The script installs and exposes the database only; it now prints a generic
MongoDB connection string (mongodb://user:pass@ip:27017/) instead of a
LibreChat MONGO_URI with a hardcoded /LibreChat database. README 'Wiring
LibreChat' section replaced with a generic 'Connecting a client' section.
Application wiring is left to that app's own config or a separate script.
A plain CREATE ROLE ... PASSWORD stores PostgreSQL's native 16-byte SCRAM salt.
DocumentDB has no check_password_hook, so that salt is served verbatim to Mongo
clients, which reject it at SASL step2 with 'invalid salt length of 16'.
Provision the user through documentdb_api.create_user / update_user instead:
DocumentDB builds the SCRAM-SHA-256 verifier with documentdb.scramDefaultSaltLen
(28 bytes) via its own scram_build_secret. create_user only accepts a read-only
role or the clusterAdmin + readWriteAnyDatabase pair, so use the latter for R/W.
- CREATE EXTENSION documentdb now runs before user provisioning so the API
functions exist.
- Spec built with jq (password JSON-escaped) and passed in a $DDB$ dollar-quoted
SQL literal; idempotent via update_user when the role already exists.
- Set password_encryption = 'scram-sha-256' explicitly in postgresql.conf.
A fresh Debian template has not generated the Proxmox host locale that pct exec
forwards (e.g. fr_FR.UTF-8), so apt, perl and apt-listchanges warn on every run.
Export LC_ALL=C.UTF-8 / LANG=C.UTF-8 globally and forward them through pct exec
(base tooling, the piped installer, and the host-side upgrade).
- detect_latest_debian_template now selects the newest debian-12 template only.
Auto-detecting the newest Debian overall picked debian-13, which would pair the
deb12-only DocumentDB extension with a mismatched libicu. Trixie now requires
setting TEMPLATE + DOCUMENTDB_DISTRO explicitly.
- Add preflight_script_url: verify SCRIPT_URL is reachable on the host before
creating the LXC, so a branch/path that 404s fails immediately with guidance
instead of dying mid-install after the container is built.
