[RiadGahlouz]

What is this PR about?

Adds full support for Azure Blob Storage (AZ_BS) as a backup destination alongside S3 / S3-compatible storage, and redesigns the destinations settings interface into Backup Destinations. Key features include:

• Authentication: Supports Storage Account Name + Access Key (Shared Key) and Shared Access Signature (SAS URL).
• Quick Paste Auto-Parser: Automatically extracts Account Name, Account Key, and custom/non-standard endpoints when pasting an Azure Connection String.
• Rclone Integration: Implements dynamic on-the-fly Rclone :azureblob: remote and flag building with credential redaction (--azureblob-key, --azureblob-sas-url).
• Runner Support: Fully integrated across all backup and restore runners (PostgreSQL, MySQL, MariaDB, MongoDB, LibSQL, Docker Compose stacks, web server settings, and persistent volumes).
• UI Redesign: Renames section to "Backup Destinations", adds provider badges (S3 vs. Azure Blob), context-aware container/bucket labels, and in-row quick "Test Connection" buttons.
• Drizzle Migration & OpenAPI: Includes migration 0196_windy_jack_power.sql with journal entries and ensures OpenAPI generation compatibility (pnpm generate:openapi).
• Automated Tests: Adds 45 automated unit and integration tests across 7 test suites.

Checklist

Before submitting this PR, please make sure that:

• You created a dedicated branch based on the canary branch.
• You have read the suggestions in the CONTRIBUTING.md file https://github.com/Dokploy/dokploy/blob/canary/CONTRIBUTING.md#pull-request
• You have tested this PR in your local instance. If you have not tested it yet, please do so before submitting. This helps avoid wasting maintainers' time reviewing code that has not been verified by you.

Issues related (if applicable)

closes #3675

Confidence Score: 5/5

The Azure Blob destination changes appear safe to merge, with all previous findings resolved and no actionable new issue established.

Summary

Adds Azure Blob Storage as a first-class backup destination and extends backup and restore execution across databases, Compose services, web-server data, and persistent volumes.

• Supports Azure account-key and SAS URL authentication, connection-string parsing, optional custom endpoints, and Azure-specific rclone remotes.
• Introduces type-specific API validation while retaining compatibility with legacy S3 inputs and the az_bs alias.
• Redesigns destination management with provider-aware fields, badges, container labels, and connection testing.
• Adds credential redaction for Azure rclone flags and broad test coverage for validation, parsing, command construction, injection resistance, and redaction.
• Adds the destination type migration and associated Drizzle metadata.
• The follow-up changes address the prior findings by supplying an execution server for cloud quick tests, normalizing provider changes, enforcing type-specific API validation, and covering actual shell-quoted credential formats.

_{Reviews (3) · Last reviewed commit: "fix(destinations): address Azure Blob St..."}

[narcisonunez]

I like this feature. This is an automated review and I will personally review this later. Please check the following comments.

Review: Azure Blob Storage backup destination

Solid feature design overall (clean getDestinationRemote abstraction, safe additive migration, consistent shell-quoting against command injection, and real tests that actually exercise the code). Ran the full suite + typecheck locally: all green except 4 pre-existing, unrelated Docker-network-dependent tests. A few issues should be fixed before merge, especially #1 and #2.

Must fix

1. Partial credential leak in redactRcloneCredentials (packages/server/src/utils/backups/redact.ts). The regex breaks when a secret contains both ' and " (shell-quote wraps it in double quotes with an escaped \" inside, and the redaction regex stops at that literal quote), leaking the tail of the secret. This now also feeds errorMessage sent to Discord/Slack/email/webhook notifications on backup failure, not just logs.
2. SAS URL doesn't auto-fill Container Name (handle-destinations.tsx, SAS field). parseAzureSasUrl exists and extracts the container name but is never wired to the input (onChange). A pasted SAS URL scoped to one container with a stale "Container Name" value silently produces a broken destination.
3. isSas detection sniffs the secret string instead of trusting provider (packages/server/src/utils/backups/utils.ts:100). Runs on raw DB rows, bypassing the Zod validation that normally requires accessKey for account_key mode; can silently build an incomplete rclone command instead of failing clearly.
4. "Container not found" error falls back to the destination name, not the storage account (destination.ts router, ~line 88): input.accessKey || input.name — SAS URL mode always has empty accessKey, so the error is misleading.

Should check

5. The Azure-specific friendly error is gated on "directory not found", which is rclone's S3-backend wording — unverified whether the azureblob backend actually returns that string for a missing container.
6. s3DestinationSchema/azureBlobDestinationSchema (and their 12 dedicated tests) aren't used by the real API path (apiCreateDestination/apiUpdateDestination use a separate destinationSchema) — false test coverage confidence.

Nits

7. additionalFlags was dropped from the client-side form.trigger([...]) validation list before "Test Connection" (present pre-PR, missing now).
8. 8 restore call sites rebuild the remote path by hand instead of reusing getRemotePath() (path-normalization has already drifted from the backup side).
9. Section-divider comments (/* AZURE BLOB STORAGE FIELDS */, etc.) violate this repo's CLAUDE.md.
10. Provider-required-field validation and the az_bs/azure_blob alias check are each duplicated across ~4-5 places instead of one shared helper.

[Support-SDL]

Are there any updates on this? I would also like to be able to connect to Azure Blob for backups