Merge pull request #50 from tma1-ai/greptime-standalone-config-auth

feat(greptime): default standalone server config + opt-in enforced static auth

Author: killme2008

.env.dev.example

@@ -48,8 +48,8 @@ DATABASE_URL="postgresql://postgres:postgres@localhost:5432/postgres"
 # GREPTIME_SQL_PORT="4002"
 # GREPTIME_SQL_READ_ONLY_HOST="localhost"
 # GREPTIME_DB="openfuse"
-# GREPTIME_USER="root"
-# GREPTIME_PASSWORD=""
+# GREPTIME_USER="openfuse"
+# GREPTIME_PASSWORD="" # empty -> local GreptimeDB runs without auth
 # GREPTIME_SQL_MAX_OPEN_CONNECTIONS="25"
 # GREPTIME_RAW_EVENTS_TABLE="raw_events"
 # LANGFUSE_GREPTIME_WRITE_MAX_FIELD_BYTES applies only when reactively truncating an oversized row.

.env.prod.example

@@ -242,10 +242,12 @@ GREPTIME_SQL_PORT="4002"
 # Optional dedicated read-only MySQL host; falls back to GREPTIME_SQL_HOST.
 # GREPTIME_SQL_READ_ONLY_HOST="greptimedb"
 GREPTIME_DB="openfuse"
-# Auth: empty for an unauthenticated single-node GreptimeDB. Set both for a
-# secured/managed deployment.
-# GREPTIME_USER=
-# GREPTIME_PASSWORD=
+# Auth: a non-empty password turns on enforced GreptimeDB static auth — the greptimedb container
+# generates a credentials file and starts with --user-provider, and the app authenticates with the
+# same user/password. These two values MUST match. Leave the password empty only for a single,
+# unauthenticated node you fully control. Set a strong password for any real deployment.
+GREPTIME_USER="openfuse"
+GREPTIME_PASSWORD="changeme-greptime-password" # CHANGEME
 # Max open connections in the MySQL read pool.
 # GREPTIME_SQL_MAX_OPEN_CONNECTIONS=25
 # Raw events table name (write-path source of truth).

.env.quickstart.example

@@ -28,6 +28,8 @@ REDIS_AUTH="myredissecret"
 
 # --- GreptimeDB (analytics event store) ---
 # Hosts are the docker-compose service name. gRPC 4001 = writes, MySQL 4002 = reads + migrations.
+# GreptimeDB auth is OFF here (no GREPTIME_PASSWORD) — fine for local eval, not for a shared host.
+# To enforce auth, set GREPTIME_PASSWORD (see .env.prod.example).
 GREPTIME_GRPC_URL="greptimedb:4001"
 GREPTIME_SQL_HOST="greptimedb"
 GREPTIME_SQL_PORT="4002"

.github/workflows/release-images.yml

@@ -5,7 +5,8 @@ name: Release images
 #
 # Triggers:
 #   - push a `v*` tag (e.g. `v1.2.0`)  -> versioned release: semver tags + `latest`
-#     (non-`-rc` tags only get the floating major/minor and `latest`).
+#     (pre-release tags like `v1.0.0-alpha.1` only get the exact `{{version}}`
+#     tag; the floating major/minor and `latest` stay on the last stable tag).
 #   - manual run (workflow_dispatch)   -> builds the chosen ref, tagged by commit sha
 #     plus an optional custom tag input. Never moves `latest`.
 #
@@ -82,11 +83,11 @@ jobs:
             latest=false
           tags: |
             type=semver,pattern={{version}},enable=${{ github.event_name == 'push' }}
-            type=semver,pattern={{major}}.{{minor}},enable=${{ github.event_name == 'push' && !contains(github.ref, '-rc') }}
-            type=semver,pattern={{major}},enable=${{ github.event_name == 'push' && !contains(github.ref, '-rc') }}
+            type=semver,pattern={{major}}.{{minor}},enable=${{ github.event_name == 'push' && !contains(github.ref, '-') }}
+            type=semver,pattern={{major}},enable=${{ github.event_name == 'push' && !contains(github.ref, '-') }}
             type=sha
             type=raw,value=${{ github.event.inputs.tag }},enable=${{ github.event.inputs.tag != '' }}
-            type=raw,value=latest,enable=${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-rc') }}
+            type=raw,value=latest,enable=${{ github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') && !contains(github.ref, '-') }}
 
       - name: Build and push
         uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6

README.md

@@ -43,23 +43,23 @@ Read [Known limitations](docs/known-limitations.md) before you deploy.
 
 ## 5-minute quickstart (Docker Compose)
 
-Requirements: Docker and Docker Compose. The stack is `langfuse-web`, `langfuse-worker`, `greptimedb`, `postgres`, and `redis`, with object storage off by default. Both schemas migrate automatically inside the container on startup.
+Requirements: Docker and Docker Compose. The quickest path is the single `openfuse-standalone` container — web + worker in one process — wired to Postgres, Redis, and GreptimeDB. Both schemas migrate automatically on startup; object storage is off by default.
 
 ```bash
 git clone https://github.com/tma1-ai/openfuse.git
 cd openfuse
-cp .env.quickstart.example .env   # working dev defaults — no edits needed
-docker compose up -d              # builds web/worker, starts the full stack
+cp .env.quickstart.example .env                        # working dev defaults — no edits needed
+docker compose -f docker-compose.standalone.yml up -d  # one app container + Postgres/Redis/GreptimeDB
 ```
 
-Open <http://localhost:3000>. The quickstart env auto-creates a demo project, so you can log in as `demo@example.com` / `langfuse-dev` or point any Langfuse SDK at the bundled keys (`pk-lf-1234567890` / `sk-lf-1234567890`) right away. Those values are insecure dev defaults — for a real deployment start from `.env.prod.example` and set your own secrets. Full guide: [deployment](docs/deployment.md).
+Open <http://localhost:3000>. The quickstart env auto-creates a demo project, so you can log in as `demo@example.com` / `langfuse-dev` or point any Langfuse SDK at the bundled keys (`pk-lf-1234567890` / `sk-lf-1234567890`) right away. Those values are insecure dev defaults — for a real deployment start from `.env.prod.example` and set your own secrets, including a GreptimeDB password (`GREPTIME_PASSWORD`) to turn on enforced auth on the analytics store. Full guide: [deployment](docs/deployment.md).
 
-### Single container (standalone)
+### Split web + worker
 
-For a single node, `tma1ai/openfuse-standalone` runs web + worker in one container (the GreptimeDB-standalone analogue):
+To scale web and worker independently, use the default `docker-compose.yml` (separate `langfuse-web` and `langfuse-worker` images) instead:
 
 ```bash
-docker compose -f docker-compose.standalone.yml up   # then open http://localhost:3000
+docker compose up -d   # builds web/worker, starts the full stack
 ```
 
 ## Published images

README.zh.md

@@ -43,23 +43,23 @@ LLM trace 本质就是可观测性数据：带高基数上下文的、带时间
 
 ## 5 分钟快速开始（Docker Compose）
 
-需要 Docker 和 Docker Compose。整套栈是 `langfuse-web`、`langfuse-worker`、`greptimedb`、`postgres`、`redis`，对象存储默认关闭。两套 schema 在容器启动时自动迁移。
+需要 Docker 和 Docker Compose。最快的方式是单个 `openfuse-standalone` 容器——web + worker 跑在一个进程里——再接上 Postgres、Redis、GreptimeDB。两套 schema 在启动时自动迁移，对象存储默认关闭。
 
 ```bash
 git clone https://github.com/tma1-ai/openfuse.git
 cd openfuse
-cp .env.quickstart.example .env   # working dev defaults — no edits needed
-docker compose up -d              # builds web/worker, starts the full stack
+cp .env.quickstart.example .env                        # working dev defaults — no edits needed
+docker compose -f docker-compose.standalone.yml up -d  # 一个 app 容器 + Postgres/Redis/GreptimeDB
 ```
 
-打开 <http://localhost:3000>。quickstart 的 env 会自动创建一个 demo project，所以你可以直接用 `demo@example.com` / `langfuse-dev` 登录，或者把任意 Langfuse SDK 指向内置的 key（`pk-lf-1234567890` / `sk-lf-1234567890`）。这些是不安全的 dev 默认值——正式部署请从 `.env.prod.example` 出发、自己生成 secret。完整指南见[部署文档](docs/deployment.md)。
+打开 <http://localhost:3000>。quickstart 的 env 会自动创建一个 demo project，所以你可以直接用 `demo@example.com` / `langfuse-dev` 登录，或者把任意 Langfuse SDK 指向内置的 key（`pk-lf-1234567890` / `sk-lf-1234567890`）。这些是不安全的 dev 默认值——正式部署请从 `.env.prod.example` 出发、自己生成 secret，并为分析存储设置 GreptimeDB 密码（`GREPTIME_PASSWORD`）以开启强制鉴权。完整指南见[部署文档](docs/deployment.md)。
 
-### 单容器（standalone）
+### 拆分 web + worker
 
-单节点部署用 `tma1ai/openfuse-standalone`，把 web + worker 跑在一个容器里（GreptimeDB standalone 的对应物）：
+要让 web 和 worker 独立扩缩，改用默认的 `docker-compose.yml`（`langfuse-web` 和 `langfuse-worker` 两个独立镜像）：
 
 ```bash
-docker compose -f docker-compose.standalone.yml up   # then open http://localhost:3000
+docker compose up -d   # builds web/worker, starts the full stack
 ```
 
 ## 已发布镜像

docker-compose.build.yml

@@ -40,8 +40,8 @@ services:
       GREPTIME_SQL_HOST: ${GREPTIME_SQL_HOST:-greptimedb}
       GREPTIME_SQL_PORT: ${GREPTIME_SQL_PORT:-4002}
       GREPTIME_DB: ${GREPTIME_DB:-openfuse}
-      GREPTIME_USER: ${GREPTIME_USER:-}
-      GREPTIME_PASSWORD: ${GREPTIME_PASSWORD:-}
+      GREPTIME_USER: ${GREPTIME_USER:-openfuse}
+      GREPTIME_PASSWORD: ${GREPTIME_PASSWORD:-} # CHANGEME (set to enforce GreptimeDB auth; required for any non-local deployment)
       # Object storage is OPTIONAL: media, the OTel ingestion carrier, and the eval observation blob
       # store default to a local-file backend (shared volumes below), so no MinIO is started. Enable
       # the optional `minio` service with `--profile s3` for S3-backed storage / batch exports.
@@ -115,17 +115,17 @@ services:
   greptimedb:
     # GreptimeDB analytics store (replaces ClickHouse). Standalone mode exposes HTTP (4000),
     # gRPC (4001, ingest SDK), MySQL wire (4002, read path + migrations), Postgres wire (4003).
+    # The entrypoint wrapper loads docker/greptimedb/config.toml as a tuning starting point and
+    # turns on enforced static auth when GREPTIME_PASSWORD is set (empty -> no auth).
     image: docker.io/greptime/greptimedb:v1.1.1
-    command:
-      - standalone
-      - start
-      - --http-addr=0.0.0.0:4000
-      - --rpc-bind-addr=0.0.0.0:4001
-      - --mysql-addr=0.0.0.0:4002
-      - --postgres-addr=0.0.0.0:4003
-      - --data-home=/greptimedb_data
+    entrypoint: ["/bin/sh", "/usr/local/bin/openfuse-greptime-entrypoint.sh"]
+    environment:
+      GREPTIME_USER: ${GREPTIME_USER:-openfuse}
+      GREPTIME_PASSWORD: ${GREPTIME_PASSWORD:-} # CHANGEME (set to enforce GreptimeDB auth; required for any non-local deployment)
     volumes:
       - langfuse_greptimedb_data:/greptimedb_data
+      - ./docker/greptimedb/config.toml:/etc/greptime/config.toml:ro
+      - ./docker/greptimedb/entrypoint.sh:/usr/local/bin/openfuse-greptime-entrypoint.sh:ro
     ports:
       - "4000:4000"
       - "4001:4001"

docker-compose.dev.yml

@@ -3,23 +3,24 @@ services:
     # GreptimeDB backend for the fork. Replaces ClickHouse as the analytics store; the read/write
     # paths and the test harness target this. Standalone mode exposes HTTP (4000), gRPC (4001,
     # ingest SDK), MySQL wire (4002, read pool + migrations), and Postgres wire (4003).
+    # The entrypoint wrapper loads docker/greptimedb/config.toml as a tuning starting point.
+    # Local dev leaves GREPTIME_PASSWORD empty, so auth stays off; set it to exercise
+    # enforced static auth locally.
     image: docker.io/greptime/greptimedb:v1.1.1
     container_name: ${GREPTIME_CONTAINER_NAME:-langfuse-greptimedb}
-    command:
-      - standalone
-      - start
-      - --http-addr=0.0.0.0:4000
-      - --rpc-bind-addr=0.0.0.0:4001
-      - --mysql-addr=0.0.0.0:4002
-      - --postgres-addr=0.0.0.0:4003
-      - --data-home=/greptimedb_data
+    entrypoint: ["/bin/sh", "/usr/local/bin/openfuse-greptime-entrypoint.sh"]
+    environment:
+      GREPTIME_USER: ${GREPTIME_USER:-openfuse}
+      GREPTIME_PASSWORD: ${GREPTIME_PASSWORD:-}
     ports:
       - ${HOST_IP:-127.0.0.1}:${GREPTIME_HTTP_PORT:-4000}:4000
       - ${HOST_IP:-127.0.0.1}:${GREPTIME_GRPC_PORT:-4001}:4001
       - ${HOST_IP:-127.0.0.1}:${GREPTIME_MYSQL_PORT:-4002}:4002
       - ${HOST_IP:-127.0.0.1}:${GREPTIME_PG_PORT:-4003}:4003
     volumes:
       - langfuse_greptimedb_data:/greptimedb_data
+      - ./docker/greptimedb/config.toml:/etc/greptime/config.toml:ro
+      - ./docker/greptimedb/entrypoint.sh:/usr/local/bin/openfuse-greptime-entrypoint.sh:ro
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:4000/health"]
       interval: 5s

docker-compose.standalone.yml

@@ -52,8 +52,8 @@ services:
       GREPTIME_SQL_HOST: ${GREPTIME_SQL_HOST:-greptimedb}
       GREPTIME_SQL_PORT: ${GREPTIME_SQL_PORT:-4002}
       GREPTIME_DB: ${GREPTIME_DB:-openfuse}
-      GREPTIME_USER: ${GREPTIME_USER:-}
-      GREPTIME_PASSWORD: ${GREPTIME_PASSWORD:-} # CHANGEME (set if GreptimeDB auth is enabled)
+      GREPTIME_USER: ${GREPTIME_USER:-openfuse}
+      GREPTIME_PASSWORD: ${GREPTIME_PASSWORD:-} # CHANGEME (set to enforce GreptimeDB auth; required for any non-local deployment)
       # --- redis ---
       REDIS_HOST: ${REDIS_HOST:-redis}
       REDIS_PORT: ${REDIS_PORT:-6379}
@@ -78,18 +78,18 @@ services:
   greptimedb:
     # GreptimeDB analytics store. Standalone mode exposes HTTP (4000), gRPC (4001, ingest SDK),
     # MySQL wire (4002, read path + migrations), Postgres wire (4003).
+    # The entrypoint wrapper loads docker/greptimedb/config.toml as a tuning starting point and
+    # turns on enforced static auth when GREPTIME_PASSWORD is set (empty -> no auth).
     image: docker.io/greptime/greptimedb:v1.1.1
     restart: always
-    command:
-      - standalone
-      - start
-      - --http-addr=0.0.0.0:4000
-      - --rpc-bind-addr=0.0.0.0:4001
-      - --mysql-addr=0.0.0.0:4002
-      - --postgres-addr=0.0.0.0:4003
-      - --data-home=/greptimedb_data
+    entrypoint: ["/bin/sh", "/usr/local/bin/openfuse-greptime-entrypoint.sh"]
+    environment:
+      GREPTIME_USER: ${GREPTIME_USER:-openfuse}
+      GREPTIME_PASSWORD: ${GREPTIME_PASSWORD:-} # CHANGEME (set to enforce GreptimeDB auth; required for any non-local deployment)
     volumes:
       - langfuse_greptimedb_data:/greptimedb_data
+      - ./docker/greptimedb/config.toml:/etc/greptime/config.toml:ro
+      - ./docker/greptimedb/entrypoint.sh:/usr/local/bin/openfuse-greptime-entrypoint.sh:ro
     ports:
       - 127.0.0.1:4000:4000
       - 127.0.0.1:4002:4002

docker-compose.yml

@@ -39,8 +39,8 @@ services:
       GREPTIME_SQL_HOST: ${GREPTIME_SQL_HOST:-greptimedb}
       GREPTIME_SQL_PORT: ${GREPTIME_SQL_PORT:-4002}
       GREPTIME_DB: ${GREPTIME_DB:-openfuse}
-      GREPTIME_USER: ${GREPTIME_USER:-}
-      GREPTIME_PASSWORD: ${GREPTIME_PASSWORD:-} # CHANGEME (set if GreptimeDB auth is enabled)
+      GREPTIME_USER: ${GREPTIME_USER:-openfuse}
+      GREPTIME_PASSWORD: ${GREPTIME_PASSWORD:-} # CHANGEME (set to enforce GreptimeDB auth; required for any non-local deployment)
       LANGFUSE_USE_AZURE_BLOB: ${LANGFUSE_USE_AZURE_BLOB:-false}
       LANGFUSE_USE_OCI_NATIVE_OBJECT_STORAGE: ${LANGFUSE_USE_OCI_NATIVE_OBJECT_STORAGE:-false}
       LANGFUSE_OCI_AUTH_TYPE: ${LANGFUSE_OCI_AUTH_TYPE:-workload_identity}
@@ -118,18 +118,18 @@ services:
   greptimedb:
     # GreptimeDB analytics store (replaces ClickHouse). Standalone mode exposes HTTP (4000),
     # gRPC (4001, ingest SDK), MySQL wire (4002, read path + migrations), Postgres wire (4003).
+    # The entrypoint wrapper loads docker/greptimedb/config.toml as a tuning starting point and
+    # turns on enforced static auth when GREPTIME_PASSWORD is set (empty -> no auth).
     image: docker.io/greptime/greptimedb:v1.1.1
     restart: always
-    command:
-      - standalone
-      - start
-      - --http-addr=0.0.0.0:4000
-      - --rpc-bind-addr=0.0.0.0:4001
-      - --mysql-addr=0.0.0.0:4002
-      - --postgres-addr=0.0.0.0:4003
-      - --data-home=/greptimedb_data
+    entrypoint: ["/bin/sh", "/usr/local/bin/openfuse-greptime-entrypoint.sh"]
+    environment:
+      GREPTIME_USER: ${GREPTIME_USER:-openfuse}
+      GREPTIME_PASSWORD: ${GREPTIME_PASSWORD:-} # CHANGEME (set to enforce GreptimeDB auth; required for any non-local deployment)
     volumes:
       - langfuse_greptimedb_data:/greptimedb_data
+      - ./docker/greptimedb/config.toml:/etc/greptime/config.toml:ro
+      - ./docker/greptimedb/entrypoint.sh:/usr/local/bin/openfuse-greptime-entrypoint.sh:ro
     ports:
       - 127.0.0.1:4000:4000
       - 127.0.0.1:4001:4001