feat/lxc-ferretdb #9

Damien · 2026-05-29T10:30:30Z

Damien commented

2026-05-29 10:30:30 +00:00

No description provided.

Damien added 5 commits 2026-05-29 10:30:30 +00:00

Update README with FerretDB installation script and requirements e120d179e3

Add FerretDB script to available scripts table
Update requirements to include FerretDB

fix(ferretdb): pin template to debian-12 and fail fast on bad SCRIPT_URL 5caf885d83

- detect_latest_debian_template now selects the newest debian-12 template only.
  Auto-detecting the newest Debian overall picked debian-13, which would pair the
  deb12-only DocumentDB extension with a mismatched libicu. Trixie now requires
  setting TEMPLATE + DOCUMENTDB_DISTRO explicitly.
- Add preflight_script_url: verify SCRIPT_URL is reachable on the host before
  creating the LXC, so a branch/path that 404s fails immediately with guidance
  instead of dying mid-install after the container is built.

fix(ferretdb): force C.UTF-8 locale to silence apt/perl locale warnings f13af26a62

A fresh Debian template has not generated the Proxmox host locale that pct exec
forwards (e.g. fr_FR.UTF-8), so apt, perl and apt-listchanges warn on every run.
Export LC_ALL=C.UTF-8 / LANG=C.UTF-8 globally and forward them through pct exec
(base tooling, the piped installer, and the host-side upgrade).

fix(ferretdb): create the Mongo user via DocumentDB to fix SCRAM salt length d10efadaba

A plain CREATE ROLE ... PASSWORD stores PostgreSQL's native 16-byte SCRAM salt.
DocumentDB has no check_password_hook, so that salt is served verbatim to Mongo
clients, which reject it at SASL step2 with 'invalid salt length of 16'.

Provision the user through documentdb_api.create_user / update_user instead:
DocumentDB builds the SCRAM-SHA-256 verifier with documentdb.scramDefaultSaltLen
(28 bytes) via its own scram_build_secret. create_user only accepts a read-only
role or the clusterAdmin + readWriteAnyDatabase pair, so use the latter for R/W.

- CREATE EXTENSION documentdb now runs before user provisioning so the API
  functions exist.
- Spec built with jq (password JSON-escaped) and passed in a $DDB$ dollar-quoted
  SQL literal; idempotent via update_user when the role already exists.
- Set password_encryption = 'scram-sha-256' explicitly in postgresql.conf.

refactor(ferretdb): keep the install agnostic, drop LibreChat-specific wiring 671dd91530

The script installs and exposes the database only; it now prints a generic
MongoDB connection string (mongodb://user:pass@ip:27017/) instead of a
LibreChat MONGO_URI with a hardcoded /LibreChat database. README 'Wiring
LibreChat' section replaced with a generic 'Connecting a client' section.
Application wiring is left to that app's own config or a separate script.

Damien merged commit 4df3ba57a4 into main

2026-05-29 10:30:41 +00:00

Damien deleted branch feat/lxc-ferretdb

2026-05-29 10:30:41 +00:00

Damien referenced this issue from a commit

2026-05-29 10:30:43 +00:00

Merge pull request 'feat/lxc-ferretdb' (#9) from feat/lxc-ferretdb into main

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Damien/infra-scripts#9