feat(greptime): default standalone server config + opt-in enforced static auth - #50
Merged
Merged
Conversation
…on stable only
- Bump worker and shared VERSION.ts to v1.0.0-alpha.1 so all three VERSION
constants (web/worker/shared) match the package.json version; web was already
bumped, the other two lagged at the upstream v3.184.1.
- release-images.yml: exclude every SemVer pre-release (-alpha/-beta/-rc), not
just -rc, from the floating major/major.minor tags and `latest`. A pre-release
now publishes only the exact {{version}} and commit-sha tags.
…static auth Ship a small GreptimeDB server config and wire optional static-user auth so the analytics store can be secured like Postgres/Redis, while local dev/quickstart stay frictionless. - docker/greptimedb/config.toml: GreptimeDB defaults plus commented tuning hints (caches stay "Auto", sized from machine memory), mounted read-only via --config-file. - docker/greptimedb/entrypoint.sh: when GREPTIME_PASSWORD is set, write a username=plain:password credentials file (mode 600, CR/LF and '=' rejected, username constrained) and start with --user-provider=static_user_provider:file; empty password keeps the node unauthenticated. - Default GREPTIME_USER to "openfuse" across env schema, migration runner, and MySQL fallbacks so app and server agree; gRPC auth is sent only as configured. - Wire all four Compose files to the entrypoint + config; .env.prod.example sets GREPTIME_USER/GREPTIME_PASSWORD (CHANGEME); quickstart/dev stay no-auth. - Lead the README quickstart with the single standalone container; document auth and the server config in deployment.md / operations.md.
Repo-wide `pnpm run format` pass so the whole-tree pre-commit format:check passes. Touches only files that were already non-conformant on main; no behavioral change.
There was a problem hiding this comment.
Pull request overview
This PR improves the GreptimeDB self-hosting experience by shipping a default standalone server config and an opt-in, enforced static-auth mechanism (activated via GREPTIME_PASSWORD), while aligning defaults/docs and updating image release tagging behavior for pre-releases.
Changes:
- Add
docker/greptimedb/config.tomland a GreptimeDB entrypoint that enables static-user auth only whenGREPTIME_PASSWORDis set; wire this into all Compose variants. - Standardize Greptime defaults across app + migration tooling (default user
openfuse) and update docs/README quickstart guidance accordingly. - Update release workflow tagging to avoid moving
latest/ floating tags for any SemVer pre-release, plus bump worker/shared version constants tov1.0.0-alpha.1.
Reviewed changes
Copilot reviewed 40 out of 40 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| worker/src/utils/ingestionReadSkipCache.ts | Formatting-only change to project ID skip list check. |
| worker/src/features/evaluation/observationEval/tests/observationEvalProcessor.test.ts | Formatting-only change in test constant string layout. |
| worker/src/env.ts | Default GREPTIME_USER to openfuse and apply formatting. |
| worker/src/constants/VERSION.ts | Bump worker version constant to v1.0.0-alpha.1. |
| web/src/server/api/trpc.ts | Formatting-only change in error shape serialization. |
| web/src/server/api/routers/traces.ts | Formatting-only change around date conversion for Greptime queries. |
| web/src/pages/api/public/traces/index.ts | Formatting-only change to middleware options object. |
| web/src/pages/api/public/traces/[traceId].ts | Formatting-only change to middleware options object. |
| web/src/pages/api/public/observations/index.ts | Formatting-only change to middleware options object. |
| web/src/pages/api/public/observations/[observationId].ts | Formatting-only change to middleware options object. |
| web/src/pages/api/public/metrics/index.ts | Formatting-only change to middleware options object. |
| web/src/tests/server/withMiddlewares.servertest.ts | Formatting-only changes in DbResourceError test setup. |
| web/src/tests/server/unit/localMediaUpload.servertest.ts | Formatting-only change in request builder call. |
| scripts/greptime-migrate.mjs | Align Greptime migration default user to openfuse and update comment. |
| README.zh.md | Update quickstart to lead with standalone Compose and mention Greptime auth model. |
| README.md | Update quickstart to lead with standalone Compose and mention Greptime auth model. |
| packages/shared/src/server/repositories/observations_converters.ts | Formatting-only changes in converters. |
| packages/shared/src/server/repositories/dataset-run-items-converters.ts | Formatting-only change in datetime parsing call. |
| packages/shared/src/server/greptime/client.ts | Change MySQL-wire default user fallback from root to openfuse. |
| packages/shared/src/server/greptime/applyMigrations.ts | Change migration connection fallback user from root to openfuse. |
| packages/shared/src/features/query/server/greptimeQueryExecutor.ts | Formatting-only changes in query execution helpers. |
| packages/shared/src/env.ts | Default GREPTIME_USER to openfuse and document auth/config behavior. |
| packages/shared/src/constants/VERSION.ts | Bump shared version constant to v1.0.0-alpha.1. |
| docs/operations.md | Document shipped Greptime server config and opt-in static auth. |
| docs/greptimedb-migration/parity/harness/reads.ts | Formatting-only changes in parity harness read case generation. |
| docs/greptimedb-migration/parity/harness/payloads.ts | Formatting-only changes in parity harness payload construction. |
| docs/greptimedb-migration/parity/harness/metricsMatrix.ts | Formatting-only changes in metrics matrix generation. |
| docs/greptimedb-migration/parity/harness/lib.ts | Formatting-only changes and minor line wrapping in harness utilities. |
| docs/greptimedb-migration/07-deployment.md | Update Greptime env defaults and describe password-driven auth enforcement. |
| docs/deployment.md | Document Greptime authentication model + config file and update release tag semantics. |
| docker/greptimedb/entrypoint.sh | New entrypoint to optionally enable enforced static-user auth and pass config file. |
| docker/greptimedb/config.toml | New default GreptimeDB config with commented tuning guidance. |
| docker-compose.yml | Wire Greptime entrypoint/config; standardize GREPTIME_USER default to openfuse. |
| docker-compose.standalone.yml | Wire Greptime entrypoint/config; standardize GREPTIME_USER default to openfuse. |
| docker-compose.dev.yml | Wire Greptime entrypoint/config; allow local opt-in auth via GREPTIME_PASSWORD. |
| docker-compose.build.yml | Wire Greptime entrypoint/config; standardize GREPTIME_USER default to openfuse. |
| .github/workflows/release-images.yml | Prevent floating tags and latest for any pre-release tag (not just -rc). |
| .env.quickstart.example | Document Greptime auth OFF-by-default behavior in quickstart env. |
| .env.prod.example | Provide GREPTIME_USER default + GREPTIME_PASSWORD placeholder and explain enforcement. |
| .env.dev.example | Align Greptime dev example defaults with openfuse user and empty-password no-auth. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…E_USER GREPTIME_USER now defaults to "openfuse" (always truthy), so the previous `if (env.GREPTIME_USER)` gate made the ingester always send a Basic Auth header even with no password — i.e. against a node where auth is meant to be off. Gate on GREPTIME_PASSWORD instead so an unauthenticated node stays header-free, and auth is sent only when a password is configured (matching the entrypoint). Caught in PR review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Give the GreptimeDB analytics store a sensible default server config and make it securable like Postgres/Redis, without adding friction to local dev/quickstart.
GreptimeDB server config
docker/greptimedb/config.toml, mounted read-only and passed via--config-file. Keeps GreptimeDB's defaults and carries commented performance-tuning hints (caches/write buffers stayAuto, sized from machine memory — right for a single node).Opt-in enforced static auth
docker/greptimedb/entrypoint.sh. WhenGREPTIME_PASSWORDis set, it writes ausername=plain:passwordcredentials file (mode600; rejects CR/LF and=; constrains the username) and starts GreptimeDB with--user-provider=static_user_provider:file:…, so the password is actually enforced. Empty password → unauthenticated node (dev/quickstart stay frictionless).GREPTIME_USERisopenfuseacross the env schema (web/worker), the migration runner, and the MySQL fallbacks, so app and server agree. A node with no user-provider ignores credentials, so the default stays frictionless until a deployment sets a password..env.prod.examplesetsGREPTIME_USER/GREPTIME_PASSWORD(CHANGEME); quickstart/dev stay no-auth.Docs
deployment.md/operations.mddocument the auth model and the server config;07-deployment.mdupdated to current defaults.Release/version (separate commit)
workerandsharedVERSION.tstov1.0.0-alpha.1(web was already bumped).release-images.yml: exclude every SemVer pre-release (-alpha/-beta/-rc), not just-rc, from the floatingmajor/major.minortags andlatest.Formatting (separate commit)
prettierpass over files that were already non-conformant onmain(no behavioral change), so the whole-tree pre-commit format check passes.Verification
greptime/greptimedb:v1.1.1via--config-file; entrypoint resolves the binary and/bin/sh.openfuseagainst a no-auth node — all pass.plain:format): credentials file is-rw-------; MySQL rejects an empty password and accepts the correct one; gRPC write/read pass.=in password all rejected.pnpm tc, shared+worker lint, shellcheck, anddocker compose config -qfor all four compose files pass.