mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-11-02 18:17:11 +09:00
Juan DenisandClaude Opus 5
5927e44487
The engine templates were written from upstream docs and reviewed carefully, but
only ever read. Every one has now been brought up for real, authenticated
against, and torn down.
CouchDB was broken. A fresh node never created its system databases: `/_all_dbs`
answered `[]`, `_users` did not exist so no non-admin account could ever be
created, and it error-looped on "Missing system database _users". The image
reads only COUCHDB_USER/PASSWORD/SECRET/ERLANG_COOKIE — both
COUCHDB_COUCHDB__SINGLE_NODE and ERL_FLAGS are rejected as unknown_config_value
— so `single_node = true` ships as a local.d config file instead.
Meilisearch and Valkey advertised versions they do not install (1.0 vs the 1.12
that boots; 8.0 vs 8.1.9), caught by comparing the catalog header against what
actually reported for itself.
The method mattered more than the count. Probing auth from INSIDE the container
is not a test and would have passed two engines that were never checked:
postgres initdb writes `host all all 127.0.0.1/32 trust`, so a deliberately
wrong password succeeds on loopback, and the ClickHouse client reads
CLICKHOUSE_PASSWORD out of the container's own environment. Re-run from a remote
source address, both correctly refuse. Every auth assertion here was made from
off-host.
Nine tests cover what can be checked without Docker, led by the one that matters
most: the generated admin password must actually REACH the image. Mongo,
ClickHouse and CouchDB all start happily with authentication disabled when the
password is generated but never passed — silent, and indistinguishable from
working. Also: every ${VAR} resolves, no port binds all interfaces, the catalog
port matches the published one, the declared version is the tag installed, and a
config file can never be rendered over the data volume's mount point (which
would delete persistence without a word).
Verified by reverting each fix and confirming the tests fail with the right
message, then restoring. 67 passed.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
74 lines
1.7 KiB
YAML
74 lines
1.7 KiB
YAML
id: valkey
|
|
name: Valkey
|
|
version: "8"
|
|
description: Redis-compatible fork stewarded by the Linux Foundation -- a drop-in for cache workloads
|
|
icon: https://serverkit.ai/imgs/template-icons/valkey.svg
|
|
categories:
|
|
- database
|
|
- cache
|
|
website: https://valkey.io
|
|
documentation: https://valkey.io/docs/
|
|
|
|
engine:
|
|
family: Key-value
|
|
protocol: redis
|
|
default_port: 6380
|
|
admin_user: default
|
|
admin_password_var: DB_PASSWORD
|
|
port_var: PORT
|
|
bind_var: BIND_ADDRESS
|
|
unit: keys
|
|
client: valkey-cli
|
|
data_path: /data
|
|
version_var: IMAGE_TAG
|
|
versions:
|
|
- "8"
|
|
- "7.2"
|
|
|
|
variables:
|
|
- name: IMAGE_TAG
|
|
type: string
|
|
default: "8"
|
|
hidden: true
|
|
description: Image tag; constrained to engine.versions by the installer
|
|
- name: PORT
|
|
type: port
|
|
# Sits beside a Redis on 6379.
|
|
default: "6380"
|
|
hidden: false
|
|
description: Host port to publish Valkey on
|
|
- name: BIND_ADDRESS
|
|
type: string
|
|
default: 127.0.0.1
|
|
hidden: true
|
|
description: Address the port binds to. 127.0.0.1 keeps the engine private.
|
|
- name: DB_PASSWORD
|
|
type: password
|
|
length: 28
|
|
description: Password required by AUTH (requirepass)
|
|
|
|
compose:
|
|
services:
|
|
app:
|
|
image: valkey/valkey:${IMAGE_TAG}-alpine
|
|
container_name: ${APP_NAME}
|
|
restart: unless-stopped
|
|
ports:
|
|
- "${BIND_ADDRESS}:${PORT}:6379"
|
|
# Same as Redis: no password env var, auth goes on the command line.
|
|
command: valkey-server --requirepass "${DB_PASSWORD}" --appendonly yes
|
|
volumes:
|
|
- valkey-data:/data
|
|
|
|
volumes:
|
|
valkey-data:
|
|
|
|
ports:
|
|
- port: "${PORT}"
|
|
protocol: redis
|
|
description: RESP protocol
|
|
|
|
requirements:
|
|
memory: 256MB
|
|
storage: 1GB
|