Repository navigation
feat!: Appwrite 2.5.0, built-in object storage, Functions and Sites on by default - #21
Merged
Merged
Conversation
- appVersion 2.5.0, with the images its docker-compose.yml uses: console 1.2.74-self-hosted, executor 1.1.2, browser 0.3.6, geo 0.3.2. - files/env-defaults.yaml regenerated: _APP_TRUSTED_PROXIES, _APP_ALLOWED_INTERNAL_ADDRESSES and _APP_DNS_EXTERNAL are new, and node-22 joins the default function runtimes. make env-defaults crashed on 2.5.0, whose variables.php uses an Appwrite class for a default; the generator now loads such classes from the same Appwrite version, and the Makefile only replaces the file when generation succeeds. - The assistant is gone: Appwrite removed it in 2.4.0. Setting assistant.* fails with that message (templates/_deprecations.tpl), through a schema stub that hack/schema-postprocess.py now adds for deprecated keys. - The browser gets ALLOWED_HOSTS with the API Service's host: browser 0.3.5 and later refuse private addresses, which broke site screenshots. - The console no longer gets VITE_GROWTH_ENDPOINT, as in compose. - ClickHouse follows Appwrite 2.4.0: the per-second metric, trace and text logs are removed rather than sampled, and an init script gives tables left behind by a config change a TTL. - Docs: trusted proxies, requests to private addresses, the external DNS resolver under egress policies, the now-required GitHub webhook secret, and 2.5.0 wherever a version is named (claims checked against 2.5.0). - CI upgrades from 2.3.0, the Appwrite of chart 1.0.0.
storage.s3.mode picks where the bucket lives: builtin (the default) runs SeaweedFS, an Apache-2.0 S3-compatible store, in the release; external uses storage.s3.external.endpoint and .region, which move there from storage.s3.endpoint and .region (setting the old keys fails with where they went). The built-in store is a single-replica StatefulSet like the other built-in datastores: one `weed server` process with master, volume server and filer on loopback, serving only S3 on port 8333, as UID 1000 on a read-only root. Its users file is written from the chart's Secret on start, where the access keys are generated once like the other built-in credentials, and a postStart hook creates the bucket before the pod is ready. It only runs with storage.device s3. Appwrite, the orchestrator and the executor get its in-cluster endpoint through one helper (appwrite.s3); the build and executor policies allow it by pod selector, and with networkPolicy.enabled the object-storage policy lets only Appwrite pods, the orchestrator, build pods and the executor in. Renovate keeps SeaweedFS on its major version, as for the other datastores.
storage.device defaults to s3 on the built-in object storage, and compute.enabled and compute.executor.privileged default to true: a plain install builds and runs functions and sites, with the executor as a privileged pod in a namespace of its own. Clusters that forbid privileged pods set compute.enabled=false; the validation message and NOTES say so, and NOTES list SeaweedFS among the single-replica built-ins. - Examples that read S3 keys from your own Secrets (production, external-services, aws, gcp) or keep files on Azure Files turn compute off; functions.yaml and functions-existing-secrets.yaml turn it back on with executor nodes and Secrets of its own. - CI: every install scenario now runs compute and the built-in store; the upgrade scenario installs the published chart 1.0.0 and upgrades it with default values; the nightly installs full-values.yaml alone, so hack/compute-plane.sh and its SeaweedFS container are gone. - Docs: getting started, executor, storage, production checklist, troubleshooting (deployments fail with an internal error while compute is off), migrating from Docker (keep local storage explicitly), READMEs; the stale "before the first release" notes are gone. - CHANGELOG entries for the branch under [Unreleased].
🟢 Tier S · Ready to mergeThis PR updates the chart to Appwrite 2.5.0, removes the assistant, and adds built-in SeaweedFS object storage with revised defaults for Functions and Sites. It also updates storage and compute networking, ClickHouse configuration, generated environment defaults, and the migration and upgrade paths. Documentation, examples, CI scenarios, and tests are refreshed for the new chart behavior. Latest changes: The latest commit extends the StatefulSet-name length validation to built-in SeaweedFS and adds a test for the case where it is the only built-in store.
📂 Walkthrough · 13
✅ Fixed since the last review · 1
Reviewed the commits since |
![hansi-codes[bot]](https://avatars.githubusercontent.com/in/5046327?s=60&v=4){kind=small}
4 tasks done
The 52-character limit, which the pods' controller-revision-hash label needs, was only checked for the built-in PostgreSQL, Redis and ClickHouse. With those external and a long release name, the built-in object store could render a name its pods can't hold.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Three commits, for chart 2.0.0 (release in a separate pull request):
1. Appwrite 2.5.0 (13ed1d8)
docker-compose.ymluses: console1.2.74-self-hosted, executor1.1.2, browser0.3.6, geo0.3.2.files/env-defaults.yamlregenerated. New:_APP_TRUSTED_PROXIES,_APP_ALLOWED_INTERNAL_ADDRESSES,_APP_DNS_EXTERNAL.node-22joins the default runtimes.make env-defaultscrashed on 2.5.0, whosevariables.phpusesAppwrite\Network\TrustedProxies::DEFAULTfor a default. The generator now loads such classes from the same Appwrite version, PSR-4 style. The Makefile only replaces the file on success: before, PHP's error text ended up inenv-defaults.yaml. The upstream-drift workflow would have hit the same crash.assistant.*fails with that message, through_deprecations.tpland a schema stub thathack/schema-postprocess.pynow generates for deprecated keys.ALLOWED_HOSTSis set to the API Service's host. Browser 0.3.5+ refuses private addresses unless listed, which broke site screenshots.VITE_GROWTH_ENDPOINT, matching compose.V25).2. Built-in SeaweedFS object storage (24d5e2c)
storage.s3.mode: builtin | external, like the other datastores. External settings move tostorage.s3.external.endpointand.region. The old keys fail with where they went.weed serverwith master, volume server and filer on loopback. It serves only S3 on 8333, runs as UID 1000 on a read-only root, and keeps data on a 20Gi PVC.postStarthook creates the bucket before the pod is ready; "already exists" is fine.appwrite.s3). The executor reaches<fullname>-seaweedfs.<ns>.svcfrom inside DinD through the pod's resolver.networkPolicy.enabled, a newobject-storagepolicy admits only Appwrite pods, the orchestrator, build pods and the executor.3. Functions and Sites on by default (6c2262b)
storage.device: s3,compute.enabled: true,compute.executor.privileged: true. A plain install builds and runs functions and sites.compute.enabled=false. The NOTES and the validation message say so.Could not resolve host: orchestrator(a 500, then a 409 on retry). That's now documented in troubleshooting.hack/compute-plane.shis gone.localexplicitly), and the READMEs. CHANGELOG entries are under[Unreleased].Breaking (hence 2.0.0): the new defaults, the moved S3 keys, and the removed assistant. Upgrade notes go in the release PR.
Testing
make testpasses locally: 245/245 unit tests (10 new for object storage), ct lint,helm lint --stricton every scenario, kubeconform on 1.29–1.37, all 16 example combinations, generated files, changelog.actionlintandshellcheckare clean.make env-defaults APP_VERSION=2.5.0regenerates cleanly.