fix: add rybbit's missing redis dependency, stop renaming clickhouse's default user - #145
Merged
Conversation
…s default user
Two config bugs found running the first real deploy on heimdall:
1. rybbit-backend hardcodes "default" as its ClickHouse username (no env
var controls it - only CLICKHOUSE_HOST/DB/PASSWORD are configurable,
confirmed against rybbit's own upstream docker-compose.yml). Our
clickhouse-26.5.yml set CLICKHOUSE_USER=${APP_NAME}, which renames
ClickHouse's built-in "default" user rather than adding a second one -
so the user backend was actually trying to authenticate as no longer
existed. Dropped CLICKHOUSE_USER (and the now-pointless
CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT) from the template entirely.
2. rybbit-backend requires Redis (REDIS_HOST/REDIS_PORT/REDIS_PASSWORD)
for session tracking and bot-anomaly counters - our compose file never
had a redis service at all, so the backend was falling back to
localhost:6379 and failing every request. Added a redis service
(password-protected via --requirepass, reusing DATABASE_PASSWORD like
postgres/clickhouse already do) and wired backend's depends_on to it.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Add a one-line comment above each template's environment: block stating exactly which user/password/database an app should connect with - prompted by the ClickHouse default-user bug just fixed, where the actual credentials weren't obvious from scanning the file. Also wires CLICKHOUSE_PASSWORD into clickhouse-25.4.yml (previously unset, so its default user had no network access at all) so the new comment is actually accurate - unused by any app today, but should behave the same as clickhouse-26.5.yml when something eventually picks it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Read better as the first thing you see when opening one of these templates, rather than buried mid-service next to environment:. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
include it like postgres/clickhouse already are, override only command/healthcheck locally for --requirepass auth - image, volumes, restart, and networks now come from the shared template instead of being duplicated. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…en unset server/src/db/redis/redis.ts conditionally spreads password into the ioredis config only when REDIS_PASSWORD is set - confirmed against rybbit's actual source, unlike ClickHouse's client this one genuinely supports running without auth. Redis is internal-network-only, no different exposure than postgres/clickhouse would have without a password, so the plain include with no local override is enough. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
First step of normalizing every shared database template to the same
target state: use the engine's own default user (root for MySQL,
default for ClickHouse/Redis, postgres for Postgres), password it with
DATABASE_PASSWORD, refuse unauthenticated connections - never create a
separate ${APP_NAME} user. Redis was the one holdout with no auth at
all; --requirepass now brings it in line with postgres/mysql/mongo/
clickhouse, all of which already required a password.
Reverts the previous "drop redis auth for rybbit" commit's reasoning -
that was a per-app optimization that made sense for rybbit's client
alone, but conflicts with treating "always require a password" as a
property of the shared template itself, not a per-consumer choice.
REDIS_PASSWORD is back in rybbit's vault-env; the shared template now
carries the auth requirement so rybbit needs zero local overrides.
Postgres/MySQL/MongoDB still create an ${APP_NAME} user for now -
follow-up work, not done here.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Drop POSTGRES_USER: \${APP_NAME} - same target state as the other
shared templates, use the engine's own default user (postgres) rather
than creating a per-app one. Only codecov consumes this template
today; updated its timeseries_database_url to connect as postgres
instead of \${APP_NAME}.
Also fixes a bug introduced by the earlier redis-7.yml/redis-8.yml
auth change: codecov (the only consumer of redis-7.yml) had
redis_url: "redis://redis:6379" with no password at all - now that
the shared template requires one, that connection would have failed.
Fixed to redis://:\${DATABASE_PASSWORD}@redis:6379. Not live anywhere
yet (no vault exists for codecov), so nothing broke in production, but
would have on first deploy.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…her templates Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
…lt user
Postgres-flavored templates (postgres-17/18, pgvector-17, paradedb-17)
now connect as postgres instead of creating \${APP_NAME}; MySQL and
MongoDB now connect as root instead of creating a scoped \${APP_NAME}
user (both unused by any app today, changed for consistency with the
rest of the catalog). Updates every consumer of the postgres templates
to match: gatus's global.yml env-substitutes \${POSTGRES_USER} at
runtime (not one of our own .tpl files), semaphore's SEMAPHORE_DB_USER,
glitchtip's DATABASE_URL, rybbit's POSTGRES_USER, and codecov's
database_url in codecov.yml.tpl.
Completes the normalization started with redis-7/8.yml and
timescale-17.yml: every shared DB template now uses its engine's own
default user, password-protected, with the app's own name reserved
just for the database itself.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two config bugs surfaced by rybbit-backend's logs on heimdall's first real deploy, plus a full normalization of every shared DB template to a consistent target state: connect as the engine's own default user (postgres for Postgres, root for MySQL/MongoDB, default for ClickHouse/Redis), password it with
DATABASE_PASSWORD, refuse unauthenticated connections - never create a separate${APP_NAME}user.${APP_NAME}stays reserved for the database name itself.1. ClickHouse
defaultuser auth failure.rybbit-backendhardcodesdefaultas its ClickHouse username - confirmed against rybbit's source. Ourclickhouse-26.5.ymlsetCLICKHOUSE_USER: ${APP_NAME}, which renames the built-indefaultuser rather than adding a second one - so the account the backend authenticated as no longer existed. Fixed by droppingCLICKHOUSE_USER.2. Missing Redis for rybbit. rybbit-backend requires Redis - our compose file never had a
redisservice at all. Fixed by including the sharedredis-8.ymltemplate.3. Docs: connection credentials per shared template. Every shared DB template now has a one-line header comment stating user/password/database/port.
4. Full normalization to default users, password-required.
redis-7.yml/redis-8.yml:--requirepassadded (was the one holdout with no auth at all).timescale-17.yml,postgres-17.yml,postgres-18.yml,pgvector-17.yml,paradedb-17.yml: dropPOSTGRES_USER: ${APP_NAME}, connect aspostgres.mysql-8.yml: dropMYSQL_USER/MYSQL_PASSWORD, connect asroot.mongodb-8.yml: dropMONGODB_USERNAME/MONGODB_PASSWORD, connect asroot.Updated every real consumer to match:
codecov.yml.tpl(redis_url, database_url, timeseries_database_url - also fixes a bug the redis auth change would have introduced, since codecov's redis_url had no password at all),gatus'sglobal.yml(env-substitutes${POSTGRES_USER}at container runtime, not one of our own.tplfiles),semaphore'sSEMAPHORE_DB_USER,glitchtip'sDATABASE_URL,rybbit'sPOSTGRES_USER.Test plan
deploy/tests/(48 tests) passdocker compose configverified for every app in the catalog (gatus, semaphore, glitchtip, rybbit, codecov, traefik, cloudflared, twofauth, homepage, databasus, beszel)codecov.yml.tplrender verified viadeploy/render.pydirectly