get a TRIGGER_DASHBOARD_URL environment variable with the dashboard's address, so a task can link to its run (${TRIGGER_DASHBOARD_URL}/runs/${ctx.run.id}) on any Trigger.dev instance. A TRIGGER_DASHBOARD_URL you set on the project still wins.

v4.8.1

• Fix trigger deploy failing on self-hosted instances with custom base images. Stages built on a custom image now keep the trust store that image ships with. (b5ed66b74)

Diffs

--- v4.7.3/webapp/docker-compose.yml
+++ v4.8.1/webapp/docker-compose.yml
@@ -58,7 +58,10 @@
       DIRECT_URL: ${DIRECT_URL:-postgresql://postgres:${POSTGRES_PASSWORD}@postgres:5432/main?schema=public&sslmode=disable}
       SESSION_SECRET: ${SESSION_SECRET}
       MAGIC_LINK_SECRET: ${MAGIC_LINK_SECRET}
+      MAGIC_LINK_SAME_BROWSER_REQUIRED: ${MAGIC_LINK_SAME_BROWSER_REQUIRED:-true}
       BLOCKED_EMAIL_DOMAINS: ${BLOCKED_EMAIL_DOMAINS:-}
+      TURNSTILE_SITE_KEY: ${TURNSTILE_SITE_KEY:-}
+      TURNSTILE_SECRET_KEY: ${TURNSTILE_SECRET_KEY:-}
       ENCRYPTION_KEY: ${ENCRYPTION_KEY}
       PROVIDER_SECRET: ${PROVIDER_SECRET}
       COORDINATOR_SECRET: ${COORDINATOR_SECRET}