Skip to content

Update Container Config #144

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
overheadhunter wants to merge 4 commits into
base: develop
Choose a base branch
from
Open

Update Container Config #144

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
fdee5ee
use postgres:17
overheadhunter Feb 13, 2026
21734e4
replace deprecated `KEYCLOAK_ADMIN` properties
overheadhunter Feb 13, 2026
c1b25db
revert memory limit change
overheadhunter Feb 13, 2026
fb7beb9
remove duplicate `httpGet` in health check
overheadhunter Feb 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 14 additions & 14 deletions assets/js/hubsetup.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,12 +187,10 @@ class ConfigBuilder {
let sql = [];
if (!this.cfg.keycloak.useExternal) {
sql.push(`CREATE USER keycloak WITH ENCRYPTED PASSWORD '${this.cfg.db.keycloakPw}';
CREATE DATABASE keycloak WITH ENCODING 'UTF8';
GRANT ALL PRIVILEGES ON DATABASE keycloak TO keycloak;`)
CREATE DATABASE keycloak WITH ENCODING 'UTF8' OWNER keycloak;`)
Copy link
Member Author

@overheadhunter overheadhunter Feb 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just for explanation:

On newer Postgres versions the public schema isn't writable by non-owners. This change makes the user owner of the corresponding DB, rendering the additional GRANT ALL PRIVILEGES obsolete.

}
sql.push(`CREATE USER hub WITH ENCRYPTED PASSWORD '${this.cfg.db.hubPw}';
CREATE DATABASE hub WITH ENCODING 'UTF8';
GRANT ALL PRIVILEGES ON DATABASE hub TO hub;`);
CREATE DATABASE hub WITH ENCODING 'UTF8' OWNER hub;`);
return sql.join('\n');
}

Expand Down Expand Up @@ -388,7 +386,7 @@ EOF`;
getPostgresService() {
return {
depends_on: {'init-config': {condition: 'service_completed_successfully'}},
image: 'postgres:14-alpine',
image: 'postgres:17-alpine',
volumes: ['db-init:/docker-entrypoint-initdb.d', 'db-data:/var/lib/postgresql/data'],
deploy: {
resources: {
Expand All @@ -397,6 +395,7 @@ EOF`;
},
healthcheck: {
test: ['CMD', 'pg_isready', '-U', 'postgres'],
start_period: '30s',
interval: '10s',
timeout: '3s',
},
Expand Down Expand Up @@ -439,13 +438,14 @@ EOF`;
...(!this.cfg.compose.includeTraefik && {ports: [`${this.getPort(this.cfg.keycloak.publicUrl)}:8080`]}),
healthcheck: {
test: ['CMD', 'curl', '-f', `http://localhost:9000${this.getPathname(HubSetup.urlWithTrailingSlash(this.cfg.keycloak.publicUrl))}health/live`],
interval: '60s',
start_period: '60s',
interval: '10s',
timeout: '3s',
},
restart: 'unless-stopped',
environment: {
KEYCLOAK_ADMIN: this.cfg.keycloak.adminUser,
KEYCLOAK_ADMIN_PASSWORD: this.cfg.keycloak.adminPw,
KC_BOOTSTRAP_ADMIN_USERNAME: this.cfg.keycloak.adminUser,
KC_BOOTSTRAP_ADMIN_PASSWORD: this.cfg.keycloak.adminPw,
KC_DB: 'postgres',
KC_DB_URL: 'jdbc:postgresql://postgres:5432/keycloak',
KC_DB_USERNAME: 'keycloak',
Expand Down Expand Up @@ -669,10 +669,10 @@ class KubernetesConfigBuilder extends ConfigBuilder {
httpGet: {path: '/q/health/started', port: 8080},
},
livenessProbe: {
httpGet: {path: '/api/config', port: 8080}, httpGet: {path: '/api/config', port: 8080}, initialDelaySeconds: 10, periodSeconds: 3
httpGet: {path: '/api/config', port: 8080}, initialDelaySeconds: 10, periodSeconds: 3
},
readinessProbe: {
httpGet: {path: '/q/health/ready', port: 8080}, httpGet: {path: '/api/config', port: 8080}, initialDelaySeconds: 10, periodSeconds: 3
httpGet: {path: '/api/config', port: 8080}, initialDelaySeconds: 10, periodSeconds: 3
Comment on lines 671 to +675
Copy link
Member

@SailReal SailReal Feb 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we change this here, we should change

cryptomator.github.io/assets/js/hubsetup.js

Line 478 in fb7beb9

test: ['CMD-SHELL', '(curl -f http://localhost:8080/q/health/live && curl -f http://localhost:8080/api/config) || exit 1'],
as well.

Copy link
Member Author

@overheadhunter overheadhunter Feb 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The problem was that the object contained the httpGet key twice. I don't know whether this is valid in Kubernetes deployment files, but it is not in JS. The last definition won, therefore the yaml has always just contained this:

httpGet:
  path: /api/config
  port: 8080

Is it really intended to probe two different urls? Then we need a different solution.

},
env: [
{name: 'HUB_PUBLIC_ROOT_PATH', value: this.getPathnameWithTrailingSlash(this.cfg.hub.publicUrl)},
Expand Down Expand Up @@ -714,10 +714,10 @@ class KubernetesConfigBuilder extends ConfigBuilder {
spec: {
containers: [{
name: 'postgres',
image: 'postgres:14-alpine',
image: 'postgres:17-alpine',
ports: [{containerPort: 5432}],
resources: {
requests: {cpu: '25m', memory: '64Mi'},
requests: {cpu: '25m', memory: '32Mi'},
limits: {cpu: '1000m', memory: '256Mi'},
},
livenessProbe: {
Expand Down Expand Up @@ -763,8 +763,8 @@ class KubernetesConfigBuilder extends ConfigBuilder {
startCmd = ['/opt/keycloak/bin/kc.sh', 'start', '--import-realm']; // prod mode without build time optimizations (requires a proper TLS termination proxy)
}
let env = [
{name: 'KEYCLOAK_ADMIN', valueFrom: {secretKeyRef: {name: 'hub-secrets', key: 'kc_admin_user'}}},
{name: 'KEYCLOAK_ADMIN_PASSWORD', valueFrom: {secretKeyRef: {name: 'hub-secrets', key: 'kc_admin_pass'}}},
{name: 'KC_BOOTSTRAP_ADMIN_USERNAME', valueFrom: {secretKeyRef: {name: 'hub-secrets', key: 'kc_admin_user'}}},
{name: 'KC_BOOTSTRAP_ADMIN_PASSWORD', valueFrom: {secretKeyRef: {name: 'hub-secrets', key: 'kc_admin_pass'}}},
{name: 'KC_DB', value: 'postgres'},
{name: 'KC_DB_URL', value: 'jdbc:postgresql://postgres-svc:5432/keycloak'},
{name: 'KC_DB_USERNAME', value: 'keycloak'},
Expand Down